Prepare to support UKIs - #1007
Merged
arnaldo2792 merged 9 commits intoAug 14, 2026
Merged
Conversation
arnaldo2792
force-pushed
the
uki-support/core-kit
branch
from
August 11, 2026 01:07
7871ec2 to
96f69ca
Compare
Contributor
Author
|
(Force push to fix commit messages) |
arnaldo2792
force-pushed
the
uki-support/core-kit
branch
from
August 11, 2026 01:08
96f69ca to
43887e4
Compare
Contributor
Author
|
(Forced push to fix commit messages, for real) |
arnaldo2792
requested review from
ginglis13,
michaelb990,
piyush-jena and
vigh-m
August 11, 2026 01:19
arnaldo2792
force-pushed
the
uki-support/core-kit
branch
from
August 11, 2026 01:23
43887e4 to
337e9c8
Compare
Contributor
Author
|
(Forced push includes missing systemd service) |
ginglis13
reviewed
Aug 12, 2026
Comment on lines
+5
to
+6
| # Note that this file is measured into TPM PCR 5 before parsing: editing | ||
| # it changes PCR 5 and invalidates anything sealed against it. |
Contributor
There was a problem hiding this comment.
I'd suggest this being the first line of the file, seems like a significant callout. Maybe a "DO NOT EDIT" line, or "WARNING" line too?
jmt-lab
requested changes
Aug 12, 2026
arnaldo2792
force-pushed
the
uki-support/core-kit
branch
from
August 13, 2026 17:40
337e9c8 to
53b84ce
Compare
ginglis13
reviewed
Aug 13, 2026
vigh-m
reviewed
Aug 13, 2026
Comment on lines
+96
to
+97
| Patch9019: 9019-boot-remove-SMBIOS-Type-11-kernel-cmdline-extra-mech.patch | ||
| Patch9020: 9020-boot-vmspawn-finish-removing-SMBIOS-cmdline-extra-bi.patch |
Contributor
There was a problem hiding this comment.
Do these need to be 2 separate patches? Looks like they're modifying the same file.
sam-berning
reviewed
Aug 13, 2026
piyush-jena
approved these changes
Aug 14, 2026
Contributor
|
Tested jointly with #999 . Stress tested and no issues found. Assuming that the sign offs in the patches will be added. |
arnaldo2792
marked this pull request as ready for review
August 14, 2026 21:31
Enable systemd-boot and systemd-stub in the systemd-257 spec to provide the bootloader and EFI stub required for Unified Kernel Images (UKI). Add a patch to skip building 32-bit (ia32) EFI binaries on architectures that do not need them, and ship a loader.conf with sensible default settings. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>
Add EnvironmentFile=-/usr/share/bottlerocket/image-format.env to prepare-boot.service so prairiedog can read image-format variables at boot preparation time. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>
On UKI-based images, the kernel command line is measured into PCR9 as part of the UKI PE binary at boot, so the separate user-space measurement in measure-cmdline.service is redundant. Gate the service with an ExecCondition on UKI_IMAGE so it only runs on non-UKI images. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>
Prior to the introduction of systemd-boot, GRUB was the only supported bootloader and was always explicitly required. With systemd-boot now available, the bootloader must be selected based on the format of the built image. Require the (bootloader-efi) capability, which is satisfied by either grub or systemd-boot, whichever is installed based on the variant's enabled feature flags. Default to grub when the (uki-image) bconds are absent, preserving backwards compatibility with older twoliter versions. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>
UKIs do not yet support in-place upgrades. Skip installing signpost on UKI-based variants, since marking partitions with successful boots only applies to the GRUB-based boot format. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>
Add xbootldr_partition(), which scans the OS disk's GPT for a partition of the XBOOTLDR type GUID and returns its path. Returns None when no such partition exists, which is the case on GRUB images, and fails if more than one is found since there would be no way to choose between them. A prior pass introduced generic disk- and partition-type-searching abstractions (disk.rs, partition_types.rs) to support this lookup, but a single-purpose function is simpler and sufficient for the one caller that needs it, so those files are removed in favor of this helper living alongside the rest of the partition-table logic in state.rs. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>
prepare_boot previously always mounted the active partition set's ext4 boot partition. On UKI images, the boot partition is XBOOTLDR, a FAT filesystem that systemd-boot's firmware loader must be able to read. Scan the disk layout and check the UKI_IMAGE environment variable, which prepare-boot.service sets from image-format.env. If it is a UKI image, look up the XBOOTLDR partition and mount it as vfat with the mount options systemd-boot expects (umask, shortname, iocharset, and an SELinux context, since FAT has no extended attributes to carry a label). Otherwise, fall back to the existing ext4 mount of the active set's boot partition. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>
Backport of upstream bb19b6104978b5ede792fa3f0cfc74272f20bf9c. Signed-off-by: Maher Homsi <maherhom@amazon.com>
The FIPS kernel integrity check hardcoded /boot/.vmlinuz.hmac, which
does not exist on UKI images where the kernel is embedded in the EFI
binary.
Add two oneshot units, generate-fips-hmac-path-uki.service and
generate-fips-hmac-path-vmlinuz.service, that inspect UKI_IMAGE in
/usr/share/bottlerocket/image-format.env and write the matching HMAC
path to /etc/fips-hmac-path.env. Both are gated on fips=1 and ordered
before fipscheck.target and check-kernel-integrity.service, which now
reads ${HMAC_PATH} from that file instead of a fixed path.
Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>
arnaldo2792
force-pushed
the
uki-support/core-kit
branch
from
August 14, 2026 21:55
968cc95 to
72a14e4
Compare
ginglis13
approved these changes
Aug 14, 2026
jmt-lab
approved these changes
Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of changes:
This series prepares the core kit to support Unified Kernel Images.
Build
systemd-bootandsystemd-stubfor systemd-257. A patch for systemd was needed to prevent it from building these binaries for the wrong CPU architectures (32 bits).The release package was updated to conditionally include
grub, since now there is another package that provides a bootloader.Given that in-place upgrades aren't supported for the time being,
signpostis skipped entirely as a binary. However, the library component was updated to find the correct FAT partition that includes the UKI to mount it at/boot. This is needed for other parts of the system, like the FIPS check.User-space PCR9 measurements are skipped for UKI-based images, since PCR9 is measured at the kernel level when systemd-boot is used.
Testing done:
As part of: bottlerocket-os/bottlerocket-kernel-kit#523
in-place-upgrades+ukiare usedTerms of contribution:
By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.