stage0 netboot rework, mkuki library, and local full-chain test harness#8
Merged
Conversation
One unit of work across stage0, mkuki, the metadata schema, and the test/CI
tooling; the pieces interlock and were not cleanly separable.
stage0 transport:
- Replace EFI_HTTP/HttpDxe with a raw EFI_TCP4 + EFI_DNS4 client (tcp4.rs,
dns4.rs, http.rs, net.rs). HttpDxe does not drain multi-segment response
bodies and is the least portable network driver; TCP4/DNS4 is the portable
subset. A tight-poll pump() fixes receive throughput. DNS configures
statically from the existing DHCP lease (no second DHCP).
- Boot-relative timing logs (timing.rs) for diagnosing stalls.
stage0 admission:
- Embedded _stage1 metadata via a PE section (embedded.rs), used in place of
the cloud metadata service when present (signed and measured with the image).
- Signed remote args (args_url plus optional args_sig_url, {sha256} templated).
- Content-addressable sig_url ({sha256}); reject non-http URLs.
Metadata schema:
- Rename the _stage0 key to _stage1. The key names the target a stage loads:
stage0 reads _stage1, stage1 reads _stage2.
mkuki:
- Rename crate lockboot-mkuki to mkuki and expose it as an importable library
(lib.rs) with a thin CLI; tracing-based logging.
Test harness:
- make boot-stage0-<arch> now defaults to the signed test payload and
regenerates user-data each run, so it works with no arguments and never goes
stale. test-stage0 is an alias.
- New make test-chain-<arch>: full stage0 -> UKI -> stage1 -> stage2 chain
served from one local directory (no S3). boot.sh gains --serve-dir.
Makefile / CI:
- Dependency prep and key generation run inside the build container, so slim
runners (e.g. act) without rpm2cpio/cpio/curl can build.
- Remove the legacy direct-UKI boot targets (UKI is netboot-only via stage0).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
HarryR
added a commit
that referenced
this pull request
Jun 21, 2026
GitHub force-runs Node 20 actions on Node 24 and emits a deprecation warning (seen on PR #8's build job for `upload-artifact`). This bumps every pinned action to its latest Node 24 release, still SHA-pinned with accurate version comments. `node24` was not backported to the prior majors of the `docker/*` and `gh-release` actions, so those are **major** bumps. The workflow uses only vanilla options, and each required input was verified to still exist in the new majors. | Action | From | To | Runs in | |---|---|---|---| | actions/upload-artifact | v5.0.0 | v7.0.1 | build (per-push) | | actions/download-artifact | v5.0.0 | v8.0.1 | release (tag) | | softprops/action-gh-release | v2.4.2 | v3.0.1 | release (tag) | | docker/setup-buildx-action | v3.7.1 | v4.1.0 | release (tag) | | docker/login-action | v3.3.0 | v4.2.0 | release (tag) | | docker/metadata-action | v5.5.1 | v6.1.0 | release (tag) | | docker/build-push-action | v6.18.0 | v7.2.0 | release (tag) | `actions/checkout` (v5.0.0) and `actions/attest-build-provenance` (v3.0.0, composite) were already Node 24, left as-is. This PR's CI exercises the `upload-artifact` bump on the build job. The `docker/*` and `gh-release` bumps only run in the tag-gated release jobs, so they get exercised on the next `stage0-v*` / `uki-v*` tag. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
One interlocking unit of work (could not be cleanly split):
stage0 transport — replace EFI_HTTP/HttpDxe with a raw EFI_TCP4 + EFI_DNS4 client (
tcp4.rs,dns4.rs,http.rs,net.rs). HttpDxe does not drain multi-segment bodies and is the least portable network driver. Tight-pollpump()restores receive throughput; DNS configures statically from the existing DHCP lease (no second DHCP). Boot-relative timing logs (timing.rs).stage0 admission — embedded
_stage1metadata via a PE section (embedded.rs, signed + measured with the image); signed remote args (args_url+ optionalargs_sig_url,{sha256}templated); content-addressablesig_url; reject non-http URLs.Metadata schema — rename the
_stage0key to_stage1. The key names the target a stage loads: stage0 reads_stage1, stage1 reads_stage2.mkuki — rename crate
lockboot-mkukitomkuki, expose as an importable library (lib.rs) with a thin CLI, tracing-based logging.Test harness —
make boot-stage0-<arch>defaults to the signed test payload and regenerates user-data each run (works with no args, never stale). Newmake test-chain-<arch>: fullstage0 -> UKI -> stage1 -> stage2chain served from one local directory (no S3);boot.shgains--serve-dir.Makefile / CI — dependency prep + key generation run inside the build container so slim runners (e.g.
act) withoutrpm2cpio/cpio/curlbuild cleanly. Removed the legacy direct-UKI boot targets.Test plan
make boot-stage0-x86_64(stage0 + signed leaf payload, ed25519): verified end to end locally.make test-chain-x86_64(full chain, local-served, sha256): verified end to end locally.actcontainerization fixes.🤖 Generated with Claude Code