Skip to content

Commit 6435cbf

Browse files
aadhar-agarwalCopilot
aadhar-agarwal
and
Copilot
authored
fix(acl): bump marketplace to 3.20260517.01 and adapt to UKI rename (#8577)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 15a2590 commit 6435cbf

5 files changed

Lines changed: 60 additions & 15 deletions

File tree

‎.pipelines/.vsts-vhd-builder-release.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -873,7 +873,7 @@ stages:
873873
echo '##vso[task.setvariable variable=IMG_PUBLISHER]MicrosoftCBLMariner'
874874
echo '##vso[task.setvariable variable=IMG_OFFER]azure-linux-3'
875875
echo '##vso[task.setvariable variable=IMG_SKU]azure-linux-3-acl'
876-
echo '##vso[task.setvariable variable=IMG_VERSION]3.20260510.01'
876+
echo '##vso[task.setvariable variable=IMG_VERSION]3.20260517.01'
877877
echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2'
878878
echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_D16ds_v5'
879879
echo '##vso[task.setvariable variable=FEATURE_FLAGS]None'
@@ -898,7 +898,7 @@ stages:
898898
echo '##vso[task.setvariable variable=IMG_PUBLISHER]MicrosoftCBLMariner'
899899
echo '##vso[task.setvariable variable=IMG_OFFER]azure-linux-3'
900900
echo '##vso[task.setvariable variable=IMG_SKU]azure-linux-3-arm64-gen2-acl'
901-
echo '##vso[task.setvariable variable=IMG_VERSION]3.20260510.02'
901+
echo '##vso[task.setvariable variable=IMG_VERSION]3.20260517.01'
902902
echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2'
903903
echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_D16pds_v6'
904904
echo '##vso[task.setvariable variable=FEATURE_FLAGS]None'
@@ -923,7 +923,7 @@ stages:
923923
echo '##vso[task.setvariable variable=IMG_PUBLISHER]MicrosoftCBLMariner'
924924
echo '##vso[task.setvariable variable=IMG_OFFER]azure-linux-3'
925925
echo '##vso[task.setvariable variable=IMG_SKU]azure-linux-3-acl'
926-
echo '##vso[task.setvariable variable=IMG_VERSION]3.20260510.01'
926+
echo '##vso[task.setvariable variable=IMG_VERSION]3.20260517.01'
927927
echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2'
928928
echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_D16ds_v5'
929929
echo '##vso[task.setvariable variable=FEATURE_FLAGS]None'
@@ -948,7 +948,7 @@ stages:
948948
echo '##vso[task.setvariable variable=IMG_PUBLISHER]MicrosoftCBLMariner'
949949
echo '##vso[task.setvariable variable=IMG_OFFER]azure-linux-3'
950950
echo '##vso[task.setvariable variable=IMG_SKU]azure-linux-3-arm64-gen2-acl'
951-
echo '##vso[task.setvariable variable=IMG_VERSION]3.20260510.02'
951+
echo '##vso[task.setvariable variable=IMG_VERSION]3.20260517.01'
952952
echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2'
953953
echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_D16pds_v6'
954954
echo '##vso[task.setvariable variable=FEATURE_FLAGS]None'

‎.pipelines/.vsts-vhd-builder.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -212,7 +212,7 @@ stages:
212212
echo '##vso[task.setvariable variable=IMG_PUBLISHER]MicrosoftCBLMariner'
213213
echo '##vso[task.setvariable variable=IMG_OFFER]azure-linux-3'
214214
echo '##vso[task.setvariable variable=IMG_SKU]azure-linux-3-acl'
215-
echo '##vso[task.setvariable variable=IMG_VERSION]3.20260510.01'
215+
echo '##vso[task.setvariable variable=IMG_VERSION]3.20260517.01'
216216
echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2'
217217
echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_D16ds_v5'
218218
echo '##vso[task.setvariable variable=FEATURE_FLAGS]None'
@@ -234,7 +234,7 @@ stages:
234234
echo '##vso[task.setvariable variable=IMG_PUBLISHER]MicrosoftCBLMariner'
235235
echo '##vso[task.setvariable variable=IMG_OFFER]azure-linux-3'
236236
echo '##vso[task.setvariable variable=IMG_SKU]azure-linux-3-arm64-gen2-acl'
237-
echo '##vso[task.setvariable variable=IMG_VERSION]3.20260510.02'
237+
echo '##vso[task.setvariable variable=IMG_VERSION]3.20260517.01'
238238
echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2'
239239
echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_D16pds_v6'
240240
echo '##vso[task.setvariable variable=FEATURE_FLAGS]None'
@@ -256,7 +256,7 @@ stages:
256256
echo '##vso[task.setvariable variable=IMG_PUBLISHER]MicrosoftCBLMariner'
257257
echo '##vso[task.setvariable variable=IMG_OFFER]azure-linux-3'
258258
echo '##vso[task.setvariable variable=IMG_SKU]azure-linux-3-acl'
259-
echo '##vso[task.setvariable variable=IMG_VERSION]3.20260510.01'
259+
echo '##vso[task.setvariable variable=IMG_VERSION]3.20260517.01'
260260
echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2'
261261
echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_D16ds_v5'
262262
echo '##vso[task.setvariable variable=FEATURE_FLAGS]None'
@@ -278,7 +278,7 @@ stages:
278278
echo '##vso[task.setvariable variable=IMG_PUBLISHER]MicrosoftCBLMariner'
279279
echo '##vso[task.setvariable variable=IMG_OFFER]azure-linux-3'
280280
echo '##vso[task.setvariable variable=IMG_SKU]azure-linux-3-arm64-gen2-acl'
281-
echo '##vso[task.setvariable variable=IMG_VERSION]3.20260510.02'
281+
echo '##vso[task.setvariable variable=IMG_VERSION]3.20260517.01'
282282
echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2'
283283
echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_D16pds_v6'
284284
echo '##vso[task.setvariable variable=FEATURE_FLAGS]None'

‎vhdbuilder/packer/cleanup-vhd.sh‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,22 @@ rm -f /etc/machine-id
1313
touch /etc/machine-id
1414
chmod 644 /etc/machine-id
1515
# Restore the UKI firstboot addon consumed by ignition-quench during this build
16-
# Without this, VMs created from this VHD won't get flatcar.first_boot=detected on the kernel cmdline
17-
if [ -f /boot/acl/uki-addons/firstboot.addon.efi ] && [ ! -f /boot/EFI/Linux/acl.efi.extra.d/firstboot.addon.efi ]; then
18-
install -D -m 0644 /boot/acl/uki-addons/firstboot.addon.efi /boot/EFI/Linux/acl.efi.extra.d/firstboot.addon.efi
16+
# Without this, VMs created from this VHD won't get flatcar.first_boot=detected on the kernel cmdline.
17+
# The active UKI follows UAPI naming (vmlinuz-<version>.efi) on newer ACL images and was
18+
# previously named acl.efi -- discover it dynamically rather than hardcoding either name.
19+
if [ -f /boot/acl/uki-addons/firstboot.addon.efi ]; then
20+
uki_path="$(find /boot/EFI/Linux -maxdepth 1 -type f \
21+
\( -name 'vmlinuz-*.efi' -o -name 'acl.efi' \) 2>/dev/null \
22+
| sort | head -n1)"
23+
if [ -z "${uki_path}" ]; then
24+
echo "cleanup-vhd: No UKI found under /boot/EFI/Linux (expected acl.efi or vmlinuz-*.efi); firstboot addon not restored" >&2
25+
exit 1
26+
fi
27+
uki_name="$(basename "${uki_path}")"
28+
addon_dir="/boot/EFI/Linux/${uki_name}.extra.d"
29+
if [ ! -f "${addon_dir}/firstboot.addon.efi" ]; then
30+
install -D -m 0644 /boot/acl/uki-addons/firstboot.addon.efi "${addon_dir}/firstboot.addon.efi"
31+
fi
1932
fi
2033
# Cleanup disk usage diagnostics file (created by generate-disk-usage.sh)
2134
rm -f /opt/azure/disk-usage.txt

‎vhdbuilder/packer/test/linux-vhd-content-test.sh‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -642,10 +642,22 @@ testFips() {
642642
else
643643
err $test "/etc/system-fips marker file does not exist."
644644
fi
645-
if [ -f /boot/EFI/Linux/acl.efi.extra.d/fips.addon.efi ]; then
646-
echo "ACL FIPS UKI addon file exists in active ESP location."
645+
# ACL images historically named the UKI "acl.efi"; newer (UAPI-compliant)
646+
# images use "vmlinuz-<version>.efi". systemd-boot loads cmdline addons
647+
# from "<UKI filename>.extra.d/", so the addon directory tracks the
648+
# UKI's actual name. Probe for either layout.
649+
uki_path=$(find /boot/EFI/Linux -maxdepth 1 -type f \
650+
\( -name 'vmlinuz-*.efi' -o -name 'acl.efi' \) 2>/dev/null | sort | head -n1)
651+
if [ -z "${uki_path}" ]; then
652+
err $test "No UKI found under /boot/EFI/Linux (expected acl.efi or vmlinuz-*.efi)."
647653
else
648-
err $test "ACL FIPS UKI addon file does not exist in active ESP location."
654+
uki_name=$(basename "${uki_path}")
655+
fips_addon_path="/boot/EFI/Linux/${uki_name}.extra.d/fips.addon.efi"
656+
if [ -f "${fips_addon_path}" ]; then
657+
echo "ACL FIPS UKI addon file exists at ${fips_addon_path}."
658+
else
659+
err $test "ACL FIPS UKI addon file does not exist at ${fips_addon_path}."
660+
fi
649661
fi
650662
fi
651663

‎vhdbuilder/scripts/linux/acl/tool_installs_acl.sh‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,13 +33,33 @@ installFIPS() {
3333
echo "Installing FIPS..."
3434

3535
local fips_addon_src="/boot/acl/uki-addons/fips.addon.efi"
36-
local fips_addon_dst="/boot/EFI/Linux/acl.efi.extra.d/fips.addon.efi"
3736

3837
if [ ! -f "${fips_addon_src}" ]; then
3938
echo "FIPS addon not found at ${fips_addon_src}" >&2
4039
exit 1
4140
fi
4241

42+
# Discover the active UKI on the ESP. systemd-boot loads addons from
43+
# the directory named "<UKI filename>.extra.d/", so the destination
44+
# must track the UKI's actual name. ACL images historically named the
45+
# UKI "acl.efi"; newer (UAPI-compliant) images use "vmlinuz-<ver>.efi".
46+
# Hardcoding "acl.efi.extra.d/" silently orphans the addon on the new
47+
# naming scheme and leaves the kernel booting without fips=1.
48+
local uki_path
49+
uki_path="$(find /boot/EFI/Linux -maxdepth 1 -type f \
50+
\( -name 'vmlinuz-*.efi' -o -name 'acl.efi' \) 2>/dev/null \
51+
| sort | head -n1)"
52+
53+
if [ -z "${uki_path}" ]; then
54+
echo "No UKI found under /boot/EFI/Linux (expected acl.efi or vmlinuz-*.efi)" >&2
55+
exit 1
56+
fi
57+
58+
local uki_name
59+
uki_name="$(basename "${uki_path}")"
60+
local fips_addon_dst="/boot/EFI/Linux/${uki_name}.extra.d/fips.addon.efi"
61+
62+
echo "Installing FIPS addon: ${fips_addon_src} -> ${fips_addon_dst}"
4363
install -D -m 0644 "${fips_addon_src}" "${fips_addon_dst}"
4464

4565
touch /etc/system-fips

0 commit comments

Comments
 (0)