Right now I'm assembling parts and plans for a key ceremony, i.e. a procedure to generate cryptographic keys in a high security environment. In particular I want to take a laptop with coreboot (Thinkpad T60) and some smart cards with key import functionality and generate the keys on the laptop and import them into the cards to get key backup. For this task I need to choose an operating system meeting very specific requirements.
Requirements:
The operating system must be open source
The OS must be able to boot from a live CD
The OS must be able to operate without persistent storage (except for a read only DVD)
There must be a way to verify the integrity of the burned disc externally against known good values (hashes?)
Preferably it should be able to continue operation even if the DVD is removed
it must work with the coreboot installed T60
it must not require more than 8GB RAM and should work with 2GB
it must allow to (temporarily) install packages (required drivers for the cards and the card reader) from a separate disc (either in the optical boot drive or an external USB optical drive)
it must not be larger than 4.7 GB (eg fit on a standard DVD)