lix-community/lanzaboote
0
0
Fork 0
Code Issues Pull requests 4 Projects Releases Packages Wiki Activity

WIP: in-memory assembling of PEs #1

Draft
raito wants to merge 16 commits from in-memory-assembling into master
pull from: in-memory-assembling
merge into: lix-community:master
Conversation 0 Commits 16 Files changed 26 +2057 -531
raito commented 2025-05-09 19:07:37 +00:00
Owner
Copy link
No description provided. 
Now, it is possible to build any package of the workspace in a fine grained fashion.
We want here to capture the required data to assemble a stub, here is a partial structure
modulo ESP generation paths.

Other pieces of code can consume this structure, validate it before passing it to the PE assembler
and the signer.

We convert everything into owned structures because we cannot really do
deserialization in any context with lifetimes going around, but,
allocations are generally very cheap in this context.
In order to offer more flexible signature mechanisms in lanzaboote,
we need to take a step back and offer a general PE signature trait.

After this, we will be able to plug various different implementations.
Remote signing enables a user to request for:

- PE signature of a given store path, which is assumed to be available on the server side
- PE signature oi a stub given by its parameters, which are assumed to be analyzable on the server side
  (i.e. computing hashes is possible.)
- Verifying if a PE signature is correct according to PE signatures and Secure Boot policy
It is now possible to use remote signature inside lzbt-systemd.
This is an example server to perform remote signatures
based on stub parameters provided.
Our lanzaboote integration tests are getting more and more sophisticated and ambitious.

Let's extract them into a "lanzalib", so they can be used with multiple backends.
We build lanzasignd now as part of the flake as an additional software we provide.
Introduces the Secure Boot remote signing server for NixOS.
Lanzaboote boot module now supports using a potential remote signer server,
but this support is limited to the lanzaboote bootables and not the fwupd ones.
A simple test harness for remote signatures with lanzasignd.
We didn't test if there *was* a signature, idempotency of removal of signatures (i.e. removing an non-existent signature
is the identity operation) could fool us into believing we had a signed thing then not signed.
This is relevant for a remote signer who relies on the existence of store paths
remotely, for example.
We should wait on the upstream PR to be merged so we can get rid of the
flake reference.
Life is too short to guess why EDK2 is broken, hence, I needed to debug the PE loader
and I wrote that in another project for debugging a kernel.

Here we go for this project.
`lanzaboote_image` is no more, we directly go from a set of stub parameters to the in-memory
representation of the final image.

Whatever the consumer wants to do with it, they are free to do so.

For now, we redump it into a temporary directory to make the changes minimal.

This depends on an unreleased branch of Goblin.
This pull request has changes conflicting with the target branch.
  • flake.lock
  • flake.nix
  • nix/modules/lanzaboote.nix
  • nix/tests/lanzaboote.nix
  • rust/tool/Cargo.lock
  • rust/tool/shared/Cargo.toml
  • rust/tool/shared/src/pe.rs
  • rust/tool/shared/src/signature/local.rs
  • rust/tool/shared/src/signature/mod.rs
  • rust/tool/systemd/src/cli.rs
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin in-memory-assembling:in-memory-assembling
git switch in-memory-assembling

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch master
git merge --no-ff in-memory-assembling
git switch in-memory-assembling
git rebase master
git switch master
git merge --ff-only in-memory-assembling
git switch in-memory-assembling
git rebase master
git switch master
git merge --no-ff in-memory-assembling
git switch master
git merge --squash in-memory-assembling
git switch master
git merge --ff-only in-memory-assembling
git switch master
git merge in-memory-assembling
git push origin master
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: lix-community/lanzaboote#1
No description provided.
Delete branch "in-memory-assembling"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?