sync(feat/swtpm-ci): merge fork main updates#7
Open
foil-copy-overrate wants to merge 9 commits into
Open
Conversation
Attach a swtpm-backed QEMU emulator TPM so /dev/tpm0 is present in bcvk ephemeral VMs, enabling TPM2 test coverage (PCR, LUKS2 PCR binding, ConditionSecurity=measured-os) without physical hardware. Test-only; yubiOS production RoT stays YubiKey FIDO2. - crates/bcvk-qemu/src/swtpm.rs: pure builders (swtpm argv + QEMU tpm args, arch-aware tpm-crb/tpm-tis-device) + table-driven unit tests - qemu.rs: QemuConfig.swtpm field, enable_swtpm(), device emission in spawn(), host swtpm process spawn (spawn_swtpm) wired into RunningQemu - run_ephemeral.rs: --swtpm flag on CommonVmOpts - docs/swtpm.md: usage + rationale (QEMU emulator device vs guest systemd-tpm2-swtpm.service under direct boot) Refs: #3 Assisted-by: Sauna (claude-sonnet-4-6)
Adds a --swu2f flag to bcvk ephemeral run. Because QEMU only emulates CTAP1 (u2f-emulated, no hmac-secret) and systemd-cryptenroll/LUKS2 FIDO2 unlock require CTAP2 hmac-secret, the authenticator runs inside the guest over /dev/uhid (e.g. fidorium/passless). bcvk only ensures the uhid module is loaded via modules-load=uhid; the authenticator binary ships in the test image (image side, like swtpm/swtpm-tools). New module crates/bcvk-qemu/src/swu2f.rs (Swu2fConfig + uhid karg builders, table-driven unit tests), wired through CommonVmOpts and the ephemeral run cmdline. Docs in docs/swu2f.md. For yubiOS issue bootc-dev#25 (post-launch software FIDO2 emulator). Test-only; production trust stays on the YubiKey FIDO2 device (ADR-003). Assisted-by: Sauna (claude-opus-4.8)
Mirror the swtpm split for FIDO2/U2F so yubiOS can test pam-u2f and systemd-cryptenroll FIDO2 paths without a physical YubiKey. - crates/bcvk-qemu/src/swu2f.rs: pure builder for the QEMU `u2f-emulated` (libu2f-emu) USB HID U2F/CTAP1 token (-usb -device u2f-emulated[,dir=]), ephemeral or setup-dir identity + table tests - lib.rs: expose `swu2f` module + re-export `Swu2fConfig` - docs/swu2f.md: spec. Layer 1 = QEMU u2f-emulated (CTAP1, covers pam-u2f); Layer 2 = in-guest /dev/uhid CTAP2 authenticator (FIDO2 hmac-secret) for systemd-cryptenroll --fido2, staged as a separate guest-image PR. Test-only; yubiOS production RoT stays YubiKey FIDO2 (ADR-003). Not compiled here — needs cargo build + nextest + human Signed-off-by. Refs: yubi-OS/yubiOS#25 Assisted-by: Sauna (FOLLOWER_2)
HEAD be5f385 rewrote swu2f.rs to the host QEMU u2f-emulated (CTAP1) route and dropped push_uhid_kargs, but run_ephemeral.rs:1420 still calls bcvk_qemu::swu2f::push_uhid_kargs -> dangling symbol, kit fails to build. QEMU u2f-emulated is CTAP1/U2F-only (no hmac-secret) and cannot drive systemd-cryptenroll --fido2 for the LUKS2 FIDO2 e2e test (bootc-dev#33/bootc-dev#20); the --swu2f flag help already says it exposes /dev/uhid. Restore the in-guest uhid module (push_uhid_kargs + uhid Swu2fConfig, per 66fbf13) so run_ephemeral resolves and cargo check passes, and reconcile docs/swu2f.md to match (Layer 2 uhid implemented; Layer 1 QEMU u2f-emulated documented as a not-yet-wired pam-u2f-only option). Test-only; prod RoT stays YubiKey (ADR-003). Refs bootc-dev#25. No merge.
…on feat/swtpm-ci HEAD be5f385 rewrote swu2f.rs to the host-QEMU u2f-emulated route (qemu_u2f_args/Swu2fConfig) and dropped push_uhid_kargs, but crates/kit/src/run_ephemeral.rs:1420 still calls bcvk_qemu::swu2f::push_uhid_kargs(&mut kernel_cmdline) -> dangling symbol, crate fails to compile. Canonical route is in-guest /dev/uhid CTAP2 (per cult-leader decision): QEMU u2f-emulated is CTAP1/U2F-only (no hmac-secret) so it cannot drive systemd-cryptenroll --fido2 that the LUKS2 e2e (bootc-dev#33) needs. Restore the original in-guest swu2f.rs (push_uhid_kargs + uhid_karg + Swu2fConfig + table tests) so the --swu2f flag (modules-load=uhid) and run_ephemeral call site line up again. lib.rs re-export of Swu2fConfig stays valid. Refs yubi-OS/yubiOS#25, unblocks bootc-dev#33. bcvk feature branch, no merge. Assisted-by: Sauna (claude)
…yubi-OS/yubiOS bootc-dev#9/bootc-dev#20 — silent rc=2 with empty piped stderr)
…lure error (yubi-OS/yubiOS bootc-dev#9/bootc-dev#20)
…(bwrap userns fix)
# Conflicts: # crates/kit/src/run_ephemeral.rs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mainintofeat/swtpm-ciso this branch carries the 9 upstream commits now present on the fork main branch.crates/kit/src/run_ephemeral.rsCommonVmOptsconflict by keeping the branch's--swtpmand--swu2ftest options while adding upstream's--outputand--log-dirfields.Testing
cargo fmt --checkcargo test --workspace --lib --binsAssisted-by: AI