Repository navigation
feat(sign): prove a sign-time anchor carries an upgrade - #82
Merged
Merged
Conversation
The engine now reads the sign-time upgrade anchor from CRYPTOS_UPGRADE_ANCHOR and ships cryptosctl image sign. release/pins.yaml follows go.mod so the release guard stays consistent. Refs #41 Signed-off-by: Bugs5382 <12115015+Bugs5382@users.noreply.github.com>
The bridge job builds the candidate unsigned with no build-time anchor, signs it with cryptosctl image sign and a second throwaway key, checks it with sbverify --cert and the detached signature, boots it, refuses an image signed by the other key, and stages, activates and boots a second image signed the same way. Closes #41 Signed-off-by: Bugs5382 <12115015+Bugs5382@users.noreply.github.com>
…mage sign Refs #41 Signed-off-by: Bugs5382 <12115015+Bugs5382@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
Closes #41
An operator who downloads the unsigned release UKI and signs it afterwards now gets a node that takes in-place upgrades. switchroot already carries a sign-time anchor to init (#80); this pins the cryptos-node commit that reads it and ships
cryptosctl image sign(CryptOS-PKI/cryptos-node#382, 01cf9e5), and proves the whole path in the QEMU suite.go.mod/go.summove cryptos-node tov0.0.0-20261016122123-01cf9e529716(checksums from sum.golang.org), andrelease/pins.yamlfollows sotask release:guardstays consistent.test/image/build-bridge.shnow also builds the candidate the release-asset way (noSB_CERT, and it fails if/initholds a certificate anyway), twice with different versions. It signs each with the pinnedcryptosctl image signand a second throwaway key K2 on/dev/shm, and checks each.sigwith openssl. Those are the doc's how-to steps, run as written.TestBridgeUpgradegets three sign-time anchor steps on a fresh nodeid Root:sbverify --cert K2on both signed UKIs, and the detached.sigchecked in Go;image statushas to answer with the running version (an image with no anchor answers Unimplemented);docs/secure-boot.mdgets a "Sign a downloaded unsigned image" how-to usingcryptosctl image sign(replacing the note that signing afterwards leaves no anchor).docs/image-upgrade.mdanddocs/release.mdare updated to match.Verification
task release:guardin CI with the moved pin.How this was verified
CI is the proof; nothing was built, tested or booted locally. go.mod and go.sum were edited by hand from the checksum database, and CI's module download verifies them. gofmt,
bash -nand actionlint are clean.