From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id D3A5BA4CB; Thu, 25 Jun 2026 20:21:17 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id C86A8A495; Thu, 25 Jun 2026 20:21:14 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS autolearn=unavailable autolearn_force=no version=4.0.1 Received: from mail-106112.protonmail.ch (mail-106112.protonmail.ch [79.135.106.112]) by atuin.qyliss.net (Postfix) with ESMTPS id 8BAFFA45C for ; Thu, 25 Jun 2026 20:21:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=colbyt.com; s=protonmail; t=1782418872; x=1782678072; bh=5AG+7LgDxJQX0eWrhNnAVbCZ7YKv/rair8ZO4pHL2bM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:From:To: Cc:Date:Subject:Reply-To:Feedback-ID:Message-ID:BIMI-Selector; b=iIaQCPCCSMo8fEhk/cUx6+dqJDQPLCsBOS568MTDHO6kEoD/vEZi4dHszi24MWJSw FaEcpj0cv4XJEmWIRATCJ1mjJutm21UJb0VVHiOk2n2EiknjIkACTuAzRqk/Exnc+h m70wYe74k/ZdYGghKN7dcZpd+SkJBXoQkVDt6GmkYBQgTl1bOn9YIZoGpIfzAPIpIU 0SMgttqNnG/qvcspPXEaEvxVSsCcneiafgA3yfjmemmHYNeYKm8hLyvSpw43tq/PoK 3XNfyw1/Dth4iGhYaR7QxFkaVU061SHAyvdJSeiHjbLRl+v95sEOGd87eeCF+n/CJL wdjURsPHvV89g== X-Pm-Submission-Id: 4gmVYy3jQbz1DDr8 From: colbyt To: devel@spectrum-os.org Subject: [PATCH 1/5] vm: generate dm-verity metadata for sub-VM roots Date: Thu, 25 Jun 2026 13:20:09 -0700 Message-ID: <20260625202013.1417254-2-colby@colbyt.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260625202013.1417254-1-colby@colbyt.com> References: <20260625202013.1417254-1-colby@colbyt.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: U4YY4RZUU35BX5ATIIQ7GOFMVPCI2EWH X-Message-ID-Hash: U4YY4RZUU35BX5ATIIQ7GOFMVPCI2EWH X-MailFrom: colby@colbyt.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: colbyt X-Mailman-Version: 3.3.10 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Generate dm-verity metadata for the app VM and net VM root filesystems, and install the root hash next to each VM disk image. The disk layout now has separate verity and root partitions. Both partition UUIDs are derived from the root hash, matching the host rootfs approach and giving the initramfs enough information to find the two partitions without hard-coded UUIDs. Signed-off-by: colbyt --- img/app/Makefile | 21 +++++++++++++++++++-- img/app/default.nix | 6 +++++- vm/sys/net/Makefile | 21 +++++++++++++++++++-- vm/sys/net/default.nix | 6 +++++- 4 files changed, 48 insertions(+), 6 deletions(-) diff --git a/img/app/Makefile b/img/app/Makefile index fd75e6e..6e47570 100644 --- a/img/app/Makefile +++ b/img/app/Makefile @@ -15,6 +15,7 @@ VMM = cloud-hypervisor HOST_BUILD_FILES = \ $(imgdir)/appvm/blk/root.img \ + $(imgdir)/appvm/blk/rootfs.verity.roothash \ $(imgdir)/appvm/vmlinux all: $(HOST_BUILD_FILES) @@ -24,10 +25,26 @@ $(imgdir)/appvm/vmlinux: $(KERNEL) mkdir -p $$(dirname $@) cp $(KERNEL) $@ -$(imgdir)/appvm/blk/root.img: ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/rootfs.erofs +build/rootfs.verity-timestamp: build/rootfs.erofs + mkdir -p build + $(VERITYSETUP) format \ + --root-hash-file build/rootfs.verity.roothash \ + -- build/rootfs.erofs build/rootfs.verity.superblock + echo >> build/rootfs.verity.roothash + awk 'length == 64 && !/[^0-9a-f]/ { valid = 1 } END { exit !valid }' \ + build/rootfs.verity.roothash + touch -- $@ +build/rootfs.verity.roothash build/rootfs.verity.superblock: build/rootfs.verity-timestamp + +$(imgdir)/appvm/blk/rootfs.verity.roothash: build/rootfs.verity.roothash + mkdir -p $$(dirname $@) + cp build/rootfs.verity.roothash $@ + +$(imgdir)/appvm/blk/root.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/rootfs.erofs build/rootfs.verity.roothash build/rootfs.verity.superblock mkdir -p $$(dirname $@) ../../scripts/make-gpt.sh $@.tmp \ - build/rootfs.erofs:root:5460386f-2203-4911-8694-91400125c604:root + build/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)"):verity \ + build/rootfs.erofs:root:$$(../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)"):root mv $@.tmp $@ DIRS = dev host run mnt proc sys tmp \ diff --git a/img/app/default.nix b/img/app/default.nix index 71e6fa0..ebd37e7 100644 --- a/img/app/default.nix +++ b/img/app/default.nix @@ -4,6 +4,7 @@ import ../../lib/call-package.nix ( { spectrum-app-tools, spectrum-build-tools, src, terminfo , lib, appimageTools, buildFHSEnv, runCommand, stdenvNoCC, writeClosure +, cryptsetup , erofs-utils, jq, s6-rc, util-linux, xorg , cacert, linux_latest }: @@ -104,6 +105,7 @@ stdenvNoCC.mkDerivation { fileset = lib.fileset.intersection src (lib.fileset.unions [ ./. ../../lib/common.mk + ../../scripts/format-uuid.sh ../../scripts/make-erofs.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk @@ -111,7 +113,9 @@ stdenvNoCC.mkDerivation { }; sourceRoot = "source/img/app"; - nativeBuildInputs = [ erofs-utils jq spectrum-build-tools s6-rc util-linux ]; + nativeBuildInputs = [ + cryptsetup erofs-utils jq spectrum-build-tools s6-rc util-linux + ]; env = { KERNEL = "${kernel}/${baseNameOf kernelTarget}"; diff --git a/vm/sys/net/Makefile b/vm/sys/net/Makefile index 653ef13..c6cf7f2 100644 --- a/vm/sys/net/Makefile +++ b/vm/sys/net/Makefile @@ -14,6 +14,7 @@ VMM = cloud-hypervisor HOST_BUILD_FILES = \ $(vmdir)/netvm/blk/root.img \ + $(vmdir)/netvm/blk/rootfs.verity.roothash \ $(vmdir)/netvm/vmlinux all: $(HOST_BUILD_FILES) @@ -23,10 +24,26 @@ $(vmdir)/netvm/vmlinux: $(KERNEL) mkdir -p $$(dirname $@) cp $(KERNEL) $@ -$(vmdir)/netvm/blk/root.img: ../../../scripts/make-gpt.sh ../../../scripts/sfdisk-field.awk build/rootfs.erofs +build/rootfs.verity-timestamp: build/rootfs.erofs + mkdir -p build + $(VERITYSETUP) format \ + --root-hash-file build/rootfs.verity.roothash \ + -- build/rootfs.erofs build/rootfs.verity.superblock + echo >> build/rootfs.verity.roothash + awk 'length == 64 && !/[^0-9a-f]/ { valid = 1 } END { exit !valid }' \ + build/rootfs.verity.roothash + touch -- $@ +build/rootfs.verity.roothash build/rootfs.verity.superblock: build/rootfs.verity-timestamp + +$(vmdir)/netvm/blk/rootfs.verity.roothash: build/rootfs.verity.roothash + mkdir -p $$(dirname $@) + cp build/rootfs.verity.roothash $@ + +$(vmdir)/netvm/blk/root.img: ../../../scripts/format-uuid.sh ../../../scripts/make-gpt.sh ../../../scripts/sfdisk-field.awk build/rootfs.erofs build/rootfs.verity.roothash build/rootfs.verity.superblock mkdir -p $$(dirname $@) ../../../scripts/make-gpt.sh $@.tmp \ - build/rootfs.erofs:root:ea21da27-0391-48da-9235-9d2ab2ca7844:root + build/rootfs.verity.superblock:verity:$$(../../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)"):verity \ + build/rootfs.erofs:root:$$(../../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)"):root mv $@.tmp $@ DIRS = dev etc/s6-linux-init/env proc run sys diff --git a/vm/sys/net/default.nix b/vm/sys/net/default.nix index a722b02..8549bf3 100644 --- a/vm/sys/net/default.nix +++ b/vm/sys/net/default.nix @@ -6,6 +6,7 @@ import ../../../lib/call-package.nix ( pkgsMusl.callPackage ( { lib, stdenvNoCC, nixos, runCommand, writeClosure +, cryptsetup , erofs-utils, jq, s6-rc, util-linux, xorg , busybox, dbus, execline, iwd, kmod, linuxPackagesFor, linux_latest , mdevd, nftables, s6, s6-linux-init, spectrum-driver-tools, xdp-tools @@ -110,6 +111,7 @@ stdenvNoCC.mkDerivation { fileset = lib.fileset.intersection src (lib.fileset.unions [ ./. ../../../lib/common.mk + ../../../scripts/format-uuid.sh ../../../scripts/make-erofs.sh ../../../scripts/make-gpt.sh ../../../scripts/sfdisk-field.awk @@ -117,7 +119,9 @@ stdenvNoCC.mkDerivation { }; sourceRoot = "source/vm/sys/net"; - nativeBuildInputs = [ erofs-utils jq spectrum-build-tools s6-rc util-linux ]; + nativeBuildInputs = [ + cryptsetup erofs-utils jq spectrum-build-tools s6-rc util-linux + ]; env = { KERNEL = "${kernel}/${baseNameOf kernelTarget}"; -- 2.54.0