stage0: fallback URL lists for _stage1 admission (mirror resiliency)#1
Merged
Conversation
Give stage0's _stage1 the same UrlList fallback stage1 has for _stage2, so the UKI
hop can list mirrors. http-only (stage0 has no TLS); the payload stays pinned, so any
mirror that yields verifying bytes is admitted and a dead/wrong mirror is skipped.
- config.rs: url and sig_url/args_url/args_sig_url become a UrlList (string or list);
deserialize-only, http-only + printable-ASCII per entry; Verify carries the lists.
- main.rs: replace the single-URL download with admit_payload/admit_from/download_first
(try each until one downloads AND admits), mirroring stage1; {sha256} substituted per
entry; signed-args fetch is list-aware. Admission stays a gate; only PCR 14 (the binary
hash) is measured.
- Makefile: boot-% gains FALLBACK=1 (dead 10.0.2.1:9 + real url) to exercise the loop.
Verified: x86_64 UEFI build clean; QEMU boot passes baseline (ed25519) and FALLBACK=1
(dead mirror refused fast, fell through to the real mirror, verified, PCR14, chain-loaded).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Gives stage0's
_stage1the sameUrlListfallback that stage1 has for_stage2, so the UKI hop can list mirrors. http-only (stage0 has no TLS); the payload stays cryptographically pinned, so any mirror that yields verifying bytes is admitted and a dead/wrong mirror is skipped.Changes
config.rs:urlandsig_url/args_url/args_sig_urlbecome aUrlList(a JSON string or a list). Deserialize-only (no_std), http-only + printable-ASCII per entry;Verifycarries the lists.main.rs: the single-URL download becomesadmit_payload/admit_from/download_first— try each URL until one downloads AND admits — mirroring stage1's loop.{sha256}is substituted per entry; the signed-args fetch is list-aware. Admission stays a gate; only PCR 14 (the payload hash) is measured.Makefile:boot-%gainsFALLBACK=1(a[dead 10.0.2.1:9, real]url list) to exercise the loop.Verification
FALLBACK=1rejects the dead mirror fast (RST ~8ms), falls through to the real mirror (DNS-resolved), verifies, extends PCR 14, and chain-loads.Prereq for the upcoming host-side deploy tool, which emits
_stage1(+_stage2) with mirror lists.🤖 Generated with Claude Code