Build host images with sev_verify harness#257
Draft
amd-aliem wants to merge 2 commits into
Draft
Conversation
Signed-off-by: Amanda Liem <aliem@amd.com>
Signed-off-by: Amanda Liem <aliem@amd.com>
There was a problem hiding this comment.
Pull request overview
This PR reworks the host-image boot pipeline to run the SEV certification harness (sev_verify) during the test stage, removing the prior launch/report stages and switching certificate/report publishing to consume sev-verify JSON/Markdown artifacts under /root/results/.
Changes:
- Add
sev_verifypackaging/installation into the host image and a newsev-verify.servicethat runs the harness duringtest.target. - Remove
launch.target/report.targetand their associated services/scripts, updating target ordering toboot → system → test → stop. - Update
beacon-reportto publish reports generated bysev-verify(Markdown + optional embeddedsev-verify.log) and derive milestones from the achieved certified level.
Reviewed changes
Copilot reviewed 36 out of 37 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| sev_verify/output.py | Updates Markdown report headers and table columns to use test descriptions. |
| pyproject.toml | Adds setuptools-based packaging and sev-verify console script entrypoint. |
| modules/test/host/test-done/mkosi.extra/usr/local/lib/systemd/system/test-done.service | Makes the test barrier depend on sev-verify.service. |
| modules/test/host/sev-verify/mkosi.postinst | Installs sev_verify into the host image via pip from repo sources. |
| modules/test/host/sev-verify/mkosi.extra/usr/local/lib/systemd/system/sev-verify.service | Adds a oneshot systemd service to run sev-verify during the test stage. |
| modules/test/host/sev-verify/mkosi.extra/usr/local/lib/scripts/run-sev-verify.sh | Adds the harness runner script that writes /root/results/ artifacts. |
| modules/test/host/sev-verify/mkosi.conf | Adds mkosi BuildSources mapping to include repo sources in the image build. |
| modules/test/host/mkosi.conf | Includes the new sev-verify module in the host test image. |
| modules/stop/host/beacon-report/mkosi.extra/usr/local/lib/systemd/system/beacon-report.service | Re-targets beacon reporting to run after test.target instead of report.target. |
| modules/stop/host/beacon-report/mkosi.extra/usr/local/lib/scripts/get_processor_model.py | Adds CPU model detection helper used for beacon labels. |
| modules/stop/host/beacon-report/mkosi.extra/usr/local/lib/scripts/beacon-report.sh | Switches beacon publishing to consume sev-verify JSON/Markdown outputs in /root/results/. |
| modules/report/host/sev-certificate-generator/mkosi.extra/usr/local/lib/systemd/system/sev-certificate-generator.service | Removes legacy certificate generator systemd unit. |
| modules/report/host/sev-certificate-generator/mkosi.extra/usr/local/lib/scripts/generate_sev_certificate/test_environment/sev_version_3_0_0_0/test_environment.py | Removes legacy test-environment reporting code. |
| modules/report/host/sev-certificate-generator/mkosi.extra/usr/local/lib/scripts/generate_sev_certificate/test_environment/sev_version_3_0_0_0/host_environment/package_version.sh | Removes legacy package-version helper. |
| modules/report/host/sev-certificate-generator/mkosi.extra/usr/local/lib/scripts/generate_sev_certificate/test_environment/sev_version_3_0_0_0/host_environment/host_os_package.py | Removes legacy host package mapping. |
| modules/report/host/sev-certificate-generator/mkosi.extra/usr/local/lib/scripts/generate_sev_certificate/test_environment/sev_version_3_0_0_0/host_environment/host_environment.py | Removes legacy host environment reporting. |
| modules/report/host/sev-certificate-generator/mkosi.extra/usr/local/lib/scripts/generate_sev_certificate/test_environment/sev_version_3_0_0_0/guest_environment_on_host/guest_environment_on_host.py | Removes legacy guest-on-host environment reporting. |
| modules/report/host/sev-certificate-generator/mkosi.extra/usr/local/lib/scripts/generate_sev_certificate/sev_certificate/sev_certificate_version_3_0_0_0.py | Removes legacy SEV certificate generation implementation. |
| modules/report/host/sev-certificate-generator/mkosi.extra/usr/local/lib/scripts/generate_sev_certificate/sev_certificate/generate_sev_certificate.py | Removes legacy SEV certificate generator entrypoint. |
| modules/report/host/sev-certificate-generator/mkosi.extra/usr/local/lib/scripts/generate_sev_certificate/service/service.py | Removes legacy systemd log parsing helper. |
| modules/report/host/report-done/mkosi.extra/usr/local/lib/systemd/system/report-done.service | Removes report-stage barrier unit. |
| modules/report/host/mkosi.conf | Removes report-stage module includes. |
| modules/report/host/display-guest-logs/mkosi.extra/usr/local/lib/systemd/system/display-guest-logs.service | Removes legacy guest log display service. |
| modules/report/host/display-guest-logs/mkosi.extra/usr/local/lib/scripts/display-guest-logs.sh | Removes legacy guest log display script. |
| modules/launch/host/verify-guest/mkosi.extra/usr/local/lib/systemd/system/verify-guest.service | Removes legacy guest verification service. |
| modules/launch/host/verify-guest/mkosi.extra/usr/local/lib/scripts/verify-guest.sh | Removes legacy guest verification script. |
| modules/launch/host/mkosi.conf | Removes launch-stage module includes. |
| modules/launch/host/launch-guest/mkosi.extra/usr/local/lib/systemd/system/launch-guest.service | Removes legacy guest launch service. |
| modules/launch/host/launch-guest/mkosi.extra/usr/local/lib/scripts/launch-guest.sh | Removes legacy guest launch script. |
| modules/launch/host/launch-done/mkosi.extra/usr/local/lib/systemd/system/launch-done.service | Removes launch-stage barrier unit. |
| modules/launch/host/guest-measurement/mkosi.extra/usr/local/lib/scripts/guest_measurement.sh | Removes legacy measurement generation script. |
| modules/build/host/targets/mkosi.extra/usr/local/lib/systemd/system/test.target | Updates test stage ordering to start after system.target. |
| modules/build/host/targets/mkosi.extra/usr/local/lib/systemd/system/stop.target | Updates stop stage to start after test.target. |
| modules/build/host/targets/mkosi.extra/usr/local/lib/systemd/system/report.target | Removes report stage target. |
| modules/build/host/targets/mkosi.extra/usr/local/lib/systemd/system/launch.target | Removes launch stage target. |
| modules/build/host/mkosi.conf | Drops inclusion of removed launch/report host modules. |
| docs/troubleshooting.md | Adds updated troubleshooting docs matching the new stage pipeline and artifact locations. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+2
to
+14
| set -uo pipefail | ||
|
|
||
| RESULTS_DIR="/root/results" | ||
| LOG_FILE="${RESULTS_DIR}/sev-verify.log" | ||
|
|
||
| mkdir -p "$RESULTS_DIR" | ||
|
|
||
| python3 -m sev_verify \ | ||
| /usr/local/lib/guest-image/guest.efi \ | ||
| --output-dir "$RESULTS_DIR" \ | ||
| 2>&1 | tee "$LOG_FILE" | ||
|
|
||
| exit "${PIPESTATUS[0]}" |
Comment on lines
+153
to
+157
| w("| Test | Description | Result |") | ||
| w("|------|-------------|--------|") | ||
| for tr in trs: | ||
| icon = _RESULT_ICON.get(tr.result, tr.result) | ||
| w(f"| {tr.test.name} | {tr.test.scope} | {icon} |") | ||
| w(f"| {tr.test.name} | {tr.test.description} | {icon} |") |
Comment on lines
+165
to
+169
| w("| Test | Description | Result |") | ||
| w("|------|-------------|--------|") | ||
| for tr in unlabeled: | ||
| icon = _RESULT_ICON.get(tr.result, tr.result) | ||
| w(f"| {tr.test.name} | {tr.test.scope} | {icon} |") | ||
| w(f"| {tr.test.name} | {tr.test.description} | {icon} |") |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DO NOT MERGE BEFORE MAX CERT LEVELS ARE IMPLEMENTED - waiting on #256. We want to group a few tests in 3.0.0-1 that are under development, so need to cap the max achievable cert level/milestone to 3.0.0-0 for now while still allowing the 3.0.0-1 tests to run.
Add sev_verify into host image and rework host systemd order to call it. Remove launch.target and report.target, add sev-verify.service into test.target. Guest launch(es) and certificate generation is moved into sev_verify to run during the test stage.
boot.target -> system.target ->
launch.target ->test.target ->report.target ->stop.targetExample issue: amd-aliem#170
Services by Stage
Boot / System
Launch (Removed)calculate-measurement.servicelaunch-guest.serviceverify-guest.serviceTest
Report (Removed)display-guest-logs.servicesev-certificate-generator.serviceStop
Barriers
launch-done.servicereport-done.serviceArtifacts
/sev_certificate_v3.0.0-0.txt