<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="text-align:left; direction:ltr;">
<div>Hi!</div>
<div><br>
</div>
<div>I have done something very similar, here's what I did.</div>
<div><br>
</div>
<div>My ramdisk is just a vanilla cpio.</div>
<div>My kernel is just vanilla zImage.</div>
<div><br>
</div>
<div>My main image does "inherit magic" and magic.bbclass does something like this, where create_custom_fitimage has a lot of kernel-fitimage.bbclass copied out.</div>
<div>do_magic () {</div>
<div>create_custom_fitimage</div>
<div>install fitImage.bin ${IMAGE_ROOTFS}/boot/fitImage</div>
<div>}</div>
<div>do_magic[depends] += "my-ramdisk:do_image_complete virtual/kernel"</div>
<div>addtask magic before do_image after do_pre_image_task</div>
<div><br>
</div>
<div>It does read a lot of stuff from deploy but so does the main kernel-fitimage.bbclass so I don't think that's a problem.</div>
<div><br>
</div>
<div>Regards</div>
<div>//Ernst</div>
<div></div>
<div><br>
</div>
<div>On Tue, 2020-03-10 at 22:23 +0100, Bartosz Golaszewski wrote:</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<pre>Hi,</pre>
<pre><br></pre>
<pre>I've been struggling for a while now trying to fix a circular</pre>
<pre>dependency issue when the initramfs image needs to access an image</pre>
<pre>file generated by the main (for lack of a better term) image recipe.</pre>
<pre><br></pre>
<pre>I've tried to fix our downstream layer only to come to the conclusion</pre>
<pre>that some things must probably be modified upstream to make sense.</pre>
<pre>Unfortunately when trying different solutions I always arrive at some</pre>
<pre>kind of circular dependency with the current task order.</pre>
<pre><br></pre>
<pre>My use-case is the following:</pre>
<pre><br></pre>
<pre>I'd like to use dm-verity to protect the rootfs from tampering as part</pre>
<pre>of the verified boot flow. At boot-time the rootfs partition is mapped</pre>
<pre>using veritysetup from a trusted initramfs stored in a signed</pre>
<pre>fitImage. This initramfs also contains the root verity hash while the</pre>
<pre>rest of the hash tree is stored on a different partition.</pre>
<pre><br></pre>
<pre>The dm-verity meta data is generated from a class[1] I wrote with the</pre>
<pre>aim of upstreaming it to meta-security as an image conversion of</pre>
<pre>ext[234] and btrfs images.</pre>
<pre><br></pre>
<pre>For the sake of clarity of the example let's assume we're generating</pre>
<pre>an ext4 image for core-image-full-cmdline and set INITRAMFS_IMAGE to</pre>
<pre>"dm-verity-image-initramfs".</pre>
<pre><br></pre>
<pre>The veritysetup conversion becomes part of the</pre>
<pre>core-image-full-cmdline:do_image_ext4 task, while</pre>
<pre>dm-verity-image-initramfs:do_rootfs needs to depend on</pre>
<pre>core-image-full-cmdline:do_image_ext4 as it needs to compute the</pre>
<pre>hashes based on the block device image. It cannot however depend on</pre>
<pre>core-image-full-cmdline:do_image_complete as it depends on many tasks</pre>
<pre>(e.g. kernel and u-boot tasks) that would inevitably lead to a</pre>
<pre>circular dependency.</pre>
<pre><br></pre>
<pre>The output files from recipes inheriting image.bbclass are not</pre>
<pre>deployed before do_image_complete nor is anything done in do_install</pre>
<pre>or do_populate_sysroot (these tasks are flagged noexec or deleted), so</pre>
<pre>I cannot access them from dm-verity-image-initramfs:do_rootfs.</pre>
<pre><br></pre>
<pre>As a workaround in the downstream layer I've been manually putting the</pre>
<pre>verity meta data into the DEPLOY_DIR_IMAGE from</pre>
<pre>core-image-full-cmdline:do_image_ext4 but this obviously isn't correct</pre>
<pre>as far as the deploy class and sstate are concerned.</pre>
<pre><br></pre>
<pre>Now the question is: how do I approach it so that I can eventually</pre>
<pre>make it part of upstream meta-security?</pre>
<pre><br></pre>
<pre>Do I implement do_install in image.bbclass so that initramfs can</pre>
<pre>depend on core-image-full-cmdline:do_populate_sysroot and have the</pre>
<pre>artifacts installed locally? But this would mean that the initramfs</pre>
<pre>recipe deploys the main image artifact. Should we deploy the images</pre>
<pre>earlier (before do_image_complete) for the initramfs recipe to fetch</pre>
<pre>from DEPLOY_DIR_IMAGE? Any other ideas?</pre>
<pre><br></pre>
<pre>Best regards,</pre>
<pre>Bartosz Golaszewski</pre>
<pre><br></pre>
<pre>[1] <a href="https://urldefense.com/v3/__https://github.com/brgl/meta-security/blob/topic/verity-et-al/classes/dm-verity-img.bbclass__;!!BFCLnRDDbM3FOmw!txpeOwM3etV4NJvGfflIsSW7V8RsvhhLNrDSJLj0iliKoiEm8Iu2Tf0NDsJyJVDxIcZFIg$">https://urldefense.com/v3/__https://github.com/brgl/meta-security/blob/topic/verity-et-al/classes/dm-verity-img.bbclass__;!!BFCLnRDDbM3FOmw!txpeOwM3etV4NJvGfflIsSW7V8RsvhhLNrDSJLj0iliKoiEm8Iu2Tf0NDsJyJVDxIcZFIg$</a> </pre>
<pre><br></pre>
</blockquote>
</body>
</html>