Commit Graph

43 Commits

Author SHA1 Message Date
Itxaka
55a6622c4a
Copy PCR related files generated by systemd-stub in uki (#203) 2023-12-16 07:54:42 +01:00
Itxaka
6592034132
Update dag_steps.go 2023-12-15 23:12:28 +01:00
Itxaka
76e605d9fd
Do not fail if we cant measure 2023-12-15 23:03:59 +01:00
Itxaka
424392b390
measure PCR phase (#201) 2023-12-15 16:20:34 +01:00
Itxaka
c4ad991e0c
unlock partitions with UKI TPM values (#191) 2023-11-30 22:19:47 +01:00
Itxaka
ad83785e37
Fix log to add timestamp (#161) 2023-09-26 10:56:32 +02:00
Itxaka
30b454eac4
Check if uki install mode before mounting oem (#159)
Signed-off-by: Itxaka <itxaka@kairos.io>
2023-09-25 17:03:50 +02:00
Itxaka
7f2813e5b7
Mount ESP under /efi if possible + identify EFI run source (#158) 2023-09-25 14:14:56 +02:00
Itxaka
5412c76ebb
Uki changes for iso/install (#156) 2023-09-22 14:56:26 +02:00
Itxaka
a1710b8589
Set basic /run mount from the start to be able to always log (#154) 2023-09-19 09:51:57 +02:00
Mauro Morales
62831b8ecf
Sort bind mounts (#134)
* Sort bind mounts

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

* Add comment

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

---------

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>
2023-06-12 10:47:49 +02:00
Itxaka
0811f0f054
Increase compatibility with alpine systems (#132) 2023-05-30 21:51:03 +02:00
Itxaka
9399d0cf08
Move some err to warnings (#124) 2023-05-08 15:20:05 +02:00
Itxaka
14426d39b4
Upgrade kcrypt partitions on boot (#122)
Co-authored-by: Dimitris Karakasilis <jimmykarily@gmail.com>
2023-05-08 09:44:43 +02:00
Itxaka
2e9e5de03e
Fix missing sysroot mount in fstab (#121) 2023-05-05 12:34:23 +02:00
Itxaka
d644fb0af9
Run kcrypt unlock via immucore (#118) 2023-05-04 18:58:26 +02:00
Itxaka
06ff33cc97
⬆️ Bump deps (#114) 2023-04-28 09:30:56 +02:00
Itxaka
f1c3aad0ee
🌱 activate LVM volumes at the start (#113) 2023-04-19 16:23:51 +02:00
Itxaka
6bf656cd21
Try to mount oem under livemedia (#110) 2023-04-12 16:19:21 +02:00
Itxaka
2534577e09
🐛 Add missing dependency to bind mounts (#102)
As overlay mounts its responsible of mounting some of the RW paths that
bind mounts are using (for example /etc) we need to depend on it and let
it finish before running ht ebind mounts

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-03-21 10:58:15 +01:00
Itxaka
8f7d808dec
Bring UKI to a working state (#97)
- Mount the needed base mounts (/proc /dev /sys /tmp)
 - Use our own console for yip (required to add the PATH under uki)
 - Order the DAG in a proper way (was out of order and not working)

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-03-14 10:33:38 +01:00
Itxaka
44c2a5be26
Update kairos sdk to latest master (#89)
Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-03-09 19:45:24 +01:00
Itxaka
88a2ca8a9b
Conditional for loading oem (#85) 2023-03-09 12:57:10 +01:00
Itxaka
9cada0ecd0
🐛 Separate weak steps vs normal steps (#81)
And dont set any step to weak

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-03-08 20:05:57 +01:00
Itxaka
aa5939da89
Rework workflow (#77)
This makes immucore run more in parallel rather than block everything
else. We just tell sysroot.mount that eventually it will be mounted and
to wait for a bit.

This allows us to be more flexible where to run and run in parallel in
cases like cdrom in which we may do things but we need the sysroot to be
mounted already but not from us.

Also adds the initramfs stage directly in immucore and merges all the dracut config into one

    Dont create sysroot, just add a timeout override so it waits for us
    Dont block on the service, just make sure to finish before
    initrd.target
    Fix mounts from cmdline
    More proper log
    Store logs under the /run/immucore dir
    Store rootfs and initramfs logs separated
    Do not log the full stages in INFO level
    Run initramfs stage in immucore directly on boot and cd/netboot
    Drop systemd requirement from dracut module

Signed-off-by: Itxaka itxaka.garcia@spectrocloud.com
2023-03-08 11:45:11 +01:00
Itxaka
fecfbf8e92
Add tests and fix some issues that arised from testing (#74)
* Add tests and fix some issues that arised from testing

Mainly around the cmdargs and how many items it returns.
Also drop the iso target and jobs as its not necessary now

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

* Lint

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

---------

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-03-02 16:46:25 +01:00
Itxaka
b0b326313b
🐛 Get oem label from cmdline before using runtime (#73)
Otherwise we are ignoring any override via stanza

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-03-02 11:45:05 +01:00
Itxaka
ea5c1c75f2
🐛 Support immucore stanzas in cmdline (#72)
Introduce support for the same old cos stanzas but with immucore naming
so we can control them better in the future

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-03-02 11:10:28 +01:00
Itxaka
6ed15c7227
🐛 Load overlay config from cos-layout.env (#71)
Load the base overlay config from the cos-layout.env file. This means we
have to depend the base overlay mount to the load-config step, which
moves things a bit in the DAG.

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-03-02 10:44:54 +01:00
Itxaka
73c4c3e0af
Add missing cmdline stanzas (#69)
Adds support for:
 - rd.cos.oemtimeout=
 - rd.cos.overlay=tmpfs:SIZE
 - rd.cos.overlay=LABEL=DEVICE_LABEL
 - rd.cos.overlay=UUID=DEVICE_UUID

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-03-01 21:45:32 +01:00
Itxaka
086227d672
Uki Support (#67)
Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-03-01 11:42:46 +01:00
Itxaka
3a52112b91
Revert "Uki support" (#66
This reverts commit 985b8c9401.
2023-02-28 19:46:15 +01:00
Itxaka
985b8c9401
Uki support (#61) 2023-02-28 14:37:02 +01:00
Itxaka
9a480df901 Re-enable longer RW_PATHS
Looks like the problem comes from the custom mounts overriding this
values

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-02-22 12:21:02 +01:00
Itxaka
97478bd8ac Re-fix overlay and binds
Cleanup at the end, append both

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-02-22 11:57:38 +01:00
Itxaka
69b0c0131f Add custom mounts and fix default rw paths
Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-02-22 11:26:59 +01:00
Itxaka
5dde396331
Add fsck before mounting (#56)
Respect all options from systemd-fsck as that it what is currently used
on kairos.

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-02-17 16:15:26 +01:00
Itxaka
c081f987f8
Fix recovery (#54)
* Fix recovery

 - change TargetLabel into TargetDevice to hav ethe full device instead
   of just the label
 - log error if we cant mount
 - Get state partition to mount depending on recovery or active/passive
 - Get state patition fs on the fly
 - Set proper label device to mount on sysroot based on our boot state

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

* Fix test

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

---------

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-02-17 11:53:26 +01:00
Itxaka
88df028e6d
Allow setting root to RW (#53)
This patch allows setting the root mount as RW indicated by setting
rd.cos.debugrw in the cmdline

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-02-17 09:54:23 +01:00
Itxaka
4083ff691d
Mark rd.cos.disable sentinel as livecd (#46)
Original cos-immutable-rootfs sets the sentinel to livecd if it finds
the rd.cos.disable in the cmdline.

We should do the same. Unfortunately the state sdk doesnt support that
yet so we have to do it on our side until its supported

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-02-17 09:27:12 +01:00
Itxaka
bc53b0de3a Workaround for kairos sdk not detecting netboot
Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-02-16 15:30:54 +01:00
Itxaka
4cfe5e764d Run udevadm trigger after mounting loop device
So the devices get refreshed and they show up under /dev/disk/by-label

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-02-16 10:41:02 +01:00
Itxaka
ad014e9f22
Full rework (#41)
* Full rework

 - Extract steps to a different file
 - Simplify dag for easy understanding
 - Load dag based on our boot process
 - Simplify steps to not depend on useless stuff
 - Better logging

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

* Move sentinel file to the dag

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

* Adapt tests

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

---------

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-02-15 22:30:08 +01:00