feat(native): add JD default and GHNRP return gates
This commit is contained in:
parent
97f862052f
commit
55b3e56ca0
2 changed files with 164 additions and 0 deletions
89
product-source/hololake-platform/guanghu-os/scripts/set-jd-native-default.sh
Executable file
89
product-source/hololake-platform/guanghu-os/scripts/set-jd-native-default.sh
Executable file
|
|
@ -0,0 +1,89 @@
|
|||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
[[ $# -eq 3 ]] || {
|
||||
echo "usage: set-jd-native-default.sh <world-root> <recovery-root> <expected-candidate-sha256>" >&2
|
||||
exit 64
|
||||
}
|
||||
[[ ${EUID} -eq 0 ]] || exit 77
|
||||
|
||||
world_root=$(readlink -f "$1")
|
||||
recovery_root=$(readlink -f "$2")
|
||||
expected_candidate_sha=$3
|
||||
[[ ${expected_candidate_sha} =~ ^[0-9a-f]{64}$ ]]
|
||||
|
||||
grep -q '^node_id: JD-FD-PRIMARY$' "${world_root}/CURRENT.hldp"
|
||||
grep -q '^status: PASS_100$' "${recovery_root}/RETURN-RECEIPT.hldp"
|
||||
/guanghu/bin/ghctl authorize "${world_root}" \
|
||||
overwrite_system_disk_and_exit_linux >/dev/null
|
||||
grep -q "menuentry 'Guanghu OS JD native one-time resident'.*'guanghu-jd-native-once'" \
|
||||
/boot/grub/grub.cfg
|
||||
grep -q "menuentry 'Ubuntu'.*'gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6'" \
|
||||
/boot/grub/grub.cfg
|
||||
grep -q "load_env --file '(hd0)139+2' guanghu_recovery" \
|
||||
/boot/grub/grub.cfg
|
||||
|
||||
installed_sha=$(dd if=/dev/vda bs=512 skip=105 count=29 status=none |
|
||||
sha256sum | awk '{print $1}')
|
||||
[[ ${installed_sha} == "${expected_candidate_sha}" ]]
|
||||
|
||||
cp /etc/default/grub "${recovery_root}/default-grub.before-native-default"
|
||||
cp /boot/grub/grub.cfg "${recovery_root}/grub.cfg.before-native-default"
|
||||
cp /boot/grub/grubenv "${recovery_root}/grubenv.before-native-default"
|
||||
cat /proc/sys/kernel/random/boot_id \
|
||||
>"${recovery_root}/linux-boot-id.before-native-default"
|
||||
|
||||
new_default=$(mktemp)
|
||||
trap 'rm -f "${new_default}"' EXIT
|
||||
awk '
|
||||
BEGIN { changed = 0 }
|
||||
/^GRUB_DEFAULT=/ {
|
||||
print "GRUB_DEFAULT=guanghu-jd-native-once"
|
||||
changed = 1
|
||||
next
|
||||
}
|
||||
{ print }
|
||||
END {
|
||||
if (!changed) {
|
||||
print "GRUB_DEFAULT=guanghu-jd-native-once"
|
||||
}
|
||||
}
|
||||
' /etc/default/grub >"${new_default}"
|
||||
install -m 0644 "${new_default}" /etc/default/grub
|
||||
update-grub >/dev/null
|
||||
|
||||
grep -q '^GRUB_DEFAULT=guanghu-jd-native-once$' /etc/default/grub
|
||||
grep -q 'set default="guanghu-jd-native-once"' /boot/grub/grub.cfg
|
||||
grep -q "load_env --file '(hd0)139+2' guanghu_recovery" \
|
||||
/boot/grub/grub.cfg
|
||||
grub-editenv /boot/grub/grubenv unset initrdfail prev_entry next_entry
|
||||
! grub-editenv /boot/grub/grubenv list |
|
||||
grep -Eq '^(initrdfail|prev_entry|next_entry)=.+$'
|
||||
|
||||
observed_at=$(date --iso-8601=seconds)
|
||||
cat >"${recovery_root}/NATIVE-DEFAULT-RECEIPT.hldp" <<EOF
|
||||
schema: guanghu.jd-native-default-receipt/v1
|
||||
receipt_id: GH-OS-JD-FD-PRIMARY-001-NATIVE-DEFAULT
|
||||
status: CONFIGURED_NOT_REBOOTED
|
||||
observed_at: ${observed_at}
|
||||
node_id: JD-FD-PRIMARY
|
||||
candidate:
|
||||
lba_start: 105
|
||||
sector_count: 29
|
||||
sha256: ${installed_sha}
|
||||
grub:
|
||||
default_entry: guanghu-jd-native-once
|
||||
hosted_recovery_entry: gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6
|
||||
native_recovery_protocol: GHNRP
|
||||
native_recovery_raw_blocklist: (hd0)139+2
|
||||
stale_one_time_state: CLEARED
|
||||
rollback:
|
||||
recovery_root: ${recovery_root}
|
||||
default_grub_backed_up: true
|
||||
generated_grub_backed_up: true
|
||||
grubenv_backed_up: true
|
||||
next_action: REBOOT_NATIVE_DEFAULT_THEN_PROVE_GHNRP_RETURNS_TO_HOSTED_RECOVERY
|
||||
EOF
|
||||
chmod 0400 "${recovery_root}"/*
|
||||
sync
|
||||
cat "${recovery_root}/NATIVE-DEFAULT-RECEIPT.hldp"
|
||||
|
|
@ -0,0 +1,75 @@
|
|||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
[[ $# -eq 2 ]] || {
|
||||
echo "usage: verify-jd-native-default-return.sh <world-root> <recovery-root>" >&2
|
||||
exit 64
|
||||
}
|
||||
[[ ${EUID} -eq 0 ]] || exit 77
|
||||
|
||||
world_root=$(readlink -f "$1")
|
||||
recovery_root=$(readlink -f "$2")
|
||||
grep -q '^node_id: JD-FD-PRIMARY$' "${world_root}/CURRENT.hldp"
|
||||
grep -q '^status: CONFIGURED_NOT_REBOOTED$' \
|
||||
"${recovery_root}/NATIVE-DEFAULT-RECEIPT.hldp"
|
||||
/guanghu/bin/ghctl authorize "${world_root}" \
|
||||
run_tests_and_health_checks >/dev/null
|
||||
|
||||
before_boot_id=$(<"${recovery_root}/linux-boot-id.before-native-default")
|
||||
after_boot_id=$(</proc/sys/kernel/random/boot_id)
|
||||
[[ ${before_boot_id} != "${after_boot_id}" ]]
|
||||
grep -q '^GRUB_DEFAULT=guanghu-jd-native-once$' /etc/default/grub
|
||||
! grub-editenv /boot/grub/grubenv list | grep -Eq '^next_entry=.+$'
|
||||
|
||||
dd if=/dev/vda of="${recovery_root}/lba134.native-default-proof.bin" \
|
||||
bs=512 skip=134 count=1 status=none
|
||||
dd if=/dev/vda of="${recovery_root}/lba139-140.native-default-beacon.bin" \
|
||||
bs=512 skip=139 count=2 status=none
|
||||
python3 - "${recovery_root}/lba134.native-default-proof.bin" <<'PY'
|
||||
import pathlib
|
||||
import sys
|
||||
|
||||
proof = pathlib.Path(sys.argv[1]).read_bytes()
|
||||
assert proof[0] == 0xA7
|
||||
assert proof[1:].startswith(b"GHOS_NATIVE_LONG64_DISK_PROOF\x00")
|
||||
assert proof[32:36] == bytes([1, 1, 1, 1])
|
||||
assert proof[42:44] == bytes([0x7F, 0])
|
||||
assert proof[90] == 13
|
||||
assert proof[91:105] == bytes([1] * 14)
|
||||
assert proof[105] == 16
|
||||
PY
|
||||
cmp "${recovery_root}/lba139-140.native-default-beacon.bin" \
|
||||
/usr/lib/guanghu-os/jd-recovery-clear.env
|
||||
systemctl is-enabled --quiet guanghu-jd-native-recovery-clear.service
|
||||
|
||||
observed_at=$(date --iso-8601=seconds)
|
||||
proof_sha=$(sha256sum \
|
||||
"${recovery_root}/lba134.native-default-proof.bin" | awk '{print $1}')
|
||||
cat >"${recovery_root}/NATIVE-DEFAULT-RETURN-RECEIPT.hldp" <<EOF
|
||||
schema: guanghu.jd-native-default-return/v1
|
||||
receipt_id: GH-OS-JD-FD-PRIMARY-001-NATIVE-DEFAULT-RETURN
|
||||
status: PASS_100
|
||||
observed_at: ${observed_at}
|
||||
node_id: JD-FD-PRIMARY
|
||||
boot:
|
||||
native_is_default: true
|
||||
hosted_recovery_returned: true
|
||||
linux_boot_id_before: ${before_boot_id}
|
||||
linux_boot_id_after: ${after_boot_id}
|
||||
native:
|
||||
proof_sha256: ${proof_sha}
|
||||
acknowledged_sequences: 1-16
|
||||
world_store: PASS_100
|
||||
gestational_index: PASS_100
|
||||
recovery:
|
||||
protocol: GHNRP
|
||||
beacon_consumed_and_cleared: PASS_100
|
||||
boundary:
|
||||
native_default_proven: true
|
||||
final_native_residency_proven: false
|
||||
next_action: BUILD_AND_VERIFY_NON_RECOVERING_NATIVE_RESIDENCY_RUNTIME
|
||||
EOF
|
||||
chmod 0400 "${recovery_root}"/*
|
||||
dd if=/dev/zero of=/dev/vda bs=512 seek=134 count=1 \
|
||||
conv=notrunc,fsync status=none
|
||||
cat "${recovery_root}/NATIVE-DEFAULT-RETURN-RECEIPT.hldp"
|
||||
Loading…
Reference in a new issue