index

Downloading TailsOS with NixOS

TailsOS is an operating system that boots from a thumbdrive and forgets everything you do. Sounds odd, but in some cases it’s critical you know memory was zeroed and all state was destroyed, for instance when generating or using cryptographic secrets. This is a guide on how to download Tails, verify signatures, and flash to a USB.

Steps

These steps are adapted from the Debian/Ubuntu guide and may become stale. Check the official steps before proceeding and make adjustments as needed.

First, we need a virtual container with a Debian image, as we will need the debian-keyring collection of public keys and signatures. The virtualization tool of choice is podman for this example. Start by adding this to configuration.nix:

virtualisation.podman.enable = true;

Then rebuild the OS:

sudo nixos-rebuild switch

If it isn’t present already, add a shell with gnupg, which will be used to verify signatures:

nix shell nixpkgs#gnupg

Now fetch the Tails signing key, the TailsOS image, and signature attesting to that image:

wget https://tails.net/tails-signing.key

wget --continue \
  https://download.tails.net/tails/stable/tails-amd64-7.10/tails-amd64-7.10.img

wget \
  https://tails.net/torrents/files/tails-amd64-7.10.img.sig

Export these environment variables after cross referencing with the official TailsOS steps. This includes the TailsOS signing key fingerprint, and the version of the image you just downloaded, along with the signature.

export IMAGE='tails-amd64-7.10.img'
export SIG="${IMAGE}.sig"
export TAILS_FPR='A490D0F4D311A4153E2BB7CADBB802B258ACD84F'

Using the virtual container, we will verify the signatures from TailsOS and Debian developer(s) after we download them. Namely, we will check the signature from Chris Lamb of Debian. Notice the TailsOS signing key is pasted in full here, and you may need to change it:

podman run --rm \
  -v "$PWD:/work" \
  debian:stable-slim \
  sh -ec '
    apt-get update
    apt-get install -y --no-install-recommends gnupg debian-keyring

    gpg --import /work/tails-signing.key

    gpg --no-default-keyring \
      --keyring=/usr/share/keyrings/debian-keyring.gpg \
      --export "chris@chris-lamb.co.uk" |
      gpg --import

    gpg --keyid-format 0xlong \
      --check-sigs A490D0F4D311A4153E2BB7CADBB802B258ACD84F

    gpg --no-default-keyring \
      --keyring=/usr/share/keyrings/debian-keyring.gpg \
      --export "chris@chris-lamb.co.uk" \
      > /work/chris-lamb-from-debian-keyring.asc

    test -s /work/chris-lamb-from-debian-keyring.asc
  '

Verify the signatures once more, this time from your shell:

gpg --import tails-signing.key chris-lamb-from-debian-keyring.asc

gpg --fingerprint "$TAILS_FPR"

gpg --keyid-format 0xlong --check-sigs "$TAILS_FPR"

If the signatures pass the checks, you may continue to this step. Otherwise, stop immediately and report malformed signatures to the TailsOS team. This will sign with your GPG key:

# Only do this after you have confirmed the expected certification.
# This needs a secret OpenPGP key in your normal GnuPG keyring.
gpg --list-secret-keys
gpg --lsign-key "$TAILS_FPR"

# Verify the downloaded USB image.
TZ=UTC gpg --no-options --keyid-format long \
  --verify "$SIG" "$IMAGE"

Find your USB stick, probably in /dev/sda:

# With the target USB stick unplugged:
lsblk -d -o PATH,SIZE,MODEL,TRAN,RM

# Plug it in, then run the same command again:
lsblk -d -o PATH,SIZE,MODEL,TRAN,RM

Using the path you found above, replace sdX with the location of your thumb drive. The entire contents found at /dev/sd* will be removed:

# Replace this with the whole USB device you identified.
USB=/dev/sdX

# Last safety check: inspect model, size, and partitions.
lsblk -o PATH,SIZE,MODEL,TRAN,RM,MOUNTPOINTS "$USB"

Write TailsOS to the USB:

# This irreversibly overwrites the selected device.
sudo dd if="$PWD/$IMAGE" of="$USB" bs=4M conv=fsync status=progress
sync

Congrats! Your USB drive now contains a reusable and stateless operating system!