Feat: Add FsGuard module

.github/workflows/vib-build.yml

@@ -18,7 +18,10 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - uses: vanilla-os/vib-gh-action@v0.3.2-2
+    - uses: vanilla-os/vib-gh-action@v0.3.3-1
+      with:
+        recipe: 'recipe.yml'
+        plugins: 'Vanilla-OS/vib-fsguard:v1.0-3'
 
     - name: Build the Docker image
       run: docker image build -f Containerfile --tag ghcr.io/vanilla-os/core:main .

.github/workflows/vib-pr.yml

@@ -13,7 +13,10 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - uses: vanilla-os/vib-gh-action@v0.3.2-2
+    - uses: vanilla-os/vib-gh-action@v0.3.3-1
+      with:
+        recipe: 'recipe.yml'
+        plugins: 'Vanilla-OS/vib-fsguard:v1.0-3'
 
     - name: Build the Docker image
       run: docker image build -f Containerfile --tag vanillaos/core:validation .

recipe.yml

@@ -16,19 +16,6 @@ modules:
   - apt install -y man-db
   - mandb -c
 
-- name: fsguard
-  type: shell
-  source:
-    type: tar
-    url: https://github.com/linux-immutability-tools/FsGuard/releases/download/v0.1.2/FsGuard_0.1.2_linux_amd64.tar.gz
-  commands:
-  - apt install -y minisign
-  - mv /sources/FsGuard /usr/bin
-  - /usr/bin/gen_fsguard_filelist /usr/bin
-  - sed -i '\/usr\/bin\/gen_fsguard_filelist.*/d' /FsGuard/filelist
-  - sed -i '\/usr\/bin\/sign_filelist.*/d' /FsGuard/filelist
-  - /usr/bin/sign_filelist
-
 - name: packages-modules
   type: includes
   includes:
@@ -54,17 +41,31 @@ modules:
     - modules/140-manpages
     - modules/999-replace-locale-gen
 
-- name: cleanup
+- name: cleanup1
   type: shell
   commands:
   - apt remove -y linux-image-rt-amd64 linux-image-6.4.0-4-rt-amd64
   - apt remove -y dpkg-dev build-essential
   - apt autoremove -y
   - apt clean
-  - rm -rf /var/cache/*
-  - rm -rf /tmp/*
-  - rm -rf /var/tmp/*
-  - rm -rf /sources
-  - rm /usr/bin/gen_fsguard_filelist
-  - rm /usr/bin/sign_filelist
-  - mkdir -p /var/cache/apt/archives/partial
+
+- name: fsguard
+  type: fsguard
+  FsGuardLocation: "/usr/sbin/init"
+  GenerateKey: true
+  FilelistPaths: ["/usr/bin"]
+  modules:
+    - name: minisign
+      type: apt
+      source:
+        packages:
+          - "minisign"
+
+- name: cleanup2
+  type: shell
+  commands:
+    - rm -rf /var/cache/*
+    - rm -rf /tmp/*
+    - rm -rf /var/tmp/*
+    - rm -rf /sources
+    - mkdir -p /var/cache/apt/archives/partial