initrd: Consume signed fwupd capsules - #2191
Draft
Sean-StarLabs wants to merge 2 commits into
Draft
Conversation
Allow boards to consume firmware staged by fwupd on a FAT ESP. Validate the EFI capsule before passing its ROM to a board-selected writer. Authenticate an exact manifest and payload with an isolated vendor keyring. Bind each package to its board and capsule GUID, enforce bounded sizes, and require a newer generation to prevent rollback. Quarantine rejected requests and mark accepted requests as applying before invoking the writer. Remove a request only after a successful write, then reboot according to board policy. Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Add a TPM2 QEMU board for exercising the fwupd capsule handoff with a disposable public key and a file-backed mock writer. Give the VM a stable SMBIOS identity that the companion fwupd proof of concept can match. Confirmation and reboot are bypassed only for this non-flashing fixture; physical boards remain disabled. Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Collaborator
|
CC @pietrushnic @macpijan (feel free to ping proper internal resource for review) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft / RFC
Add a board-gated path for consuming firmware staged by fwupd in
EFI/UpdateCapsule. The consumer validates the EFI capsule, exact package contents, board and capsule GUID, generation, ROM size and hash, and a detached signature from an isolated vendor keyring before calling a board-selected writer.Rejected requests are quarantined. Accepted requests are renamed to
.applyingbefore the writer runs and removed only after a successful write.Add an independent TPM2 QEMU fixture with a disposable public key, mock file-backed writer, and stable SMBIOS identity. Physical boards remain disabled.
Runtime validation
WIP follow-up
This is based directly on current
linuxboot/headsmaster and has no dependency on the Star Labs board series.Production enablement still requires per-board capsule GUIDs, embedded production public keys, monotonic generation policy, physical flash writers, a persistent completion/failure result contract, and protected-flash hardware validation.
Companion fwupd Draft PR: fwupd/fwupd#10910.