Audiobuzz
8e1d40a30b
Builds the host side of TPM identity enrolment — the "inline single-UKI"
vehicle from docs/tpm-enrolment-design.md. A production (secure) UKI now
auto-enrols a fresh host with no client cert, then reboots into the normal
secure path.
New dracut hook files/dracut/95dot1x-macsec/tpm-enrol.sh (initqueue/settled
prio 25, BEFORE dot1x-macsec-up at 30):
- no-op when a cert is already present in NV 0x01800001 (normal boot) or
under rd.dot1x=0 (test path has no trustworthy identity to enrol);
- on EMPTY NV: generate the signing key in the TPM @0x81010001 (openssl tpm2
provider builds the CSR; key never leaves the TPM), pre-auth DHCP on the
PHYSICAL NIC (nmcli re-manages en*, overriding the secure-mode unmanaged
drop-in), POST CSR+context to rd.fleet.enrol_url, show the broker
fingerprint on Plymouth, poll /status, write the issued leaf cert (DER) to
NV, and reboot to converge.
- Empty-NV and the secure path are mutually exclusive, so this never reorders
the load-bearing boot sequence (invariant #2).
Wiring:
- module-setup.sh: require+install the tpm2 key-gen/NV tools, curl, awk, and
the openssl tpm2 PROVIDER (ossl-modules/tpm2.so, asserted present — tpm2-tss
alone can't sign with a handle: key); install the hook.
- diskless.pkr.hcl: install tpm2-openssl + curl; assert hook/tools/provider in
the initramfs (invariant #9). New enrol_url var threaded to extract-artifacts.
- extract-artifacts.sh: bake rd.fleet.enrol_url into the cmdline.
- fleet.script: enrol-active/enrol-wait/enrol-done banner; fingerprint on the
message line (public — states only, invariant #1).
Shell JSON build/parse/cert-extract pipeline (no jq in the initramfs) verified
end-to-end against a live broker. BENCH-VERIFY list in docs/TODO.md #11 (tpm2
provider key-ref on real/swtpm, empty-NV detect, pre-auth DHCP override, Plymouth
render, NV write + reboot convergence, prod HTTPS).
125 lines
4.4 KiB
Plaintext
125 lines
4.4 KiB
Plaintext
# Fleet — cyber sci-fi secure-bring-up splash (Plymouth "script" plugin).
|
|
#
|
|
# Asset-free on purpose: everything is drawn with Image.Text, so the repo carries
|
|
# no binary images. The dracut hooks drive it with `plymouth update --status=<tok>`
|
|
# (see dot1x-macsec-up.sh / nvmf-connect.sh); this script maps each token to a
|
|
# security-handshake checklist and pulses the in-progress step. Tokens are
|
|
# best-effort and order-independent — anything not reported just stays "pending",
|
|
# and in rd.dot1x=0 test mode the auth/MACsec rows are marked "skipped" (never
|
|
# "failed"). No per-host data is ever shown (only states), per the no-state rule.
|
|
|
|
# ---- background (dark teal -> black) ----
|
|
Window.SetBackgroundTopColor(0.00, 0.05, 0.07);
|
|
Window.SetBackgroundBottomColor(0.00, 0.00, 0.00);
|
|
|
|
sw = Window.GetWidth();
|
|
sh = Window.GetHeight();
|
|
|
|
# ---- title / subtitle ----
|
|
title_img = Image.Text("F L E E T", 0.0, 1.0, 0.85, 1, "Sans Bold 36");
|
|
title = Sprite(title_img);
|
|
title.SetX(sw / 2 - title_img.GetWidth() / 2);
|
|
title.SetY(sh / 2 - 150);
|
|
|
|
sub_img = Image.Text("secure diskless bring-up", 0.30, 0.65, 0.65, 1, "Sans 14");
|
|
sub = Sprite(sub_img);
|
|
sub.SetX(sw / 2 - sub_img.GetWidth() / 2);
|
|
sub.SetY(sh / 2 - 102);
|
|
|
|
# ---- handshake stages ----
|
|
# state per stage: 0 pending, 1 active, 2 done, 3 skipped
|
|
n = 5;
|
|
label[0] = "TPM identity";
|
|
label[1] = "802.1X EAP-TLS";
|
|
label[2] = "MACsec link";
|
|
label[3] = "Network (DHCP)";
|
|
label[4] = "NVMe-oF root";
|
|
|
|
col_x = sw / 2 - 150;
|
|
row_y = sh / 2 - 36;
|
|
row_h = 34;
|
|
|
|
fun draw(i) {
|
|
glyph = "[ ]"; r = 0.22; g = 0.42; b = 0.42; # pending (dim teal)
|
|
if (state[i] == 1) { glyph = "[>>]"; r = 1.00; g = 0.72; b = 0.10; } # active (amber)
|
|
if (state[i] == 2) { glyph = "[OK]"; r = 0.10; g = 1.00; b = 0.50; } # done (neon green)
|
|
if (state[i] == 3) { glyph = "[--]"; r = 0.30; g = 0.30; b = 0.36; } # skipped (grey)
|
|
img = Image.Text(glyph + " " + label[i], r, g, b, 1, "Sans 16");
|
|
row[i].SetImage(img);
|
|
row[i].SetX(col_x);
|
|
row[i].SetY(row_y + i * row_h);
|
|
row[i].SetOpacity(1.0);
|
|
}
|
|
|
|
i = 0;
|
|
while (i < n) {
|
|
state[i] = 0;
|
|
row[i] = Sprite();
|
|
draw(i);
|
|
i = i + 1;
|
|
}
|
|
|
|
# ---- footer ----
|
|
foot_img = Image.Text("erofs + dm-verity • NVMe/TCP • no per-host state",
|
|
0.25, 0.45, 0.45, 1, "Sans 11");
|
|
foot = Sprite(foot_img);
|
|
foot.SetX(sw / 2 - foot_img.GetWidth() / 2);
|
|
foot.SetY(sh / 2 + 150);
|
|
|
|
# ---- first-boot TPM enrolment banner (only shown on an empty-NV host) ----
|
|
# tpm-enrol.sh drives enrol-active/enrol-wait/enrol-done; the public fingerprint
|
|
# rides the message line (on_message) below. States only, no per-host secret.
|
|
enrol_b = Sprite(); enrol_b.SetOpacity(0);
|
|
fun enrol_banner(text, r, g, b) {
|
|
eimg = Image.Text(text, r, g, b, 1, "Sans Bold 16");
|
|
enrol_b.SetImage(eimg);
|
|
enrol_b.SetX(sw / 2 - eimg.GetWidth() / 2);
|
|
enrol_b.SetY(sh / 2 - 70);
|
|
enrol_b.SetOpacity(1.0);
|
|
}
|
|
|
|
# ---- status tokens from the boot hooks ----
|
|
fun set(i, s) { state[i] = s; draw(i); }
|
|
|
|
fun on_status(t) {
|
|
if (t == "mode-test") { set(0, 3); set(1, 3); set(2, 3); }
|
|
if (t == "enrol-active") { set(0, 1); enrol_banner("FIRST-BOOT TPM ENROLMENT", 1.00, 0.72, 0.10); }
|
|
if (t == "enrol-wait") enrol_banner("AWAITING ADMIN APPROVAL — verify the code below", 1.00, 0.72, 0.10);
|
|
if (t == "enrol-done") { enrol_banner("IDENTITY ENROLLED — rebooting", 0.10, 1.00, 0.50); set(0, 2); }
|
|
if (t == "tpm-active") set(0, 1);
|
|
if (t == "tpm-done") set(0, 2);
|
|
if (t == "dot1x-active") set(1, 1);
|
|
if (t == "dot1x-done") set(1, 2);
|
|
if (t == "macsec-active") set(2, 1);
|
|
if (t == "macsec-done") set(2, 2);
|
|
if (t == "net-active") set(3, 1);
|
|
if (t == "net-done") set(3, 2);
|
|
if (t == "nvme-active") set(4, 1);
|
|
if (t == "nvme-done") set(4, 2);
|
|
}
|
|
Plymouth.SetUpdateStatusFunction(on_status);
|
|
|
|
# ---- optional free-text line (e.g. warnings via `plymouth message`) ----
|
|
msg = Sprite();
|
|
fun on_message(text) {
|
|
img = Image.Text(text, 0.55, 0.80, 0.80, 1, "Sans 12");
|
|
msg.SetImage(img);
|
|
msg.SetX(sw / 2 - img.GetWidth() / 2);
|
|
msg.SetY(sh / 2 + 182);
|
|
}
|
|
Plymouth.SetMessageFunction(on_message);
|
|
|
|
# ---- pulse the in-progress row ----
|
|
tick = 0;
|
|
fun on_refresh() {
|
|
tick = tick + 1;
|
|
o = 1.0;
|
|
if (tick % 24 < 12) o = 0.45;
|
|
i = 0;
|
|
while (i < n) {
|
|
if (state[i] == 1) row[i].SetOpacity(o);
|
|
i = i + 1;
|
|
}
|
|
}
|
|
Plymouth.SetRefreshFunction(on_refresh);
|