raito/lanzaboote
0
0
Fork 0
Code Issues 45 Pull requests 6 Projects Releases 6 Packages Wiki Activity Actions

systemd-stub feature parity #94

New issue
Open
opened 2023-02-02 23:51:19 +00:00 by RaitoBezarius · 6 comments
RaitoBezarius commented 2023-02-02 23:51:19 +00:00 (Migrated from github.com)
Copy link

We would like to have similar design and features as systemd-stub, ideally, lanzastub should be a drop-in replacement tailored for NixOS:

Random seed

  • Support

SMBIOS

  • Load command line via SMBIOS

Addons support

  • Load command line addons

Sections in the stub

  • DTB support
  • Bootsplash support
  • Expected TPM2 PCR signatures
  • TPM2 PCR public key support

Companion files

  • Local credentials files specific to that generation
  • System extensions images
  • Global credentials

EFI variables passed to the OS

  • LoaderDevicePartUUID
  • LoaderFirmwareInfo
  • LoaderFirmwareType
  • LoaderImageIdentifier
  • StubInfo
  • StubFeatures
  • StubPcrKernelImage
  • StubPcrKernelParameters
  • StubPcrInitRDSysExts
We would like to have similar design and features as `systemd-stub`, ideally, lanzastub should be a *drop-in* replacement tailored for NixOS: ## Random seed - [ ] Support ## SMBIOS - [ ] Load command line via SMBIOS ## Addons support - [ ] Load command line addons ## Sections in the stub - [ ] DTB support - [ ] Bootsplash support - [x] Expected TPM2 PCR signatures - [x] TPM2 PCR public key support ## Companion files - [x] Local credentials files specific to that generation - [x] System extensions images - [x] Global credentials ## EFI variables passed to the OS - [x] `LoaderDevicePartUUID` - [x] `LoaderFirmwareInfo` - [x] `LoaderFirmwareType` - [x] `LoaderImageIdentifier` - [x] `StubInfo` - [x] `StubFeatures` - [x] `StubPcrKernelImage` - [x] `StubPcrKernelParameters` - [x] `StubPcrInitRDSysExts`
nikstur commented 2023-02-03 00:54:07 +00:00 (Migrated from github.com)
Copy link

Working on this here makes it much harder for other people, especially systemd upstream but also maintainers of other distros to work on the next gen sd-stub in Rust. I'd rather see development happen somewhere else (maybe here: https://github.com/nikstur/sd-stub-rs) and then moved into the systemd namespace as soon as possible.

Working on this here makes it much harder for other people, especially systemd upstream but also maintainers of other distros to work on the next gen sd-stub in Rust. I'd rather see development happen somewhere else (maybe here: https://github.com/nikstur/sd-stub-rs) and then moved into the systemd namespace as soon as possible.
👍 1
nikstur commented 2023-02-08 15:26:32 +00:00 (Migrated from github.com)
Copy link

This is a useful tracker, thx @RaitoBezarius But since we won't use it here, I closed the issue.

This is a useful tracker, thx @RaitoBezarius But since we won't use it here, I closed the issue.
RaitoBezarius commented 2023-04-30 00:18:12 +00:00 (Migrated from github.com)
Copy link

As I am going to implement all of this first, then move it to sd-stub, I will track it here first.

As I am going to implement all of this first, then move it to sd-stub, I will track it here first.
👍 2
RaitoBezarius commented 2023-05-01 00:21:51 +00:00 (Migrated from github.com)
Copy link

DTB support and bootsplash are hard to do, they are blocked on upstream support.

DTB support and bootsplash are hard to do, they are blocked on upstream support.
clhodapp commented 2023-07-23 21:36:53 +00:00 (Migrated from github.com)
Copy link

@RaitoBezarius which upstream?

@RaitoBezarius which upstream?
RaitoBezarius commented 2023-07-23 21:55:38 +00:00 (Migrated from github.com)
Copy link

@RaitoBezarius which upstream?

uefi-rs :)

DTB is fixed now, bootsplash is still blocked.

> @RaitoBezarius which upstream? `uefi-rs` :) DTB is fixed now, bootsplash is still blocked.
👀 1
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
test
qm3ster/patch-1
blitz/npins
enroll-keys
github-actions
systemd-sb-enroll
fix-ci
bump-edk2
global-credentials
signing-client
in-memory-assembling
cpio-packing
uboot
netboot
experiment-sd-addons
insecure-boot
refactor-building
tpm2-pcr-sections
bootsplash
sd-stub-dtb
bzimage-load
configuration-limit-test
boot-file-integrity-investigation
crane-uefi
v0.4.2
v0.4.1
v0.4.0
v0.3.0
v0.2.0
v0.1.0
Labels
Clear labels   
bug

Something isn't working

  
dependency

Issues related to our dependencies

  
documentation

Improvements or additions to documentation

  
duplicate

This issue or pull request already exists

  
enhancement

New feature or request

  
good first issue

Good for newcomers

  
help wanted

Extra attention is needed

  
invalid

This doesn't seem right

  
question

Further information is requested

  
review-next

   
security

   
stub

   
tool

   
wontfix

This will not be worked on

No labels
bug
dependency
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
review-next
security
stub
tool
wontfix
Milestone
Clear milestone
No items
No milestone
Release 0.5.0
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: raito/lanzaboote#94
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?