mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-07-13 20:27:41 +00:00
4c760fd031
This change adds the CONFIDENTIAL_GUEST variable to the kernel
build logic. Similar to commit
976df22119, we would like to enable
the cryptsetup functionalities not only when building a measured
root file system, but also when building for a confidential guest.
The current state is that not all confidential guests use a
measured root filesystem, and as a matter of fact, we should
indeed decouple these aspects.
With the current convention, a confidential guest is a user of CDH
with its storage features. A better naming of the
CONFIDENTIAL_GUEST variable could have been a naming related to CDH
storage functionality. Further, the kernel build script's -m
parameter could be improved too - as indicated by this change, not
only measured rootfs builds will need the cryptsetup.conf file.
Signed-off-by: Manuel Huber <manuelh@nvidia.com>
99 lines
3.0 KiB
Bash
Executable File
99 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Copyright (c) 2021 Intel Corporation
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
set -o errexit
|
|
set -o nounset
|
|
set -o pipefail
|
|
|
|
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
# shellcheck disable=SC1091 # import based on variable
|
|
source "${script_dir}/../../scripts/lib.sh"
|
|
|
|
# repo_root_dir is defined in lib.sh make sure it is set
|
|
repo_root_dir="${repo_root_dir:-}"
|
|
|
|
[[ -n "${repo_root_dir}" ]] || die "repo_root_dir is not set"
|
|
readonly kernel_builder="${repo_root_dir}/tools/packaging/kernel/build-kernel.sh"
|
|
|
|
BUILDX=
|
|
PLATFORM=
|
|
|
|
DESTDIR=${DESTDIR:-${PWD}}
|
|
PREFIX=${PREFIX:-/opt/kata}
|
|
container_image="${KERNEL_CONTAINER_BUILDER:-$(get_kernel_image_name)}"
|
|
MEASURED_ROOTFS=${MEASURED_ROOTFS:-no}
|
|
CONFIDENTIAL_GUEST=${CONFIDENTIAL_GUEST:-no}
|
|
KBUILD_SIGN_PIN="${KBUILD_SIGN_PIN:-}"
|
|
kernel_builder_args="-a ${ARCH:-} $*"
|
|
KERNEL_DEBUG_ENABLED=${KERNEL_DEBUG_ENABLED:-"no"}
|
|
|
|
if [[ "${MEASURED_ROOTFS}" == "yes" ]] || [[ "${CONFIDENTIAL_GUEST}" == "yes" ]]; then
|
|
kernel_builder_args+=" -m"
|
|
fi
|
|
|
|
if [[ "${CROSS_BUILD:-}" == "true" ]]; then
|
|
container_image="${container_image}-${ARCH:-}-cross-build"
|
|
# Need to build a s390x image due to an issue at
|
|
# https://github.com/kata-containers/kata-containers/pull/6586#issuecomment-1603189242
|
|
if [[ ${ARCH:-} == "s390x" ]]; then
|
|
BUILDX="buildx"
|
|
PLATFORM="--platform=linux/s390x"
|
|
fi
|
|
fi
|
|
|
|
container_engine=${CONTAINER_ENGINE:-"docker"}
|
|
container_build=${container_engine}
|
|
|
|
if [[ -n "${BUILDX}" ]]; then
|
|
container_build+=" ${BUILDX}"
|
|
fi
|
|
|
|
container_build+=" build"
|
|
|
|
if [[ -n "${PLATFORM}" ]]; then
|
|
container_build+=" ${PLATFORM}"
|
|
fi
|
|
|
|
container_build+=" --build-arg ARCH=${ARCH:-}"
|
|
|
|
"${container_engine}" pull "${container_image}" || \
|
|
{
|
|
${container_build} -t "${container_image}" "${script_dir}" && \
|
|
# No-op unless PUSH_TO_REGISTRY is exported as "yes"
|
|
push_to_registry "${container_image}";
|
|
}
|
|
|
|
"${container_engine}" run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \
|
|
-w "${PWD}" \
|
|
--env KERNEL_DEBUG_ENABLED="${KERNEL_DEBUG_ENABLED}" \
|
|
--env KBUILD_SIGN_PIN="${KBUILD_SIGN_PIN}" \
|
|
--user "$(id -u)":"$(id -g)" \
|
|
"${container_image}" \
|
|
bash -c "${kernel_builder} ${kernel_builder_args} setup"
|
|
|
|
"${container_engine}" run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \
|
|
-w "${PWD}" \
|
|
--user "$(id -u)":"$(id -g)" \
|
|
"${container_image}" \
|
|
bash -c "${kernel_builder} ${kernel_builder_args} build"
|
|
|
|
"${container_engine}" run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \
|
|
-w "${PWD}" \
|
|
--env DESTDIR="${DESTDIR}" --env PREFIX="${PREFIX}" \
|
|
--user "$(id -u)":"$(id -g)" \
|
|
"${container_image}" \
|
|
bash -c "${kernel_builder} ${kernel_builder_args} install"
|
|
|
|
"${container_engine}" run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \
|
|
-w "${PWD}" \
|
|
--env DESTDIR="${DESTDIR}" --env PREFIX="${PREFIX}" \
|
|
--env USER="${USER}" \
|
|
--env KBUILD_SIGN_PIN="${KBUILD_SIGN_PIN}" \
|
|
--user "$(id -u)":"$(id -g)" \
|
|
"${container_image}" \
|
|
bash -c "${kernel_builder} ${kernel_builder_args} build-headers"
|