Skip to content

Commit f3dc163

Browse files
travierJohan-Liebert1jeckersb
committed
examples: Add initial bootc examples (bls & uki)
Co-Authored-By: Pragyan Poudyal <[email protected]> Co-Authored-By: John Eckersberg <[email protected]> Signed-off-by: Timothée Ravier <[email protected]>
1 parent af13b84 commit f3dc163

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

49 files changed

+2092
-0
lines changed

‎examples/.gitignore‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
*.ign
2+
*.img
3+
*.qcow2
4+
backups
5+
bootc-bls/*.addon.efi
6+
bootc-bls/*.qcow2
7+
bootc-bls/bootc
8+
bootc-bls/extra-fcos/usr/bin/bootc
9+
bootc-bls/extra-fcos/usr/lib/dracut/modules.d/37bootc/bootc-initramfs-setup
10+
bootc-bls/extra/usr/bin/bootc
11+
bootc-bls/extra/usr/lib/dracut/modules.d/37bootc/bootc-initramfs-setup
12+
bootc-bls/iid
13+
bootc-bls/secureboot
14+
bootc-bls/tmp
15+
systemd-bootx64.efi

‎examples/bootc-bls/Containerfile‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
FROM quay.io/fedora/fedora-bootc:42
2+
COPY . /
3+
4+
RUN rm /etc/yum.repos.d/fedora-cisco-openh264.repo
5+
RUN dnf install -y fsverity-utils
6+
7+
RUN passwd -d root
8+
9+
# need to have bootc-initramfs-setup in the initramfs so we need this
10+
RUN set -x; \
11+
kver=$(cd /usr/lib/modules && echo *); \
12+
dracut -vf --install "/etc/passwd /etc/group" /usr/lib/modules/$kver/initramfs.img $kver;

‎examples/bootc-bls/Containerfile.stage1‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
FROM quay.io/fedora/fedora-bootc:42
2+
COPY . /
3+
4+
RUN rm -f "/etc/yum.repos.d/fedora-cisco-openh264.repo"
5+
RUN dnf install -y fsverity-utils
6+
7+
RUN passwd -d root
8+
9+
# need to have bootc-initramfs-setup in the initramfs so we need this
10+
RUN set -x; \
11+
kver=$(cd /usr/lib/modules && echo *); \
12+
dracut -vf --install "/etc/passwd /etc/group" /usr/lib/modules/$kver/initramfs.img $kver;

‎examples/bootc-bls/Containerfile.stage2‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
FROM quay.io/fedora/fedora-bootc-base-uki:42 AS base
2+
3+
FROM base as kernel
4+
5+
ARG COMPOSEFS_FSVERITY
6+
7+
RUN --mount=type=secret,id=key \
8+
--mount=type=secret,id=cert <<EOF
9+
set -eux
10+
11+
mkdir -p /etc/kernel /etc/dracut.conf.d
12+
{
13+
printf "composefs=${COMPOSEFS_FSVERITY} root=UUID=910678ff-f77e-4a7d-8d53-86f2ac47a823 rw"
14+
printf " selinux=1 enforcing=0 audit=0"
15+
printf " console=tty0 console=ttyS0,115000n"
16+
# printf " console=ttyS0,115000n rd.systemd.debug_shell=1 rd.systemd.default_debug_tty=tty0"
17+
printf "\n"
18+
} > /etc/kernel/cmdline
19+
20+
rm -f "/etc/yum.repos.d/fedora-cisco-openh264.repo"
21+
dnf install -y systemd-ukify sbsigntools systemd-boot-unsigned
22+
23+
kver=$(cd /usr/lib/modules && echo *)
24+
mkdir -p "/boot/EFI/Linux"
25+
mkdir -p "/boot/EFI/Linux/$kver.efi.extra.d"
26+
27+
ukify build \
28+
--linux "/usr/lib/modules/$kver/vmlinuz" \
29+
--initrd "/usr/lib/modules/$kver/initramfs.img" \
30+
--uname="${kver}" \
31+
--cmdline "@/etc/kernel/cmdline" \
32+
--os-release "@/etc/os-release" \
33+
--signtool sbsign \
34+
--secureboot-private-key "/run/secrets/key" \
35+
--secureboot-certificate "/run/secrets/cert" \
36+
--measure \
37+
--json pretty \
38+
--output "/boot/EFI/Linux/$kver.efi"
39+
40+
ukify build \
41+
--cmdline "ignition.firstboot ignition.platform.id=qemu" \
42+
--signtool sbsign \
43+
--secureboot-private-key "/run/secrets/key" \
44+
--secureboot-certificate "/run/secrets/cert" \
45+
--output "/boot/EFI/Linux/$kver.efi.extra.d/ignition.addon.efi"
46+
47+
# ukify build \
48+
# --cmdline "rd.luks.uuid=luks-8ec9cda3-6b77-45d7-bb56-a95cd9e83234" \
49+
# --signtool sbsign \
50+
# --secureboot-private-key "/run/secrets/key" \
51+
# --secureboot-certificate "/run/secrets/cert" \
52+
# --output "/boot/EFI/Linux/$kver.efi.extra.d/luks.addon.efi"
53+
54+
sbsign \
55+
--key "/run/secrets/key" \
56+
--cert "/run/secrets/cert" \
57+
"/usr/lib/systemd/boot/efi/systemd-bootx64.efi" \
58+
--output "/boot/systemd-bootx64.efi"
59+
EOF
60+
61+
FROM base as final
62+
63+
RUN --mount=type=bind,from=kernel,target=/_mount/kernel <<EOF
64+
kver=$(cd /usr/lib/modules && echo *)
65+
mkdir -p /boot/EFI/Linux
66+
# We put the UKI in /boot for now due to composefs verity not being the
67+
# same due to mtime of /usr/lib/modules being changed
68+
cp -r /_mount/kernel/boot/* /boot/
69+
EOF
70+
71+
FROM base as final-final
72+
COPY --from=final /boot /boot

‎examples/bootc-bls/build-bootc-bls‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/bash
2+
3+
set -eux
4+
5+
cd "${0%/*}"
6+
7+
FROM="${FROM:-quay.io/fedora/fedora-bootc:42}"
8+
TAG="${TAG:-quay.io/fedora/fedora-bootc-bls:42}"
9+
EXTRA="${EXTRA:-extra}"
10+
11+
# cargo build --release --features=composefs-backend
12+
13+
mkdir -p "${EXTRA}/usr/bin/"
14+
cp ../../target/release/bootc "${EXTRA}/usr/bin/"
15+
cp ../../target/release/bootc-initramfs-setup "${EXTRA}/usr/lib/dracut/modules.d/37bootc/"
16+
17+
podman build \
18+
--from "${FROM}" \
19+
-t "${TAG}" \
20+
-f Containerfile \
21+
"${EXTRA}"

‎examples/bootc-bls/build-bootc-uki-base‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/bin/bash
2+
3+
set -eux
4+
5+
cd "${0%/*}"
6+
7+
FROM="${FROM:-quay.io/fedora/fedora-bootc:42}"
8+
TAG="${TAG:-quay.io/fedora/fedora-bootc-base-uki:42}"
9+
EXTRA="${EXTRA:-extra}"
10+
11+
# cargo build --release --features=composefs-backend
12+
13+
mkdir -p "${EXTRA}/usr/bin/"
14+
cp ../../target/release/bootc "${EXTRA}/usr/bin/"
15+
cp ../../target/release/bootc-initramfs-setup "${EXTRA}/usr/lib/dracut/modules.d/37bootc/"
16+
17+
mkdir -p tmp
18+
19+
podman build \
20+
--from "${FROM}" \
21+
-t "${TAG}" \
22+
-f Containerfile.stage1 \
23+
--iidfile=iid \
24+
"${EXTRA}"

‎examples/bootc-bls/build-bootc-uki-final‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
#!/bin/bash
2+
3+
set -eux
4+
5+
cd "${0%/*}"
6+
7+
# cargo build --release --features=composefs-backend
8+
9+
FROM="${FROM:-quay.io/fedora/fedora-bootc-base-uki:42}"
10+
TAG="${TAG:-quay.io/fedora/fedora-bootc-uki:42}"
11+
12+
cp ../../target/release/bootc .
13+
14+
mount /dev/vdb3 tmp
15+
16+
# rm -rf tmp/sysroot
17+
mkdir -p tmp/sysroot/composefs
18+
19+
IMAGE_ID="$(sed s/sha256:// iid)"
20+
./bootc internals cfs --repo tmp/sysroot/composefs oci pull containers-storage:"${IMAGE_ID}"
21+
COMPOSEFS_FSVERITY=$(./bootc internals cfs --repo tmp/sysroot/composefs oci compute-id --bootable "${IMAGE_ID}")
22+
23+
# See: https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot
24+
# Alternative to generate keys for testing: `sbctl create-keys`
25+
if [[ ! -d "secureboot" ]]; then
26+
echo "Generating test Secure Boot keys"
27+
mkdir secureboot
28+
pushd secureboot > /dev/null
29+
uuidgen --random > GUID.txt
30+
openssl req -newkey rsa:4096 -nodes -keyout PK.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Platform Key/" -out PK.crt
31+
openssl x509 -outform DER -in PK.crt -out PK.cer
32+
openssl req -newkey rsa:4096 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Key Exchange Key/" -out KEK.crt
33+
openssl x509 -outform DER -in KEK.crt -out KEK.cer
34+
openssl req -newkey rsa:4096 -nodes -keyout db.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Signature Database key/" -out db.crt
35+
openssl x509 -outform DER -in db.crt -out db.cer
36+
popd > /dev/null
37+
fi
38+
39+
# For debugging, add --no-cache to podman command
40+
sudo podman build \
41+
--from "${FROM}" \
42+
-t "${TAG}" \
43+
--build-arg=COMPOSEFS_FSVERITY="${COMPOSEFS_FSVERITY}" \
44+
-f Containerfile.stage2 \
45+
--secret=id=key,src=secureboot/db.key \
46+
--secret=id=cert,src=secureboot/db.crt
47+
48+
# rm -rf tmp/efi
49+
# mkdir -p tmp/efi
50+
# ./bootc internals cfs --repo tmp/sysroot/composefs oci pull containers-storage:"${IMAGE_ID}"
51+
# ./bootc internals cfs --repo tmp/sysroot/composefs oci compute-id --bootable "${IMAGE_ID}"
52+
# ./bootc internals cfs --repo tmp/sysroot/composefs oci prepare-boot "${IMAGE_ID}" --bootdir tmp/efi
53+
54+
umount tmp

‎examples/bootc-bls/build-fcos-bls‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
3+
export FROM="quay.io/fedora/fedora-coreos:stable"
4+
export TAG="quay.io/fedora/fedora-coreos-bls:stable"
5+
export EXTRA="extra-fcos"
6+
exec ./build-bootc-bls

‎examples/bootc-bls/build-fcos-uki-base‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
3+
export FROM="quay.io/fedora/fedora-coreos:stable"
4+
export TAG="quay.io/fedora/fedora-coreos-base-uki:stable"
5+
export EXTRA="extra-fcos"
6+
exec ./build-bootc-uki-base

‎examples/bootc-bls/build-fcos-uki-final‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/bash
2+
3+
export FROM="quay.io/fedora/fedora-coreos-base-uki:stable"
4+
export TAG="quay.io/fedora/fedora-coreos-uki:stable"
5+
exec ./build-bootc-uki-final

0 commit comments

Comments
 (0)