Verity hash output support. #209
Conversation
|
|
||
| cat <<EOF > $verityConfiguration | ||
| [Unit] | ||
| After=espmountmonitor.service |
There was a problem hiding this comment.
You can use Before and RequiredBy / WantedBy instead of After and Requires to specify the same dependencies but from the opposite service/mount file.
|
|
||
| function updateVeritySetupUnit () { | ||
| systemdDropInDir=/etc/systemd/system | ||
| verityDropInDir=$systemdDropInDir/systemd-veritysetup@root.service.d |
There was a problem hiding this comment.
We shouldn't hardcode this to root verity. Use veritysetup-pre.target instead of systemd-veritysetup@root.service.
There was a problem hiding this comment.
I've refactored the 90mountesppartition dracut module to follow systemd-native mounting workflows.
- Removed the previous manual polling script and service (
espmountmonitor). - Dropped the dependency on modifying
systemd-veritysetup@root.servicedirectly. - Added a generator (
mountesppartition-generator.sh) to dynamically create aboot-efi.mountunit at initramfs boot time. - The
boot-efi.mountis generated based on the kernel cmdline argumentpre.verity.mount=UUID, mounts the ESP to/boot/efi, and ensures it is ready beforeveritysetup-pre.target. - Switched from using After/Requires to Before/WantedBy for clean dependency declaration.
Please have a review, thanks!
| espMountMonitorDir=$systemdDropInDir | ||
| espMountMonitorUnitFile=$espMountMonitorDir/$espMountMonitorName | ||
|
|
||
| cat <<EOF > $espMountMonitorUnitFile |
There was a problem hiding this comment.
Create a .mount file instead of creating a .service file that calls mount.
| @@ -0,0 +1 @@ | |||
| add_dracutmodules+=" mountesppartition " | |||
There was a problem hiding this comment.
There is also the toolkit/tools/internal/resources directory, which embeds the files into the binary.
There was a problem hiding this comment.
TODO - add doc guiding user.
liulanze
force-pushed
the
user/lanzeliu/verity-sig-output
branch
from
8435e49 to
4d4156d
Compare
|
Preview API is merged in a separate PR and other changes are in devdrop |
Checklist