Skip to content

Commit 2b73d3b

Browse files
flowzone-app[bot]flowzone-app[bot]
authored
v5.3.0
1 parent 8ca52d2 commit 2b73d3b

File tree

3 files changed

+252
-1
lines changed

3 files changed

+252
-1
lines changed

‎.versionbot/CHANGELOG.yml

Lines changed: 226 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,229 @@
1+
- commits:
2+
- subject: Update layers/meta-balena to 02acc2b2f2337154e79825e21fc5a517a1f97315
3+
hash: c3f7774ce7e27ad2edca7adbc6aea317d3255ce9
4+
body: Update layers/meta-balena
5+
footer:
6+
Changelog-entry: Update layers/meta-balena to 02acc2b2f2337154e79825e21fc5a517a1f97315
7+
changelog-entry: Update layers/meta-balena to 02acc2b2f2337154e79825e21fc5a517a1f97315
8+
author: Self-hosted Renovate Bot
9+
nested:
10+
- commits:
11+
- subject: "hup: signed-update: silence tpm2-tools output"
12+
hash: 877b7b39f2ac3dbab0cc806916ef2c13dbdfd885
13+
body: |
14+
The output of these tools doesn't need logged. Silence them.
15+
footer:
16+
Change-type: patch
17+
change-type: patch
18+
Signed-off-by: Joseph Kogut <joseph@balena.io>
19+
signed-off-by: Joseph Kogut <joseph@balena.io>
20+
author: Joseph Kogut
21+
nested: []
22+
- subject: "hup: silence mountpoint"
23+
hash: d9a477b706ffc8ba4d8126e9665a2142bb705719
24+
body: ""
25+
footer:
26+
Change-type: patch
27+
change-type: patch
28+
Signed-off-by: Joseph Kogut <joseph@balena.io>
29+
signed-off-by: Joseph Kogut <joseph@balena.io>
30+
author: Joseph Kogut
31+
nested: []
32+
- subject: "hup: signed-update: print predicted PCR values after creating a
33+
policy"
34+
hash: a3b2b9ba45470b4ff6b35c56c13e2400c51c95c7
35+
body: ""
36+
footer:
37+
Change-type: patch
38+
change-type: patch
39+
Signed-off-by: Joseph Kogut <joseph@balena.io>
40+
signed-off-by: Joseph Kogut <joseph@balena.io>
41+
author: Joseph Kogut
42+
nested: []
43+
- subject: "os-helpers-tpm2: firmware_measures_efibins: silence grep"
44+
hash: cd7b142195cd7cd33126e0dfbd75ee00e6b03aa3
45+
body: >
46+
The firmware_measures_efibins function outputs different strings
47+
48+
depending on whether the TPM event log is available, and whether
49+
or not
50+
51+
EFI binaries are measured into PCR 7 as indicated in the event
52+
log.
53+
54+
55+
We don't need to print the output of the parsed event log, so
56+
redirect
57+
58+
it.
59+
footer:
60+
Change-type: patch
61+
change-type: patch
62+
Signed-off-by: Joseph Kogut <joseph@balena.io>
63+
signed-off-by: Joseph Kogut <joseph@balena.io>
64+
author: Joseph Kogut
65+
nested: []
66+
- subject: "os-helpers-tpm2: specify TCTI backend"
67+
hash: c4eb9d7f6ad412bd74d77ece0e534c8dd2dd6fac
68+
body: >
69+
Specify the TCTI backend [0], which also silences error messages
70+
from
71+
72+
trying unsupported backends
73+
74+
75+
[0]
76+
https://github.com/tpm2-software/tpm2-tools/blob/master/man/common/tcti.md
77+
footer:
78+
Change-type: patch
79+
change-type: patch
80+
Signed-off-by: Joseph Kogut <joseph@balena.io>
81+
signed-off-by: Joseph Kogut <joseph@balena.io>
82+
author: Joseph Kogut
83+
nested: []
84+
- subject: "os-helpers-sb: silence 'command -v'"
85+
hash: 0cc0e51ec48fd90c7164cf458c6a2b583319999d
86+
body: ""
87+
footer:
88+
Change-type: patch
89+
change-type: patch
90+
Signed-off-by: Joseph Kogut <joseph@balena.io>
91+
signed-off-by: Joseph Kogut <joseph@balena.io>
92+
author: Joseph Kogut
93+
nested: []
94+
- subject: "hup: signed-update: update boot files as needed"
95+
hash: c08e732e0a678bce9cf48774fabd9016325fcaa7
96+
body: >
97+
Unconditionally update the kernel and second stage bootloader
98+
when the
99+
100+
content on disk doesn't match the binaries shipped in the
101+
hostapp.
102+
103+
104+
Previously this was only done when migrating, but the kernel,
105+
and
106+
107+
consequently the second stage bootloader, change every build.
108+
This means
109+
110+
firmwares which measure EFI binaries into PCR 7 won't boot
111+
unless the
112+
113+
second stage bootloader is updated to match the digests enrolled
114+
in the
115+
116+
security database.
117+
footer:
118+
Change-type: patch
119+
change-type: patch
120+
Signed-off-by: Joseph Kogut <joseph@balena.io>
121+
signed-off-by: Joseph Kogut <joseph@balena.io>
122+
author: Joseph Kogut
123+
nested: []
124+
- subject: "hup: signed-update: always remove policy directory"
125+
hash: 7c4032d4596c72a85902c91bd48845543f3651b3
126+
body: >
127+
After creating a new policy, always remove any previous policy
128+
directory
129+
130+
that was found.
131+
footer:
132+
Change-type: patch
133+
change-type: patch
134+
Signed-off-by: Joseph Kogut <joseph@balena.io>
135+
signed-off-by: Joseph Kogut <joseph@balena.io>
136+
author: Joseph Kogut
137+
nested: []
138+
- subject: "os-helpers-tpm2: append event log digests before separator"
139+
hash: 1c19ebb6b7c9b47ae81a3d67fc5526ea3ed55caf
140+
body: >
141+
Don't continue appending event log digests after the separator.
142+
This
143+
144+
fixes creating a TPM policy on machines that measure EFI
145+
binaries into
146+
147+
PCR 7 double appending the EFI binary hashes, which will cause
148+
boot
149+
150+
failures.
151+
footer:
152+
Change-type: patch
153+
change-type: patch
154+
Signed-off-by: Joseph Kogut <joseph@balena.io>
155+
signed-off-by: Joseph Kogut <joseph@balena.io>
156+
author: Joseph Kogut
157+
nested: []
158+
- subject: "hostapp-update-hooks: signed-update: fix exit code conditional"
159+
hash: 06ef101cf68056c348f4c6810b522f2bbdbb7e55
160+
body: >
161+
Shellcheck warning SC2319 indicates that the condition being
162+
checked
163+
164+
here may be overwritten by subsequent commands.
165+
166+
167+
Replace this conditional with a switch statement that directly
168+
evaluates
169+
170+
the output.
171+
172+
173+
Also bump the minor version to make it more obvious that PCR 7
174+
sealing
175+
176+
brings a new feature, which should've happened previously.
177+
footer:
178+
Change-type: minor
179+
change-type: minor
180+
Signed-off-by: Joseph Kogut <joseph@balena.io>
181+
signed-off-by: Joseph Kogut <joseph@balena.io>
182+
author: Joseph Kogut
183+
nested: []
184+
- subject: "os-helpers-tpm2: fix awk syntax error causing unbootable machines"
185+
hash: 6c21f43c49361dac28f432083122a3ee35704a6f
186+
body: >
187+
A missing semi-colon caused the firmware_measures_efibins
188+
function to
189+
190+
return an exit code of one, which the 0-signed-update
191+
hostapp-update
192+
193+
hook interpreted as "this firmware does not measure EFI binaries
194+
into
195+
196+
PCR 7", as opposed to zero, indicating "this firmware *does*
197+
measure EFI
198+
199+
binaries into PCR 7", or two, indicating "the TPM event log is
200+
201+
unavailable and it's impossible to tell."
202+
203+
204+
Taking the wrong branch in this conditional led to an
205+
inappropriate
206+
207+
policy being created to seal the LUKS passphrase, which could
208+
not be
209+
210+
unlocked on the next boot, as in QEMU with edk2, EFI binaries
211+
*are*
212+
213+
measured into PCR 7.
214+
footer:
215+
Change-type: patch
216+
change-type: patch
217+
Signed-off-by: Joseph Kogut <joseph@balena.io>
218+
signed-off-by: Joseph Kogut <joseph@balena.io>
219+
author: Joseph Kogut
220+
nested: []
221+
version: meta-balena-5.3.0
222+
title: ""
223+
date: 2024-04-24T06:33:36.925Z
224+
version: 5.3.0
225+
title: ""
226+
date: 2024-04-24T10:34:36.174Z
1227
- commits:
2228
- subject: Update layers/meta-balena to 5618489132d1e31652f7e018da32bdd5b7492e64
3229
hash: f98fa3970d63ae3bf463f64308c03103ac48b96e

‎CHANGELOG.md

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,31 @@
11
Change log
22
-----------
33

4+
# v5.3.0
5+
## (2024-04-24)
6+
7+
8+
<details>
9+
<summary> Update layers/meta-balena to 02acc2b2f2337154e79825e21fc5a517a1f97315 [Self-hosted Renovate Bot] </summary>
10+
11+
> ## meta-balena-5.3.0
12+
> ### (2024-04-24)
13+
>
14+
> * hup: signed-update: silence tpm2-tools output [Joseph Kogut]
15+
> * hup: silence mountpoint [Joseph Kogut]
16+
> * hup: signed-update: print predicted PCR values after creating a policy [Joseph Kogut]
17+
> * os-helpers-tpm2: firmware_measures_efibins: silence grep [Joseph Kogut]
18+
> * os-helpers-tpm2: specify TCTI backend [Joseph Kogut]
19+
> * os-helpers-sb: silence 'command -v' [Joseph Kogut]
20+
> * hup: signed-update: update boot files as needed [Joseph Kogut]
21+
> * hup: signed-update: always remove policy directory [Joseph Kogut]
22+
> * os-helpers-tpm2: append event log digests before separator [Joseph Kogut]
23+
> * hostapp-update-hooks: signed-update: fix exit code conditional [Joseph Kogut]
24+
> * os-helpers-tpm2: fix awk syntax error causing unbootable machines [Joseph Kogut]
25+
>
26+
27+
</details>
28+
429
# v5.2.10
530
## (2024-04-23)
631

‎VERSION

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
5.2.10
1+
5.3.0

0 commit comments

Comments
 (0)