bfjelds (bfjelds) · Oct 26, 2026
@@ -9,6 +9,7 @@ setup the disk layout for A/B update.
 Available images:
 
 - regular
+- with verity
 
 ## Additional Prerequisites
 
@@ -23,9 +24,12 @@ To build the base image, run:
 | Image type | Make command | Output path |
 | ---------- | ------------ | ----------- |
 | Regular | `make artifacts/trident-vm-grub-testimage.qcow2` | `artifacts/trident-vm-grub-testimage.qcow2` |
+| With verity `qcow2` | `make artifacts/trident-vm-grub-verity-testimage.qcow2` | `artifacts/trident-vm-grub-verity-testimage.qcow2` |
+| With verity fixed size `vhd` | `make artifacts/trident-vm-grub-verity-azure-testimage.vhd` | `artifacts/trident-vm-grub-verity-azure-testimage.vhd` |
 
 To build the update images, run:
 
 | Image type | Make command | Output path |
 | ---------- | ------------ | ----------- |
 | Regular | `make artifacts/trident-vm-grub-testimage.cosi` | `artifacts/trident-vm-grub-testimage.cosi` |
+| With verity | `make artifacts/trident-vm-grub-verity-testimage.cosi` | `artifacts/trident-vm-grub-verity-testimage.cosi` |
@@ -0,0 +1,3 @@
+outputs:
+  $replace:
+    - format: cosi
@@ -0,0 +1,6 @@
+config:
+  os:
+    $include: ./include/grub-verity-os-common.yaml
+  scripts:
+    postCustomization:
+      - $include: ./include/grub-verity-scripts.yaml
@@ -0,0 +1,33 @@
+# Base (vhd-fixed) counterpart to grub-verity-azure.yaml. The VHD is the
+# initial-deploy image and needs the dual-slot A/B partition layout (like
+# grub-verity-base.yaml), unlike the cosi update target which only ever
+# lands on a single slot. Shared os/scripts content comes from
+# grub-verity-base+grub-verity-azure-base.yaml; this file only layers the
+# azure-specific overrides on top. Storage uses the Azure-specific legacy
+# layout (15G disk cap, 16M ESP, growable /srv), not the generic QEMU
+# grub-verity-base sizing -- see storage-grub-verity-azure-base.yaml.
+outputs:
+  $replace:
+    - format: vhd-fixed
+base:
+  $set:
+    ref: core_selinux
+config:
+  storage:
+    $include: ./include/storage-grub-verity-azure-base.yaml
+  os:
+    selinux:
+      mode:
+        $set: permissive
+    packages:
+      install:
+        $remove:
+          - netplan
+        $append:
+          - selinux-policy
+          - WALinuxAgent
+    users:
+      $replace:
+        - name: testuser
+          secondaryGroups:
+            - wheel
@@ -0,0 +1,24 @@
+outputs:
+  $replace:
+    - format: cosi
+base:
+  $set:
+    ref: core_selinux
+config:
+  storage:
+    $include: ./include/storage-grub-verity-azure.yaml
+  os:
+    hostname: trident-vm-testimg
+    selinux:
+      mode:
+        $set: permissive
+    packages:
+      install:
+        $append:
+          - selinux-policy
+          - WALinuxAgent
+    users:
+      $replace:
+        - name: testuser
+          secondaryGroups:
+            - wheel
@@ -0,0 +1,6 @@
+config:
+  os:
+    $include: ./include/grub-verity-base-os-common.yaml
+  scripts:
+    postCustomization:
+      - $include: ./include/grub-verity-base-scripts.yaml
@@ -0,0 +1,6 @@
+outputs:
+  $replace:
+    - format: qcow2
+config:
+  storage:
+    $include: ./include/storage-grub-verity-base.yaml
@@ -0,0 +1,8 @@
+outputs:
+  $replace:
+    - format: cosi
+config:
+  storage:
+    $include: ./include/storage-grub-verity.yaml
+  os:
+    hostname: trident-vm-verity-testimg
@@ -0,0 +1,8 @@
+config:
+  os:
+    $include: ./include/uki-verity-os-common.yaml
+  scripts:
+    postCustomization:
+      - $include: ./include/uki-verity-scripts.yaml
+  previewFeatures:
+    - uki
@@ -0,0 +1,29 @@
+outputs:
+  $replace:
+    - format: cosi
+    - format: qcow2
+
+config:
+  storage:
+    $include: ./include/storage-root-verity.yaml
+  os:
+    hostname: trident-vm-root-verity-testimg
+    additionalFiles:
+      - source: base/files/99-dhcp-eth0.network
+        destination: /etc/systemd/network/99-dhcp-eth0.network
+      - source: ../common/files/sudoers-wheel
+        destination: /etc/sudoers.d/wheel
+    overlays:
+      - mountPoint: /etc
+        lowerDirs:
+          - /etc
+        upperDir: /var/lib/overlays/etc/upper
+        workDir: /var/lib/overlays/etc/work
+        mountDependencies:
+          - /var
+        isInitrdOverlay: true
+    services:
+      enable:
+        - kdump
+        - trident
+        - tridentd.socket
@@ -0,0 +1,19 @@
+outputs:
+  $replace:
+    - format: cosi
+    - format: qcow2
+config:
+  storage:
+    $include: ./include/storage-usr-verity.yaml
+  os:
+    hostname: trident-vm-usr-verity-testimg
+    additionalFiles:
+      - source: base/files/99-dhcp-eth0.network
+        destination: /etc/systemd/network/99-dhcp-eth0.network
+      - source: ../common/files/sudoers-wheel
+        destination: /etc/sudoers.d/wheel
+    services:
+      enable:
+        - kdump
+        - trident
+        - tridentd.socket
@@ -2,11 +2,11 @@ name: trident-vm-testimage
 
 matrix:
   arch: [amd64, arm64]
-  scenario: [grub, grub-base]
+  scenario: [grub, grub-base, grub-verity, grub-verity-base, root-verity, usr-verity, grub-verity-azure, grub-verity-azure-base]
 
 selectors:
   exclude:
-    - { arch: arm64, scenario: [grub-base] }
+    - { arch: arm64, scenario: [grub-base, grub-verity-base, root-verity, usr-verity, grub-verity-azure, grub-verity-azure-base] }
 
 base:
   ref: qemu_guest

@@ -0,0 +1,53 @@
+bootloader:
+  resetType: hard-reset
+hostname: trident-vm-verity-testimg
+selinux:
+  mode: disabled
+kernelCommandLine:
+  extraCommandLine:
+    - console=tty0
+    - console=tty1
+    - console=ttyS0
+    - rd.debug
+    - loglevel=6
+    - log_buf_len=1M
+    - systemd.journald.forward_to_console=1
+packages:
+  install:
+    - device-mapper
+    - dnf
+    - efibootmgr
+    - grub2-efi-binary
+    - iproute
+    - iptables
+    - jq
+    - kexec-tools
+    - lvm2
+    - openssh-server
+    - systemd-udev
+    - trident
+    - veritysetup
+    - vim
+    - netplan
+additionalFiles:
+  - source: base/files/etc-mount-mic.service
+    destination: /etc/systemd/system/etc-mount.service
+  - source: base/files/etc-mount.sh
+    destination: /usr/local/bin/etc-mount.sh
+  - source: base/files/sshd-keygen.service
+    destination: /usr/lib/systemd/system/sshd-keygen.service
+  - source: base/files/99-dhcp-eth0.network
+    destination: /etc/systemd/network/99-dhcp-eth0.network
+  - source: ../common/files/sudoers-wheel
+    destination: /etc/sudoers.d/wheel
+services:
+  enable:
+    - etc-mount
+    - kdump
+    - tridentd.socket
+users:
+  - name: testuser
+    sshPublicKeyPaths:
+      - base/files/id_rsa.pub
+    secondaryGroups:
+      - wheel
@@ -0,0 +1,7 @@
+- path: base/scripts/post-install.sh
+- path: base/scripts/create-rw-overlay-dirs.sh
+- path: base/scripts/update-host-status.sh
+- path: base/scripts/prepare-update-config-verity.sh
+- path: base/scripts/ssh-move-host-keys.sh
+- path: base/scripts/create-ssh-dirs.sh
+- path: base/scripts/duid-type-to-link-layer.sh
@@ -0,0 +1,59 @@
+bootloader:
+  resetType: hard-reset
+selinux:
+  mode: disabled
+kernelCommandLine:
+  extraCommandLine:
+    - console=tty0
+    - console=tty1
+    - console=ttyS0
+    - rd.debug
+    - loglevel=6
+    - log_buf_len=1M
+    - systemd.journald.forward_to_console=1
+packages:
+  install:
+    - curl
+    - device-mapper
+    - dnf
+    - dracut-overlayfs
+    - efibootmgr
+    - grub2-efi-binary-noprefix
+    - iproute
+    - iptables
+    - jq
+    - kexec-tools
+    - lsof
+    - lvm2
+    - netplan
+    - openssh-server
+    - systemd-udev
+    - trident-service
+    - veritysetup
+    - vim
+    - netplan
+  remove:
+    - grub2-efi-binary
+additionalFiles:
+  - source: base/files/etc-mount.service
+    destination: /etc/systemd/system/etc-mount.service
+  - source: base/files/etc-mount.sh
+    destination: /usr/local/bin/etc-mount.sh
+  - source: ../common/files/sudoers-wheel
+    destination: /etc/sudoers.d/wheel
+  - source: base/files/99-dhcp-eth0.network
+    destination: /etc/systemd/network/99-dhcp-eth0.network
+  - source: ../common/files/use-grpc-client-commit.conf
+    destination: /etc/systemd/system/trident.service.d/override.conf
+services:
+  enable:
+    - etc-mount
+    - kdump
+    - trident
+    - tridentd.socket
+users:
+  - name: testuser
+    sshPublicKeyPaths:
+      - base/files/id_rsa.pub
+    secondaryGroups:
+      - wheel
@@ -0,0 +1,4 @@
+- path: base/scripts/post-install.sh
+- path: base/scripts/ssh-move-host-keys.sh
+- path: base/scripts/update-os-release.sh
+- path: base/scripts/duid-type-to-link-layer.sh
@@ -0,0 +1,70 @@
+bootType: efi
+disks:
+  - partitionTableType: gpt
+    maxSize: 15G
+    partitions:
+      - id: esp
+        type: esp
+        size: 16M
+      - id: boot-a
+        size: 256M
+      - id: boot-b
+        size: 256M
+      - id: root-a
+        size: 4G
+      - id: root-b
+        size: 4G
+      - id: root-hash-a
+        size: 128M
+      - id: root-hash-b
+        size: 128M
+      - id: var-a
+        size: 1G
+      - id: var-b
+        size: 1G
+      - id: trident-overlay-a
+        size: 32M
+      - id: trident-overlay-b
+        size: 32M
+      - id: trident
+        size: 512M
+      - id: home
+        size: 1G
+      - id: srv
+        size: grow
+verity:
+  - id: rootverity
+    name: root
+    dataDeviceId: root-a
+    hashDeviceId: root-hash-a
+    dataDeviceMountIdType: uuid
+    hashDeviceMountIdType: uuid
+filesystems:
+  - deviceId: esp
+    type: fat32
+    mountPoint:
+      path: /boot/efi
+      options: umask=0077
+  - deviceId: boot-a
+    type: ext4
+    mountPoint: /boot
+  - deviceId: rootverity
+    type: ext4
+    mountPoint:
+      path: /
+      options: defaults,ro
+  - deviceId: var-a
+    type: ext4
+    mountPoint: /var
+  - deviceId: trident-overlay-a
+    type: ext4
+    mountPoint: /var/lib/trident-overlay
+  - deviceId: trident
+    type: ext4
+    mountPoint: /var/lib/trident
+  - deviceId: home
+    type: ext4
+    mountPoint: /home
+  - deviceId: srv
+    type: ext4
+    mountPoint: /srv