Initial FDE CanvOS build changes.

.arg.template

@@ -10,4 +10,15 @@ HTTPS_PROXY=
 HTTP_PROXY=
 PROXY_CERT_PATH=
 UPDATE_KERNEL=false
-CLUSTERCONFIG=spc.tgz
+CLUSTERCONFIG=spc.tgz
+CIS_HARDENING=true
+
+# If you have Ubuntu Pro, use the UBUNTU_PRO_KEY variable to activate it as part of the image build
+# UBUNTU_PRO_KEY=your-key
+
+# For enabling Secure Boot with Full Disk Encryption
+# IS_UKI=true
+# MY_ORG="ACME Corporation"
+# UKI_BRING_YOUR_OWN_KEYS=false         # See sb-private-ca/howto.md for instructions on bringing your own certiticates
+# INCLUDE_MS_SECUREBOOT_KEYS=true       # Adds Microsoft Secure Boot certificates; if you export existing keys from a device, you typically won't need this
+# AUTO_ENROLL_SECUREBOOT_KEYS=false     # Set to true to automatically enroll certificates on devices in Setup Mode, useful for flashing devices without user interaction

.earthlyignore

@@ -0,0 +1,2 @@
+local/
+build/*

.gitignore

@@ -8,11 +8,13 @@ config.yaml
 content-*/*
 *.arg
 .idea
-
 .DS_Store
-
 build/
 local/
 keys/
 secure-boot/
-spectro-luet-auth.yaml
+sb-private-ca/*.pem
+sb-private-ca/*.key
+sb-private-ca/*.req
+spectro-luet-auth.yaml
+spc.tgz

Dockerfile

@@ -23,6 +23,19 @@ RUN if [ "${OS_DISTRIBUTION}" = "opensuse-leap" ] && [ "${PROXY_CERT_PATH}" != "
 
 ### To install the nginx package for Ubuntu  ###
 
+#TODO: Remove the following line. This is only for dev purpose.
+
+# RUN useradd -m kairos && echo "kairos:kairos" | chpasswd
+# RUN adduser kairos sudo
+# RUN echo '%sudo ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
+
+# sbctl and mokutil are useful tools to check secure boot status, manage secure boot keys.
+# RUN curl -Ls https://github.com/Foxboron/sbctl/releases/download/0.13/sbctl-0.13-linux-amd64.tar.gz | tar -xvzf - && mv sbctl/sbctl /usr/bin/sbctl
+# RUN chmod +x /usr/bin/sbctl
+# RUN apt-get update && apt-get install -y \
+#     mokutil \
+#     && apt-get clean
+
 # RUN apt-get update && apt-get install nginx -y
 ### or