To not make the post excessively long, the procedure for building packages has been put into TrenchBoot SDK documentation (github.com/TrenchB…kages.md). Follow the instructions in the file to build the TrenchBoot AEM packages. Installing Xen and GRUB packages The following process was carried out and tested on Qubes OS 4.2 (openqa.qubes-os.org/tests/5…ts/55506). In order to install the packages one has to send the Xen and GRUB RPMs to the Dom0. Please note that moving any external files or data to Dom0 is potentially dangerous. Ensure that your environment is safe and the RPMs have the right checksums after copying them to Dom0. If you don’t know how to copy files to Dom0, refer to the Qubes OS documentation (www.qubes-os.org/doc/how…rom-dom0). Even before installing packages, it is required to enable the current-testing repository to avoid the need to install additional dependencies: sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing If the RPMs are inside Dom0, install them with the following command (assuming you downloaded all of them to one directory): sudo dnf update \ python3-xen-4.17.0-3.fc32.x86_64.rpm \ xen-4.17.0-3.fc32.x86_64.rpm \ xen-hypervisor-4.17.0-3.fc32.x86_64.rpm \ xen-libs-4.17.0-3.fc32.x86_64.rpm \ xen-licenses-4.17.0-3.fc32.x86_64.rpm \ xen-runtime-4.17.0-3.fc32.x86_64.rpm \ grub2-common-2.06-1.fc32.noarch.rpm \ grub2-pc-modules-2.06-1.fc32.noarch.rpm \ grub2-pc-2.06-1.fc32.x86_64.rpm \ grub2-tools-2.06-1.fc32.x86_64.rpm \ grub2-tools-extra-2.06-1.fc32.x86_64.rpm \ grub2-tools-minimal-2.06-1.fc32.x86_64.rpm Invoke sudo grub2-install /dev/sdX, where X is the letter representing the disk with /boot partition. Additionally, you will have to download SINIT ACM and place it in /boot partition/directory so that GRUB will be able to pick it up. Note it is only necessary if your firmware/BIOS does not include/place SINIT ACM in the Intel TXT region. You may obtain all SINIT ACMs as described here (github.com/QubesOS…b/README). Copy the SINIT ACM suitable for your platform to /boot directory. In the case of Dell OptiPlex it will be SNB_IVB_SINIT_20190708_PW.bin. Install Qubes AEM packages with the following command because Qubes OS 4.2 lacks AEM packages: qubes-dom0-update --enablerepo=qubes-dom0-current-testing anti-evil-maid Enter the SeaBIOS TPM menu (hotkey t) and choose the clear TPM option. Then activate and enable the TPM by selecting the appropriate options. If in any case you are using proprietary firmware, clear the TPM and then enable and activate it in the firmware setup application. Follow the steps in set up TPM for AEM (github.com/QubesOS…b/README). The anti-evil-maid script may not work with LUKS2 in its current state, so make a fix according to this Pull Request (github.com/QubesOS…41/files) if needed. Now it is possible to setup Qubes OS AEM device (github.com/QubesOS…b/README). This will create the AEM entry in Qubes GRUB, but this entry is using tboot. You will need to edit the grub configuration file (/boot/grub2/grub.cfg) by copying the standard Qubes OS entry (without AEM) and adding: slaunch slaunch_module / before the multiboot2 directive, which loads Xen Hypervisor. Name the entry differently, e.g. Qubes OS with TrenchBoot AEM. Also, you will need to copy the AEM parameters for the Linux kernel: e.g.: aem.uuid=38474da6-7b2d-410d-95e6-8683005fb23f rd.luks.key=/tmp/aem-keyfile rd.luks.crypttab=no