Skip to content

Commit 3e7e6dd

Browse files
travierJohan-Liebert1jeckersb
committed
examples: Add initial examples for bls & uki, bootc & FCOS
Co-Authored-By: Pragyan Poudyal <[email protected]> Co-Authored-By: John Eckersberg <[email protected]> Signed-off-by: Timothée Ravier <[email protected]>
1 parent 98b75bb commit 3e7e6dd

19 files changed

+640
-0
lines changed

‎examples/.gitignore‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
*.addon.efi
2+
*.ign
3+
*.img
4+
*.qcow2
5+
backups
6+
bootc-bls/bootc
7+
bootc-bls/extra-fcos/usr/bin/bootc
8+
bootc-bls/extra-fcos/usr/lib/dracut/modules.d/37bootc/bootc-initramfs-setup
9+
bootc-bls/extra/usr/bin/bootc
10+
bootc-bls/extra/usr/lib/dracut/modules.d/37bootc/bootc-initramfs-setup
11+
bootc-bls/iid
12+
bootc-bls/secureboot
13+
bootc-bls/tmp
14+
systemd-bootx64.efi

‎examples/bootc-bls/Containerfile‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
FROM quay.io/fedora/fedora-bootc:42
2+
COPY . /
3+
4+
RUN <<EOF
5+
set -euxo pipefail
6+
7+
# Disable root password for debug/testing/demos
8+
passwd -d root
9+
10+
if [[ "$(grep -c "VARIANT=\"CoreOS\"" /etc/os-release)" -eq 1 ]]; then
11+
# Disable some units that currently don't work for us
12+
sed -i 's/enable coreos-warn-invalid-mounts.service//' \
13+
/usr/lib/systemd/system-preset/45-fcos.preset
14+
sed -i 's/enable coreos-populate-lvmdevices.service//' \
15+
/usr/lib/systemd/system-preset/45-coreos-populate-lvmdevices.preset
16+
17+
# Fix dependencies
18+
sed -i 's|ExecStart=/usr/sbin/coreos-boot-edit|ExecStart=true|' \
19+
/usr/lib/dracut/modules.d/35coreos-ignition/coreos-boot-edit.service
20+
sed -i 's|ExecStart=/usr/bin/rdcore verify-unique-fs-label --rereadpt boot|ExecStart=true|' \
21+
/usr/lib/dracut/modules.d/35coreos-ignition/coreos-ignition-unique-boot.service
22+
23+
sed -i 's/ConditionKernelCommandLine=ostree/ConditionKernelCommandLine=composefs/' \
24+
/usr/lib/dracut/modules.d/40ignition-ostree/*
25+
sed -i 's/After=ostree-prepare-root.service/After=bootc-initramfs-setup.service/' \
26+
/usr/lib/dracut/modules.d/40ignition-ostree/*
27+
sed -i 's/Requires=ostree-prepare-root.service/Requires=bootc-initramfs-setup.service/' \
28+
/usr/lib/dracut/modules.d/40ignition-ostree/*
29+
30+
sed -i '/Type=oneshot/a ExecStart=bash -c "udevadm settle; sleep 1"' \
31+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-growfs.service
32+
33+
sed -i 's|ExecStart=/usr/sbin/ignition-ostree-mount-var mount|ExecStart=true|' \
34+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-var.service
35+
sed -i 's|ExecStop=/usr/sbin/ignition-ostree-mount-var umount|ExecStart=true|' \
36+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-var.service
37+
38+
sed -i 's|ExecStart=/usr/sbin/ignition-ostree-firstboot-uuid boot|ExecStart=true|' \
39+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-uuid-boot.service
40+
sed -i 's|ExecStart=/usr/sbin/ignition-ostree-firstboot-uuid root|ExecStart=true|' \
41+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-uuid-root.service
42+
43+
sed -i 's/find/find fsverity/' \
44+
/usr/lib/dracut/modules.d/40ignition-ostree/module-setup.sh
45+
46+
sed -i 's|chcon -v --reference "${saved_root}" /sysroot # the root of the fs itself|chcon -v system_u:object_r:root_t:s0 /sysroot # the root of the fs itself|' \
47+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
48+
sed -i '/chattr +i/d' \
49+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
50+
sed -i '/chcon -v system_u:object_r:root_t:s0 \/sysroot # the root of the fs itself/a echo "Enabling fs-verity again..."' \
51+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
52+
sed -i '/echo "Enabling fs-verity again..."/a find /sysroot/composefs/objects -type f -exec fsverity enable {} \\;' \
53+
/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs.sh
54+
55+
# We don't want openh264
56+
rm -f "/etc/yum.repos.d/fedora-cisco-openh264.repo"
57+
58+
# Install fsverity utils to re-enable fsverity on repo objects after
59+
# transposefs step when reprovisionning the root disk
60+
dnf install -y fsverity-utils
61+
fi
62+
EOF
63+
64+
# need to have bootc-initramfs-setup in the initramfs so we need this
65+
RUN set -x; \
66+
kver=$(cd /usr/lib/modules && echo *); \
67+
dracut -vf --install "/etc/passwd /etc/group" /usr/lib/modules/$kver/initramfs.img $kver;

‎examples/bootc-bls/Containerfile.uki‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
FROM quay.io/fedora/fedora-bootc-bls:42 AS base
2+
3+
FROM base as kernel
4+
5+
ARG COMPOSEFS_FSVERITY
6+
7+
RUN --mount=type=secret,id=key \
8+
--mount=type=secret,id=cert <<EOF
9+
set -eux
10+
11+
mkdir -p /etc/kernel /etc/dracut.conf.d
12+
{
13+
printf "composefs=${COMPOSEFS_FSVERITY} root=UUID=910678ff-f77e-4a7d-8d53-86f2ac47a823 rw"
14+
printf " selinux=1 enforcing=0 audit=0"
15+
# printf " console=tty0 console=ttyS0,115000n"
16+
printf " console=ttyS0,115000n rd.systemd.debug_shell=1 rd.systemd.default_debug_tty=tty0"
17+
printf "\n"
18+
} > /etc/kernel/cmdline
19+
20+
rm -f "/etc/yum.repos.d/fedora-cisco-openh264.repo"
21+
dnf install -y systemd-ukify sbsigntools systemd-boot-unsigned
22+
23+
kver=$(cd /usr/lib/modules && echo *)
24+
mkdir -p "/boot/EFI/Linux"
25+
mkdir -p "/boot/EFI/Linux/$kver.efi.extra.d"
26+
27+
ukify build \
28+
--linux "/usr/lib/modules/$kver/vmlinuz" \
29+
--initrd "/usr/lib/modules/$kver/initramfs.img" \
30+
--uname="${kver}" \
31+
--cmdline "@/etc/kernel/cmdline" \
32+
--os-release "@/etc/os-release" \
33+
--signtool sbsign \
34+
--secureboot-private-key "/run/secrets/key" \
35+
--secureboot-certificate "/run/secrets/cert" \
36+
--measure \
37+
--json pretty \
38+
--output "/boot/EFI/Linux/$kver.efi"
39+
40+
ukify build \
41+
--cmdline "ignition.firstboot ignition.platform.id=qemu" \
42+
--signtool sbsign \
43+
--secureboot-private-key "/run/secrets/key" \
44+
--secureboot-certificate "/run/secrets/cert" \
45+
--output "/boot/EFI/Linux/$kver.efi.extra.d/ignition.addon.efi"
46+
47+
sbsign \
48+
--key "/run/secrets/key" \
49+
--cert "/run/secrets/cert" \
50+
"/usr/lib/systemd/boot/efi/systemd-bootx64.efi" \
51+
--output "/boot/systemd-bootx64.efi"
52+
EOF
53+
54+
FROM base as final
55+
56+
RUN --mount=type=bind,from=kernel,target=/_mount/kernel <<EOF
57+
kver=$(cd /usr/lib/modules && echo *)
58+
mkdir -p /boot/EFI/Linux
59+
# We put the UKI in /boot for now due to composefs verity not being the
60+
# same due to mtime of /usr/lib/modules being changed
61+
cp -r /_mount/kernel/boot/* /boot/
62+
EOF
63+
64+
FROM base as final-final
65+
COPY --from=final /boot /boot

‎examples/bootc-bls/build-bootc-bls‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/bin/bash
2+
3+
set -eux
4+
5+
cd "${0%/*}"
6+
7+
FROM="${FROM:-quay.io/fedora/fedora-bootc:42}"
8+
TAG="${TAG:-quay.io/fedora/fedora-bootc-bls:42}"
9+
EXTRA="${EXTRA:-extra}"
10+
11+
# cargo build --release --features=composefs-backend
12+
13+
mkdir -p "${EXTRA}/usr/bin/"
14+
cp ../../target/release/bootc "${EXTRA}/usr/bin/"
15+
cp ../../target/release/bootc-initramfs-setup "${EXTRA}/usr/lib/dracut/modules.d/37bootc/"
16+
17+
mkdir -p tmp
18+
19+
podman build \
20+
--from "${FROM}" \
21+
-t "${TAG}" \
22+
-f Containerfile \
23+
--iidfile=iid \
24+
"${EXTRA}"

‎examples/bootc-bls/build-bootc-uki‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
#!/bin/bash
2+
3+
set -eux
4+
5+
cd "${0%/*}"
6+
7+
# cargo build --release --features=composefs-backend
8+
9+
FROM="${FROM:-quay.io/fedora/fedora-bootc-bls:42}"
10+
TAG="${TAG:-quay.io/fedora/fedora-bootc-uki:42}"
11+
12+
cp ../../target/release/bootc .
13+
14+
mount /dev/vdb3 tmp
15+
16+
# rm -rf tmp/sysroot
17+
mkdir -p tmp/sysroot/composefs
18+
19+
IMAGE_ID="$(sed s/sha256:// iid)"
20+
./bootc internals cfs --repo tmp/sysroot/composefs oci pull containers-storage:"${IMAGE_ID}"
21+
COMPOSEFS_FSVERITY=$(./bootc internals cfs --repo tmp/sysroot/composefs oci compute-id --bootable "${IMAGE_ID}")
22+
23+
# See: https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot
24+
# Alternative to generate keys for testing: `sbctl create-keys`
25+
if [[ ! -d "secureboot" ]]; then
26+
echo "Generating test Secure Boot keys"
27+
mkdir secureboot
28+
pushd secureboot > /dev/null
29+
uuidgen --random > GUID.txt
30+
openssl req -newkey rsa:4096 -nodes -keyout PK.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Platform Key/" -out PK.crt
31+
openssl x509 -outform DER -in PK.crt -out PK.cer
32+
openssl req -newkey rsa:4096 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Key Exchange Key/" -out KEK.crt
33+
openssl x509 -outform DER -in KEK.crt -out KEK.cer
34+
openssl req -newkey rsa:4096 -nodes -keyout db.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Signature Database key/" -out db.crt
35+
openssl x509 -outform DER -in db.crt -out db.cer
36+
popd > /dev/null
37+
fi
38+
39+
# For debugging, add --no-cache to podman command
40+
sudo podman build \
41+
--from "${FROM}" \
42+
-t "${TAG}" \
43+
--build-arg=COMPOSEFS_FSVERITY="${COMPOSEFS_FSVERITY}" \
44+
-f Containerfile.uki \
45+
--secret=id=key,src=secureboot/db.key \
46+
--secret=id=cert,src=secureboot/db.crt
47+
48+
# rm -rf tmp/efi
49+
# mkdir -p tmp/efi
50+
# ./bootc internals cfs --repo tmp/sysroot/composefs oci pull containers-storage:"${IMAGE_ID}"
51+
# ./bootc internals cfs --repo tmp/sysroot/composefs oci compute-id --bootable "${IMAGE_ID}"
52+
# ./bootc internals cfs --repo tmp/sysroot/composefs oci prepare-boot "${IMAGE_ID}" --bootdir tmp/efi
53+
54+
umount tmp

‎examples/bootc-bls/build-fcos-bls‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/bash
2+
3+
export FROM="quay.io/fedora/fedora-coreos:stable"
4+
export TAG="quay.io/fedora/fedora-coreos-bls:stable"
5+
exec ./build-bootc-bls

‎examples/bootc-bls/build-fcos-uki‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/bash
2+
3+
export FROM="quay.io/fedora/fedora-coreos-bls:stable"
4+
export TAG="quay.io/fedora/fedora-coreos-uki:stable"
5+
exec ./build-bootc-uki

‎examples/bootc-bls/build-uki-addon‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/bin/bash
2+
3+
set -euxo pipefail
4+
5+
cd "${0%/*}"
6+
7+
mkdir -p ../addons
8+
9+
declare -A addons=(
10+
["luks"]="rd.luks.name=8ec9cda3-6b77-45d7-bb56-a95cd9e83234=root"
11+
["console-tty0"]="console=tty0"
12+
["console-ttyS0"]="console=ttyS0,115000n"
13+
["debug-tty0"]="rd.systemd.debug_shell=1 rd.systemd.default_debug_tty=tty0"
14+
)
15+
16+
for addon in "${!addons[@]}"; do
17+
echo "Building kernel command line UKI addon '${addon}': ${addons[${addon}]}"
18+
ukify build \
19+
--cmdline "${addons[${addon}]}" \
20+
--signtool sbsign \
21+
--secureboot-private-key "secureboot/db.key" \
22+
--secureboot-certificate "secureboot/db.crt" \
23+
--output "../addons/${addon}.addon.efi"
24+
25+
done

‎examples/bootc-bls/extra/usr/lib/dracut/modules.d/37bootc/bootc-initramfs-setup.service‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Copyright (C) 2013 Colin Walters <[email protected]>
2+
#
3+
# This library is free software; you can redistribute it and/or
4+
# modify it under the terms of the GNU Lesser General Public
5+
# License as published by the Free Software Foundation; either
6+
# version 2 of the License, or (at your option) any later version.
7+
#
8+
# This library is distributed in the hope that it will be useful,
9+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
10+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11+
# Lesser General Public License for more details.
12+
#
13+
# You should have received a copy of the GNU Lesser General Public
14+
# License along with this library. If not, see <https://www.gnu.org/licenses/>.
15+
16+
[Unit]
17+
DefaultDependencies=no
18+
ConditionKernelCommandLine=composefs
19+
ConditionPathExists=/etc/initrd-release
20+
After=sysroot.mount
21+
Requires=sysroot.mount
22+
Before=initrd-root-fs.target
23+
Before=initrd-switch-root.target
24+
25+
OnFailure=emergency.target
26+
OnFailureJobMode=isolate
27+
28+
[Service]
29+
Type=oneshot
30+
ExecStart=/usr/bin/bootc-initramfs-setup
31+
StandardInput=null
32+
StandardOutput=journal
33+
StandardError=journal+console
34+
RemainAfterExit=yes

‎examples/bootc-bls/extra/usr/lib/dracut/modules.d/37bootc/module-setup.sh‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/usr/bin/bash
2+
3+
check() {
4+
return 0
5+
}
6+
7+
depends() {
8+
return 0
9+
}
10+
11+
install() {
12+
inst \
13+
"${moddir}/bootc-initramfs-setup" /usr/bin/bootc-initramfs-setup
14+
inst \
15+
"${moddir}/bootc-initramfs-setup.service" \
16+
"${systemdsystemunitdir}/bootc-initramfs-setup.service"
17+
18+
$SYSTEMCTL -q --root "${initdir}" add-wants \
19+
'initrd-root-fs.target' 'bootc-initramfs-setup.service'
20+
}

0 commit comments

Comments
 (0)