many: snap integrity discovery run mode #15044
Draft
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
c/snap-bootstrap: add separate file for installrun mode (preseed) and further refactors
the new design simplifies how snap dm-verity data for a corresponding snap are generated and used by having them as a separate file (i.e located next to the snap file) instead of attaching them at the end of their snap file by default. The extra integrity data header is removed as all the information needed to mount a snap with its verity data (root hash, salt, other parameters) will be retrieved from a new integrity stanza in snap-revision assertions.
- stopped exporting veritySuperBlock.Validate(). Call it as part of
ReadSuperBlock() instead.
- rename LookupDmVerityData to LookupDmVerityDataAndCrossCheck.
- create 2 error types ErrDmVerityDataNotFound and
ErrUnexpectedDmVerityData. These error types will be useful for
instance in snap-bootstrap. snap-bootstrap will need to make a
decision about whether to generate data in case
ErrDmVerityDataNotFound or wrap the error with extra context such as
"dm-verity data found on disk don't match assertion" in case
ErrUnexpectedDmVerityData.
…yDataAndCrossCheck
…urned by ReadDmVeritySuperblock
This commit adds support for looking up dm-verity integrity data for asserted snaps in the seed (ones that have verified assertions available). snap-bootstrap can then use these integrity data parameters to call to the snap integrity API in order to either detect available dm-verity hash data or generate them. It will then proceed with mounting the snaps using dm-verity.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is based on top of:
and enables mounting snaps with integrity data in run mode.
Jira: https://warthogs.atlassian.net/browse/FR-10111