feat(eif): add EIF image format support for Nitro Enclaves

Introduce a new `image-format = "eif"` variant type that produces an AWS
Nitro Enclaves Image Format (kernel + cmdline + ramdisk + metadata)
alongside a GPT disk image and bare kernel.

- Add `tools/eif-builder` crate implementing the EIF v4 container format
- Add `twoliter/embedded/rpm2eif` build script and wire it into
  `build.Dockerfile`, branching on `IMAGE_FORMAT=eif` to skip rpm2img's
  partitioning/secure-boot flags (rpm2eif owns the layout)
- Extend `buildsys::manifest::ImageFormat` with `Eif` and plumb it through
  `DockerBuild`; reject `repack-variant` for EIF with a clear error
- Teach `pubsys fetch_variant` to fetch the `.eif`, `-disk.img`, and
  `-kernel` artifacts published by EIF variants
- Bundle `eif-builder` as a twoliter embedded tool
- Add `hello-eif` test variant and manifest-parsing tests

Author: jmt-lab

Cargo.lock

@@ -23,9 +23,20 @@ members = [
     "tools/unplug",
     "tools/update-metadata",
     "tools/advisory-checker",
+    "tools/eif-builder",
 
     "twoliter",
-    "twoliter/src/tool-crates/*",
+    "twoliter/src/tool-crates/advisory-checker",
+    "twoliter/src/tool-crates/buildsys",
+    "twoliter/src/tool-crates/embedded-bundle",
+    "twoliter/src/tool-crates/pcrsys",
+    "twoliter/src/tool-crates/pipesys",
+    "twoliter/src/tool-crates/pubsys",
+    "twoliter/src/tool-crates/pubsys-setup",
+    "twoliter/src/tool-crates/testsys",
+    "twoliter/src/tool-crates/tuftool",
+    "twoliter/src/tool-crates/unplug",
+    "twoliter/src/tool-crates/eif-builder",
 
     "tests/integration-tests",
 ]
@@ -62,6 +73,7 @@ bottlerocket-types = { version = "0.0.16", git = "https://github.com/bottlerocke
 bottlerocket-variant = { version = "0.1", path = "tools/bottlerocket-variant" }
 buildsys = { version = "0.1", path = "tools/buildsys", lib = true, artifact = [ "bin:buildsys" ] }
 buildsys-config = { version = "0.1", path = "tools/buildsys-config" }
+eif-builder = { version = "0.1", path = "tools/eif-builder", artifact = [ "bin:eif-builder" ] }
 error-utils = { version = "0.1", path = "tools/error-utils" }
 include-env-compressed = { version = "0.1", path = "tools/include-env-compressed" }
 include-env-compressed-macro = { version = "0.1", path = "tools/include-env-compressed/include-env-compressed-macro" }
@@ -84,6 +96,7 @@ testsys-model = { version = "0.0.16", git = "https://github.com/bottlerocket-os/
 twoliter = { version = "0.20.0", path = "twoliter", artifact = [ "bin:twoliter" ] }
 twoliter-tool-advisory-checker = { version = "0.1", path = "twoliter/src/tool-crates/advisory-checker" }
 twoliter-tool-buildsys = { version = "0.1", path = "twoliter/src/tool-crates/buildsys" }
+twoliter-tool-eif-builder = { version = "0.1", path = "twoliter/src/tool-crates/eif-builder" }
 twoliter-tool-embedded-bundle = { version = "0.1", path = "twoliter/src/tool-crates/embedded-bundle" }
 twoliter-tool-pcrsys = { version = "0.1", path = "twoliter/src/tool-crates/pcrsys" }
 twoliter-tool-pipesys = { version = "0.1", path = "twoliter/src/tool-crates/pipesys" }

Cargo.toml

@@ -13,6 +13,7 @@ members = [
     "packages/pkg-f",
     "packages/pkg-g",
     "variants/hello-ootb",
+    "variants/hello-eif",
 ]
 
 [profile.dev]

tests/projects/local-kit/Cargo.lock

@@ -0,0 +1,19 @@
+[package]
+name = "hello-eif"
+version = "0.1.0"
+edition = "2021"
+publish = false
+build = "../build.rs"
+# Don't rebuild crate just because of changes to README.
+exclude = ["README.md"]
+
+[package.metadata.build-variant]
+included-packages = ["pkg-e"]
+image-format = "eif"
+kernel-parameters = []
+
+[lib]
+path = "../variants.rs"
+
+[build-dependencies]
+extra-3-kit = { path = "../../kits/extra-3-kit" }

tests/projects/local-kit/Cargo.toml

@@ -265,6 +265,16 @@ impl VariantBuildArgs {
         args.build_arg("VARIANT_RUNTIME", &self.variant_runtime);
         args.build_arg("VERSION_ID", &self.version_image);
 
+        // TWOLITER_VERSION is injected by the twoliter binary into its
+        // subprocess environment. Passing it through as a Docker build-arg
+        // lets rpm2eif embed it into EIF metadata (BuildMetadata.BuildToolVersion).
+        // Absence is not an error: buildsys may be invoked directly during
+        // development, in which case the field is left empty.
+        args.build_arg(
+            "TWOLITER_VERSION",
+            std::env::var("TWOLITER_VERSION").unwrap_or_default(),
+        );
+
         for image_feature in self.image_features.iter() {
             args.build_arg(format!("{image_feature}"), "1");
         }
@@ -492,6 +502,7 @@ impl DockerBuild {
                 data_image_size_gib: data_image_size_gib.to_string(),
                 image_features: manifest.info().image_features().unwrap_or_default(),
                 image_format: match manifest.info().image_format() {
+                    Some(ImageFormat::Eif) => "eif",
                     Some(ImageFormat::Raw) | None => "raw",
                     Some(ImageFormat::Qcow2) => "qcow2",
                     Some(ImageFormat::Vmdk) => "vmdk",
@@ -533,6 +544,13 @@ impl DockerBuild {
 
     /// Create a new `DockerBuild` that can repackage a variant image.
     pub(crate) fn repack_variant(args: RepackVariantArgs, manifest: &Manifest) -> Result<Self> {
+        // Repack is implemented by `img2img`, which has no EIF support. Fail
+        // fast here so users get a clear error instead of a cryptic failure
+        // deep inside the Dockerfile build.
+        if matches!(manifest.info().image_format(), Some(ImageFormat::Eif)) {
+            return error::EifRepackUnsupportedSnafu.fail();
+        }
+
         let image_layout = manifest.info().image_layout().cloned().unwrap_or_default();
         let ImageLayout {
             os_image_size_gib,
@@ -577,6 +595,7 @@ impl DockerBuild {
                 data_image_size_gib: data_image_size_gib.to_string(),
                 image_features: manifest.info().image_features().unwrap_or_default(),
                 image_format: match manifest.info().image_format() {
+                    Some(ImageFormat::Eif) => "eif",
                     Some(ImageFormat::Raw) | None => "raw",
                     Some(ImageFormat::Qcow2) => "qcow2",
                     Some(ImageFormat::Vmdk) => "vmdk",

tests/projects/local-kit/variants/hello-eif/Cargo.toml

@@ -107,6 +107,9 @@ pub(crate) enum Error {
         source: semver::Error,
         version_str: String,
     },
+
+    #[snafu(display("Repacking is not supported for image-format = \"eif\""))]
+    EifRepackUnsupported,
 }
 
 pub(super) type Result<T> = std::result::Result<T, Error>;

tools/buildsys/src/builder.rs

@@ -115,7 +115,8 @@ included-packages = ["release"]
 ```
 
 `image-format` is the desired format for the built images.
-This can be `raw` (the default), `vmdk`, or `qcow2`.
+This can be `raw` (the default), `vmdk`, `qcow2`, or `eif`
+(AWS Nitro Enclaves Image Format).
 ```ignore
 [package.metadata.build-variant]
 image-format = "vmdk"
@@ -721,6 +722,7 @@ pub struct BuildVariant {
 #[derive(Deserialize, Debug, Clone)]
 #[serde(rename_all = "lowercase")]
 pub enum ImageFormat {
+    Eif,
     Qcow2,
     Raw,
     Vmdk,
@@ -1033,4 +1035,30 @@ mod test {
         ];
         assert_eq!(kit_list, expected);
     }
+
+    /// Verify that a variant declaring `image-format = "eif"` parses and
+    /// surfaces `ImageFormat::Eif` from `image_format()`.
+    #[test]
+    fn test_image_format_eif_variant_hello_eif() {
+        let manifest_path = cargo_manifest("hello-eif");
+        let temp_dir = TempDir::new().unwrap();
+        let cargo_metadata_path = cargo_metadata_path(&temp_dir);
+        let manifest = Manifest::new(manifest_path, cargo_metadata_path).unwrap();
+        assert!(matches!(
+            manifest.info().image_format(),
+            Some(ImageFormat::Eif)
+        ));
+    }
+
+    /// Sanity check: the existing non-EIF variant has no `image-format` set and
+    /// therefore returns `None`. This guards the default-`raw` path used by
+    /// `builder.rs`.
+    #[test]
+    fn test_image_format_default_variant_hello_ootb() {
+        let manifest_path = cargo_manifest("hello-ootb");
+        let temp_dir = TempDir::new().unwrap();
+        let cargo_metadata_path = cargo_metadata_path(&temp_dir);
+        let manifest = Manifest::new(manifest_path, cargo_metadata_path).unwrap();
+        assert!(manifest.info().image_format().is_none());
+    }
 }

tools/buildsys/src/builder/error.rs

@@ -0,0 +1,17 @@
+[package]
+name = "eif-builder"
+version = "0.1.0"
+edition = "2021"
+license = "Apache-2.0 OR MIT"
+publish = false
+
+[dependencies]
+crc32fast.workspace = true
+clap = { workspace = true, features = ["derive"] }
+serde_json.workspace = true
+
+[dev-dependencies]
+tempfile.workspace = true
+
+[lints]
+workspace = true