github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2026-07-26 15:55:24 +00:00
Code Issues Projects Releases Wiki Activity

build: consume guest-components CoCo artefacts instead of building locally

Browse Source 
guest-components' coco-extension-image workflow now publishes two
artefacts from the same assembled rootfs, and kata consumes each on the
matching path:

* Monolithic confidential rootfs (Go runtime): the scratch OCI container
  image from the "Publish OCI container image" step
  (ghcr.io/confidential-containers/guest-components/coco-extension).
  install_coco_guest_components() resolves the per-arch manifest digest,
  verifies provenance, and exports the filesystem into
  kata-static-coco-guest-components.tar.zst (binaries, cryptsetup, pause
  bundle, ocicrypt config). This replaces the local guest-components
  compile and removes the separate pause-image dependency from
  confidential rootfs targets.

* Composable extension (runtime-rs): the EROFS + dm-verity disk image
  from the "Publish disk image with ORAS" step
  (ghcr.io/confidential-containers/guest-components/coco-extension-disk).
  install_image_coco_extension() resolves the per-arch digest, verifies
  provenance, and oras-pulls that exact digest into kata-static.

Both paths pin the guest-components revision under
.externals.coco-guest-components in versions.yaml (version,
container_image, and extension_image must stay in sync). Provenance
verification uses gh attestation verify --bundle-from-oci and fails the
build by default (VERIFY_COCO_EXTENSION_PROVENANCE=no to bypass; skipped
on s390x where gh has no binary). The build container installs the GitHub
CLI and forwards GITHUB_TOKEN from the runner into the container.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Fabiano Fidêncio
2026-07-13 14:26:25 +02:00
committed by Mikko Ylinen
parent e49ad473bb
commit cd75c2fac5
10 changed files with 316 additions and 158 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
.github/workflows/build-kata-static-tarball-amd64.yaml vendored
View File

@@ -57,7 +57,6 @@ jobs:
- ovmf
- ovmf-sev
- ovmf-tdx
- pause-image
- qemu
- qemu-snp-experimental
- qemu-tdx-experimental
@@ -108,6 +107,8 @@ jobs:
RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
KBUILD_SIGN_PIN: ${{ contains(matrix.asset, 'nvidia') && secrets.KBUILD_SIGN_PIN || '' }}
USE_DEVMAPPER: ${{ matrix.asset == 'agent' && 'yes' || 'no' }}
GH_TOKEN: ${{ github.token }}
VERIFY_COCO_EXTENSION_PROVENANCE: "yes"
- name: Parse OCI image name and digest
id: parse-oci-segments
@@ -266,6 +267,9 @@ jobs:
TARGET_BRANCH: ${{ inputs.target-branch }}
RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
KBUILD_SIGN_PIN: ${{ contains(matrix.asset, 'nvidia') && secrets.KBUILD_SIGN_PIN || '' }}
# Used to verify the guest-components CoCo extension provenance.
GH_TOKEN: ${{ github.token }}
VERIFY_COCO_EXTENSION_PROVENANCE: "yes"
- name: store-artifact ${{ matrix.asset }}
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0

6
.github/workflows/build-kata-static-tarball-arm64.yaml vendored
View File

@@ -55,7 +55,6 @@ jobs:
- kernel-nvidia-gpu
- nydus
- ovmf
- pause-image
- qemu
- virtiofsd
concurrency:
@@ -101,6 +100,8 @@ jobs:
RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
KBUILD_SIGN_PIN: ${{ contains(matrix.asset, 'nvidia') && secrets.KBUILD_SIGN_PIN || '' }}
USE_DEVMAPPER: ${{ matrix.asset == 'agent' && 'yes' || 'no' }}
GH_TOKEN: ${{ github.token }}
VERIFY_COCO_EXTENSION_PROVENANCE: "yes"
- name: Parse OCI image name and digest
id: parse-oci-segments
@@ -255,6 +256,8 @@ jobs:
TARGET_BRANCH: ${{ inputs.target-branch }}
RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
KBUILD_SIGN_PIN: ${{ contains(matrix.asset, 'nvidia') && secrets.KBUILD_SIGN_PIN || '' }}
GH_TOKEN: ${{ github.token }}
VERIFY_COCO_EXTENSION_PROVENANCE: "yes"
- name: store-artifact ${{ matrix.asset }}
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
@@ -275,7 +278,6 @@ jobs:
- busybox
- coco-guest-components
- kernel-nvidia-gpu-modules
- pause-image
concurrency:
group: ${{ github.workflow }}-${{ github.job }}-${{ github.event.pull_request.number || github.ref }}-arm-${{ toJSON(matrix) }}
cancel-in-progress: true

3
.github/workflows/build-kata-static-tarball-s390x.yaml vendored
View File

@@ -47,7 +47,6 @@ jobs:
- coco-guest-components
- fake-boot-image-se
- kernel
- pause-image
- qemu
- virtiofsd
concurrency:
@@ -99,6 +98,7 @@ jobs:
TARGET_BRANCH: ${{ inputs.target-branch }}
RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
USE_DEVMAPPER: ${{ matrix.asset == 'agent' && 'yes' || 'no' }}
GH_TOKEN: ${{ github.token }}
- name: Parse OCI image name and digest
id: parse-oci-segments
@@ -237,6 +237,7 @@ jobs:
ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
TARGET_BRANCH: ${{ inputs.target-branch }}
RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
GH_TOKEN: ${{ github.token }}
- name: store-artifact ${{ matrix.asset }}
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0