Tyler Cipriani: Notes

Coreboot on the ThinkPad X220 with a Raspberry Pi

2019-02-21T20:59:13Z

My work laptop is terrible. About a year and a half ago, when I started my current gig, I received an Asus Zenbook that has been the bane of my existence ever since. First, it is impossible to work outside on this shiny monstrosity: all you see is your own dumb face squinting back at you, slightly obscured by very noticeable fingerprints from its mirror-like screen. Why are there fingerprints on the screen? Because, oh yeah, it’s a terrible touchscreen for no real reason. While the keyboard is serviceable, it is far from being a joy to use. There are no physical mouse buttons which, on a Linux install, means I’m forever flailing, trying to get middle-click paste to work (LPT: I setup an xdotool shortcut to paste – doesn’t work in Emacs though…). The Asus has also succumb to the Apple-esque use of dongles to replace all necessary ports (like Ethernet, FFS).

The final straw for this ridiculous machine was, for a reason that is beyond me, UEFI occasionally loses track of the boot drives and (although you can still see(!) the .efi file on disk via the UEFI interface) it won’t let you add it as a boot drive until you’ve sweated enough and/or there is a sufficiently powerful cosmic ray to flip the bits necessary to allow you to continue your life. This problem pretty much killed my productivity at my last offsite – as a result I decided to drop $500 and get a refurb ThinkPad X220 with more RAM and a bigger SSD than the ($1800) Zenbook.

X-Series ThinkPads are niiiiice ¶

I have been using a ThinkPad X230t for the past 3 years, and, although the tablet is a little bulky, it has been everything I need in a work laptop – matte screen, physical buttons for all the things, an Ethernet port – it’s basically not an unbelievably stupid laptop design (which is the bar now, evidently). The X220 I purchased for work is even better – it’s slightly smaller (since it’s not also a Wacom tablet), plus the X220 has a nice keyboard – which – holy shit! – remember when anyone actually cared about laptop keyboards‽

I am become hacker, destroyer of laptops ¶

One of the other reasons for buying the X220 is that I’ve heard-tell (A.K.A, did a quick DDG search) that it supports Coreboot (although, sadly, not Libreboot, yet). The actual incantations for flashing the ROM on the X220 are spread over a few sources, with some sizable gaps in process.

I spent the past 2 days pretty lost, flailing in the dark, booting my freshly flashed laptop to a momentary flicker of the green power-light, no fans, nothing, sighing, and compiling again. Now I stand victorious, Debian stable (8.6 as of November 2016) is booting from SeaBIOS.

I kept a lot of notes on the process. Hopefully, these notes save someone some frustration, or make this process a tiny bit more approachable.

Caveat Emptor – I’m terrible at hardware stuff and writing, so follow these steps at your own peril!

Things you need ¶

Lonovo ThinkPad X220
USB to TTY Serial Cable
Raspberry Pi 3 Model B
Pomona SOIC8 5250 Test Clip
8x Female Jumper Wire
An HDMI monitor and external keyboard (possibly, you may be able to figure out how to do this without one)
Another computer that will act as your Raspberry Pi terminal via the USB to TTY serial cable (is what I did anyway)

What the whole flashing setup looked like for me X230 -> USB-to-TTY -> Raspberry Pi -> Pomona Clip -> X220

ThinkPad X220 Disassembly ¶

Remove Keyboard and palmrest (follow Lonovo’s Guide)

Power down and remove battery
I removed the keyboard and palm rest in 2 separate steps.
Flip over and remove the 7 screws holding the keyboard and palmrest in place (they all have a picture of a square with 3 buttons [trackpad, I guess] near them).
WARNING – 2 of these screws are different sizes than the other 5! The ones closest to the front-edge of the laptop are shorter, keep them seperate.
Locations Diagram:

    Bottom of the ThinkPad -- 'X' marks screws to be removed
   +-----------------------------------------------------------+
   |   xxxxxxxxxxxx Battery xxxxxxxxxxxxxxxxxxxxxxxxx          |
   |   xxxxxxxxxxxxx Area xxxxxxxxxxxxxxxxxxxxxxxxxxx          |
   |                                                           |
   |                                                           |
   |                                                           |
   |              +----X----------------+                      |
   |              |                     |                      |
   |              |      Memory         |                      |
   |              |       Door          |                      |
   |   X          |        X            |             X        |
   |      X       +---------------------+                      |
   |                  X               X                        |
   +-----------------------------------------------------------+

Flip it over, push the keyboard back, pull up the tabs near the palmrest.
Rest the removed keyboard on the palmrest and remove ribbon cable from the motherboard.
Flip palmrest up, and click the ribbon cable holding it in place, remove it.
Lift tape on the left side of motherboard covering the chip you’re looking for.
The BIOS chip you are looking for is right there – the left-front of the motherboard if the screen is facing you.

Pomona 5250 attached to BIOS clip on ThinkPad X220

Setup Your Pi as a Flasher ¶

Now that you have access to the BIOS chip, you should setup your Raspberry Pi, and attach it to the Pomona 5250 clip via the SPI pins. Unfortunately, you do seem to need a monitor with HDMI to setup the Pi (someone better at Raspberry Pi things may know better).

After the initial setup I was able to switch to using a serial cable interface.

GIANT HUGE WARNING OF DOOM: Hook your Pomona clip to your motherboard ONLY WITH THE BATTERY REMOVED, THE X220 UNPLUGGED, AAAANNDDD THE RASPBERRY PI OFF!!!! You could probably fry this chip. I don’t actually know, but I was paranoid about it throughout the process. Power on the Raspberry Pi only when you’re certain the Pomona clip is secure.

Download the Raspbian Lite torrent

Unzip the rasbian zip file and copy to an sd card

dd bs=4M if=rasbian-lite.img of=/dev/<partition of sd card>

Hook up your Raspberry Pi to a monitor and boot
Change password using passwd (default user/pass: pi/raspberry)

Setup wifi by editing /etc/wpa_supplicant/wpa_supplicant.conf

network={
    ssid="YOUR_SSID"
    psk="YOUR_PASSWORD"
}

Edit /boot/config.txt
```
dtparam=spi=on
enable_uart=1
```

Now you can reboot and hook to a serial cable:

Serial cable hookup diagram:

   Edge of pi (furthest from you)
 L    PWR       GND  TXD  RXD
 E      |         |    |    |
 F +----v---------v----v----v-------------------------------------------------------------------------------+
 T |    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    |
   |    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    |
 E +--------------------------------------------------------------------------------------------------------+
 D
 G
 E
   Body of Pi (closest to you)

Install all the pre-req software working mostly from github wiki page Hardware Flashing with Raspberry Pi

sudo apt-get update && sudo apt-get dist-upgrade && sudo reboot
sudo apt-get update && sudo apt-get install libftdi1 libftdi-dev libusb-dev libpci-dev subversion
sudo apt-get install build-essential pciutils usbutils libpci-dev libusb-dev libftdi1 libftdi-dev zlib1g-dev subversion
svn co svn://flashrom.org/flashrom/trunk flashrom
cd flashrom
make
sudo make install

Add the SPI kernal modules to /etc/modules so they persist between boots.

sudo modprobe spi_bcm2835
sudo modprobe spidev

Power down the Pi, Hook your Pi to your Pomona clip, then hook the Pomona clip to the motherboard, and power back up.

Raspberry Pi 3 attached to ThinkPad X220 Pomona Clip

X220 BIOS Chip pinout

 Screen (furthest from you)
             __
  MOSI  5 --|  |-- 4  GND
   CLK  6 --|  |-- 3  N/C
   N/C  7 --|  |-- 2  MISO
   VCC  8 --|__|-- 1  CS

   Edge (closest to you)

PI Pinout

WARNING!!! This is the pinout for the RASPBERRY PI 3 MODEL B V1.2 it has 40 pins rather than 26

   Edge of pi (furthest from you)
 L                                                             CS
 E                                                             |
 F +--------------------------------------------------------------------------------------------------------+
 T |    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    |
   |    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    |
 E +--------------------------------------------^----^----^----^---------------------------------------^----+
 D                                              |    |    |    |                                       |
 G                                             3.3V  MOSI MISO |                                      GND
 E                                           (VCC)            CLK
   Body of Pi (closest to you)

See if flashrom can detect your chipset (if you see No EEPROM/flash device found. double check your connections and the pins for your pi – I realized I had my pins setup as if I were on the 26-GPIO pin Raspberry Pi rather than the 40-GPIO pin model 3)

NOTE: 2018-04-06

One person emailed to indicate that the flashrom commands below required setting an spispeed, i.e., sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512
```
pi@raspberrypi:~$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0
flashrom v0.9.9-r1954 on Linux 4.4.26-v7+ (armv7l)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
Found Winbond flash chip "W25Q64.V" (8192 kB, SPI) on linux_spi.
No operations were specified.
```
Read your flashchip and verify that the md5sums match. If the md5sums of your reads don’t match repeat steps 9 and 10 until they do. If they never do, check your wiring with a multimeter (I had to do this at one point).
```
pi@raspberrypi:~$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -r flash01.bin
pi@raspberrypi:~$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -r flash02.bin
pi@raspberrypi:~$ md5sum flash01.bin flash02.bin
```
Download coreboot on the Pi. Compile and use ifdtool to extract all the needed bits to all the right places in the coreboot blobs directory.
```
git clone http://review.coreboot.org/coreboot.git ~/coreboot
cd ~/coreboot
git submodule update --init --recursive
cd ~/coreboot/util/ifdtool
make
sudo make install
cd ~
ifdtool -x ~/flash01.bin
mkdir -p ~/coreboot/3rdparty/blobs/mainboard/lenovo/x220
cd ~/coreboot/3rdparty/blobs/mainboard/lenovo/x220
mv ~/flashregion_0_flashdescriptor.bin descriptor.bin
mv ~/flashregion_2_intel_me.bin me.bin
mv ~/flashregion_3_gbe.bin gbe.bin
```
NOTE: 2017-06-15

Thomas Maulbeck emailed me and mentioned that git submodule update --init --recursive did not populate the 3rdparty/blobs directory. It seems that .gitmodules for coreboot has several urls that look in the parent directory for bare git repositories that don’t exist in the setup I’ve described in this post.

Maulbeck was able to work around compilation errors by cloning 3rdparty/blobs directly:
```
cd ~/coreboot/3rdparty
git clone http://review.coreboot.org/p/blobs.git
```
If compilation fails with some mention of a missing 3rdparty/blobs/cpu/intel/model_206ax/microcode.bin this may be the root cause.

Build coreboot on the Pi following the wiki instructions

configure via (note – this is completely cargo-culted bullshit and YMMV…a lot) make nconfig

general
    - [*] Compress ramstage with LZMA
    - [*] Include coreboot .config file into the ROM image
    - [*] Allow use of binary-only repository
mainboard
    -  Mainboard vendor (Lenovo)
    -  Mainboard model (ThinkPad X220)
    -  ROM chip size (8192 KB (8 MB))
    -  (0x100000) Size of CBFS filesystem in ROM
chipset
    - [*] Enable VMX for virtualization
    -  Include CPU microcode in CBFS (Generate from tree)
    -  Flash ROM locking on S3 resume (Don't lock ROM sections on S3 resume)
    - [*] Add Intel descriptor.bin file
      (3rdparty/blobs/mainboard/$(MAINBOARDDIR)/descriptor.bin) Path and filename of the descriptor.bin file
    - [*] Add Intel ME/TXE firmware
      (3rdparty/blobs/mainboard/$(MAINBOARDDIR)/me.bin) Path to management engine firmware
    - [*] Add gigabit ethernet firmware
      (3rdparty/blobs/mainboard/$(MAINBOARDDIR)/gbe.bin) Path to gigabit ethernet firmware
devices
    - [*] Use native graphics initialization
display
    - (nothing checked)
generic drivers
    - [*] Support Intel PCI-e WiFi adapters
    - [*] PS/2 keyboard init
console
    - [*] Squelch AP CPUs from early console.
      [*] Show POST codes on the debug console
system tables
    - [*] Generate SMBIOS tables
payload
    - Add a payload (SeaBIOS)
    - SeaBIOS version (master)
    - (3000) PS/2 keyboard controller initialization timeout (milliseconds)
    - [*] Harware init during option ROM execution
    - [*] Include generated option rom that implements legacy VGA BIOS compatibility
    - [*] Use LZMA compression for payloads
debugging
    - (nothing checked)

NOTE: 2018-04-06

One person emailed to mention that make nconfig may require a number of dependencies, see the coreboot wiki for a complete list. As of this writing that list reads: apt-get install git build-essential gnat flex bison libncurses5-dev wget zlib1g-dev

Compile coreboot!

make crossgcc-i386 CPUS=4
make iasl
make

EDIT – 2016-11-27 Andreas Sinninger pointed out I was missing the path to the Intel ME/TXE firmware – corrected.

FINALLY! Flash your new coreboot.rom to your rom chip:

pi@raspberrypi:~$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -r flash01.bin
pi@raspberrypi:~$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -r flash02.bin
pi@raspberrypi:~$ md5sum flash01.bin flash02.bin  # if these don't match, stop, turn off the pi, fiddle with the Pomona clip, repeat this step
pi@raspberrypi:~$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -w ~/coreboot/build/coreboot.rom

If your laptop boots up to a SeaBIOS screen at this point: you win! If not, don’t despair, you can flash flash01.bin to go back to your old BIOS, or, better yet, keep compiling until it works.

Resources ¶

These are some general resources without which my X220 would be a pathetic pile of smashed up silicon by now.

GPG Security things

2017-02-14T15:11:05Z

Revocation Cert ¶

Needed to revoke your key should the master signing/certifying key ever be compromised

gpg --output \<tyler@tylercipriani.com\>.gpg-revocation-certificate --gen-revoke tyler@tylercipriani.com
lpr \<tyler@tylercipriani.com\>.gpg-revocation-certificate
shred --remove \<tyler@tylercipriani.com\>.gpg-revocation-certificate

store printed revocation cert in file or safe-deposit box

Key backup ¶

Paperkey

Download paperkey and its gpg signature

wget -c http://www.jabberwocky.com/software/paperkey/paperkey-1.3.tar.gz
wget -c http://www.jabberwocky.com/software/paperkey/paperkey-1.3.tar.gz.sig

Get David Shaw's public key (0x99242560) from your keyserver of choice

gpg --search-keys 'dshaw@jabberwocky.com'

Verify you have downloaded the right paper key and that the level of trust is sufficient for your purposes

gpg --verify Downloads/paperkey-1.3.tar.gz.sig paperkey-1.3.tar.gz
gpg: Signature made Thu 03 Jan 2013 09:18:32 PM MST using RSA key ID FEA78A7AA1BC4FA4
gpg: Good signature from "David M. Shaw <dshaw@jabberwocky.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 7D92 FD31 3AB6 F373 4CC5  9CA1 DB69 8D71 9924 2560
     Subkey fingerprint: A154 3829 812C 9EA9 87F1  4526 FEA7 8A7A A1BC 4FA4

If you have a good signature from davidExtract and install

tar xvzf paperkey-1.3.tar.gz
rm paperkey-1.3.tar.gz
cd paperkey-1.3
./configure
make
sudo make install

Print you secret key

gpg --export-secret-key tyler@tylercipriani.com | paperkey | lpr

Store it in your file or safe-deposit-box

Subkeys ¶

Good Resource

By default, GnuPG creates a key for signing and an encryption subkey:

gpg --list-keys tyler

pub	rsa4096	2014-02-19	[SC]
6237D8D3ECC1AE918729296FF6DAD285018FAC02
uid	[ultimate]	Tyler	Cipriani	<tyler@tylercipriani.com>
sub	rsa4096	2014-02-19	[E]

You can add a new subkey with the command

gpg --edit-key tyler
gpg> addkey

And then you should see

gpg --list-keys tyler

pub	rsa4096	2014-02-19	[SC]
6237D8D3ECC1AE918729296FF6DAD285018FAC02
uid	[ultimate]	Tyler	Cipriani	<tyler@tylercipriani.com>
sub	rsa4096	2014-02-19	[E]
sub	rsa4096	2016-09-02	[S]	[expires:	2018-09-02]

You can then remove your certification master key (make sure you've gone through the key backup process before you do this!)

Export all your secret subkeys
Remove all your secret keys from your keyring
Reimport only your subkeys

gpg --export-secret-subkeys tyler > subkeys
gpg --delete-secret-key tyler
gpg --import subkeys
shred --remove subkeys

Now gpg --list-keys shows a # next to sec# next to my [SC] key. This indicates that the key is no longer accessible.

Bash Completion

2017-07-01T00:49:09Z

Links ¶

Intro to bash completion

Basics ¶

Most Debian installed bash completions live under /usr/share/bash_completion/completions

# the first argument ($1) is the name of the command whose  arguments are being completed
# the second argument ($2) is the word being completed,
# and the third argument ($3) is the word preceding the word  being  completed  on the current command line
# In the context of this function the following variables are defined:
# COMP_LINE, COMP_POINT, COMP_KEY, and COMP_TYPE
# as well as COMP_WORDS and COMP_CWORD
#  It must put the possible completions in the COMPREPLY array
# See bash(1) '^  Programmable Completion' for more information
_some_function() {
  local cur cmd
  cur=${COMP_WORDS[$COMP_CWORD]}
  cmd=( "${COMP_WORDS[@]}" )
}
complete -F _some_function command

`complete` options ¶

Some complete options you want:

-o bashdefault - if no completions are found do the bash default thing
-o default - readline completions if both the complete function and bash expansions fail
-o nospace - don’t append a space at the end of matches (useful if you’re doing directory stuffs)
-S or -P - a prefix or suffix that is added at the end of a completion generated by the function passed to complete -F

Example ¶

# Many of the ideas presented in this script were stolen
# in-part or wholesale from
# <https://github.com/git/git/blob/master/contrib/completion/git-completion.bash>
__scap_subcommands=
__scap_get_subcommands() {
    if [ -n "$__scap_subcommands" ]; then
        return
    fi

    __scap_subcommands=$(scap --_autocomplete)
}

_scap() {
    local cur cmd=() sub rep

    cur=${COMP_WORDS[$COMP_CWORD]}
    cmd=( "${COMP_WORDS[@]}" )

    if (( COMP_CWORD == 1 )); then
        __scap_get_subcommands
        rep=$( compgen -W "$__scap_subcommands" -- "$cur" )
        COMPREPLY=( $rep )
        return
    fi

    # limit the command to autocomplete to the first 3 words
    if (( COMP_CWORD >= 2 )); then
        # don't complete any sub-subcommands, only options
        if [[ -n "$cur" && "${cur:0:1}" != '-' ]]; then
            COMPREPLY=()
            return
        fi
        cmd=( "${COMP_WORDS[@]:0:3}" )
    fi

    # replace the last word in the command with '--_autocomplete'
    cmd[ $(( ${#cmd[@]} - 1 )) ]='--_autocomplete'

    rep=$( compgen -W "$( ${cmd[@]} )" -- "$cur" )

    COMPREPLY=( $rep )
}

# By default append nospace except when completion comes from _scap
complete -S' ' -o bashdefault -o default -o nospace -F _scap scap

GNU Autotools

2017-02-14T15:11:05Z

Links ¶

https://robots.thoughtbot.com/the-magic-behind-configure-make-make-install

`configure.ac` ¶

Written in m4sh (m4 + shell)
Program initialization: AC_INIT macro—needs name, version, maintainer
Initialize automake: AM_INIT_AUTOMAKE
Make sure that C-compiler exists: AC_PROG_CC
Build Makefile from Makefile.in, replaces @PACKAGE_VERSION@-type variables: AC_CONFIG_FILES([Makefile])
Output the script: AC_OUTPUT

AC_INIT([hello-world], [0.1], [tyler@tylercipriani.com])

# Initialize automake
AM_INIT_AUTOMAKE

# Ensure C-compiler exists
AC_PROG_CC

# Specify what files are to be created
AC_CONFIG_FILES([Makefile])
AC_OUTPUT

`Makefile.am` ¶

The ./configure script (created by configure.ac), expects to find Makefile.in
Makefile.in is long and dumb (just like ./configure), so we make a Makefile.am
automake generates Makefile.in
foreign AUTOMAKE_OPTIONS tells that the layout is "non standard"

AUTOMAKE_OPTIONS = foreign
bin_PROGRAMS = hello-world
hello-world_SOURCES = hello-world.c

Put it all together: ¶

create m4 environment: aclocal
autoconf does: configure.ac → configure
automake --add-missing does: Makefile.am → Makefile.in
autoreconf --install: autoreconf runs autoconf, autoheader, aclocal, automake, libtoolize, and autopoint

Ikiwiki things

2017-02-14T15:11:05Z

Install ¶

Mostly it was pretty easy

Grabbed the tar from debian
Followed install instructions from Ikiwiki's install page

tar xvzf ikiwiki_3.20160121.tar.gz
cd ikiwiki_3.20160121
sudo PERL5LIB=`pwd` PERL_MM_USE_DEFAULT=1 perl -MCPAN -e 'CPAN::Shell->install("Bundle::IkiWiki")'
sudo PERL5LIB=`pwd` PERL_MM_USE_DEFAULT=1 perl -MCPAN -e 'CPAN::Shell->install("Bundle::IkiWiki::Extras")'
make
sudo make install

OpenID Setup ¶

~~Ikiwiki requires an OpenID setup~~.

You can login to Ikiwiki with OpenID, and I think that's neat!

Since OpenID is somewhat dead, I decided to setup a personal SimpleID.

I put this all on the analytics server.

First I had to create a DNS record for openid.tylercipriani.com so letsencrypt would work.

Then I made a new letsencrypt cert:

/usr/local/src/letsencrypt/letsencrypt-auto certonly --standalone -d openid.tylercipriani.com

Then I grabbed and installed openid

cd /usr/local/src
curl -sLO http://downloads.sourceforge.net/simpleid/simpleid-1.0.1.tar.gz
tar xvzf simpleid-1.0.1.tar.gz
mkdir /srv/www/openid.tylercipriani.com
mv simpleid/{cache,identities,store,www} /srv/www/openid.tylercipriani.com
mv /srv/www/openid.tylercipriani.com/{config.php.dist,config.php}

Edited the config.php file, changed root webserver and the pretty url thing

I also made a virtualserver: openid.tylercipriani.com

Identity file: thcipriani.identity

identity="https://tylercipriani.com/"
password="blah:sha1:salt"
administrator=1
[user_info]
...
[sreg]
...

Blog setup ¶

The things that I didn't understand about Ikiwiki:

htmlscrubber removes all your scripts
Some changes to the setup file (like git_wrapper updates) require you to run ikiwiki --changesetup [setupfile]
I am running a staging wiki on my laptop, a wiki on my webserver, and then pushing the compiled files to s3: WAT‽

Mutt

2017-02-14T15:11:05Z

Contacts ¶

Install goobook:

sudo pip2 install -U goobook

I ran into some problems in arch, had to upgrade/reinstall a few deps:

(ﾉ^ヮ^)ﾉ*:・ﾟ✧ sudo pip2 install -U pyasn1
(ﾉ^ヮ^)ﾉ*:・ﾟ✧ sudo pip2 install -U cryptography

goobook then needs to authenticate with gmail:

goobook authenticate

Once you go through the oauth song and dance you should be able to run a query

(ﾉ^ヮ^)ﾉ*:・ﾟ✧ goobook query tyler

thcipriani@gmail.com    Tyler Cipriani  other groups: "System Group: Friends"

From there, just need to add a bit of magic to the ~/.muttrc file

set query_command="goobook query %s"
macro index,pager a \
    "<pipe-message>goobook add<return>" "add sender to google contacts"
bind editor <Tab> complete-query

Viewing URLs ¶

Install urlview: ncurses program parses urls out of text.

Create a $HOME/urlview file:

COMMAND xdg-open %s &

Bind \,u in the editor:

macro pager ,u "|urlview<enter>" "call urlview to open links"

Searching Mail ¶

Searching works really well via notmuch

Afer install, setup via

notmuch setup

After setup, it's just a matter of calling

notmuch new

to index the things

Bitlebee/IRC info

2017-02-14T15:11:05Z

Helpful Posts ¶

- pthree.org post

Datko's book has this same kinda stuff.

Restart bitlbee without restarting Weechat ¶

sudo service bitlbee stop
/disconnect localhost
sudo service bitlbee start
/connect localhost/6667
/msg &bitlbee identify [password]

Setup OTR ¶

First had to install the bitlbee-plugin-otr plugin:

sudo apt-get install bitlbee-plugin-otr

In the &bitlebee window

account list
> @root 0 (gtalk): jabber, thcipriani@gmail.com (connected)
> @root 1 (twitter): twitter, thcipriani (connected)

Will return a list of accounts that are currently setup in bitlbee.

To generate a key for the 0th account—gmail in my case:

otr keygen 0

VHS to MP4 on Linux

2017-02-14T15:11:05Z

I recently ordered a set of videos that I remember from a few years ago that did not make the jump to DVD, unfortunately.

I do have a VCR; however, I never have it hooked up because…why would I?

The solution here: convert my VHS tapes into H.264/MP3 mp4-contained files.

Now the question is: how?

Hardware ¶

I managed to grab an EasyCap D60 Recording device from Amazon.

This device is supported inside the linux kernel (from version 3.18 forward…maybe?)

Once I plugged in this device, it was working:

lsusb

This bad boy:

Bus

Device

016:

1b71:3002

Fushicai

USBTV007

Video

Grabber

[EasyCAP]

I checked out:

ls /dev | grep -i video

And I noticed a new video device video1. Easy.

Capture Software ¶

I used VLC to caputre raw input.

Media → Open Caputre Device
Video Device Name → /dev/video1
Audio Device Name → hw:2,0
Play pulldown menu → Convert
Dump Raw Input
Destination File → /home/tyler/Videos
Start
Hit play on the VCR
Hit the Rec. button in VLC

The auto-named avi file in ~/Videos was FUCKING HUGE.

ls -lh ~/Videos | grep -i avi

Conversion ¶

I found a blog where a person does this. I have a vauge memory about doing this at UpSync, so I'll give it a shot: 2-pass mp4 conversion.

Let's see what happens!

ffmpeg -i ~/Videos/vlc-record-2016-04-22-14h47m57s-Streaming-.avi -c:v libx264 -pix_fmt yuv420p -preset slow -threads 0 -b:v 825k -strict -2 -c:a aac -b:a 96k -pass 1 -f mp4 -y /dev/null

ffmpeg -i ~/Videos/vlc-record-2016-04-22-14h47m57s-Streaming-.avi -c:v libx264 -pix_fmt yuv420p \
  -preset slow -threads 0 -b:v 825k -strict -2 -c:a aac -b:a 96k -pass 2 ~/Videos/out.mp4

The settings above created an mp4 that could be played via x264 on a RaspberryPi 3.

Beaglebone Black Setup on Debian 8

2017-02-14T15:11:05Z

Flash eMMC with latest Debian image ¶

Download Debian image [whatever].img.xz
- http://beagleboard.org/latest-images
```
unxz bone-debian-7.8-lxde-4gb-armhf-2015-03-01-4gb.img.xz
```
Insert microSD card and make sure that it is unmounted
- lsblk
- fdisk -l

Copy the img to the microSD card

sudo dd bs=4 if=bone-debian-7.8-lxde-4gb-armhf-2015-03-01-4gb.img of=/dev/mmcblk0 conv=fsync

This step will take a lot of time.

Mount the microSD card and make sure it flashes to the beaglebone:

sudo mount /dev/mmcblk0p1 /mnt/sd-card
vim /mnt/sd-card/boot/uEnv.txt

Uncomment the line:

cmdline=init=/opt/scripts/tools/eMMC/init-eMMC-flasher-v3.sh

Hookup the USB-to-serial cable
- Connect Black Wire to Pin 1 (closest to 5v barrel)
- Connect Green Wire to Pin 4 (2 pins from pin 1)
- Connect White Wire to Pin 5
Connect to USB, check output of dmesg for which /dev/ the serial connection is on
Connect to serial connection via screen
```
screen /dev/ttyUSB0 115200
```
put sdcard in BBB and power up, hold the S2 button, power up
Wait, the status lights will flash in a cylon pattern, you can watch the eMMC flash progress via screen
All User LEDs should be solid on completion

More info is available on the BeagleBoneBlack Wiki

Initial setup ¶

Connect over SSH ¶

To connect via ssh: plugin beaglebone to computer via SSH

ssh -l root 192.168.7.2

Wifi Setup ¶

Plugin the wifi adapter
Reboot (unplug it and plug it back in)
Generate your pre-shared key using wpa_passphrase (see Debian Wiki)

vim /etc/network/interfaces

auto wlan0
iface wlan0 inet dhcp
    wpa-ssid "network-name"
    wpa-psk "network-password"

ifdown wlan0; ifup wlan0
use ip -o addr show to confirm that you have an ip address

Update debian ¶

Use the Debian Upgrade Script to update debian:

#!/usr/bin/env bash
# Debian auto-upgrade script
# https://debian-handbook.info/browse/stable/sect.automatic-upgrades.html

# kill all cached creds
sudo -k

# ask for new creds
sudo -v

export DEBIAN_FRONTEND=noninteractive
sudo apt-get update
yes '' | sudo apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" dist-upgrade

Basic security ¶

Make a root password ¶

Install pwgen: sudo apt-get install pwgen
Generate a root password: pwgen -Bsy 16 1
Store that password in your password store—you'll never remember it
Login to beaglebone via ssh, run passwd

Add a privileged non-root user ¶

Generate a non-privileged user password: pwgen -Bsy 16 1
Save password in password store

Add the user

sudo groupadd sudo-user
sudo groupadd ssh-user
useradd tyler
mkdir /home/tyler
mkdir /home/tyler/.ssh
touch /home/tyler/.ssh/authorized_keys
chown -R tyler:tyler /home/tyler
chmod 700 /home/tyler/.ssh
chmod 600 /home/tyler/.ssh/authorized_keys
usermod -a -G sudo-user tyler
usermod -a -G ssh-user tyler
usermod --shell /bin/bash tyler
passwd tyler

give that user sudo privileges
- EDITOR=vim visudo -f /etc/sudoers.d/sudo-user
- Add the line: %sudo-user ALL=(ALL) NOPASSWD:ALL

Add your laptop's key to user's authorized_keys

# This should happen from your local machine: laptop/desktop/whatever
cat ~/.ssh/id_rsa.pub | ssh -l tyler 192.168.7.2 'mkdir -p .ssh && cat >> ~/.ssh/authorized_keys'

Remove demo user ¶

userdel -fr debian

Lockdown ssh ¶

Generate better hostkeys

cd /etc/ssh
rm ssh_host_*key*
ssh-keygen -t rsa -b 4096 -f ssh_host_rsa_key < /dev/null

Modfiy /etc/ssh/sshd_config to make it like below:

Ciphers aes256-ctr,aes192-ctr,aes128-ctr
KexAlgorithms diffie-hellman-group-exchange-sha256
MACs hmac-sha2-512,hmac-sha2-256,hmac-ripemd160
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
PubkeyAuthentication yes
PermitRootLogin no
PasswordAuthentication no
AllowGroups ssh-user

Restart SSH service ssh restart
Open a new terminal window and make sure you can still login (you may need to delete and reaccept hostkeys)

Fun Stuff ¶

Change ssh banner:

sudo apt-get install figlet
awk '$1 !~ /default/' /etc/issue.net > ~/issue.net && sudo mv ~/issue.net /etc/issue.net
sudo sh -c 'figlet BeagleBone >> /etc/issue.net'

BeagleBone pin-out
- http://stuffwemade.net/post/beaglebone-pinout

Things to remember ¶

thank god for 1wire temp sensor blog posts:

http://interactingobjects.com/ds18b20-temperature-sensor-on-a-beaglebone-black-running-ubuntu/
http://klaus.ede.hih.au.dk/index.php/BBB_and_OneWire

iwconfig when can't find wlan0 interface (could be wlan1)

neovim on debian

2017-02-14T15:11:05Z

Installing Neovim ¶

Install Prerequisites

sudo apt-get -f install libtool libtool-bin autoconf automake cmake g++ pkg-config unzip libmsgpack-dev libuv-dev libluajit-5.1-dev

Clone repo

git clone https://github.com/neovim/neovim.git

Make install
```
cd neovim
make
sudo make install
```

Setup Neovim ¶

ln -s ~/.vim $XDG_CONFIG_HOME/nvim
ln -s ~/.vimrc $XDG_CONFIG_HOME/nvim/init.vim

GPG Things

2017-02-14T15:11:05Z

Get your fingerprint: ¶

gpg --list-secret-keys --fingerprint

Get someone elses key ¶

Using email ¶

gpg2 --search-keys EMAIL

Using keyid ¶

gpg2 --recv-key KEYID

Sign keys ¶

gpg2 --recv-key KEYID
gpg2 --sign-key KEYID
gpg2 --send-key KEYID

Photos ¶

View someone's photo ¶

gpg --edit-key KEYID showphoto

Add a photo ¶

Suggested image sizes are 240x288 pixels (GnuPG) or 120x144 pixels (PGP) to make a JPEG of 4K-6K in size. A 1.2 h:w ratio w = h / (144 / 120)

gpg --edit-key KEYID addphoto

Keysigning party etherpad ¶

To Sign keys ¶

gpg2 --recv-key KEYID
gpg2 --sign-key KEYID
gpg2 --send-key KEYID

Script to quickly sign all keys ¶

 for k in $(grep pub ksp-wmf-20160108.txt | awk '{print $2}' | awk -F '/' '{print $2}'); do
    echo "Receiving $k"
    gpg2 --recv-key $k
    echo "Signing key $k"
    gpg2 --sign-key $k
    echo "Sending key $k"
    gpg2 --send-key $k
done

IF YOU NEED A KEY, GET HELP!! ¶

Resources ¶

PGP/GPG Intro

OpenPGP Best practices

http://web.monkeysphere.info/monkeysign/

WMF Keysigning ¶

https://people.wikimedia.org/~faidon/ksp-wmf-20160108.txt

SHA256 Checksum: 52F2 CF39   6A54 6D56   7F55 7138   7264 11BA
                    AEE3 F34E   8880 681C   9A67 75D1   3BBC 74DC              [ ]
                    52F2CF39 6A546D56 7F557138 726411BA AEE3F34E 8880681C 9A6775D1 3BBC74DC

                    RIPEMD160 Checksum: BB44 91B6 0A4D 5865 2105    2A4C 19FB 11AD 8BCC C3C3    [ ]
                    BB44 91B6 0A4D 5865 2105  2A4C 19FB 11AD 8BCC C3C3

Mutt problems ¶

"can't query passphrase in batch mode" ¶

Uncomment, use agent in ~/.gnupg/gpg.conf

Pass problems ¶

No Secret Key ¶

Problem ¶

gpg: decryption failed: No secret key

Solution ¶

install pinentry-curses
~/.gnupg/gpg-agent.conf

pinentry-program /usr/bin/pinentry

gpg-connect-agent reloadagent /bye

AWS Cloudfront SSL Cert

2017-02-14T15:11:05Z

Setup an Comodo positive SSL cert on AWS Cloudfront

Buy Comodo positive SSL cert via namecheap

Inspect last years cert:

openssl req -noout -text -in tylercipriani_com.csr

Generate private key and signing request

You can generate a new key as a separate step, or as part of the req command

To generate a new key manually use:

openssl genrsa -out /path/to/output.key 2048
mkdir -p ~/Projects/Certs/com.tylercipriani/2015-11-24
cd ~/Projects/Certs/com.tylercipriani/2015-11-24

To generate a new key as part of a signing reuest use:

openssl req -sha256 -new -newkey rsa:2048 -nodes -keyout /path/to/output.key -out /path/to/output.csr
     ensures output key is not encrypted ────┘

Answer lots of questions

Country Name (2 letter code) [XX]:US
State or Province Name (full name) []:Colorado
Locality Name (eg, city) [Default City]:Longmont
Organization Name (eg, company) [Default Company Ltd]:Tyler Cipriani
Organizational Unit Name (eg, section) []:.
Common Name (eg, your name or your server's hostname) []:tylercipriani.com
Email Address []:spam@tylercipriani.com
A challenge password []:

What is a challenge password: https://tools.ietf.org/html/rfc2985#page-16

Should now have a tylercipriani_com.csr and an tylercipriani_com.key
Do the namecheap needful:
- Login to namecheap and activate your certificate
- xsel -p < tylercipriani_com.csr then paste in the “Enter CSR” field
- Choose, “Apache, Nginx, or Other” as the server type
- Verify the domain, click “Next”
- Verify CSR info, click “Next”
- Select “Email-based” Domain Control Validation (DCV) method
- Company contacts page, “NA” as company name, my address in address, tyler@tylercipriani.com in admin email
You’ll get an email that asks you to enter a validation into a Comodo site, do that
You’ll get an email with tylercipriani_com.zip
aws configure to ensure that your awscli is setup

Use awscli to upload

awscli iam upload-server-certificate \
  --server-certificate-name tylercipriani_com_2015-11-24 \
  --certificate-body file://tylercipriani_com.crt \
  --private-key file://tylercipriani_com.key \
  --certificate-chain file://tylercipriani_com.ca-bundle \
  --path /cloudfront/

Login to your aws dashboard, click cloudfront, go do Distribution Settings, click edit, find the new ssl key name in the dropdown and click, “Yes, edit”
Should work…

Asus debian jessie install

2017-02-14T15:11:05Z

Reboot, hitting F2 over-and-over
Turn off Fastboot and Secureboot in UEFI
Download Non-free firmware
- Linux Questions Answer
- firmware-iwlwifi download
Extract firmware from deb

ar xv firmware-iwlwifi.deb tar xvf data.tar.xz
Copy to ext4 formatted sd-card

mkfs.ext4 /dev/[sd-card] mount -t ext4 /dev/[sd-card] /mnt/sd-card cp -r lib/firmware/* /mnt/sd-card
Insert Install Media
Setup installer to recognize dmraid
- SataRaid DebianInstaller
- Hit ‘E’ with ‘Install’ selected
- append ‘dmraid=true’ to eol
- F10 to save-and-exit
Detect network hardware
- Ctrl-Alt F2
- mkdir /lib/firmware
- blkid (to list mounts)
- mount -t ext4 /dev/sdd1 /lib/firmware
- modprobe ahci
- Ctrl-Alt F1
Manual partition

https://wiki.debian.org/DebianInstaller/SoftwareRaidRoot
Run live disk, chroot, fuck around

http://forums.debian.net/viewtopic.php?f=17&t=116036

Troubleshooting:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=711147

Show root partition:
```
cat /proc/cmdline
```
initramfs modules

/etc/initramfs-tools/modules update-initramfs –k all –u
Large xterm:

xterm -fn 10x20
chroot

boot ubuntu live sudo -i cryptsetup luksOpen /dev/mapper/isw_cejababahfd_ASUS_03 cryptroot lvm vgscan lvm vgchange -ay mount /dev/mapper/taskmaster–vg-root /mnt mount /dev/mapper/isw_cejababahfd_ASUS_02 /mnt/boot mount -o bind /sys /mnt/sys mount -t proc /proc /mnt/proc mount -o bind /dev /mnt/dev chroot /mnt
chroot & install dmraid

chroot apt-get install dmraid initramfs modules
break raid:

http://ubuntuforums.org/showthread.php?t=2193133&page=2&p=12913689#post12913689

For realz Steps! ¶

Download Ubuntu 14.04 Live OS and Debian 8.1.0 netinst
Copy to a Ubuntu USB Drive:
- use lsblk/blkid to find USB drive name without number, e.g. /dev/sdb NOT /dev/sdb1
- dd bs=4M ~/Downloads/ubuntu-14.04.2-desktop-amd64.iso of=/dev/[usbdrive-without-number]
Download Non-free firmware
- Linux Questions Answer
- firmware-iwlwifi download
Extract firmware from deb
- ar xv firmware-iwlwifi.deb
- tar xvf data.tar.xz
Copy to ext4 formatted sd-card
- mkfs.ext4 /dev/[sd-card]
- mount -t ext4 /dev/[sd-card] /mnt/sd-card
- cp -r lib/firmware/* /mnt/sd-card
Boot Ubuntu from usb/change UEFI opts
- Insert Ubuntu USB drive in Asus, Boot while holding F2
- Boot → Fastboot [Disabled]
- Security → Secure Boot Menu → Secure Boot Control [Disabled]
- Advanced → SATA Configuration → SATA Mode Selection [AHCI]
- Boot → Boot Option Priorites (hit + until USB drive is at the top)
- F10 (save and exit)
Try Ubuntu without installing
Enable network, start terminal (Start → uxterm → xterm -fn 10x20)
sudo gparted, delete all partitions on /dev/sda /dev/sdb
Create partition table on /dev/sdb:
- Select /dev/sdb
- Device → Create Partition Table…
Shutdown, remove usb
Copy Debian netinst to USB Drive:
- use lsblk/blkid to find USB drive name without number, e.g. /dev/sdb NOT /dev/sdb1
- sudo dd bs=4M if=Downloads/debian-8.0.0-amd64-netinst.iso of=[usbdrive-without-number]
Detect network hardware
- Ctrl-Alt F2
- mkdir /lib/firmware
- blkid (to list mounts)
- mount -t ext4 /dev/sdd1 /lib/firmware
- modprobe ahci
- Ctrl-Alt F1
Partition Disks
- Manual
  1. sda & sbd delete existing partitions
  2. sda1 256MB EFI System partition
  3. sda2 512MB mountat /boot ext4
  4. sda3 REMAINDER physical volume for raid
  5. sdb1 ALL physical volument for raid
  6. configure software raid, raid0 [x]sda3 [x]sdb1
  7. raid0 disk1 use as physical volume for encryption
  8. configure encrypted volumes [x]/dev/md0
  9. encrypted-disk 1: use as physical volume for lvm
  10. configure lvm volume group
  11. 20 GB / ; 4 GB swap ; remainder /home
Post xmonad-install disable GDM login:
- XMonad Install
- Disable GDM systemd

Cucumber tests getting started

2017-02-14T15:11:05Z

https://gorails.com/setup/ubuntu/14.04

Check setup ¶

ruby -v
gem list selenium
gem install selenium-webdriver
Firefox
IRB

Ruby install ¶

❯ curl -fsSL https://gist.github.com/mislav/055441129184a1512bb5.txt | \
  rbenv install --patch 2.2.3
~ 6m 50s
❯ rbenv global 2.2.2
~
❯ ruby -v
ruby 2.2.2p95 (2015-04-13 revision 50295) [x86_64-linux]
~
❯ echo "gem: --no-ri --no-rdoc" > ~/.gemrc
~

Selenium webdriver ¶

require "selenium-webdriver" https://code.google.com/p/selenium/wiki/RubyBindings

driver.class http://www.rubydoc.info/gems/selenium-webdriver/Selenium/WebDriver/Driver

Core tests ¶

[mw-core]/tests/browser/features/create_account.feature

Schenario Outline can be passed variable

Scenario: [English text] # Just a comment, nothing is parsed
Given [this thing] # Sets up the test
When [other thing] # Action that is part of the test
And
But

Bundler ¶

cd [mwcore]/tests/browser
bundle install
bundle exec cucumber features/create_account.feature:14

Important ¶

export BROWSER=firefox
export MEDIAWIKI_ENVIRONMENT=mw-vagrant-host

Git annex notes

2017-02-14T15:11:05Z

Setup New repo ¶

init git:
```
git init
```
init git annex:
```
git annex init local
```

Add S3 Remote named public-s3

git annex initremote public-s3 type=S3 encryption=none bucket=tyler.zone chunk=0

Add file to git annex
```
git annex add [big-file]
```
copy current directory to public-s3 remote
```
git annex copy --to public-s3
```
remove local copy—will only remove if already in remote—nothing lost
```
git annex drop [file]
```
Commit
```
git -a -m 'initial commit'
```

Setup NFS as remote using Rsync over ssh ¶

Add Rsync as unencrypted remote

git annex initremote nas type=rsync rsyncurl=nfs.blazeyandltyler.com:/volume1/homes/tyler/PicturesAnnex encryption=none

Add file to nas
```
git annex copy --to=nas
```

Pull down photos ¶

eval (~/.amazonrc)
git annex enableremote public-s3
git annex get [whatever]

Make available to the public (after public s3 setup): ¶

git annex addurl --file [filename] "http://tyler.zone/$(git annex lookupkey [filename])"

List remotes and remote info ¶

Show remotes ¶

git annex enableremote

Show remote info ¶

git annex info [remote-name]
git annex info tylercipriani-raw

Finding info about files ¶

Find a file:

git annex whereis [filename]

Adding a file to http://tyler.zone

eval $(~/.amazonrc)
git annex copy --to=photo-site [file]
git annex addurl --file [file] "http://tyler.zone/$(git annex lookupkey [filename])"

Links ¶

Setup ¶

Make amazon bucket with policy:

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "AllowPublicRead",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::[bucket-name]/*"
    }
  ]
}

Put creds out into the environment

eval (~/.amazonrc)
cd into repo:
cd /home/tyler/Projects/Timelapse

Tyler Cipriani: Notes

Coreboot on the ThinkPad X220 with a Raspberry Pi

X-Series ThinkPads are niiiiice ¶

I am become hacker, destroyer of laptops ¶

Things you need ¶

ThinkPad X220 Disassembly ¶

Setup Your Pi as a Flasher ¶

Resources ¶

GPG Security things

Revocation Cert ¶

Key backup ¶

Subkeys ¶

Bash Completion

Links ¶

Basics ¶

complete options ¶

Example ¶

GNU Autotools

Links ¶

configure.ac ¶

Makefile.am ¶

Put it all together: ¶

Ikiwiki things

Install ¶

OpenID Setup ¶

Blog setup ¶

Mutt

Contacts ¶

Viewing URLs ¶

Searching Mail ¶

Bitlebee/IRC info

Helpful Posts ¶

Restart bitlbee without restarting Weechat ¶

Setup OTR ¶

VHS to MP4 on Linux

Hardware ¶

Capture Software ¶

Conversion ¶

Beaglebone Black Setup on Debian 8

Flash eMMC with latest Debian image ¶

Initial setup ¶

Connect over SSH ¶

Wifi Setup ¶

Update debian ¶

Basic security ¶

Make a root password ¶

Add a privileged non-root user ¶

Remove demo user ¶

Lockdown ssh ¶

Fun Stuff ¶

Things to remember ¶

neovim on debian

Installing Neovim ¶

Setup Neovim ¶

GPG Things

Get your fingerprint: ¶

Get someone elses key ¶

Using email ¶

Using keyid ¶

Sign keys ¶

Photos ¶

View someone's photo ¶

Add a photo ¶

Keysigning party etherpad ¶

To Sign keys ¶

Script to quickly sign all keys ¶

IF YOU NEED A KEY, GET HELP!! ¶

Resources ¶

WMF Keysigning ¶

Mutt problems ¶

"can't query passphrase in batch mode" ¶

Pass problems ¶

No Secret Key ¶

Problem ¶

Solution ¶

AWS Cloudfront SSL Cert

Asus debian jessie install

For realz Steps! ¶

Cucumber tests getting started

Check setup ¶

`complete` options ¶

`configure.ac` ¶

`Makefile.am` ¶