Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Minor cleanup related to composefs #3268

Merged
merged 2 commits into from
Jun 20, 2024
Merged

Minor cleanup related to composefs #3268

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
023888d
docs/composefs: Fix reference to `ostree sign`
ueno Jun 19, 2024
371540f
repo: Remove leftover OpenSSL includes
ueno Jun 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions docs/composefs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ covering the composefs fsverity digest with a signature.
### Signatures

If a commit is signed with an Ed25519 private key (see `ostree
--sign`), and `composefs.keyfile` is specified in `prepare-root.conf`,
sign`), and `composefs.keyfile` is specified in `prepare-root.conf`,
then the initrd will find the commit being booted in the system repo
and validate its signature against the public key. It will then ensure
that the composefs digest being booted has an fs-verity digest
Expand All @@ -63,7 +63,7 @@ to use it with transient keys. This is done like this:
* Generate a new keypair before each build
* Embed the public key in the initrd that is part of the commit.
* Ensure the initrd has a `prepare-root.conf` with `[composefs] enabled=signed`, and either use `keypath` or inject `/etc/ostree/initramfs-root-binding.key`; for more see `man ostree-prepare-root`
* After committing, run `ostree --sign` with the private key.
* After committing, run `ostree sign` with the private key.
* Throw away the private key.

When a transient key is used this way, that ties the initrd with the
Expand Down
13 changes: 0 additions & 13 deletions src/libostree/ostree-repo-verity.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,19 +29,6 @@
#include <linux/fsverity.h>
#endif

#if defined(HAVE_OPENSSL)
#include <openssl/bio.h>
#include <openssl/engine.h>
#include <openssl/err.h>
#include <openssl/pem.h>
#include <openssl/pkcs7.h>

G_DEFINE_AUTOPTR_CLEANUP_FUNC (X509, X509_free);
G_DEFINE_AUTOPTR_CLEANUP_FUNC (EVP_PKEY, EVP_PKEY_free);
G_DEFINE_AUTOPTR_CLEANUP_FUNC (BIO, BIO_free);
G_DEFINE_AUTOPTR_CLEANUP_FUNC (PKCS7, PKCS7_free);
#endif

gboolean
_ostree_repo_parse_fsverity_config (OstreeRepo *self, GError **error)
{
Expand Down
Loading