Skip to content

Commit bb67248

Browse files
traviertravier
committed
wip
1 parent 3e7e6dd commit bb67248

20 files changed

+235
-37
lines changed

‎examples/.gitignore‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,9 @@
33
*.img
44
*.qcow2
55
backups
6-
bootc-bls/bootc
7-
bootc-bls/extra-fcos/usr/bin/bootc
8-
bootc-bls/extra-fcos/usr/lib/dracut/modules.d/37bootc/bootc-initramfs-setup
9-
bootc-bls/extra/usr/bin/bootc
10-
bootc-bls/extra/usr/lib/dracut/modules.d/37bootc/bootc-initramfs-setup
6+
bootc
117
bootc-bls/iid
128
bootc-bls/secureboot
139
bootc-bls/tmp
10+
bootc-initramfs-setup
1411
systemd-bootx64.efi

‎examples/bootc-bls/Containerfile‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -53,15 +53,17 @@ if [[ "$(grep -c "VARIANT=\"CoreOS\"" /etc/os-release)" -eq 1 ]]; then
5353
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
5454

5555
# We don't want openh264
56-
rm -f "/etc/yum.repos.d/fedora-cisco-openh264.repo"
56+
rm -f '/etc/yum.repos.d/fedora-cisco-openh264.repo'
5757

5858
# Install fsverity utils to re-enable fsverity on repo objects after
5959
# transposefs step when reprovisionning the root disk
6060
dnf install -y fsverity-utils
61+
dnf clean all
6162
fi
62-
EOF
6363

64-
# need to have bootc-initramfs-setup in the initramfs so we need this
65-
RUN set -x; \
66-
kver=$(cd /usr/lib/modules && echo *); \
67-
dracut -vf --install "/etc/passwd /etc/group" /usr/lib/modules/$kver/initramfs.img $kver;
64+
# Rebuild the initramfs to get bootc-initramfs-setup
65+
kver=$(cd /usr/lib/modules && echo *)
66+
dracut -vf --install "/etc/passwd /etc/group" /usr/lib/modules/$kver/initramfs.img $kver
67+
68+
bootc container lint
69+
EOF

‎examples/bootc-bls/Containerfile.cocl‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
FROM quay.io/fedora/fedora-coreos:stable
2+
3+
FROM quay.io/afrosi_rh/kbs-client-image:latest as kbc
4+
FROM quay.io/confidential-clusters/clevis-pin-trustee as clevis
5+
FROM quay.io/confidential-clusters/ignition:clevis-pin-trustee as ignition
6+
7+
FROM quay.io/fedora/fedora-coreos:stable
8+
COPY . /
9+
10+
COPY --from=kbc /usr/local/bin/kbs-client /usr/bin/trustee-attester
11+
COPY --from=clevis /usr/bin/clevis-pin-trustee /usr/bin/clevis-pin-trustee
12+
COPY --from=clevis /usr/bin/clevis-encrypt-trustee /usr/bin/clevis-encrypt-trustee
13+
COPY --from=clevis /usr/bin/clevis-decrypt-trustee /usr/bin/clevis-decrypt-trustee
14+
COPY --from=ignition /usr/bin/ignition /usr/lib/dracut/modules.d/30ignition/ignition
15+
16+
RUN <<EOF
17+
set -euxo pipefail
18+
19+
# Disable root password for debug/testing/demos
20+
passwd -d root
21+
22+
if [[ "$(grep -c "VARIANT=\"CoreOS\"" /etc/os-release)" -eq 1 ]]; then
23+
# Disable some units that currently don't work for us
24+
sed -i 's/enable coreos-warn-invalid-mounts.service//' \
25+
/usr/lib/systemd/system-preset/45-fcos.preset
26+
sed -i 's/enable coreos-populate-lvmdevices.service//' \
27+
/usr/lib/systemd/system-preset/45-coreos-populate-lvmdevices.preset
28+
29+
# Fix dependencies
30+
sed -i 's|ExecStart=/usr/sbin/coreos-boot-edit|ExecStart=true|' \
31+
/usr/lib/dracut/modules.d/35coreos-ignition/coreos-boot-edit.service
32+
sed -i 's|ExecStart=/usr/bin/rdcore verify-unique-fs-label --rereadpt boot|ExecStart=true|' \
33+
/usr/lib/dracut/modules.d/35coreos-ignition/coreos-ignition-unique-boot.service
34+
35+
sed -i 's/ConditionKernelCommandLine=ostree/ConditionKernelCommandLine=composefs/' \
36+
/usr/lib/dracut/modules.d/40ignition-ostree/*
37+
sed -i 's/After=ostree-prepare-root.service/After=bootc-initramfs-setup.service/' \
38+
/usr/lib/dracut/modules.d/40ignition-ostree/*
39+
sed -i 's/Requires=ostree-prepare-root.service/Requires=bootc-initramfs-setup.service/' \
40+
/usr/lib/dracut/modules.d/40ignition-ostree/*
41+
42+
sed -i '/Type=oneshot/a ExecStart=bash -c "udevadm settle; sleep 1"' \
43+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-growfs.service
44+
45+
sed -i 's|ExecStart=/usr/sbin/ignition-ostree-mount-var mount|ExecStart=true|' \
46+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-var.service
47+
sed -i 's|ExecStop=/usr/sbin/ignition-ostree-mount-var umount|ExecStart=true|' \
48+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-var.service
49+
50+
sed -i 's|ExecStart=/usr/sbin/ignition-ostree-firstboot-uuid boot|ExecStart=true|' \
51+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-uuid-boot.service
52+
sed -i 's|ExecStart=/usr/sbin/ignition-ostree-firstboot-uuid root|ExecStart=true|' \
53+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-uuid-root.service
54+
55+
sed -i 's/find/find fsverity/' \
56+
/usr/lib/dracut/modules.d/40ignition-ostree/module-setup.sh
57+
58+
sed -i 's|chcon -v --reference "${saved_root}" /sysroot # the root of the fs itself|chcon -v system_u:object_r:root_t:s0 /sysroot # the root of the fs itself|' \
59+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
60+
sed -i '/chattr +i/d' \
61+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
62+
sed -i '/chcon -v system_u:object_r:root_t:s0 \/sysroot # the root of the fs itself/a echo "Enabling fs-verity again..."' \
63+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
64+
sed -i '/echo "Enabling fs-verity again..."/a find /sysroot/composefs/objects -type f -exec fsverity enable {} \\;' \
65+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
66+
67+
# We don't want openh264
68+
rm -f '/etc/yum.repos.d/fedora-cisco-openh264.repo'
69+
70+
# Install fsverity utils to re-enable fsverity on repo objects after
71+
# transposefs step when reprovisionning the root disk
72+
dnf install -y fsverity-utils
73+
dnf clean all
74+
fi
75+
76+
# Rebuild the initramfs to get bootc-initramfs-setup & our other dracut modules
77+
kver=$(cd /usr/lib/modules && echo *)
78+
dracut -vf --install "/etc/passwd /etc/group" /usr/lib/modules/$kver/initramfs.img $kver
79+
80+
bootc container lint
81+
EOF

‎examples/bootc-bls/Containerfile.systemdboot‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
FROM quay.io/fedora/fedora-bootc-bls:42 AS base
2+
3+
COPY /systemd-bootx64.efi /usr/lib/bootupd/updates/EFI/fedora/grubx64.efi

‎examples/bootc-bls/Containerfile.uki‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -44,11 +44,11 @@ RUN --mount=type=secret,id=key \
4444
--secureboot-certificate "/run/secrets/cert" \
4545
--output "/boot/EFI/Linux/$kver.efi.extra.d/ignition.addon.efi"
4646

47-
sbsign \
48-
--key "/run/secrets/key" \
49-
--cert "/run/secrets/cert" \
50-
"/usr/lib/systemd/boot/efi/systemd-bootx64.efi" \
51-
--output "/boot/systemd-bootx64.efi"
47+
# sbsign \
48+
# --key "/run/secrets/key" \
49+
# --cert "/run/secrets/cert" \
50+
# "/usr/lib/systemd/boot/efi/systemd-bootx64.efi" \
51+
# --output "/boot/systemd-bootx64.efi"
5252
EOF
5353

5454
FROM base as final

‎examples/bootc-bls/build-bootc-bls‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ cd "${0%/*}"
77
FROM="${FROM:-quay.io/fedora/fedora-bootc:42}"
88
TAG="${TAG:-quay.io/fedora/fedora-bootc-bls:42}"
99
EXTRA="${EXTRA:-extra}"
10+
CONTAINERFILE="${CONTAINERFILE:-Containerfile}"
1011

1112
# cargo build --release --features=composefs-backend
1213

@@ -19,6 +20,6 @@ mkdir -p tmp
1920
podman build \
2021
--from "${FROM}" \
2122
-t "${TAG}" \
22-
-f Containerfile \
23+
-f "${CONTAINERFILE}" \
2324
--iidfile=iid \
2425
"${EXTRA}"

‎examples/bootc-bls/build-bootc-uki‎

Lines changed: 31 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -9,17 +9,6 @@ cd "${0%/*}"
99
FROM="${FROM:-quay.io/fedora/fedora-bootc-bls:42}"
1010
TAG="${TAG:-quay.io/fedora/fedora-bootc-uki:42}"
1111

12-
cp ../../target/release/bootc .
13-
14-
mount /dev/vdb3 tmp
15-
16-
# rm -rf tmp/sysroot
17-
mkdir -p tmp/sysroot/composefs
18-
19-
IMAGE_ID="$(sed s/sha256:// iid)"
20-
./bootc internals cfs --repo tmp/sysroot/composefs oci pull containers-storage:"${IMAGE_ID}"
21-
COMPOSEFS_FSVERITY=$(./bootc internals cfs --repo tmp/sysroot/composefs oci compute-id --bootable "${IMAGE_ID}")
22-
2312
# See: https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot
2413
# Alternative to generate keys for testing: `sbctl create-keys`
2514
if [[ ! -d "secureboot" ]]; then
@@ -36,9 +25,39 @@ if [[ ! -d "secureboot" ]]; then
3625
popd > /dev/null
3726
fi
3827

39-
# For debugging, add --no-cache to podman command
28+
if [[ ! -f "systemd-bootx64.efi" ]]; then
29+
# Sign systemd-boot once and re-use it for all builds to keep it unchanged
30+
sudo podman run --rm \
31+
--security-opt label=disable \
32+
--secret=id=key,src=secureboot/db.key \
33+
--secret=id=cert,src=secureboot/db.crt \
34+
--volume "$PWD:/var/srv" \
35+
--workdir "/var/srv"
36+
"${FROM}" \
37+
bash -c "rm -f '/etc/yum.repos.d/fedora-cisco-openh264.repo'; dnf install -y sbsigntools systemd-boot-unsigned; sbsign --key '/run/secrets/key' --cert '/run/secrets/cert' '/usr/lib/systemd/boot/efi/systemd-bootx64.efi' --output '/var/srv/systemd-bootx64.efi'"
38+
fi
39+
40+
# Replace GRUB with a signed systemd-boot binary
4041
sudo podman build \
4142
--from "${FROM}" \
43+
-t "${TAG}-systemdboot" \
44+
-f Containerfile.systemdboot
45+
46+
cp ../../target/release/bootc .
47+
48+
# Workaround: Mount a filesystem where fs-verity is enabled
49+
mount /dev/vdb3 tmp
50+
51+
# rm -rf tmp/sysroot
52+
mkdir -p tmp/sysroot/composefs
53+
54+
IMAGE_ID="$(sed s/sha256:// iid)"
55+
./bootc internals cfs --repo tmp/sysroot/composefs oci pull containers-storage:"${IMAGE_ID}"
56+
COMPOSEFS_FSVERITY=$(./bootc internals cfs --repo tmp/sysroot/composefs oci compute-id --bootable "${IMAGE_ID}")
57+
58+
# For debugging, add --no-cache to podman command
59+
sudo podman build \
60+
--from "${FROM}-systemdboot" \
4261
-t "${TAG}" \
4362
--build-arg=COMPOSEFS_FSVERITY="${COMPOSEFS_FSVERITY}" \
4463
-f Containerfile.uki \

‎examples/bootc-bls/build-fcos-bls‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/bin/bash
22

3-
export FROM="quay.io/fedora/fedora-coreos:stable"
4-
export TAG="quay.io/fedora/fedora-coreos-bls:stable"
3+
export FROM="quay.io/fedora/fedora-coreos:42.20250901.3.0"
4+
export TAG="quay.io/fedora/fedora-coreos-bls:42.20250901.3.0"
55
exec ./build-bootc-bls

‎examples/bootc-bls/build-fcos-bls-cocl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
3+
export FROM="quay.io/fedora/fedora-coreos:42.20250901.3.0"
4+
export TAG="quay.io/fedora/fedora-coreos-bls-cocl:42.20250901.3.0"
5+
export CONTAINERFILE="Containerfile.cocl"
6+
exec ./build-bootc-bls

‎examples/bootc-bls/build-fcos-uki‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/bin/bash
22

3-
export FROM="quay.io/fedora/fedora-coreos-bls:stable"
4-
export TAG="quay.io/fedora/fedora-coreos-uki:stable"
3+
export FROM="quay.io/fedora/fedora-coreos-bls:42.20250901.3.0"
4+
export TAG="quay.io/fedora/fedora-coreos-uki:42.20250901.3.0"
55
exec ./build-bootc-uki

0 commit comments

Comments
 (0)