Skip to content

Commit 979c3f4

Browse files
nikita-dubrovskiinikita-dubrovskii
committed
qemu-secex: generate fake-secure-vm.qcow2 for local build
Automatically generates genprotimgvm during build, when official one is not available and/or there is no so-called "IBM Universal Hostkey". Main goal is to support local/custom build of qemu-secex target. Assuming there is a valid hostkey (/srv/secex-hostkey), it'd possible to generate coreos.qemu-secex.qcow2 just by running: ``` cosa cmd-buildextend-secex ``` If later there is a need to build some other variant, previously generated genprotimgvm could be used again: ``` cosa buildextend-secex --force --genprotimgvm path/to/fake-secure-vm.qcow2 ```
1 parent cc0d950 commit 979c3f4

File tree

1 file changed

+66
-45
lines changed

1 file changed

+66
-45
lines changed

‎src/cmd-osbuild‎

Lines changed: 66 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -77,51 +77,67 @@ json.dump(j, sys.stdout, indent=4)
7777
# For qemu-secex we need to do a few extra things like spin up a
7878
# VM to run genprotimg and save off the pubkey for Ignition.
7979
postprocess_qemu_secex() {
80-
if [ ! -f "${genprotimgvm}" ]; then
81-
fatal "No genprotimgvm provided at ${genprotimgvm}"
82-
fi
83-
84-
# Basic qemu args:
85-
qemu_args=(); blk_size="512"
86-
[[ $platform == metal4k ]] && blk_size="4096"
87-
qemu_args+=("-drive" "if=none,id=target,format=qcow2,file=${imgpath},cache=unsafe" \
88-
"-device" "virtio-blk,serial=target,drive=target,physical_block_size=${blk_size},logical_block_size=${blk_size}")
89-
90-
# SecureVM (holding Universal Key for all IBM Z Mainframes) requires scripts to execute genprotimg
91-
se_script_dir="/usr/lib/coreos-assembler/secex-genprotimgvm-scripts"
92-
genprotimg_img="${PWD}/secex-genprotimg.img"
93-
genprotimg_dir=$(mktemp -p "${tmp_builddir}" -d)
94-
cp "${se_script_dir}/genprotimg-script.sh" "${se_script_dir}/post-script.sh" "${genprotimg_dir}"
95-
# Extra kargs with dm-verity hashes
96-
secex_kargs="ignition.firstboot"
97-
secex_kargs+=" rootfs.roothash=$(<"${outdir}/${platform}/rootfs_hash")"
98-
secex_kargs+=" bootfs.roothash=$(<"${outdir}/${platform}/bootfs_hash")"
99-
echo "${secex_kargs}" > "${genprotimg_dir}/parmfile"
100-
virt-make-fs --format=raw --type=ext4 "${genprotimg_dir}" "${genprotimg_img}"
101-
rm -rf "${genprotimg_dir}"
102-
qemu_args+=("-drive" "if=none,id=genprotimg,format=raw,file=${genprotimg_img}" \
103-
"-device" "virtio-blk,serial=genprotimg,drive=genprotimg")
104-
105-
# GPG keys used for protecting Ignition config
106-
tmp_gpg_home=$(mktemp -p "${tmp_builddir}" -d)
107-
ignition_pubkey=$(mktemp -p "${tmp_builddir}")
108-
ignition_prikey=$(mktemp -p "${tmp_builddir}")
109-
gpg --homedir "${tmp_gpg_home}" --batch --passphrase '' --yes --quick-gen-key "Secure Execution (secex) ${build}" rsa4096 encr none
110-
gpg --homedir "${tmp_gpg_home}" --armor --export secex > "${ignition_pubkey}"
111-
gpg --homedir "${tmp_gpg_home}" --armor --export-secret-key secex > "${ignition_prikey}"
112-
exec 9<"${ignition_prikey}"
113-
rm -rf "${tmp_gpg_home}" "${ignition_prikey}"
114-
qemu_args+=("-add-fd" "fd=9,set=3" "-drive" "if=none,id=gpgkey,format=raw,file=/dev/fdset/3,readonly=on" \
115-
"-device" "virtio-blk,serial=gpgkey,drive=gpgkey")
116-
117-
/usr/lib/coreos-assembler/secex-genprotimgvm-scripts/runvm.sh \
118-
--genprotimgvm "${genprotimgvm}" -- "${qemu_args[@]}"
119-
rm -f "${genprotimg_img}"
120-
exec 9>&-
121-
122-
# Now store the generated ${ignition_pubkey} in the builddir and meta.json
123-
gpg_key_filename="${name}-${build}-ignition-secex-key.gpg.pub"
124-
postprocess_artifact "ignition-gpg-key" "${ignition_pubkey}" "${gpg_key_filename}" 'True'
80+
if [ ! -f "${genprotimgvm}" ]; then
81+
echo "No genprotimgvm provided"
82+
genprotimgvm="${workdir}/tmp/fake-secure-vm.qcow2"
83+
if [ -f "${genprotimgvm}" ]; then
84+
echo "Found locally generated ${genprotimgvm}, skipping generation"
85+
else
86+
if [ ! -f "${hostkey}" ]; then
87+
fatal "No hostkey and no genprotimgvm provided"
88+
fi
89+
ignition=$(mktemp -p "${tmp_builddir}")
90+
butane -p -d "$(dirname "${hostkey}")" /usr/lib/coreos-assembler/secex-genprotimgvm-scripts/genprotimg.bu -o "${ignition}"
91+
92+
cp "/srv/builds/latest/${basearch}/${name}-${build}-qemu.${basearch}.${suffix}" "${genprotimgvm}"
93+
chmod +w "${genprotimgvm}"
94+
genvm_args=("-drive" "if=none,id=hda,format=qcow2,file=${genprotimgvm},auto-read-only=off,cache=unsafe" \
95+
"-device" "virtio-blk,drive=hda,bootindex=1")
96+
kola qemuexec -i "${ignition}" -- "${genvm_args[@]}"
97+
fi
98+
fi
99+
100+
# Basic qemu args:
101+
qemu_args=(); blk_size="512"
102+
[[ $platform == metal4k ]] && blk_size="4096"
103+
qemu_args+=("-drive" "if=none,id=target,format=qcow2,file=${imgpath},cache=unsafe" \
104+
"-device" "virtio-blk,serial=target,drive=target,physical_block_size=${blk_size},logical_block_size=${blk_size}")
105+
106+
# SecureVM (holding Universal Key for all IBM Z Mainframes) requires scripts to execute genprotimg
107+
se_script_dir="/usr/lib/coreos-assembler/secex-genprotimgvm-scripts"
108+
genprotimg_img="${PWD}/secex-genprotimg.img"
109+
genprotimg_dir=$(mktemp -p "${tmp_builddir}" -d)
110+
cp "${se_script_dir}/genprotimg-script.sh" "${se_script_dir}/post-script.sh" "${genprotimg_dir}"
111+
# Extra kargs with dm-verity hashes
112+
secex_kargs="ignition.firstboot"
113+
secex_kargs+=" rootfs.roothash=$(<"${outdir}/${platform}/rootfs_hash")"
114+
secex_kargs+=" bootfs.roothash=$(<"${outdir}/${platform}/bootfs_hash")"
115+
echo "${secex_kargs}" > "${genprotimg_dir}/parmfile"
116+
virt-make-fs --format=raw --type=ext4 "${genprotimg_dir}" "${genprotimg_img}"
117+
rm -rf "${genprotimg_dir}"
118+
qemu_args+=("-drive" "if=none,id=genprotimg,format=raw,file=${genprotimg_img}" \
119+
"-device" "virtio-blk,serial=genprotimg,drive=genprotimg")
120+
121+
# GPG keys used for protecting Ignition config
122+
tmp_gpg_home=$(mktemp -p "${tmp_builddir}" -d)
123+
ignition_pubkey=$(mktemp -p "${tmp_builddir}")
124+
ignition_prikey=$(mktemp -p "${tmp_builddir}")
125+
gpg --homedir "${tmp_gpg_home}" --batch --passphrase '' --yes --quick-gen-key "Secure Execution (secex) ${build}" rsa4096 encr none
126+
gpg --homedir "${tmp_gpg_home}" --armor --export secex > "${ignition_pubkey}"
127+
gpg --homedir "${tmp_gpg_home}" --armor --export-secret-key secex > "${ignition_prikey}"
128+
exec 9<"${ignition_prikey}"
129+
rm -rf "${tmp_gpg_home}" "${ignition_prikey}"
130+
qemu_args+=("-add-fd" "fd=9,set=3" "-drive" "if=none,id=gpgkey,format=raw,file=/dev/fdset/3,readonly=on" \
131+
"-device" "virtio-blk,serial=gpgkey,drive=gpgkey")
132+
133+
/usr/lib/coreos-assembler/secex-genprotimgvm-scripts/runvm.sh \
134+
--genprotimgvm "${genprotimgvm}" -- "${qemu_args[@]}"
135+
rm -f "${genprotimg_img}"
136+
exec 9>&-
137+
138+
# Now store the generated ${ignition_pubkey} in the builddir and meta.json
139+
gpg_key_filename="${name}-${build}-ignition-secex-key.gpg.pub"
140+
postprocess_artifact "ignition-gpg-key" "${ignition_pubkey}" "${gpg_key_filename}" 'True'
125141
}
126142

127143
# Here we generate the input JSON we pass to runvm_osbuild for all of our image builds
@@ -207,6 +223,7 @@ EOF
207223
main() {
208224
# Set Some Defaults
209225
genprotimgvm=/data.secex/genprotimgvm.qcow2
226+
hostkey=/srv/secex-hostkey
210227
build=
211228
force=
212229

@@ -244,6 +261,10 @@ main() {
244261
genprotimgvm="$2"
245262
shift
246263
;;
264+
--hostkey)
265+
hostkey="$2"
266+
shift
267+
;;
247268
--platforms)
248269
shift # The arg is next in position args
249270
# Split the comma separated string of platforms into an array

0 commit comments

Comments
 (0)