Skip to content

Commit 0945652

Browse files
danzattdanzatt
authored
Merge pull request #3162 from flatcar/danzatt/sign-sysexts
Signed OS-dependent sysexts
2 parents 09e679c + f7a2e24 commit 0945652

File tree

23 files changed

+403
-14
lines changed

23 files changed

+403
-14
lines changed

‎.github/workflows/portage-stable-packages-list‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -293,6 +293,7 @@ dev-libs/tree-sitter
293293
dev-libs/tree-sitter-bash
294294
dev-libs/userspace-rcu
295295
dev-libs/xmlsec
296+
dev-libs/xxhash
296297
dev-libs/yajl
297298

298299
dev-perl/File-Slurper
@@ -671,6 +672,7 @@ sys-fs/btrfs-progs
671672
sys-fs/cryptsetup
672673
sys-fs/dosfstools
673674
sys-fs/e2fsprogs
675+
sys-fs/erofs-utils
674676
sys-fs/fuse
675677
sys-fs/fuse-common
676678
sys-fs/fuse-overlayfs
@@ -750,6 +752,7 @@ virtual/service-manager
750752
virtual/ssh
751753
virtual/tmpfiles
752754
virtual/udev
755+
virtual/zlib
753756

754757
x11-drivers/nvidia-drivers
755758

‎build_library/prod_image_util.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,10 @@ EOF
170170
# Remove source locale data, only need to ship the compiled archive.
171171
sudo rm -rf ${root_fs_dir}/usr/share/i18n/
172172

173+
# Inject ephemeral sysext signing certificate
174+
sudo mkdir -p "${root_fs_dir}/usr/lib/verity.d"
175+
sudo cp "${SYSEXT_SIGNING_KEY_DIR}/sysexts.crt" "${root_fs_dir}/usr/lib/verity.d"
176+
173177
# Finish image will move files from /etc to /usr/share/flatcar/etc.
174178
# Note that image filesystem contents generated by finish_image will not
175179
# include sysext contents (only the sysext squashfs files themselves).

‎build_library/sysext_prod_builder‎

Lines changed: 25 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ create_prod_sysext() {
6363
# The --install_root_basename="${name}-base-sysext-rootfs" flag is
6464
# important - it sets the name of a rootfs directory, which is used
6565
# to determine the package target in coreos/base/profile.bashrc
66-
sudo "FLATCAR_BUILD_ID=$FLATCAR_BUILD_ID" "${SCRIPTS_DIR}/build_sysext" \
66+
sudo -E "FLATCAR_BUILD_ID=$FLATCAR_BUILD_ID" "${SCRIPTS_DIR}/build_sysext" \
6767
--board="${BOARD}" \
6868
--image_builddir="${workdir}/sysext-build" \
6969
--squashfs_base="${base_sysext}" \
@@ -99,6 +99,14 @@ sysext_mountdir="${BUILD_DIR}/prod-sysext-work/mounts"
9999
sysext_base="${sysext_workdir}/base-os.squashfs"
100100

101101
function cleanup() {
102+
IFS=':' read -r -a mounted_sysexts <<< "$sysext_lowerdirs"
103+
# skip the rootfs
104+
mounted_sysexts=("${mounted_sysexts[@]:1}")
105+
106+
for sysext in "${mounted_sysexts[@]}"; do
107+
sudo systemd-dissect --umount --rmdir "$sysext"
108+
done
109+
102110
sudo umount "${sysext_mountdir}"/* || true
103111
rm -rf "${sysext_workdir}" || true
104112
}
@@ -116,6 +124,7 @@ sudo mksquashfs "${root_fs_dir}" "${sysext_base}" -noappend -xattrs-exclude '^bt
116124
# for combined overlay later.
117125
prev_pkginfo=""
118126
sysext_lowerdirs="${sysext_mountdir}/rootfs-lower"
127+
mkdir -p "${sysext_mountdir}"
119128
for sysext in ${sysexts_list//,/ }; do
120129
# format is "<name>:<group>/<package>"
121130
name="${sysext%|*}"
@@ -129,12 +138,21 @@ for sysext in ${sysexts_list//,/ }; do
129138
"${grp_pkg}" \
130139
"${prev_pkginfo}"
131140

132-
mkdir -p "${sysext_mountdir}/${name}" \
133-
"${sysext_mountdir}/${name}_pkginfo"
134-
sudo mount -rt squashfs -o loop,nodev "${sysext_output_dir}/${name}.raw" \
135-
"${sysext_mountdir}/${name}"
136-
sudo mount -rt squashfs -o loop,nodev "${sysext_output_dir}/${name}_pkginfo.raw" \
137-
"${sysext_mountdir}/${name}_pkginfo"
141+
sudo systemd-dissect \
142+
--read-only \
143+
--mount \
144+
--mkdir \
145+
--image-policy='root=encrypted+unprotected+absent:usr=encrypted+unprotected+absent' \
146+
"${sysext_output_dir}/${name}.raw" \
147+
"${sysext_mountdir}/${name}"
148+
149+
sudo systemd-dissect \
150+
--read-only \
151+
--mount \
152+
--mkdir \
153+
--image-policy='root=encrypted+unprotected+absent:usr=encrypted+unprotected+absent' \
154+
"${sysext_output_dir}/${name}_pkginfo.raw" \
155+
"${sysext_mountdir}/${name}_pkginfo"
138156

139157
sysext_lowerdirs="${sysext_lowerdirs}:${sysext_mountdir}/${name}"
140158
sysext_lowerdirs="${sysext_lowerdirs}:${sysext_mountdir}/${name}_pkginfo"

‎build_library/vm_image_util.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -602,7 +602,7 @@ install_oem_sysext() {
602602
fi
603603

604604
mkdir -p "${built_sysext_dir}"
605-
sudo "${build_sysext_env[@]}" "${SCRIPT_ROOT}/build_sysext" "${build_sysext_flags[@]}" "${oem_sysext}"
605+
sudo -E "${build_sysext_env[@]}" "${SCRIPT_ROOT}/build_sysext" "${build_sysext_flags[@]}" "${oem_sysext}"
606606

607607
local installed_sysext_oem_dir='/oem/sysext'
608608
local installed_sysext_file_prefix="${oem_sysext}-${version}"

‎build_sysext‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -304,14 +304,25 @@ if [[ -n "${invalid_files}" ]]; then
304304
die "Invalid file ownership: ${invalid_files}"
305305
fi
306306

307-
mksquashfs "${BUILD_DIR}/${FLAGS_install_root_basename}" "${BUILD_DIR}/${SYSEXTNAME}.raw" \
308-
-noappend -xattrs-exclude '^btrfs.' -comp "${FLAGS_compression}" ${FLAGS_mksquashfs_opts}
307+
systemd-repart \
308+
--private-key="${SYSEXT_SIGNING_KEY_DIR}/sysexts.key" \
309+
--certificate="${SYSEXT_SIGNING_KEY_DIR}/sysexts.crt" \
310+
--make-ddi=sysext \
311+
--copy-source="${BUILD_DIR}/${FLAGS_install_root_basename}" \
312+
"${BUILD_DIR}/${SYSEXTNAME}.raw"
313+
309314
rm -rf "${BUILD_DIR}"/{fs-root,"${FLAGS_install_root_basename}",workdir}
310315

311316
# Generate reports
312317
mkdir "${BUILD_DIR}/img-rootfs"
313-
mount -rt squashfs -o loop,nodev "${BUILD_DIR}/${SYSEXTNAME}.raw" "${BUILD_DIR}/img-rootfs"
318+
systemd-dissect --read-only \
319+
--mount \
320+
--mkdir \
321+
--image-policy='root=encrypted+unprotected+absent:usr=encrypted+unprotected+absent' \
322+
"${BUILD_DIR}/${SYSEXTNAME}.raw" \
323+
"${BUILD_DIR}/img-rootfs"
324+
314325
write_contents "${BUILD_DIR}/img-rootfs" "${BUILD_DIR}/${SYSEXTNAME}_contents.txt"
315326
write_contents_with_technical_details "${BUILD_DIR}/img-rootfs" "${BUILD_DIR}/${SYSEXTNAME}_contents_wtd.txt"
316327
write_disk_space_usage_in_paths "${BUILD_DIR}/img-rootfs" "${BUILD_DIR}/${SYSEXTNAME}_disk_usage.txt"
317-
umount "${BUILD_DIR}/img-rootfs"
328+
systemd-dissect --umount --rmdir "${BUILD_DIR}/img-rootfs"

‎changelog/changes/2025-11-05-signed-os-dependent-sysexts.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
- OS-dependent sysexts (e.g., docker-flatcar, containerd-flatcar) are now cryptographically signed using dm-verity roothash signatures. This enables stricter sysext policies via systemd-sysext and provides a foundation for verifying user-provided extensions in future releases. The format changed from squashfs to erofs-based Discoverable Disk Images (DDI). ([scripts#3162](https://github.com/flatcar/scripts/pull/3162))

‎sdk_container/src/third_party/coreos-overlay/app-crypt/azure-keyvault-pkcs11/Manifest‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
DIST azure-keyvault-pkcs11-0_p20250526.tar.gz 22829 BLAKE2B 59df337d32c1931577cd6538a53032fc9f5a43ce67192d114b23b84adfb36c234e091c9cbf2183efc080d093a6c17b7596abd3e7789ffbbd0634912d16d92693 SHA512 410f3f4e446aa1c1307769bc021f39ec9dd01cd08c2a3089889ad382f2b1948bd03eb065970901982a014a31f4bef4cd102a14a39286a7518736b59b4d0ee03f
1+
DIST azure-keyvault-pkcs11-0_p20250905.tar.gz 22855 BLAKE2B e380d091ef486b988cc3720ae16f00082af69eb8f2dab4f1ee9729e3f18ea3ec06c39cf774aed6a887fba14190431592e7bfc5cb161f3b1a2cc82a050a1d4758 SHA512 902ec4a31e52f3d480dac485c12569813c108fed69b968b42a0262b3d94bcbe6b79ac54c801dec3f44141dcb387d04873ddccd99bf06ed46c93bc2fb919374f7

sdk_container/src/third_party/coreos-overlay/app-crypt/azure-keyvault-pkcs11/azure-keyvault-pkcs11-0_p20250526.ebuild renamed to sdk_container/src/third_party/coreos-overlay/app-crypt/azure-keyvault-pkcs11/azure-keyvault-pkcs11-0_p20250905.ebuild

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ EAPI=8
55

66
inherit cmake
77

8-
COMMIT="126ae2bc714f2867b6628b49962f388c4b314f5f"
8+
COMMIT="c72d89bf0b17f8c21a93870efaaabb93c0dc9c63"
99
DESCRIPTION="PKCS#11 module for Azure Key Vault"
1010
HOMEPAGE="https://github.com/jepio/azure_keyvault_pkcs11"
1111
SRC_URI="https://github.com/jepio/azure_keyvault_pkcs11/archive/${COMMIT}.tar.gz -> ${P}.tar.gz"

‎sdk_container/src/third_party/coreos-overlay/coreos-devel/sdk-depends/sdk-depends-0.0.1.ebuild‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ DEPEND="
4646
sys-firmware/edk2-bin
4747
sys-fs/btrfs-progs
4848
sys-fs/cryptsetup
49+
sys-fs/erofs-utils
4950
dev-perl/Parse-Yapp
5051
dev-util/pkgcheck
5152
"

‎sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.accept_keywords‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,5 @@
11
# Temporarily put the SDK version ahead for sd-json support in Dracut.
2+
3+
# Needed for building signed sysexts with systemd-repart
4+
dev-libs/xxhash
5+
sys-fs/erofs-utils

0 commit comments

Comments
 (0)