systemd: build cryptsetup #691
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
vigh-m
force-pushed
the
systemd-cryptsetup-build
branch
from
6587c86 to
a197f44
Compare
|
⬆️ split the changes into multiple commits |
bcressey
reviewed
Oct 14, 2025
Comment on lines
22
to
23
| +# else | ||
| +# include <openssl/hmac.h> |
There was a problem hiding this comment.
This should have its own guard:
# ifndef OPENSSL_HMAC_H
# include <openssl/hmac.h>
# endif
| if (r < 0) | ||
| return log_debug_errno(SYNTHETIC_ERRNO(EIO), | ||
| - "Signature verification failed: 0x%lx", ERR_get_error()); | ||
| + "Signature verification failed: 0x%u", ERR_get_error()); |
There was a problem hiding this comment.
If this is really a uint32_t, you should use the matching printf specifier:
#include <inttypes.h>
...
"Signature verification failed: 0x"PRIx32, ERR_get_error()
| DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(ASN1_TYPE*, ASN1_TYPE_free, NULL); | ||
| DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(ASN1_STRING*, ASN1_STRING_free, NULL); | ||
|
|
||
| +# ifndef OPENSSL_NO_UI_CONSOLE |
Comment on lines
6
to
7
| # Disable OpenSSL UI since aws-lc does not support it. | ||
| %global _cross_cflags %{_cross_cflags} -DOPENSSL_NO_UI_CONSOLE=1 |
There was a problem hiding this comment.
I'd slightly prefer either:
- patching the pkgconfig file in
libcryptoto include this by default - patching
meson.buildto include it
Comment on lines
73
to
75
| # Disable sb-sign since that has a dependency on PKCS7 which is not provided | ||
| # by aws-lc | ||
| Patch9015: 9015-disable-sb-sign.patch |
There was a problem hiding this comment.
Suggested change
| # Disable sb-sign since that has a dependency on PKCS7 which is not provided | |
| # by aws-lc | |
| Patch9015: 9015-disable-sb-sign.patch | |
| # Disable sb-sign since that has a dependency on PKCS7 which is not provided | |
| # by aws-lc | |
| Patch9015: 9015-disable-sb-sign.patch |
Comment on lines
821
to
833
| %{_cross_libdir}/pcrlock.d/350-action-efi-application.pcrlock | ||
| %{_cross_libdir}/pcrlock.d/400-secureboot-separator.pcrlock.d/300-0x00000000.pcrlock | ||
| %{_cross_libdir}/pcrlock.d/400-secureboot-separator.pcrlock.d/600-0xffffffff.pcrlock | ||
| %{_cross_libdir}/pcrlock.d/500-separator.pcrlock.d/300-0x00000000.pcrlock | ||
| %{_cross_libdir}/pcrlock.d/500-separator.pcrlock.d/600-0xffffffff.pcrlock | ||
| %{_cross_libdir}/pcrlock.d/700-action-efi-exit-boot-services.pcrlock.d/300-present.pcrlock | ||
| %{_cross_libdir}/pcrlock.d/700-action-efi-exit-boot-services.pcrlock.d/600-absent.pcrlock | ||
| %{_cross_libdir}/pcrlock.d/750-enter-initrd.pcrlock | ||
| %{_cross_libdir}/pcrlock.d/800-leave-initrd.pcrlock | ||
| %{_cross_libdir}/pcrlock.d/850-sysinit.pcrlock | ||
| %{_cross_libdir}/pcrlock.d/900-ready.pcrlock | ||
| %{_cross_libdir}/pcrlock.d/950-shutdown.pcrlock | ||
| %{_cross_libdir}/pcrlock.d/990-final.pcrlock |
There was a problem hiding this comment.
I doubt that these specific pcrlock policy files will be useful, though the mechanism is elegant.
I'd like to get systemd-pcrextend included; that's what would perform some of the measurements that these pcrlock files anticipate.
There was a problem hiding this comment.
Ack. I've %exclude(d) them in their own section for now. systemd-pcrextend requires BOOTLOADER to be enabled which I can explore outside of this
Comment on lines
834
to
836
| %{_cross_libdir}/systemd/system-generators/systemd-cryptsetup-generator | ||
| %{_cross_libdir}/systemd/system-generators/systemd-integritysetup-generator | ||
| %{_cross_libdir}/systemd/system-generators/systemd-veritysetup-generator |
There was a problem hiding this comment.
Suggested change
| %{_cross_libdir}/systemd/system-generators/systemd-cryptsetup-generator | |
| %{_cross_libdir}/systemd/system-generators/systemd-integritysetup-generator | |
| %{_cross_libdir}/systemd/system-generators/systemd-veritysetup-generator | |
| %{_cross_systemdgeneratordir}/systemd-cryptsetup-generator | |
| %{_cross_systemdgeneratordir}/systemd-integritysetup-generator | |
| %{_cross_systemdgeneratordir}/systemd-veritysetup-generator |
Comment on lines
837
to
838
| %{_cross_libdir}/systemd/system/cryptsetup-pre.target | ||
| %{_cross_libdir}/systemd/system/cryptsetup.target |
There was a problem hiding this comment.
Use %{_cross_unitdir} instead of %{_cross_libdir}/systemd/system.
Comment on lines
839
to
840
| %{_cross_libdir}/systemd/system/initrd-root-device.target.wants/remote-cryptsetup.target | ||
| %{_cross_libdir}/systemd/system/initrd-root-device.target.wants/remote-veritysetup.target |
There was a problem hiding this comment.
omit: we don't have an initrd
Suggested change
| %{_cross_libdir}/systemd/system/initrd-root-device.target.wants/remote-cryptsetup.target | |
| %{_cross_libdir}/systemd/system/initrd-root-device.target.wants/remote-veritysetup.target |
Comment on lines
843
to
844
| %{_cross_libdir}/systemd/system/remote-cryptsetup.target | ||
| %{_cross_libdir}/systemd/system/remote-veritysetup.target |
There was a problem hiding this comment.
Add these to the "Exclude remote filesystem targets" section above.
This extends the upstream patch to allow building systemd with openssl drop-ins that don't have UI support
openssl and aws-lc (and boringssl) have diverged wrt the return type of ERR_get_error() and `long unsigned int` has been patched to be `uint32_t` instead
sb-sign has a dependency on PKCS7 which is not provided by aws-lc. Adding a new meson option to prevent it from being built
Stub out install_secure_boot_auto_enroll since it depends on PKCS7. Instead default to the EOPNOTSUPP condition with a debug log
Add a patch to extend meson options to set OPENSSL_NO_UI_CONSOLE=1 during build. The option can be controlled with the CONFIGURE_OPTS in the specfile
vigh-m
force-pushed
the
systemd-cryptsetup-build
branch
from
a197f44 to
48b5ad8
Compare
|
⬆️ Addressed comments |
bcressey
approved these changes
Oct 17, 2025
Comment on lines
846
to
854
| %{_cross_libdir}/systemd/system/integritysetup-pre.target | ||
| %{_cross_libdir}/systemd/system/integritysetup.target | ||
| %{_cross_libdir}/systemd/system/sysinit.target.wants/cryptsetup.target | ||
| %{_cross_libdir}/systemd/system/sysinit.target.wants/integritysetup.target | ||
| %{_cross_libdir}/systemd/system/sysinit.target.wants/veritysetup.target | ||
| %{_cross_libdir}/systemd/system/system-systemd\x2dcryptsetup.slice | ||
| %{_cross_libdir}/systemd/system/system-systemd\x2dveritysetup.slice | ||
| %{_cross_libdir}/systemd/system/veritysetup-pre.target | ||
| %{_cross_libdir}/systemd/system/veritysetup.target |
There was a problem hiding this comment.
replace %{_cross_libdir}/systemd/system with %{_cross_unitdir}.
vigh-m
force-pushed
the
systemd-cryptsetup-build
branch
from
48b5ad8 to
aa360e9
Compare
|
⬆️ replaced |
bcressey
approved these changes
Oct 20, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue number:
Closes #536
Description of changes:
systemd-cryptsetupforsystemd-257systemd-257to the latest upstream release.systemdwithoutopenssl/ui.hwhich is a requirement to buildsystemd-cryptsetupTesting done:
All testing was done on an aws-k8s-1.34(-nvidia) variant
No errors in the journalctl logs:
Tested a few systemd commands without error
No unit files showing any errors
The instance joins the cluster as expected
Basic workloads are launched on the node correctly
Tested neuron instances:
Tested Neuron Workloads:
Nvidia instances working as expected:
Basic Nvidia workload tests worked as expected.
Ran basic scale testing by launching ~100 g4dn.xlarge, m5.large, c6i.large, r7a.large,
Soak testing with an AMI (Pending)
Terms of contribution:
By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.