morgan
/
isogenerator
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat: Allow users to override secure boot key and password (#40) 

* feat: Allow users to override secure boot key and password when using container or action

* fix: follow redirects

* chore: update docs

* fix: added comments and removed additional \n

* fix: removed defaults

* fix: added conditional for adding public key

* chore(ci): Added additional test for secure boot

* chore(ci): fixed up workflows to match production

* fix(ci): added workflow dispatch to test

* fix(ci): fixed version and added IMAGE_TAG

* chore(ci): changed to bluefin to test both 38 and 39 secure boot

* chore(ci): added required variables to entrypoint

* chore(ci): added merge_group and added paths-ignore

* chore(ci): updated description

* chore(ci): set to Silverblue since we are testing Bluefin

* chore(ci): Fixed secure boot key not found error

Received error in anaconda when check was hit, need to set as a soft failure to exit the script early without stopping anaconda installation.

* chore: fixed formatting

* chore: fixed whitespace

* chore(ci): Removed duplicate test

* chore: fix whitespace

* chore(ci): fixed test and removed upload to Github Artifacts

* chore: updated README

* fix: set password to ublue default

* fix: changed enrollment password in containerfile
This commit is contained in:
Noel Miller 2024-02-27 18:06:38 -06:00 committed by GitHub
parent 3401b10c56
commit f70e8ea027
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
10 changed files with 99 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
.github/workflows/build-container-image.yml vendored
View File

@ -1,9 +1,14 @@
---
name: Build Container Image
on:
merge_group:
pull_request:
branches:
- main
paths-ignore:
- '*.md'
- 'LICENSE'
- 'CODEOWNERS'
push:
branches:
- main

32
.github/workflows/test-iso.yml vendored
View File

@ -10,6 +10,7 @@ on:
- '*.md'
- 'LICENSE'
- 'CODEOWNERS'
workflow_dispatch:
jobs:
build-and-push-iso:
@ -18,15 +19,30 @@ jobs:
container:
image: fedora:39
options: "--privileged"
volumes:
- "/:/host"
permissions:
contents: read
packages: write
strategy:
fail-fast: false
matrix:
version:
version:
- 38
- 39
secure_boot:
- true
- false
include:
- secure_boot: true
SECURE_BOOT_KEY_URL: 'https://github.com/ublue-os/akmods/raw/main/certs/public_key.der'
ENROLLMENT_PASSWORD: 'ublue-os'
SECURE_BOOT_STRING: '-secure'
- secure_boot: false
SECURE_BOOT_KEY_URL: ''
ENROLLMENT_PASSWORD: ''
SECURE_BOOT_STRING: ''
steps:
- name: Checkout
uses: actions/checkout@v4
@ -41,6 +57,18 @@ jobs:
VERSION: ${{ matrix.version }}
ACTION_REPO: ${{ github.repository }}
ACTION_REF: ${{ github.ref }}
SECURE_BOOT_KEY_URL: ${{ matrix.SECURE_BOOT_KEY_URL }}
ENROLLMENT_PASSWORD: ${{ matrix.ENROLLMENT_PASSWORD }}
- name: Upload ISO as artifact
uses: actions/upload-artifact@v4
with:
name: base-main-${{ matrix.version }}${{ matrix.SECURE_BOOT_STRING }}.iso
path: end_iso/*
if-no-files-found: error
retention-days: 0
compression-level: 0
overwrite: true
check:
name: Check build successful
@ -55,4 +83,4 @@ jobs:
run: exit 1
- name: Exit
shell: bash
run: exit 0
run: exit 0

2
Containerfile
View File

@ -13,6 +13,8 @@ ENV IMAGE_TAG="${VERSION}"
ENV VARIANT="Kinoite"
ENV VERSION="${VERSION}"
ENV WEB_UI="false"
ENV SECURE_BOOT_KEY_URL=""
ENV ENROLLMENT_PASSWORD="ublue-os"
COPY / /isogenerator
WORKDIR /isogenerator

11
Makefile
View File

@ -8,6 +8,8 @@ IMAGE_TAG = $(VERSION)
EXTRA_BOOT_PARAMS =
VARIANT = Kinoite
WEB_UI = false
ENROLLMENT_PASSWORD = ublue-os
SECURE_BOOT_KEY_URL =
# Generated vars
## Formatting = _UPPERCASE
@ -50,6 +52,14 @@ lorax_templates/%.tmpl: lorax_templates/%.tmpl.in
boot.iso: lorax_templates/set_installer.tmpl lorax_templates/configure_upgrades.tmpl
rm -Rf $(_BASE_DIR)/results
# Set the enrollment password
sed 's/@ENROLLMENT_PASSWORD@/$(ENROLLMENT_PASSWORD)/' $(_BASE_DIR)/scripts/enroll-secureboot-key.sh.in > $(_BASE_DIR)/scripts/enroll-secureboot-key.sh
# Download the secure boot key
if [ -n "$(SECURE_BOOT_KEY_URL)" ]; then\
curl --fail -L -o $(_BASE_DIR)/sb_pubkey.der $(SECURE_BOOT_KEY_URL);\
fi
# Remove the "Test this media & install" menu entry
sed -i '/menuentry '\''Test this media & install @PRODUCT@ @VERSION@'\'' --class fedora --class gnu-linux --class gnu --class os {/,/}/d' /usr/share/lorax/templates.d/99-generic/config_files/x86/grub2-bios.cfg
sed -i '/menuentry '\''Test this media & install @PRODUCT@ @VERSION@'\'' --class fedora --class gnu-linux --class gnu --class os {/,/}/d' /usr/share/lorax/templates.d/99-generic/config_files/x86/grub2-efi.cfg
@ -68,6 +78,7 @@ boot.iso: lorax_templates/set_installer.tmpl lorax_templates/configure_upgrades.
sed -i 's/linux @KERNELPATH@ @ROOT@ inst.rescue quiet/linux @KERNELPATH@ @ROOT@ inst.rescue quiet $(EXTRA_BOOT_PARAMS)/g' /usr/share/lorax/templates.d/99-generic/config_files/x86/grub2-bios.cfg
sed -i 's/linuxefi @KERNELPATH@ @ROOT@ inst.rescue quiet/linuxefi @KERNELPATH@ @ROOT@ inst.rescue quiet $(EXTRA_BOOT_PARAMS)/g' /usr/share/lorax/templates.d/99-generic/config_files/x86/grub2-efi.cfg
# Build boot.iso
lorax -p $(IMAGE_NAME) -v $(VERSION) -r $(VERSION) -t $(VARIANT) \
--isfinal --buildarch=$(ARCH) --volid=$(_VOLID) \
$(_LORAX_ARGS) \

29
README.md
View File

@ -37,19 +37,24 @@ sudo podman run --rm --privileged --volume .:/isogenerator/output -e VERSION=39
## Customizing
The following variables can be used to customize the create image.
| Variable | Description | Default Value |
| ----------------- | -------------------------------------------------------- | ---------------------- |
| ARCH | Architecture for image to build | x86_64 |
| VERSION | Fedora version of installer to build | 39 |
| IMAGE_REPO | Repository containing the source container image | ghcr.io/ublue-os |
| IMAGE_NAME | Name of the source container image | base-main |
| IMAGE_TAG | Tag of the source container image | *VERSION* |
| EXTRA_BOOT_PARAMS | Extra params used by grub to boot the anaconda installer | \[empty\] |
| VARIANT | Source container variant\* | Kinoite |
| WEB_UI | Enable Anaconda WebUI (experimental) | false |
| Variable | Description | Default Value |
| ----------------- | ------------------------------------------------------------ | ---------------------- |
| ARCH | Architecture for image to build | x86_64 |
| VERSION | Fedora version of installer to build | 39 |
| IMAGE_REPO | Repository containing the source container image | ghcr.io/ublue-os |
| IMAGE_NAME | Name of the source container image | base-main |
| IMAGE_TAG | Tag of the source container image | *VERSION* |
| EXTRA_BOOT_PARAMS | Extra params used by grub to boot the anaconda installer | \[empty\] |
| VARIANT | Source container variant\* | Kinoite |
| WEB_UI | Enable Anaconda WebUI (experimental) | false |
| ENROLLMENT_PASSWORD | Password used to enroll secure boot key into BIOS\*\* | isogenerator |
| SECURE_BOOT_KEY_URL | URL used to download your secure boot key for enrollment\*\* | \[empty\] |
Available options for VARIANT can be found by running `dnf provides system-release`.
Variant will be the third item in the package name. Example: `fedora-release-kinoite-39-34.noarch` will be kinoite
\*Available options for VARIANT can be found by running `dnf provides system-release`. Variant will be the third item in the package name. Example: `fedora-release-kinoite-39-34.noarch` will be kinoite
\*\*NOTE: ENROLLMENT_PASSWORD and SECURE_BOOT_KEY_URL are not required. They are only required if you are creating specific kernel modules or if you are using Universal Blue Kernel Modules.
Our public key for our kmods is located here: https://github.com/ublue-os/akmods/raw/main/certs/public_key.der
## VSCode Dev Container
There is a dev container configuration provided for development. By default it will use the existing container image available at `ghcr.io/ublue-os/isogenerator`, however, you can have it build a new image by editing `.devcontainer/devcontainer.json` and replacing `image` with `build`. `Ctrl+/` can be used to comment and uncomment blocks of code within VSCode.

20
action.yml
View File

@ -32,6 +32,12 @@ inputs:
description: Enable Anaconda WebUI
required: true
default: "false"
ENROLLMENT_PASSWORD:
description: Used for supporting secure boot (requires SECURE_BOOT_KEY_URL to be defined)
required: false
SECURE_BOOT_KEY_URL:
description: Secure boot key that is installed from URL location
required: false
ACTION_REPO:
description: Repository with the build action
required: false
@ -107,7 +113,9 @@ runs:
VARIANT=${{ inputs.VARIANT }} \
VERSION=${{ inputs.VERSION }} \
WEB_UI=${{ inputs.WEB_UI }} \
EXTRA_BOOT_PARAMS=${{ inputs.EXTRA_BOOT_PARAMS }}
EXTRA_BOOT_PARAMS=${{ inputs.EXTRA_BOOT_PARAMS }} \
SECURE_BOOT_KEY_URL=${{ inputs.SECURE_BOOT_KEY_URL }} \
ENROLLMENT_PASSWORD=${{ inputs.ENROLLMENT_PASSWORD }}
- name: Create deploy.iso and generate sha256 checksum
shell: bash
@ -123,13 +131,3 @@ runs:
mkdir end_iso
sha256sum ${{ inputs.IMAGE_NAME }}-${{ inputs.IMAGE_TAG || inputs.VERSION }}.iso > ./end_iso/${{ inputs.IMAGE_NAME }}-${{ inputs.IMAGE_TAG || inputs.VERSION }}-CHECKSUM
mv ${{ inputs.IMAGE_NAME }}-${{ inputs.IMAGE_TAG || inputs.VERSION }}.iso end_iso/
- name: Upload ISO as artifact
uses: actions/upload-artifact@v4
with:
name: ${{ inputs.IMAGE_NAME }}-${{ inputs.IMAGE_TAG || inputs.VERSION }}.iso
path: end_iso/*
if-no-files-found: error
retention-days: 0
compression-level: 0
overwrite: true

13
entrypoint.sh
View File

@ -3,6 +3,15 @@
set -eu
# pre-create loop devices manually. In containers we can't use losetup for that.
mknod -m 0660 /dev/loop0 b 7 0 2> /dev/null || true
mknod -m 0660 /dev/loop0 b 7 0 2>/dev/null || true
make output/${IMAGE_NAME}-${IMAGE_TAG}.iso ARCH=${ARCH} VERSION=${VERSION} IMAGE_REPO=${IMAGE_REPO} IMAGE_NAME=${IMAGE_NAME} IMAGE_TAG=${IMAGE_TAG} VARIANT=${VARIANT} WEB_UI=${WEB_UI}
make output/${IMAGE_NAME}-${IMAGE_TAG}.iso \
ARCH=${ARCH} \
VERSION=${VERSION} \
IMAGE_REPO=${IMAGE_REPO} \
IMAGE_NAME=${IMAGE_NAME} \
IMAGE_TAG=${IMAGE_TAG} \
VARIANT=${VARIANT} \
WEB_UI=${WEB_UI} \
SECURE_BOOT_KEY_URL=${SECURE_BOOT_KEY_URL} \
ENROLLMENT_PASSWORD=${ENROLLMENT_PASSWORD}

20
scripts/enroll-secureboot-key.sh → scripts/enroll-secureboot-key.sh.in
View File

@ -2,14 +2,8 @@
set -oue pipefail
readonly SECUREBOOT_KEY="/run/install/repo/ublue-os-akmods-public-key.der"
readonly ENROLLMENT_PASSWORD="ublue-os"
SYS_ID="$(cat /sys/devices/virtual/dmi/id/product_name)"
if [[ ":Jupiter:Galileo:" =~ ":$SYS_ID:" ]]; then
echo "Steam Deck hardware detected. Skipping key enrollment."
exit 0
fi
readonly ENROLLMENT_PASSWORD=@ENROLLMENT_PASSWORD@
readonly SECUREBOOT_KEY="/run/install/repo/sb_pubkey.der"
if [[ ! -d "/sys/firmware/efi" ]]; then
echo "EFI mode not detected. Skipping key enrollment."
@ -17,8 +11,14 @@ if [[ ! -d "/sys/firmware/efi" ]]; then
fi
if [[ ! -f "${SECUREBOOT_KEY}" ]]; then
echo "Secure boot key not found: ${SECUREBOOT_KEY}"
exit 1
echo "Secure boot key not provided: ${SECUREBOOT_KEY}"
exit 0
fi
SYS_ID="$(cat /sys/devices/virtual/dmi/id/product_name)"
if [[ ":Jupiter:Galileo:" =~ ":$SYS_ID:" ]]; then
echo "Steam Deck hardware detected. Skipping key enrollment."
exit 0
fi
mokutil --timeout -1 || :

BIN
scripts/ublue-os-akmods-public-key.der
View File

Binary file not shown.

6
xorriso/gen_input.sh.in
View File

@ -5,8 +5,10 @@ echo "-outdev $(pwd)/output/@IMAGE_NAME@-@IMAGE_TAG@.iso"
echo "-boot_image any replay"
echo "-joliet on"
echo "-compliance joliet_long_names"
echo "-map $(pwd)/scripts/ublue-os-akmods-public-key.der ublue-os-akmods-public-key.der"
echo "-chmod 0444 /ublue-os-akmods-public-key.der"
if [ -f $(pwd)/sb_pubkey.der ]; then
echo "-map $(pwd)/sb_pubkey.der sb_pubkey.der"
echo "-chmod 0444 /sb_pubkey.der"
fi
echo "-map $(pwd)/scripts/enroll-secureboot-key.sh enroll-secureboot-key.sh"
echo "-chmod 0777 enroll-secureboot-key.sh"
cd container