Skip to content

Commit e68bc7c

Browse files
dustymabedustymabe
committed
cmd-buildextend-metal: move qemu-secex postprocessing into a function
Improves code readability.
1 parent 783f4bf commit e68bc7c

File tree

1 file changed

+64
-50
lines changed

1 file changed

+64
-50
lines changed

‎src/cmd-buildextend-metal‎

Lines changed: 64 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,56 @@ json.dump(j, sys.stdout, indent=4)
5858
echo "Successfully generated: ${target_filename}"
5959
}
6060

61+
# For qemu-secex we need to do a few extra things like spin up a
62+
# VM to run genprotimg and save off the pubkey for Ignition.
63+
postprocess_qemu_secex() {
64+
if [ ! -f "${genprotimgvm}" ]; then
65+
fatal "No genprotimgvm provided at ${genprotimgvm}"
66+
fi
67+
68+
# Basic qemu args:
69+
qemu_args=(); blk_size="512"
70+
[[ $platform == metal4k ]] && blk_size="4096"
71+
qemu_args+=("-drive" "if=none,id=target,format=${image_format},file=${imgpath},cache=unsafe" \
72+
"-device" "virtio-blk,serial=target,drive=target,physical_block_size=${blk_size},logical_block_size=${blk_size}")
73+
74+
# SecureVM (holding Universal Key for all IBM Z Mainframes) requires scripts to execute genprotimg
75+
se_script_dir="/usr/lib/coreos-assembler/secex-genprotimgvm-scripts"
76+
genprotimg_img="${PWD}/secex-genprotimg.img"
77+
genprotimg_dir=$(mktemp -p "${tmp_builddir}" -d)
78+
cp "${se_script_dir}/genprotimg-script.sh" "${se_script_dir}/post-script.sh" "${genprotimg_dir}"
79+
# Extra kargs with dm-verity hashes
80+
secex_kargs="ignition.firstboot"
81+
secex_kargs+=" rootfs.roothash=$(<"${outdir}/${platform}/rootfs_hash")"
82+
secex_kargs+=" bootfs.roothash=$(<"${outdir}/${platform}/bootfs_hash")"
83+
echo "${secex_kargs}" > "${genprotimg_dir}/parmfile"
84+
virt-make-fs --format=raw --type=ext4 "${genprotimg_dir}" "${genprotimg_img}"
85+
rm -rf "${genprotimg_dir}"
86+
qemu_args+=("-drive" "if=none,id=genprotimg,format=raw,file=${genprotimg_img}" \
87+
"-device" "virtio-blk,serial=genprotimg,drive=genprotimg")
88+
89+
# GPG keys used for protecting Ignition config
90+
tmp_gpg_home=$(mktemp -p "${tmp_builddir}" -d)
91+
ignition_pubkey=$(mktemp -p "${tmp_builddir}")
92+
ignition_prikey=$(mktemp -p "${tmp_builddir}")
93+
gpg --homedir "${tmp_gpg_home}" --batch --passphrase '' --yes --quick-gen-key "Secure Execution (secex) ${build}" rsa4096 encr none
94+
gpg --homedir "${tmp_gpg_home}" --armor --export secex > "${ignition_pubkey}"
95+
gpg --homedir "${tmp_gpg_home}" --armor --export-secret-key secex > "${ignition_prikey}"
96+
exec 9<"${ignition_prikey}"
97+
rm -rf "${tmp_gpg_home}" "${ignition_prikey}"
98+
qemu_args+=("-add-fd" "fd=9,set=3" "-drive" "if=none,id=gpgkey,format=raw,file=/dev/fdset/3,readonly=on" \
99+
"-device" "virtio-blk,serial=gpgkey,drive=gpgkey")
100+
101+
/usr/lib/coreos-assembler/secex-genprotimgvm-scripts/runvm.sh \
102+
--genprotimgvm "${genprotimgvm}" -- "${qemu_args[@]}"
103+
rm -f "${genprotimg_img}"
104+
exec 9>&-
105+
106+
# Now store the generated ${ignition_pubkey} in the builddir and meta.json
107+
gpg_key_filename="${name}-${build}-ignition-secex-key.gpg.pub"
108+
postprocess_artifact "ignition-gpg-key" "${ignition_pubkey}" "${gpg_key_filename}" 'True'
109+
}
110+
61111
# Here we generate the input JSON we pass to runvm_osbuild for all of our image builds
62112
generate_runvm_osbuild_config() {
63113
runvm_osbuild_config_json="${workdir}/tmp/runvm-osbuild-config-${build}.json"
@@ -266,56 +316,20 @@ main() {
266316

267317
mv "${outdir}/${platform}/${platform}" "${imgpath}"
268318

269-
if [[ "${platform}" == "qemu-secex" ]]; then
270-
if [ ! -f "${genprotimgvm}" ]; then
271-
fatal "No genprotimgvm provided at ${genprotimgvm}"
272-
fi
273-
274-
# Basic qemu args:
275-
qemu_args=(); blk_size="512"
276-
[[ $platform == metal4k ]] && blk_size="4096"
277-
qemu_args+=("-drive" "if=none,id=target,format=${image_format},file=${imgpath},cache=unsafe" \
278-
"-device" "virtio-blk,serial=target,drive=target,physical_block_size=${blk_size},logical_block_size=${blk_size}")
279-
280-
# SecureVM (holding Universal Key for all IBM Z Mainframes) requires scripts to execute genprotimg
281-
se_script_dir="/usr/lib/coreos-assembler/secex-genprotimgvm-scripts"
282-
genprotimg_img="${PWD}/secex-genprotimg.img"
283-
genprotimg_dir=$(mktemp -p "${tmp_builddir}" -d)
284-
cp "${se_script_dir}/genprotimg-script.sh" "${se_script_dir}/post-script.sh" "${genprotimg_dir}"
285-
# Extra kargs with dm-verity hashes
286-
secex_kargs="ignition.firstboot"
287-
secex_kargs+=" rootfs.roothash=$(<"${outdir}/${platform}/rootfs_hash")"
288-
secex_kargs+=" bootfs.roothash=$(<"${outdir}/${platform}/bootfs_hash")"
289-
echo "${secex_kargs}" > "${genprotimg_dir}/parmfile"
290-
virt-make-fs --format=raw --type=ext4 "${genprotimg_dir}" "${genprotimg_img}"
291-
rm -rf "${genprotimg_dir}"
292-
qemu_args+=("-drive" "if=none,id=genprotimg,format=raw,file=${genprotimg_img}" \
293-
"-device" "virtio-blk,serial=genprotimg,drive=genprotimg")
294-
295-
# GPG keys used for protecting Ignition config
296-
tmp_gpg_home=$(mktemp -p "${tmp_builddir}" -d)
297-
ignition_pubkey=$(mktemp -p "${tmp_builddir}")
298-
ignition_prikey=$(mktemp -p "${tmp_builddir}")
299-
gpg --homedir "${tmp_gpg_home}" --batch --passphrase '' --yes --quick-gen-key "Secure Execution (secex) ${build}" rsa4096 encr none
300-
gpg --homedir "${tmp_gpg_home}" --armor --export secex > "${ignition_pubkey}"
301-
gpg --homedir "${tmp_gpg_home}" --armor --export-secret-key secex > "${ignition_prikey}"
302-
exec 9<"${ignition_prikey}"
303-
rm -rf "${tmp_gpg_home}" "${ignition_prikey}"
304-
qemu_args+=("-add-fd" "fd=9,set=3" "-drive" "if=none,id=gpgkey,format=raw,file=/dev/fdset/3,readonly=on" \
305-
"-device" "virtio-blk,serial=gpgkey,drive=gpgkey")
306-
307-
/usr/lib/coreos-assembler/secex-genprotimgvm-scripts/runvm.sh \
308-
--genprotimgvm "${genprotimgvm}" -- "${qemu_args[@]}"
309-
rm -f "${genprotimg_img}"
310-
exec 9>&-
311-
312-
# Now store the generated ${ignition_pubkey} in the builddir and meta.json
313-
gpg_key_filename="${name}-${build}-ignition-secex-key.gpg.pub"
314-
postprocess_artifact "ignition-gpg-key" "${ignition_pubkey}" "${gpg_key_filename}" 'True'
315-
fi
316-
317-
# Now store the generated artifact in the builddir and meta.json
318-
postprocess_artifact "${platform}" "${imgpath}" "${imgname}" 'False'
319+
case "$platform" in
320+
qemu-secex)
321+
# Massage the generated artifact through an extra VM for secex. This
322+
# will also create an Ignition pubkey and store it in the meta.json
323+
# and builddir.
324+
postprocess_qemu_secex
325+
# Also need to update the meta.json and builddir with the main artifact.
326+
postprocess_artifact "${platform}" "${imgpath}" "${imgname}" 'False'
327+
;;
328+
*)
329+
# Update the meta.json and builddir with the generated artifact.
330+
postprocess_artifact "${platform}" "${imgpath}" "${imgname}" 'False'
331+
;;
332+
esac
319333

320334
# Quiet for the rest of this so the last thing we see is a success message
321335
set +x

0 commit comments

Comments
 (0)