Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable uki flow #69

Draft
wants to merge 1 commit into
base: user/romoh/verity-hash-with-cap-fix
Choose a base branch
from
+23 −2
Draft

Enable uki flow #69

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions toolkit/tools/imagecustomizerapi/mountidentifiertype.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@ const (

MountIdentifierTypeDeviceMapper MountIdentifierType = "device-mapper"

MountIdentifierTypeOverlay MountIdentifierType = "overlay"

// MountIdentifierTypeDefault uses the default type, which is PARTUUID.
MountIdentifierTypeDefault MountIdentifierType = ""
)
Expand Down
11 changes: 11 additions & 0 deletions toolkit/tools/pkg/imagecustomizerlib/customizeverity.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,8 @@ func updateGrubConfigForVerity(rootfsVerity imagecustomizerapi.Verity, rootHash
partIdToPartUuid map[string]string, partitions []diskutils.PartitionInfo,
rootHashSignatureArgument string, requireRootHashSignatureArgument string, bootPartitionUuid string,
) error {
logger.Log.Debugf("---- debug ---- updateGrubConfigForVerity()")

var err error

newArgs, err := constructVerityKernelCmdlineArgs(rootfsVerity, rootHash, partIdToPartUuid, partitions,
Expand All @@ -123,6 +125,8 @@ func updateGrubConfigForVerity(rootfsVerity imagecustomizerapi.Verity, rootHash
return fmt.Errorf("failed to generate verity kernel arguments:\n%w", err)
}

logger.Log.Debugf("---- debug ---- updateGrubConfigForVerity() - newArgs=(%s)", newArgs)

grub2Config, err := file.Read(grubCfgFullPath)
if err != nil {
return fmt.Errorf("failed to read grub config:\n%w", err)
Expand Down Expand Up @@ -287,12 +291,16 @@ func updateUkiKernelArgsForVerity(rootfsVerity imagecustomizerapi.Verity, rootHa
partIdToPartUuid map[string]string, partitions []diskutils.PartitionInfo, buildDir string,
rootHashSignatureArgument string, requireRootHashSignatureArgument string, bootPartitionUuid string,
) error {
logger.Log.Debugf("---- debug ---- updateUkiKernelArgsForVerity()")

newArgs, err := constructVerityKernelCmdlineArgs(rootfsVerity, rootHash, partIdToPartUuid, partitions,
rootHashSignatureArgument, requireRootHashSignatureArgument, bootPartitionUuid)
if err != nil {
return fmt.Errorf("failed to generate verity kernel arguments:\n%w", err)
}

logger.Log.Debugf("---- debug ---- updateUkiKernelArgsForVerity() - newArgs=(%s)", newArgs)

// UKI is enabled, update ukify kernel cmdline args file instead of grub.cfg.
err = appendKernelArgsToUkiCmdlineFile(buildDir, newArgs)
if err != nil {
Expand All @@ -306,6 +314,7 @@ func generateSignedRootHashArtifacts(deviceId string, deviceRootHash string, out
requireSignedRootfsRootHash bool, requireSignedRootHashes bool,
) (rootHashSignatureArgument string, requireRootHashSignatureArgument string, err error) {

logger.Log.Debugf("---- debug ---- generateSignedRootHashArtifacts()")
if !outputVerityHashes {
return "", "", nil
}
Expand All @@ -325,9 +334,11 @@ func generateSignedRootHashArtifacts(deviceId string, deviceRootHash string, out

// ToDo: how do we handle multiple verity device?
if requireSignedRootfsRootHash {
logger.Log.Debugf("---- debug ---- generateSignedRootHashArtifacts() - adding systemd.verity_root_options=root-hash-signature")
rootHashSignatureArgument = "systemd.verity_root_options=root-hash-signature=" + rootHashSignedFileImagePath
}
if requireSignedRootHashes {
logger.Log.Debugf("---- debug ---- generateSignedRootHashArtifacts() - adding dm_verity.require_signatures=1")
requireRootHashSignatureArgument = "dm_verity.require_signatures=1"
}

Expand Down
3 changes: 3 additions & 0 deletions toolkit/tools/pkg/imagecustomizerlib/imagecustomizer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -921,6 +921,9 @@ func customizeVerityImageHelper(buildDir string, baseConfigPath string, config *
return err
}

logger.Log.Debugf("---- debug ---- rootHashSignatureArgument=(%s)", rootHashSignatureArgument)
logger.Log.Debugf("---- debug ---- requireRootHashSignatureArgument=(%s)", requireRootHashSignatureArgument)

if config.OS.Uki != nil {
// UKI is enabled, update kernel cmdline args file instead of grub.cfg.
err = updateUkiKernelArgsForVerity(rootfsVerity, rootHash, partIdToPartUuid, diskPartitions, buildDir,
Expand Down
9 changes: 7 additions & 2 deletions toolkit/tools/pkg/imagecustomizerlib/partitionutils.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -245,7 +245,7 @@ func fstabEntriesToMountPoints(fstabEntries []diskutils.FstabEntry, diskPartitio
return nil, err
}

// ToDo: device mapper returns an empty string
// ToDo: device mapper and overlay return an empty string
if source == "" {
continue
}
Expand Down Expand Up @@ -312,7 +312,8 @@ func findSourcePartitionHelper(source string,
var partition diskutils.PartitionInfo
var partitionIndex int

if mountIdType != imagecustomizerapi.MountIdentifierTypeDeviceMapper {
if mountIdType != imagecustomizerapi.MountIdentifierTypeDeviceMapper &&
mountIdType != imagecustomizerapi.MountIdentifierTypeOverlay {
partition, partitionIndex, err = findPartition(mountIdType, mountId, partitions)
if err != nil {
return imagecustomizerapi.MountIdentifierTypeDefault, diskutils.PartitionInfo{}, 0, err
Expand Down Expand Up @@ -377,6 +378,10 @@ func parseSourcePartition(source string) (imagecustomizerapi.MountIdentifierType
return imagecustomizerapi.MountIdentifierTypeDeviceMapper, deviceMapperValue, nil
}

if source == "overlay" {
return imagecustomizerapi.MountIdentifierTypeOverlay, "", nil
}

err := fmt.Errorf("unknown fstab source type (%s)", source)
return imagecustomizerapi.MountIdentifierTypeDefault, "", err
}
Expand Down