Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mkosi: use cryptography instead of openssl #4

Open
wants to merge 4 commits into
base: signed-gpt
Choose a base branch
from
Open

mkosi: use cryptography instead of openssl #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9d34036
mkosi: make roundup helper more generic
poettering Sep 10, 2021
cd4b43f
mkosi: optionally, sign verity data
poettering Sep 7, 2021
71db4f3
doc: document Verity=signed
poettering Sep 10, 2021
3eb5754
mkosi: use cryptography instead of openssl
behrmann Sep 13, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 17 additions & 3 deletions mkosi.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -528,10 +528,24 @@ a boolean argument: either "1", "yes", or "true" to enable, or "0",

`Verity=`, `--verity`

: Add an "Verity" integrity partition to the image. If enabled, the
root partition is protected with `dm-verity` against off-line
: Add an "Verity" integrity partition to the image. Takes a boolean or
the special value `signed`, and defaults to disabled. If enabled,
the root partition (or `/usr/` partition, inc ase `UsrOnly=` is
enabled) is protected with `dm-verity` against off-line
modification, the verification data is placed in an additional GPT
partition. Implies `ReadOnly=yes`.
partition. Implies `ReadOnly=yes`. If this is enabled the Verity
root hash is written to an output file with `.roothash` or
`.usrhash` suffix. If set to `signed` Verity is also enabled, but
the resulting root hash is then also signed (in PKCS#7 format) with
the signature key configured with `SecureBootKey=` (or in other
words: the SecureBoot key pair is then both used to sign the kernel,
if that's enabled, and the root/`/usr/` file system). This signature
is then stored in an additiona output file with the `.roothash.p7s`
or `.usrhash.p7s` suffix in DER format. It is also written to an
additional partition in the image. The latter allows generating
self-contained signed disk images, implementing the Verity
provisions described in the [Discoverable Partitions
Specification](https://systemd.io/DISCOVERABLE_PARTITIONS).

`CompressFs=`, `--compress-fs=`

Expand Down
Loading