Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Switch from raw to QCOW2 and 2MB to 4MB firmware, adjust firmware variables creation #2434

Merged
merged 6 commits into from
Nov 12, 2024
Merged

Switch from raw to QCOW2 and 2MB to 4MB firmware, adjust firmware variables creation #2434

merged 6 commits into from
Nov 12, 2024

Commits on Nov 12, 2024

  1. ci-automation: Include --qemu-ovmf-vars in qemu_update test for arm64 

    Kola's logic for choosing BIOS vs EFI isn't too smart, and not
specifying --qemu-ovmf-vars leads to it passing -bios to QEMU. This
doesn't make sense for arm64, but it did work anyway with the old
firmware in raw format. The new firmware in QCOW2 format doesn't work
this way.

Signed-off-by: James Le Cuirot <[email protected]>
    @chewi
    chewi committed Nov 12, 2024
    Configuration menu
    Copy the full SHA
    d67c395 View commit details
    Browse the repository at this point in the history

  2. Switch from raw (.fd) EDK2 firmware images to QCOW2, plus 4MB on amd64 

    The new arm64 firmware supporting Secure Boot (see next commit) is in
QCOW2 format only, avoiding the extra space taken up by the 64MB
padding. Supporting both raw and QCOW2 images would be messy, so switch
entirely to QCOW2.

Only the 4MB images are in QCOW2 format on amd64, so also switch away
from the 2MB images. 4MB images are now the default for most
distributions as they are needed to apply certain Windows updates.

Signed-off-by: James Le Cuirot <[email protected]>
    @chewi
    chewi committed Nov 12, 2024
    Configuration menu
    Copy the full SHA
    d1ba9b1 View commit details
    Browse the repository at this point in the history

  3. sys-firmware/edk2-aarch64: Drop in favour of edk2-bin 

    edk2-bin now supports multiple platforms, including QEMU on arm64, so we
no longer need to use Fedora's build. Note that the Secure Boot
implementation is currently insecure as it lacks SMM, which is needed to
protect the EFI variable store.

Signed-off-by: James Le Cuirot <[email protected]>
    @chewi
    chewi committed Nov 12, 2024
    Configuration menu
    Copy the full SHA
    e50fe0a View commit details
    Browse the repository at this point in the history

  4. Reuse Secure Boot EFI variables image prepared by Gentoo 

    Rather than starting with a blank image, reuse the image that already
has the Microsoft certificates and the latest DBX revocation list
applied. Gentoo also applies the Red Hat certificates, which we don't
need, but this is okay.

Signed-off-by: James Le Cuirot <[email protected]>
    @chewi
    chewi committed Nov 12, 2024
    Configuration menu
    Copy the full SHA
    c0b58cf View commit details
    Browse the repository at this point in the history

  5. coreos-base/coreos-sb-keys: Drop unnecessary PK and KEK certificates 

    These are only needed when you are going to ship DB updates to existing
systems, which we are not going to do. Our EFI variables are only for
testing. End users are expected to use EFI variables provided by their
hosts or hardware vendors. We presumably provided these before because
some PK and KEK does need to be provided, but we can now use the
Microsoft and Red Hat ones provided via Gentoo's edk2 package.

Signed-off-by: James Le Cuirot <[email protected]>
    @chewi
    chewi committed Nov 12, 2024
    Configuration menu
    Copy the full SHA
    5125317 View commit details
    Browse the repository at this point in the history

  6. sys-boot/mokutil: Install on arm64 now that it supports Secure Boot 

    Signed-off-by: James Le Cuirot <[email protected]>
    @chewi
    chewi committed Nov 12, 2024
    Configuration menu
    Copy the full SHA
    010afcd View commit details
    Browse the repository at this point in the history