osbuild: add support for qemu-secex #3764
Conversation
There was a problem hiding this comment.
I don't feel qualified to comment on the osbuild part, though i looked over it and i did not find anything that looked wrong to me.
One question, how is the naming scheme of the patch files, since normally i would expect the numbers to show the order they need to be applied in and for them to unique? But here is see 0001 is used twice?
they are written to stdout using |
nikita-dubrovskii
changed the title
|
osbuild pr: osbuild/osbuild#1806 |
src/0001-stages-add-stage-for-creating-dm-verity-partitions.patch
Outdated
Show resolved
Hide resolved
src/0001-stages-add-stage-for-creating-dm-verity-partitions.patch
Outdated
Show resolved
Hide resolved
src/0001-stages-add-stage-for-creating-dm-verity-partitions.patch
Outdated
Show resolved
Hide resolved
nikita-dubrovskii
force-pushed
the
secex
branch
4 times, most recently
from
6b22007
to
e5ec67b
Compare
nikita-dubrovskii
changed the title
nikita-dubrovskii
force-pushed
the
secex
branch
3 times, most recently
from
69827fc
to
432ab0c
Compare
|
@jschintag could you please check the scripts with official |
|
/retest |
There was a problem hiding this comment.
Some minor comments but LGTM overall.
Nice work on this @nikita-dubrovskii. It's been a long time coming!
There was a problem hiding this comment.
Probably worth a comment here at the top of this file about what this Butane config is for.
Would be nice to put the instructions in the commit message somewhere more visible. Maybe in https://coreos.github.io/coreos-assembler/devel/ ?
Not a blocker/can be a follow-up.
There was a problem hiding this comment.
Spoke OOB with Nikita about this. In a follow-up, he will add logic that will actually start up a VM with that Butane config for the local dev case.
This template coul be used to create genprotimgvm locally. During build this VM is used to generete 'sdboot' image and 'zipl' it on coreos.qemu-secex.s390x.qcow2 image. Put this template, your id_rsa.pub and valid secex-hostkey into same directory and generate Ignition config: ``` butane --pretty --files-dir . genprotimg.bu -o genprotimg.ign ``` Than get rhcos.qemu-secex.s390x.qcow2 and customize it with generated above ignition config.
I have run it on the builder and i could build a secure execution test and run the associated kola tests successfully. |
Great, thx for testing! |
There was a problem hiding this comment.
Spoke OOB with Nikita about this. In a follow-up, he will add logic that will actually start up a VM with that Butane config for the local dev case.
Discussion also goes in: dustymabe/osbuild#22