Skip to content

Commit 5152daa

Browse files
blucabluca
committed
ci: add mkosi configuration and CI
Build a set of images across the following matrix: - debian/ubuntu/fedora/centos - grub/systemd-boot - UKI/kernel - x86-64/arm64 And boot them in qemu, running a smoke test that ensures the image is bootable and secure boot is configured correctly. When booting a UKI, a MOK-signed addon is also loaded and verified. Shim is signed with a local certificate enrolled in 'db' via virt-firmware before booting. The distro signing certificate is embedde in shim, for distro-signed second stages and kernels. Signed-off-by: Luca Boccassi <luca.boccassi@gmail.com>
1 parent b86b909 commit 5152daa

File tree

24 files changed

+527
-0
lines changed

24 files changed

+527
-0
lines changed

‎.github/workflows/mkosi.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: mkosi
2+
3+
on:
4+
push:
5+
# branches:
6+
# - master
7+
pull_request:
8+
branches:
9+
- master
10+
11+
jobs:
12+
boot:
13+
runs-on: ${{ matrix.runner }}
14+
concurrency:
15+
group: ${{ github.workflow }}-${{ matrix.distro }}-${{ matrix.bootloader }}-${{ matrix.uki }}-${{ matrix.runner }}-${{ github.ref }}
16+
cancel-in-progress: true
17+
strategy:
18+
fail-fast: false
19+
matrix:
20+
distro:
21+
- fedora
22+
- centos
23+
- ubuntu
24+
- debian
25+
bootloader:
26+
# Locally signed systemd-boot
27+
- systemd-boot
28+
# Distro signed grub2
29+
- grub-signed
30+
uki:
31+
# BLS #1 boot, kernel + initrd
32+
- none
33+
# BLS #2 boot, locally built UKI (unsigned because it is not provided by the distro)
34+
- unsigned
35+
runner:
36+
- ubuntu-24.04
37+
- ubuntu-24.04-arm
38+
include:
39+
# Debian provides distro-signed systemd-boot
40+
- distro: debian
41+
bootloader: systemd-boot-signed
42+
uki: unsigned
43+
runner: ubuntu-24.04
44+
- distro: debian
45+
bootloader: systemd-boot-signed
46+
uki: unsigned
47+
runner: ubuntu-24.04-arm
48+
exclude:
49+
# The systemd-boot version in 24.04 fails to boot the arm64 compressed kernel
50+
- distro: ubuntu
51+
bootloader: systemd-boot
52+
uki: none
53+
runner: ubuntu-24.04-arm
54+
# grub fails to load UKI with: error: ../../grub-core/script/function.c:119:can't find command `chainloader'
55+
- distro: centos
56+
bootloader: grub-signed
57+
uki: unsigned
58+
runner: ubuntu-24.04-arm
59+
- distro: fedora
60+
bootloader: grub-signed
61+
uki: unsigned
62+
runner: ubuntu-24.04-arm
63+
# kernel is not signed
64+
- distro: fedora
65+
bootloader: grub-signed
66+
uki: none
67+
runner: ubuntu-24.04-arm
68+
69+
steps:
70+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
71+
with:
72+
submodules: recursive
73+
- uses: systemd/mkosi@7be5159f246d4b1283f62f8a0ab3f0ae90651e38
74+
75+
- name: Generate key
76+
run: mkosi genkey
77+
78+
- name: Summary
79+
run: mkosi summary
80+
81+
- name: Build tools tree
82+
run: mkosi -f sandbox -- true
83+
84+
- name: Build image
85+
run: mkosi sandbox -- mkosi --distribution ${{ matrix.distro }} --bootloader ${{ matrix.bootloader }} --unified-kernel-images ${{ matrix.uki }} --kernel-command-line=systemd.unit=mkosi-test.service -f build
86+
87+
- name: Run smoke tests
88+
run: test "$(timeout -k 30 5m mkosi sandbox -- mkosi --firmware-variables mkosi/mkosi.output/ovmf_vars.fd --distribution ${{ matrix.distro }} --kernel-command-line-extra=systemd.unit=mkosi-test.service qemu 1>&2; echo $?)" -eq 123

‎.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,3 +52,8 @@ shim_cert.h
5252
!/test-data/
5353
/test-random.h
5454
version.c
55+
/.mkosi-private/
56+
/mkosi/mkosi.builddir/
57+
/mkosi/mkosi.cache/
58+
/mkosi/mkosi.local.conf
59+
/mkosi/mkosi.output/

‎mkosi/mkosi.build.chroot‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#!/bin/bash
2+
set -e
3+
4+
if [ "$ARCHITECTURE" = "x86-64" ]; then
5+
EFI_ARCHITECTURE="x64"
6+
elif [ "$ARCHITECTURE" = "x86" ]; then
7+
EFI_ARCHITECTURE="ia32"
8+
elif [ "$ARCHITECTURE" = "arm64" ]; then
9+
EFI_ARCHITECTURE="aa64"
10+
else
11+
EFI_ARCHITECTURE="$ARCHITECTURE"
12+
fi
13+
14+
cd "$BUILDDIR"
15+
16+
openssl x509 -inform PEM -in "$SRCDIR/mkosi/mkosi.conf.d/$DISTRIBUTION/certs/shim.crt" -outform DER -out shim.der
17+
18+
export VENDOR_CERT_FILE=$PWD/shim.der
19+
export EFIDIR=$DISTRIBUTION
20+
export DEBUG=1
21+
22+
make TOPDIR="$SRCDIR" -f "$SRCDIR/Makefile" -j1
23+
24+
for b in shim fb mm; do
25+
install -D "${b}${EFI_ARCHITECTURE}.efi" -t "$DESTDIR/usr/lib/shim/" -m 0755
26+
done

‎mkosi/mkosi.clean‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/bin/sh
2+
3+
rm -f "$OUTPUTDIR/ovmf_vars.fd"
4+
rm -rf "$OUTPUTDIR/mok/"

‎mkosi/mkosi.conf‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
[Config]
2+
MinimumVersion=commit:7be5159f246d4b1283f62f8a0ab3f0ae90651e38
3+
4+
[Output]
5+
RepartDirectories=mkosi.repart
6+
OutputDirectory=mkosi.output
7+
8+
[Build]
9+
History=yes
10+
ToolsTree=default
11+
BuildDirectory=mkosi.builddir
12+
CacheDirectory=mkosi.cache
13+
Incremental=yes
14+
15+
[Validation]
16+
SecureBoot=yes
17+
SecureBootAutoEnroll=no
18+
19+
[Content]
20+
Bootable=yes
21+
ShimBootloader=unsigned
22+
23+
# Default configuration is systemd-boot + UKI, can be overridden
24+
# on the command line or via mkosi/mkosi.local.conf
25+
Bootloader=systemd-boot-signed
26+
UnifiedKernelImages=unsigned
27+
28+
SELinuxRelabel=no
29+
KernelInitrdModules=default
30+
KernelCommandLine=
31+
systemd.show_status=0
32+
systemd.log_ratelimit_kmsg=0
33+
printk.devkmsg=on
34+
rw
35+
selinux=0
36+
systemd.firstboot=no
37+
oops=panic
38+
panic=-1
39+
softlockup_panic=1
40+
panic_on_warn=1
41+
mitigations=off
42+
43+
Packages=
44+
mokutil
45+
openssl
46+
47+
[Runtime]
48+
# TODO: remove command line from mkosi.yml and uncomment this when
49+
# https://github.com/systemd/mkosi/pull/3817 is fixed
50+
#FirmwareVariables=%O/ovmf_vars.fd
51+
Firmware=uefi-secure-boot
52+
Credentials=
53+
journal.storage=persistent
54+
tty.serial.hvc0.agetty.autologin=root
55+
tty.serial.hvc0.login.noauth=yes
56+
tty.console.agetty.autologin=root
57+
tty.console.login.noauth=yes
58+
tty.virtual.tty1.agetty.autologin=root
59+
tty.virtual.tty1.login.noauth=yes
60+
RuntimeBuildSources=yes
61+
RuntimeScratch=no
62+
CPUs=2
63+
VSock=yes
64+
# TODO: tpmrm0 device doesn't show up in initrd on arm64
65+
TPM=no
66+
67+
[Include]
68+
Include=mkosi-vm

‎mkosi/mkosi.conf.d/centos-fedora/mkosi.conf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
[Match]
2+
Distribution=|centos
3+
Distribution=|fedora
4+
5+
[Content]
6+
Packages=
7+
dos2unix
8+
efibootmgr
9+
efivar
10+
python-virt-firmware
11+
12+
BuildPackages=
13+
make
14+
gcc
15+
elfutils-libelf-devel
16+
openssl-devel
17+
pesign

‎mkosi/mkosi.conf.d/centos-fedora/mkosi.conf.d/grub-arm64.conf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[Match]
2+
Architecture=arm64
3+
4+
[Content]
5+
Packages=grub2-efi-aa64

‎mkosi/mkosi.conf.d/centos-fedora/mkosi.conf.d/grub-x86-64.conf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[Match]
2+
Architecture=x86-64
3+
4+
[Content]
5+
Packages=grub2-efi-x64

‎mkosi/mkosi.conf.d/centos/certs/shim.crt‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDYjCCAkqgAwIBAgIJAIlReu6IOzL7MA0GCSqGSIb3DQEBCwUAMEYxIDAeBgNV
3+
BAMMF0NlbnRPUyBTZWN1cmUgQm9vdCBDQSAyMSIwIAYJKoZIhvcNAQkBFhNzZWN1
4+
cml0eUBjZW50b3Mub3JnMB4XDTIwMDYwOTA4MTkzMloXDTM4MDExODA4MTkzMlow
5+
RjEgMB4GA1UEAwwXQ2VudE9TIFNlY3VyZSBCb290IENBIDIxIjAgBgkqhkiG9w0B
6+
CQEWE3NlY3VyaXR5QGNlbnRvcy5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
7+
ggEKAoIBAQChatbNaQDV0RTCqff1tl92xI6gu1k8jYufW8FyzZ6uDnxoGpBT0LiU
8+
WKuGjMQ89JgiApFzDYSLWrZg8NbTnVdz0hny4SMyspe5weUk6IToKXvEejZNFn6i
9+
vae2vfT0/ASKsgIvUcz4sWHMK43vbfv/pVpYGLgoG5aNUkt7VhkeURwJzR3ODgDp
10+
aL4bQ/7qEo8ASHCEvQx6klG330Z06O0kjS6GK12cPC1t5ZlimVXCNWP1jf0pMWmh
11+
aBrZjbyY0j8R7Yns3cEovAM230chsVdyFxSYpqCLzMlmWNxiIlvcAoDIRMWEa7Da
12+
SSAfJWH+ygAzad1PHlnCB0zAFbLAMJH1AgMBAAGjUzBRMB0GA1UdDgQWBBRwAH+Z
13+
IJwSa+FHdOrse22WMfNNyjAfBgNVHSMEGDAWgBRwAH+ZIJwSa+FHdOrse22WMfNN
14+
yjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAe5NcVSUd/POZs
15+
Jkiep8ATNwXglLAeYxB55F42sXx5OOdKMBmhqWQIVJvaih/wsfKIBfdUGv2L9dH8
16+
IQgiU1PRYx0baSVJno3HcQTbCqLvnvckusR7IUTDAFj774MvXwS6yV6pXzxDmuh2
17+
t8hRktOKFeUtdlDYqg9X3Ia3GkoB5huyEbuaZTNcV4TAfU/yAERNIAgRs+fLQU70
18+
OgGlWsp35J8qPkZKabGf0surDa2xa6iAoFyknxruoKQ8uNSB9KB7/0JvVouNx90+
19+
ncykWW96GVKs8+H5WGza10FqrchtThSNCSXTtLbTXoK0Atdvu0o04XUbsCGMnlcG
20+
zAVb3/m0
21+
-----END CERTIFICATE-----

‎mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
[Match]
2+
Distribution=|debian
3+
Distribution=|ubuntu
4+
5+
[Content]
6+
Packages=
7+
dos2unix
8+
efibootmgr
9+
efitools
10+
efivar
11+
python3-virt-firmware
12+
sbsigntool
13+
14+
BuildPackages=
15+
build-essential
16+
gnu-efi
17+
libefivar-dev
18+
libelf-dev
19+
pesign

0 commit comments

Comments
 (0)