Skip to content

Commit 12a1d01

Browse files
traviertravier
authored
Merge pull request #61 from bgartzi/esp-alternate_locations
Esp alternate locations
2 parents 507c58e + 3ba9a00 commit 12a1d01

9 files changed

Lines changed: 341 additions & 35 deletions

File tree

‎.github/workflows/tests.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ jobs:
3232
target-image-url:
3333
- "https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/42.20250929.3.0/x86_64/fedora-coreos-42.20250929.3.0-ostree.x86_64.ociarchive"
3434
- "https://mirror.openshift.com/pub/openshift-v4/dependencies/rhcos/4.19/4.19.0/rhcos-4.19.0-x86_64-ostree.x86_64.ociarchive"
35+
- "quay.io/trusted-execution-clusters/fedora-coreos@sha256:0eafb8b60f0329a743d42e7d4d286eb4b36fd096489fdda74d011d861e6692e6"
3536
test-finder:
3637
- grep -E "^ *test-.*$" | grep -v uki
3738
host-platform:

‎justfile‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
image := "https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/42.20250929.3.0/x86_64/fedora-coreos-42.20250929.3.0-ostree.x86_64.ociarchive"
77
target_container_ociarchive_path := absolute_path(join("/tmp", file_name(image)))
8-
target_container_name := without_extension(file_name(image))
8+
target_container_name := replace_regex(without_extension(file_name(image)), "@sha256:", "-")
99
target_container_osinfo_path := "/tmp/compute-pcrs-osinfo"
1010
target_container_mount_point := "/var/srv/image"
1111
host_platform := "qemu-ovmf/fedora-42"
@@ -14,12 +14,17 @@ skip_build := "false"
1414

1515
pull-target-container-image:
1616
#!/bin/bash
17+
# set -x
1718
set -euo pipefail
1819
if ! podman image exists {{target_container_name}}; then
19-
curl --skip-existing -o {{target_container_ociarchive_path}} {{image}}
20-
image_id=$(podman load -i {{target_container_ociarchive_path}} 2>/dev/null | awk -F ':' '{print $NF}')
21-
rm {{target_container_ociarchive_path}}
22-
podman tag $image_id {{target_container_name}}
20+
if podman pull {{image}}; then
21+
podman tag {{image}} {{target_container_name}}
22+
else
23+
curl --skip-existing -o {{target_container_ociarchive_path}} {{image}}
24+
image_id=$(podman load -i {{target_container_ociarchive_path}} 2>/dev/null | awk -F ':' '{print $NF}')
25+
rm {{target_container_ociarchive_path}}
26+
podman tag $image_id {{target_container_name}}
27+
fi
2328
fi
2429

2530
extract-info-target-container-image: pull-target-container-image

‎lib/src/esp.rs‎

Lines changed: 24 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
// SPDX-License-Identifier: MIT
55

66
use crate::pefile;
7+
use glob::glob;
78
use std::fs;
89
use std::io;
910
use std::path::{Path, PathBuf};
@@ -14,35 +15,32 @@ pub struct Esp {
1415
grub: PathBuf,
1516
}
1617

17-
const ESP_VENDOR_NAMES: [&str; 2] = ["redhat", "fedora"];
18+
fn find_efi_bin(search_path: &Path, bin_name: &str) -> io::Result<PathBuf> {
19+
let glob_path = search_path.join(Path::new("**/EFI/*/").join(bin_name));
20+
let glob_pattern = glob_path.to_str().ok_or_else(|| {
21+
io::Error::new(
22+
io::ErrorKind::InvalidInput,
23+
"Invalid efi bin search pattern",
24+
)
25+
})?;
1826

19-
fn esp_vendor_path(esp_root_path: &Path) -> io::Result<PathBuf> {
20-
for vendor in ESP_VENDOR_NAMES {
21-
let vendor_path = esp_root_path.join(format!("EFI/{vendor}"));
22-
match fs::metadata(&vendor_path) {
23-
Err(_) => {}
24-
Ok(metadata) => {
25-
if metadata.is_dir() {
26-
return Ok(vendor_path);
27-
}
28-
}
27+
let search_results = match glob(glob_pattern) {
28+
Ok(results) => results,
29+
Err(_) => {
30+
return Err(io::Error::new(
31+
io::ErrorKind::InvalidInput,
32+
"Invalid efi bin search pattern",
33+
));
2934
}
35+
};
36+
if let Some(path) = search_results.filter_map(Result::ok).next() {
37+
// Assume there's just one of them; return the first one
38+
return Ok(path);
3039
}
31-
Err(io::Error::new(
32-
io::ErrorKind::NotFound,
33-
String::from("Unknown ESP tree format"),
34-
))
35-
}
3640

37-
fn bin_path_from_esp_vendor(esp_vendor_path: &Path, bin_name: &str) -> io::Result<PathBuf> {
38-
let bin_path = esp_vendor_path.join(bin_name);
39-
let metadata = fs::metadata(&bin_path)?;
40-
if metadata.is_file() {
41-
return Ok(bin_path);
42-
}
4341
Err(io::Error::new(
44-
io::ErrorKind::IsADirectory,
45-
bin_path.to_string_lossy(),
42+
io::ErrorKind::NotFound,
43+
format!("{bin_name} not found"),
4644
))
4745
}
4846

@@ -53,11 +51,9 @@ impl Esp {
5351
return Err(io::Error::new(io::ErrorKind::NotADirectory, path));
5452
}
5553

56-
let esp_vendor_path = esp_vendor_path(&path_pb)?;
57-
5854
Ok(Esp {
59-
grub: bin_path_from_esp_vendor(&esp_vendor_path, "grubx64.efi")?,
60-
shim: bin_path_from_esp_vendor(&esp_vendor_path, "shimx64.efi")?,
55+
grub: find_efi_bin(&path_pb, "grubx64.efi")?,
56+
shim: find_efi_bin(&path_pb, "shimx64.efi")?,
6157
})
6258
}
6359

‎lib/src/rootfs.rs‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,34 @@
33
//
44
// SPDX-License-Identifier: MIT
55

6+
use std::fs;
67
use std::io;
78
use std::path;
89

910
const RELATIVE_KERNELS_PATH: &str = "usr/lib/modules/";
10-
const RELATIVE_ESP_PATH: &str = "usr/lib/bootupd/updates/";
11+
const RELATIVE_ESP_OLD: &str = "usr/lib/bootupd/updates/";
12+
// From fcos-44 on shim/grub are stored in different directories
13+
// see https://fedoraproject.org/wiki/Changes/BootLoaderUpdatesPhase1
14+
const RELATIVE_ESP_NEW: &str = "usr/lib/efi";
1115

1216
pub struct RootFSTree {
1317
esp_path: String,
1418
kernels_path: String,
1519
}
1620

21+
fn esp_path_absolute(rootfs_path: &path::Path) -> io::Result<path::PathBuf> {
22+
let temptative = rootfs_path.join(RELATIVE_ESP_NEW);
23+
match fs::exists(&temptative)? {
24+
true => Ok(temptative),
25+
false => Ok(rootfs_path.join(RELATIVE_ESP_OLD)),
26+
}
27+
}
28+
1729
impl RootFSTree {
1830
pub fn new(rootfs_path: &str) -> io::Result<RootFSTree> {
1931
let rootfs_path = path::absolute(rootfs_path)?;
2032
let kernels_path = rootfs_path.join(RELATIVE_KERNELS_PATH);
21-
let esp_path = rootfs_path.join(RELATIVE_ESP_PATH);
33+
let esp_path = esp_path_absolute(&rootfs_path)?;
2234
Ok(RootFSTree {
2335
esp_path: esp_path.to_str().unwrap().into(),
2436
kernels_path: kernels_path.to_str().unwrap().into(),

‎test-fixtures/qemu-ovmf/fedora-42/fedora-44.20260111.91.1/all-pcrs.json‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
{
2+
"pcrs": [
3+
{
4+
"id": 4,
5+
"value": "55cafe514d82bb527d34b678c4d2954d1aab07b6483367b67cc90f121d6f67d4",
6+
"events": [
7+
{
8+
"name": "EV_EFI_ACTION",
9+
"pcr": 4,
10+
"hash": "3d6772b4f84ed47595d72a2c4c5ffd15f5bb72c7507fe26f2aaee2c69d5633ba",
11+
"id": "Pcr4EfiCall"
12+
},
13+
{
14+
"name": "EV_SEPARATOR",
15+
"pcr": 4,
16+
"hash": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
17+
"id": "Pcr4Separator"
18+
},
19+
{
20+
"name": "EV_EFI_BOOT_SERVICES_APPLICATION",
21+
"pcr": 4,
22+
"hash": "9d5c8223265f3119cbc44155abbb58717e998338f41a4edeacb4b0b94357821f",
23+
"id": "Pcr4Shim"
24+
},
25+
{
26+
"name": "EV_EFI_BOOT_SERVICES_APPLICATION",
27+
"pcr": 4,
28+
"hash": "72c5ea9371a1262e5275d2ed7e97fb6ae420f7e8e5eb5f18a1232c088cd74680",
29+
"id": "Pcr4Grub"
30+
},
31+
{
32+
"name": "EV_EFI_BOOT_SERVICES_APPLICATION",
33+
"pcr": 4,
34+
"hash": "c5da3452bfe17cce87e00390f70afb55303f4f4411af853cf5289b95fce81c14",
35+
"id": "Pcr4Vmlinuz"
36+
}
37+
]
38+
},
39+
{
40+
"id": 7,
41+
"value": "8e8d561f8e596446b86c0cdbf22d9ff54a0b2913dd44054e23c493c93aa79ce7",
42+
"events": [
43+
{
44+
"name": "EV_EFI_VARIABLE_DRIVER_CONFIG",
45+
"pcr": 7,
46+
"hash": "ccfc4bb32888a345bc8aeadaba552b627d99348c767681ab3141f5b01e40a40e",
47+
"id": "Pcr7SecureBoot"
48+
},
49+
{
50+
"name": "EV_EFI_VARIABLE_DRIVER_CONFIG",
51+
"pcr": 7,
52+
"hash": "adb6fc232943e39c374bf4782b6c697f43c39fca1f4b51dfceda21164e19a893",
53+
"id": "Pcr7Pk"
54+
},
55+
{
56+
"name": "EV_EFI_VARIABLE_DRIVER_CONFIG",
57+
"pcr": 7,
58+
"hash": "b5432fe20c624811cb0296391bfdf948ebd02f0705ab8229bea09774023f0ebf",
59+
"id": "Pcr7Kek"
60+
},
61+
{
62+
"name": "EV_EFI_VARIABLE_DRIVER_CONFIG",
63+
"pcr": 7,
64+
"hash": "4313e43de720194a0eabf4d6415d42b5a03a34fdc47bb1fc924cc4e665e6893d",
65+
"id": "Pcr7Db"
66+
},
67+
{
68+
"name": "EV_EFI_VARIABLE_DRIVER_CONFIG",
69+
"pcr": 7,
70+
"hash": "001004ba58a184f09be6c1f4ec75a246cc2eefa9637b48ee428b6aa9bce48c55",
71+
"id": "Pcr7Dbx"
72+
},
73+
{
74+
"name": "EV_SEPARATOR",
75+
"pcr": 7,
76+
"hash": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
77+
"id": "Pcr7Separator"
78+
},
79+
{
80+
"name": "EV_EFI_VARIABLE_AUTHORITY",
81+
"pcr": 7,
82+
"hash": "4d4a8e2c74133bbdc01a16eaf2dbb5d575afeb36f5d8dfcf609ae043909e2ee9",
83+
"id": "Pcr7ShimCert"
84+
},
85+
{
86+
"name": "EV_EFI_VARIABLE_AUTHORITY",
87+
"pcr": 7,
88+
"hash": "bcf4d1ff6bf02f949e5afd49dc45fe3e16f39b302764bf2ee98257e8297a1f7d",
89+
"id": "Pcr7SbatLevel"
90+
},
91+
{
92+
"name": "EV_EFI_VARIABLE_AUTHORITY",
93+
"pcr": 7,
94+
"hash": "ad5901fd581e6640c742c488083b9ac2c48255bd28a16c106c6f9df52702ee3f",
95+
"id": "Pcr7GrubMokListCert"
96+
}
97+
]
98+
},
99+
{
100+
"id": 14,
101+
"value": "17cdefd9548f4383b67a37a901673bf3c8ded6f619d36c8007562de1d93c81cc",
102+
"events": [
103+
{
104+
"name": "EV_IPL",
105+
"pcr": 14,
106+
"hash": "e8e48e3ad10bc243341b4663c0057aef0ec7894ccc9ecb0598f0830fa57f7220",
107+
"id": "Pcr14MokList"
108+
},
109+
{
110+
"name": "EV_IPL",
111+
"pcr": 14,
112+
"hash": "8d8a3aae50d5d25838c95c034aadce7b548c9a952eb7925e366eda537c59c3b0",
113+
"id": "Pcr14MokListX"
114+
},
115+
{
116+
"name": "EV_IPL",
117+
"pcr": 14,
118+
"hash": "4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a",
119+
"id": "Pcr14MokListTrusted"
120+
}
121+
]
122+
}
123+
]
124+
}

‎test-fixtures/qemu-ovmf/fedora-42/fedora-44.20260111.91.1/pcr14.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"id": 14,
3+
"value": "17cdefd9548f4383b67a37a901673bf3c8ded6f619d36c8007562de1d93c81cc",
4+
"events": [
5+
{
6+
"name": "EV_IPL",
7+
"pcr": 14,
8+
"hash": "e8e48e3ad10bc243341b4663c0057aef0ec7894ccc9ecb0598f0830fa57f7220",
9+
"id": "Pcr14MokList"
10+
},
11+
{
12+
"name": "EV_IPL",
13+
"pcr": 14,
14+
"hash": "8d8a3aae50d5d25838c95c034aadce7b548c9a952eb7925e366eda537c59c3b0",
15+
"id": "Pcr14MokListX"
16+
},
17+
{
18+
"name": "EV_IPL",
19+
"pcr": 14,
20+
"hash": "4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a",
21+
"id": "Pcr14MokListTrusted"
22+
}
23+
]
24+
}

‎test-fixtures/qemu-ovmf/fedora-42/fedora-44.20260111.91.1/pcr4.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"id": 4,
3+
"value": "55cafe514d82bb527d34b678c4d2954d1aab07b6483367b67cc90f121d6f67d4",
4+
"events": [
5+
{
6+
"name": "EV_EFI_ACTION",
7+
"pcr": 4,
8+
"hash": "3d6772b4f84ed47595d72a2c4c5ffd15f5bb72c7507fe26f2aaee2c69d5633ba",
9+
"id": "Pcr4EfiCall"
10+
},
11+
{
12+
"name": "EV_SEPARATOR",
13+
"pcr": 4,
14+
"hash": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
15+
"id": "Pcr4Separator"
16+
},
17+
{
18+
"name": "EV_EFI_BOOT_SERVICES_APPLICATION",
19+
"pcr": 4,
20+
"hash": "9d5c8223265f3119cbc44155abbb58717e998338f41a4edeacb4b0b94357821f",
21+
"id": "Pcr4Shim"
22+
},
23+
{
24+
"name": "EV_EFI_BOOT_SERVICES_APPLICATION",
25+
"pcr": 4,
26+
"hash": "72c5ea9371a1262e5275d2ed7e97fb6ae420f7e8e5eb5f18a1232c088cd74680",
27+
"id": "Pcr4Grub"
28+
},
29+
{
30+
"name": "EV_EFI_BOOT_SERVICES_APPLICATION",
31+
"pcr": 4,
32+
"hash": "c5da3452bfe17cce87e00390f70afb55303f4f4411af853cf5289b95fce81c14",
33+
"id": "Pcr4Vmlinuz"
34+
}
35+
]
36+
}

‎test-fixtures/qemu-ovmf/fedora-42/fedora-44.20260111.91.1/pcr7-sb-disabled.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"id": 7,
3+
"value": "b926225ac488e9c50ef2fa815aa7104b385a06907093bfb1dc62eeb7abecddf1",
4+
"events": [
5+
{
6+
"name": "EV_EFI_VARIABLE_DRIVER_CONFIG",
7+
"pcr": 7,
8+
"hash": "115aa827dbccfb44d216ad9ecfda56bdea620b860a94bed5b7a27bba1c4d02d8",
9+
"id": "Pcr7SecureBoot"
10+
},
11+
{
12+
"name": "EV_EFI_VARIABLE_DRIVER_CONFIG",
13+
"pcr": 7,
14+
"hash": "dea7b80ab53a3daaa24d5cc46c64e1fa9ffd03739f90aadbd8c0867c4a5b4890",
15+
"id": "Pcr7Pk"
16+
},
17+
{
18+
"name": "EV_EFI_VARIABLE_DRIVER_CONFIG",
19+
"pcr": 7,
20+
"hash": "e670e121fcebd473b8bc41bb801301fc1d9afa33904f06f7149b74f12c47a68f",
21+
"id": "Pcr7Kek"
22+
},
23+
{
24+
"name": "EV_EFI_VARIABLE_DRIVER_CONFIG",
25+
"pcr": 7,
26+
"hash": "baf89a3ccace52750c5f0128351e0422a41597a1adfd50822aa363b9d124ea7c",
27+
"id": "Pcr7Db"
28+
},
29+
{
30+
"name": "EV_EFI_VARIABLE_DRIVER_CONFIG",
31+
"pcr": 7,
32+
"hash": "9f75b6823bff6af1024a4e2036719cdd548d3cbc2bf1de8e7ef4d0ed01f94bf9",
33+
"id": "Pcr7Dbx"
34+
},
35+
{
36+
"name": "EV_SEPARATOR",
37+
"pcr": 7,
38+
"hash": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
39+
"id": "Pcr7Separator"
40+
},
41+
{
42+
"name": "EV_EFI_VARIABLE_AUTHORITY",
43+
"pcr": 7,
44+
"hash": "922e939a5565798a5ef12fe09d8b49bf951a8e7f89a0cca7a51636693d41a34d",
45+
"id": "Pcr7SbatLevel"
46+
}
47+
]
48+
}

0 commit comments

Comments
 (0)