Update boot theme

CLAUDE.md

@@ -28,6 +28,9 @@ files/etc/dot1x/                          Supplicant config + RADIUS CA (placeho
 files/etc/dracut.conf.d/90-diskless.conf  no-hostonly + drivers + modules
                                           (NM unmanaged split is now runtime:
                                           95dot1x-macsec/nm-unmanaged.sh, secure-mode only)
+files/plymouth/themes/fleet/              Custom boot splash (scripted security
+                                          checklist; driven by hook status tokens)
+files/kiosk/                              weston+Chromium kiosk + chromium lockdown policy
 scripts/extract-artifacts.sh              qcow2 -> kernel/initramfs/erofs+verity/cmdline
 scripts/build-oci.sh                      ukify + sbsign + roothash gate + OCI image
 serving/                                  Lab serving stack: dnsmasq + nginx + SPDK
@@ -149,6 +152,13 @@ instead of working around it.
   build; the supplicant config carries both options.
 - erofs module availability on the target RHEL kernel (fallback:
   journal-less ext4 in `extract-artifacts.sh`).
+- `fleet` Plymouth theme: confirm (a) the script plugin package actually
+  installed (`/usr/lib64/plymouth/script.so` — else the build fell back to
+  `spinner`, logged as a WARNING), (b) the scripted theme + a font got bundled
+  into the initramfs (`lsinitrd | grep -E 'fleet.script|script.so'`), and (c) it
+  renders (text via `Image.Text` needs the label plugin + a font in the early
+  initramfs). If blank, the splash silently no-ops but boot continues; ESC shows
+  the log. Untested in this workspace (needs a display).
 - `systemd.verity_root_options=hash-offset` is **NOT supported** by Rocky 9.8
   systemd-veritysetup (verified: "unknown option hash-offset=" → "Failed to load
   verity superblock"). Resolved by the documented fallback — data and hash are
@@ -195,14 +205,23 @@ These bit us bringing the build up on Rocky 9.8; they are easy to regress.
   stack stays in the image, dormant. The matching lab DHCP/HTTP/NVMe-oF serving
   stack lives in `serving/` (docker compose). Re-enable security by dropping the
   var / setting `DISABLE_DOT1X: "false"` in the CI workflow.
-- **Boot splash toggle**: `boot_splash=true` (default) bakes `rhgb quiet` for a
+- **Boot splash toggle**: `boot_splash=true` (default) bakes `rhgb quiet` for the
-  Plymouth graphical splash (theme `spinner`, set in the provisioner); `false`
+  Plymouth splash; `false` bakes `plymouth.enable=0` for a verbose console boot —
-  bakes `plymouth.enable=0` for a verbose console boot — keep it OFF while
+  keep OFF while debugging the boot chain. Plymouth is always in the image +
-  debugging the boot chain. Plymouth is always in the image + initramfs (the
+  initramfs (the `plymouth` dracut module, which pulls `drm`); only the cmdline
-  `plymouth` dracut module, which pulls `drm`); only the cmdline changes. CI
+  changes. Press ESC at boot to see details behind a splash. ks.cfg no longer
-  currently sets `BOOT_SPLASH: "false"` during the network-manager bench-verify.
+  excludes `plymouth`.
-  Press ESC at boot to see details behind a splash. ks.cfg no longer excludes
+- **Splash theme = custom `fleet`** (`files/plymouth/themes/fleet/`, script
-  `plymouth`.
+  plugin, asset-free — drawn with `Image.Text`). It renders a security-handshake
+  checklist (TPM → 802.1X → MACsec → Network → NVMe-oF) driven by best-effort
+  `plymouth update --status=<token>` calls from the dracut hooks
+  (`dot1x-macsec-up.sh`, `nvmf-connect.sh`). Tokens: `mode-test` (marks
+  auth/MACsec skipped), `tpm|dot1x|macsec|net|nvme`-`active|done`. **Rules:** the
+  emits are non-fatal (`plymouth … || true`) and must never reorder the
+  load-bearing boot sequence; show only STATES, never per-host data (invariant
+  #1). The provisioner installs the script plugin best-effort and **falls back to
+  the stock `spinner` theme** if `script.so` is absent, so a plugin-package-name
+  change can't break the build.
 
 ## Testing changes
 

diskless.pkr.hcl

@@ -212,6 +212,13 @@ build {
     destination = "/tmp/"
   }
 
+  # Custom 'fleet' Plymouth theme (scripted security-handshake splash). Staged to
+  # /tmp/plymouth, installed + set default in the package step before dracut runs.
+  provisioner "file" {
+    source      = "files/plymouth"
+    destination = "/tmp/"
+  }
+
   # --- 2. Packages, configs, diskless adaptations --------------------------
   provisioner "shell" {
     inline = [
@@ -228,13 +235,21 @@ build {
       # dracut warns and silently falls back to gzip (a larger initramfs).
       "dnf -y install wpa_supplicant tpm2-tools tpm2-tss nvme-cli cryptsetup dracut-network NetworkManager zstd openssl",
 
-      # Plymouth boot splash. plymouth-scripts provides plymouth-set-default-theme;
+      # Plymouth boot splash. The custom scripted 'fleet' theme renders the
-      # spinner is the clean modern theme. Set the default theme BEFORE the dracut
+      # security-handshake checklist driven by the dracut hooks
-      # build below so the (-no-hostonly) initramfs bundles it; no -R here because
+      # (`plymouth update --status=...`). plymouth-plugin-label gives Image.Text
-      # we rebuild the initramfs explicitly. Whether the splash shows at boot is
+      # its font rendering; dejavu fonts back it. The script-plugin package name
-      # decided by the cmdline (boot_splash var), not by installing this.
+      # has varied across releases, so install it best-effort and FALL BACK to the
-      "dnf -y install plymouth plymouth-scripts plymouth-theme-spinner",
+      # stock 'spinner' theme if script.so is absent — never break the build over
-      "plymouth-set-default-theme spinner",
+      # the theme. Set the default theme BEFORE the dracut build below so the
+      # (--no-hostonly) initramfs bundles the theme + its plugin + a font; no -R
+      # (we rebuild the initramfs explicitly). Whether the splash shows at boot is
+      # gated by the cmdline (boot_splash var), not by installing this.
+      "dnf -y install plymouth plymouth-scripts plymouth-plugin-label dejavu-sans-fonts",
+      "dnf -y install plymouth-plugin-script 2>/dev/null || dnf -y install plymouth-theme-script 2>/dev/null || true",
+      "cp -a /tmp/plymouth/themes/fleet /usr/share/plymouth/themes/fleet",
+      "if [ -e /usr/lib64/plymouth/script.so ]; then plymouth-set-default-theme fleet; echo '==> plymouth theme: fleet (scripted security splash)'; else dnf -y install plymouth-theme-spinner && plymouth-set-default-theme spinner; echo 'WARNING: plymouth script plugin (script.so) missing — using spinner; fleet security splash unavailable' >&2; fi",
+      "rm -rf /tmp/plymouth",
 
       # Stage etc files into place
       "install -D -m0644 /tmp/etc-stage/dot1x/radius-ca.pem            /etc/dot1x/radius-ca.pem",

files/dracut/95dot1x-macsec/dot1x-macsec-up.sh

@@ -15,6 +15,11 @@ STAMP=/run/dot1x/.done
 [ -e "$STAMP" ] && exit 0
 mkdir -p /run/dot1x /run/wpa_supplicant
 
+# Best-effort boot-splash status for the 'fleet' Plymouth theme. NEVER fatal and
+# NEVER reorders anything — a splash call must not perturb the load-bearing
+# auth -> macsec -> DHCP -> NVMe sequence below. No-op if plymouth isn't running.
+ply() { plymouth update --status="$1" 2>/dev/null || true; }
+
 # --- knobs (override on the kernel cmdline) ---------------------------------
 NIC=$(getarg rd.dot1x.if=)
 if [ -z "$NIC" ]; then
@@ -42,6 +47,7 @@ info "dot1x-macsec: using interface $NIC, NV index $NVINDEX"
 # networks only. Remove rd.dot1x=0 from the cmdline to restore full security.
 if [ "$(getarg rd.dot1x=)" = "0" ]; then
     warn "dot1x-macsec: 802.1X/MACsec DISABLED (rd.dot1x=0) — TEST MODE, no link security"
+    ply mode-test   # splash: mark TPM/802.1X/MACsec rows as skipped (not failed)
     # Networking in test mode is owned ENTIRELY by `ip=dhcp` on the cmdline:
     # dracut's network module brings the NIC up, gets a lease and writes
     # resolv.conf. Do NOT `ifup`/`ip link set up` the NIC here — a second
@@ -70,6 +76,7 @@ if [ "$(getarg rd.dot1x=)" = "0" ]; then
 fi
 
 # --- 1. client certificate out of TPM NV ------------------------------------
+ply tpm-active
 if [ ! -s /run/dot1x/client.pem ]; then
     if ! tpm2_nvread -T device:/dev/tpmrm0 "$NVINDEX" -o /run/dot1x/client.der; then
         warn "dot1x-macsec: tpm2_nvread failed — cannot authenticate"
@@ -77,6 +84,7 @@ if [ ! -s /run/dot1x/client.pem ]; then
     fi
     openssl x509 -inform DER -in /run/dot1x/client.der -out /run/dot1x/client.pem
 fi
+ply tpm-done
 
 # --- 2. supplicant as a root storage daemon ---------------------------------
 ip link set "$NIC" up
@@ -88,6 +96,7 @@ if [ ! -e /run/dot1x/wpa.pid ]; then
         -c /etc/dot1x/wpa_supplicant-dot1x.conf \
         -P /run/dot1x/wpa.pid" &
 fi
+ply dot1x-active
 
 # --- 3. wait for authentication + macsec0 -----------------------------------
 i=0
@@ -104,9 +113,13 @@ if [ "$i" -ge "$TIMEOUT" ]; then
     exit 1
 fi
 info "dot1x-macsec: port authorized, macsec0 up after ${i}s"
+ply dot1x-done
+ply macsec-active
 
 # --- 4. address the secure interface; netroot rides on macsec0 --------------
 ip link set macsec0 up
+ply macsec-done
+ply net-active
 # DHCP on macsec0 via NetworkManager (NOT the old network-legacy `ifup`): NM owns
 # macsec0, so it RENEWS the lease in the running system after switch-root — the
 # whole point of the network-manager port. macsec0 was created externally by
@@ -127,6 +140,7 @@ if [ "$i" -ge "$TIMEOUT" ]; then
     exit 1
 fi
 info "dot1x-macsec: macsec0 addressed via NetworkManager (DHCP)"
+ply net-done
 
 # --- 5. derive per-host NVMe identity from the TPM certificate --------------
 # Keeps the image fleet-generic: the host NQN is a function of the machine

files/dracut/95dot1x-macsec/nvmf-connect.sh

@@ -29,6 +29,12 @@ _trsvcid=${_rest##*,}
 # nvme_tcp is usually auto-loaded; ensure it so /dev/nvme-fabrics exists.
 modprobe nvme_tcp 2>/dev/null
 
+# Best-effort boot-splash status for the 'fleet' Plymouth theme (never fatal). By
+# the time this runs the ip=dhcp link is up, so mark Network done and NVMe active.
+ply() { plymouth update --status="$1" 2>/dev/null || true; }
+ply net-done
+ply nvme-active
+
 # Keep-alive / reconnect tuning for the ROOT device. These persist across
 # switch-root (the in-kernel nvme-tcp controller and its opts survive).
 #   -k 30  keep-alive timeout (s). The 5s default means a KA every 2.5s; under
@@ -53,6 +59,7 @@ while [ "$_i" -lt 60 ]; do
         if [ -b "$_ns" ]; then
             mkdir -p /run/dot1x
             : > /run/dot1x/.nvmf-connected
+            ply nvme-done
             echo "nvmf-connect: connected ${_trtype}/${_traddr}/${_trsvcid} ($_ns)"
             exit 0
         fi

files/plymouth/themes/fleet/fleet.plymouth

@@ -0,0 +1,8 @@
+[Plymouth Theme]
+Name=Fleet
+Description=Cyber sci-fi secure diskless bring-up splash (TPM / 802.1X / MACsec / NVMe-oF). Driven by `plymouth update --status=` tokens from the dracut hooks.
+ModuleName=script
+
+[script]
+ImageDir=/usr/share/plymouth/themes/fleet
+ScriptFile=/usr/share/plymouth/themes/fleet/fleet.script

files/plymouth/themes/fleet/fleet.script

@@ -0,0 +1,109 @@
+# Fleet — cyber sci-fi secure-bring-up splash (Plymouth "script" plugin).
+#
+# Asset-free on purpose: everything is drawn with Image.Text, so the repo carries
+# no binary images. The dracut hooks drive it with `plymouth update --status=<tok>`
+# (see dot1x-macsec-up.sh / nvmf-connect.sh); this script maps each token to a
+# security-handshake checklist and pulses the in-progress step. Tokens are
+# best-effort and order-independent — anything not reported just stays "pending",
+# and in rd.dot1x=0 test mode the auth/MACsec rows are marked "skipped" (never
+# "failed"). No per-host data is ever shown (only states), per the no-state rule.
+
+# ---- background (dark teal -> black) ----
+Window.SetBackgroundTopColor(0.00, 0.05, 0.07);
+Window.SetBackgroundBottomColor(0.00, 0.00, 0.00);
+
+sw = Window.GetWidth();
+sh = Window.GetHeight();
+
+# ---- title / subtitle ----
+title_img = Image.Text("F L E E T", 0.0, 1.0, 0.85, 1, "Sans Bold 36");
+title = Sprite(title_img);
+title.SetX(sw / 2 - title_img.GetWidth() / 2);
+title.SetY(sh / 2 - 150);
+
+sub_img = Image.Text("secure diskless bring-up", 0.30, 0.65, 0.65, 1, "Sans 14");
+sub = Sprite(sub_img);
+sub.SetX(sw / 2 - sub_img.GetWidth() / 2);
+sub.SetY(sh / 2 - 102);
+
+# ---- handshake stages ----
+# state per stage: 0 pending, 1 active, 2 done, 3 skipped
+n = 5;
+label[0] = "TPM identity";
+label[1] = "802.1X EAP-TLS";
+label[2] = "MACsec link";
+label[3] = "Network (DHCP)";
+label[4] = "NVMe-oF root";
+
+col_x = sw / 2 - 150;
+row_y = sh / 2 - 36;
+row_h = 34;
+
+fun draw(i) {
+    glyph = "[  ]"; r = 0.22; g = 0.42; b = 0.42;            # pending (dim teal)
+    if (state[i] == 1) { glyph = "[>>]"; r = 1.00; g = 0.72; b = 0.10; }  # active (amber)
+    if (state[i] == 2) { glyph = "[OK]"; r = 0.10; g = 1.00; b = 0.50; }  # done (neon green)
+    if (state[i] == 3) { glyph = "[--]"; r = 0.30; g = 0.30; b = 0.36; }  # skipped (grey)
+    img = Image.Text(glyph + "   " + label[i], r, g, b, 1, "Sans 16");
+    row[i].SetImage(img);
+    row[i].SetX(col_x);
+    row[i].SetY(row_y + i * row_h);
+    row[i].SetOpacity(1.0);
+}
+
+i = 0;
+while (i < n) {
+    state[i] = 0;
+    row[i] = Sprite();
+    draw(i);
+    i = i + 1;
+}
+
+# ---- footer ----
+foot_img = Image.Text("erofs + dm-verity   •   NVMe/TCP   •   no per-host state",
+                      0.25, 0.45, 0.45, 1, "Sans 11");
+foot = Sprite(foot_img);
+foot.SetX(sw / 2 - foot_img.GetWidth() / 2);
+foot.SetY(sh / 2 + 150);
+
+# ---- status tokens from the boot hooks ----
+fun set(i, s) { state[i] = s; draw(i); }
+
+fun on_status(t) {
+    if (t == "mode-test")     { set(0, 3); set(1, 3); set(2, 3); }
+    if (t == "tpm-active")    set(0, 1);
+    if (t == "tpm-done")      set(0, 2);
+    if (t == "dot1x-active")  set(1, 1);
+    if (t == "dot1x-done")    set(1, 2);
+    if (t == "macsec-active") set(2, 1);
+    if (t == "macsec-done")   set(2, 2);
+    if (t == "net-active")    set(3, 1);
+    if (t == "net-done")      set(3, 2);
+    if (t == "nvme-active")   set(4, 1);
+    if (t == "nvme-done")     set(4, 2);
+}
+Plymouth.SetUpdateStatusFunction(on_status);
+
+# ---- optional free-text line (e.g. warnings via `plymouth message`) ----
+msg = Sprite();
+fun on_message(text) {
+    img = Image.Text(text, 0.55, 0.80, 0.80, 1, "Sans 12");
+    msg.SetImage(img);
+    msg.SetX(sw / 2 - img.GetWidth() / 2);
+    msg.SetY(sh / 2 + 182);
+}
+Plymouth.SetMessageFunction(on_message);
+
+# ---- pulse the in-progress row ----
+tick = 0;
+fun on_refresh() {
+    tick = tick + 1;
+    o = 1.0;
+    if (tick % 24 < 12) o = 0.45;
+    i = 0;
+    while (i < n) {
+        if (state[i] == 1) row[i].SetOpacity(o);
+        i = i + 1;
+    }
+}
+Plymouth.SetRefreshFunction(on_refresh);