tools: genpolicy static checks

Package genpolicy and enable static checks for it.

Fixes: #8813

Signed-off-by: Dan Mihai <dmihai@microsoft.com>

.github/workflows/build-kata-static-tarball-amd64.yaml

@@ -33,6 +33,7 @@ jobs:
           - cloud-hypervisor
           - cloud-hypervisor-glibc
           - firecracker
+          - genpolicy
           - kata-ctl
           - kernel
           - kernel-confidential

.github/workflows/static-checks.yaml

@@ -48,6 +48,7 @@ jobs:
           - kata-ctl
           - runk
           - trace-forwarder
+          - genpolicy
         command:
           - "make vendor"
           - "make check"
@@ -75,6 +76,8 @@ jobs:
             install-libseccomp: yes
           - component: runk
             install-libseccomp: yes
+          - component: genpolicy
+            component-path: src/tools/genpolicy
     steps:
       - name: Checkout the code
         uses: actions/checkout@v4

src/tools/genpolicy/Cargo.lock

@@ -1112,15 +1112,6 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
-[[package]]
-name = "openssl-src"
-version = "111.25.1+1.1.1t"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ef9a9cc6ea7d9d5e7c4a913dc4b48d0e359eddf01af1dfec96ba7064b4aba10"
-dependencies = [
- "cc",
-]
-
 [[package]]
 name = "openssl-sys"
 version = "0.9.90"
@@ -1129,7 +1120,6 @@ checksum = "374533b0e45f3a7ced10fcaeccca020e66656bc03dac384f852e4e5a7a8104a6"
 dependencies = [
  "cc",
  "libc",
- "openssl-src",
  "pkg-config",
  "vcpkg",
 ]

src/tools/genpolicy/Cargo.toml

@@ -1,3 +1,8 @@
+# Copyright (c) 2024 Microsoft Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
 [package]
 name = "genpolicy"
 version = "0.1.0"
@@ -35,7 +40,7 @@ async-trait = "0.1.68"
 docker_credential = "1.2.0"
 flate2 = { version = "1.0.26", features = ["zlib-ng"], default-features = false }
 oci-distribution = { version = "0.10.0" }
-openssl = { version = "0.10.54", features = ["vendored"] }
+openssl = { version = "0.10.54" }
 serde_ignored = "0.1.7"
 serde_json = "1.0.39"
 serde-transcode = "1.1.1"
@@ -44,7 +49,7 @@ tokio = {version = "1.33.0", features = ["rt-multi-thread"]}
 # OCI container specs.
 oci = { path = "../../libs/oci" }
 
-# Kata Agent prototol.
+# Kata Agent protocol.
 protocols = { path = "../../libs/protocols", features = ["with-serde"] }
 protobuf = "3.2.0"
 

src/tools/genpolicy/README.md

@@ -18,32 +18,12 @@ The Policy auto-generated by `genpolicy` is typically used for implementing conf
 
 # Building `genpolicy` from source code
 
-## Install build dependencies
+Build in docker container:
 
-Example for Ubuntu 22.04.3:
+```sh
-
-```bash
-$ sudo apt-get update
-$ sudo apt-get install -y build-essential cmake curl git musl-dev musl-tools
-$ curl --proto '=https' --tlsv1.3 https://sh.rustup.rs -sSf | sh
-$ source "$HOME/.cargo/env"
-$ arch=$(uname -m)
-$ rustup target add "${arch}-unknown-linux-musl"
-```
-
-# Build `genpolicy`
-
-```bash
 $ git clone https://github.com/kata-containers/kata-containers.git
-$ cd kata-containers/src/tools/genpolicy
+$ cd kata-containers
-$ source "$HOME/.cargo/env"
+$ tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh --build=genpolicy
-$ make && make install
-```
-
-If you want to use `LIBC=gnu` instead of the default `LIBC=musl`, change the last step above to:
-
-```bash
-$ LIBC=gnu make && LIBC=gnu make install
 ```
 
 # Executing `genpolicy`

src/tools/genpolicy/src/verity.rs

@@ -56,9 +56,7 @@ impl<T: Digest + Clone> Verity<T> {
             count
         };
 
-        let mut data = Vec::new();
+        let data = vec![0; hash_block_size];
-        data.resize(hash_block_size, 0);
-
         let mut levels = Vec::new();
         levels.resize(
             level_count,
@@ -209,8 +207,7 @@ pub fn traverse_file<T: Digest + Clone>(
     mut verity: Verity<T>,
     writer: &mut impl FnMut(&mut File, &[u8], u64) -> io::Result<()>,
 ) -> io::Result<GenericArray<u8, T::OutputSize>> {
-    let mut buf = Vec::new();
+    let mut buf = vec![0; verity.data_block_size];
-    buf.resize(verity.data_block_size, 0);
     while verity.more_blocks() {
         file.seek(SeekFrom::Start(read_offset))?;
         file.read_exact(&mut buf)?;

tools/packaging/kata-deploy/local-build/Makefile

@@ -93,6 +93,9 @@ cloud-hypervisor-glibc-tarball:
 firecracker-tarball:
 	${MAKE} $@-build
 
+genpolicy-tarball:
+	${MAKE} $@-build
+
 kata-ctl-tarball:
 	${MAKE} $@-build
 

tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh

@@ -90,6 +90,7 @@ options:
 	cloud-hypervisor
 	cloud-hypervisor-glibc
 	firecracker
+	genpolicy
 	kata-ctl
 	kernel
 	kernel-confidential
@@ -713,6 +714,10 @@ install_agent_ctl() {
 	install_tools_helper "agent-ctl"
 }
 
+install_genpolicy() {
+	install_tools_helper "genpolicy"
+}
+
 install_kata_ctl() {
 	install_tools_helper "kata-ctl"
 }
@@ -787,6 +792,8 @@ handle_build() {
 
 	firecracker) install_firecracker ;;
 
+	genpolicy) install_genpolicy ;;
+
 	kata-ctl) install_kata_ctl ;;
 
 	kernel) install_kernel ;;
@@ -893,6 +900,7 @@ main() {
 		agent-ctl
 		cloud-hypervisor
 		firecracker
+		genpolicy
 		kata-ctl
 		kernel
 		kernel-experimental

tools/packaging/static-build/tools/Dockerfile

@@ -9,11 +9,14 @@ ARG RUST_TOOLCHAIN
 SHELL ["/bin/ash", "-o", "pipefail", "-c"]
 RUN apk --no-cache add \
         bash \
+        cmake \
         curl \
         gcc \
         git \
         libcap-ng-static \
         libseccomp-static \
+        openssl-dev \
+        openssl-libs-static \
         make \
         musl-dev \
         protoc && \