Skip to content

Commit e2d9e60

Browse files
travierJohan-Liebert1jeckersb
committed
examples: Add initial examples for bls & uki, bootc & FCOS
Co-Authored-By: Pragyan Poudyal <[email protected]> Co-Authored-By: John Eckersberg <[email protected]> Signed-off-by: Timothée Ravier <[email protected]>
1 parent dbb047b commit e2d9e60

28 files changed

+863
-0
lines changed

‎examples/.gitignore‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
*.addon.efi
2+
*.ign
3+
*.img
4+
*.qcow2
5+
backups
6+
bootc
7+
bootc-bls/iid
8+
bootc-bls/secureboot
9+
bootc-bls/tmp
10+
bootc-initramfs-setup
11+
systemd-bootx64.efi

‎examples/bootc-bls/Containerfile‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
FROM quay.io/fedora/fedora-bootc:42
2+
COPY . /
3+
4+
RUN <<EOF
5+
set -euxo pipefail
6+
7+
# Disable root password for debug/testing/demos
8+
passwd -d root
9+
10+
if [[ "$(grep -c "VARIANT=\"CoreOS\"" /etc/os-release)" -eq 1 ]]; then
11+
# Disable some units that currently don't work for us
12+
sed -i 's/enable coreos-warn-invalid-mounts.service//' \
13+
/usr/lib/systemd/system-preset/45-fcos.preset
14+
sed -i 's/enable coreos-populate-lvmdevices.service//' \
15+
/usr/lib/systemd/system-preset/45-coreos-populate-lvmdevices.preset
16+
sed -i 's/enable coreos-oci-migration-motd.service//' \
17+
/usr/lib/systemd/system-preset/35-oci-migration.preset
18+
19+
# Fix dependencies
20+
sed -i 's|ExecStart=/usr/sbin/coreos-boot-edit|ExecStart=true|' \
21+
/usr/lib/dracut/modules.d/35coreos-ignition/coreos-boot-edit.service
22+
sed -i 's|ExecStart=/usr/bin/rdcore verify-unique-fs-label --rereadpt boot|ExecStart=true|' \
23+
/usr/lib/dracut/modules.d/35coreos-ignition/coreos-ignition-unique-boot.service
24+
25+
sed -i 's/ConditionKernelCommandLine=ostree/ConditionKernelCommandLine=composefs/' \
26+
/usr/lib/dracut/modules.d/40ignition-ostree/*
27+
sed -i 's/After=ostree-prepare-root.service/After=bootc-initramfs-setup.service/' \
28+
/usr/lib/dracut/modules.d/40ignition-ostree/*
29+
sed -i 's/Requires=ostree-prepare-root.service/Requires=bootc-initramfs-setup.service/' \
30+
/usr/lib/dracut/modules.d/40ignition-ostree/*
31+
32+
sed -i '/Type=oneshot/a ExecStart=bash -c "udevadm settle; sleep 1"' \
33+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-growfs.service
34+
35+
sed -i 's|ExecStart=/usr/sbin/ignition-ostree-mount-var mount|ExecStart=true|' \
36+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-var.service
37+
sed -i 's|ExecStop=/usr/sbin/ignition-ostree-mount-var umount|ExecStart=true|' \
38+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-var.service
39+
40+
sed -i 's|ExecStart=/usr/sbin/ignition-ostree-firstboot-uuid boot|ExecStart=true|' \
41+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-uuid-boot.service
42+
sed -i 's|ExecStart=/usr/sbin/ignition-ostree-firstboot-uuid root|ExecStart=true|' \
43+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-uuid-root.service
44+
45+
sed -i 's/find/find fsverity/' \
46+
/usr/lib/dracut/modules.d/40ignition-ostree/module-setup.sh
47+
48+
sed -i 's|chcon -v --reference "${saved_root}" /sysroot # the root of the fs itself|chcon -v system_u:object_r:root_t:s0 /sysroot # the root of the fs itself|' \
49+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
50+
sed -i '/chattr +i/d' \
51+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
52+
sed -i '/chcon -v system_u:object_r:root_t:s0 \/sysroot # the root of the fs itself/a echo "Enabling fs-verity again..."' \
53+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
54+
sed -i '/echo "Enabling fs-verity again..."/a find /sysroot/composefs/objects -type f -exec fsverity enable {} \\;' \
55+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
56+
57+
# We don't want openh264
58+
rm -f '/etc/yum.repos.d/fedora-cisco-openh264.repo'
59+
60+
# Install fsverity utils to re-enable fsverity on repo objects after
61+
# transposefs step when reprovisionning the root disk
62+
dnf install -y fsverity-utils
63+
dnf clean all
64+
fi
65+
66+
# Rebuild the initramfs to get bootc-initramfs-setup
67+
kver=$(cd /usr/lib/modules && echo *)
68+
dracut -vf --install "/etc/passwd /etc/group" /usr/lib/modules/$kver/initramfs.img $kver
69+
70+
bootc container lint
71+
EOF

‎examples/bootc-bls/Containerfile.cocl‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
ARG BASE
2+
FROM $BASE
3+
4+
FROM quay.io/afrosi_rh/kbs-client-image:latest as kbc
5+
FROM quay.io/confidential-clusters/clevis-pin-trustee as clevis
6+
FROM quay.io/confidential-clusters/ignition:clevis-pin-trustee as ignition
7+
8+
FROM $BASE
9+
COPY . /
10+
11+
COPY --from=kbc /usr/local/bin/kbs-client /usr/bin/trustee-attester
12+
COPY --from=clevis /usr/bin/clevis-pin-trustee /usr/bin/clevis-pin-trustee
13+
COPY --from=clevis /usr/bin/clevis-encrypt-trustee /usr/bin/clevis-encrypt-trustee
14+
COPY --from=clevis /usr/bin/clevis-decrypt-trustee /usr/bin/clevis-decrypt-trustee
15+
COPY --from=ignition /usr/bin/ignition /usr/lib/dracut/modules.d/30ignition/ignition
16+
17+
RUN <<EOF
18+
set -euxo pipefail
19+
20+
# Disable root password for debug/testing/demos
21+
passwd -d root
22+
23+
if [[ "$(grep -c "VARIANT=\"CoreOS\"" /etc/os-release)" -eq 1 ]]; then
24+
# Disable some units that currently don't work for us
25+
sed -i 's/enable coreos-warn-invalid-mounts.service//' \
26+
/usr/lib/systemd/system-preset/45-fcos.preset
27+
sed -i 's/enable coreos-populate-lvmdevices.service//' \
28+
/usr/lib/systemd/system-preset/45-coreos-populate-lvmdevices.preset
29+
sed -i 's/enable coreos-oci-migration-motd.service//' \
30+
/usr/lib/systemd/system-preset/35-oci-migration.preset
31+
32+
# Fix dependencies
33+
sed -i 's|ExecStart=/usr/sbin/coreos-boot-edit|ExecStart=true|' \
34+
/usr/lib/dracut/modules.d/35coreos-ignition/coreos-boot-edit.service
35+
sed -i 's|ExecStart=/usr/bin/rdcore verify-unique-fs-label --rereadpt boot|ExecStart=true|' \
36+
/usr/lib/dracut/modules.d/35coreos-ignition/coreos-ignition-unique-boot.service
37+
38+
sed -i 's/ConditionKernelCommandLine=ostree/ConditionKernelCommandLine=composefs/' \
39+
/usr/lib/dracut/modules.d/40ignition-ostree/*
40+
sed -i 's/After=ostree-prepare-root.service/After=bootc-initramfs-setup.service/' \
41+
/usr/lib/dracut/modules.d/40ignition-ostree/*
42+
sed -i 's/Requires=ostree-prepare-root.service/Requires=bootc-initramfs-setup.service/' \
43+
/usr/lib/dracut/modules.d/40ignition-ostree/*
44+
45+
sed -i '/Type=oneshot/a ExecStart=bash -c "udevadm settle; sleep 1"' \
46+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-growfs.service
47+
48+
sed -i 's|ExecStart=/usr/sbin/ignition-ostree-mount-var mount|ExecStart=true|' \
49+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-var.service
50+
sed -i 's|ExecStop=/usr/sbin/ignition-ostree-mount-var umount|ExecStart=true|' \
51+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-var.service
52+
53+
sed -i 's|ExecStart=/usr/sbin/ignition-ostree-firstboot-uuid boot|ExecStart=true|' \
54+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-uuid-boot.service
55+
sed -i 's|ExecStart=/usr/sbin/ignition-ostree-firstboot-uuid root|ExecStart=true|' \
56+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-uuid-root.service
57+
58+
sed -i 's/find/find fsverity/' \
59+
/usr/lib/dracut/modules.d/40ignition-ostree/module-setup.sh
60+
61+
sed -i 's|chcon -v --reference "${saved_root}" /sysroot # the root of the fs itself|chcon -v system_u:object_r:root_t:s0 /sysroot # the root of the fs itself|' \
62+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
63+
sed -i '/chattr +i/d' \
64+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
65+
sed -i '/chcon -v system_u:object_r:root_t:s0 \/sysroot # the root of the fs itself/a echo "Enabling fs-verity again..."' \
66+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
67+
sed -i '/echo "Enabling fs-verity again..."/a find /sysroot/composefs/objects -type f -exec fsverity enable {} \\;' \
68+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
69+
70+
# We don't want openh264
71+
rm -f '/etc/yum.repos.d/fedora-cisco-openh264.repo'
72+
73+
# Install fsverity utils to re-enable fsverity on repo objects after
74+
# transposefs step when reprovisionning the root disk
75+
dnf install -y fsverity-utils
76+
dnf clean all
77+
fi
78+
79+
# Rebuild the initramfs to get bootc-initramfs-setup & our other dracut modules
80+
kver=$(cd /usr/lib/modules && echo *)
81+
dracut -vf --install "/etc/passwd /etc/group" /usr/lib/modules/$kver/initramfs.img $kver
82+
83+
bootc container lint
84+
EOF
85+
86+
# RUN sed -i "s/42.20250901.3.0/42.20250901.3.1/g" /usr/lib/os-release
87+
# LABEL org.opencontainers.image.version=42.20250901.3.0

‎examples/bootc-bls/Containerfile.systemdboot‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
FROM quay.io/fedora/fedora-bootc-bls:42 AS base
2+
3+
COPY /systemd-bootx64.efi /usr/lib/bootupd/updates/EFI/fedora/grubx64.efi

‎examples/bootc-bls/Containerfile.uki‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
FROM quay.io/fedora/fedora-bootc-bls:42 AS base
2+
3+
FROM base as kernel
4+
5+
ARG COMPOSEFS_FSVERITY
6+
7+
RUN --mount=type=secret,id=key \
8+
--mount=type=secret,id=cert <<EOF
9+
set -eux
10+
11+
mkdir -p /etc/kernel /etc/dracut.conf.d
12+
{
13+
printf "composefs=${COMPOSEFS_FSVERITY} root=UUID=910678ff-f77e-4a7d-8d53-86f2ac47a823 rw"
14+
printf " selinux=1 enforcing=0 audit=0"
15+
# printf " console=tty0 console=ttyS0,115000n"
16+
printf " console=ttyS0,115000n rd.systemd.debug_shell=1 rd.systemd.default_debug_tty=tty0"
17+
printf "\n"
18+
} > /etc/kernel/cmdline
19+
20+
rm -f "/etc/yum.repos.d/fedora-cisco-openh264.repo"
21+
dnf install -y systemd-ukify sbsigntools systemd-boot-unsigned
22+
23+
kver=$(cd /usr/lib/modules && echo *)
24+
mkdir -p "/boot/EFI/Linux"
25+
mkdir -p "/boot/EFI/Linux/$kver.efi.extra.d"
26+
27+
ukify build \
28+
--linux "/usr/lib/modules/$kver/vmlinuz" \
29+
--initrd "/usr/lib/modules/$kver/initramfs.img" \
30+
--uname="${kver}" \
31+
--cmdline "@/etc/kernel/cmdline" \
32+
--os-release "@/etc/os-release" \
33+
--signtool sbsign \
34+
--secureboot-private-key "/run/secrets/key" \
35+
--secureboot-certificate "/run/secrets/cert" \
36+
--measure \
37+
--json pretty \
38+
--output "/boot/EFI/Linux/$kver.efi"
39+
40+
ukify build \
41+
--cmdline "ignition.firstboot ignition.platform.id=qemu" \
42+
--signtool sbsign \
43+
--secureboot-private-key "/run/secrets/key" \
44+
--secureboot-certificate "/run/secrets/cert" \
45+
--output "/boot/EFI/Linux/$kver.efi.extra.d/ignition.addon.efi"
46+
47+
# sbsign \
48+
# --key "/run/secrets/key" \
49+
# --cert "/run/secrets/cert" \
50+
# "/usr/lib/systemd/boot/efi/systemd-bootx64.efi" \
51+
# --output "/boot/systemd-bootx64.efi"
52+
EOF
53+
54+
FROM base as final
55+
56+
RUN --mount=type=bind,from=kernel,target=/_mount/kernel <<EOF
57+
kver=$(cd /usr/lib/modules && echo *)
58+
mkdir -p /boot/EFI/Linux
59+
# We put the UKI in /boot for now due to composefs verity not being the
60+
# same due to mtime of /usr/lib/modules being changed
61+
cp -r /_mount/kernel/boot/* /boot/
62+
EOF
63+
64+
FROM base as final-final
65+
COPY --from=final /boot /boot

‎examples/bootc-bls/build-bootc-bls‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#!/bin/bash
2+
3+
set -eux
4+
5+
cd "${0%/*}"
6+
7+
FROM="${FROM:-quay.io/fedora/fedora-bootc:42}"
8+
TAG="${TAG:-quay.io/fedora/fedora-bootc-bls:42}"
9+
EXTRA="${EXTRA:-extra}"
10+
CONTAINERFILE="${CONTAINERFILE:-Containerfile}"
11+
12+
# cargo build --release --features=composefs-backend
13+
14+
mkdir -p "${EXTRA}/usr/bin/"
15+
cp ../../target/release/bootc "${EXTRA}/usr/bin/"
16+
cp ../../target/release/bootc-initramfs-setup "${EXTRA}/usr/lib/dracut/modules.d/37bootc/"
17+
18+
mkdir -p tmp
19+
20+
podman build \
21+
--from "${FROM}" \
22+
--build-arg BASE="${FROM}" \
23+
-t "${TAG}" \
24+
-f "${CONTAINERFILE}" \
25+
--iidfile=iid \
26+
"${EXTRA}"

‎examples/bootc-bls/build-bootc-uki‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
#!/bin/bash
2+
3+
set -eux
4+
5+
cd "${0%/*}"
6+
7+
# cargo build --release --features=composefs-backend
8+
9+
FROM="${FROM:-quay.io/fedora/fedora-bootc-bls:42}"
10+
TAG="${TAG:-quay.io/fedora/fedora-bootc-uki:42}"
11+
12+
# See: https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot
13+
# Alternative to generate keys for testing: `sbctl create-keys`
14+
if [[ ! -d "secureboot" ]]; then
15+
echo "Generating test Secure Boot keys"
16+
mkdir secureboot
17+
pushd secureboot > /dev/null
18+
uuidgen --random > GUID.txt
19+
openssl req -newkey rsa:4096 -nodes -keyout PK.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Platform Key/" -out PK.crt
20+
openssl x509 -outform DER -in PK.crt -out PK.cer
21+
openssl req -newkey rsa:4096 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Key Exchange Key/" -out KEK.crt
22+
openssl x509 -outform DER -in KEK.crt -out KEK.cer
23+
openssl req -newkey rsa:4096 -nodes -keyout db.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Signature Database key/" -out db.crt
24+
openssl x509 -outform DER -in db.crt -out db.cer
25+
popd > /dev/null
26+
fi
27+
28+
if [[ ! -f "systemd-bootx64.efi" ]]; then
29+
# Sign systemd-boot once and re-use it for all builds to keep it unchanged
30+
sudo podman run --rm \
31+
--security-opt label=disable \
32+
--volume "$PWD/secureboot/db.key:/run/secrets/key" \
33+
--volume "$PWD/secureboot/db.crt:/run/secrets/cert" \
34+
--volume "$PWD:/var/srv" \
35+
--workdir "/var/srv" \
36+
"${FROM}" \
37+
bash -c "rm -f '/etc/yum.repos.d/fedora-cisco-openh264.repo'; dnf install -y sbsigntools systemd-boot-unsigned; sbsign --key '/run/secrets/key' --cert '/run/secrets/cert' '/usr/lib/systemd/boot/efi/systemd-bootx64.efi' --output '/var/srv/systemd-bootx64.efi'"
38+
fi
39+
40+
# Replace GRUB with a signed systemd-boot binary
41+
sudo podman build \
42+
--from "${FROM}" \
43+
-t "${FROM}-systemdboot" \
44+
--iidfile=iid \
45+
-f Containerfile.systemdboot
46+
47+
cp ../../target/release/bootc .
48+
49+
# Workaround: Mount a filesystem where fs-verity is enabled
50+
mount /dev/vdb3 tmp
51+
52+
# rm -rf tmp/sysroot
53+
mkdir -p tmp/sysroot/composefs
54+
55+
IMAGE_ID="$(sed s/sha256:// iid)"
56+
./bootc internals cfs --repo tmp/sysroot/composefs oci pull containers-storage:"${IMAGE_ID}"
57+
COMPOSEFS_FSVERITY=$(./bootc internals cfs --repo tmp/sysroot/composefs oci compute-id --bootable "${IMAGE_ID}")
58+
59+
# For debugging, add --no-cache to podman command
60+
sudo podman build \
61+
--from "${FROM}-systemdboot" \
62+
-t "${TAG}" \
63+
--build-arg=COMPOSEFS_FSVERITY="${COMPOSEFS_FSVERITY}" \
64+
-f Containerfile.uki \
65+
--secret=id=key,src=secureboot/db.key \
66+
--secret=id=cert,src=secureboot/db.crt
67+
68+
# rm -rf tmp/efi
69+
# mkdir -p tmp/efi
70+
# ./bootc internals cfs --repo tmp/sysroot/composefs oci pull containers-storage:"${IMAGE_ID}"
71+
# ./bootc internals cfs --repo tmp/sysroot/composefs oci compute-id --bootable "${IMAGE_ID}"
72+
# ./bootc internals cfs --repo tmp/sysroot/composefs oci prepare-boot "${IMAGE_ID}" --bootdir tmp/efi
73+
74+
umount tmp

‎examples/bootc-bls/build-fcos-bls‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/bash
2+
3+
export FROM="quay.io/fedora/fedora-coreos:42.20250901.3.0"
4+
export TAG="quay.io/fedora/fedora-coreos-bls:42.20250901.3.0"
5+
exec ./build-bootc-bls

‎examples/bootc-bls/build-fcos-bls-cocl‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash
2+
3+
export FROM="quay.io/fedora/fedora-coreos:42.20250901.3.0"
4+
export TAG="quay.io/fedora/fedora-coreos-bls-cocl:42.20250901.3.0"
5+
# export TAG="quay.io/fedora/fedora-coreos-bls-cocl:42.20250901.3.1"
6+
export CONTAINERFILE="Containerfile.cocl"
7+
export EXTRA="extra-cocl"
8+
exec ./build-bootc-bls

‎examples/bootc-bls/build-fcos-uki‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/bash
2+
3+
export FROM="quay.io/fedora/fedora-coreos-bls:42.20250901.3.0"
4+
export TAG="quay.io/fedora/fedora-coreos-uki:42.20250901.3.0"
5+
exec ./build-bootc-uki

0 commit comments

Comments
 (0)