Verity hash signature I/O feature support. #270
Conversation
|
|
||
| if [[ -n "$bootPartitionUuid" ]]; then | ||
| mkdir -p /boot | ||
| mount -U $bootPartitionUuid /boot |
There was a problem hiding this comment.
This code is only temporary, so it doesn't matter too much but you should really be using a .mount file instead of calling mount manually.
There was a problem hiding this comment.
Agree the .mount unit would be in the long term, due to time constraints and the temporary of this implementation, shall we be going with the simpler mount approach for now. Marking as won’t fix for this iteration.
toolkit/tools/internal/resources/verity-signature/10-mountbootpartition.conf
Outdated
Show resolved
Hide resolved
liulanze
force-pushed
the
user/lanzeliu/io-verityhash
branch
2 times, most recently
from
642b69d to
02c276c
Compare
| return fmt.Errorf("invalid hashSignaturePath:\n%w", err) | ||
| } | ||
|
|
||
| sigPath := filepath.Clean(v.HashSignaturePath) |
There was a problem hiding this comment.
Would it make sense to report an error if filepath.Clean returns a string that is different than what was passed to it?
There was a problem hiding this comment.
Do you mean we don't like users to give non-standard path? I've added, please check.
| return nil | ||
| } | ||
|
|
||
| func InstallVerityMountBootPartitionDracutModule(installRoot string) error { |
There was a problem hiding this comment.
nit: Make function private.
liulanze
force-pushed
the
user/lanzeliu/io-verityhash
branch
from
d74117e to
b102647
Compare
This PR adds support for Verity hash signature I/O in Image Customizer, prepare the appropriate kernel command line arguments (such as
root-hash-signature=...), and integrate with the supportingdracutmodule for boot-time verification.It also resolves two related bugs. First, it ensures that if
hashSignaturePathis not specified for a Verity device, no signature artifacts are generated or emitted, even if verity-hash is included in.output.artifacts. Second, it fixes the parsing logic forsystemd.verity_*_optionskernel arguments to properly handleroot-hash-signature=...in addition to corruption handling options, ensuring the signature path is correctly extracted and reapplied when rebuilding images.Checklist