Add method to validate signature of efi file #337
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Itxaka <[email protected]>
Itxaka
force-pushed
the
verify_upgrade_artifacts
branch
from
c9bb36b
to
027116d
Compare
jimmykarily
reviewed
May 16, 2024
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #337 +/- ##
==========================================
- Coverage 59.07% 54.71% -4.37%
==========================================
Files 39 43 +4
Lines 4242 4670 +428
==========================================
+ Hits 2506 2555 +49
- Misses 1460 1831 +371
- Partials 276 284 +8 ☔ View full report in Codecov by Sentry. |
Signed-off-by: Itxaka <[email protected]>
Signed-off-by: Itxaka <[email protected]>
jimmykarily
reviewed
May 17, 2024
Tests showed that the approach was wrong. Now we check for the list of db certs and extract those properly Signed-off-by: Itxaka <[email protected]>
Signed-off-by: Itxaka <[email protected]>
Itxaka
force-pushed
the
verify_upgrade_artifacts
branch
from
56ae67d
to
997f98d
Compare
Signed-off-by: Itxaka <[email protected]>
|
Seems to me like this has gottena bit big. Just to parse a couple of things, we need to bring a library for parsing pe files, so for me it makes more sense to have this in the sdk as a generic function that checks the signature validity instead of cluttering teh agent with this maybe... ? |
jimmykarily
reviewed
May 20, 2024
jimmykarily
reviewed
May 20, 2024
jimmykarily
reviewed
May 20, 2024
jimmykarily
approved these changes
May 20, 2024
Co-authored-by: Dimitris Karakasilis <[email protected]>
Signed-off-by: Itxaka <[email protected]>
- Check for zero size before parsing - mmap the file, seems to consume less memory - return on unknown errors when stat-ing the file - convert the type so we can keep using v1.FS - Add more debug logging - Extra test for zero size - Fix the location of the efi file during upgrade check Signed-off-by: Itxaka <[email protected]>
|
Seems to be working with a proper EFI: |
|
certs in the machine DB: |
|
Artifact checks out, signed by my default test key |
|
Now testing with an upgrade image signed with a different key (generic one created on the fly during artifact build): Check fails as expected: Need to fix the error message though as its pretty crude LOL |
|
New error message a bit more extensive |
Signed-off-by: Itxaka <[email protected]>
mauromorales
approved these changes
May 21, 2024
Signed-off-by: Itxaka <[email protected]>
renovate bot
referenced
this pull request
in kairos-io/provider-kairos
May 24, 2024
…0.5 (#569) [](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [github.com/kairos-io/kairos-agent/v2](https://togithub.com/kairos-io/kairos-agent) | `v2.10.4` -> `v2.10.5` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>kairos-io/kairos-agent (github.com/kairos-io/kairos-agent/v2)</summary> ### [`v2.10.5`](https://togithub.com/kairos-io/kairos-agent/releases/tag/v2.10.5) [Compare Source](https://togithub.com/kairos-io/kairos-agent/compare/v2.10.4...v2.10.5) #### What's Changed - Update dependency cypress to v13.9.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/kairos-io/kairos-agent/pull/327](https://togithub.com/kairos-io/kairos-agent/pull/327) - Fix reboot/power off message by [@​Itxaka](https://togithub.com/Itxaka) in [https://github.com/kairos-io/kairos-agent/pull/331](https://togithub.com/kairos-io/kairos-agent/pull/331) - Force go 1.19 for releases by [@​mauromorales](https://togithub.com/mauromorales) in [https://github.com/kairos-io/kairos-agent/pull/333](https://togithub.com/kairos-io/kairos-agent/pull/333) - Update actions/checkout action to v4 by [@​renovate](https://togithub.com/renovate) in [https://github.com/kairos-io/kairos-agent/pull/290](https://togithub.com/kairos-io/kairos-agent/pull/290) - Update module github.com/kairos-io/kairos-sdk to v0.1.6 by [@​renovate](https://togithub.com/renovate) in [https://github.com/kairos-io/kairos-agent/pull/326](https://togithub.com/kairos-io/kairos-agent/pull/326) - Update module golang.org/x/net to v0.25.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/kairos-io/kairos-agent/pull/328](https://togithub.com/kairos-io/kairos-agent/pull/328) - Update module golang.org/x/sys to v0.20.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/kairos-io/kairos-agent/pull/330](https://togithub.com/kairos-io/kairos-agent/pull/330) - Update github/codeql-action action to v3 by [@​renovate](https://togithub.com/renovate) in [https://github.com/kairos-io/kairos-agent/pull/291](https://togithub.com/kairos-io/kairos-agent/pull/291) - Update module github.com/google/go-github/v40 to v62 by [@​renovate](https://togithub.com/renovate) in [https://github.com/kairos-io/kairos-agent/pull/335](https://togithub.com/kairos-io/kairos-agent/pull/335) - Update module github.com/google/go-github/v61 to v62 by [@​renovate](https://togithub.com/renovate) in [https://github.com/kairos-io/kairos-agent/pull/336](https://togithub.com/kairos-io/kairos-agent/pull/336) - Update module github.com/mudler/yip to v1.7.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/kairos-io/kairos-agent/pull/334](https://togithub.com/kairos-io/kairos-agent/pull/334) - Update module golang.org/x/oauth2 to v0.20.0 - autoclosed by [@​renovate](https://togithub.com/renovate) in [https://github.com/kairos-io/kairos-agent/pull/329](https://togithub.com/kairos-io/kairos-agent/pull/329) - Update module github.com/google/go-github/v40 to v62 by [@​renovate](https://togithub.com/renovate) in [https://github.com/kairos-io/kairos-agent/pull/338](https://togithub.com/kairos-io/kairos-agent/pull/338) - Update dependency alpinejs to v3.14.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/kairos-io/kairos-agent/pull/340](https://togithub.com/kairos-io/kairos-agent/pull/340) - Add method to validate signature of efi file by [@​Itxaka](https://togithub.com/Itxaka) in [https://github.com/kairos-io/kairos-agent/pull/337](https://togithub.com/kairos-io/kairos-agent/pull/337) - Update dependency cypress to v13.10.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/kairos-io/kairos-agent/pull/342](https://togithub.com/kairos-io/kairos-agent/pull/342) - Update module github.com/kairos-io/kcrypt to v0.11.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/kairos-io/kairos-agent/pull/343](https://togithub.com/kairos-io/kairos-agent/pull/343) - Update module github.com/rs/zerolog to v1.33.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/kairos-io/kairos-agent/pull/345](https://togithub.com/kairos-io/kairos-agent/pull/345) - Update module github.com/google/go-github/v40 to v62 by [@​renovate](https://togithub.com/renovate) in [https://github.com/kairos-io/kairos-agent/pull/346](https://togithub.com/kairos-io/kairos-agent/pull/346) - Bump kairos-sdk to v0.1.7 by [@​jimmykarily](https://togithub.com/jimmykarily) in [https://github.com/kairos-io/kairos-agent/pull/347](https://togithub.com/kairos-io/kairos-agent/pull/347) - Move udevadm triggering in kcrypt by [@​jimmykarily](https://togithub.com/jimmykarily) in [https://github.com/kairos-io/kairos-agent/pull/350](https://togithub.com/kairos-io/kairos-agent/pull/350) - Bump sdk to v0.1.8 by [@​mauromorales](https://togithub.com/mauromorales) in [https://github.com/kairos-io/kairos-agent/pull/349](https://togithub.com/kairos-io/kairos-agent/pull/349) **Full Changelog**: kairos-io/kairos-agent@v2.10.4...v2.10.5 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 11pm every weekday,before 7am every weekday,every weekend" in timezone Europe/Brussels, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/kairos-io/provider-kairos). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zNjguMTAiLCJ1cGRhdGVkSW5WZXIiOiIzNy4zNjguMTAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
](https://renovatebot.com){kind=link}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This seems rigth but needs testing. Also makes sense to have this in the sdk instead maybe?
Fixes kairos-io/kairos#2200