From 4480b28a9aaa6d88e6e90a0cfd6a0c5a460d369c Mon Sep 17 00:00:00 2001 From: Brian Fjeldstad Date: Mon, 26 Oct 2026 16:06:49 +0000 Subject: [PATCH] tests: add VM verity scenarios Add GRUB verity, Azure verity, root-verity, and usr-verity VM base/update layouts. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6501a6e2-9ece-44f9-a91a-4d8e0c0e6d07 --- .../trident-vm-testimage/README.md | 4 + .../by-arch+scenario/arm64+grub-verity.yaml | 3 + .../grub-verity+grub-verity-azure.yaml | 6 ++ .../by-scenario/grub-verity-azure-base.yaml | 33 ++++++++ .../by-scenario/grub-verity-azure.yaml | 24 ++++++ ...ub-verity-base+grub-verity-azure-base.yaml | 6 ++ .../by-scenario/grub-verity-base.yaml | 6 ++ .../by-scenario/grub-verity.yaml | 8 ++ .../by-scenario/root-verity+usr-verity.yaml | 8 ++ .../by-scenario/root-verity.yaml | 29 +++++++ .../by-scenario/usr-verity.yaml | 19 +++++ .../trident-vm-testimage/image.yaml | 4 +- .../include/grub-verity-base-os-common.yaml | 53 +++++++++++++ .../include/grub-verity-base-scripts.yaml | 7 ++ .../include/grub-verity-os-common.yaml | 59 ++++++++++++++ .../include/grub-verity-scripts.yaml | 4 + .../storage-grub-verity-azure-base.yaml | 70 +++++++++++++++++ .../include/storage-grub-verity-azure.yaml | 57 ++++++++++++++ .../include/storage-grub-verity-base.yaml | 69 ++++++++++++++++ .../include/storage-grub-verity.yaml | 54 +++++++++++++ .../include/storage-root-verity.yaml | 78 +++++++++++++++++++ .../include/storage-usr-verity.yaml | 77 ++++++++++++++++++ .../include/uki-verity-os-common.yaml | 41 ++++++++++ .../include/uki-verity-scripts.yaml | 6 ++ 24 files changed, 723 insertions(+), 2 deletions(-) create mode 100644 tests/tailor-images/trident-vm-testimage/by-arch+scenario/arm64+grub-verity.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity+grub-verity-azure.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity-azure-base.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity-azure.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity-base+grub-verity-azure-base.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity-base.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/by-scenario/root-verity+usr-verity.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/by-scenario/root-verity.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/by-scenario/usr-verity.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/include/grub-verity-base-os-common.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/include/grub-verity-base-scripts.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/include/grub-verity-os-common.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/include/grub-verity-scripts.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/include/storage-grub-verity-azure-base.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/include/storage-grub-verity-azure.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/include/storage-grub-verity-base.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/include/storage-grub-verity.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/include/storage-root-verity.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/include/storage-usr-verity.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/include/uki-verity-os-common.yaml create mode 100644 tests/tailor-images/trident-vm-testimage/include/uki-verity-scripts.yaml diff --git a/tests/tailor-images/trident-vm-testimage/README.md b/tests/tailor-images/trident-vm-testimage/README.md index 87586b80d..62305dd36 100644 --- a/tests/tailor-images/trident-vm-testimage/README.md +++ b/tests/tailor-images/trident-vm-testimage/README.md @@ -9,6 +9,7 @@ setup the disk layout for A/B update. Available images: - regular +- with verity ## Additional Prerequisites @@ -23,9 +24,12 @@ To build the base image, run: | Image type | Make command | Output path | | ---------- | ------------ | ----------- | | Regular | `make artifacts/trident-vm-grub-testimage.qcow2` | `artifacts/trident-vm-grub-testimage.qcow2` | +| With verity `qcow2` | `make artifacts/trident-vm-grub-verity-testimage.qcow2` | `artifacts/trident-vm-grub-verity-testimage.qcow2` | +| With verity fixed size `vhd` | `make artifacts/trident-vm-grub-verity-azure-testimage.vhd` | `artifacts/trident-vm-grub-verity-azure-testimage.vhd` | To build the update images, run: | Image type | Make command | Output path | | ---------- | ------------ | ----------- | | Regular | `make artifacts/trident-vm-grub-testimage.cosi` | `artifacts/trident-vm-grub-testimage.cosi` | +| With verity | `make artifacts/trident-vm-grub-verity-testimage.cosi` | `artifacts/trident-vm-grub-verity-testimage.cosi` | diff --git a/tests/tailor-images/trident-vm-testimage/by-arch+scenario/arm64+grub-verity.yaml b/tests/tailor-images/trident-vm-testimage/by-arch+scenario/arm64+grub-verity.yaml new file mode 100644 index 000000000..59e00d589 --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/by-arch+scenario/arm64+grub-verity.yaml @@ -0,0 +1,3 @@ +outputs: + $replace: + - format: cosi diff --git a/tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity+grub-verity-azure.yaml b/tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity+grub-verity-azure.yaml new file mode 100644 index 000000000..ad0608c84 --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity+grub-verity-azure.yaml @@ -0,0 +1,6 @@ +config: + os: + $include: ./include/grub-verity-os-common.yaml + scripts: + postCustomization: + - $include: ./include/grub-verity-scripts.yaml diff --git a/tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity-azure-base.yaml b/tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity-azure-base.yaml new file mode 100644 index 000000000..669be0365 --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity-azure-base.yaml @@ -0,0 +1,33 @@ +# Base (vhd-fixed) counterpart to grub-verity-azure.yaml. The VHD is the +# initial-deploy image and needs the dual-slot A/B partition layout (like +# grub-verity-base.yaml), unlike the cosi update target which only ever +# lands on a single slot. Shared os/scripts content comes from +# grub-verity-base+grub-verity-azure-base.yaml; this file only layers the +# azure-specific overrides on top. Storage uses the Azure-specific legacy +# layout (15G disk cap, 16M ESP, growable /srv), not the generic QEMU +# grub-verity-base sizing -- see storage-grub-verity-azure-base.yaml. +outputs: + $replace: + - format: vhd-fixed +base: + $set: + ref: core_selinux +config: + storage: + $include: ./include/storage-grub-verity-azure-base.yaml + os: + selinux: + mode: + $set: permissive + packages: + install: + $remove: + - netplan + $append: + - selinux-policy + - WALinuxAgent + users: + $replace: + - name: testuser + secondaryGroups: + - wheel diff --git a/tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity-azure.yaml b/tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity-azure.yaml new file mode 100644 index 000000000..9e572bc9d --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity-azure.yaml @@ -0,0 +1,24 @@ +outputs: + $replace: + - format: cosi +base: + $set: + ref: core_selinux +config: + storage: + $include: ./include/storage-grub-verity-azure.yaml + os: + hostname: trident-vm-testimg + selinux: + mode: + $set: permissive + packages: + install: + $append: + - selinux-policy + - WALinuxAgent + users: + $replace: + - name: testuser + secondaryGroups: + - wheel diff --git a/tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity-base+grub-verity-azure-base.yaml b/tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity-base+grub-verity-azure-base.yaml new file mode 100644 index 000000000..a5d3f9648 --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity-base+grub-verity-azure-base.yaml @@ -0,0 +1,6 @@ +config: + os: + $include: ./include/grub-verity-base-os-common.yaml + scripts: + postCustomization: + - $include: ./include/grub-verity-base-scripts.yaml diff --git a/tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity-base.yaml b/tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity-base.yaml new file mode 100644 index 000000000..c81b5fdd7 --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity-base.yaml @@ -0,0 +1,6 @@ +outputs: + $replace: + - format: qcow2 +config: + storage: + $include: ./include/storage-grub-verity-base.yaml diff --git a/tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity.yaml b/tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity.yaml new file mode 100644 index 000000000..03400b853 --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/by-scenario/grub-verity.yaml @@ -0,0 +1,8 @@ +outputs: + $replace: + - format: cosi +config: + storage: + $include: ./include/storage-grub-verity.yaml + os: + hostname: trident-vm-verity-testimg diff --git a/tests/tailor-images/trident-vm-testimage/by-scenario/root-verity+usr-verity.yaml b/tests/tailor-images/trident-vm-testimage/by-scenario/root-verity+usr-verity.yaml new file mode 100644 index 000000000..ac986e4ae --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/by-scenario/root-verity+usr-verity.yaml @@ -0,0 +1,8 @@ +config: + os: + $include: ./include/uki-verity-os-common.yaml + scripts: + postCustomization: + - $include: ./include/uki-verity-scripts.yaml + previewFeatures: + - uki diff --git a/tests/tailor-images/trident-vm-testimage/by-scenario/root-verity.yaml b/tests/tailor-images/trident-vm-testimage/by-scenario/root-verity.yaml new file mode 100644 index 000000000..153202d9c --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/by-scenario/root-verity.yaml @@ -0,0 +1,29 @@ +outputs: + $replace: + - format: cosi + - format: qcow2 + +config: + storage: + $include: ./include/storage-root-verity.yaml + os: + hostname: trident-vm-root-verity-testimg + additionalFiles: + - source: base/files/99-dhcp-eth0.network + destination: /etc/systemd/network/99-dhcp-eth0.network + - source: ../common/files/sudoers-wheel + destination: /etc/sudoers.d/wheel + overlays: + - mountPoint: /etc + lowerDirs: + - /etc + upperDir: /var/lib/overlays/etc/upper + workDir: /var/lib/overlays/etc/work + mountDependencies: + - /var + isInitrdOverlay: true + services: + enable: + - kdump + - trident + - tridentd.socket diff --git a/tests/tailor-images/trident-vm-testimage/by-scenario/usr-verity.yaml b/tests/tailor-images/trident-vm-testimage/by-scenario/usr-verity.yaml new file mode 100644 index 000000000..c631ce489 --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/by-scenario/usr-verity.yaml @@ -0,0 +1,19 @@ +outputs: + $replace: + - format: cosi + - format: qcow2 +config: + storage: + $include: ./include/storage-usr-verity.yaml + os: + hostname: trident-vm-usr-verity-testimg + additionalFiles: + - source: base/files/99-dhcp-eth0.network + destination: /etc/systemd/network/99-dhcp-eth0.network + - source: ../common/files/sudoers-wheel + destination: /etc/sudoers.d/wheel + services: + enable: + - kdump + - trident + - tridentd.socket diff --git a/tests/tailor-images/trident-vm-testimage/image.yaml b/tests/tailor-images/trident-vm-testimage/image.yaml index c04f38ec5..47d0a4add 100644 --- a/tests/tailor-images/trident-vm-testimage/image.yaml +++ b/tests/tailor-images/trident-vm-testimage/image.yaml @@ -2,11 +2,11 @@ name: trident-vm-testimage matrix: arch: [amd64, arm64] - scenario: [grub, grub-base] + scenario: [grub, grub-base, grub-verity, grub-verity-base, root-verity, usr-verity, grub-verity-azure, grub-verity-azure-base] selectors: exclude: - - { arch: arm64, scenario: [grub-base] } + - { arch: arm64, scenario: [grub-base, grub-verity-base, root-verity, usr-verity, grub-verity-azure, grub-verity-azure-base] } base: ref: qemu_guest diff --git a/tests/tailor-images/trident-vm-testimage/include/grub-verity-base-os-common.yaml b/tests/tailor-images/trident-vm-testimage/include/grub-verity-base-os-common.yaml new file mode 100644 index 000000000..7aceedaad --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/include/grub-verity-base-os-common.yaml @@ -0,0 +1,53 @@ +bootloader: + resetType: hard-reset +hostname: trident-vm-verity-testimg +selinux: + mode: disabled +kernelCommandLine: + extraCommandLine: + - console=tty0 + - console=tty1 + - console=ttyS0 + - rd.debug + - loglevel=6 + - log_buf_len=1M + - systemd.journald.forward_to_console=1 +packages: + install: + - device-mapper + - dnf + - efibootmgr + - grub2-efi-binary + - iproute + - iptables + - jq + - kexec-tools + - lvm2 + - openssh-server + - systemd-udev + - trident + - veritysetup + - vim + - netplan +additionalFiles: + - source: base/files/etc-mount-mic.service + destination: /etc/systemd/system/etc-mount.service + - source: base/files/etc-mount.sh + destination: /usr/local/bin/etc-mount.sh + - source: base/files/sshd-keygen.service + destination: /usr/lib/systemd/system/sshd-keygen.service + - source: base/files/99-dhcp-eth0.network + destination: /etc/systemd/network/99-dhcp-eth0.network + - source: ../common/files/sudoers-wheel + destination: /etc/sudoers.d/wheel +services: + enable: + - etc-mount + - kdump + - tridentd.socket +users: + - name: testuser + sshPublicKeyPaths: + - base/files/id_rsa.pub + secondaryGroups: + - wheel diff --git a/tests/tailor-images/trident-vm-testimage/include/grub-verity-base-scripts.yaml b/tests/tailor-images/trident-vm-testimage/include/grub-verity-base-scripts.yaml new file mode 100644 index 000000000..d43975b09 --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/include/grub-verity-base-scripts.yaml @@ -0,0 +1,7 @@ +- path: base/scripts/post-install.sh +- path: base/scripts/create-rw-overlay-dirs.sh +- path: base/scripts/update-host-status.sh +- path: base/scripts/prepare-update-config-verity.sh +- path: base/scripts/ssh-move-host-keys.sh +- path: base/scripts/create-ssh-dirs.sh +- path: base/scripts/duid-type-to-link-layer.sh diff --git a/tests/tailor-images/trident-vm-testimage/include/grub-verity-os-common.yaml b/tests/tailor-images/trident-vm-testimage/include/grub-verity-os-common.yaml new file mode 100644 index 000000000..93bf5ba13 --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/include/grub-verity-os-common.yaml @@ -0,0 +1,59 @@ +bootloader: + resetType: hard-reset +selinux: + mode: disabled +kernelCommandLine: + extraCommandLine: + - console=tty0 + - console=tty1 + - console=ttyS0 + - rd.debug + - loglevel=6 + - log_buf_len=1M + - systemd.journald.forward_to_console=1 +packages: + install: + - curl + - device-mapper + - dnf + - dracut-overlayfs + - efibootmgr + - grub2-efi-binary-noprefix + - iproute + - iptables + - jq + - kexec-tools + - lsof + - lvm2 + - netplan + - openssh-server + - systemd-udev + - trident-service + - veritysetup + - vim + - netplan + remove: + - grub2-efi-binary +additionalFiles: + - source: base/files/etc-mount.service + destination: /etc/systemd/system/etc-mount.service + - source: base/files/etc-mount.sh + destination: /usr/local/bin/etc-mount.sh + - source: ../common/files/sudoers-wheel + destination: /etc/sudoers.d/wheel + - source: base/files/99-dhcp-eth0.network + destination: /etc/systemd/network/99-dhcp-eth0.network + - source: ../common/files/use-grpc-client-commit.conf + destination: /etc/systemd/system/trident.service.d/override.conf +services: + enable: + - etc-mount + - kdump + - trident + - tridentd.socket +users: + - name: testuser + sshPublicKeyPaths: + - base/files/id_rsa.pub + secondaryGroups: + - wheel diff --git a/tests/tailor-images/trident-vm-testimage/include/grub-verity-scripts.yaml b/tests/tailor-images/trident-vm-testimage/include/grub-verity-scripts.yaml new file mode 100644 index 000000000..db0dca3e4 --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/include/grub-verity-scripts.yaml @@ -0,0 +1,4 @@ +- path: base/scripts/post-install.sh +- path: base/scripts/ssh-move-host-keys.sh +- path: base/scripts/update-os-release.sh +- path: base/scripts/duid-type-to-link-layer.sh diff --git a/tests/tailor-images/trident-vm-testimage/include/storage-grub-verity-azure-base.yaml b/tests/tailor-images/trident-vm-testimage/include/storage-grub-verity-azure-base.yaml new file mode 100644 index 000000000..a5b0e7e57 --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/include/storage-grub-verity-azure-base.yaml @@ -0,0 +1,70 @@ +bootType: efi +disks: + - partitionTableType: gpt + maxSize: 15G + partitions: + - id: esp + type: esp + size: 16M + - id: boot-a + size: 256M + - id: boot-b + size: 256M + - id: root-a + size: 4G + - id: root-b + size: 4G + - id: root-hash-a + size: 128M + - id: root-hash-b + size: 128M + - id: var-a + size: 1G + - id: var-b + size: 1G + - id: trident-overlay-a + size: 32M + - id: trident-overlay-b + size: 32M + - id: trident + size: 512M + - id: home + size: 1G + - id: srv + size: grow +verity: + - id: rootverity + name: root + dataDeviceId: root-a + hashDeviceId: root-hash-a + dataDeviceMountIdType: uuid + hashDeviceMountIdType: uuid +filesystems: + - deviceId: esp + type: fat32 + mountPoint: + path: /boot/efi + options: umask=0077 + - deviceId: boot-a + type: ext4 + mountPoint: /boot + - deviceId: rootverity + type: ext4 + mountPoint: + path: / + options: defaults,ro + - deviceId: var-a + type: ext4 + mountPoint: /var + - deviceId: trident-overlay-a + type: ext4 + mountPoint: /var/lib/trident-overlay + - deviceId: trident + type: ext4 + mountPoint: /var/lib/trident + - deviceId: home + type: ext4 + mountPoint: /home + - deviceId: srv + type: ext4 + mountPoint: /srv diff --git a/tests/tailor-images/trident-vm-testimage/include/storage-grub-verity-azure.yaml b/tests/tailor-images/trident-vm-testimage/include/storage-grub-verity-azure.yaml new file mode 100644 index 000000000..d5ea89924 --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/include/storage-grub-verity-azure.yaml @@ -0,0 +1,57 @@ +bootType: efi +disks: + - partitionTableType: gpt + # Azure's fixed update-image layout needs a bounded disk size (unlike the generic grub-verity + # scenario, which has none) -- matches the legacy image's `updateimg-grub-verity-azure.yaml`. + maxSize: 7G + partitions: + - id: esp + type: esp + size: 8M + - id: boot + size: 256M + - id: root + size: 4G + - id: root-hash + size: 128M + - id: var + size: 1G + - id: trident-overlay + size: 32M + - id: srv + size: 1G + - id: home + size: 32M +verity: + - id: rootverity + name: root + dataDeviceId: root + hashDeviceId: root-hash + dataDeviceMountIdType: uuid + hashDeviceMountIdType: uuid +filesystems: + - deviceId: esp + type: fat32 + mountPoint: + path: /boot/efi + options: umask=0077 + - deviceId: boot + type: ext4 + mountPoint: /boot + - deviceId: rootverity + type: ext4 + mountPoint: + path: / + options: defaults,ro + - deviceId: var + type: ext4 + mountPoint: /var + - deviceId: trident-overlay + type: ext4 + mountPoint: /var/lib/trident-overlay + - deviceId: srv + type: ext4 + mountPoint: /srv + - deviceId: home + type: ext4 + mountPoint: /home diff --git a/tests/tailor-images/trident-vm-testimage/include/storage-grub-verity-base.yaml b/tests/tailor-images/trident-vm-testimage/include/storage-grub-verity-base.yaml new file mode 100644 index 000000000..28bcd41bb --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/include/storage-grub-verity-base.yaml @@ -0,0 +1,69 @@ +bootType: efi +disks: + - partitionTableType: gpt + partitions: + - id: esp + type: esp + size: 512M + - id: boot-a + size: 256M + - id: boot-b + size: 256M + - id: root-a + size: 4G + - id: root-b + size: 4G + - id: root-hash-a + size: 128M + - id: root-hash-b + size: 128M + - id: var-a + size: 1G + - id: var-b + size: 1G + - id: trident-overlay-a + size: 32M + - id: trident-overlay-b + size: 32M + - id: trident + size: 512M + - id: home + size: 1G + - id: srv + size: 128M +verity: + - id: rootverity + name: root + dataDeviceId: root-a + hashDeviceId: root-hash-a + dataDeviceMountIdType: uuid + hashDeviceMountIdType: uuid +filesystems: + - deviceId: esp + type: fat32 + mountPoint: + path: /boot/efi + options: umask=0077 + - deviceId: boot-a + type: ext4 + mountPoint: /boot + - deviceId: rootverity + type: ext4 + mountPoint: + path: / + options: defaults,ro + - deviceId: var-a + type: ext4 + mountPoint: /var + - deviceId: trident-overlay-a + type: ext4 + mountPoint: /var/lib/trident-overlay + - deviceId: trident + type: ext4 + mountPoint: /var/lib/trident + - deviceId: home + type: ext4 + mountPoint: /home + - deviceId: srv + type: ext4 + mountPoint: /srv diff --git a/tests/tailor-images/trident-vm-testimage/include/storage-grub-verity.yaml b/tests/tailor-images/trident-vm-testimage/include/storage-grub-verity.yaml new file mode 100644 index 000000000..fbe1d145e --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/include/storage-grub-verity.yaml @@ -0,0 +1,54 @@ +bootType: efi +disks: + - partitionTableType: gpt + partitions: + - id: esp + type: esp + size: 8M + - id: boot + size: 256M + - id: root + size: 4G + - id: root-hash + size: 128M + - id: var + size: 1G + - id: trident-overlay + size: 32M + - id: srv + size: 1G + - id: home + size: 32M +verity: + - id: rootverity + name: root + dataDeviceId: root + hashDeviceId: root-hash + dataDeviceMountIdType: uuid + hashDeviceMountIdType: uuid +filesystems: + - deviceId: esp + type: fat32 + mountPoint: + path: /boot/efi + options: umask=0077 + - deviceId: boot + type: ext4 + mountPoint: /boot + - deviceId: rootverity + type: ext4 + mountPoint: + path: / + options: defaults,ro + - deviceId: var + type: ext4 + mountPoint: /var + - deviceId: trident-overlay + type: ext4 + mountPoint: /var/lib/trident-overlay + - deviceId: srv + type: ext4 + mountPoint: /srv + - deviceId: home + type: ext4 + mountPoint: /home diff --git a/tests/tailor-images/trident-vm-testimage/include/storage-root-verity.yaml b/tests/tailor-images/trident-vm-testimage/include/storage-root-verity.yaml new file mode 100644 index 000000000..e5e3cbd74 --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/include/storage-root-verity.yaml @@ -0,0 +1,78 @@ +bootType: efi +disks: + - partitionTableType: gpt + partitions: + - id: esp + type: esp + label: esp + size: 512M + - id: boot-a + size: 256M + - id: boot-b + size: 256M + - id: root-a + size: 4G + - id: root-b + size: 4G + - id: root-hash-a + size: 128M + - id: root-hash-b + size: 128M + - id: var-a + size: 1G + - id: var-b + size: 1G + - id: trident + label: trident + size: 512M + - id: home + label: home + size: 1G + - id: srv + label: srv + size: 128M +verity: + - id: rootverity + name: root + dataDeviceId: root-a + hashDeviceId: root-hash-a + dataDeviceMountIdType: uuid + hashDeviceMountIdType: uuid +filesystems: + - deviceId: esp + type: fat32 + mountPoint: + idType: part-label + path: /boot/efi + options: umask=0077 + - deviceId: boot-a + type: ext4 + mountPoint: + idType: uuid + path: /boot + - deviceId: rootverity + type: ext4 + mountPoint: + path: / + options: defaults,ro + - deviceId: var-a + type: ext4 + mountPoint: + idType: uuid + path: /var + options: defaults,x-initrd.mount + - deviceId: trident + type: ext4 + mountPoint: + idType: part-label + path: /var/lib/trident + - deviceId: home + type: ext4 + mountPoint: + idType: part-label + path: /home + - deviceId: srv + type: ext4 + mountPoint: + idType: part-label + path: /srv diff --git a/tests/tailor-images/trident-vm-testimage/include/storage-usr-verity.yaml b/tests/tailor-images/trident-vm-testimage/include/storage-usr-verity.yaml new file mode 100644 index 000000000..a380c8eb5 --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/include/storage-usr-verity.yaml @@ -0,0 +1,77 @@ +bootType: efi +disks: + - partitionTableType: gpt + partitions: + - id: esp + type: esp + label: esp + size: 512M + - id: boot-a + size: 256M + - id: boot-b + size: 256M + - id: root-a + size: 4G + - id: root-b + size: 4G + - id: usr-a + size: 1G + - id: usr-b + size: 1G + - id: usr-hash-a + size: 128M + - id: usr-hash-b + size: 128M + - id: trident + label: trident + size: 512M + - id: home + label: home + size: 1G + - id: srv + label: srv + size: 128M +verity: + - id: usrverity + name: usr + dataDeviceId: usr-a + hashDeviceId: usr-hash-a + dataDeviceMountIdType: uuid + hashDeviceMountIdType: uuid +filesystems: + - deviceId: esp + type: fat32 + mountPoint: + idType: part-label + path: /boot/efi + options: umask=0077 + - deviceId: boot-a + type: ext4 + mountPoint: + idType: uuid + path: /boot + - deviceId: usrverity + type: ext4 + mountPoint: + path: /usr + options: defaults,ro + - deviceId: root-a + type: ext4 + mountPoint: + idType: uuid + path: / + - deviceId: trident + type: ext4 + mountPoint: + idType: part-label + path: /var/lib/trident + - deviceId: home + type: ext4 + mountPoint: + idType: part-label + path: /home + - deviceId: srv + type: ext4 + mountPoint: + idType: part-label + path: /srv diff --git a/tests/tailor-images/trident-vm-testimage/include/uki-verity-os-common.yaml b/tests/tailor-images/trident-vm-testimage/include/uki-verity-os-common.yaml new file mode 100644 index 000000000..6f277178b --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/include/uki-verity-os-common.yaml @@ -0,0 +1,41 @@ +bootloader: + resetType: hard-reset +selinux: + mode: disabled +uki: + mode: create +kernelCommandLine: + extraCommandLine: + - console=tty0 + - console=tty1 + - console=ttyS0 + - rd.debug + - loglevel=6 + - log_buf_len=1M + - systemd.journald.forward_to_console=1 + - rd.hostonly=0 +packages: + install: + - device-mapper + - dnf + - efibootmgr + - iproute + - iptables + - jq + - kexec-tools + - lvm2 + - openssh-server + - systemd-boot + - systemd-udev + - trident-service + - veritysetup + - vim + - netplan + remove: + - grub2-efi-binary +users: + - name: testuser + sshPublicKeyPaths: + - base/files/id_rsa.pub + secondaryGroups: + - wheel diff --git a/tests/tailor-images/trident-vm-testimage/include/uki-verity-scripts.yaml b/tests/tailor-images/trident-vm-testimage/include/uki-verity-scripts.yaml new file mode 100644 index 000000000..89bf812cc --- /dev/null +++ b/tests/tailor-images/trident-vm-testimage/include/uki-verity-scripts.yaml @@ -0,0 +1,6 @@ +- path: base/scripts/post-install.sh +- path: base/scripts/update-host-status.sh +- path: base/scripts/prepare-update-config-verity.sh + arguments: + - uki +- path: base/scripts/duid-type-to-link-layer.sh