Linux Information

Table of Contents

• Image configurations
• Partition Layout
• IMAGO software updates
• Secure Boot
  • Enrolling the DKMS Machine Owner Key

Images for the VisionBox AGE-X use the amd64 architecture.

Image configurations

IMAGO currently provides a single image configuration:

Configuration	Description	Installation size
a	Basic image Debian base system with Xfce4 desktop environment Additional packages: openssh-server, openssh-client, snmpd, avahi-daemon, screen, htop, python3, ... Software development packages: gcc, g++, gdb, make, ... Packages provided by IMAGO: IMAGO Linux SDK: imago-sdk imago-snmpd-update: Linux service which updates the file /etc/snmp/snmpd.conf.local to make the device discoverable by the VIBFinder tool. The service additionally sets the host name to the device's serial number during boot. imago-archive-keyring: public IMAGO APT repository deb.imago.tech for online SDK and ViewIT updates	≈ 2 GB

Note

The default password for superuser root is vision. The same password is also used for the regular user visionbox. Use the command passwd to change the passwords.

Partition Layout

The Installation script creates a new GPT partition table on the target device using the following layout:

Partition layout

Partition	Type	Size	File system type	Mount point
1	BIOS boot	1 MB	-	-
2	EFI system	1 GB	VFAT	/boot
3	Linux	remaining space	Ext4	/

IMAGO software updates

The public Debian repository at deb.imago.tech enables online installation and updates of packages provided by IMAGO. The repository is already prepared in the Linux images, provided by the package imago-archive-keyring.

The repository is already prepared in new Linux images.

Note

imago-archive-keyring package versions < 1.1.1.0 contain an expired public key.

To download and install or upgrade the repository manually:

wget https://deb.imago.tech/pool/main/i/imago-archive-keyring/imago-archive-keyring_1.2.0.0_all.deb
dpkg -i imago-archive-keyring_1.2.0.0_all.deb
apt update

The following software packages are currently supported:

• imago-sdk
• imago-snmpd-update

Example for installing or updating the SDK:

apt update
apt install imago-sdk

Secure Boot

Support for Secure Boot is implemented starting with Debian 13 and requires support by the hardware. The following devices are currently supported:

• VisionBox AGE-X5 with 10^th generation CPU
• VisionBox AGE-X6

The Installation script automatically prepares the system for Secure Boot if available.

A Machine Owner Key (MOK) is used to sign and trust custom software during UEFI Secure Boot. Public keys can be enrolled into the UEFI firmware's non-volatile memory (NVRAM) using the Linux program mokutil. The Dynamic Kernel Module Support (DKMS) tool uses this feature to enable Secure Boot support for third-party kernel modules like provided by the IMAGO Linux SDK.

Enrolling the DKMS Machine Owner Key

The Installation script automatically creates a unique key pair for DKMS on each installed system:

• /var/lib/dkms/mok.key: Private key
• /var/lib/dkms/mok.pub: Public key

If Secure Boot is supported, the script initiates the UEFI enrollment process after the image is installed. When rebooting the system, the blue-screen MOK manager is started automatically:

MOK Manager

The enrollment must be completed by the user as follows:

• Press any key within 10 seconds to enter MOK management
• Select Enroll MOK → Continue → Yes
• Enter the same Root passwort as used by the installed image (default: vision)
• Select Reboot

Secure Boot can then be enabled in the BIOS:

• Enter the BIOS by pressing the DEL key during power-on
• Go to the Security page → Secure Boot
• Set the Secure Boot entry to Enabled
• Set Secure Boot Mode to Standard
• Press F10 for Save and Exit

Run the mokutil tool in a Linux shell to verify that Secure Boot is enabled:

~# mokutil --sb-state
SecureBoot enabled

Run the following command to list enrolled keys:

~# mokutil -l:
[key 1]
...
        Subject: CN=Debian Secure Boot CA
...
[key 2]
...
        Subject: CN=DKMS module signing key
...

The first key is not stored in NVRAM, it's compiled into Debian's first-stage UEFI program Shim which itself is signed by Microsoft and therefore trusted by UEFI. Shim uses the first key to verify signature of the Grub bootloader and the kernel image. The second key for DKMS is stored in NVRAM.

If the DKMS key is missing, it can be enrolled manually using a temporary password like follows:

~# mokutil --import /var/lib/dkms/mok.pub
input password:
input password again:

The MOK manager will be started automatically after reboot to complete the enrollment process.