From f40801215bba9d02539c5ad9615a7ad98e5632f7 Mon Sep 17 00:00:00 2001 From: JumpyVi Date: Fri, 9 Oct 2026 21:00:02 -0400 Subject: [PATCH 1/5] Allow setting mkosi key from github secrets --- .github/workflows/build-release.yml | 14 +++++-- Justfile | 57 +++++++++++++++++++++-------- 2 files changed, 51 insertions(+), 20 deletions(-) diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index b5542ca4b..d62f0ddf1 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -62,12 +62,18 @@ jobs: run: | echo "ARCH=$(just _get_arch)" >> "$GITHUB_ENV" - - name: Generate key - run: just genkey + # Private key used for verity check and secureboot + - name: Inject mkosi private key + run: | + echo ${{ secrets.MKOSI_PRIVATE_KEY }} > mkosi.key + chmod 600 mkosi.key - name: Build with mkosi - # Will either run do-daily or do-stable - run: just do-${{ inputs.stream }} + # Will either run do-daily, do-stable or do-proposed, + # then shred the key to make sure it's never accidently uploaded + run: | + just do-${{ inputs.stream }} + shred mkosi.key --remove -s 1k - name: Generate SHA256SUMS (all partitions) run: just checksum-repo diff --git a/Justfile b/Justfile index 189ddef85..5e661d108 100644 --- a/Justfile +++ b/Justfile @@ -1,16 +1,6 @@ -default: - #!/usr/bin/env bash - set -xeuo pipefail +default: just --choose -_do-release stream: - #!/usr/bin/env bash - sudo rm -rf mkosi.output/ && \ - just mkosi -B --debug --profile={{stream}} --force --workspace-directory=/workspace && \ - sudo PROFILE={{stream}} SQUASHFS_LEVEL="${SQUASHFS_LEVEL:-}" ./assemble-iso.sh - sudo just compress-repo - sudo chown -R "$(id -u):$(id -g)" mkosi.output - sudo chmod -R u+rwX mkosi.output # Built every day from the main branch do-daily: (_do-release "daily") @@ -21,21 +11,57 @@ do-stable: (_do-release "stable") # Built from PRs do-proposed: (_do-release "proposed") +_do-release stream: + #!/usr/bin/env bash + sudo rm -rf mkosi.output/ && \ + just mkosi -B --debug --profile={{stream}} --force --workspace-directory=/workspace && \ + sudo PROFILE={{stream}} SQUASHFS_LEVEL="${SQUASHFS_LEVEL:-}" ./assemble-iso.sh + sudo just compress-repo + sudo chown -R "$(id -u):$(id -g)" mkosi.output + sudo chmod -R u+rwX mkosi.output + +# Get arch directly from systemd, to get the same format as mkosi _get_arch: @systemd-analyze architectures | awk '/native/ {print $1}' +# Get current mkosi.version value _get_timestamp: #!/usr/bin/env bash set -euo pipefail echo "$(cat ./mkosi.version)" -genkey: - just mkosi genkey + +# > Name: Owner of the key +# > Days: Days before the key expires +# Generate a new key if there is no existing ones +genkey name=`whoami` days="7": + #!/usr/bin/env bash + set -euo pipefail + if [ ! -f "./mkosi.key" ]; then + rm -f ./mkosi.crt + echo "Generating a new cert for {{name}}, valid for the next {{days}} days..." + just _podman_mkosi genkey --genkey-common-name="{{name}}" --genkey-valid-days="{{days}}" + echo "Done!" + fi + echo "Certificate OK" + +# > Name: Owner of the key +# > Days: Days before the key expires +# Delete old key and generate a new one +regenkey name=`whoami` days="7": + rm -f mkosi.{crt,key} + echo "Old keys removed" + just genkey "{{name}}" "{{days}}" + mkosi +subcommand: + #!/usr/bin/env bash + just genkey + just _podman_mkosi {{subcommand}} + +_podman_mkosi +args: mkdir -p {{env_var('HOME')}}/.cache/mkosi-workspace sudo mkdir -p ~/.cache/mkosi - sudo podman run --rm \ --network host \ --dns 8.8.8.8 \ @@ -47,8 +73,7 @@ mkosi +subcommand: -w /work \ -v "{{env_var('HOME')}}/.cache/mkosi-workspace:/workspace" \ ghcr.io/elementary/mkosi:tanit \ - mkosi {{subcommand}} - + mkosi {{args}} clean: From 65620ccacf877886d4baa800def0d91c6a494bbd Mon Sep 17 00:00:00 2001 From: JumpyVi <62212220+jumpyvi@users.noreply.github.com> Date: Fri, 9 Oct 2026 21:01:14 -0400 Subject: [PATCH 2/5] Add mkosi.crt via upload --- mkosi.crt | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 mkosi.crt diff --git a/mkosi.crt b/mkosi.crt new file mode 100644 index 000000000..0186fab30 --- /dev/null +++ b/mkosi.crt @@ -0,0 +1,18 @@ +-----BEGIN CERTIFICATE----- +MIIC0zCCAbugAwIBAgIUT0O+TbPDE/UaUn/szdYuMaokBdowDQYJKoZIhvcNAQEL +BQAwEjEQMA4GA1UEAwwHanVtcHl2aTAeFw0yNjEwMTAwMDU1MDJaFw0yNjEwMjAw +MDU1MDJaMBIxEDAOBgNVBAMMB2p1bXB5dmkwggEiMA0GCSqGSIb3DQEBAQUAA4IB +DwAwggEKAoIBAQDBhib+dnGeG15Wo+3j9ZQFGmR/eoUwmhfQGTVzQ8zQvY6fksvc +lezJ3YZ2aq57b2bADiHxFOeAJ2qvHbXMVDcn6tBXavWdnJuzPwGs+wdQ9/CFIKA9 +YY5j6xP1/N//BtJ/gK/AJZ7G9Ox3shhWSLaFYu1HiklPVhtdHmf87zn5/pV+vwKs +P9aRE7FgcaCBSWu+V9lItEnZsxjmOBJsHf9mmkYxS8PbSJPkjL7qZ918PAwGt1Ei +a+MiKYK2TrOItYAvR7hS+wLQPfWYJbL0435MisbM1IXztOmbF+JUw9YQcUgZdTOJ +kYxFuyY7ZXs1zi9JzNgNB9hBhvtQqD7vjL3/AgMBAAGjITAfMB0GA1UdDgQWBBS6 +v4+0zpb6677zXuvaSUV/8blErjANBgkqhkiG9w0BAQsFAAOCAQEAUTMBO2gTepbw +iTvutdbFjgJ90OgJ8iheYGKex3FDlghpjGRlHLZnj3E3hO/dT1INhssxMYak3gH9 +nMg7poUcg0xhJxxoF+ogzDBJg9svOz+dDgpgrSOdugLtmAXwRo97rJu2miFHKrQB +hvQaIGbvOkJWKfnL0rehoumkN/rXE8Buhg4DXNVG0HQbtdz+yLR8Nf/WBGjVtCMm +yZr9momDal8fW+8/3utNCU1BoXKPS24ipcujKPoqCfMpw5aw19TS+zTQoL7ivdSG +woqFyoJ5PswtZQGUb3CZw0goYTbg4jNIkaxQiSo+Enu2y3HoCYhTt2WTf6nsSuZf +2nrlHSylxA== +-----END CERTIFICATE----- From 314a8b84c6cffd1625484f3641dd5b00c7f7f489 Mon Sep 17 00:00:00 2001 From: JumpyVi Date: Fri, 9 Oct 2026 21:02:52 -0400 Subject: [PATCH 3/5] Set secureboot to yes --- mkosi.images/sysupdate/mkosi.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mkosi.images/sysupdate/mkosi.conf b/mkosi.images/sysupdate/mkosi.conf index e4faab5f5..9dcb59fbf 100644 --- a/mkosi.images/sysupdate/mkosi.conf +++ b/mkosi.images/sysupdate/mkosi.conf @@ -45,5 +45,5 @@ KernelCommandLine= ipe.enforce=0 [Validation] -SecureBoot=no +SecureBoot=yes SignExpectedPcr=no From 2a91225c6d84c0e1c1334fcf8f8bb6b73e721d8a Mon Sep 17 00:00:00 2001 From: JumpyVi Date: Fri, 9 Oct 2026 21:06:49 -0400 Subject: [PATCH 4/5] Fix IO --- .github/workflows/build-release.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index d62f0ddf1..9707594e2 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -64,8 +64,10 @@ jobs: # Private key used for verity check and secureboot - name: Inject mkosi private key + env: + MKOSI_PRIVATE_KEY: ${{ secrets.MKOSI_PRIVATE_KEY }} run: | - echo ${{ secrets.MKOSI_PRIVATE_KEY }} > mkosi.key + echo "$MKOSI_PRIVATE_KEY" > mkosi.key chmod 600 mkosi.key - name: Build with mkosi From 24551d48a38ba11bee993cc45a755fead6fe1533 Mon Sep 17 00:00:00 2001 From: JumpyVi Date: Fri, 9 Oct 2026 21:10:52 -0400 Subject: [PATCH 5/5] Rename MKOSI_PRIVATE_KEY --- .github/workflows/build-release.yml | 4 ++-- mkosi.images/sysupdate/mkosi.conf | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index 9707594e2..1f5916da9 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -65,9 +65,9 @@ jobs: # Private key used for verity check and secureboot - name: Inject mkosi private key env: - MKOSI_PRIVATE_KEY: ${{ secrets.MKOSI_PRIVATE_KEY }} + MKOSI_SECRET_KEY: ${{ secrets.MKOSI_SECRET_KEY }} run: | - echo "$MKOSI_PRIVATE_KEY" > mkosi.key + echo "$MKOSI_SECRET_KEY" > mkosi.key chmod 600 mkosi.key - name: Build with mkosi diff --git a/mkosi.images/sysupdate/mkosi.conf b/mkosi.images/sysupdate/mkosi.conf index 9dcb59fbf..d5b4ed643 100644 --- a/mkosi.images/sysupdate/mkosi.conf +++ b/mkosi.images/sysupdate/mkosi.conf @@ -46,4 +46,4 @@ KernelCommandLine= [Validation] SecureBoot=yes -SignExpectedPcr=no +SignExpectedPcr=yes