[PATCH 1/5] vm: generate dm-verity metadata for sub-VM roots

[colbyt <colby@colbyt.com>]

Generate dm-verity metadata for the app VM and net VM root filesystems,
and install the root hash next to each VM disk image.

The disk layout now has separate verity and root partitions. Both
partition UUIDs are derived from the root hash, matching the host rootfs
approach and giving the initramfs enough information to find the two
partitions without hard-coded UUIDs.

Signed-off-by: colbyt <colby@colbyt.com>
---
 img/app/Makefile       | 21 +++++++++++++++++++--
 img/app/default.nix    |  6 +++++-
 vm/sys/net/Makefile    | 21 +++++++++++++++++++--
 vm/sys/net/default.nix |  6 +++++-
 4 files changed, 48 insertions(+), 6 deletions(-)

diff --git a/img/app/Makefile b/img/app/Makefile
index fd75e6e..6e47570 100644
--- a/img/app/Makefile
+++ b/img/app/Makefile
@@ -15,6 +15,7 @@ VMM = cloud-hypervisor
 
 HOST_BUILD_FILES = \
 	$(imgdir)/appvm/blk/root.img \
+	$(imgdir)/appvm/blk/rootfs.verity.roothash \
 	$(imgdir)/appvm/vmlinux
 
 all: $(HOST_BUILD_FILES)
@@ -24,10 +25,26 @@ $(imgdir)/appvm/vmlinux: $(KERNEL)
 	mkdir -p $$(dirname $@)
 	cp $(KERNEL) $@
 
-$(imgdir)/appvm/blk/root.img: ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/rootfs.erofs
+build/rootfs.verity-timestamp: build/rootfs.erofs
+	mkdir -p build
+	$(VERITYSETUP) format \
+		--root-hash-file build/rootfs.verity.roothash \
+		-- build/rootfs.erofs build/rootfs.verity.superblock
+	echo >> build/rootfs.verity.roothash
+	awk 'length == 64 && !/[^0-9a-f]/ { valid = 1 } END { exit !valid }' \
+		build/rootfs.verity.roothash
+	touch -- $@
+build/rootfs.verity.roothash build/rootfs.verity.superblock: build/rootfs.verity-timestamp
+
+$(imgdir)/appvm/blk/rootfs.verity.roothash: build/rootfs.verity.roothash
+	mkdir -p $$(dirname $@)
+	cp build/rootfs.verity.roothash $@
+
+$(imgdir)/appvm/blk/root.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/rootfs.erofs build/rootfs.verity.roothash build/rootfs.verity.superblock
 	mkdir -p $$(dirname $@)
 	../../scripts/make-gpt.sh $@.tmp \
-	    build/rootfs.erofs:root:5460386f-2203-4911-8694-91400125c604:root
+	    build/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)"):verity \
+	    build/rootfs.erofs:root:$$(../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)"):root
 	mv $@.tmp $@
 
 DIRS = dev host run mnt proc sys tmp \
diff --git a/img/app/default.nix b/img/app/default.nix
index 71e6fa0..ebd37e7 100644
--- a/img/app/default.nix
+++ b/img/app/default.nix
@@ -4,6 +4,7 @@
 import ../../lib/call-package.nix (
 { spectrum-app-tools, spectrum-build-tools, src, terminfo
 , lib, appimageTools, buildFHSEnv, runCommand, stdenvNoCC, writeClosure
+, cryptsetup
 , erofs-utils, jq, s6-rc, util-linux, xorg
 , cacert, linux_latest
 }:
@@ -104,6 +105,7 @@ stdenvNoCC.mkDerivation {
     fileset = lib.fileset.intersection src (lib.fileset.unions [
       ./.
       ../../lib/common.mk
+      ../../scripts/format-uuid.sh
       ../../scripts/make-erofs.sh
       ../../scripts/make-gpt.sh
       ../../scripts/sfdisk-field.awk
@@ -111,7 +113,9 @@ stdenvNoCC.mkDerivation {
   };
   sourceRoot = "source/img/app";
 
-  nativeBuildInputs = [ erofs-utils jq spectrum-build-tools s6-rc util-linux ];
+  nativeBuildInputs = [
+    cryptsetup erofs-utils jq spectrum-build-tools s6-rc util-linux
+  ];
 
   env = {
     KERNEL = "${kernel}/${baseNameOf kernelTarget}";
diff --git a/vm/sys/net/Makefile b/vm/sys/net/Makefile
index 653ef13..c6cf7f2 100644
--- a/vm/sys/net/Makefile
+++ b/vm/sys/net/Makefile
@@ -14,6 +14,7 @@ VMM = cloud-hypervisor
 
 HOST_BUILD_FILES = \
 	$(vmdir)/netvm/blk/root.img \
+	$(vmdir)/netvm/blk/rootfs.verity.roothash \
 	$(vmdir)/netvm/vmlinux
 
 all: $(HOST_BUILD_FILES)
@@ -23,10 +24,26 @@ $(vmdir)/netvm/vmlinux: $(KERNEL)
 	mkdir -p $$(dirname $@)
 	cp $(KERNEL) $@
 
-$(vmdir)/netvm/blk/root.img: ../../../scripts/make-gpt.sh ../../../scripts/sfdisk-field.awk build/rootfs.erofs
+build/rootfs.verity-timestamp: build/rootfs.erofs
+	mkdir -p build
+	$(VERITYSETUP) format \
+		--root-hash-file build/rootfs.verity.roothash \
+		-- build/rootfs.erofs build/rootfs.verity.superblock
+	echo >> build/rootfs.verity.roothash
+	awk 'length == 64 && !/[^0-9a-f]/ { valid = 1 } END { exit !valid }' \
+		build/rootfs.verity.roothash
+	touch -- $@
+build/rootfs.verity.roothash build/rootfs.verity.superblock: build/rootfs.verity-timestamp
+
+$(vmdir)/netvm/blk/rootfs.verity.roothash: build/rootfs.verity.roothash
+	mkdir -p $$(dirname $@)
+	cp build/rootfs.verity.roothash $@
+
+$(vmdir)/netvm/blk/root.img: ../../../scripts/format-uuid.sh ../../../scripts/make-gpt.sh ../../../scripts/sfdisk-field.awk build/rootfs.erofs build/rootfs.verity.roothash build/rootfs.verity.superblock
 	mkdir -p $$(dirname $@)
 	../../../scripts/make-gpt.sh $@.tmp \
-	    build/rootfs.erofs:root:ea21da27-0391-48da-9235-9d2ab2ca7844:root
+	    build/rootfs.verity.superblock:verity:$$(../../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)"):verity \
+	    build/rootfs.erofs:root:$$(../../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)"):root
 	mv $@.tmp $@
 
 DIRS = dev etc/s6-linux-init/env proc run sys
diff --git a/vm/sys/net/default.nix b/vm/sys/net/default.nix
index a722b02..8549bf3 100644
--- a/vm/sys/net/default.nix
+++ b/vm/sys/net/default.nix
@@ -6,6 +6,7 @@ import ../../../lib/call-package.nix (
 pkgsMusl.callPackage (
 
 { lib, stdenvNoCC, nixos, runCommand, writeClosure
+, cryptsetup
 , erofs-utils, jq, s6-rc, util-linux, xorg
 , busybox, dbus, execline, iwd, kmod, linuxPackagesFor, linux_latest
 , mdevd, nftables, s6, s6-linux-init, spectrum-driver-tools, xdp-tools
@@ -110,6 +111,7 @@ stdenvNoCC.mkDerivation {
     fileset = lib.fileset.intersection src (lib.fileset.unions [
       ./.
       ../../../lib/common.mk
+      ../../../scripts/format-uuid.sh
       ../../../scripts/make-erofs.sh
       ../../../scripts/make-gpt.sh
       ../../../scripts/sfdisk-field.awk
@@ -117,7 +119,9 @@ stdenvNoCC.mkDerivation {
   };
   sourceRoot = "source/vm/sys/net";
 
-  nativeBuildInputs = [ erofs-utils jq spectrum-build-tools s6-rc util-linux ];
+  nativeBuildInputs = [
+    cryptsetup erofs-utils jq spectrum-build-tools s6-rc util-linux
+  ];
 
   env = {
     KERNEL = "${kernel}/${baseNameOf kernelTarget}";
-- 
2.54.0