From 8631b0f8b9b76e861e68da93bb427c559ed215af Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Mon, 28 Jul 2025 23:10:03 +0100 Subject: [PATCH 1/6] mkosi: update mkosi commit reference to cb1a3c90490922441548d09b09c7b76426e4bc20 * cb1a3c9049 FirmwareVariables: allow generating during image build * 6104923534 env: export $EFI_ARCHITECTURE in hook scripts on EFI arches * fef33f96a2 mkosi-tools: ukify moved to systemd-ukify in openSUSE * ec4475a846 ensure builds with cache over device boundaries * 7be5159f24 Change UnifiedKernelImages to enum and accept signed/unsigned * 071ac4a575 mkosi-vm: install systemd-boot-efi-signed where available * 1865be628e opensuse: Install OpenSUSE-release if another release package is not installed * 0381b17819 qemu: Disable hpet for x86 VMs * 4f63700eb3 mkosi-tools: install systemd-boot-tools for bootctl * 1230ed333b man: remove duplicate 'the' in FirmwareVariables description --- .github/workflows/coverage.yml | 2 +- .github/workflows/linter.yml | 2 +- .github/workflows/mkosi.yml | 2 +- mkosi/mkosi.conf | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 88b41d2d8c3..5fbc999b537 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -25,7 +25,7 @@ jobs: steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 - - uses: systemd/mkosi@184472f0f1f831ca29953546ec01fd941ff763a6 + - uses: systemd/mkosi@cb1a3c90490922441548d09b09c7b76426e4bc20 # Freeing up disk space with rm -rf can take multiple minutes. Since we don't need the extra free space # immediately, we remove the files in the background. However, we first move them to a different location diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml index 8c0ec63d403..ac652b4b8fa 100644 --- a/.github/workflows/linter.yml +++ b/.github/workflows/linter.yml @@ -38,7 +38,7 @@ jobs: LINTER_RULES_PATH: .github/linters GITHUB_ACTIONS_CONFIG_FILE: actionlint.yml - - uses: systemd/mkosi@184472f0f1f831ca29953546ec01fd941ff763a6 + - uses: systemd/mkosi@cb1a3c90490922441548d09b09c7b76426e4bc20 - name: Check that tabs are not used in Python code run: sh -c '! git grep -P "\\t" -- src/core/generate-bpf-delegate-configs.py src/boot/generate-hwids-section.py src/ukify/ukify.py test/integration-tests/integration-test-wrapper.py' diff --git a/.github/workflows/mkosi.yml b/.github/workflows/mkosi.yml index 6ea2a79bffe..1b8e58112a4 100644 --- a/.github/workflows/mkosi.yml +++ b/.github/workflows/mkosi.yml @@ -147,7 +147,7 @@ jobs: steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 - - uses: systemd/mkosi@184472f0f1f831ca29953546ec01fd941ff763a6 + - uses: systemd/mkosi@cb1a3c90490922441548d09b09c7b76426e4bc20 # Freeing up disk space with rm -rf can take multiple minutes. Since we don't need the extra free space # immediately, we remove the files in the background. However, we first move them to a different location diff --git a/mkosi/mkosi.conf b/mkosi/mkosi.conf index 7772ff208c5..537a1839918 100644 --- a/mkosi/mkosi.conf +++ b/mkosi/mkosi.conf @@ -1,7 +1,7 @@ # SPDX-License-Identifier: LGPL-2.1-or-later [Config] -MinimumVersion=commit:184472f0f1f831ca29953546ec01fd941ff763a6 +MinimumVersion=commit:cb1a3c90490922441548d09b09c7b76426e4bc20 Dependencies= exitrd initrd From add7a4a9f20467f12d9a791b5907c59e9d223d24 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Mon, 28 Jul 2025 01:55:27 +0100 Subject: [PATCH 2/6] test: do not fail TEST-70-TPM2 when secure boot is enabled MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit [ 183.037401] TEST-70-TPM2.sh[2876]: + systemd-creds decrypt --name=pcrlock.arch /tmp/fakexbootldr/loader/credentials/pcrlock.arch.cred [ 183.054755] TEST-70-TPM2.sh[3003]: Found container virtualization none. [ 183.083789] TEST-70-TPM2.sh[3003]: Reading EFI variable /sys/firmware/efi/efivars/LoaderTpm2ActivePcrBanks-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f. [ 183.094377] TEST-70-TPM2.sh[3003]: Detected slow EFI variable read access on LoaderTpm2ActivePcrBanks-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f: 55.799ms [ 183.095353] TEST-70-TPM2.sh[3003]: Reading EFI variable /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c. [ 183.099653] TEST-70-TPM2.sh[3003]: Credential uses fixed key for fallback use when TPM2 is absent — but TPM2 is present, and SecureBoot is enabled, refusing. --- test/units/TEST-70-TPM2.pcrlock.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/test/units/TEST-70-TPM2.pcrlock.sh b/test/units/TEST-70-TPM2.pcrlock.sh index 38e082bb886..7e546273b39 100755 --- a/test/units/TEST-70-TPM2.pcrlock.sh +++ b/test/units/TEST-70-TPM2.pcrlock.sh @@ -156,7 +156,11 @@ test -f "$CREDENTIAL_FILE" CREDENTIAL_NAME=${CREDENTIAL_FILE#/tmp/fakexbootldr/loader/credentials/} CREDENTIAL_NAME=${CREDENTIAL_NAME%.cred} -systemd-creds decrypt --name="$CREDENTIAL_NAME" "$CREDENTIAL_FILE" +# If SB is enabled then this will fail as it's not locked but TPM2 is enabled +if cmp /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c <(printf '\6\0\0\0\1'); then + ALLOW_NULL=--allow-null +fi +systemd-creds decrypt "${ALLOW_NULL:-}" --name="$CREDENTIAL_NAME" "$CREDENTIAL_FILE" ln -s "$CREDENTIAL_FILE" /tmp/fakexbootldr/loader/credentials/"$CREDENTIAL_NAME" test -f /tmp/fakexbootldr/loader/credentials/"$CREDENTIAL_NAME" From b61bff3436b1f04978983739cf5c1aeb7f618e75 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sun, 27 Jul 2025 13:16:23 +0100 Subject: [PATCH 3/6] test: preserve ESP when testing bootctl --- test/units/TEST-87-AUX-UTILS-VM.bootctl.sh | 42 ++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/test/units/TEST-87-AUX-UTILS-VM.bootctl.sh b/test/units/TEST-87-AUX-UTILS-VM.bootctl.sh index 5f12313a840..0f5f45b3d8b 100755 --- a/test/units/TEST-87-AUX-UTILS-VM.bootctl.sh +++ b/test/units/TEST-87-AUX-UTILS-VM.bootctl.sh @@ -21,7 +21,42 @@ fi (! systemd-detect-virt -cq) +restore_esp() { + if [ ! -d /tmp/esp.bak ]; then + return + fi + + if [ -d /tmp/esp.bak/EFI/ ]; then + cp -r /tmp/esp.bak/EFI/* "$(bootctl --print-esp-path)/EFI/" + fi + if [ -d /tmp/esp.bak/loader/ ]; then + cp -r /tmp/esp.bak/loader/* "$(bootctl --print-esp-path)/loader/" + fi + rm -rf /tmp/esp.bak +} + +backup_esp() { + if [ -d /tmp/esp.bak ]; then + return + fi + + if [[ -d "$(bootctl --print-esp-path)/EFI" ]]; then + mkdir -p /tmp/esp.bak + cp -r "$(bootctl --print-esp-path)/EFI/" /tmp/esp.bak/ + fi + if [[ -d "$(bootctl --print-esp-path)/loader" ]]; then + mkdir -p /tmp/esp.bak + cp -r "$(bootctl --print-esp-path)/loader/" /tmp/esp.bak/ + fi +} + basic_tests() { + # Ensure the system's ESP (no --image/--root args) is still available for the next tests + if [ $# -eq 0 ]; then + backup_esp + trap restore_esp RETURN ERR + fi + bootctl "$@" --help bootctl "$@" --version @@ -274,6 +309,10 @@ testcase_bootctl_varlink() { } testcase_bootctl_secure_boot_auto_enroll() { + # mkosi can also add keys here, so back them up and restored them + backup_esp + trap restore_esp RETURN ERR + cat >/tmp/openssl.conf < Date: Sun, 27 Jul 2025 13:17:04 +0100 Subject: [PATCH 4/6] mkosi: enable secure boot and autoenroll by default With GHA now fixed, just always enable SB so that we get extra coverage --- mkosi/mkosi.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mkosi/mkosi.conf b/mkosi/mkosi.conf index 537a1839918..545b7e69be4 100644 --- a/mkosi/mkosi.conf +++ b/mkosi/mkosi.conf @@ -39,6 +39,8 @@ WithTests=no [Validation] SignExpectedPcr=yes +SecureBoot=yes +SecureBootAutoEnroll=yes [Content] ExtraTrees= From 5ae58ac2b93a4046fbae4e0c825b8cc9d03d10d8 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sun, 27 Jul 2025 21:23:17 +0100 Subject: [PATCH 5/6] test: add a secureboot test with an addon --- mkosi/mkosi.finalize | 10 ++++++++++ .../TEST-87-AUX-UTILS-VM/meson.build | 1 + test/units/TEST-87-AUX-UTILS-VM.bootctl.sh | 17 +++++++++++++++++ 3 files changed, 28 insertions(+) diff --git a/mkosi/mkosi.finalize b/mkosi/mkosi.finalize index e6aededc604..bb7ad2d9ea7 100755 --- a/mkosi/mkosi.finalize +++ b/mkosi/mkosi.finalize @@ -3,3 +3,13 @@ set -e touch -r "$BUILDROOT/usr" "$BUILDROOT/etc/.updated" "$BUILDROOT/var/.updated" + +if [ -n "$EFI_ARCHITECTURE" ]; then + mkdir -p "$BUILDROOT/boot/loader/addons" + ukify build \ + --stub "$BUILDROOT/usr/lib/systemd/boot/efi/addon${EFI_ARCHITECTURE}.efi.stub" \ + --cmdline="addonfoobar" \ + --output "$BUILDROOT/boot/loader/addons/test.addon.efi" \ + --secureboot-certificate "$SRCDIR/mkosi/mkosi.crt" \ + --secureboot-private-key "$SRCDIR/mkosi/mkosi.key" +fi diff --git a/test/integration-tests/TEST-87-AUX-UTILS-VM/meson.build b/test/integration-tests/TEST-87-AUX-UTILS-VM/meson.build index 84901392047..d82172729fc 100644 --- a/test/integration-tests/TEST-87-AUX-UTILS-VM/meson.build +++ b/test/integration-tests/TEST-87-AUX-UTILS-VM/meson.build @@ -7,5 +7,6 @@ integration_tests += [ 'storage': 'persistent', 'coredump-exclude-regex' : '/(test-usr-dump|test-dump|bash)$', 'vm' : true, + 'firmware' : 'auto', }, ] diff --git a/test/units/TEST-87-AUX-UTILS-VM.bootctl.sh b/test/units/TEST-87-AUX-UTILS-VM.bootctl.sh index 0f5f45b3d8b..c6b4ea06552 100755 --- a/test/units/TEST-87-AUX-UTILS-VM.bootctl.sh +++ b/test/units/TEST-87-AUX-UTILS-VM.bootctl.sh @@ -342,4 +342,21 @@ EOF bootctl remove } +testcase_secureboot() { + if [ ! -d /sys/firmware/efi ]; then + echo "Not booted with EFI, skipping secureboot tests." + return 0 + fi + + # Ensure secure boot is enabled and not in setup mode + cmp /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c <(printf '\6\0\0\0\1') + cmp /sys/firmware/efi/efivars/SetupMode-8be4df61-93ca-11d2-aa0d-00e098032b8c <(printf '\6\0\0\0\0') + bootctl status | grep -q "Secure Boot: enabled" + + # Ensure the addon is fully loaded and parsed + bootctl status | grep -q "global-addon: loader/addons/test.addon.efi" + bootctl status | grep "cmdline" | grep -q addonfoobar + grep -q addonfoobar /proc/cmdline +} + run_testcases From 31ae0d088ffbe7a89c1aff6ffafc47fbd04c4a92 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sun, 27 Jul 2025 21:25:10 +0100 Subject: [PATCH 6/6] ci: test integration with shim in debian jobs Debian provides a signed shim that trusts sdboot and can be installed without pulling in grub automatically. Install it in the debian mkosi CI job, and build a custom efivars with the mkosi cert enrolled in MOK but not DB, to test those code paths. --- .github/workflows/mkosi.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/.github/workflows/mkosi.yml b/.github/workflows/mkosi.yml index 1b8e58112a4..d6d8e096afb 100644 --- a/.github/workflows/mkosi.yml +++ b/.github/workflows/mkosi.yml @@ -64,6 +64,7 @@ jobs: vm: 1 no_qemu: 0 no_kvm: 0 + shim: 0 - distro: debian release: testing runner: ubuntu-24.04 @@ -74,6 +75,7 @@ jobs: vm: 0 no_qemu: 0 no_kvm: 0 + shim: 1 - distro: debian release: testing runner: ubuntu-24.04-arm @@ -84,6 +86,7 @@ jobs: vm: 0 no_qemu: 1 no_kvm: 1 + shim: 0 - distro: ubuntu release: noble runner: ubuntu-24.04 @@ -94,6 +97,7 @@ jobs: vm: 0 no_qemu: 0 no_kvm: 0 + shim: 0 - distro: fedora release: "42" runner: ubuntu-24.04 @@ -104,6 +108,7 @@ jobs: vm: 0 no_qemu: 0 no_kvm: 0 + shim: 0 - distro: fedora release: rawhide runner: ubuntu-24.04 @@ -114,6 +119,7 @@ jobs: vm: 0 no_qemu: 0 no_kvm: 0 + shim: 0 - distro: opensuse release: tumbleweed runner: ubuntu-24.04 @@ -124,6 +130,7 @@ jobs: vm: 0 no_qemu: 0 no_kvm: 0 + shim: 0 - distro: centos release: "9" runner: ubuntu-24.04 @@ -134,6 +141,7 @@ jobs: vm: 0 no_qemu: 0 no_kvm: 0 + shim: 0 - distro: centos release: "10" runner: ubuntu-24.04 @@ -144,6 +152,7 @@ jobs: vm: 0 no_qemu: 0 no_kvm: 0 + shim: 0 steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 @@ -227,6 +236,23 @@ jobs: -Dbpf-framework=disabled \ build + - name: Prepare shim integration + run: | + if [ ${{ matrix.shim }} = 1 ]; then + { printf '[Content]\nPackages=shim-signed\nShimBootloader=signed\n'; \ + printf '[Runtime]\nFirmware=uefi-secure-boot\nFirmwareVariables=%%O/ovmf_vars_shim.fd\n'; } \ + >>mkosi/mkosi.local.conf + + sudo mkdir -p build/mkosi.output/ + sudo mkosi -f box -- \ + virt-fw-vars \ + --secure-boot \ + --enroll-cert mkosi/mkosi.crt \ + --add-mok 605dab50-e046-4300-abb6-3dd810dd8b23 mkosi/mkosi.crt \ + --input /usr/share/OVMF/OVMF_VARS_4M.fd \ + --output build/mkosi.output/ovmf_vars_shim.fd + fi + - name: Build image run: sudo mkosi box -- meson compile -C build mkosi