stage1: config on stdin, drop --url/--file; args smoke test + doc fixes#14
Merged
Conversation
Config input the Unix way: a user-data document piped on stdin now wins over the cloud metadata service (stage1 < user-data.json). stdin is only read when fd 0 is a pipe or regular file, never the console, so PID 1 never blocks. The --url/--file dev flags are removed -- pipe instead. stage1 no longer takes any config-source args; stage0 passes none, and a piped config takes precedence over argv. --attest is unchanged. Add a smoke-args-% target: boots the full chain with a known inline _stage2.args array (one arg has a space, to prove a real argv vector and not shell word-splitting) and asserts the payload echoed it. The signed -remote-args path stays covered by test-chain SIGN=1 SIGN_ARGS=1. Refresh the stale crate READMEs, which predated the deploy-tool split and the memfd/stdin work: drop --make-config/--url/--file, and correct the measurement docs (code-only PCR 14; config is NOT measured into PCR 15, and the attestation nonce is H(binary), not H(H(binary)||H(config))). Verified: full chain boots in both sha256 and ed25519 modes; smoke-args passes for inline args and signed args reach argv. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
stage1 < user-data.json). stdin is read only when fd 0 is a pipe or regular file (never the console), so PID 1 never blocks. The--url/--filedev flags are removed -- pipe instead.--attestunchanged. The_stage2-> stage2 argv path is untouched.smoke-args-%target boots the full chain with an inline_stage2.args = ["--smoke","hello world"]and asserts the payload echoedarg[1]/arg[2](the space proves a real argv vector, not shell word-splitting). Signed remote args stay covered bytest-chain SIGN=1 SIGN_ARGS=1.--make-config/--url/--fileand/tmp/stage2.exe; correct the measurement docs to code-only PCR 14 (config is NOT measured into PCR 15; attest nonce isH(binary), notH(H(binary)||H(config))). Add an args-model note to the root README.Args model (documented, no behavior change)
_stage2.args/ signedargs_url._stage1.argsis stage0's generic EFI LoadOptions; for this Linux UKI the kernel cmdline is baked/measured/immutable and LoadOptions are ignored under Secure Boot, so operator config flows through_stage2, not the cmdline. (stage0 side documented separately.)Verification
make smoke-args-x86_64-> PASS (arg[1]: --smoke,arg[2]: hello world, space preserved).make test-chain-x86_64 SIGN=1 SIGN_ARGS=1-> signed args reach argv (--from,signed-args).make test-chain-x86_64and... SIGN=1-> full chain boots + powers off in both modes, config on stdin.cargo testgreen;cargo check -p stage1warning-free.🤖 Generated with Claude Code