[UKI] Measure #2028

Itxaka · 2023-11-27T16:28:03Z

Part of #1152

mauromorales · 2023-12-07T14:49:10Z

Earthfile

@@ -456,7 +456,7 @@ uki-tools-image:
 # This is for easy testing SecureBoot locally for development purposes
 # Installing this keys in other place than a VM for testing SecureBoot is irresponsible
 uki:
-    FROM ubuntu
+    FROM +uki-tools-image


I think this is the only mention of uki-tools-image target, should we get rid of the target?

For now, but other targets will probably reuse it, the one that creates the upgrade artifacts probably

This used to be consumed by at least 3 targets, not sure what have I done to screw that up

mauromorales · 2023-12-07T14:59:17Z

build_uki.sh

@@ -0,0 +1,144 @@
+#!/usr/bin/env bash


i miss where this file is being consumed

Currently a manual process to generate the images as I'm still working on it, order, retouches and also needs an extra path to generate the artifacts

mauromorales

lgtm

mauromorales · 2023-12-11T11:33:57Z

Earthfile

+    ARG KAIROS_VERSION=$(cat VERSION)
+    FROM scratch
+    COPY +uki-image-artifacts/efi /
+    SAVE IMAGE --push $IMAGE_REPOSITORY_ORG/${FAMILY}:${KAIROS_VERSION}-uki


yup as discussed you should be able to compose the new name with naming.sh

ARG OS_NAME=kairos-${VARIANT}-${FLAVOR}-${FLAVOR_RELEASE} RUN KAIROS_VERSION=$(cat ./VERSION) \ OS_VERSION=$(cat ./VERSION) \ OS_LABEL=$(cat ./VERSION) \ OS_LABEL=$(naming.sh container_artifact_label) \ OS_REPO=$(naming.sh container_artifact_repo) \ ARTIFACT=$(naming.sh bootable_artifact_name) \ envsubst >>/etc/os-release </usr/lib/os-release.tmpl RUN KAIROS_VERSION=$(cat ./VERSION) naming.sh container_artifact_name > /IMAGE ARG _CIMG=$(cat ./IMAGE)

we used to have a command for this, but since for a little while it was done in the dockerfile, I removed it, maybe I should bring it back, but we can do that after this PR

We will soon replace the naming.sh script with versioneer (though the standalone cli or kairos-agent). If you find naming.sh needing any changes, let's coordinate first.

yes indeed, we could have the uki as part of the name maybe in the versioneer? no idea where, if as the model or something (so generic and uki) ?

mauromorales

just the issue with the naming which you already brought up, other than that lgtm

- dont save unsigned artifact as its not used - use the same base image for uki target instead of 2 different ones - save local artifacts on uki-artifacts target Signed-off-by: Itxaka <itxaka@kairos.io>

Signed-off-by: Itxaka <itxaka@kairos.io>

Also add agent dev branch to uki build script Add also init stanza to uki cmdline Signed-off-by: Itxaka <itxaka@kairos.io>

Also add the version to config and efi files Signed-off-by: Itxaka <itxaka@kairos.io>

Signed-off-by: Itxaka <itxaka@kairos.io>

jimmykarily · 2023-12-13T07:23:27Z

tests/keys/private.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----


Are we signing with a publicly available private key? We are not pushing the uki artifact when we release right?

We currently are not pushing anything anywhere.

This is for testing mainly and done with public private keys and certs, all of them used in the uki test pipeline.

Final releases would need a specific workflow to sign and measure them with our private keys.

But that is like a whole other conversation on how to sign them, where, who has the key, how we cycle them, etc..

Not willing to open that discussion right now as it's a big one 🤣

Sure, I'm just making sure I got this right.

Move to ubuntu 23.04 to test TPM encryption on uki Use immmucore from master brnahc until we have a new release Expand uki tests to check that we are encrypting partitions Signed-off-by: Itxaka <itxaka@kairos.io>

Itsd known to work with the encryption as it has a high enough systemd version Adds cracklib-dicts as those are used when validating the luks password Uses agent from main branch as that one has support for uki and newer kcrypt libs Signed-off-by: Itxaka <itxaka@kairos.io>

Signed-off-by: Itxaka <itxaka@kairos.io>

Itxaka · 2023-12-16T09:59:20Z

tested and it seems to work on fedora >=38 and ubuntu >= 23.10
tumbleweed supposedly should work but I was not able to make it work somehow and had very weird issues.

Signed-off-by: Itxaka <itxaka@kairos.io>

so its compatible with fedora 38 and 39 Signed-off-by: Itxaka <itxaka@kairos.io>

They are already in the kairos folder, so only the version is needed in the file name. Same thing with conf file, we keep the name and thats it Signed-off-by: Itxaka <itxaka@kairos.io>

Signed-off-by: Itxaka <itxaka@kairos.io>

Itxaka · 2023-12-18T15:09:18Z

cancelled everything but the uki job

jimmykarily · 2023-12-19T07:58:38Z

Earthfile

@@ -367,79 +348,158 @@ uki-tools-image:
 # NOTE: NEVER EVER EVER use this keys for signing anything that its going outside your computer
 # This is for easy testing SecureBoot locally for development purposes
 # Installing this keys in other place than a VM for testing SecureBoot is irresponsible
-uki:


I'm also making some changes on this. We may get some conflicts: https://github.com/kairos-io/kairos/pull/2081/files#diff-2705f6016a64189abd14041e2f3e8dbb829553295d9088e4eb42eccb5e61bf47R367

New versions are now in the latest framework so we should be able to use those directly Signed-off-by: Itxaka <itxaka@kairos.io>

Itxaka · 2023-12-19T10:08:54Z

This should be finished.

A big change here is that we are moving to use the "main" framework image. That ok for you @mauromorales @jimmykarily @mudler ? I could also cut a new version once @jimmykarily has merged the versioneer stuff, but currently the main framework version has a kairos-agent RC version, so it feels bad to cut a release with RC versions.

jimmykarily · 2023-12-19T11:35:25Z

This should be finished.

A big change here is that we are moving to use the "main" framework image. That ok for you @mauromorales @jimmykarily @mudler ? I could also cut a new version once @jimmykarily has merged the versioneer stuff, but currently the main framework version has a kairos-agent RC version, so it feels bad to cut a release with RC versions.

Oh I forgot we now need to build a new framework image in order to get a new kairos-agent tested. My changes on the kairos-agent should be done. I tagged another rc this morning but it's still building the arm package: https://github.com/kairos-io/packages/actions/runs/7260525990/job/19779962604

If you can to tag kairos-agent as stable and release a framework image with that, I'm fine with it. It will help me test my PR too.

jimmykarily · 2023-12-19T11:44:22Z

Earthfile

@@ -9,7 +9,7 @@ ARG LUET_VERSION=0.35.0
 # renovate: datasource=docker depName=aquasec/trivy
 ARG TRIVY_VERSION=0.47.0
 # renovate: datasource=github-releases depName=kairos-io/kairos-framework
-ARG KAIROS_FRAMEWORK_VERSION="v2.4.4"
+ARG KAIROS_FRAMEWORK_VERSION="main"


I don't think we override this in release pipelines. This means we will be releasing from "main" images. Is it needed only because of the kairos-agent rc? Let's cut a stable one then.

mauromorales · 2023-12-19T11:51:31Z

This should be finished.

A big change here is that we are moving to use the "main" framework image. That ok for you @mauromorales @jimmykarily @mudler ? I could also cut a new version once @jimmykarily has merged the versioneer stuff, but currently the main framework version has a kairos-agent RC version, so it feels bad to cut a release with RC versions.

For me it's ok to move to main but in that case I don't see the value of producing versions for the framework images. I think relying on main can be tricky because what do we release against? It means that either we always have a moving target or that master tests nightly while release build a version. What I mean is that if we consider these issues not to cause many problems then it's a go for me. But for a different component that moves faster I would say it's better not to.

mudler · 2023-12-19T13:23:48Z

what maybe makes sense is having releases using tagged framework images, while main can just consume main (so can be used for development)

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

Itxaka · 2023-12-19T15:12:20Z

bumped to use latest framework released version.

We changed the messages and exit values if the kcrypt failed so we need to adapt the tests Signed-off-by: Itxaka <itxaka@kairos.io>

Itxaka requested a review from a team November 27, 2023 16:28

Itxaka force-pushed the ukify branch from 866b782 to f5b372e Compare November 27, 2023 19:12

Itxaka mentioned this pull request Dec 4, 2023

🌱 spike: lifecycle for static measured boot #1152

Closed

mauromorales reviewed Dec 7, 2023

View reviewed changes

mauromorales approved these changes Dec 7, 2023

View reviewed changes

mauromorales reviewed Dec 11, 2023

View reviewed changes

Itxaka added 9 commits December 11, 2023 13:43

[UKI] Improve targets in Earthfile

3a349e3

- dont save unsigned artifact as its not used - use the same base image for uki target instead of 2 different ones - save local artifacts on uki-artifacts target Signed-off-by: Itxaka <itxaka@kairos.io>

[uki] add test private certificate for measurement

66e142a

Signed-off-by: Itxaka <itxaka@kairos.io>

[uki] Add script to build uki iso with measurements bundled

aaced7d

Signed-off-by: Itxaka <itxaka@kairos.io>

[uki] Rework script to use only docker+earthly

d5217e8

Signed-off-by: Itxaka <itxaka@kairos.io>

Add tpm2 package to base images

6f4c7dd

Also add agent dev branch to uki build script Add also init stanza to uki cmdline Signed-off-by: Itxaka <itxaka@kairos.io>

Fix loader to allow multiple uki entries

b871d79

Also add the version to config and efi files Signed-off-by: Itxaka <itxaka@kairos.io>

Fix uki image building all inside earthly

5beb454

Signed-off-by: Itxaka <itxaka@kairos.io>

Use cIMG for the image name like other artifacts

e54299a

Signed-off-by: Itxaka <itxaka@kairos.io>

Use proper artifact namingt

91c1dd6

Signed-off-by: Itxaka <itxaka@kairos.io>

Itxaka force-pushed the ukify branch from 74577d1 to 91c1dd6 Compare December 11, 2023 12:48

Fix uki workflow

befabad

Signed-off-by: Itxaka <itxaka@kairos.io>

jimmykarily reviewed Dec 13, 2023

View reviewed changes

Itxaka and others added 4 commits December 16, 2023 08:59

Improve uki output and extend tests

339f756

Move to ubuntu 23.04 to test TPM encryption on uki Use immmucore from master brnahc until we have a new release Expand uki tests to check that we are encrypting partitions Signed-off-by: Itxaka <itxaka@kairos.io>

Merge branch 'master' into ukify

f47582c

Print uki install process during test

fd948f1

Signed-off-by: Itxaka <itxaka@kairos.io>

Itxaka added 5 commits December 16, 2023 11:11

test

6dff5a5

Signed-off-by: Itxaka <itxaka@kairos.io>

Bump zfs repo to 2.4

70fd6bf

so its compatible with fedora 38 and 39 Signed-off-by: Itxaka <itxaka@kairos.io>

Do not add kairos prefix to efi files

95671e8

They are already in the kairos folder, so only the version is needed in the file name. Same thing with conf file, we keep the name and thats it Signed-off-by: Itxaka <itxaka@kairos.io>

Restore link to init

bc6e66e

Signed-off-by: Itxaka <itxaka@kairos.io>

Fix things

f1a6934

Signed-off-by: Itxaka <itxaka@kairos.io>

jimmykarily reviewed Dec 19, 2023

View reviewed changes

Use latest framework and drop manual immmucore/agent injection

3c3d679

New versions are now in the latest framework so we should be able to use those directly Signed-off-by: Itxaka <itxaka@kairos.io>

Itxaka force-pushed the ukify branch from 3716034 to 3c3d679 Compare December 19, 2023 10:01

Merge branch 'master' into ukify

909957e

jimmykarily reviewed Dec 19, 2023

View reviewed changes

Update framework version

c1a0d62

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

Fix encryption tests

d59d85a

We changed the messages and exit values if the kcrypt failed so we need to adapt the tests Signed-off-by: Itxaka <itxaka@kairos.io>

jimmykarily approved these changes Dec 20, 2023

View reviewed changes

Itxaka merged commit d62455d into kairos-io:master Dec 20, 2023
34 of 35 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[UKI] Measure #2028

[UKI] Measure #2028

Itxaka commented Nov 27, 2023

mauromorales Dec 7, 2023

Itxaka Dec 7, 2023

mauromorales Dec 7, 2023

Itxaka Dec 7, 2023

mauromorales left a comment

mauromorales Dec 11, 2023

mauromorales Dec 11, 2023

jimmykarily Dec 13, 2023

Itxaka Dec 13, 2023

mauromorales left a comment

jimmykarily Dec 13, 2023

Itxaka Dec 13, 2023

jimmykarily Dec 13, 2023

Itxaka commented Dec 16, 2023

Itxaka commented Dec 18, 2023

jimmykarily Dec 19, 2023

Itxaka commented Dec 19, 2023

jimmykarily commented Dec 19, 2023

jimmykarily Dec 19, 2023

mauromorales commented Dec 19, 2023

mudler commented Dec 19, 2023

Itxaka commented Dec 19, 2023

[UKI] Measure #2028

[UKI] Measure #2028

Conversation

Itxaka commented Nov 27, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mauromorales left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mauromorales left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Itxaka commented Dec 16, 2023

Itxaka commented Dec 18, 2023

Choose a reason for hiding this comment

Itxaka commented Dec 19, 2023

jimmykarily commented Dec 19, 2023

Choose a reason for hiding this comment

mauromorales commented Dec 19, 2023

mudler commented Dec 19, 2023

Itxaka commented Dec 19, 2023