Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

DNM: OCI layer signature support #304

Open
wants to merge 52 commits into
base: msft-main
Choose a base branch
from
Open

DNM: OCI layer signature support #304

wants to merge 52 commits into from

Conversation

jiria
Copy link
Member

@jiria jiria commented Feb 5, 2025

Merge Checklist
  • Followed patch format from upstream recommendation: https://github.com/kata-containers/community/blob/main/CONTRIBUTING.md#patch-format
    • Included a single commit in a given PR - at least unless there are related commits and each makes sense as a change on its own.
  • Aware about the PR to be merged using "create a merge commit" rather than "squash and merge" (or similar)
  • The upstream/missing label (or upstream/not-needed) has been set on the PR.
Summary
Test Methodology

miz060 and others added 30 commits December 6, 2024 17:50
@miz060
Debug: modify Makefile
1cac817
@miz060
prototype implementation dm-verity
307c553
@miz060
debug1
373d97d
@miz060
debug2
acb4830
@miz060
debug3
44923d2
@miz060
debug4
4bc9b10
@miz060
debug5
df43ebe
@miz060
debug6
1092096
@miz060
debug7
ab0e444
@miz060
debug8
fc7bdd3
@miz060
debug9
f5c5b5a
@miz060
debug10
efbfe83
@miz060
debug11
dc68ce4
@miz060
debug11
8f948ad
@miz060
debug12
0b27725
@miz060
12/10 debug1
f17e27d
@miz060
Add more debug info
64cdeb9
@miz060
add more logs
0dff4cc
@miz060
do mount only with mount flow
c6b4174
@miz060
Add tarfs mounting
7c00acc
@miz060
Remove unnecessary directory replication during overlayfs creation
ed6c9ee
@miz060
Remove wrong clear and check lowerdir string length
ef8e42c
@jiria
Initial support for container verity image signing
1fb34af
@jiria
Add support for random salt
ccc52f7
@jiria
Use layer_digest instead of diff_id and also support bulk import of i…
441327e 
…mages
@jiria
Update snapshotter to include support for using verity root hash sign…
4ac972b 
…atures
@jiria
Better error messages
c8ba8de
@jiria
Use format
89e8898
@jiria
Switch overlay mounting logic
02fb5b9
@jiria
Cleanup the service file
1466645
jiria and others added 22 commits December 31, 2024 16:47
@jiria
Add input checks
5e3dd0d
@jiria
Update .service to make it more resilient
4386a18
@jiria
Store salts and sigs in the labels to allow for reloading of the sign…
553984a 
…ature json
@jiria
Extend the signing tool to support uncompressed layers
14d4b03
@jiria
Add support for docker tar layers
6cb5b30
@jiria
Use mediatype label from containerd
701efad
@miz060
Extend layer decompression based on mediatype label from containerd
0820687
@miz060
Fix fetching and renaming order
e361b00
@miz060
refactor to avoid error
2d3c817
@miz060
Address comment
fe5e1ce
@miz060
Merge pull request #284 from microsoft/mitchzhu/solar
f310713 
Extend layer decompression based on mediatype label from containerd
@jiria
Cleanup naming plus workaround
ea3822c
@jiria
Do not truncate if reusing the existing image
40f0d90
@miz060
Improve tardev logging
e938ee4
@miz060
Add info logging
35a02ac
@miz060
Add error mapping
a7e7b99
@miz060
Merge pull request #289 from microsoft/mitchzhu/improve_tardev_logs
f19e9d1 
Improve tardev-snapshotter log levels
@jiria
Cleanup white spaces
cedcd2b
@jiria
Use "overlay" as a source when mounting overlay
8b742d9
@miz060
Add retry logic to layer fetching and decompression
24ed368
@miz060
Address comment
fdfa224
@miz060
Merge pull request #291 from microsoft/mitchzhu/add_retry
66d2248 
Add retry logic to image layer fetching and decompression
@jiria jiria requested review from a team as code owners February 5, 2025 02:01
@jiria jiria changed the title Jiria/solar OCI layer signature support Feb 5, 2025
sprt
sprt reviewed Feb 5, 2025
View reviewed changes
tools/osbuilder/node-builder/azure-linux/Makefile
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc @ms-mahuber - these changes probably break the current dev flow.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, should have clarified, this is not yet ready for merging. The current proposal is to:

  1. syphon out the changes to tardev-snapshotter and merge those (perhaps modulo the salt changes)
  2. refactor the new tool to better align with gen policy

@jiria jiria changed the title OCI layer signature support DNM: OCI layer signature support Feb 5, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sprt sprt sprt left review comments

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@jiria @sprt @miz060