auto-enroll: use safe auto enrollment rather than YOLO enrollment #229
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Depends on QMP API being upstreamed. |
RaitoBezarius
force-pushed
the
systemd-sb-enroll
branch
2 times, most recently
from
dd82f71 to
56f0a64
Compare
|
Note to myself: finish merging the stuff inside of nixpkgs for the QMP. |
I remeber that you explained to me in person why this is needed, but I think I forgot. Wouldn't this solution be just as bad/good as our current solution? |
nikstur
reviewed
Jan 22, 2024
RaitoBezarius
force-pushed
the
systemd-sb-enroll
branch
from
56f0a64 to
596bf9b
Compare
RaitoBezarius
force-pushed
the
systemd-sb-enroll
branch
from
596bf9b to
996d722
Compare
RaitoBezarius
force-pushed
the
systemd-sb-enroll
branch
from
996d722 to
41383fa
Compare
|
ffs: it doesn't enroll on aarch64. |
RaitoBezarius
force-pushed
the
systemd-sb-enroll
branch
from
41383fa to
280392c
Compare
|
and now I assume that events for aarch64 VMs are fried... |
This uses the systemd semantics for automatic enrollment at boot time. For now, it is very simple, in the future, we can better use this option to push the proper auth files with names or have Type #1 entries for enrollment. :)
RaitoBezarius
force-pushed
the
systemd-sb-enroll
branch
from
280392c to
c6e4ea5
Compare
|
OK, I was holding my own code wrong. |
|
Ah yes,
|
blitz
reviewed
Mar 19, 2024
| @@ -147,7 +162,32 @@ let | |||
| }; | |||
| boot.lanzaboote = { | |||
| enable = true; | |||
| enrollKeys = lib.mkDefault true; | |||
| # Under aarch64, various things goes wrong... | |||
There was a problem hiding this comment.
nit: You could elaborate here a bit, so people know why this wrinkle exists and when it may go away.
blitz
approved these changes
Mar 19, 2024
There was a problem hiding this comment.
Looks good to me!
@RaitoBezarius It looks like the tests need some love. Feel free to merge after fixing them.
4 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This uses the systemd semantics for automatic enrollment at boot time.
For now, it is very simple, in the future, we can better use this option to push the proper auth files with names or have Type #1 entries for enrollment. :)
This PR relies on unreleased commits in nixpkgs for the testing framework to detect properly for EFI resets as for some reason this makes the whole thing hangs otherwise…In other news, your wish has been granted @blitz !