From b393b228c1687bb8eb1a4a3c115675682dc69fc6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Leonard=20G=C3=B6hrs?= Date: Fri, 26 Jun 2026 10:03:18 +0200 Subject: [PATCH 1/3] base: do not install gcc MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit There is really no reason why a C compiler should be part of our base image. Signed-off-by: Leonard Göhrs --- base/setup.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/base/setup.sh b/base/setup.sh index 13d5c32..4dd542e 100755 --- a/base/setup.sh +++ b/base/setup.sh @@ -30,6 +30,6 @@ prepare sudo systemctl stop unattended-upgrades sudo -E apt-get --assume-yes purge openssh-server unattended-upgrades -sudo -E apt-get --assume-yes install rsync ssh gcc +sudo -E apt-get --assume-yes install rsync ssh cleanup From 4e6987b4f44171562cab94ce1efcd1ea48bf92bf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Leonard=20G=C3=B6hrs?= Date: Fri, 26 Jun 2026 10:15:14 +0200 Subject: [PATCH 2/3] labgrid-client: do not hardcode the name of the runner user MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This does not matter in practice, but I think it looks clever. Signed-off-by: Leonard Göhrs --- labgrid-client/setup.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/labgrid-client/setup.sh b/labgrid-client/setup.sh index 6aad02f..45f6870 100755 --- a/labgrid-client/setup.sh +++ b/labgrid-client/setup.sh @@ -15,7 +15,7 @@ sudo cp "${selfdir}/20-cuskci.network" /etc/systemd/network/ sudo -E apt-get install --assume-yes --no-install-recommends \ pipx qemu-system-x86 ovmf swtpm -sudo usermod -aG kvm runner +sudo usermod -aG kvm "$(whoami)" sudo -E pipx install --global --include-deps \ git+https://github.com/labgrid-project/labgrid From ba67e6c35b8a71f7bb575a6c5a9e85a48439fb76 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Leonard=20G=C3=B6hrs?= Date: Fri, 26 Jun 2026 10:12:22 +0200 Subject: [PATCH 3/3] base: install tpm2-pkcs11 and use it for SSH MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This enables us to log into hosts via SSH without exposing the private key to the running jobs. The tpm2-pkcs11 provider prints error messages when no store is set up, so only use it when one is present. Signed-off-by: Leonard Göhrs --- base/setup.sh | 4 +++- base/ssh_config | 4 ++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/base/setup.sh b/base/setup.sh index 4dd542e..6122769 100755 --- a/base/setup.sh +++ b/base/setup.sh @@ -30,6 +30,8 @@ prepare sudo systemctl stop unattended-upgrades sudo -E apt-get --assume-yes purge openssh-server unattended-upgrades -sudo -E apt-get --assume-yes install rsync ssh +sudo -E apt-get --assume-yes install libtpm2-pkcs11-1 rsync ssh + +sudo usermod -aG tss "$(whoami)" cleanup diff --git a/base/ssh_config b/base/ssh_config index 8336ebb..4270e1d 100644 --- a/base/ssh_config +++ b/base/ssh_config @@ -1,3 +1,7 @@ +# Use tpm2-pkcs11 if a TPM device is present and a store is set up +Match exec "test -e /dev/tpm0 -a -e ~/.tpm2_pkcs11" + PKCS11Provider /usr/lib/x86_64-linux-gnu/pkcs11/libtpm2_pkcs11.so + Host ptxdist-cache Hostname 10.0.2.2 User ptxdist-cache