CWCOW: Unmount CIM volume #2588
Conversation
Signed-off-by: Mahati Chamarthy <[email protected]>
|
I have tested this on nord1 and it works at least as well as before with the simple attestation report web server nanoserver based container. |
| BlockPath: physicalDevPath, | ||
| CimName: blockCimDevice.CimName, | ||
|
|
||
| // skip the merged cim and verify individual layer hashes |
There was a problem hiding this comment.
Do we have a written explanation anywhere of why we don't need to check the merged CIM root hash? I think it needs to be explained here.
| log.G(ctx).Tracef("WCOWBlockCIMMounts Add { %v}", wcowBlockCimMounts) | ||
|
|
||
| // The block device takes some time to show up. Wait for a few seconds. | ||
| time.Sleep(2 * time.Second) |
There was a problem hiding this comment.
As discussed (but not for today) this can't be a sleep before check but needs to be more like the LCOW scheme where it only sleeps if it fails. See
hcsshim/internal/guest/storage/scsi/scsi.go
Line 205 in cbc0126
| return fmt.Errorf("failed to get CIM verification info: %w", err) | ||
| } | ||
| layerDigests[i] = cimRootDigestBytes | ||
| layerHashes[i] = base64.URLEncoding.EncodeToString(cimRootDigestBytes) |
There was a problem hiding this comment.
As discussed (also not for today), the layer hash strings ought to be hex encoded as per the linux ones.
2 participants
ResourceCloserlist as it is already unmounted previously i.e.lc.scratchMount.Release(ctx);