Skip to content

Commit dda89ee

Browse files
croissannecroissanne
committed
examples/nofsverity: add example without fsverity
Signed-off-by: Sanne Raymaekers <[email protected]>
1 parent 3c39ba1 commit dda89ee

File tree

15 files changed

+202
-0
lines changed

15 files changed

+202
-0
lines changed

‎examples/nofsverity/Containerfile.arch

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
FROM archlinux AS base
2+
COPY extra /
3+
RUN <<EOF
4+
set -eux
5+
6+
touch /etc/machine-id
7+
mkdir -p boot/EFI/Linux
8+
9+
pacman -Syu --noconfirm
10+
pacman -Sy --noconfirm \
11+
composefs \
12+
dosfstools \
13+
linux \
14+
openssh \
15+
strace \
16+
skopeo
17+
18+
systemctl enable systemd-networkd systemd-resolved sshd
19+
passwd -d root
20+
mkdir /sysroot
21+
EOF
22+
COPY cfsctl /usr/bin
23+
24+
FROM base AS kernel
25+
ARG COMPOSEFS_FSVERITY
26+
RUN <<EOF
27+
set -eux
28+
# systemd-boot-unsigned: ditto
29+
echo "root=/dev/vda2 console=ttyS0,115200 composefs=${COMPOSEFS_FSVERITY} rw" > /etc/kernel/cmdline
30+
pacman -Sy --noconfirm systemd-ukify
31+
mkinitcpio -p linux
32+
EOF
33+
34+
FROM base AS bootable
35+
COPY --from=kernel /boot /boot

‎examples/nofsverity/build

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
#!/bin/sh
2+
3+
set -eux
4+
5+
os="${1:-fedora}"
6+
cd "${0%/*}"
7+
8+
FIX_VERITY=1 ../common/check-config
9+
10+
case "${os}" in
11+
arch)
12+
containerfile='Containerfile.arch'
13+
features='--features=pre-6.15'
14+
;;
15+
*)
16+
echo "*** unknown variant ${os}"
17+
false
18+
;;
19+
esac
20+
21+
# https://github.com/containers/buildah/issues/5656
22+
PODMAN_BUILD="podman build --no-cache"
23+
24+
cargo build --release "${features}"
25+
26+
cp ../../target/release/cfsctl .
27+
cp ../../target/release/composefs-setup-root extra/usr/lib/dracut/modules.d/37composefs/
28+
CFSCTL='./cfsctl --repo tmp/sysroot/composefs'
29+
30+
rm -rf tmp
31+
mkdir -p tmp/sysroot/composefs
32+
33+
${PODMAN_BUILD} \
34+
--iidfile=tmp/base.iid \
35+
--target=base \
36+
-f "${containerfile}" \
37+
.
38+
39+
BASE_ID="$(sed s/sha256:// tmp/base.iid)"
40+
${CFSCTL} oci pull containers-storage:"${BASE_ID}"
41+
BASE_IMAGE_FSVERITY="$(${CFSCTL} oci compute-id --bootable "${BASE_ID}")"
42+
43+
${PODMAN_BUILD} \
44+
--iidfile=tmp/final.iid \
45+
--build-context=base="container-image://${BASE_ID}" \
46+
--build-arg=COMPOSEFS_FSVERITY="?${BASE_IMAGE_FSVERITY}" \
47+
--label=containers.composefs.fsverity="${BASE_IMAGE_FSVERITY}" \
48+
-f "${containerfile}" \
49+
.
50+
51+
FINAL_ID="$(sed s/sha256:// tmp/final.iid)"
52+
${CFSCTL} oci pull containers-storage:"${FINAL_ID}"
53+
${CFSCTL} oci prepare-boot "${FINAL_ID}" --bootdir tmp/efi
54+
55+
../common/install-systemd-boot
56+
../common/make-image -sr "${os}-nofsverity-efi.qcow2"

‎examples/nofsverity/extra/etc/dracut.conf.d/no-xattr.conf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
export DRACUT_NO_XATTR=1

‎examples/nofsverity/extra/etc/mkinitcpio.conf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
MODULES=(overlay erofs)
2+
BINARIES=(strace)
3+
HOOKS=(base udev composefs autodetect microcode modconf kms keyboard keymap block filesystems)

‎examples/nofsverity/extra/etc/mkinitcpio.d/linux.preset

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
ALL_kver="/boot/vmlinuz-linux"
2+
3+
MODULES=(ext4 overlay erofs)
4+
BINARIES=(fsck.ext4 strace)
5+
HOOKS=(base udev composefs autodetect microcode modconf kms keyboard keymap consolefont block filesystems fsck)
6+
7+
PRESETS=('default')
8+
9+
default_uki="/boot/EFI/Linux/arch-linux.efi"
10+
default_options="--splash=/usr/share/systemd/bootctl/splash-arch.bmp"

‎examples/nofsverity/extra/etc/resolv.conf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../run/systemd/resolve/stub-resolv.conf

‎examples/nofsverity/extra/root/.ssh/authorized_keys

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDUOtNJdBEXyKxBB898rdT54ULjMGuO6v4jLXmRsdRhR5Id/lKNc9hsdioPWUePgYlqML2iSV72vKQoVhkyYkpcsjr3zvBny9+5xej3+TBLoEMAm2hmllKPmxYJDU8jQJ7wJuRrOVOnk0iSNF+FcY/yaQ0owSF02Nphx47j2KWc0IjGGlt4fl0fmHJuZBA2afN/4IYIIsEWZziDewVtaEjWV3InMRLllfdqGMllhFR+ed2hQz9PN2QcapmEvUR4UCy/mJXrke5htyFyHi8ECfyMMyYeHwbWLFQIve4CWix9qtksvKjcetnxT+WWrutdr3c9cfIj/c0v/Zg/c4zETxtp cockpit-test

‎examples/nofsverity/extra/usr/lib/dracut/dracut.conf.d/37composefs.conf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# we want to make sure the virtio disk drivers get included
2+
hostonly=no
3+
4+
# we need to force these in via the initramfs because we don't have modules in
5+
# the base image
6+
force_drivers+=" virtio_net vfat "

‎examples/nofsverity/extra/usr/lib/dracut/modules.d/37composefs/composefs-setup-root.service

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Copyright (C) 2013 Colin Walters <[email protected]>
2+
#
3+
# This library is free software; you can redistribute it and/or
4+
# modify it under the terms of the GNU Lesser General Public
5+
# License as published by the Free Software Foundation; either
6+
# version 2 of the License, or (at your option) any later version.
7+
#
8+
# This library is distributed in the hope that it will be useful,
9+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
10+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11+
# Lesser General Public License for more details.
12+
#
13+
# You should have received a copy of the GNU Lesser General Public
14+
# License along with this library. If not, see <https://www.gnu.org/licenses/>.
15+
16+
[Unit]
17+
DefaultDependencies=no
18+
ConditionKernelCommandLine=composefs
19+
ConditionPathExists=/etc/initrd-release
20+
After=sysroot.mount
21+
Requires=sysroot.mount
22+
Before=initrd-root-fs.target
23+
Before=initrd-switch-root.target
24+
25+
OnFailure=emergency.target
26+
OnFailureJobMode=isolate
27+
28+
[Service]
29+
Type=oneshot
30+
ExecStart=/usr/bin/composefs-setup-root
31+
StandardInput=null
32+
StandardOutput=journal
33+
StandardError=journal+console
34+
RemainAfterExit=yes

‎examples/nofsverity/extra/usr/lib/dracut/modules.d/37composefs/module-setup.sh

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/usr/bin/bash
2+
3+
check() {
4+
return 0
5+
}
6+
7+
depends() {
8+
return 0
9+
}
10+
11+
install() {
12+
inst \
13+
"${moddir}/composefs-setup-root" /bin/composefs-setup-root
14+
inst \
15+
"${moddir}/composefs-setup-root.service" \
16+
"${systemdsystemunitdir}/composefs-setup-root.service"
17+
18+
$SYSTEMCTL -q --root "${initdir}" add-wants \
19+
'initrd-root-fs.target' 'composefs-setup-root.service'
20+
}

‎examples/nofsverity/extra/usr/lib/initcpio/hooks/composefs

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/usr/bin/ash
2+
3+
run_latehook() {
4+
local composefs
5+
6+
composefs="$(getarg composefs)"
7+
if [ -z "$composefs" ]; then
8+
return 0
9+
fi
10+
11+
/usr/bin/composefs-setup-root --sysroot /new_root
12+
}

‎examples/nofsverity/extra/usr/lib/initcpio/install/composefs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/usr/bin/env bash
2+
3+
build() {
4+
add_binary "/usr/lib/dracut/modules.d/37composefs/composefs-setup-root" "/usr/bin/composefs-setup-root"
5+
add_runscript
6+
}

‎examples/nofsverity/extra/usr/lib/kernel/install.conf.d/37composefs.conf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
layout = uki
2+
uki_generator = ukify

‎examples/nofsverity/extra/usr/lib/systemd/network/37-wired.network

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
[Match]
2+
Type=ether
3+
4+
[Link]
5+
RequiredForOnline=routable
6+
7+
[Network]
8+
DHCP=yes
9+

‎examples/nofsverity/extra/usr/lib/systemd/system/systemd-growfs-root.service.d/37-composefs.conf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Make sure we grow the right root filesystem
2+
3+
[Service]
4+
ExecStart=
5+
ExecStart=/usr/lib/systemd/systemd-growfs /sysroot
6+

0 commit comments

Comments
 (0)