Skip to content

Commit c6e30b1

Browse files
dustymabedustymabe
committed
cmd-buildextend-metal: move qemu-secex postprocessing into a function
Improves code readability.
1 parent 284601e commit c6e30b1

File tree

1 file changed

+64
-50
lines changed

1 file changed

+64
-50
lines changed

‎src/cmd-buildextend-metal‎

Lines changed: 64 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,56 @@ json.dump(j, sys.stdout, indent=4)
5757
echo "Successfully generated: ${target_filename}"
5858
}
5959

60+
# For qemu-secex we need to do a few extra things like spin up a
61+
# VM to run genprotimg and save off the pubkey for Ignition.
62+
postprocess_qemu_secex() {
63+
if [ ! -f "${genprotimgvm}" ]; then
64+
fatal "No genprotimgvm provided at ${genprotimgvm}"
65+
fi
66+
67+
# Basic qemu args:
68+
qemu_args=(); blk_size="512"
69+
[[ $platform == metal4k ]] && blk_size="4096"
70+
qemu_args+=("-drive" "if=none,id=target,format=${image_format},file=${imgpath},cache=unsafe" \
71+
"-device" "virtio-blk,serial=target,drive=target,physical_block_size=${blk_size},logical_block_size=${blk_size}")
72+
73+
# SecureVM (holding Universal Key for all IBM Z Mainframes) requires scripts to execute genprotimg
74+
se_script_dir="/usr/lib/coreos-assembler/secex-genprotimgvm-scripts"
75+
genprotimg_img="${PWD}/secex-genprotimg.img"
76+
genprotimg_dir=$(mktemp -p "${tmp_builddir}" -d)
77+
cp "${se_script_dir}/genprotimg-script.sh" "${se_script_dir}/post-script.sh" "${genprotimg_dir}"
78+
# Extra kargs with dm-verity hashes
79+
secex_kargs="ignition.firstboot"
80+
secex_kargs+=" rootfs.roothash=$(<"${outdir}/${platform}/rootfs_hash")"
81+
secex_kargs+=" bootfs.roothash=$(<"${outdir}/${platform}/bootfs_hash")"
82+
echo "${secex_kargs}" > "${genprotimg_dir}/parmfile"
83+
virt-make-fs --format=raw --type=ext4 "${genprotimg_dir}" "${genprotimg_img}"
84+
rm -rf "${genprotimg_dir}"
85+
qemu_args+=("-drive" "if=none,id=genprotimg,format=raw,file=${genprotimg_img}" \
86+
"-device" "virtio-blk,serial=genprotimg,drive=genprotimg")
87+
88+
# GPG keys used for protecting Ignition config
89+
tmp_gpg_home=$(mktemp -p "${tmp_builddir}" -d)
90+
ignition_pubkey=$(mktemp -p "${tmp_builddir}")
91+
ignition_prikey=$(mktemp -p "${tmp_builddir}")
92+
gpg --homedir "${tmp_gpg_home}" --batch --passphrase '' --yes --quick-gen-key "Secure Execution (secex) ${build}" rsa4096 encr none
93+
gpg --homedir "${tmp_gpg_home}" --armor --export secex > "${ignition_pubkey}"
94+
gpg --homedir "${tmp_gpg_home}" --armor --export-secret-key secex > "${ignition_prikey}"
95+
exec 9<"${ignition_prikey}"
96+
rm -rf "${tmp_gpg_home}" "${ignition_prikey}"
97+
qemu_args+=("-add-fd" "fd=9,set=3" "-drive" "if=none,id=gpgkey,format=raw,file=/dev/fdset/3,readonly=on" \
98+
"-device" "virtio-blk,serial=gpgkey,drive=gpgkey")
99+
100+
/usr/lib/coreos-assembler/secex-genprotimgvm-scripts/runvm.sh \
101+
--genprotimgvm "${genprotimgvm}" -- "${qemu_args[@]}"
102+
rm -f "${genprotimg_img}"
103+
exec 9>&-
104+
105+
# Now store the generated ${ignition_pubkey} in the builddir and meta.json
106+
gpg_key_filename="${name}-${build}-ignition-secex-key.gpg.pub"
107+
postprocess_artifact "ignition-gpg-key" "${ignition_pubkey}" "${gpg_key_filename}" 'True'
108+
}
109+
60110
# Here we generate the input JSON we pass to runvm_osbuild for all of our image builds
61111
generate_runvm_osbuild_config() {
62112
runvm_osbuild_config_json="${workdir}/tmp/runvm-osbuild-config-${build}.json"
@@ -265,56 +315,20 @@ main() {
265315

266316
mv "${outdir}/${platform}/${platform}" "${imgpath}"
267317

268-
if [[ "${platform}" == "qemu-secex" ]]; then
269-
if [ ! -f "${genprotimgvm}" ]; then
270-
fatal "No genprotimgvm provided at ${genprotimgvm}"
271-
fi
272-
273-
# Basic qemu args:
274-
qemu_args=(); blk_size="512"
275-
[[ $platform == metal4k ]] && blk_size="4096"
276-
qemu_args+=("-drive" "if=none,id=target,format=${image_format},file=${imgpath},cache=unsafe" \
277-
"-device" "virtio-blk,serial=target,drive=target,physical_block_size=${blk_size},logical_block_size=${blk_size}")
278-
279-
# SecureVM (holding Universal Key for all IBM Z Mainframes) requires scripts to execute genprotimg
280-
se_script_dir="/usr/lib/coreos-assembler/secex-genprotimgvm-scripts"
281-
genprotimg_img="${PWD}/secex-genprotimg.img"
282-
genprotimg_dir=$(mktemp -p "${tmp_builddir}" -d)
283-
cp "${se_script_dir}/genprotimg-script.sh" "${se_script_dir}/post-script.sh" "${genprotimg_dir}"
284-
# Extra kargs with dm-verity hashes
285-
secex_kargs="ignition.firstboot"
286-
secex_kargs+=" rootfs.roothash=$(<"${outdir}/${platform}/rootfs_hash")"
287-
secex_kargs+=" bootfs.roothash=$(<"${outdir}/${platform}/bootfs_hash")"
288-
echo "${secex_kargs}" > "${genprotimg_dir}/parmfile"
289-
virt-make-fs --format=raw --type=ext4 "${genprotimg_dir}" "${genprotimg_img}"
290-
rm -rf "${genprotimg_dir}"
291-
qemu_args+=("-drive" "if=none,id=genprotimg,format=raw,file=${genprotimg_img}" \
292-
"-device" "virtio-blk,serial=genprotimg,drive=genprotimg")
293-
294-
# GPG keys used for protecting Ignition config
295-
tmp_gpg_home=$(mktemp -p "${tmp_builddir}" -d)
296-
ignition_pubkey=$(mktemp -p "${tmp_builddir}")
297-
ignition_prikey=$(mktemp -p "${tmp_builddir}")
298-
gpg --homedir "${tmp_gpg_home}" --batch --passphrase '' --yes --quick-gen-key "Secure Execution (secex) ${build}" rsa4096 encr none
299-
gpg --homedir "${tmp_gpg_home}" --armor --export secex > "${ignition_pubkey}"
300-
gpg --homedir "${tmp_gpg_home}" --armor --export-secret-key secex > "${ignition_prikey}"
301-
exec 9<"${ignition_prikey}"
302-
rm -rf "${tmp_gpg_home}" "${ignition_prikey}"
303-
qemu_args+=("-add-fd" "fd=9,set=3" "-drive" "if=none,id=gpgkey,format=raw,file=/dev/fdset/3,readonly=on" \
304-
"-device" "virtio-blk,serial=gpgkey,drive=gpgkey")
305-
306-
/usr/lib/coreos-assembler/secex-genprotimgvm-scripts/runvm.sh \
307-
--genprotimgvm "${genprotimgvm}" -- "${qemu_args[@]}"
308-
rm -f "${genprotimg_img}"
309-
exec 9>&-
310-
311-
# Now store the generated ${ignition_pubkey} in the builddir and meta.json
312-
gpg_key_filename="${name}-${build}-ignition-secex-key.gpg.pub"
313-
postprocess_artifact "ignition-gpg-key" "${ignition_pubkey}" "${gpg_key_filename}" 'True'
314-
fi
315-
316-
# Now store the generated artifact in the builddir and meta.json
317-
postprocess_artifact "${platform}" "${imgpath}" "${imgname}" 'False'
318+
case "$platform" in
319+
qemu-secex)
320+
# Massage the generated artifact through an extra VM for secex. This
321+
# will also create an Ignition pubkey and store it in the meta.json
322+
# and builddir.
323+
postprocess_qemu_secex
324+
# Also need to update the meta.json and builddir with the main artifact.
325+
postprocess_artifact "${platform}" "${imgpath}" "${imgname}" 'False'
326+
;;
327+
*)
328+
# Update the meta.json and builddir with the generated artifact.
329+
postprocess_artifact "${platform}" "${imgpath}" "${imgname}" 'False'
330+
;;
331+
esac
318332

319333
# Quiet for the rest of this so the last thing we see is a success message
320334
set +x

0 commit comments

Comments
 (0)