Skip to content

Commit 073f62f

Browse files
nikita-dubrovskiinikita-dubrovskii
committed
qemu-secex: generate fake-secure-vm.qcow2 for local build
1 parent 395aab6 commit 073f62f

File tree

1 file changed

+62
-45
lines changed

1 file changed

+62
-45
lines changed

‎src/cmd-osbuild‎

Lines changed: 62 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -77,51 +77,63 @@ json.dump(j, sys.stdout, indent=4)
7777
# For qemu-secex we need to do a few extra things like spin up a
7878
# VM to run genprotimg and save off the pubkey for Ignition.
7979
postprocess_qemu_secex() {
80-
if [ ! -f "${genprotimgvm}" ]; then
81-
fatal "No genprotimgvm provided at ${genprotimgvm}"
82-
fi
83-
84-
# Basic qemu args:
85-
qemu_args=(); blk_size="512"
86-
[[ $platform == metal4k ]] && blk_size="4096"
87-
qemu_args+=("-drive" "if=none,id=target,format=qcow,file=${imgpath},cache=unsafe" \
88-
"-device" "virtio-blk,serial=target,drive=target,physical_block_size=${blk_size},logical_block_size=${blk_size}")
89-
90-
# SecureVM (holding Universal Key for all IBM Z Mainframes) requires scripts to execute genprotimg
91-
se_script_dir="/usr/lib/coreos-assembler/secex-genprotimgvm-scripts"
92-
genprotimg_img="${PWD}/secex-genprotimg.img"
93-
genprotimg_dir=$(mktemp -p "${tmp_builddir}" -d)
94-
cp "${se_script_dir}/genprotimg-script.sh" "${se_script_dir}/post-script.sh" "${genprotimg_dir}"
95-
# Extra kargs with dm-verity hashes
96-
secex_kargs="ignition.firstboot"
97-
secex_kargs+=" rootfs.roothash=$(<"${outdir}/${platform}/rootfs_hash")"
98-
secex_kargs+=" bootfs.roothash=$(<"${outdir}/${platform}/bootfs_hash")"
99-
echo "${secex_kargs}" > "${genprotimg_dir}/parmfile"
100-
virt-make-fs --format=raw --type=ext4 "${genprotimg_dir}" "${genprotimg_img}"
101-
rm -rf "${genprotimg_dir}"
102-
qemu_args+=("-drive" "if=none,id=genprotimg,format=raw,file=${genprotimg_img}" \
103-
"-device" "virtio-blk,serial=genprotimg,drive=genprotimg")
104-
105-
# GPG keys used for protecting Ignition config
106-
tmp_gpg_home=$(mktemp -p "${tmp_builddir}" -d)
107-
ignition_pubkey=$(mktemp -p "${tmp_builddir}")
108-
ignition_prikey=$(mktemp -p "${tmp_builddir}")
109-
gpg --homedir "${tmp_gpg_home}" --batch --passphrase '' --yes --quick-gen-key "Secure Execution (secex) ${build}" rsa4096 encr none
110-
gpg --homedir "${tmp_gpg_home}" --armor --export secex > "${ignition_pubkey}"
111-
gpg --homedir "${tmp_gpg_home}" --armor --export-secret-key secex > "${ignition_prikey}"
112-
exec 9<"${ignition_prikey}"
113-
rm -rf "${tmp_gpg_home}" "${ignition_prikey}"
114-
qemu_args+=("-add-fd" "fd=9,set=3" "-drive" "if=none,id=gpgkey,format=raw,file=/dev/fdset/3,readonly=on" \
115-
"-device" "virtio-blk,serial=gpgkey,drive=gpgkey")
116-
117-
/usr/lib/coreos-assembler/secex-genprotimgvm-scripts/runvm.sh \
118-
--genprotimgvm "${genprotimgvm}" -- "${qemu_args[@]}"
119-
rm -f "${genprotimg_img}"
120-
exec 9>&-
121-
122-
# Now store the generated ${ignition_pubkey} in the builddir and meta.json
123-
gpg_key_filename="${name}-${build}-ignition-secex-key.gpg.pub"
124-
postprocess_artifact "ignition-gpg-key" "${ignition_pubkey}" "${gpg_key_filename}" 'True'
80+
if [ ! -f "${genprotimgvm}" ]; then
81+
if [ ! -f "${hostkey}" ]; then
82+
fatal "No hostkey and no genprotimgvm provided"
83+
fi
84+
echo "Generating genprotimgvm locally"
85+
ignition=$(mktemp -p "${tmp_builddir}")
86+
butane -p -d "$(dirname "${hostkey}")" /usr/lib/coreos-assembler/secex-genprotimgvm-scripts/genprotimg.bu -o "${ignition}"
87+
88+
genprotimgvm=/srv/fake-secure-vm.qcow2
89+
cp "/srv/builds/latest/${basearch}/${name}-${build}-qemu.${basearch}.${image_format}" "${genprotimgvm}"
90+
chmod +w "${genprotimgvm}"
91+
genvm_args=("-drive" "if=none,id=hda,file=${genprotimgvm},auto-read-only=off,cache=unsafe" \
92+
"-device" "virtio-blk,drive=hda,bootindex=1")
93+
kola qemuexec -i "${ignition}" -- "${genvm_args[@]}"
94+
fi
95+
96+
# Basic qemu args:
97+
qemu_args=(); blk_size="512"
98+
[[ $platform == metal4k ]] && blk_size="4096"
99+
qemu_args+=("-drive" "if=none,id=target,format=qcow,file=${imgpath},cache=unsafe" \
100+
"-device" "virtio-blk,serial=target,drive=target,physical_block_size=${blk_size},logical_block_size=${blk_size}")
101+
102+
# SecureVM (holding Universal Key for all IBM Z Mainframes) requires scripts to execute genprotimg
103+
se_script_dir="/usr/lib/coreos-assembler/secex-genprotimgvm-scripts"
104+
genprotimg_img="${PWD}/secex-genprotimg.img"
105+
genprotimg_dir=$(mktemp -p "${tmp_builddir}" -d)
106+
cp "${se_script_dir}/genprotimg-script.sh" "${se_script_dir}/post-script.sh" "${genprotimg_dir}"
107+
# Extra kargs with dm-verity hashes
108+
secex_kargs="ignition.firstboot"
109+
secex_kargs+=" rootfs.roothash=$(<"${outdir}/${platform}/rootfs_hash")"
110+
secex_kargs+=" bootfs.roothash=$(<"${outdir}/${platform}/bootfs_hash")"
111+
echo "${secex_kargs}" > "${genprotimg_dir}/parmfile"
112+
virt-make-fs --format=raw --type=ext4 "${genprotimg_dir}" "${genprotimg_img}"
113+
rm -rf "${genprotimg_dir}"
114+
qemu_args+=("-drive" "if=none,id=genprotimg,format=raw,file=${genprotimg_img}" \
115+
"-device" "virtio-blk,serial=genprotimg,drive=genprotimg")
116+
117+
# GPG keys used for protecting Ignition config
118+
tmp_gpg_home=$(mktemp -p "${tmp_builddir}" -d)
119+
ignition_pubkey=$(mktemp -p "${tmp_builddir}")
120+
ignition_prikey=$(mktemp -p "${tmp_builddir}")
121+
gpg --homedir "${tmp_gpg_home}" --batch --passphrase '' --yes --quick-gen-key "Secure Execution (secex) ${build}" rsa4096 encr none
122+
gpg --homedir "${tmp_gpg_home}" --armor --export secex > "${ignition_pubkey}"
123+
gpg --homedir "${tmp_gpg_home}" --armor --export-secret-key secex > "${ignition_prikey}"
124+
exec 9<"${ignition_prikey}"
125+
rm -rf "${tmp_gpg_home}" "${ignition_prikey}"
126+
qemu_args+=("-add-fd" "fd=9,set=3" "-drive" "if=none,id=gpgkey,format=raw,file=/dev/fdset/3,readonly=on" \
127+
"-device" "virtio-blk,serial=gpgkey,drive=gpgkey")
128+
129+
/usr/lib/coreos-assembler/secex-genprotimgvm-scripts/runvm.sh \
130+
--genprotimgvm "${genprotimgvm}" -- "${qemu_args[@]}"
131+
rm -f "${genprotimg_img}"
132+
exec 9>&-
133+
134+
# Now store the generated ${ignition_pubkey} in the builddir and meta.json
135+
gpg_key_filename="${name}-${build}-ignition-secex-key.gpg.pub"
136+
postprocess_artifact "ignition-gpg-key" "${ignition_pubkey}" "${gpg_key_filename}" 'True'
125137
}
126138

127139
# Here we generate the input JSON we pass to runvm_osbuild for all of our image builds
@@ -207,6 +219,7 @@ EOF
207219
main() {
208220
# Set Some Defaults
209221
genprotimgvm=/data.secex/genprotimgvm.qcow2
222+
hostkey=/srv/secex-hostkey
210223
build=
211224
force=
212225

@@ -244,6 +257,10 @@ main() {
244257
genprotimgvm="$2"
245258
shift
246259
;;
260+
--hostkey)
261+
hostkey="$2"
262+
shift
263+
;;
247264
--platforms)
248265
shift # The arg is next in position args
249266
# Split the comma separated string of platforms into an array

0 commit comments

Comments
 (0)