Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Kirkstone: backport main changes #1543

Merged
merged 19 commits into from
Nov 25, 2024
Merged

Kirkstone: backport main changes #1543

merged 19 commits into from
Nov 25, 2024

Conversation

quaresmajose
Copy link
Member

@quaresmajose quaresmajose commented Nov 21, 2024 •
edited
Loading

backport some changes from main tip add24ec

ldts and others added 4 commits November 21, 2024 16:28
@ldts @quaresmajose
base: UEFI Secure Boot Provisioning
cfb476e 
Simplify the Secure Boot key provisioning process by adding a
systemd-boot entry wich uses the efitools EFI program "LockDown.efi".

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
(cherry picked from commit c23ebb7)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@vanmaegima @quaresmajose
bsp: core: base-files: automount vfat boot partition
fb9b822 
Automount[1] the boot partition to  minimize vfat partition corruption risks.

This mounts the partition on demand and unmounts after use.

[1] https://www.freedesktop.org/software/systemd/man/latest/systemd.automount.html#

Signed-off-by: Vanessa Maegima <vanessa.maegima@foundries.io>
(cherry picked from commit 52eadde)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@igoropaniuk @quaresmajose
base: u-boot-ostree-scr-fit: drop unneeded variable assigments
05d61d9 
Drop unneeded variable assigments as they don't make sense (the variable
is assigned to its value).

Signed-off-by: Igor Opaniuk <igor.opaniuk@foundries.io>
(cherry picked from commit 14b1840)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@igoropaniuk @quaresmajose
base: u-boot-ostree-scr-fit: separate bootfirmware version variables
b40c5e0 
Store stable boot firmware version in "fiovb.bootfirmware_version",
and use "bootfirmware_version" only as a temporary storage
for a target boot firmware version

Signed-off-by: Igor Opaniuk <igor.opaniuk@foundries.io>
(cherry picked from commit 47083a3)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@quaresmajose quaresmajose requested a review from a team November 21, 2024 16:31
@quaresmajose quaresmajose mentioned this pull request Nov 21, 2024
Merged
vanmaegima
vanmaegima reviewed Nov 21, 2024
View reviewed changes
Copy link
Member

@vanmaegima vanmaegima left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From CS perspective:

  • removing jailhouse should be fine as it's already removed from Factory creation and active customers are not using it (we should just document as an Attention Point for the Migration)
  • changes in BRANCH/SRCREV need to be double checked as Daiane pointed out
  • UEFI provision changes look good
  • SOTA client changes look good

@ricardosalveti
Copy link
Member

ricardosalveti commented Nov 21, 2024 •
edited
Loading

From my side:

  • OK to remove jailhouse since we never really supported it officially
  • Updates to the SOTA stack needs to be confirmed with @mike-sul and @detsch, because they were not yet fully validated on a release
  • Clang revert requires a meta-clang update as well, right?

ldts and others added 15 commits November 22, 2024 10:03
@ldts @quaresmajose
base: kernel-lmp-efi: check for sbsign sbverify errors
db4a5ad 
Report errors during secure boot sign and verify.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
(cherry picked from commit 2e5e792)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@quaresmajose
bsp: stm32-mfgtool-files: make it compatible with stm bsp
57bc6e4 
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
(cherry picked from commit fbcf51d)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@quaresmajose
bsp: ti-mfgtool-files: make it compatible with ti bsp
bde278a 
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
(cherry picked from commit eb7b3a2)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@quaresmajose
base: mfgtool-files: make it compatible with imx bsp
61a563e 
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
(cherry picked from commit f92130d)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@quaresmajose
base/bsp: drop jailhouse
ab103fc 
This allows us to reduce maintenance and testing effort.
If necessary, it can be added at the customer's factory.

Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
(cherry picked from commit 73ab71f)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@ldts @quaresmajose
efitools: provide an unlock.efi solution
f2a283a 
Generate a specular file (unlock) to the provisioning one.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
(cherry picked from commit 026661d)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@ldts @quaresmajose
base: initramfs-framework: refactor access to UEFI variables
9662d78 
Use efivar to access uefi variables in a standard way.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
(cherry picked from commit 352caf1)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@ldts @quaresmajose
base: init-install-efi: installer: support encrypted rootfs
de6b3d2 
Add support for a CI encrypted rootfs USB installer.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
(cherry picked from commit 2445ef2)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@ldts @quaresmajose
base: initramfs: check for secure boot
8b34981 
Using efivar --print-decimal returns an integer.

Fixes: 352caf1 ("base: initramfs-framework: refactor access to UEFI variables")
Fixes: 2445ef2 ("base: init-install-efi: installer: support encrypted rootfs")

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
(cherry picked from commit 604223e)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@ldts @quaresmajose
base: initrd: CI encryption: use the customer's passphrase
4861469 
Fix the current implementation where the passphrase is not being
propagated. Users can now request their own passphrases for CI luks
encryption.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
(cherry picked from commit 1c4ae75)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@ldts @quaresmajose
bsp: intel-corei7-64: provisioning/revocation menu
9a40008 
Systemd-boot will display its menu by alphabetically iterating the
different configuration files.

This commit makes sure that the secure boot menus (provision/revocation)
are displayed next to each other for a more structured screen.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
(cherry picked from commit 3d03807)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@ldts @quaresmajose
efitools: unlock: must have UEFI_SIGN_ENABLE
4d02a15 
The UEFI key revocation tool requires the user to provide the keys that
need to be revoked.

If the keys are not provided, the userspace tools built by this recipe
will still be deployed.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
(cherry picked from commit fcd7286)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@quaresmajose
base: efitools: verify the signing keys
b920b1f 
Instead of raising a Python exception, we can verify that all required
keys are present and provide a helpful error message if any are missing.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
(cherry picked from commit a135ad2)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@ldts @quaresmajose
bsp: intel-corei7-64: default entry
7b124da 
On the first boot, systemd-boot 250.4 defaults to the last element on
the display list.

Make the OSTree deployment the last (alphabetically sorted)

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
(cherry picked from commit 129b261)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@igoropaniuk @quaresmajose
bsp: tf-a: fix path to the combo image
2d532d0 
Fix the path to the combo (tfa+fip) image ('s/arm-trusted-firmware/fip/g').

Fixes: 5413f74 ("bsp: tf-a-fio-st: create combo images for eval board")
Signed-off-by: Igor Opaniuk <igor.opaniuk@foundries.io>
(cherry picked from commit d6b9d3f)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
@quaresmajose
Copy link
Member Author

From CS perspective:

  • removing jailhouse should be fine as it's already removed from Factory creation and active customers are not using it (we should just document as an Attention Point for the Migration)
  • changes in BRANCH/SRCREV need to be double checked as Daiane pointed out

I dropped these changes

  • UEFI provision changes look good
  • SOTA client changes look good

@quaresmajose
Copy link
Member Author

From my side:

  • OK to remove jailhouse since we never really supported it officially
  • Updates to the SOTA stack needs to be confirmed with @mike-sul and @detsch, because they were not yet fully validated on a release

I dropped these changes

  • Clang revert requires a meta-clang update as well, right?

right, so I also drop it

ricardosalveti
ricardosalveti approved these changes Nov 22, 2024
View reviewed changes
Copy link
Member

@ricardosalveti ricardosalveti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@quaresmajose quaresmajose merged commit 5e05256 into foundriesio:kirkstone Nov 25, 2024
1 check passed
@quaresmajose quaresmajose deleted the kirkstone branch November 25, 2024 10:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vanmaegima vanmaegima vanmaegima left review comments

@ricardosalveti ricardosalveti ricardosalveti approved these changes

@angolini angolini angolini approved these changes

@Tim-Anderson Tim-Anderson Awaiting requested review from Tim-Anderson

@caiotpereira caiotpereira Awaiting requested review from caiotpereira

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@quaresmajose @ricardosalveti @angolini @vanmaegima @ldts @igoropaniuk