Linux Guard Dev Release

[liulanze]

---

WIP

Key Deltas Between Dev Branch and Main Branch (Linux Guard / Prism)

1. Verity Hash Signature Input/Output Support
   i. systemd patch support: Mariner shiproom approval needed
   Tracking bug: ETA pending, I need to get started on it before providing a reasonable ETA.

2. Verity + UKI -> Verity + UKI Output Image Generation not working

            Dependency: boot partition cleaning code must be commented out; still relies on boot partition and GRUB.
            Active, the bootloader project has been kicked off, design doc:   Bootloader Switching in IC with systemd-boot Support.docx, now I am at phase 1 for the PoC, ETA ~1 week.
   

3. Shim and Systemd-boot Binary Overriding✅

            In main branch, systemd-boot binary overrides shim binary by default for non-signing situation.
            Fix merged in the main.
   

4. Overlay Customization SELinux Handling✅

            Main branch does not remove pre-existing SELinux policy for overlay's upperdir and workdir.
            Fixed, the /usr verity switching eliminates the usage of overlay.
   

5. COSI Metadata Limitation✅

            Main branch COSI metadata cannot handle Verity devices using custom DeviceMountIdType (only supports default partuuid).
            Active, ETA 2 days.
   

6. Overlay-enabled Base Image Customization✅

            Main branch Prism lacks the ability to recognize existing overlay setups from fstab file during image customization.
            Fixed, the /usr verity switching eliminates the usage of overlay.
   

Checklist

• Tests added/updated
• Documentation updated (if needed)
• Code conforms to style guidelines