AB update: dedicated verity hash partitions, UUID-based A/B boot, and trident integration#27
Closed
bfjelds wants to merge 1 commit into
Closed
Conversation
…integration Move dm-verity from inline hash mode (appended to USR partition) to dedicated HASH-A/HASH-B partitions. Switch boot cmdline from partition UUIDs (PARTUUID=) to filesystem/verity UUIDs (UUID=) so the same UKI works for both A and B slots, enabling A/B updates. Changes: - disk_layout_uki.json: Add HASH-A (3) and HASH-B (5) partitions with dps-usr-verity type, renumber OEM→6 and ROOT→7 - disk_util: Add DPS_USR_VERITY_GUIDS, support verity_hash cross-ref to dedicated hash partition, extract verity/fs UUIDs - build_image_util.sh: Pass --verity_uuid and --fs_uuid through the verity and bootloader pipeline - grub.cfg: Use UUID= instead of PARTUUID= with hash-offset - grub_install.sh: Inject @@FSUUID@@ and @@VERITYUUID@@ placeholders - uki_install.sh: Read UUIDs from build artifacts instead of static disk_layout.json values, add --verity_uuid/--fs_uuid flags - package_catalog.yaml: Add trident to systemd package group - build_image_util.sh (rpm): Enable tridentd.socket at build time - rpm_install.sh: Temporarily disable SELinux module removal to unblock trident install Based on changes from user/frhuelsz/ab-update-trident branch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
Author
|
folded into #28 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces inline dm-verity with dedicated hash partitions and switches boot parameters from partition UUIDs to filesystem/verity superblock UUIDs, enabling A/B-agnostic boot. Also integrates trident as an RPM package.
Validation
TBD
Dedicated verity hash partitions
disk_layout_uki.jsonusing Discoverable Partition Spec (dps-usr-verity) type GUIDs.verity_hashcross-reference pointing to its dedicated hash partition instead of using the inlineverityfeature flag.disk_utilupdated to support the newdps-usr-veritypartition type (x86_64 and aarch64 GUIDs) and separate-partition verity formatting viaveritysetup format.UUID-based boot (A/B agnostic)
systemd.verity_usr_data=UUID=<btrfs-uuid>systemd.verity_usr_hash=UUID=<verity-uuid>systemd.verity_usr_options=panic-on-corruptionblkidfor btrfs FS UUID,veritysetupoutput for verity superblock UUID) and written to artifact files, then injected into UKI cmdline and GRUB config via@@FSUUID@@/@@VERITYUUID@@placeholders.Trident integration
tridenttopackage_catalog.yaml.tridentd.socketvia systemd symlink during image build.semodule -r) to unblock trident install (marked with TODO to re-enable).Replaces
https://dev.azure.com/mariner-org/ACL/_git/acl-scripts/pullrequest/27611