mirror of
https://github.com/kata-containers/kata-containers.git
synced 2025-08-21 09:25:19 +00:00
actions: Consider root_hash_*.txt for the CC actions
The ability to do a measured boot has been overlooked when releasing the payload consumed by the Confidential Containers project, and this happened as we depend, at the shim-v2 build time, of a `root_hash_*.txt` generated in the `tools/osbuilder/` directory, which is then used to add a specific parameter to the `kernel_params` in the Kata Containers configuration files. With everything said above, the best way we can ensure this is done is by saving those files during the rootfs build, download them during the shim-v2 build (which *must* happen only after the rootfs builds happen), and correctly use them there. Fixes: #5847 Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
This commit is contained in:
Fabiano Fidêncio
parent
788f1e6d61
commit
e1f075dc60
@ -16,7 +16,6 @@ jobs:
|
|||||||
- cc-kernel
|
- cc-kernel
|
||||||
- cc-qemu
|
- cc-qemu
|
||||||
- cc-rootfs-image
|
- cc-rootfs-image
|
||||||
- cc-shim-v2
|
|
||||||
- cc-virtiofsd
|
- cc-virtiofsd
|
||||||
- cc-sev-kernel
|
- cc-sev-kernel
|
||||||
- cc-sev-ovmf
|
- cc-sev-ovmf
|
||||||
@ -56,9 +55,60 @@ jobs:
|
|||||||
retention-days: 1
|
retention-days: 1
|
||||||
if-no-files-found: error
|
if-no-files-found: error
|
||||||
|
|
||||||
create-kata-tarball:
|
- name: store-artifact root_hash_tdx.txt
|
||||||
|
uses: actions/upload-artifact@v3
|
||||||
|
with:
|
||||||
|
name: root_hash_tdx.txt
|
||||||
|
path: tools/osbuilder/root_hash_tdx.txt
|
||||||
|
retention-days: 1
|
||||||
|
if-no-files-found: ignore
|
||||||
|
|
||||||
|
- name: store-artifact root_hash_vanilla.txt
|
||||||
|
uses: actions/upload-artifact@v3
|
||||||
|
with:
|
||||||
|
name: root_hash_vanilla.txt
|
||||||
|
path: tools/osbuilder/root_hash_vanilla.txt
|
||||||
|
retention-days: 1
|
||||||
|
if-no-files-found: ignore
|
||||||
|
|
||||||
|
build-asset-cc-shim-v2:
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
needs: build-asset
|
needs: build-asset
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v3
|
||||||
|
|
||||||
|
- name: Get root_hash_tdx.txt
|
||||||
|
uses: actions/download-artifact@v3
|
||||||
|
with:
|
||||||
|
name: root_hash_tdx.txt
|
||||||
|
path: tools/osbuilder/
|
||||||
|
|
||||||
|
- name: Get root_hash_vanilla.txt
|
||||||
|
uses: actions/download-artifact@v3
|
||||||
|
with:
|
||||||
|
name: root_hash_vanilla.txt
|
||||||
|
path: tools/osbuilder/
|
||||||
|
|
||||||
|
- name: Build cc-shim-v2
|
||||||
|
run: |
|
||||||
|
make cc-shim-v2-tarball
|
||||||
|
build_dir=$(readlink -f build)
|
||||||
|
# store-artifact does not work with symlink
|
||||||
|
sudo cp -r "${build_dir}" "kata-build"
|
||||||
|
env:
|
||||||
|
PUSH_TO_REGISTRY: yes
|
||||||
|
|
||||||
|
- name: store-artifact cc-shim-v2
|
||||||
|
uses: actions/upload-artifact@v3
|
||||||
|
with:
|
||||||
|
name: kata-artifacts
|
||||||
|
path: kata-build/kata-static-cc-shim-v2.tar.xz
|
||||||
|
retention-days: 1
|
||||||
|
if-no-files-found: error
|
||||||
|
|
||||||
|
create-kata-tarball:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
needs: [build-asset, build-asset-cc-shim-v2]
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v3
|
- uses: actions/checkout@v3
|
||||||
- name: get-artifacts
|
- name: get-artifacts
|
||||||
|
|||||||
@ -15,7 +15,6 @@ jobs:
|
|||||||
- cc-kernel
|
- cc-kernel
|
||||||
- cc-qemu
|
- cc-qemu
|
||||||
- cc-rootfs-image
|
- cc-rootfs-image
|
||||||
- cc-shim-v2
|
|
||||||
- cc-virtiofsd
|
- cc-virtiofsd
|
||||||
steps:
|
steps:
|
||||||
- name: Login to Kata Containers quay.io
|
- name: Login to Kata Containers quay.io
|
||||||
@ -52,9 +51,50 @@ jobs:
|
|||||||
retention-days: 1
|
retention-days: 1
|
||||||
if-no-files-found: error
|
if-no-files-found: error
|
||||||
|
|
||||||
create-kata-tarball:
|
- name: store-artifact root_hash_vanilla.txt
|
||||||
|
uses: actions/upload-artifact@v3
|
||||||
|
with:
|
||||||
|
name: root_hash_vanilla.txt-s390x
|
||||||
|
path: tools/osbuilder/root_hash_vanilla.txt
|
||||||
|
retention-days: 1
|
||||||
|
if-no-files-found: ignore
|
||||||
|
|
||||||
|
build-asset-cc-shim-v2:
|
||||||
runs-on: s390x
|
runs-on: s390x
|
||||||
needs: build-asset
|
needs: build-asset
|
||||||
|
steps:
|
||||||
|
- name: Adjust a permission for repo
|
||||||
|
run: |
|
||||||
|
sudo chown -R $USER:$USER $GITHUB_WORKSPACE
|
||||||
|
|
||||||
|
- uses: actions/checkout@v3
|
||||||
|
|
||||||
|
- name: Get root_hash_vanilla.txt
|
||||||
|
uses: actions/download-artifact@v3
|
||||||
|
with:
|
||||||
|
name: root_hash_vanilla.txt-s390x
|
||||||
|
path: tools/osbuilder/
|
||||||
|
|
||||||
|
- name: Build cc-shim-v2
|
||||||
|
run: |
|
||||||
|
make cc-shim-v2-tarball
|
||||||
|
build_dir=$(readlink -f build)
|
||||||
|
# store-artifact does not work with symlink
|
||||||
|
sudo cp -r "${build_dir}" "kata-build"
|
||||||
|
env:
|
||||||
|
PUSH_TO_REGISTRY: yes
|
||||||
|
|
||||||
|
- name: store-artifact cc-shim-v2
|
||||||
|
uses: actions/upload-artifact@v3
|
||||||
|
with:
|
||||||
|
name: kata-artifacts-s390x
|
||||||
|
path: kata-build/kata-static-cc-shim-v2.tar.xz
|
||||||
|
retention-days: 1
|
||||||
|
if-no-files-found: error
|
||||||
|
|
||||||
|
create-kata-tarball:
|
||||||
|
runs-on: s390x
|
||||||
|
needs: [build-asset, build-asset-cc-shim-v2]
|
||||||
steps:
|
steps:
|
||||||
- name: Adjust a permission for repo
|
- name: Adjust a permission for repo
|
||||||
run: |
|
run: |
|
||||||
|
|||||||
52
.github/workflows/cc-payload.yaml
vendored
52
.github/workflows/cc-payload.yaml
vendored
@ -14,7 +14,6 @@ jobs:
|
|||||||
- cc-kernel
|
- cc-kernel
|
||||||
- cc-qemu
|
- cc-qemu
|
||||||
- cc-rootfs-image
|
- cc-rootfs-image
|
||||||
- cc-shim-v2
|
|
||||||
- cc-virtiofsd
|
- cc-virtiofsd
|
||||||
- cc-sev-kernel
|
- cc-sev-kernel
|
||||||
- cc-sev-ovmf
|
- cc-sev-ovmf
|
||||||
@ -44,9 +43,58 @@ jobs:
|
|||||||
retention-days: 1
|
retention-days: 1
|
||||||
if-no-files-found: error
|
if-no-files-found: error
|
||||||
|
|
||||||
create-kata-tarball:
|
- name: store-artifact root_hash_tdx.txt
|
||||||
|
uses: actions/upload-artifact@v3
|
||||||
|
with:
|
||||||
|
name: root_hash_tdx.txt
|
||||||
|
path: tools/osbuilder/root_hash_tdx.txt
|
||||||
|
retention-days: 1
|
||||||
|
if-no-files-found: ignore
|
||||||
|
|
||||||
|
- name: store-artifact root_hash_vanilla.txt
|
||||||
|
uses: actions/upload-artifact@v3
|
||||||
|
with:
|
||||||
|
name: root_hash_vanilla.txt
|
||||||
|
path: tools/osbuilder/root_hash_vanilla.txt
|
||||||
|
retention-days: 1
|
||||||
|
if-no-files-found: ignore
|
||||||
|
|
||||||
|
build-asset-cc-shim-v2:
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
needs: build-asset
|
needs: build-asset
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v3
|
||||||
|
|
||||||
|
- name: Get root_hash_tdx.txt
|
||||||
|
uses: actions/download-artifact@v3
|
||||||
|
with:
|
||||||
|
name: root_hash_tdx.txt
|
||||||
|
path: tools/osbuilder/
|
||||||
|
|
||||||
|
- name: Get root_hash_vanilla.txt
|
||||||
|
uses: actions/download-artifact@v3
|
||||||
|
with:
|
||||||
|
name: root_hash_vanilla.txt
|
||||||
|
path: tools/osbuilder/
|
||||||
|
|
||||||
|
- name: Build cc-shim-v2
|
||||||
|
run: |
|
||||||
|
make cc-shim-v2-tarball
|
||||||
|
build_dir=$(readlink -f build)
|
||||||
|
# store-artifact does not work with symlink
|
||||||
|
sudo cp -r "${build_dir}" "kata-build"
|
||||||
|
|
||||||
|
- name: store-artifact cc-shim-v2
|
||||||
|
uses: actions/upload-artifact@v3
|
||||||
|
with:
|
||||||
|
name: kata-artifacts
|
||||||
|
path: kata-build/kata-static-cc-shim-v2.tar.xz
|
||||||
|
retention-days: 1
|
||||||
|
if-no-files-found: error
|
||||||
|
|
||||||
|
create-kata-tarball:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
needs: [build-asset, build-asset-cc-shim-v2]
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v3
|
- uses: actions/checkout@v3
|
||||||
- name: get-artifacts
|
- name: get-artifacts
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user