Hello,
We use Tails a lot, thank you for your work!
In our thread model, an opposant might get physically the USB stick to
inject malwares inside the squashfs partition, and the user would never
know the Tails is corrupted.
Currently, Tails has an option to clone itself and update another stick
with ease.
It would be incredible if we can test the integrity of another stick
using an integrated Tails app! Maybe re-using the GrapheneOS's Auditor
options (auditee, auditor, remote verification).
For such a test, I created this Bash tool:
https://0xacab.org/TheCodesUprising/tools/tails-integrity (TW: It is
completely in a beta version).
The idea is to allow the user to check the current (--self) stick or
another plugged one (--device), against a downloaded .img or the current
stick (--device mode).
The test verifies the Tails versions match, then proceed to a
file-by-file comparison with the exclusion of not-immutable files
(
https://0xacab.org/TheCodesUprising/tools/tails-integrity/-/blob/main/src/lib/compare.sh?ref_type=heads#L29).
I can better explain the tool or re-work it if you find it useful; I'd
be very happy to know your thoughts about such a tool, if it's something
you're interested about and if you find my project valuable.
Everything on tails-integrity can be reused as this or adapted; I would
be very happy if it can be reused and helpful to improve an automatic
integrity check for a newer Tails version :)
Best regards,
Lucas
