New OpenSUSE OS: Add OpenSUSE Tumbleweed OS to verify SNP certification. by LakshmiSaiHarika · Pull Request #180 · AMDEPYC/sev-certify

LakshmiSaiHarika · 2025-11-03T04:58:24Z

Added OpenSuse Tumbleweed distribution to verify SNP certification process on this Opensuse distribution.
For the results, please take a look at my forked GH issue for the OpenSUSE Tumbleweed release here

npmccallum · 2025-11-20T20:23:18Z

We need to move to a fixed release. But we can't because Leap 16 isn't available in mkosi yet. See: systemd/mkosi#3994

Add host and guest image configurations for openSUSE Leap 16.0 with required packages including kernel-default, systemd, qemu, and development tools. Signed-off-by: Harika Nittala <lnittala@amd.com>

Add systemd-conf module with combined status format to explicitly add service name in the service description of journalctl message across all linux distributions. This was added as a fix on opensuse-leap to get the host and guest service description as per the pattern defined in get_service_description. Signed-off-by: Harika Nittala <lnittala@amd.com>

Bump ToolsTreeRelease from 42 to 44 and include the new systemd-conf module in the common build configuration. Signed-off-by: Harika Nittala <lnittala@amd.com>

Add opensuse-leap to the supported distributions in load-kernel-modules and network-fix build scripts for proper module configuration and resolv.conf handling. Signed-off-by: Harika Nittala <lnittala@amd.com>

Add opensuse-leap package names for qemu and ovmf in host_os_package.py, and add zypper package manager support in package_version.sh. Signed-off-by: Harika Nittala <lnittala@amd.com>

Update apt sources to use Ubuntu resolute (26.04) for mkosi installation in the CI workflow. Signed-off-by: Harika Nittala <lnittala@amd.com>

Signed-off-by: Harika Nittala <lnittala@amd.com>

Start beacon-report.service after the sev-certificate.txt file is created. The sev-certificate.txt is generated by the sev-certificate-generator.service. beacon-report.service raises a `sev-certificate.txt` file not found error when this service starts after display-guest-logs.service but before sev-certificate-generator.service. Signed-off-by: Harika Nittala <lnittala@amd.com>

LakshmiSaiHarika · 2026-06-09T21:30:04Z

Updating this PR with the OpenSUSE Leap Release, as Leap 16 is now available in mkosi v26.

LakshmiSaiHarika · 2026-06-09T21:37:40Z

Please follow the description below for the updated PR changes:

Updated the Ubuntu codename from plucky to resolute, since resolute provides mkosi v26 support.
Upgraded FedoraToolsTreeRelease from 42 to 44 to ensure compatibility with the latest tool builds using mkosi v26.
Added openSUSE Leap 16.0 mkosi configurations for both host and guest images.
Configured the systemd status format module to use:
StatusUnitFormat=combined
This explicitly includes the service name in journalctl messages across all Linux distributions.
This change was required specifically for openSUSE Leap, where the default format did not match the pattern expected by get_service_description, leading to parsing issues for both host and guest service descriptions.
Added openSUSE Leap support to:
- kernel module loading scripts
- network-fix build scripts
Added package mapping and package manager support for openSUSE Leap:
- qemu -> qemu
- ovmf → qemu-ovmf-x86_64
- Added zypper package manager support
Added openSUSE Leap support in the build and release GitHub workflows.
Fixed report-done.service ordering issues where beacon-report.service could start before sev-certificate.txt was generated, causing intermittent "file not found" errors.

LakshmiSaiHarika · 2026-06-09T21:41:08Z

@@ -0,0 +1,2 @@
+[Manager]
+StatusUnitFormat=combined


This change was required specifically for openSUSE Leap, where the default format did not match the pattern expected by get_service_description (openSUSE didn't include the service name in its description), leading to parsing issues for both host and guest service descriptions.

LakshmiSaiHarika · 2026-06-09T21:42:55Z

-Requires=display-guest-logs.service sev-certificate-generator.service
-After=display-guest-logs.service sev-certificate-generator.service
+Requires=sev-certificate-generator.service
+After=sev-certificate-generator.service


Fixed report-done.service ordering issues where beacon-report.service could start before sev-certificate.txt was generated, causing intermittent "file not found" errors.

LakshmiSaiHarika

Please refer to my comments for the detailed explanation of the few changes.

LakshmiSaiHarika · 2026-06-09T21:48:13Z

Please refer to my sev-certify forked GH issues for the latest SEV certificates produced with this PR.
https://github.com/LakshmiSaiHarika/snpcert/issues

LakshmiSaiHarika · 2026-06-09T21:51:55Z

SEV certification on OpenSUSE Leap fails due to the missing compatible AMDSEV-ovmf package support on OpenSUSE Leap.

I filed a bug report for the ovmf package in OpenSUSE portal to add support for AMDSEV-compatible guest firmware to calculate expected guest measurement:
https://bugzilla.opensuse.org/show_bug.cgi?id=1266809

LakshmiSaiHarika · 2026-06-09T21:59:46Z

+        python3-emoji
+        jq
+        avahi
+KernelCommandLine="iommu=nopt"


To enable AMD SEV (Secure Encrypted Virtualization) in openSUSE Leap, I had to disable IOMMU passthrough to protect encrypted guest memory integrity as per the OpenSUSE 15 SP6 documentation:
https://documentation.suse.com/sles/15-SP6/html/SLES-all/cha-vm-security.html

LakshmiSaiHarika

Disable IOMMU passthrough on OpenSUSE host in the kernel command line parameter.

LakshmiSaiHarika · 2026-06-26T16:40:10Z

This PR requires refactoring to use sev-verify tool on this OS Release

Signed-off-by: Harika Nittala <lnittala@amd.com>

…suse leap Signed-off-by: Harika Nittala <lnittala@amd.com>

LakshmiSaiHarika added 8 commits June 8, 2026 18:18

feat: Add openSUSE Leap 16.0 image configurations

9593d1a

Add host and guest image configurations for openSUSE Leap 16.0 with required packages including kernel-default, systemd, qemu, and development tools. Signed-off-by: Harika Nittala <lnittala@amd.com>

build: Update tools tree and add systemd-conf module

da85938

Bump ToolsTreeRelease from 42 to 44 and include the new systemd-conf module in the common build configuration. Signed-off-by: Harika Nittala <lnittala@amd.com>

feat: Add openSUSE Leap support in build modules

cd2af80

Add opensuse-leap to the supported distributions in load-kernel-modules and network-fix build scripts for proper module configuration and resolv.conf handling. Signed-off-by: Harika Nittala <lnittala@amd.com>

feat: Add openSUSE Leap package mappings for certificate generator

ebe7f3c

Add opensuse-leap package names for qemu and ovmf in host_os_package.py, and add zypper package manager support in package_version.sh. Signed-off-by: Harika Nittala <lnittala@amd.com>

ci: Update Ubuntu codename from plucky to resolute

03da33e

Update apt sources to use Ubuntu resolute (26.04) for mkosi installation in the CI workflow. Signed-off-by: Harika Nittala <lnittala@amd.com>

refactor: Add OpenSUSE Leap in the build and release GH workflow

e364df9

Signed-off-by: Harika Nittala <lnittala@amd.com>

LakshmiSaiHarika force-pushed the add-opensuse-tumbleweed-os branch from bcf88d4 to b1eb17d Compare June 9, 2026 21:30

LakshmiSaiHarika commented Jun 9, 2026

View reviewed changes

This was referenced Jun 9, 2026

build opensuse Leap 16 host uki #28

Open

build opensuse Leap 16 guest image #21

Open

LakshmiSaiHarika requested a review from DGonzalezVillal June 9, 2026 21:54

LakshmiSaiHarika commented Jun 9, 2026

View reviewed changes

LakshmiSaiHarika marked this pull request as draft June 26, 2026 16:39

LakshmiSaiHarika added 2 commits June 30, 2026 15:29

refactor: add ovmf file path in OpenSUSE leap

0b5622e

Signed-off-by: Harika Nittala <lnittala@amd.com>

refactor: install ovmf package from Virtualization repository in Open…

a0cd136

…suse leap Signed-off-by: Harika Nittala <lnittala@amd.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

New OpenSUSE OS: Add OpenSUSE Tumbleweed OS to verify SNP certification.#180

New OpenSUSE OS: Add OpenSUSE Tumbleweed OS to verify SNP certification.#180
LakshmiSaiHarika wants to merge 10 commits into
AMDEPYC:mainfrom
LakshmiSaiHarika:add-opensuse-tumbleweed-os

LakshmiSaiHarika commented Nov 3, 2025

Uh oh!

npmccallum commented Nov 20, 2025

Uh oh!

LakshmiSaiHarika commented Jun 9, 2026 •

edited

Loading

Uh oh!

LakshmiSaiHarika commented Jun 9, 2026

Uh oh!

LakshmiSaiHarika Jun 9, 2026

Uh oh!

LakshmiSaiHarika Jun 9, 2026

Uh oh!

LakshmiSaiHarika left a comment •

edited

Loading

Uh oh!

LakshmiSaiHarika commented Jun 9, 2026

Uh oh!

LakshmiSaiHarika commented Jun 9, 2026

Uh oh!

LakshmiSaiHarika Jun 9, 2026

Uh oh!

LakshmiSaiHarika left a comment

Uh oh!

LakshmiSaiHarika commented Jun 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -0,0 +1,2 @@
		[Manager]
		StatusUnitFormat=combined

Uh oh!

Conversation

LakshmiSaiHarika commented Nov 3, 2025

Uh oh!

npmccallum commented Nov 20, 2025

Uh oh!

LakshmiSaiHarika commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LakshmiSaiHarika commented Jun 9, 2026

Uh oh!

LakshmiSaiHarika Jun 9, 2026

Choose a reason for hiding this comment

Uh oh!

LakshmiSaiHarika Jun 9, 2026

Choose a reason for hiding this comment

Uh oh!

LakshmiSaiHarika left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

LakshmiSaiHarika commented Jun 9, 2026

Uh oh!

LakshmiSaiHarika commented Jun 9, 2026

Uh oh!

LakshmiSaiHarika Jun 9, 2026

Choose a reason for hiding this comment

Uh oh!

LakshmiSaiHarika left a comment

Choose a reason for hiding this comment

Uh oh!

LakshmiSaiHarika commented Jun 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

LakshmiSaiHarika commented Jun 9, 2026 •

edited

Loading

LakshmiSaiHarika left a comment •

edited

Loading