feat(native): add JD default and GHNRP return gates
This commit is contained in:
parent
97f862052f
commit
55b3e56ca0
2 changed files with 164 additions and 0 deletions
89
product-source/hololake-platform/guanghu-os/scripts/set-jd-native-default.sh
Executable file
89
product-source/hololake-platform/guanghu-os/scripts/set-jd-native-default.sh
Executable file
|
|
@ -0,0 +1,89 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
[[ $# -eq 3 ]] || {
|
||||||
|
echo "usage: set-jd-native-default.sh <world-root> <recovery-root> <expected-candidate-sha256>" >&2
|
||||||
|
exit 64
|
||||||
|
}
|
||||||
|
[[ ${EUID} -eq 0 ]] || exit 77
|
||||||
|
|
||||||
|
world_root=$(readlink -f "$1")
|
||||||
|
recovery_root=$(readlink -f "$2")
|
||||||
|
expected_candidate_sha=$3
|
||||||
|
[[ ${expected_candidate_sha} =~ ^[0-9a-f]{64}$ ]]
|
||||||
|
|
||||||
|
grep -q '^node_id: JD-FD-PRIMARY$' "${world_root}/CURRENT.hldp"
|
||||||
|
grep -q '^status: PASS_100$' "${recovery_root}/RETURN-RECEIPT.hldp"
|
||||||
|
/guanghu/bin/ghctl authorize "${world_root}" \
|
||||||
|
overwrite_system_disk_and_exit_linux >/dev/null
|
||||||
|
grep -q "menuentry 'Guanghu OS JD native one-time resident'.*'guanghu-jd-native-once'" \
|
||||||
|
/boot/grub/grub.cfg
|
||||||
|
grep -q "menuentry 'Ubuntu'.*'gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6'" \
|
||||||
|
/boot/grub/grub.cfg
|
||||||
|
grep -q "load_env --file '(hd0)139+2' guanghu_recovery" \
|
||||||
|
/boot/grub/grub.cfg
|
||||||
|
|
||||||
|
installed_sha=$(dd if=/dev/vda bs=512 skip=105 count=29 status=none |
|
||||||
|
sha256sum | awk '{print $1}')
|
||||||
|
[[ ${installed_sha} == "${expected_candidate_sha}" ]]
|
||||||
|
|
||||||
|
cp /etc/default/grub "${recovery_root}/default-grub.before-native-default"
|
||||||
|
cp /boot/grub/grub.cfg "${recovery_root}/grub.cfg.before-native-default"
|
||||||
|
cp /boot/grub/grubenv "${recovery_root}/grubenv.before-native-default"
|
||||||
|
cat /proc/sys/kernel/random/boot_id \
|
||||||
|
>"${recovery_root}/linux-boot-id.before-native-default"
|
||||||
|
|
||||||
|
new_default=$(mktemp)
|
||||||
|
trap 'rm -f "${new_default}"' EXIT
|
||||||
|
awk '
|
||||||
|
BEGIN { changed = 0 }
|
||||||
|
/^GRUB_DEFAULT=/ {
|
||||||
|
print "GRUB_DEFAULT=guanghu-jd-native-once"
|
||||||
|
changed = 1
|
||||||
|
next
|
||||||
|
}
|
||||||
|
{ print }
|
||||||
|
END {
|
||||||
|
if (!changed) {
|
||||||
|
print "GRUB_DEFAULT=guanghu-jd-native-once"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
' /etc/default/grub >"${new_default}"
|
||||||
|
install -m 0644 "${new_default}" /etc/default/grub
|
||||||
|
update-grub >/dev/null
|
||||||
|
|
||||||
|
grep -q '^GRUB_DEFAULT=guanghu-jd-native-once$' /etc/default/grub
|
||||||
|
grep -q 'set default="guanghu-jd-native-once"' /boot/grub/grub.cfg
|
||||||
|
grep -q "load_env --file '(hd0)139+2' guanghu_recovery" \
|
||||||
|
/boot/grub/grub.cfg
|
||||||
|
grub-editenv /boot/grub/grubenv unset initrdfail prev_entry next_entry
|
||||||
|
! grub-editenv /boot/grub/grubenv list |
|
||||||
|
grep -Eq '^(initrdfail|prev_entry|next_entry)=.+$'
|
||||||
|
|
||||||
|
observed_at=$(date --iso-8601=seconds)
|
||||||
|
cat >"${recovery_root}/NATIVE-DEFAULT-RECEIPT.hldp" <<EOF
|
||||||
|
schema: guanghu.jd-native-default-receipt/v1
|
||||||
|
receipt_id: GH-OS-JD-FD-PRIMARY-001-NATIVE-DEFAULT
|
||||||
|
status: CONFIGURED_NOT_REBOOTED
|
||||||
|
observed_at: ${observed_at}
|
||||||
|
node_id: JD-FD-PRIMARY
|
||||||
|
candidate:
|
||||||
|
lba_start: 105
|
||||||
|
sector_count: 29
|
||||||
|
sha256: ${installed_sha}
|
||||||
|
grub:
|
||||||
|
default_entry: guanghu-jd-native-once
|
||||||
|
hosted_recovery_entry: gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6
|
||||||
|
native_recovery_protocol: GHNRP
|
||||||
|
native_recovery_raw_blocklist: (hd0)139+2
|
||||||
|
stale_one_time_state: CLEARED
|
||||||
|
rollback:
|
||||||
|
recovery_root: ${recovery_root}
|
||||||
|
default_grub_backed_up: true
|
||||||
|
generated_grub_backed_up: true
|
||||||
|
grubenv_backed_up: true
|
||||||
|
next_action: REBOOT_NATIVE_DEFAULT_THEN_PROVE_GHNRP_RETURNS_TO_HOSTED_RECOVERY
|
||||||
|
EOF
|
||||||
|
chmod 0400 "${recovery_root}"/*
|
||||||
|
sync
|
||||||
|
cat "${recovery_root}/NATIVE-DEFAULT-RECEIPT.hldp"
|
||||||
|
|
@ -0,0 +1,75 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
[[ $# -eq 2 ]] || {
|
||||||
|
echo "usage: verify-jd-native-default-return.sh <world-root> <recovery-root>" >&2
|
||||||
|
exit 64
|
||||||
|
}
|
||||||
|
[[ ${EUID} -eq 0 ]] || exit 77
|
||||||
|
|
||||||
|
world_root=$(readlink -f "$1")
|
||||||
|
recovery_root=$(readlink -f "$2")
|
||||||
|
grep -q '^node_id: JD-FD-PRIMARY$' "${world_root}/CURRENT.hldp"
|
||||||
|
grep -q '^status: CONFIGURED_NOT_REBOOTED$' \
|
||||||
|
"${recovery_root}/NATIVE-DEFAULT-RECEIPT.hldp"
|
||||||
|
/guanghu/bin/ghctl authorize "${world_root}" \
|
||||||
|
run_tests_and_health_checks >/dev/null
|
||||||
|
|
||||||
|
before_boot_id=$(<"${recovery_root}/linux-boot-id.before-native-default")
|
||||||
|
after_boot_id=$(</proc/sys/kernel/random/boot_id)
|
||||||
|
[[ ${before_boot_id} != "${after_boot_id}" ]]
|
||||||
|
grep -q '^GRUB_DEFAULT=guanghu-jd-native-once$' /etc/default/grub
|
||||||
|
! grub-editenv /boot/grub/grubenv list | grep -Eq '^next_entry=.+$'
|
||||||
|
|
||||||
|
dd if=/dev/vda of="${recovery_root}/lba134.native-default-proof.bin" \
|
||||||
|
bs=512 skip=134 count=1 status=none
|
||||||
|
dd if=/dev/vda of="${recovery_root}/lba139-140.native-default-beacon.bin" \
|
||||||
|
bs=512 skip=139 count=2 status=none
|
||||||
|
python3 - "${recovery_root}/lba134.native-default-proof.bin" <<'PY'
|
||||||
|
import pathlib
|
||||||
|
import sys
|
||||||
|
|
||||||
|
proof = pathlib.Path(sys.argv[1]).read_bytes()
|
||||||
|
assert proof[0] == 0xA7
|
||||||
|
assert proof[1:].startswith(b"GHOS_NATIVE_LONG64_DISK_PROOF\x00")
|
||||||
|
assert proof[32:36] == bytes([1, 1, 1, 1])
|
||||||
|
assert proof[42:44] == bytes([0x7F, 0])
|
||||||
|
assert proof[90] == 13
|
||||||
|
assert proof[91:105] == bytes([1] * 14)
|
||||||
|
assert proof[105] == 16
|
||||||
|
PY
|
||||||
|
cmp "${recovery_root}/lba139-140.native-default-beacon.bin" \
|
||||||
|
/usr/lib/guanghu-os/jd-recovery-clear.env
|
||||||
|
systemctl is-enabled --quiet guanghu-jd-native-recovery-clear.service
|
||||||
|
|
||||||
|
observed_at=$(date --iso-8601=seconds)
|
||||||
|
proof_sha=$(sha256sum \
|
||||||
|
"${recovery_root}/lba134.native-default-proof.bin" | awk '{print $1}')
|
||||||
|
cat >"${recovery_root}/NATIVE-DEFAULT-RETURN-RECEIPT.hldp" <<EOF
|
||||||
|
schema: guanghu.jd-native-default-return/v1
|
||||||
|
receipt_id: GH-OS-JD-FD-PRIMARY-001-NATIVE-DEFAULT-RETURN
|
||||||
|
status: PASS_100
|
||||||
|
observed_at: ${observed_at}
|
||||||
|
node_id: JD-FD-PRIMARY
|
||||||
|
boot:
|
||||||
|
native_is_default: true
|
||||||
|
hosted_recovery_returned: true
|
||||||
|
linux_boot_id_before: ${before_boot_id}
|
||||||
|
linux_boot_id_after: ${after_boot_id}
|
||||||
|
native:
|
||||||
|
proof_sha256: ${proof_sha}
|
||||||
|
acknowledged_sequences: 1-16
|
||||||
|
world_store: PASS_100
|
||||||
|
gestational_index: PASS_100
|
||||||
|
recovery:
|
||||||
|
protocol: GHNRP
|
||||||
|
beacon_consumed_and_cleared: PASS_100
|
||||||
|
boundary:
|
||||||
|
native_default_proven: true
|
||||||
|
final_native_residency_proven: false
|
||||||
|
next_action: BUILD_AND_VERIFY_NON_RECOVERING_NATIVE_RESIDENCY_RUNTIME
|
||||||
|
EOF
|
||||||
|
chmod 0400 "${recovery_root}"/*
|
||||||
|
dd if=/dev/zero of=/dev/vda bs=512 seek=134 count=1 \
|
||||||
|
conv=notrunc,fsync status=none
|
||||||
|
cat "${recovery_root}/NATIVE-DEFAULT-RETURN-RECEIPT.hldp"
|
||||||
Loading…
Reference in a new issue