feat(cryptpilot-convert): pin systemd UEFI stub via --uki-stub-version - #133
Merged
Conversation
|
@imlk0 ，您好，您的请求已接收，请耐心等待结果。 |
|
@imlk0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。 |
|
@imlk0 ，您好，您的请求已接收，请耐心等待结果。 |
|
@imlk0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。 |
Add a --uki-stub-version <distro|version> option (requires --uki) to
control the source of the systemd UEFI stub (linuxx64.efi.stub) used
to assemble the UKI:
- "distro" (default) installs systemd-boot-unsigned from the distro
repo, preserving the legacy version-floating behavior.
- A version prefix (e.g. 261, 261.2-1) downloads a pinned, unsigned
stub from the public Arch Linux Archive, resolved to the highest
matching package. The prefix must be followed by a segment boundary
("." or "-") so a short prefix like "25" does not silently jump to
259.x; on no match the error lists the available versions.
The pinned stub is downloaded (curl) and extracted (zstd + tar) on the
host, placed at the canonical path dracut --uefi expects, then removed
(restoring any pre-existing one) so the converted image's rootfs is
byte-for-byte unchanged. The resolved exact version and stub sha256 are
logged for measurement traceability.
Different systemd-stub versions measure into PCR4/PCR8/PCR12
differently; pinning the stub keeps the UKI measurement reference
values stable across builds.
Also install curl/zstd/tar when the Arch path is selected, and preflight
those tools with a clear actionable error.
Docs (boot.md/boot_zh.md, quick-start) updated.
Verified end-to-end on an Alinux 4 image: --uki-stub-version 261
resolves to systemd-261.2-1 (sha256 2d9b8073...) and 260 to
systemd-260.2-2 (sha256 26e9f431...), yielding distinct UKI
measurement.uki.SHA-384 values; the embedded stub in the produced
qcow2 matches the expected Arch stub byte-for-byte (.sbat).
Signed-off-by: Kun Lai <laikun@linux.alibaba.com>
Assisted-by: Claude:glm-5.2
Document the project's commit conventions in the Git Commit Requirements
section:
- Require a Signed-off-by trailer with the author's own identity on every
commit (git commit -s, or added by hand).
- Require an Assisted-by trailer (AGENT_NAME:MODEL_VERSION [TOOLS]) as the
only accepted form of AI attribution on Claude-authored commits.
- Never commit plan/spec files or anything that is gitignored.
- Never hand-edit cryptpilot.spec Version/Release/%changelog; version and
changelog are produced at release time by make bump-version-{major,minor,patch}.
Signed-off-by: Kun Lai <laikun@linux.alibaba.com>
Assisted-by: Claude:glm-5.2
imlk0
force-pushed
the
stable-systemd-stub
branch
from
August 31, 2026 06:51
2bf56c0 to
b899655
Compare
|
@imlk0 ，您好，您的请求已接收，请耐心等待结果。 |
|
@imlk0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。 |
|
@imlk0 ，您好，您的请求已接收，请耐心等待结果。 |
|
@imlk0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Background
Different
systemd-stubversions measure into PCR4/PCR8/PCR12 differently. Today the stub is sourced on demand from the distro repo (yum install systemd-boot-unsigned), so its version floats with the distro and the UKI measurement reference is unstable across builds.Change
Add
--uki-stub-version <distro|version>(only meaningful with--uki):distro(default) — installssystemd-boot-unsignedfrom the distro repo. Preserves the legacy behavior; the default is unchanged.<version-prefix>— downloads a pinned, unsigned stub from the public Arch Linux Archive, resolved to the highest matching package. The prefix must be followed by a segment boundary (.or-), so261resolves to the latest261.xwhile25does not silently jump to259.x— it errors and lists the available versions.261261.x(e.g.261.2-1)261.2261.2-1261.2-1261.2-1The pinned stub is downloaded (
curl) and extracted (zstd+tar) on the host, placed at the canonical path…/boot/efi/linuxx64.efi.stubthat dracut--uefiexpects, then removed (restoring any pre-existing one) so the converted image's rootfs is byte-for-byte unchanged. The resolved exact version and stubsha256are logged, so a loose prefix can be verified once and then pinned exactly.curl/zstd/tarare installed at step 0 when the Arch path is selected, and prefetched with a clear error if still missing.Why Arch
systemd upstream ships no prebuilt EFI binaries. The Arch Linux Archive is public, unsigned (fine for measurement), and permanently archives every historical package version — true version pinning. Fedora koji and other distro archives were also surveyed; Arch is the only one that satisfies public + unsigned + full historical pinning + reachability.
Verification
End-to-end on an Alinux 4 image, inside an alinux4 container (host
e2fsck1.46 is too old for the alinux4 ext4):--uki-stub-version 261->systemd-261.2-1, stub sha2562d9b8073…ba18->measurement.uki.SHA-38419296c51…e9c8c25--uki-stub-version 260->systemd-260.2-2, stub sha25626e9f431…2d1b->measurement.uki.SHA-384afabccc6…1f7716abDistinct stubs yield distinct measurements — confirming version pinning is what stabilizes the PCR reference. The converted rootfs is left unchanged (the placed stub is removed; the dir does not survive). The embedded stub in the produced qcow2 matches the expected Arch stub byte-for-byte (identical
.sbatsection, sha256f5591c24…66a16; the.sbattext namessystemd 260.2fromArch Linux).bash -n,cargo fmt --check,cargo build, andmake clippypass.Docs
boot.md/boot_zh.md(UKI mode),quick-start.md/quick-start_zh.md, and the spec changelog updated.Also in this PR
docs(claude.md): formalize the project Git Commit Requirements — require aSigned-off-bytrailer (the author's identity, viagit commit -sor by hand) on every commit, require anAssisted-by: AGENT:MODEL [TOOLS]trailer as the only accepted AI attribution on Claude-authored commits, and forbid hand-editingcryptpilot.specversion/%changelog(versioning is produced bymake bump-version-{major,minor,patch}at release time).