mkosi.conf

# Confer Confidential VM Proxy Image Configuration
# Built with mkosi for reproducible attestation (TDX and SEV-SNP)
#
# Uses dm-verity disk image format:
# - Small ESP with UKI (kernel + minimal initrd + cmdline with roothash)
# - Large rootfs verified via dm-verity at runtime
# - Roothash in cmdline is measured, binding entire rootfs to attestation

[Config]
Dependencies=initrd

[Output]
ImageId=confer-image
ImageVersion=0.1.3
Format=disk
ManifestFormat=json
Seed=a24031c1-fc68-453d-80fa-00ad057a5780

[Distribution]
Distribution=ubuntu
Release=noble
Repositories=

[Content]
# For reproducible builds - clamp all timestamps
SourceDateEpoch=0
Initrds=initrd

# Enable bootable disk with systemd-boot
Bootable=yes
Bootloader=systemd-boot

# Kernel command line
# Note: dm-verity roothash will be appended automatically by mkosi
KernelCommandLine=intel_iommu=on amd_iommu=on iommu=pt pcie_acs_override=downstream,multifunction

# Kernel modules to include in the initrd
KernelModulesInitrdInclude=dm-verity
                          dm-mod
                          squashfs

Packages=
    systemd
    systemd-boot-efi
    udev
    dbus
    ca-certificates
    ubuntu-keyring
    cryptsetup
    openjdk-21-jre-headless
    python3
    python3-pip
    python3-venv
    python3-dev
    curl
    wget
    gnupg
    unzip
    vim
    less
    htop
    lsof
    strace
    net-tools
    iproute2
    iputils-ping
    dnsutils
    kmod
    build-essential
    dkms
    zstd
    pciutils
    libxml2
    libxslt1.1
    linux-generic-hwe-24.04
    linux-headers-generic-hwe-24.04
    nvidia-driver-580-open=580.105.08-0ubuntu1
    nvidia-persistenced=580.105.08-0ubuntu1
    nvidia-fabricmanager=580.105.08-1
    libnvidia-nscq=580.105.08-1
    faketime

Autologin=no

Locale=C.UTF-8
Keymap=us

SkeletonTrees=mkosi.skeleton
ExtraTrees=mkosi.extra:/

# Remove non-deterministic files for reproducibility
# Keep /var/log directory as mount point for tmpfs, but remove contents
RemoveFiles=/var/log/*
RemoveFiles=/var/cache
# Note: Don't remove /etc/machine-id - systemd-networkd DHCP needs it
# We set a fixed value in mkosi.postinst for reproducibility
RemoveFiles=/etc/*-
RemoveFiles=/etc/ssh/ssh_host_*_key*

# Clean package metadata for reproducibility
CleanPackageMetadata=yes

[Build]
CacheDirectory=mkosi.cache
Incremental=yes
# No ToolsTree - use tools from Nix environment
WithNetwork=yes
SandboxTrees=mkosi.skeleton
Environment=SOURCE_DATE_EPOCH=0
Environment=KBUILD_BUILD_TIMESTAMP=@0
Environment=INITRD=No

BuildScripts=mkosi.build.chroot
BuildSources=.:src

BuildPackages=
    python3-pip
    python3-dev
    python3-venv
    build-essential
    libxml2-dev
    libxslt1-dev
    faketime