ukify: Accept allow-missing-verity param

Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Author: Johan-Liebert1

Dockerfile

@@ -176,6 +176,7 @@ RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp
 # We need our newly-built bootc for the compute-composefs-digest command
 FROM tools as sealed-uki
 ARG variant
+ARG filesystem
 # Install our bootc package (only needed for the compute-composefs-digest command)
 RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
     --mount=type=bind,from=packages,src=/,target=/run/packages \
@@ -186,8 +187,15 @@ RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp
     --mount=type=bind,from=packaging,src=/,target=/run/packaging \
     --mount=type=bind,from=base-penultimate,src=/,target=/run/target <<EORUN
 set -xeuo pipefail
+
+allow_missing_verity=false
+
+if [[ filesystem == "xfs" ]]; then
+    allow_missing_verity=true
+fi
+
 if test "${variant}" = "composefs-sealeduki-sdboot"; then
-  /run/packaging/seal-uki /run/target /out /run/secrets
+  /run/packaging/seal-uki /run/target /out /run/secrets $allow_missing_verity
 fi
 EORUN
 

Justfile

@@ -41,7 +41,11 @@ lbi_images := "quay.io/curl/curl:latest quay.io/curl/curl-base:latest registry.a
 fedora-coreos := "quay.io/fedora/fedora-coreos:testing-devel"
 generic_buildargs := ""
 _extra_src_args := if extra_src != "" { "-v " + extra_src + ":/run/extra-src:ro --security-opt=label=disable" } else { "" }
-base_buildargs := generic_buildargs + " " + _extra_src_args + " --build-arg=base=" + base + " --build-arg=variant=" + variant + " --build-arg=bootloader=" + bootloader
+base_buildargs := generic_buildargs + " " + _extra_src_args \
+                  + " --build-arg=base=" + base \
+                  + " --build-arg=variant=" + variant \
+                  + " --build-arg=bootloader=" + bootloader \
+                  + " --build-arg=filesystem=" + filesystem # required for bootc container ukify to allow missing fsverity
 buildargs := base_buildargs \
              + " --cap-add=all --security-opt=label=type:container_runtime_t --device /dev/fuse" \
              + " --secret=id=secureboot_key,src=target/test-secureboot/db.key --secret=id=secureboot_cert,src=target/test-secureboot/db.crt"

contrib/packaging/seal-uki

@@ -11,6 +11,8 @@ shift
 # Path to secrets directory
 secrets=$1
 shift
+allow_missing_verity=$1
+shift
 
 # Find the kernel version (needed for output filename)
 kver=$(bootc container inspect --rootfs "${target}" --json | jq -r '.kernel.version')
@@ -38,6 +40,12 @@ containerukifyargs=(--rootfs "${target}")
 # See https://github.com/bootc-dev/bootc/issues/1826
 containerukifyargs+=(--karg enforcing=0)
 
+missing_verity=()
+
+if [[ $allow_missing_verity == "true" ]]; then
+    missing_verity+=(--allow-missing-verity)
+fi
+
 # Build the UKI using bootc container ukify
 # This computes the composefs digest, reads kargs from kargs.d, and invokes ukify
-bootc container ukify "${containerukifyargs[@]}" -- "${ukifyargs[@]}"
+bootc container ukify "${containerukifyargs[@]}" "${missing_verity[@]}" -- "${ukifyargs[@]}"

crates/lib/src/cli.rs

@@ -411,6 +411,10 @@ pub(crate) enum ContainerOpts {
         #[clap(long = "karg", hide = true)]
         kargs: Vec<String>,
 
+        /// Make fs-verity validation optional in case the filesystem doesn't support it
+        #[clap(long)]
+        allow_missing_verity: bool,
+
         /// Additional arguments to pass to ukify (after `--`).
         #[clap(last = true)]
         args: Vec<OsString>,
@@ -1624,8 +1628,9 @@ async fn run_from_opt(opt: Opt) -> Result<()> {
             ContainerOpts::Ukify {
                 rootfs,
                 kargs,
+                allow_missing_verity,
                 args,
-            } => crate::ukify::build_ukify(&rootfs, &kargs, &args),
+            } => crate::ukify::build_ukify(&rootfs, &kargs, &args, allow_missing_verity),
         },
         Opt::Completion { shell } => {
             use clap_complete::aot::generate;

crates/lib/src/ukify.rs

@@ -30,6 +30,7 @@ pub(crate) fn build_ukify(
     rootfs: &Utf8Path,
     extra_kargs: &[String],
     args: &[OsString],
+    allow_missing_fsverity: bool,
 ) -> Result<()> {
     // Warn if --karg is used (temporary workaround)
     if !extra_kargs.is_empty() {
@@ -83,7 +84,11 @@ pub(crate) fn build_ukify(
     let mut cmdline = crate::bootc_kargs::get_kargs_in_root(&root, std::env::consts::ARCH)?;
 
     // Add the composefs digest
-    let composefs_param = format!("{COMPOSEFS_CMDLINE}={composefs_digest}");
+    let composefs_param = if allow_missing_fsverity {
+        format!("{COMPOSEFS_CMDLINE}=?{composefs_digest}")
+    } else {
+        format!("{COMPOSEFS_CMDLINE}={composefs_digest}")
+    };
     cmdline.extend(&Cmdline::from(composefs_param));
 
     // Add any extra kargs provided via --karg
@@ -129,7 +134,7 @@ mod tests {
         let tempdir = tempfile::tempdir().unwrap();
         let path = Utf8Path::from_path(tempdir.path()).unwrap();
 
-        let result = build_ukify(path, &[], &[]);
+        let result = build_ukify(path, &[], &[], false);
         assert!(result.is_err());
         let err = format!("{:#}", result.unwrap_err());
         assert!(
@@ -147,7 +152,7 @@ mod tests {
         fs::create_dir_all(tempdir.path().join("boot/EFI/Linux")).unwrap();
         fs::write(tempdir.path().join("boot/EFI/Linux/test.efi"), b"fake uki").unwrap();
 
-        let result = build_ukify(path, &[], &[]);
+        let result = build_ukify(path, &[], &[], false);
         assert!(result.is_err());
         let err = format!("{:#}", result.unwrap_err());
         assert!(