From e3b52eb428fd75e97dab5a505eee492e791d3cbe Mon Sep 17 00:00:00 2001 From: Noel Georgi Date: Wed, 23 Sep 2026 20:17:50 +0530 Subject: [PATCH] feat: add software TPM support to libvirtd Package swtpm and its runtime dependencies so libvirt can provide emulated TPM devices. Relocate helper configuration under /usr/local while keeping writable CA state in /var, and ship package SBOMs with the complete TCG license definition. Signed-off-by: Noel Georgi --- .github/workflows/ci.yaml | 8 +- .github/workflows/grype-scan-cron.yaml | 4 +- .github/workflows/weekly.yaml | 4 +- .kres.yaml | 2 +- Makefile | 6 +- Pkgfile | 10 +-- README.md | 8 +- hypervisors/libvirtd/json-glib/pkg.yaml | 41 +++++++++++ hypervisors/libvirtd/json-glib/vars.yaml | 5 ++ hypervisors/libvirtd/libtpms/pkg.yaml | 94 ++++++++++++++++++++++++ hypervisors/libvirtd/libtpms/vars.yaml | 5 ++ hypervisors/libvirtd/pkg.yaml | 22 ++++++ hypervisors/libvirtd/swtpm/pkg.yaml | 50 +++++++++++++ hypervisors/libvirtd/swtpm/vars.yaml | 5 ++ 14 files changed, 243 insertions(+), 21 deletions(-) create mode 100644 hypervisors/libvirtd/json-glib/pkg.yaml create mode 100644 hypervisors/libvirtd/json-glib/vars.yaml create mode 100644 hypervisors/libvirtd/libtpms/pkg.yaml create mode 100644 hypervisors/libvirtd/libtpms/vars.yaml create mode 100644 hypervisors/libvirtd/swtpm/pkg.yaml create mode 100644 hypervisors/libvirtd/swtpm/vars.yaml diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 98df759b..7d74febd 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -1,6 +1,6 @@ # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT. # -# Generated on 2026-09-07T07:49:20Z by kres 4b55d17. +# Generated on 2026-09-23T14:40:08Z by kres c0dd940. concurrency: group: ${{ github.head_ref || github.run_id }} @@ -64,7 +64,7 @@ jobs: git fetch --prune --unshallow - name: Set up Docker Buildx id: setup-buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # version: v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # version: v4.4.1 with: append: | - endpoint: tcp://buildkit-arm64.ci.svc.cluster.local:1234 @@ -179,7 +179,7 @@ jobs: git fetch --prune --unshallow - name: Set up Docker Buildx id: setup-buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # version: v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # version: v4.4.1 with: driver: remote endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234 @@ -233,7 +233,7 @@ jobs: git fetch --prune --unshallow - name: Set up Docker Buildx id: setup-buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # version: v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # version: v4.4.1 with: append: | - endpoint: tcp://buildkit-arm64.ci.svc.cluster.local:1234 diff --git a/.github/workflows/grype-scan-cron.yaml b/.github/workflows/grype-scan-cron.yaml index a8b419c6..15b879e3 100644 --- a/.github/workflows/grype-scan-cron.yaml +++ b/.github/workflows/grype-scan-cron.yaml @@ -1,6 +1,6 @@ # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT. # -# Generated on 2026-09-07T07:49:20Z by kres 4b55d17. +# Generated on 2026-09-23T14:40:08Z by kres c0dd940. concurrency: group: ${{ github.head_ref || github.run_id }} @@ -46,7 +46,7 @@ jobs: git fetch --prune --unshallow - name: Set up Docker Buildx id: setup-buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # version: v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # version: v4.4.1 with: driver: remote endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234 diff --git a/.github/workflows/weekly.yaml b/.github/workflows/weekly.yaml index 21e84612..6d9753b4 100644 --- a/.github/workflows/weekly.yaml +++ b/.github/workflows/weekly.yaml @@ -1,6 +1,6 @@ # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT. # -# Generated on 2026-09-07T07:49:20Z by kres 4b55d17. +# Generated on 2026-09-23T14:40:08Z by kres c0dd940. concurrency: group: ${{ github.head_ref || github.run_id }} @@ -46,7 +46,7 @@ jobs: git fetch --prune --unshallow - name: Set up Docker Buildx id: setup-buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # version: v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # version: v4.4.1 with: append: | - endpoint: tcp://buildkit-arm64.ci.svc.cluster.local:1234 diff --git a/.kres.yaml b/.kres.yaml index 381d9cfc..681017ce 100644 --- a/.kres.yaml +++ b/.kres.yaml @@ -110,7 +110,7 @@ spec: - name: EXTENSIONS_IMAGE_REF defaultValue: $(REGISTRY_AND_USERNAME)/extensions:$(TAG) - name: PKGS - defaultValue: v1.15.0-alpha.0-37-g6868000 + defaultValue: v1.15.0-alpha.0-39-ga2b57ee - name: PKGS_PREFIX defaultValue: ghcr.io/siderolabs - name: TOOLS diff --git a/Makefile b/Makefile index 2d1ee16a..47982e3b 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,6 @@ # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT. # -# Generated on 2026-09-21T14:06:01Z by kres 3e1d3c0. +# Generated on 2026-09-23T13:08:07Z by kres c0dd940. # common variables @@ -27,7 +27,7 @@ SOURCE_DATE_EPOCH := $(shell git log $(INITIAL_COMMIT_SHA) --pretty=%ct) # sync bldr image with pkgfile -BLDR_RELEASE := v0.6.3 +BLDR_RELEASE := v0.6.4 BLDR_IMAGE := ghcr.io/siderolabs/bldr:$(BLDR_RELEASE) BLDR := docker run --rm --user $(shell id -u):$(shell id -g) --volume $(PWD):/src --entrypoint=/bldr $(BLDR_IMAGE) --root=/src @@ -57,7 +57,7 @@ COMMON_ARGS += $(BUILD_ARGS) # extra variables EXTENSIONS_IMAGE_REF ?= $(REGISTRY_AND_USERNAME)/extensions:$(TAG) -PKGS ?= v1.15.0-alpha.0-37-g6868000 +PKGS ?= v1.15.0-alpha.0-39-ga2b57ee PKGS_PREFIX ?= ghcr.io/siderolabs TOOLS ?= v1.15.0-alpha.0-10-gd40b203 TOOLS_PREFIX ?= ghcr.io/siderolabs diff --git a/Pkgfile b/Pkgfile index db42b85b..81d1c6fb 100644 --- a/Pkgfile +++ b/Pkgfile @@ -1,4 +1,4 @@ -# syntax = ghcr.io/siderolabs/bldr:v0.6.3 +# syntax = ghcr.io/siderolabs/bldr:v0.6.4 format: v1alpha2 @@ -6,18 +6,18 @@ vars: CONTAINERD_VERSION: v2.3.5 # update this when updating PKGS version tag in Makefile LINUX_FIRMWARE_VERSION: "20260916" # update this when updating PKGS version tag in Makefile DRBD_DRIVER_VERSION: 9.3.4 # update this when updating PKGS version tag in Makefile - PX_FUSE_DRIVER_VERSION: 8b52ef67d261369cbc93f132db299e5dcf64ad7c # update this when updating PKGS version tag in Makefile + PX_FUSE_DRIVER_VERSION: 89758677301c91c9667559bb0a6b553f61ab17c1 # update this when updating PKGS version tag in Makefile ZFS_DRIVER_VERSION: 2.4.4 # update this when updating PKGS version tag in Makefile ZFS_TOOLS_SHA256: 2a3c70d55a37cc71618a95a60e81ad66530201eb118d37741dc92efcf848c8b1 ZFS_TOOLS_SHA512: 8be81dedc0c0ec38728248151a33b8cbc78b042bc27a913279009bd735faa6149ad5b4a2db5811d25f4a03820dd398e14f59a4aec07f6bd4bc39405190c4e4ad UTIL_LINUX_VERSION: 2.42.2 # update this when updating TOOLS in Makefile UTIL_LINUX_SHA256: 03a05d3adf9602ef128f2da05b84b3205ce60c351e5737c0370f74000679ce8a UTIL_LINUX_SHA512: 7415add0be2930654e322830808dde03ff6d511bd357f0679e6b6287a13ca79fe58ce4ac05edef86b76fb381b3a36ca2da9d3c31b5dc0a1d889c203156a57277 - ENA_VERSION: 2.17.2 # update this when updating PKGS version tag in Makefile - TENSTORRENT_VERSION: 2.10.0 # update this when updating PKGS version tag in Makefile + ENA_VERSION: 2.17.3 # update this when updating PKGS version tag in Makefile + TENSTORRENT_VERSION: 2.11.0 # update this when updating PKGS version tag in Makefile HAILORT_VERSION: 4.24.0 # update this when updating PKGS version tag in Makefile MELLANOX_MSFTFLINT_VERSION: 4.34.1-4 # update this when updating PKGS version tag in Makefile - XDMA_VERSION: 8721136 # update this when updating PKGS version tag in Makefile + XDMA_VERSION: b846609 # update this when updating PKGS version tag in Makefile # renovate: datasource=git-tags extractVersion=^libtiprc-(?.*)$ depName=git://git.linux-nfs.org/projects/steved/libtirpc.git LIBTIRPC_VERSION: 1-3-6 diff --git a/README.md b/README.md index 6f4faf6a..db4c1f2a 100644 --- a/README.md +++ b/README.md @@ -109,7 +109,7 @@ tiers based on support level: | Name | Tier | Image | Version | Description | | ---- | ---- | ----- | ------- | ----------- | -| [amazon-ena](drivers/amazon-ena) | :green_square: core | [ghcr.io/siderolabs/amazon-ena](https://github.com/siderolabs/extensions/pkgs/container/amazon-ena) | `2.17.2-VERSION` | This system extension provides Amazon ENA kernel modules built against a specific Talos version. ENA is a networking interface designed to make good use of modern CPU features and system architectures. | +| [amazon-ena](drivers/amazon-ena) | :green_square: core | [ghcr.io/siderolabs/amazon-ena](https://github.com/siderolabs/extensions/pkgs/container/amazon-ena) | `2.17.3-VERSION` | This system extension provides Amazon ENA kernel modules built against a specific Talos version. ENA is a networking interface designed to make good use of modern CPU features and system architectures. | | [chelsio-drivers](drivers/chelsio) | :yellow_square: extra | [ghcr.io/siderolabs/chelsio-drivers](https://github.com/siderolabs/extensions/pkgs/container/chelsio-drivers) | `VERSION` | This system extension provides Chelsio network drivers. | | [gasket-driver](drivers/gasket) | :yellow_square: extra | [ghcr.io/siderolabs/gasket-driver](https://github.com/siderolabs/extensions/pkgs/container/gasket-driver) | `5815ee3-VERSION` | This system extension provides google gasket driver kernel modules built against a specific Talos version. This driver is required for PCIe and M.2 Google Coral accelerators. There are 2 kernel modules ("gasket" and "apex") required to enable this driver. | | [gpio-pinctrl](drivers/gpio-pinctrl) | :yellow_square: extra | [ghcr.io/siderolabs/gpio-pinctrl](https://github.com/siderolabs/extensions/pkgs/container/gpio-pinctrl) | `VERSION` | Intel Apollo Lake GPIO/Pinctrl drivers. Provides pinctrl-intel and pinctrl-broxton kernel modules for GPIO access on Intel Apollo Lake platforms (INT3452 ACPI device). | @@ -118,14 +118,14 @@ tiers based on support level: | [joydev](drivers/joydev) | :yellow_square: extra | [ghcr.io/siderolabs/joydev](https://github.com/siderolabs/extensions/pkgs/container/joydev) | `VERSION` | This system extension provides the joydev kernel module built against a specific Talos version. This kernel module provides the Linux joystick interface (/dev/input/js*) for the Gamepad API. It is required for game streaming software like Sunshine to expose gamepad input to applications that use the legacy joystick API or the browser Gamepad API via evdev-to-joydev translation. | | [mei](drivers/mei) | :green_square: core | [ghcr.io/siderolabs/mei](https://github.com/siderolabs/extensions/pkgs/container/mei) | `VERSION` | This system extension provides Intel Management Engine drivers kernel modules built against a specific Talos version. This driver enables the Intel Management Engine, a prerequisite for Intel Arc discrete GPUs. | | [mellanox-mstflint](drivers/mellanox-mstflint) | :white_large_square: contrib | [ghcr.io/siderolabs/mellanox-mstflint](https://github.com/siderolabs/extensions/pkgs/container/mellanox-mstflint) | `4.34.1-4-VERSION` | This system extension provides mstflint. | -| [tenstorrent](drivers/tenstorrent) | :yellow_square: extra | [ghcr.io/siderolabs/tenstorrent](https://github.com/siderolabs/extensions/pkgs/container/tenstorrent) | `2.10.0` | Driver for Tenstorrent AI processing hardware | +| [tenstorrent](drivers/tenstorrent) | :yellow_square: extra | [ghcr.io/siderolabs/tenstorrent](https://github.com/siderolabs/extensions/pkgs/container/tenstorrent) | `2.11.0` | Driver for Tenstorrent AI processing hardware | | [thunderbolt](drivers/thunderbolt) | :yellow_square: extra | [ghcr.io/siderolabs/thunderbolt](https://github.com/siderolabs/extensions/pkgs/container/thunderbolt) | `VERSION` | This system extension provides Thunderbolt/USB4 drivers kernel modules built against a specific Talos version. It enables support for Thunderbolt/USB4 devices, including those used for networking. WARNING: This extension automatically authorizes all Thunderbolt devices during system boot, which poses potential security risks. Use at your own discretion. | | [uhid](drivers/uhid) | :yellow_square: extra | [ghcr.io/siderolabs/uhid](https://github.com/siderolabs/extensions/pkgs/container/uhid) | `VERSION` | This system extension provides the uhid kernel module built against a specific Talos version. This kernel module provides user-space HID device support. Applications can create virtual HID devices (such as gamepads and controllers) via /dev/uhid, which is required for game streaming software like Sunshine to emulate gamepad input from Moonlight clients. | | [uinput](drivers/uinput) | :yellow_square: extra | [ghcr.io/siderolabs/uinput](https://github.com/siderolabs/extensions/pkgs/container/uinput) | `VERSION` | This system extension provides the uinput kernel module built against a specific Talos version. This kernel module makes it possible to emulate input devices from userspace. By writing to /dev/uinput (or /dev/input/uinput) device, a process can create a virtual input device with specific capabilities. Once this virtual device is created, the process can send events through it, that will be delivered to userspace and in-kernel consumers. | | [usb-audio-drivers](drivers/usb-audio-drivers) | :white_large_square: contrib | [ghcr.io/siderolabs/usb-audio-drivers](https://github.com/siderolabs/extensions/pkgs/container/usb-audio-drivers) | `VERSION` | This system extension provides ALSA USB Audio kernel modules built against a specific Talos version. This enables USB audio interfaces (class-compliant sound cards, headsets, DACs) on Talos Linux. | | [usb-modem-drivers](drivers/usb-modem) | :yellow_square: extra | [ghcr.io/siderolabs/usb-modem-drivers](https://github.com/siderolabs/extensions/pkgs/container/usb-modem-drivers) | `VERSION` | This system extension provides USB modem drivers kernel modules built against a specific Talos version. This driver is required for USB modems to function. This extension includes all the drivers needed to operate any USB modem under Linux, but your device might not require all of them. Read your device's docs to learn which drivers you need, or just enable them all as a starting point. | | [v4l-uvc-drivers](drivers/v4l-uvc) | :yellow_square: extra | [ghcr.io/siderolabs/v4l-uvc-drivers](https://github.com/siderolabs/extensions/pkgs/container/v4l-uvc-drivers) | `VERSION` | This system extension provides the Video4Linux kernel modules required for USB Video Class devices built against a specific Talos version. This driver enables Video4Linux devices such as webcams. | -| [xdma-driver](drivers/xdma-driver) | :yellow_square: extra | [ghcr.io/siderolabs/xdma-driver](https://github.com/siderolabs/extensions/pkgs/container/xdma-driver) | `8721136-VERSION` | Xilinx DMA Driver | +| [xdma-driver](drivers/xdma-driver) | :yellow_square: extra | [ghcr.io/siderolabs/xdma-driver](https://github.com/siderolabs/extensions/pkgs/container/xdma-driver) | `b846609-VERSION` | Xilinx DMA Driver | ### Digital Video Broadcasting (DVB) @@ -170,7 +170,7 @@ tiers based on support level: | [nfs-utils](storage/nfs-utils) | :white_large_square: contrib | [ghcr.io/siderolabs/nfs-utils](https://github.com/siderolabs/extensions/pkgs/container/nfs-utils) | `v0.1.1` | This system extension provides rpcbind and rpc.statd for NFSv3 file locking support. rpcbind is a server that converts RPC program numbers into universal addresses. rpc.statd is the NSM (Network Status Monitor) service daemon that notifies NFS peers of restarts. These services are required for NFSv3 mounts with file locking support. | | [nfsd](storage/nfsd) | :yellow_square: extra | [ghcr.io/siderolabs/nfsd](https://github.com/siderolabs/extensions/pkgs/container/nfsd) | `VERSION` | This system extension provides kernel module driver for NFSD built against a specific Talos version. | | [nfsrahead](storage/nfsrahead) | :white_large_square: contrib | [ghcr.io/siderolabs/nfsrahead](https://github.com/siderolabs/extensions/pkgs/container/nfsrahead) | `2.8.4` | This system extension provides nfsrahead, a tool to configure the readahead for NFS mounts. | -| [px-fuse](storage/px-fuse) | :yellow_square: extra | [ghcr.io/siderolabs/px-fuse](https://github.com/siderolabs/extensions/pkgs/container/px-fuse) | `8b52ef67d261369cbc93f132db299e5dcf64ad7c-VERSION` | This system extension provides kernel module driver for Portworx px-fuse built against a specific Talos version. | +| [px-fuse](storage/px-fuse) | :yellow_square: extra | [ghcr.io/siderolabs/px-fuse](https://github.com/siderolabs/extensions/pkgs/container/px-fuse) | `89758677301c91c9667559bb0a6b553f61ab17c1-VERSION` | This system extension provides kernel module driver for Portworx px-fuse built against a specific Talos version. | | [trident-iscsi-tools](storage/trident-iscsi-tools) | :white_large_square: contrib | [ghcr.io/siderolabs/trident-iscsi-tools](https://github.com/siderolabs/extensions/pkgs/container/trident-iscsi-tools) | `v0.0.1` | This system extension provides the tools and binaries used by the NetApp Trident CSI for iSCSI. It contains lsscsi, ls, free, pgrep, cat and dd. | | [zfs](storage/zfs) | :yellow_square: extra | [ghcr.io/siderolabs/zfs](https://github.com/siderolabs/extensions/pkgs/container/zfs) | `2.4.4-VERSION` | This system extension provides the ZFS kernel module, the ZFS utilities, and a service to import all ZFS pools on start and unmount all pools on stop. | diff --git a/hypervisors/libvirtd/json-glib/pkg.yaml b/hypervisors/libvirtd/json-glib/pkg.yaml new file mode 100644 index 00000000..a2ff4d39 --- /dev/null +++ b/hypervisors/libvirtd/json-glib/pkg.yaml @@ -0,0 +1,41 @@ +name: json-glib +variant: scratch +shell: /bin/bash +dependencies: + - stage: base + - stage: glib +steps: + - sources: + - url: https://download.gnome.org/sources/json-glib/{{ regexReplaceAll "\\.[0-9]+$" .JSON_GLIB_VERSION "" }}/json-glib-{{ .JSON_GLIB_VERSION }}.tar.xz + destination: json-glib.tar.xz + sha256: "{{ .JSON_GLIB_SHA256 }}" + sha512: "{{ .JSON_GLIB_SHA512 }}" + prepare: + - | + tar -xf json-glib.tar.xz --strip-components=1 + meson setup build \ + --prefix=/usr/local \ + --libdir=/usr/local/lib \ + --buildtype=plain \ + --wrap-mode=nodownload \ + -Dintrospection=disabled \ + -Ddocumentation=disabled \ + -Dtests=false \ + -Dconformance=false \ + -Dinstalled_tests=false \ + -Dnls=disabled + build: + - | + meson compile -C build + install: + - | + DESTDIR=/rootfs meson install --no-rebuild -C build + sbom: + outputPath: /rootfs/usr/local/share/spdx/json-glib.spdx.json + version: {{ .JSON_GLIB_VERSION }} + # No JSON-GLib CPE was found in Grype or the NVD dictionary. + licenses: + - LGPL-2.1-or-later +finalize: + - from: /rootfs + to: / diff --git a/hypervisors/libvirtd/json-glib/vars.yaml b/hypervisors/libvirtd/json-glib/vars.yaml new file mode 100644 index 00000000..ac032e76 --- /dev/null +++ b/hypervisors/libvirtd/json-glib/vars.yaml @@ -0,0 +1,5 @@ +INTERNAL_PACKAGE: true +# renovate: datasource=git-tags depName=https://gitlab.gnome.org/GNOME/json-glib.git +JSON_GLIB_VERSION: 1.10.8 +JSON_GLIB_SHA256: 55c5c141a564245b8f8fbe7698663c87a45a7333c2a2c56f06f811ab73b212dd +JSON_GLIB_SHA512: f4ba8660b586a4e738803e4dbfdfcd34fa7ceba9189e7bf3f2b50e21f4d4886f99535ceb3453c89b1d1ae8d96bf4168a135b73b7e1a2dbc46b19e9b710ad56a1 diff --git a/hypervisors/libvirtd/libtpms/pkg.yaml b/hypervisors/libvirtd/libtpms/pkg.yaml new file mode 100644 index 00000000..15fb09b4 --- /dev/null +++ b/hypervisors/libvirtd/libtpms/pkg.yaml @@ -0,0 +1,94 @@ +name: libtpms +variant: scratch +shell: /bin/bash +dependencies: + - stage: base +steps: + - sources: + - url: https://github.com/stefanberger/libtpms/archive/refs/tags/{{ .LIBTPMS_VERSION }}.tar.gz + destination: libtpms.tar.gz + sha256: "{{ .LIBTPMS_SHA256 }}" + sha512: "{{ .LIBTPMS_SHA512 }}" + prepare: + - | + tar -xzf libtpms.tar.gz --strip-components=1 + NOCONFIGURE=1 ./autogen.sh + + ./configure \ + --prefix=/usr/local \ + --libdir=/usr/local/lib \ + --disable-static \ + --with-openssl + build: + - | + make -j $(nproc) + install: + - | + make install DESTDIR=/rootfs + rm -rf /rootfs/usr/local/share + sbom: + outputPath: /rootfs/usr/local/share/spdx/libtpms.spdx.json + version: {{ .LIBTPMS_VERSION | trimPrefix "v" }} + cpes: + - cpe:2.3:a:libtpms_project:libtpms:{{ .LIBTPMS_VERSION | trimPrefix "v" }}:*:*:*:*:*:*:* + licenses: + - BSD-3-Clause + customLicenses: + # TPM 2 license and notices from LICENSE at upstream tag v0.10.2. + - id: LicenseRef-TCGL + text: |+ + Licenses and Notices + + 1. Copyright Licenses: + + - Trusted Computing Group (TCG) grants to the user of the source code in + this specification (the "Source Code") a worldwide, irrevocable, + nonexclusive, royalty free, copyright license to reproduce, create + derivative works, distribute, display and perform the Source Code and + derivative works thereof, and to grant others the rights granted herein. + + - The TCG grants to the user of the other parts of the specification + (other than the Source Code) the rights to reproduce, distribute, + display, and perform the specification solely for the purpose of + developing products based on such documents. + + 2. Source Code Distribution Conditions: + + - Redistributions of Source Code must retain the above copyright licenses, + this list of conditions and the following disclaimers. + + - Redistributions in binary form must reproduce the above copyright + licenses, this list of conditions and the following disclaimers in the + documentation and/or other materials provided with the distribution. + + 3. Disclaimers: + + - THE COPYRIGHT LICENSES SET FORTH ABOVE DO NOT REPRESENT ANY FORM OF + LICENSE OR WAIVER, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, WITH + RESPECT TO PATENT RIGHTS HELD BY TCG MEMBERS (OR OTHER THIRD PARTIES) + THAT MAY BE NECESSARY TO IMPLEMENT THIS SPECIFICATION OR OTHERWISE. + Contact TCG Administration (admin@trustedcomputinggroup.org) for + information on specification licensing rights available through TCG + membership agreements. + + - THIS SPECIFICATION IS PROVIDED "AS IS" WITH NO EXPRESS OR IMPLIED + WARRANTIES WHATSOEVER, INCLUDING ANY WARRANTY OF MERCHANTABILITY OR + FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, COMPLETENESS, OR + NONINFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS, OR ANY WARRANTY + OTHERWISE ARISING OUT OF ANY PROPOSAL, SPECIFICATION OR SAMPLE. + + - Without limitation, TCG and its members and licensors disclaim all + liability, including liability for infringement of any proprietary + rights, relating to use of information in this specification and to the + implementation of this specification, and TCG disclaims all liability for + cost of procurement of substitute goods or services, lost profits, loss + of use, loss of data or any incidental, consequential, direct, indirect, + or special damages, whether under contract, tort, warranty or otherwise, + arising in any way out of use or reliance upon this specification or any + information herein. + + (c) Copyright IBM Corp. and others, 2012-2016 + +finalize: + - from: /rootfs + to: / diff --git a/hypervisors/libvirtd/libtpms/vars.yaml b/hypervisors/libvirtd/libtpms/vars.yaml new file mode 100644 index 00000000..cc59d339 --- /dev/null +++ b/hypervisors/libvirtd/libtpms/vars.yaml @@ -0,0 +1,5 @@ +INTERNAL_PACKAGE: true +# renovate: datasource=github-releases depName=stefanberger/libtpms +LIBTPMS_VERSION: v0.10.2 +LIBTPMS_SHA256: edac03680f8a4a1c5c1d609a10e3f41e1a129e38ff5158f0c8deaedc719fb127 +LIBTPMS_SHA512: e30297289a03d4fefb2cdf44654d6f77719a021deb9b721f08d4a23e20706b903ef5e979ba05ad333d052cf35681ba5e143fb883bed0dc37626eca2807d0c01f diff --git a/hypervisors/libvirtd/pkg.yaml b/hypervisors/libvirtd/pkg.yaml index 107fb642..3009d7af 100644 --- a/hypervisors/libvirtd/pkg.yaml +++ b/hypervisors/libvirtd/pkg.yaml @@ -27,6 +27,28 @@ dependencies: - image: "{{ .BUILD_ARG_PKGS_PREFIX }}/openssl:{{ .BUILD_ARG_PKGS }}" from: /usr/lib to: /rootfs/usr/local/lib + - image: "{{ .BUILD_ARG_PKGS_PREFIX }}/gnutls:{{ .BUILD_ARG_PKGS }}" + from: /usr/bin/certtool + to: /rootfs/usr/local/bin/certtool + - image: "{{ .BUILD_ARG_PKGS_PREFIX }}/libseccomp:{{ .BUILD_ARG_PKGS }}" + from: /usr/lib + to: /rootfs/usr/local/lib + - stage: libtpms + from: /usr/local/lib + to: /rootfs/usr/local/lib + - stage: json-glib + from: /usr/local/lib + to: /rootfs/usr/local/lib + - stage: swtpm + from: /usr/local + to: /rootfs/usr/local + # Partial runtime copies above do not include the libraries' license metadata. + - stage: libtpms + from: /usr/local/share/spdx/libtpms.spdx.json + to: /rootfs/usr/local/share/spdx/libtpms.spdx.json + - stage: json-glib + from: /usr/local/share/spdx/json-glib.spdx.json + to: /rootfs/usr/local/share/spdx/json-glib.spdx.json - stage: libxml2 from: /rootfs to: / diff --git a/hypervisors/libvirtd/swtpm/pkg.yaml b/hypervisors/libvirtd/swtpm/pkg.yaml new file mode 100644 index 00000000..fd8ed98e --- /dev/null +++ b/hypervisors/libvirtd/swtpm/pkg.yaml @@ -0,0 +1,50 @@ +name: swtpm +variant: scratch +shell: /bin/bash +dependencies: + - stage: base + - stage: glib + - stage: json-glib + - stage: libtpms + - image: "{{ .BUILD_ARG_PKGS_PREFIX }}/libseccomp:{{ .BUILD_ARG_PKGS }}" +steps: + - sources: + - url: https://github.com/stefanberger/swtpm/archive/refs/tags/{{ .SWTPM_VERSION }}.tar.gz + destination: swtpm.tar.gz + sha256: "{{ .SWTPM_SHA256 }}" + sha512: "{{ .SWTPM_SHA512 }}" + env: + BUILD_DATE: "1" + prepare: + - | + tar -xzf swtpm.tar.gz --strip-components=1 + NOCONFIGURE=1 ./autogen.sh + + # Keep immutable configuration/helpers in the extension and CA state in /var. + ./configure \ + --prefix=/usr/local \ + --libdir=/usr/local/lib \ + --sysconfdir=/usr/local/etc/swtpm \ + --localstatedir=/var \ + --with-tss-user=root \ + --with-tss-group=root \ + --without-cuse \ + --without-selinux \ + --disable-tests + build: + - | + make -j $(nproc) + install: + - | + make install DESTDIR=/rootfs + rm -rf /rootfs/usr/local/share/man /rootfs/usr/local/libexec/installed-tests + sbom: + outputPath: /rootfs/usr/local/share/spdx/swtpm.spdx.json + version: {{ .SWTPM_VERSION | trimPrefix "v" }} + cpes: + - cpe:2.3:a:swtpm_project:swtpm:{{ .SWTPM_VERSION | trimPrefix "v" }}:*:*:*:*:*:*:* + licenses: + - BSD-3-Clause +finalize: + - from: /rootfs + to: / diff --git a/hypervisors/libvirtd/swtpm/vars.yaml b/hypervisors/libvirtd/swtpm/vars.yaml new file mode 100644 index 00000000..2cf9a26a --- /dev/null +++ b/hypervisors/libvirtd/swtpm/vars.yaml @@ -0,0 +1,5 @@ +INTERNAL_PACKAGE: true +# renovate: datasource=github-releases depName=stefanberger/swtpm +SWTPM_VERSION: v0.10.2 +SWTPM_SHA256: f61cf6f1e9bbcb4cefb30b70cafaf1c4df54c6961e65cfa63830e8ad0e220134 +SWTPM_SHA512: 412034286eab4245127cf063ec637e3ca8cabcd8b58692d55b4eab49f4e9519da3107c104b771d2a097a09ffacd78aa825d0882558eff3128d7f4d2af7871574