Whonix for arm64 / Raspberry Pi (RPi)



Edit to my last post:
my mistake, actually, fstab shows dev by uuid for / (root).

grml-debootstrap now merged arm64 build support.

grml-debootstrap bug "VM build failing if combining --vmefi with --arch arm64 which maybe can be worked around in derivative-maker.

related grml-debootstrap arm64 issues:

VM --arch arm64 builds might now be functional.

It might now even be possible to cross-build arm64 images while the build machine is running Intel / amd64.

I am writing “might” because I only superficially tested that is booting using QEMU and I am not using any ARM64 hardware myself. Since there is no dedicated ARM64 maintainer, this might break in the future. This is because the amount of architectures, platforms I can support is limited by being only 1 person.

While I added a (Kicksecure) CI test for arm64 builds, which will hopefully prevent the build process from breaking again and going unnoticed for a long time, the boot process might break in the future because we don’t have CI testing yet that does not only building but actual booting and testing.

related: Continuous Integration (CI) Whonix Testing - Automated Test Suite

The good news: “some newer” RPi (don’t ask me about the details) now support booting using UEFI (Tiano Core) and are compatible with a standard arm64 GRUB2. According to above blog post, even the standard Debian installer from debian.org can nowadays install on RPi. Raspian and Armbian are now optional for RPi.

The bad news: This generate-recipe.py (part of Debian RaspberryPiImages - Debian Wiki) build script shows that each RPi needs a few different things. Such as a different kernel.

# Arch, kernel, DTB:
if version == '1':
    arch = 'armel'
    linux = 'linux-image-rpi'
    dtb = '/usr/lib/linux-image-*-rpi/bcm*rpi-*.dtb'
elif version == '2':
    arch = 'armhf'
    linux = 'linux-image-armmp'
    dtb = '/usr/lib/linux-image-*-armmp/bcm*rpi*.dtb'
elif version in ['3', '4']:
    arch = 'arm64'
    linux = 'linux-image-arm64'
    dtb = '/usr/lib/linux-image-*-arm64/broadcom/bcm*rpi*.dtb'

Also a different wireless (WiFi) / bluetooth firmware package.

This means there can likely be no universal bootable image that works on all RPi hardware versions.