go.mod: move to latest secboot #13339

valentindavid · 2023-10-27T10:03:38Z

No description provided.

valentindavid · 2023-10-27T10:03:59Z

codecov-commenter · 2023-10-27T11:17:09Z

Codecov Report

Attention: 16 lines in your changes are missing coverage. Please review.

Comparison is base (cdbd316) 78.96% compared to head (6535984) 78.86%.
Report is 55 commits behind head on master.

Files	Patch %	Lines
secboot/secboot_hooks.go	52.38%	8 Missing and 2 partials ⚠️
secboot/secboot_sb.go	40.00%	2 Missing and 1 partial ⚠️
secboot/secboot_tpm.go	91.17%	2 Missing and 1 partial ⚠️

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #13339      +/-   ##
==========================================
- Coverage   78.96%   78.86%   -0.10%     
==========================================
  Files        1028     1030       +2     
  Lines      129762   130548     +786     
==========================================
+ Hits       102462   102958     +496     
- Misses      20911    21177     +266     
- Partials     6389     6413      +24

Flag	Coverage Δ
unittests	`78.86% <73.77%> (-0.10%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

valentindavid · 2023-12-06T09:19:06Z

tests/nested/core/core20-gadget-reseal started to fail with:

2023-12-05T17:20:27.3929553Z [   91.522913] snapd[1922]: 2023/12/05 17:10:31.229509 logger.go:93: DEBUG: 2023-12-05T17:10:31Z ERROR cannot set next boot: cannot reseal the fallback encryption keys: cannot increment counter: TPM returned a warning whilst executing command TPM_CC_StartAuthSession: TPM_RC_SESSION_MEMORY (out of memory for session contexts)

alfonsosanchezbeato

I made a pass. An additional change that I wonder if is needed is that in the past parts of secboot were imported in snapd:
a466265
e45a076
and maybe we can use directly secboot now. But I don't know about the reason for importing code this way, maybe @pedronis has some context. Anyway, that should be possible a follow-up.

tests/nested/manual/uc-update-assets-secure/task.yaml

tests/nested/core/core20-kernel-failover/task.yaml

go.mod

secboot/encrypt_sb.go

secboot/secboot_hooks.go

secboot/secboot_sb.go

valentindavid · 2024-01-11T14:19:48Z

I made a pass. An additional change that I wonder if is needed is that in the past parts of secboot were imported in snapd:
a466265
e45a076
and maybe we can use directly secboot now. But I don't know about the reason for importing code this way, maybe @pedronis has some context. Anyway, that should be possible a follow-up.

I had a quick look if I could build without it. It seems that we need this code to enroll recovery keys from snap-fde-keymgr. The functions it calls are in "internal" part of secboot and cannot be used directly.

valentindavid · 2024-01-12T13:32:37Z

I have added the Block label, because we should not merge it yet. The new key format has to be merged together. But it should still be reviewed.

alfonsosanchezbeato

Thanks for the changes, I'm not approving yet as you mentioned that other things need to land first.

pedronis

lgtm, one question, did Chris have a look a the changes?

pedronis · 2024-01-18T12:47:24Z

secboot/secboot_hooks.go

-	var handle []byte
-	if keySetup.Handle == nil {
-		// this will reach fde-reveal-key as null but should be ok
-		handle = []byte("null")
-	} else {
-		handle = *keySetup.Handle
-	}


why we don't need this bit of code/manipulation anymore?

I have no idea. I believe that was done by Michael. I suppose we can revert this one if it breaks customers' fde-reveal-key.

I suppose, if "fde-setup" does not set a handle. It probably does not care about the handle in the corresponding "fde-reveal-key".

valentindavid · 2024-01-18T12:52:41Z

lgtm, one question, did Chris have a look a the changes?

I do not know if he looked through it.

alfonsosanchezbeato

LGTM

valentindavid · 2024-06-21T07:41:14Z

Everything is in #13951. Closing this one.

github-actions bot added the Run Nested -auto- Label automatically added in case nested tests need to be executed label Oct 27, 2023

valentindavid added the Run nested The PR also runs tests inluded in nested suite label Oct 27, 2023

valentindavid closed this Oct 27, 2023

valentindavid reopened this Oct 27, 2023

valentindavid force-pushed the valentindavid/move-to-latest-secboot-with-snakeoil branch 6 times, most recently from 17764c1 to 73a3ca3 Compare November 27, 2023 13:38

valentindavid force-pushed the valentindavid/move-to-latest-secboot-with-snakeoil branch from 73a3ca3 to 9e4325c Compare November 29, 2023 12:27

valentindavid closed this Nov 30, 2023

valentindavid reopened this Nov 30, 2023

valentindavid closed this Dec 1, 2023

valentindavid reopened this Dec 1, 2023

valentindavid force-pushed the valentindavid/move-to-latest-secboot-with-snakeoil branch from 9e4325c to ce639b4 Compare December 1, 2023 12:35

valentindavid force-pushed the valentindavid/move-to-latest-secboot-with-snakeoil branch 2 times, most recently from fa2ae65 to a984a37 Compare December 7, 2023 10:34

chrisccoulson mentioned this pull request Jan 4, 2024

Bump github.com/canonical/go-tpm2 dependency to v1.3.0 canonical/secboot#279

Merged

valentindavid force-pushed the valentindavid/move-to-latest-secboot-with-snakeoil branch 3 times, most recently from dc5464a to 8bc7657 Compare January 10, 2024 13:32

valentindavid changed the title ~~go.mod: move to latest secboot #13278 with snakeoil~~ go.mod: move to latest secboot Jan 10, 2024

valentindavid marked this pull request as ready for review January 10, 2024 13:35

upils mentioned this pull request Jan 10, 2024

Update dependencies canonical/ubuntu-image#176

Merged

valentindavid requested a review from alfonsosanchezbeato January 10, 2024 14:29

alfonsosanchezbeato reviewed Jan 10, 2024

View reviewed changes

valentindavid requested a review from alfonsosanchezbeato January 12, 2024 13:31

valentindavid added the ⛔ Blocked label Jan 12, 2024

alfonsosanchezbeato reviewed Jan 12, 2024

View reviewed changes

valentindavid requested a review from pedronis January 16, 2024 10:36

pedronis reviewed Jan 18, 2024

View reviewed changes

pedronis self-assigned this Jan 18, 2024

valentindavid requested a review from alfonsosanchezbeato January 23, 2024 11:05

alfonsosanchezbeato approved these changes Mar 15, 2024

View reviewed changes

valentindavid force-pushed the valentindavid/move-to-latest-secboot-with-snakeoil branch from 6535984 to 734eaf7 Compare March 19, 2024 12:03

valentindavid mentioned this pull request May 7, 2024

many: attempt to use secboot api for new key format #13951

Closed

valentindavid force-pushed the valentindavid/move-to-latest-secboot-with-snakeoil branch from 734eaf7 to 7b339f9 Compare May 7, 2024 12:44

valentindavid and others added 7 commits May 7, 2024 14:47

t/n/m/uc-update-assets-secure: sign new grub also with old key

df21e78

go.mod: move to latest secboot/go-tpm2/go-efilib

2bec6d5

fixup! t/n/m/uc-update-assets-secure: sign new grub also with old key

4673322

fixup! t/n/m/uc-update-assets-secure: sign new grub also with old key

a866779

fixup! go.mod: move to latest secboot/go-tpm2/go-efilib

5f1cca2

secboot: remove dead code

c217046

fixup! secboot: remove dead code

bc9b81a

valentindavid force-pushed the valentindavid/move-to-latest-secboot-with-snakeoil branch from 7b339f9 to bc9b81a Compare May 7, 2024 12:50

valentindavid closed this Jun 21, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

go.mod: move to latest secboot #13339

go.mod: move to latest secboot #13339

valentindavid commented Oct 27, 2023

valentindavid commented Oct 27, 2023 •

edited

Loading

codecov-commenter commented Oct 27, 2023 •

edited

Loading

valentindavid commented Dec 6, 2023

alfonsosanchezbeato left a comment

valentindavid commented Jan 11, 2024

valentindavid commented Jan 12, 2024

alfonsosanchezbeato left a comment

pedronis left a comment

pedronis Jan 18, 2024

valentindavid Jan 18, 2024

valentindavid Jan 18, 2024

valentindavid commented Jan 18, 2024

alfonsosanchezbeato left a comment

valentindavid commented Jun 21, 2024

go.mod: move to latest secboot #13339

go.mod: move to latest secboot #13339

Conversation

valentindavid commented Oct 27, 2023

valentindavid commented Oct 27, 2023 • edited Loading

codecov-commenter commented Oct 27, 2023 • edited Loading

Codecov Report

valentindavid commented Dec 6, 2023

alfonsosanchezbeato left a comment

Choose a reason for hiding this comment

valentindavid commented Jan 11, 2024

valentindavid commented Jan 12, 2024

alfonsosanchezbeato left a comment

Choose a reason for hiding this comment

pedronis left a comment

Choose a reason for hiding this comment

pedronis Jan 18, 2024

Choose a reason for hiding this comment

valentindavid Jan 18, 2024

Choose a reason for hiding this comment

valentindavid Jan 18, 2024

Choose a reason for hiding this comment

valentindavid commented Jan 18, 2024

alfonsosanchezbeato left a comment

Choose a reason for hiding this comment

valentindavid commented Jun 21, 2024

valentindavid commented Oct 27, 2023 •

edited

Loading

codecov-commenter commented Oct 27, 2023 •

edited

Loading