Skip to content

Make it possible to build simple VM images as part of the CheriBSD release process #2360

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 19 commits into
base: dev
Choose a base branch
from

Conversation

brooksdavis
Copy link
Member

I've not tested the image yet, but the right rc.conf bits seem to be there in the source root directory.

It would be better if we could run ldconfig more directly since it should now work for cross builds since f221df6. Likewise non-root package support.

brooksdavis added a commit to CTSRD-CHERI/cheribuild that referenced this pull request Mar 7, 2025
In conjunction with the changes in
CTSRD-CHERI/cheribsd#2360 this produces
ciimages/FreeBSD-15.0-CURRENT-arm64-aarch64c-BASIC-CI-ufs.raw.xz in the
output directory for cheribsd-release-morello-purecap.  The result is
untested, but likely a usable starting point if cross build actually
works.
@@ -88,6 +88,9 @@ vm_install_base() {
}

vm_emulation_setup() {
if [ -n "${WITHOUT_QEMU}" ]; then
return 0
fi
if ! [ -z "${QEMUSTATIC}" ]; then
export EMULATOR=/qemu
cp ${QEMUSTATIC} ${DESTDIR}/${EMULATOR}
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might be worth adding a new newaliases rc.d script conditional on firstboot to run newaliases if needed?

Hmm, looks like /etc/rc.d/sendmail already runs newaliases if needed, but only if sendmail is enabled. I wonder if that part should just move out to a dedicated /etc/rc.d/newaliases script.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've written one (https://reviews.freebsd.org/D49309) but it turns out to be mostly pointless because the in the default install newaliases uses dma which doesn't build an aliases.db at all (it just validates its arguments and returns 0).

@brooksdavis brooksdavis marked this pull request as draft March 10, 2025 20:45
@brooksdavis
Copy link
Member Author

I've cherry picked everything needed to avoid conflicts when cherry picking the upstream versions of relevant commits. We're not quite in sync with upstream as I skipped a few like the chain of wireless firmware changes that didn't cause conflicts and the profiled libraries change which is very broad.

brooksdavis added a commit to CTSRD-CHERI/cheribuild that referenced this pull request Mar 13, 2025
With the addition of the flag:

--cheribsd-morello-purecap/build-vm-images

and the changes in
CTSRD-CHERI/cheribsd#2360 this produces
ciimages/FreeBSD-15.0-CURRENT-arm64-aarch64c-BASIC-CI-ufs.raw.xz
in the output directory for cheribsd-release-morello-purecap.

I've put support behind a flag as older CheriBSD trees will break
without patchs.
@brooksdavis
Copy link
Member Author

I've been able to boot a BASIC-CI vm image created this way

@brooksdavis brooksdavis marked this pull request as ready for review March 13, 2025 22:41
bsdjhb pushed a commit to bsdjhb/cheribsd that referenced this pull request Mar 18, 2025
Libarchive 3.7.7

Security fixes:
 CTSRD-CHERI#2158 rpm: calculate huge header sizes correctly
 CTSRD-CHERI#2160 util: fix out of boundary access in mktemp functions
 CTSRD-CHERI#2168 uu: stop processing if lines are too long
 CTSRD-CHERI#2174 lzop: prevent integer overflow
 CTSRD-CHERI#2172 rar4: protect copy_from_lzss_window_to_unp() (CVE-2024-20696)
 CTSRD-CHERI#2175 unzip: unify EOF handling
 CTSRD-CHERI#2179 rar4: fix out of boundary access with large files
 CTSRD-CHERI#2203 rar4: fix OOB access with unicode filenames
 CTSRD-CHERI#2210 rar4: add boundary checks to rgb filter
 CTSRD-CHERI#2248 rar4: fix OOB in delta filter
 CTSRD-CHERI#2249 rar4: fix OOB in audio filter
 CTSRD-CHERI#2256 fix multiple vulnerabilities identified by SAST
 CTSRD-CHERI#2258 cpio: ignore out-of-range gid/uid/size/ino and harden AFIO parsing
 CTSRD-CHERI#2265 rar5: clear 'data ready' cache on window buffer reallocs
 CTSRD-CHERI#2269 rar4: fix CVE-2024-26256 (CVE-2024-26256)
 CTSRD-CHERI#2330 iso: be more cautious about parsing ISO-9660 timestamps
 CTSRD-CHERI#2343 tar: clean up linkpath between entries
 CTSRD-CHERI#2364 tar: don't crash on truncated tar archives
 CTSRD-CHERI#2366 gzip: prevent a hang when processing a malformed gzip inside a gzip
 CTSRD-CHERI#2377 tar: fix two leaks in tar header parsing

Important bugfixes:
 CTSRD-CHERI#2096 rar5: report encrypted entries
 CTSRD-CHERI#2150 xar: fix another infinite loop and expat error handling
 CTSRD-CHERI#2173 shar: check strdup return value
 CTSRD-CHERI#2161 lha: fix integer truncation on 32-bit systems
 CTSRD-CHERI#2338 tar: fix memory leaks when processing symlinks or parsing pax headers
 CTSRD-CHERI#2245 7zip: fix issue when skipping first file in 7zip archive that
       is a multiple of 65536 bytes
 CTSRD-CHERI#2252 7-zip: read/write symlink paths as UTF-8
 CTSRD-CHERI#2259 rar5: don't try to read rediculously long names
 CTSRD-CHERI#2290 ar: fix archive entries having no type
 CTSRD-CHERI#2360 tar: fix truncation of entry pathnames in specific archives

CVE:		CVE-2024-20696, CVE-2024-26256
PR:		282047 (exp-run)
MFC after:	1 week
bsdjhb pushed a commit to bsdjhb/cheribsd that referenced this pull request Mar 18, 2025
Libarchive 3.7.7

Security fixes:
 CTSRD-CHERI#2158 rpm: calculate huge header sizes correctly
 CTSRD-CHERI#2160 util: fix out of boundary access in mktemp functions
 CTSRD-CHERI#2168 uu: stop processing if lines are too long
 CTSRD-CHERI#2174 lzop: prevent integer overflow
 CTSRD-CHERI#2172 rar4: protect copy_from_lzss_window_to_unp() (CVE-2024-20696)
 CTSRD-CHERI#2175 unzip: unify EOF handling
 CTSRD-CHERI#2179 rar4: fix out of boundary access with large files
 CTSRD-CHERI#2203 rar4: fix OOB access with unicode filenames
 CTSRD-CHERI#2210 rar4: add boundary checks to rgb filter
 CTSRD-CHERI#2248 rar4: fix OOB in delta filter
 CTSRD-CHERI#2249 rar4: fix OOB in audio filter
 CTSRD-CHERI#2256 fix multiple vulnerabilities identified by SAST
 CTSRD-CHERI#2258 cpio: ignore out-of-range gid/uid/size/ino and harden AFIO parsing
 CTSRD-CHERI#2265 rar5: clear 'data ready' cache on window buffer reallocs
 CTSRD-CHERI#2269 rar4: fix CVE-2024-26256 (CVE-2024-26256)
 CTSRD-CHERI#2330 iso: be more cautious about parsing ISO-9660 timestamps
 CTSRD-CHERI#2343 tar: clean up linkpath between entries
 CTSRD-CHERI#2364 tar: don't crash on truncated tar archives
 CTSRD-CHERI#2366 gzip: prevent a hang when processing a malformed gzip inside a gzip
 CTSRD-CHERI#2377 tar: fix two leaks in tar header parsing

Important bugfixes:
 CTSRD-CHERI#2096 rar5: report encrypted entries
 CTSRD-CHERI#2150 xar: fix another infinite loop and expat error handling
 CTSRD-CHERI#2173 shar: check strdup return value
 CTSRD-CHERI#2161 lha: fix integer truncation on 32-bit systems
 CTSRD-CHERI#2338 tar: fix memory leaks when processing symlinks or parsing pax headers
 CTSRD-CHERI#2245 7zip: fix issue when skipping first file in 7zip archive that
       is a multiple of 65536 bytes
 CTSRD-CHERI#2252 7-zip: read/write symlink paths as UTF-8
 CTSRD-CHERI#2259 rar5: don't try to read rediculously long names
 CTSRD-CHERI#2290 ar: fix archive entries having no type
 CTSRD-CHERI#2360 tar: fix truncation of entry pathnames in specific archives

CVE:		CVE-2024-20696, CVE-2024-26256
PR:		282047 (exp-run)
MFC after:	1 week
@kwitaszczyk
Copy link
Member

There is a couple of issues when trying to use this on Ubuntu (technos in my case):

/local/scratch/kw543/repos/cheribsd/release-vm-images/release/scripts/mk-vmimage.sh: 56: /local/scratch/kw543/repos/cheribsd/release-vm-images/release/tools/vmimage.subr: Syntax error: "}" unexpected

which can be fixed with

diff --git a/release/tools/vmimage.subr b/release/tools/vmimage.subr
index 2d81da93794f..b9400784aabb 100644
--- a/release/tools/vmimage.subr
+++ b/release/tools/vmimage.subr
@@ -53,6 +53,7 @@ vm_create_base() {
 
 vm_copy_base() {
        # Defunct
+       return 0
 }
 
 vm_install_base() {
date: invalid option -- 'v'                                                                                                                                                                                    
Try 'date --help' for more information.                                                                                                                                                                        
bmake: "/local/scratch/kw543/repos/cheribsd/release-vm-images/release/Makefile.azure" line 21: warning: Command "date -v-1d -I -u" exited with status 1

which can be worked around in our case with

diff --git a/release/Makefile.vm b/release/Makefile.vm
index 1f56bdb03f97..76fede193a32 100644
--- a/release/Makefile.vm
+++ b/release/Makefile.vm
@@ -282,10 +282,12 @@ cloudware-release:        ${CLOUDTARGETS}
 cloudware-release:
 .endif
 
+.if !defined(WITHOUT_QEMU)
 .include "${.CURDIR}/Makefile.azure"
 .include "${.CURDIR}/Makefile.ec2"
 .include "${.CURDIR}/Makefile.firecracker"
 .include "${.CURDIR}/Makefile.gce"
 .include "${.CURDIR}/Makefile.oracle"
 .include "${.CURDIR}/Makefile.vagrant"
+.endif
 .include "${.CURDIR}/Makefile.inc1"
ln: failed to access 'basic-ci.ufs.raw': No such file or directory

*** Failed target:  cw-basic-ci-raw
*** Failed command: ln -f basic-ci.ufs.raw basic-ci.raw
*** Error code 1

which I have not got to the bottom of.

@brooksdavis
Copy link
Member Author

https://reviews.freebsd.org/D49526 and https://reviews.freebsd.org/D49527 address first two issues. (I contemplated gating Azure support on the host being FreeBSD, but it seemed annoying to do in a way that wasn't transparent.)

cperciva and others added 16 commits April 4, 2025 17:38
In 2016, commit 8834318 reworked the code for excluding -dbg
files from install media, and in the process accidentally broke it
for dvd images ('grep -v' should have been 'grep -vE').

FreeBSD Update builds later began to depend on this, and in any case
since DVD images are intended as "include everything" images there's
no point excluding those; so remove the (broken) filtering from DVD
image builds.

Sponsored by:	Amazon
MFC after:	2 days

(cherry picked from commit cdfd0600dc8882f0a0d0e6d9a1cdcf926edba6d6)
This adds three OCI archive format files to the release containing
FreeBSD base images suitable for static linked, dynamic linked and shell
workloads. The shell image also contains pkg-bootstrap and can be easily
extended by installing packages (including pkgbase packages).

Reviewed by: dch, cpersiva, jlduran, zlei
Differential Revision: https://reviews.freebsd.org/D46759
MFC after: 2 days

(cherry picked from commit d03c82c28da86e0812b98b051d24ae5980804ad7)
Replace "$((ls *.txz))" with "*.txz"

Reported by:	jrtc27

(cherry picked from commit e166fea685da4ac6a6891f10b07f98d0e9fcfce3)
We use a *.txz glob to get all of the "distributions" which comprise
the FreeBSD release, but we now (optionally) also build container
images which are .txz files.  Grep those out from the distribution
lists.

A better long-term fix would probably be to generate an explicit list
of the .txz files we want rather than using an overbroad glob and
filtering out the files we *don't* want.

Fixes:		d03c82c28da8 ("release: add optional OCI images")
MFC after:	1 minute
Sponsored by:	Amazon

(cherry picked from commit 47866cdcc7278faa27250dcea16374231c676050)
These are installed into /ociimages/ and stage onto the download site
at /OCI-IMAGES/; they don't belong in the same directory as the
"distribution" .txz files.

Fixes:		d03c82c28da8 ("release: add optional OCI images")
MFC after:	1 minute
Sponsored by:	Amazon

(cherry picked from commit 976e1d36be688166e140cbaded01d433c61e6d47)
We used to have two different code paths for generating release media
dist sets, one which expected to run as root, and one which did not.
It was possible that the two different paths could generate different
results.

We can use the path that does not *require* root also when running as
root, so use it always.  We'll want to do eventually do the same for all
release targets, but these ones are an easy place to start.

Reviewed by:	brooks
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D48041

(cherry picked from commit 41adc5f29ba6955e09f46e4d2c25da6fcd263ba2)
Supports reproducible builds.

PR: 283214
Reviewed-by: emaste
Signed-off-by: Pat Maddox <[email protected]>
(cherry picked from commit 950401d21e33df7ac63ef1d2316a18f09ffbaabe)
While we're here, send the etcupdate log from generating base.txz
to stdout instead of /dev/null (see e972e40) as well.

Reviewed by:	emaste, gordon, jrtc27
MFC after:	1 week
Sponsored by:	Amazon
Differential Revision:	https://reviews.freebsd.org/D48719

(cherry picked from commit ace4637ee0c666c6f5a1c664f8956f7302234edd)
This in effect always builds these targets in NO_ROOT mode, removing
one more instance where release artifact builds require a privileged
user (root).  These artifacts are now always built the same way.

Reviewed by:	brooks, Pat Maddox <[email protected]>
Sponsored by:	The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D48121

(cherry picked from commit cbba69fb5793c238cfd31697667bdff6ce1920b6)
We publish three sets of VM images on download.freebsd.org:
* Generic VM images
* BASIC-CLOUDINIT VM images
* BASIC-CI VM images

Of these, the first had names like
  FreeBSD-14.2-RELEASE-amd64-ufs.raw.xz,
the second had names like
  FreeBSD-14.2-RELEASE-amd64-BASIC-CLOUDINIT.ufs.qcow2.xz,
and the third had names like
  FreeBSD-14.2-RELEASE-amd64-BASIC-CI.ufs.raw.xz
but were listed in the CHECKSUM files with names like
  FreeBSD-14.2-RELEASE-amd64-BASIC-CI-ufs.raw.xz

Standardize these to consistently use a hyphen before the filesystem
type rather than a period.

Note: On FreeBSD 14 we ship images without the -${FS} component in
their names; these are hardlinks to the -ufs images for compatibility
purposes.  On FreeBSD 13 we only have UFS images and don't include the
filesystem in the name.

MFC after:	1 week
Reported by:	jmg
Sponsored by:	Amazon

(cherry picked from commit 35623ccc375846648f4dcdfc47c7e84fc9db4852)
- requires base tar & flua, qemu-tools & curl from ports
- set ORACLE_PAR_URL to upload to local file:/// dir or cloud buckets

Reviewed by:	emaste
Approved by:	cperciva
Differential Revision:	https://reviews.freebsd.org/D48382
Sponsored by:	SkunkWerks, GmbH

(cherry picked from commit 0ce9a414adc33af29607adbd81e0760e014fcd76)
This option disables trying to build a qemu-<target>-static and simply
doesn't do any of the operations that rely on it.  This disables package
installation which is required by most, but not all image types.

Disable all CLOUDWARE variants that require pkg when WITHOUT_QEMU is set
to avoid broken images.

Reviewed by:	emaste
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D49310

(cherry picked from commit 92d399a3be0e53622b9af16a82f9b7c7b62b34f7)
For images that don't require QEMU, support NO_ROOT.  This entails:
 - Passing NO_ROOT down to mk-vmimage.sh (which sets it for
   installworld, etc)
 - Handling etcupdate bootstrapping
 - Adding assorted config file METALOG entries
 - Running makefs in the right directory and adding -D for dups

The main gap in basic NO_ROOT support is package installation.  Each
image type must also be updated to add METALOG entries for any files it
adds.

Reviewed by:	emaste
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D49320

(cherry picked from commit c41ba99779d0431c37ac06a674e7744d15de8045)
Without this, rebuilding vm images will fail due to the .xz file
existing.

Reviewed by:	emaste
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D49321

(cherry picked from commit 59c529f2c856ec557954aa81b47603df8871ec25)
This happens to work with FreeBSD's shell, but is rejected by dash and
bash.

Reported by:	def
Reviewed by:	emaste
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D49526

(cherry picked from commit 9eb6cdafe5e2c2cfc9ddebc34ecabd1e7cbdc3ca)
brooksdavis and others added 3 commits April 4, 2025 17:38
To support common shell patterns (test -n and -z) we want NO_ROOT and
WITHOUT_QEMU to be set and not empty in mk-vmimage.sh if they are set at
all in the Makefile.

Actually do this rather than making them always set (which propogates to
submakes run by mk-vmimage.sh and unconditionally enables NO_ROOT with
undesirable side effects such as installing a /METALOG in vm images).

Reported by:	cperciva
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D49544

(cherry picked from commit e6e5cd297ab4cae4995895b99c713df9cf6e8c0f)
Using Compute Gallery as the source is the preferred method now.

Reviewed by:	brooks, emaste
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D49528

(cherry picked from commit 09f991f5f6f224f75f3cc9f666f0e0e2e9621432)
To support common shell patterns (test -n and -z) we want WITHOUT_QEMU
to be set and not empty in mk-vmimage.sh if it is defined at all in the
Makefile.

Fix a case I missed previously.

Reported by:	cperciva
Fixes:		e6e5cd297ab4 ("release/vm: fix setting NO_ROOT and WITHOUT_QEMU")
Sponsored by:	DARPA, AFRL

Reviewed by:	emaste
Differential Revision:	https://reviews.freebsd.org/D49666

(cherry picked from commit 75ae454d58144d23672607a4a02b9b36532caf76)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

8 participants