Feat: SecureBoot support

.github/workflows/build-release.yml

@@ -62,12 +62,20 @@ jobs:
         run: |
           echo "ARCH=$(just _get_arch)" >> "$GITHUB_ENV"
 
-      - name: Generate key
-        run: just genkey
+      # Private key used for verity check and secureboot
+      - name: Inject mkosi private key
+        env:
+          MKOSI_SECRET_KEY: ${{ secrets.MKOSI_SECRET_KEY }}
+        run: |
+          echo "$MKOSI_SECRET_KEY" > mkosi.key
+          chmod 600 mkosi.key
 
       - name: Build with mkosi
-        # Will either run do-daily or do-stable
-        run: just do-${{ inputs.stream }}
+        # Will either run do-daily, do-stable or do-proposed,
+        # then shred the key to make sure it's never accidently uploaded
+        run: |
+         just do-${{ inputs.stream }}
+         shred mkosi.key --remove -s 1k
 
       - name: Generate SHA256SUMS (all partitions)
         run: just checksum-repo

Justfile

@@ -1,16 +1,6 @@
-default:
-    #!/usr/bin/env bash
-    set -xeuo pipefail
+default: 
     just --choose
 
-_do-release stream:
-    #!/usr/bin/env bash
-    sudo rm -rf mkosi.output/ && \
-    just mkosi -B --debug --profile={{stream}} --force --workspace-directory=/workspace && \
-    sudo PROFILE={{stream}} SQUASHFS_LEVEL="${SQUASHFS_LEVEL:-}" ./assemble-iso.sh
-    sudo just compress-repo
-    sudo chown -R "$(id -u):$(id -g)" mkosi.output
-    sudo chmod -R u+rwX mkosi.output
 
 # Built every day from the main branch
 do-daily: (_do-release "daily")
@@ -21,21 +11,57 @@ do-stable: (_do-release "stable")
 # Built from PRs
 do-proposed: (_do-release "proposed")
 
+_do-release stream:
+    #!/usr/bin/env bash
+    sudo rm -rf mkosi.output/ && \
+    just mkosi -B --debug --profile={{stream}} --force --workspace-directory=/workspace && \
+    sudo PROFILE={{stream}} SQUASHFS_LEVEL="${SQUASHFS_LEVEL:-}" ./assemble-iso.sh
+    sudo just compress-repo
+    sudo chown -R "$(id -u):$(id -g)" mkosi.output
+    sudo chmod -R u+rwX mkosi.output
+
+# Get arch directly from systemd, to get the same format as mkosi
 _get_arch:
     @systemd-analyze architectures | awk '/native/ {print $1}'
 
+# Get current mkosi.version value
 _get_timestamp:
     #!/usr/bin/env bash
     set -euo pipefail
     echo "$(cat ./mkosi.version)"
 
-genkey:
-    just mkosi genkey
+
+# > Name: Owner of the key
+# > Days: Days before the key expires
+# Generate a new key if there is no existing ones
+genkey name=`whoami` days="7":
+    #!/usr/bin/env bash
+    set -euo pipefail
+    if [ ! -f "./mkosi.key" ]; then
+        rm -f ./mkosi.crt
+        echo "Generating a new cert for {{name}}, valid for the next {{days}} days..."
+        just _podman_mkosi genkey --genkey-common-name="{{name}}" --genkey-valid-days="{{days}}"
+        echo "Done!"
+    fi
+    echo "Certificate OK"
+
+# > Name: Owner of the key
+# > Days: Days before the key expires
+# Delete old key and generate a new one
+regenkey name=`whoami` days="7":
+    rm -f mkosi.{crt,key}
+    echo "Old keys removed"
+    just genkey "{{name}}" "{{days}}"
+
 
 mkosi +subcommand:
+    #!/usr/bin/env bash
+    just genkey
+    just _podman_mkosi {{subcommand}}
+
+_podman_mkosi +args:
     mkdir -p {{env_var('HOME')}}/.cache/mkosi-workspace
     sudo mkdir -p ~/.cache/mkosi
-
     sudo podman run --rm \
         --network host \
         --dns 8.8.8.8 \
@@ -47,8 +73,7 @@ mkosi +subcommand:
         -w /work \
         -v "{{env_var('HOME')}}/.cache/mkosi-workspace:/workspace" \
         ghcr.io/elementary/mkosi:tanit \
-        mkosi {{subcommand}}
-
+        mkosi {{args}}
 
 
 clean:

mkosi.crt

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC0zCCAbugAwIBAgIUT0O+TbPDE/UaUn/szdYuMaokBdowDQYJKoZIhvcNAQEL
+BQAwEjEQMA4GA1UEAwwHanVtcHl2aTAeFw0yNjEwMTAwMDU1MDJaFw0yNjEwMjAw
+MDU1MDJaMBIxEDAOBgNVBAMMB2p1bXB5dmkwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQDBhib+dnGeG15Wo+3j9ZQFGmR/eoUwmhfQGTVzQ8zQvY6fksvc
+lezJ3YZ2aq57b2bADiHxFOeAJ2qvHbXMVDcn6tBXavWdnJuzPwGs+wdQ9/CFIKA9
+YY5j6xP1/N//BtJ/gK/AJZ7G9Ox3shhWSLaFYu1HiklPVhtdHmf87zn5/pV+vwKs
+P9aRE7FgcaCBSWu+V9lItEnZsxjmOBJsHf9mmkYxS8PbSJPkjL7qZ918PAwGt1Ei
+a+MiKYK2TrOItYAvR7hS+wLQPfWYJbL0435MisbM1IXztOmbF+JUw9YQcUgZdTOJ
+kYxFuyY7ZXs1zi9JzNgNB9hBhvtQqD7vjL3/AgMBAAGjITAfMB0GA1UdDgQWBBS6
+v4+0zpb6677zXuvaSUV/8blErjANBgkqhkiG9w0BAQsFAAOCAQEAUTMBO2gTepbw
+iTvutdbFjgJ90OgJ8iheYGKex3FDlghpjGRlHLZnj3E3hO/dT1INhssxMYak3gH9
+nMg7poUcg0xhJxxoF+ogzDBJg9svOz+dDgpgrSOdugLtmAXwRo97rJu2miFHKrQB
+hvQaIGbvOkJWKfnL0rehoumkN/rXE8Buhg4DXNVG0HQbtdz+yLR8Nf/WBGjVtCMm
+yZr9momDal8fW+8/3utNCU1BoXKPS24ipcujKPoqCfMpw5aw19TS+zTQoL7ivdSG
+woqFyoJ5PswtZQGUb3CZw0goYTbg4jNIkaxQiSo+Enu2y3HoCYhTt2WTf6nsSuZf
+2nrlHSylxA==
+-----END CERTIFICATE-----

mkosi.images/sysupdate/mkosi.conf

@@ -45,5 +45,5 @@ KernelCommandLine=
     ipe.enforce=0
 
 [Validation]
-SecureBoot=no
-SignExpectedPcr=no
+SecureBoot=yes
+SignExpectedPcr=yes