repack-variant improvements#680
Conversation
Add a write_partition helper that hashes the source image before writing, flushes with fsync, reads back from the target offset, and compares. This catches truncated writes, filesystem corruption, or Docker storage driver issues that the previous bare dd calls could not detect. Signed-off-by: Patrick J.P. Culp <jpculp@amazon.com>
| EOF | ||
|
|
||
| local unexpected | ||
| unexpected="$(grep -Ev '^debugfs [0-9]+\.[0-9]+\.[0-9]+ \([^)]+\)$' "${errlog}" || true)" |
There was a problem hiding this comment.
The new filter ^debugfs [0-9]+.[0-9]+.[0-9]+ ([^)]+)$ matches today's e2fsprogs banner (debugfs 1.47.0 (5-Feb-2023)) but is tighter than the previous ^debugfs filter. A future SDK bump that produces any of these would silently break every repack-variant with a misleading "debugfs produced unexpected output" error:
• 4-component versions (1.47.0.1)
• RC/WIP suffixes (1.47.1-WIP)
• Extra startup lines
Not sure though if we should be concerned by any of these corner cases though
There was a problem hiding this comment.
Actually that is the intended behavior. If there is any deviation in debugfs we need it to fail so that we can validate that things still work as we expect. I suspect this will result in mild annoyances in the future, but it's a small price to pay given the risk of debugfs doing something unexpected.
| This will allow maintainers to audit which kit each package was taken from. | ||
| The rest of the variant image creation steps proceed the same way that they do now. | ||
|
|
||
| ## Twoliter Repack |
There was a problem hiding this comment.
Two small improvements:
- Add a one-liner distinguishing when to use fetch-variant vs. build-variant as the repack input.
- Enumerate the replaceable artifacts (CA bundle, root.json, Secure Boot keys, grub.cfg) — they're already mentioned generically in the intro.
There was a problem hiding this comment.
- Sure thing.
- I was hesitant to enumerate just because I'd hate for the doc to fall out of date if more customization are added down the line.
Extract `debugfs_write` which handles the rm/write/ea_set pattern, stderr validation, file existence verification, and SELinux label verification in one place. This removes duplicated heredoc logic across root, kernel, and grub writes, and ensures each write is individually verified. Signed-off-by: Patrick J.P. Culp <jpculp@amazon.com>
Signed-off-by: Patrick J.P. Culp <jpculp@amazon.com>
jpculp
force-pushed
the
repack-variant-improvements
branch
from
ecff0e4 to
130810d
Compare
3 participants
Description of changes:
Hardens the
img2imgrepack script by:ddcalls with awrite_partition()helper that addsfsyncand sha256 read-back comparison to catch silent corruption or truncation.debugfs_replace()helper that verifies each file write and SELinux label immediately rather than batching error checks.repack-variantworkflow in the design doc.Tradeoffs:
Testing done:
repack-varianton a secure-boot variant (exercises alldebugfs_replaceandwrite_partitionpaths including EFI resign)Terms of contribution:
By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.