Skip to content

CLI: use the path to the target container's root to find ESP and kernel images#27

Merged
travier merged 4 commits into
trusted-execution-clusters:mainfrom
bgartzi:root-paths
Oct 13, 2025
Merged

CLI: use the path to the target container's root to find ESP and kernel images#27
travier merged 4 commits into
trusted-execution-clusters:mainfrom
bgartzi:root-paths

Conversation

@bgartzi
Copy link
Copy Markdown
Contributor

@bgartzi bgartzi commented Sep 9, 2025

This patch series closes #23.

It's depending upon #24 not for a really good reason, but just because I wanted to run CI integration tests on fcos and rhcos against these changes.

This is a breaking change:

  • Changes the CLI arguments.
  • Changes the lib's compute_pcrs API

In both of them, drops --esp and --kernels arguments in favour of the new --rootfs argument without prior notice. I could have put more effort onto making all of them coexist, but I think that relying uniquely on --rootfs makes it cleaner, and easier to use.

Copy link
Copy Markdown
Member

@travier travier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Needs a rebase but logic looks good to me. Thanks

shim was being assigned to the grub attribute and viceversa. It worked
correctly because the shim function would return the based on the grub
path attribute (that is shim) and viceversa.

This commit fixes the typos.

Signed-off-by: Beñat Gartzia Arruabarrena <bgartzia@redhat.com>
This commit defines a variable with a default value pointing into the
path in which the target container image will be mounted. This will
allow us to avoid copying and pasting the path around.

Signed-off-by: Beñat Gartzia Arruabarrena <bgartzia@redhat.com>
This submodule models where relevant files such as the shim, grub or
kernel binaries are, and tries to locate them given the path to the
rootfs of the target container image.

Signed-off-by: Beñat Gartzia Arruabarrena <bgartzia@redhat.com>
@bgartzi
Copy link
Copy Markdown
Contributor Author

bgartzi commented Oct 6, 2025

Hi @travier, I just updated the PR with:

  • The missing rebase
  • A little tweak to the logic: Previously we were changing the lib interface. Now, the patch does not break the lib interface, instead uses the RootFSTree abstraction previously on cli's main.rs.
  • And well, a typo fix on esp.rs that I would probably need to add on another PR, but added it here as I found about that while I was working on this.

Paths to the kernel directory and the ESP (containing both grub and shim
binaries) were received as separate arguments. However, this tool is
run against a single container image at a time, meaning that we could
easily compute the paths to the kernel dir and the ESP dir just by
knowing were the rootfs of that container image is.

This commit introduces the simple logic that makes that possible, and
introduces the new --rootfs argument to the CLI.

Note that this commit only changes the CLI, not the library interface.
Now, users of the library can use the RootFSTree abstraction added in a
previous commit to compute the vmlinuz and esp paths, and then call the
predict functions. This is done as it provides greater flexibility for
library consumers (in favour of comfort) and changing it to only
accepting the rootfs path would have meant a breaking change instead.

Signed-off-by: Beñat Gartzia Arruabarrena <bgartzia@redhat.com>
@travier travier merged commit a1aa03d into trusted-execution-clusters:main Oct 13, 2025
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CLI: Find dependencies (ESP+vmlinuz) out of the path to the container image root

2 participants