hardening

Hardening for this workstation: a sealed, signed secureblue (Fedora Atomic) image with scroll, plus everything needed to unlock the disk and the screen with hardware tokens.

Path	What	Docs
image/	The OS image: secureblue Sericea + scroll, bootc/composefs, systemd-boot, a sealed UKI signed with our own keys. Includes install, key handling and the pre-install checklist	image/README.md
image/files-luks/	tokenvault: boot-time disk unlock. You enter the TPM2 PIN and the FIDO2 PIN and touch the key; together they open a vault on the ESP that holds the root keyslot's passphrase	image/LUKS.md
vmgui/	VM windows, Qubes-style: apps in KVM guests show up as scroll windows framed in the VM's color, over vsock (no network to the host), from a confined waypipe in a compositor-enforced security context. The host keeps only a bare KVM/libvirt set	vmgui/README.md
vmswitch/	Guest networks and USB: a switch made of TAP devices and one nftables table (guests share a network on demand; uplink = internet only), USB devices handed to guests through usbguard, and vmtui, a terminal tree table to drive both (Super N)	vmswitch/README.md
lockscreen/	hardened-unlock: the scroll lock screen. Unlock needs the FIDO2 key PIN, a touch and the account password, each asked separately	lockscreen/README.md
docs/	The public site (GitHub Pages): landing page, disk unlock, own Secure Boot keys, Qubes OS comparison, threat model	https://wildcommitter.github.io/fedora-secureblue-tpm-fido2/
.github/workflows/build.yml	CI: builds and signs the image with the signing environment's secrets, then publishes the installer ISO	image/README.md → Who signs what
SECURITY.md	How to report vulnerabilities privately
test/	KVM e2e for tokenvault (test/bootc: OVMF Secure Boot, swtpm, virtual FIDO2 key) and the shared harness and virtual key (test/e2e.py, test/vfido)	image/LUKS.md → Tests

Tests never touch the host's TPM, its real FIDO2 key, its disks or its PAM. They use swtpm, the virtual key in test/vfido and containers or VMs only. VM disks and other work directories (**/work/), build outputs and private keys are kept out of git (.gitignore). Private signing keys live in SECRETS_DIR on offline media, never here.