Bump enki to include microsoft certs (#154)

https://github.com/kairos-io/kairos/issues/2377

Signed-off-by: Dimitris Karakasilis <dimitris@karakasilis.me>

tools-image/Dockerfile

@@ -1,7 +1,7 @@
 # https://quay.io/repository/kairos/packages?tab=tags&tag=latest
 ARG LEAP_VERSION=15.5
-ARG LUET_VERSION=0.35.0
-ARG ENKI_VERSION=v0.0.16
+ARG LUET_VERSION=0.35.1
+ARG ENKI_VERSION=v0.0.25
 
 FROM quay.io/luet/base:$LUET_VERSION AS luet
 FROM quay.io/kairos/enki:${ENKI_VERSION} as enki
@@ -9,9 +9,10 @@ FROM quay.io/kairos/enki:${ENKI_VERSION} as enki
 FROM opensuse/leap:$LEAP_VERSION as default
 RUN zypper ref && zypper dup -y
 ## ISO+ Arm image + Netboot + cloud images Build depedencies
-RUN zypper ref && zypper in -y bc qemu-tools jq cdrtools docker git curl gptfdisk kpartx sudo xfsprogs parted util-linux-systemd e2fsprogs curl util-linux udev rsync grub2 dosfstools grub2-x86_64-efi squashfs mtools xorriso lvm2 zstd
-
-
+RUN zypper ref && zypper in -y bc qemu-tools jq cdrtools docker git curl gptfdisk kpartx sudo xfsprogs parted  \
+    util-linux-systemd e2fsprogs curl util-linux udev rsync grub2 dosfstools grub2-x86_64-efi squashfs mtools xorriso lvm2 zstd
+RUN zypper in -y python311-pip python311-cryptography sbsigntools tpm2-* # ukify deps
+RUN update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.11 1  # make python3.11 the default python3 for ukify
 COPY --from=luet /usr/bin/luet /usr/bin/luet
 ENV LUET_NOLOCK=true
 ENV TMPDIR=/tmp
@@ -23,20 +24,20 @@ COPY luet-amd64.yaml /tmp/luet-amd64.yaml
 RUN mkdir -p /etc/luet/
 RUN cp /tmp/luet-${TARGETARCH}.yaml /etc/luet/luet.yaml
 
+## Uki artifacts, will be set under the /usr/kairos directory
+RUN luet install -y system/systemd-boot
+
+# ukify + measure
+RUN luet install -y system/systemd-ukify
+# ukify deps that are not in the suse repos as packages. ukify package provides this so we have the exact versions needed
+RUN pip3 install -r /usr/kairos/ukify-requirements.txt
+
 ## Live CD artifacts
 RUN luet install -y livecd/grub2 --system-target /grub2
 RUN luet install -y livecd/grub2-efi-image --system-target /efi
 
 ## RPI64
-RUN luet install -y firmware/raspberrypi-firmware firmware/raspberrypi-firmware-config firmware/raspberrypi-firmware-dt --system-target /rpi/
-
-COPY luet-arm64-old.yaml /tmp/luet-arm64.yaml
-COPY luet-amd64-old.yaml /tmp/luet-amd64.yaml
-RUN cp /tmp/luet-${TARGETARCH}.yaml /etc/luet/luet.yaml
-RUN luet install -y firmware/u-boot-rpi64 --system-target /rpi/
-
-COPY luet-arm64.yaml /tmp/luet-arm64.yaml
-COPY luet-amd64.yaml /tmp/luet-amd64.yaml
+RUN luet install -y firmware/u-boot-rpi64 firmware/raspberrypi-firmware firmware/raspberrypi-firmware-config firmware/raspberrypi-firmware-dt --system-target /rpi/
 
 ## PineBook64 Pro
 RUN luet install -y arm-vendor-blob/u-boot-rockchip --system-target /pinebookpro/u-boot

tools-image/arm/boards/rpi4.sh

@@ -2,8 +2,6 @@
 
 partprobe
 
-kpartx -va $DRIVE
-
 image=$1
 
 if [ -z "$image" ]; then

tools-image/build-arm-image.sh

@@ -73,8 +73,12 @@ cleanup() {
   fi
 
   losetup -D "${LOOP}" || true;
-  dmsetup remove KairosVG-oem || true;
-  dmsetup remove KairosVG-recovery || true;
+  losetup -D "${DRIVE}" || true;
+
+  if [ "$model" == "rpi3" ]; then
+    dmsetup remove KairosVG-oem || true;
+    dmsetup remove KairosVG-recovery || true;
+  fi
 }
 
 ensure_dir_structure() {
@@ -364,14 +368,19 @@ if [ "$model" == "rpi3" ]; then
     sgdisk -m 1:2:3:4 ${output_image}
     sfdisk --part-type ${output_image} 1 c
 elif [ "$model" == "rpi4" ]; then
-    echo "label: gpt" | sfdisk "${output_image}"
-    sgdisk -n 1:8192:+96M -c 1:EFI -t 1:0c00 ${output_image}
+    sgdisk -n 1:0:+96M -c 1:EFI -t 1:ef00 ${output_image}
+    partprobe
     sgdisk -n 2:0:+${state_size}M -c 2:state -t 2:8300 ${output_image}
+    partprobe
     sgdisk -n 3:0:+${recovery_size}M -c 3:recovery -t 3:8300 ${output_image}
+    partprobe
     sgdisk -n 4:0:+${oem_size}M -c 4:oem -t 4:8300 ${output_image}
+    partprobe
     sgdisk -n 5:0:+64M -c 5:persistent -t 5:8300 ${output_image}
-    sgdisk -g ${output_image}
-    sgdisk -m 1:2:3:4:5 ${output_image}
+    partprobe
+    # Move backup header to end of disk
+    sgdisk -e ${output_image}
+    sgdisk -v ${output_image}
 else
     sgdisk -n 1:8192:+16M -c 1:EFI -t 1:0700 ${output_image}
     sgdisk -n 2:0:+${state_size}M -c 2:state -t 2:8300 ${output_image}
@@ -423,12 +432,12 @@ fi
 # Create partitions (RECOVERY, STATE, COS_PERSISTENT)
 mkfs.vfat -F 32 ${efi}
 fatlabel ${efi} COS_GRUB
-mkfs.ext4 -F -L ${STATE_LABEL} $state
-mkfs.ext4 -F -L ${PERSISTENT_LABEL} $persistent
+mkfs.ext3 -F -L ${STATE_LABEL} $state
+mkfs.ext3 -F -L ${PERSISTENT_LABEL} $persistent
 
 if [ "$model" == 'rpi4' ]; then
-  mkfs.ext4 -F -L ${RECOVERY_LABEL} $recovery
-  mkfs.ext4 -F -L ${OEM_LABEL} $oem
+  mkfs.ext3 -F -L ${RECOVERY_LABEL} $recovery
+  mkfs.ext3 -F -L ${OEM_LABEL} $oem
 else
   pvcreate $recovery
   vgcreate KairosVG $recovery

tools-image/entrypoint.sh

@@ -2,4 +2,4 @@
 
 set -ex
 
-enki --config-dir /config $@
+enki --config-dir /config "$@"

tools-image/luet-amd64-old.yaml

@@ -1,15 +0,0 @@
-general:
-  debug: false
-  spinner_charset: 9
-logging:
-  enable_emoji: false
-repositories:
-  - name: "kairos"
-    description: "kairos repository"
-    type: "docker"
-    cached: true
-    enable: true
-    priority: 2
-    urls:
-      - "quay.io/kairos/packages"
-    reference: 20240202131847-repository.yaml

tools-image/luet-amd64.yaml

@@ -12,4 +12,4 @@ repositories:
     priority: 2
     urls:
       - "quay.io/kairos/packages"
-    reference: 20240207153537-repository.yaml
+    reference: 20240306154541-repository.yaml

tools-image/luet-arm64-old.yaml

@@ -1,15 +0,0 @@
-general:
-  debug: false
-  spinner_charset: 9
-logging:
-  enable_emoji: false
-repositories:
-  - name: "kairos-arm64"
-    description: "kairos repository arm64"
-    type: "docker"
-    cached: true
-    enable: true
-    priority: 2
-    urls:
-      - "quay.io/kairos/packages-arm64"
-    reference: 20240202135656-repository.yaml

tools-image/luet-arm64.yaml

@@ -12,4 +12,4 @@ repositories:
     priority: 2
     urls:
       - "quay.io/kairos/packages-arm64"
-    reference: 20240207154912-repository.yaml
+    reference: 20240306155559-repository.yaml