Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merge the Dockerfile for reproducible builds #1

Draft
wants to merge 25 commits into
base: main
Choose a base branch
from
Draft
Show file tree
Hide file tree
Changes from 21 commits
Commits
Show all changes
25 commits
Select commit Hold shift + click to select a range
479f420
Add Dockerfile
sayanchowdhury Aug 29, 2024
025d1a5
Add the shim.efi and build.log
sayanchowdhury Aug 29, 2024
fd25a73
Fix Dockerfile for reproducible
sayanchowdhury Sep 2, 2024
b63cfe8
Adapt to include the flatcar-test-ca files
sayanchowdhury Sep 6, 2024
b3bc580
Add build.log, shimx64.efi and drop shim.efi
sayanchowdhury Sep 6, 2024
9108823
Update the build.log for the new shim SBAT
sayanchowdhury Sep 6, 2024
ccb500e
Update the Dockerfile to use version numbers in binaries
sayanchowdhury Sep 16, 2024
4998a65
Update README.md with the answers
sayanchowdhury Sep 17, 2024
c8dece2
README.md: Cosmetic fixes to the QA
sayanchowdhury Sep 17, 2024
a5e7784
README.md: Answer a few more questions
sayanchowdhury Sep 17, 2024
178c4ec
README.md: Fix the GRUB SBAT generation question
sayanchowdhury Sep 17, 2024
220e870
README.md: A few mostly cosmetic tweaks
chewi Sep 17, 2024
93a9dfc
README.md: Update answers now our GRUB build includes a -flatcar1 suffix
chewi Sep 26, 2024
6ade498
Dockerfile: Add the build for shim aarch64
sayanchowdhury Oct 16, 2024
4da9dc1
Improve answer on why we cannot use another distro's signed shim
chewi Oct 22, 2024
512b4a8
Remove duplicate answer
chewi Oct 22, 2024
3651e74
Update answers to reflect that we are now using Fedora's GRUB patches
chewi Oct 22, 2024
a022c6e
Add additional answers in the README.md
sayanchowdhury Nov 14, 2024
4438a2b
Update the Dockerfile/build.log/flatcar-dev-ca
sayanchowdhury Nov 14, 2024
cdff53a
Add the SHA of the shim binary & tarball
sayanchowdhury Nov 14, 2024
72fd5c2
Fix the shim ebuild revision
sayanchowdhury Nov 14, 2024
edf2c34
Update README.md based on the PR reviews
sayanchowdhury Nov 14, 2024
cf44206
README.md: Clarify verity hash extraction process
chewi Nov 14, 2024
81e0d87
README.md: The search_part_label GRUB module was listed twice
chewi Nov 14, 2024
077ae24
README.md: Add link to our shim patch for building gnu-efi
chewi Nov 14, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 34 additions & 0 deletions Dockerfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
FROM ghcr.io/flatcar/flatcar-sdk-all:4054.0.0

ARG SCRIPTS_REPO_URL=https://github.com/flatcar/scripts.git
ARG SCRIPTS_WORK_DIR=/mnt/host/source/src/scripts

# Clone the scripts repo
WORKDIR /mnt/host/source/src/scripts/
RUN git clone $SCRIPTS_REPO_URL .
RUN git -C $SCRIPTS_WORK_DIR fetch --tags
RUN git -C $SCRIPTS_WORK_DIR checkout main

ADD flatcar-dev-ca.der .

COPY --chown=sdk:sdk . /mnt/host/source/src/scripts

RUN chown sdk:sdk /mnt/host/source
RUN ln -s /mnt/host/source/src/scripts/sdk_container/src/third_party /mnt/host/source/src/
ENV SOURCE_DATE_EPOCH=1
ENV USE=official
ENV SHIM_SIGNING_CERTIFICATE=/mnt/host/source/src/scripts/flatcar-dev-ca.der
RUN wget -O /mnt/host/source/.cache/distfiles/shim-15.8.tar.bz2 https://github.com/rhboot/shim/releases/download/15.8/shim-15.8.tar.bz2
RUN emerge-amd64-usr --nodeps shim
sayanchowdhury marked this conversation as resolved.
Show resolved Hide resolved
RUN emerge-arm64-usr --nodeps shim

WORKDIR /shim-review
RUN sha256sum /mnt/host/source/.cache/distfiles/shim-15.8.tar.bz2 | tee shim-tar-bz2.sha256
RUN sha256sum /build/amd64-usr/usr/lib/shim/shimx64.efi | tee shimx64-15.8.sha256
RUN sha256sum /build/arm64-usr/usr/lib/shim/shimaa64.efi | tee shimaa64-15.8.sha256
RUN cp /build/amd64-usr/usr/lib/shim/shimx64.efi shimx64-15.8.efi
RUN cp /build/arm64-usr/usr/lib/shim/shimaa64.efi shimaa64-15.8.efi
RUN objcopy --only-section .sbat -O binary shimx64-15.8.efi /dev/stdout | tee sbat-shimx64-15.8.csv
RUN aarch64-cros-linux-gnu-objcopy --only-section .sbat -O binary /shim-review/shimaa64-15.8.efi /dev/stdout | tee sbat-shimaa64-15.8.csv
RUN hexdump -Cv shimx64-15.8.efi > shimx64-build
RUN hexdump -Cv shimaa64-15.8.efi > shima64-build
Loading