Skip to content

Conversation

@labbott
Copy link
Contributor

@labbott labbott commented Nov 21, 2025

Some refactoring in a dependent lpc55 crate accidentally dropped a check against the root key table hash on the RoT. This resulted in archive.verify incorrectly passing in places like wicketd and selecting incorrect RoT images for installation.

Copy link
Contributor

@plotnick plotnick left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like this is downgrading a bunch of packages, which doesn't seem right. I've had trouble of this form in the past trying to use cargo update; maybe it would be better to just pin the rev of hubtools we intend to use in Cargo.toml?

@labbott
Copy link
Contributor Author

labbott commented Nov 21, 2025

It looks like this is downgrading a bunch of packages, which doesn't seem right. I've had trouble of this form in the past trying to use cargo update; maybe it would be better to just pin the rev of hubtools we intend to use in Cargo.toml?

bleh good catch. I tried just updating the branch for testing and it didn't work until I did cargo update -p. I'll change this to a pin because that's what we do elsewhere.

Some refactoring in a dependent lpc55 crate accidentally dropped a check
against the root key table hash on the RoT. This resulted in
`archive.verify` incorrectly passing in places like wicketd and selecting
incorrect RoT images for installation.
@labbott
Copy link
Contributor Author

labbott commented Nov 21, 2025

I think the issue is that the actual fix was in the lpc55_sign crate which is a dependency of hubtools so I did need an update to force the pickup of the new rev.

Copy link
Contributor

@plotnick plotnick left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great, thanks! We are now pulling in two versions of hubtools because gateway-sp-comms (from m-g-s) hasn't been updated yet, but I don't think that should affect the issue we're trying to solve here, nor do I think it's a problem.

@labbott labbott merged commit 6d70269 into main Nov 22, 2025
18 checks passed
@labbott labbott deleted the fixed_hubtools branch November 22, 2025 14:47
labbott added a commit that referenced this pull request Nov 24, 2025
Omcrion #9437 fixed a bug that could cause an incorrect image
to be selected for update. Due to some luck with ordering, this
bug should not affect gimlet sleds so long as we have gimlet
images show up before cosmo images. Add some checks at build
time to make sure this is the case until we have upgraded pass
this bug.
jgallagher added a commit to oxidecomputer/management-gateway-service that referenced this pull request Nov 24, 2025
Just like oxidecomputer/omicron#9437, pin to a
specific revision to avoid issues with git deps and `cargo update`.
jgallagher added a commit to oxidecomputer/management-gateway-service that referenced this pull request Nov 24, 2025
Just like oxidecomputer/omicron#9437, pin to a
specific revision to avoid issues with git deps and `cargo update`.
labbott added a commit that referenced this pull request Nov 25, 2025
Omcrion #9437 fixed a bug that could cause an incorrect image
to be selected for update. Due to some luck with ordering, this
bug should not affect gimlet sleds so long as we have gimlet
images show up before cosmo images. Add some checks at build
time to make sure this is the case until we have upgraded pass
this bug.
labbott added a commit that referenced this pull request Nov 25, 2025
Omcrion #9437 fixed a bug that could cause an incorrect image to be
selected for update. Due to some luck with ordering, this bug should not
affect gimlet sleds so long as we have gimlet images show up before
cosmo images. Add some checks at build time to make sure this is the
case until we have upgraded pass this bug.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants