Complete Electra's post-change Secure Boot recovery archive #42

New issue

Open

opened 2026-07-01 19:37:37 +01:00 by nimmo · 0 comments

nimmo commented

2026-07-01 19:37:37 +01:00

Owner

Context

Electra's Secure Boot and TPM hardening is deployed and recovery-tested. The only remaining operational handoff is to create a final post-change archive so the off-host recovery material matches the validated configuration.

Scope

Capture current bootctl, sbctl, systemd-pcrlock, signature, and LUKS-token status.
Create the post-change encrypted recovery archives, including the required Secure Boot and LUKS recovery material.
Restore and inspect the new archives in a temporary test location.
Store the verified archives off-host and record where they are held without committing sensitive details.

Completion criteria

Current status captures and encrypted archives exist off-host.
A restore test confirms the archives are readable and complete.
The Secure Boot recovery playbook reflects the final archive contents and verification date.

## Context Electra's Secure Boot and TPM hardening is deployed and recovery-tested. The only remaining operational handoff is to create a final post-change archive so the off-host recovery material matches the validated configuration. ## Scope - Capture current `bootctl`, `sbctl`, systemd-pcrlock, signature, and LUKS-token status. - Create the post-change encrypted recovery archives, including the required Secure Boot and LUKS recovery material. - Restore and inspect the new archives in a temporary test location. - Store the verified archives off-host and record where they are held without committing sensitive details. ## Completion criteria - Current status captures and encrypted archives exist off-host. - A restore test confirms the archives are readable and complete. - The Secure Boot recovery playbook reflects the final archive contents and verification date.

nimmo added this to the Security Hardening milestone

2026-07-01 19:37:37 +01:00

nimmo added the

host:electra

project:security-hardening

labels

2026-07-01 19:37:37 +01:00

nimmo referenced this issue

2026-09-12 23:36:55 +01:00

[Wiki 4/5] Rebuild operational runbooks and the engineering handbook #222