uki: Fedora 44 kernel 7.0.12 + stub 259.6; GPG-verify + automate deps#19
Merged
Conversation
…ate deps The UKI pinned kernel 6.12.4-200.fc41 and the systemd-boot stub 256.17-1.fc41, verified only by SHA256. fc41 is EOL (no more security updates) and the kernel was ~18 months behind, so move to what Fedora CoreOS 44.20260621.3.1 ships: kernel 7.0.12-201.fc44 and stub 259.6-1.fc44. Also add supply-chain provenance and make future bumps easy: - GPG verification (mandatory, no optional path): download-verify-rpm.sh fetches from koji's SIGNED path (the plain packages/ path serves UNSIGNED builds) and verifies each RPM's Fedora signature via verify-rpm-gpg.sh (hermetic rpmdb), on every build. Trust anchor: keys/RPM-GPG-KEY-fedora-44-primary, fingerprint 36F6 12DC F27F 7D1A 48A8 35E4 DBFC F71C 6D9F 90A6 (see keys/README.md). - The pins now live in the generated tools/build-uki/fedora-deps.mk; regenerate with `make update-fedora-deps FCOS=44.20260621.3.1 SYSTEMD=259.6-1.fc44`. update-fedora-deps.py reads the kernel NVR from the FCOS build manifest, takes the stub from Fedora (explicit or latest-in-fNN via Bodhi), downloads all six RPMs from the signed path, GPG-verifies, and rewrites the pins. - Dropped the stale kernel-hash-% target (undefined var + hardcoded buildID). Verified: ena (AWS) + gve (GCP) modules present in 7.0.12; the chain boots the new kernel end to end (test-chain-x86_64 SIGN=1 / MANIFEST=1 / SIGN_ARGS=1 all pass). The measured linux.efi (and its PCR) changes, as expected for a kernel bump. aarch64 pins are GPG-verified but not boot-tested here (no aarch64 QEMU run); same pipeline as x86_64. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A containerized stage2 (keel) needs dm-crypt (encrypted data partition),
dm-verity (integrity-checked read-only runtime over erofs), the overlay
snapshotter, and erofs. Add them (and their deps reed_solomon for dm-verity FEC
and netfs for erofs) to REQUIRED_MODULES so they are bundled in the UKI, and
load them all in init before the modules_disabled latch.
Load the dependency modules explicitly rather than relying on modprobe to
auto-pull them: once modules_disabled is latched a dep that was not already
resolved can never be loaded on demand, so implicit resolution would be a
latent failure. Verified: all six present in kernel-modules-core-7.0.12-201.fc44
and copied (.ko.xz), and the chain boots with all six loading cleanly
(init: modprobe: {dm-crypt,overlay,reed_solomon,dm-verity,netfs,erofs}) through
to stage2.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Vendor the canonical build.mk (from stage0) and replace the inline docker-images + DOCKER_RUN plumbing block with include build.mk. Kept byte-identical across repos via the workspace make sync-harness, guarded by make check-harness. stage1-specific bits (RUNTIME_IMAGE, the DOCKER_OPT_DOCKER socket passthrough) stay in the Makefile. Pure relocation -- make -n expands identically. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
dm-integrity (authenticated-encrypted stage2 /data) plus its async_xor -> async_tx (ASYNC_CORE) journal deps, and the NVMe disk chain (hkdf -> nvme-auth/nvme-keyring -> nvme-core -> nvme; EC2 EBS and the harness disk are NVMe). Added to init and build.sh REQUIRED_MODULES, loaded before the modules_disabled latch so the stage2 payload finds them resident (it cannot modprobe once the latch is set). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Pin to the v0.3.0 release commit with a =0.3.0 version guard so the build fails if the rev ever drifts to a commit whose crate version is not 0.3.0. Matches the pin in stage2. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
stage2 settled on confidentiality-only dm-crypt (aes-xts-plain64) for /data, so the authenticated-encryption path (dm-integrity + its async_xor -> async_tx journal deps) is unused. Remove those 3 modules from the measured initramfs to keep the attested boot surface minimal; re-adding them is the documented extension point for authenticated /data. Also reword the storage-module comments to describe what each module provides / can be used for rather than a specific consumer, and drop the stale "keel" name. Verified: stage2 pivot (XTS /data) still PIVOT_TEST=PASS on the rebuilt UKI, with dm-integrity absent from the boot. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
HarryR
added a commit
to lockboot/stage0
that referenced
this pull request
Jul 13, 2026
## What Bring the stage0 build image and disk layout in line with the Fedora 44 chain bump, plus stable disk identity. ## Changes - **rpm + gnupg** added to `Dockerfile.build` so the UKI build can verify Fedora package GPG signatures (image parity with stage1, kept byte-identical). No effect on compiled artifacts. - **Stable lockboot GPT GUIDs + FAT volume-id.** `DISK_GUID` / `PART_GUID` are now constant across releases (`4c4f434b-424f-4f54-...`, "LOCKBOOT" + a role index), so the initial GPT is byte-stable (stable pre-stage2 PCR5) and the boot disk is identifiable by a fixed GUID rather than by hashing stage0.efi (which changed per release). This is the stable identity stage2's `find_boot_device` can key on. (stage2 still rewrites the GPT at runtime to add p2/p3, which is why it excludes PCR5 from its key binding.) - **Pin `vaportpm-attest` to v0.3.0** (rev + version guard), matching stage1. - **Extract the shared `DOCKER_RUN` harness** into `build.mk` (same refactor as stage1). ## Verification - Reproducible: GUIDs/timestamps fixed; build output byte-stable. - No change to the runtime boot path. Pairs with lockboot/stage1#19 (Fedora 44 kernel/stub) and lockboot/stage2#1. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bring the UKI to a current, GPG-verified Fedora 44 base, bundle the kernel modules stage2 needs, and supporting build cleanups.
Kernel + stub
6.12.4-200.fc41->7.0.12-201.fc44and systemd-boot stub256.17-1.fc41->259.6-1.fc44(what Fedora CoreOS 44.20260621.3.1 ships).fc41is EOL; the kernel was ~18 months behind.download-verify-rpm.shfetches from koji's signed path (plainpackages/is unsigned) and verifies each RPM againstkeys/RPM-GPG-KEY-fedora-44-primary(fp36F6 12DC F27F 7D1A 48A8 35E4 DBFC F71C 6D9F 90A6) on every build.tools/build-uki/fedora-deps.mk;make update-fedora-deps FCOS=... SYSTEMD=...reads the FCOS manifest, downloads + GPG-verifies the signed RPMs, and rewrites the pins.Storage modules for stage2
modules_disabledlatch) the modules stage2's loader needs: dm-crypt (encrypted /data), dm-verity + reed_solomon (integrity-checked erofs runtime + FEC dep), overlay (ephemeral root), erofs + netfs (RO image fs + dep), and the nvme chain (hkdf -> nvme-auth/keyring -> nvme-core -> nvme; EC2 EBS + the harness disk are NVMe). The payload cannot load modules itself, and an unresolved dep can't be pulled once the latch is set, so deps are listed explicitly.Build
vaportpm-attestto v0.3.0 (rev + version guard).DOCKER_RUNharness intobuild.mk.kernel-hash-%target.Verification
.ko.xzcopy.make test-chain-x86_64 SIGN=1 / MANIFEST=1 / SIGN_ARGS=1bootLinux 7.0.12-201.fc44end to end and run stage2.PIVOT_TEST=PASS), dm-integrity absent from the boot.Pairs with lockboot/stage0#10 (image parity: rpm+gnupg, shared harness, vaportpm pin, stable GUIDs).
🤖 Generated with Claude Code