Generate Address

Requirements

Linux Workstation (online machine)
- Any internet connected computer with a Linux shell will suffice
Air-gapped machine
Air-gapped machine
Trove SD Card

Procedure

Offline Machine: Generate Address

Retrieve AirgapOS SD card and plug it into the air-gapped machine
Turn on air-gapped machine
Unplug the AirgapOS SD card
Retrieve Trove SD card and plug it into the air-gapped machine
Copy the trove repository to the machine and switch to it
```
$ cp -r /media/trove /root/
$ cd /root/vaults
```
Start Keyfork using the relevant Shardfile:
```
$ keyfork recover shard --daemon <namespace>/shardfile.asc
```
- Follow on screen prompts
If the desired <coin> directory doesn't exist for the namespace, create it:
```
$ mkdir -p <namespace>/<coin>
```
Connect to the appropriate coin directory:
```
$ cd <namespace>/<coin>/
```
Check what the latest address account is:
```
$ ls -la .
```
Find what the latest number for the address is, and add 1 to it. This will be the new address account.
- For example if the latest address file is 42, the new account_id would be 43. The addresses should start at 0
- Set an environment variable with the new account_id:
```
$ account_id=<num>
```

Online Machine: Generate Nonce Account

Turn on online machine
Retrieve Trove SD card and plug it into the computer
Look for the SD card device name (<device_name>) in the output of the lsblk command. It will typically be listed as /dev/sdX or /dev/mmcblk<num>, where X is a letter (e.g., /dev/sdb, /dev/sdc). You can identify it by its size or by checking if it has a partition (like /dev/sdX1)
- Mount the device using: sudo mount /dev/<device_name> /media
Copy the vaults repository from the Trove SD card:
```
$ cp -r /media/trove ~/
```
- If the ~/trove/ repository already exists, ensure it doesn't have any changes that haven't been committed, then remove it using sudo rm -rf ~/trove before re-running the previous step
Ensure icepick is available on system
- Follow steps from installation guide
Change directory into the desired <namespace>/<coin> directory:
```
$ cd ~/trove/<namespace>/<coin>
```
Select which account you are creating the delegate address by viewing the appropriate <namespace>/<coin>/ directory:
```
$ ls -la .
```
Once you have selected the appropriate account, set the account_id variable:
```
$ account_id=<num>
```
Use icepick to generate nonce account:
- If using a non-mainnet-beta cluster, be sure to provide the --cluster argument
- Set icepick config file:
```
$ export ICEPICK_CONFIG_FILE=<path_to_icepick_repositry>/icepick.toml`
```
```
$ icepick workflow sol generate-nonce-account --input-file $account_id.json > $account_id-na.json
```
- Repeat command if returned message is "The transaction was possibly not received by the cluster."
Fund the wallet displayed on-screen with 0.01 SOL
- Once the funding is done, the nonce account will be created

Stage, commit, sign and push the changes:

$ git add .
$ git commit -m -S "<message>"
$ git push origin HEAD

Sealing

Gather all the original items that were in the air-gapped bundle:
- Air-gapped computer
- AirgapOS SD card
Vacuum sealing based tamper proofing
1. Insert object(s) into plastic sealing bag
2. Fill bag with enough plastic beads that most of the object is surrounded
3. Use vacuum sealer to remove air from the bag until the beads are no longer able to move
4. Take photographs of both sides of the sealed object using both the digital and polaroid camera
5. Date and sign the polaroid photographs and store them in a local lock box
6. Take the SD card to an online connected device, ensuring continued dual custody, and commit the tamper evidence photographs to a repository. If two individuals are present, have one create a PR with a signed commit, and the other do a signed merge commit.
Safe based tamper proofing
1. Place items into safe
2. Ensure the safe is properly locked

Trove

Generate Address

Requirements

Procedure

Offline Machine: Generate Address

Online Machine: Generate Nonce Account

Sealing