stage1 admission: discriminated union (payload | manifest) + reproducible boot-test matrix#6
Merged
Merged
Conversation
…ible boot-test matrix Mirror stage1's _stage2 rework on stage0's _stage1 admission: each per-arch entry is a discriminated union, a `payload` (sha256 pin or ed25519-signed, with inline or signed LoadOptions) or a `manifest` (fetch a signed manifest, verify it against the pinned key, deep-merge it, and re-evaluate). Resolution loops through a chain of signed manifests (per-hop key delegation) until a payload is reached; a repeated (url, sha256) is a cycle and fails closed. stage0 forwards no document (the UKI re-fetches its own metadata), so the merged doc drives only re-evaluation. Closes the ed25519 mix-and-match malleability (#2) without dropping the flexible url/sha256/ed25519/sig_url/args_url paths. Also add a reproducible, asserting boot-test suite driven entirely by the Makefile (no manual docker): - boot-%: mode-aware (SIGN / SIGN_ARGS / MANIFEST / FALLBACK / ARGS), serving a staging dir so payload, signed args, and a signed manifest are served uniformly - smoke-boot-%: boots every admission mode stage0 -> test-payload and asserts the payload chain-loaded, with a per-mode PASS/FAIL summary (~2 min for the matrix) - the test payload powers off instead of returning to stage0 (avoids stage0's fail-closed drain) and skips its EC2-only serial-flush hold when LoadOptions carry --nosleep (a runtime flag, no separate build); a real EC2 deploy passes no flag and keeps the hold README updated. Supersedes #5 (rebuilt from main as an additive change). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Mirrors the stage1 rework on stage0's
_stage1admission. Each per-arch entry is a discriminated union, exactly one of:payload-- admit a UEFI binary now:sha256pin ored25519-signed (sig_url), with inline or signed LoadOptions (args/args_url).manifest-- fetch a signed manifest (a_stage1fragment), verify its detached signature against the pinneded25519key, deep-merge it, and re-evaluate. Resolution loops through a chain of signed manifests (per-hop key delegation) until a payload is reached; a repeated(url, sha256)is a cycle and fails closed.stage0 forwards no document (the UKI re-fetches its own metadata), so the merged doc drives only re-evaluation. Closes the ed25519 mix-and-match malleability (#2) without dropping the flexible
url/sha256/ed25519/sig_url/args_urlpaths.config.rsmirrors stage1'smetadatatypes (http-only, Deserialize-only).Reproducible boot-test suite (Makefile-driven, no manual docker)
boot-%-- mode-aware (SIGN/SIGN_ARGS/MANIFEST/FALLBACK/ARGS), serves a staging dir so payload, signed args, and a signed manifest are all served uniformly athttp://SERVE_HOST/<file>.smoke-boot-%-- boots every admission modestage0 -> test-payloadand asserts the payload actually chain-loaded (fetch -> admit -> PCR-measure -> chain-load), with a per-mode PASS/FAIL summary.--nosleep(a runtime flag the harness passes -- no separate build; a real EC2 deploy keeps the full hold). The whole matrix runs in ~2 min.Verification
x86_64-unknown-uefiviamake.make smoke-boot-x86_64: all 5 modes PASS (sha256, ed25519 sig, signed args, signed manifest, mirror fallback) in ~2 min.Rebuilt from
mainas a purely additive change; supersedes #5. Pairs with lockboot/stage1#16.🤖 Generated with Claude Code