This adds support for UEFI Secure Boot. It adds the missing pieces to the Linux
Kernel and enforces module signing. This results in an additional security
layer where untrusted (unsigned) Kernel modules can no longer be loaded into
the live system.
NOTE: This commit will not work unless signing keys are present. Arbitrary
keys can be generated using instructions found in:
data/live-build-config/includes.chroot/var/lib/shim-signed/mok/README.md
In the past the CLI based smoketest was always executed under an else branch in
the testcase if-statement. Instead of using negative logic move all testcases
to positive logic adding an empty "catch all" else path.
We can now pass any arbitrary option to the check-qemu-install script by
calling: make test -- --bar-option or make testc -- --foo-option
please note the -- which is not a typo but rather signals the end of options
and disables further option processing and passes the options down to the next
script.
Use either "make oci" or call the script manually:
$ scripts/iso-to-oci build/live-image-amd64.hybrid.iso
I: mount ISO build/live-image-amd64.hybrid.iso
I: extracting squashfs content
I: generate OCI container image vyos-1.5-strongswan-202311241125.tar
I: to import the previously generated OCI image to your local images run:
docker import vyos-1.5-strongswan-202311241125.tar vyos:1.5-strongswan-202311241125 --change 'CMD [/sbin/init]'
Simply boot a live qemu version from the latest ISO build
(10:18) cpo lnx01:~/vyos-build [current] # sudo make qemu-live
if [ ! -f build/live-image-amd64.hybrid.iso ]; then
echo "Could not find build/live-image-amd64.hybrid.iso"
exit 1
fi
scripts/check-qemu-install --qemu-cmd build/live-image-amd64.hybrid.iso
INFO - Creating Disk image testinstall-20231119-101823-4483.img
SeaBIOS (version 1.16.2-debian-1.16.2-1)
Machine UUID f48b60b2-e6ad-49ef-9d09-4245d0585e52
Booting from DVD/CD...
ISOLINUX 6.04 20200816 ETCD Copyright (C) 1994-2015 H. Peter Anvin et al
With this change we validate both installation types that they work and
operates "as expected".
(cherry picked from commit e6ce9e76673d9de7c85510ba873f04a3521e1f19)
