]> git.ipfire.org Git - thirdparty/systemd.git/commit
dissect-image: guess verity root hash from the resources we found
authorLennart Poettering <lennart@poettering.net>
Fri, 14 Mar 2025 10:57:34 +0000 (11:57 +0100)
committerLennart Poettering <lennart@poettering.net>
Thu, 3 Apr 2025 09:08:57 +0000 (11:08 +0200)
commite34c89897af9b0c7af49d0137bf04fa31b172c4a
tree6758ea35adb069c2705edac290e053a1c809781e
parent923eabf085a03a213af3a2c0eeb2086bcf5959a5
dissect-image: guess verity root hash from the resources we found

When dissecting an image, let's make use of the Verity data even if we
got told no root hash explicitly: we can simply determine it by
concatenating the data partition uuid with the verity partition uuid.

Of course, on first thought this doesn't really add much: if the root
hash is not pinned from somewhere, this does not guarantee trust in
the image.

However, this is very useful for attestation: if we have the root hash
we can measure it before mounting things, even if we don't actually
authenticate it.

Hence, at best this helps us with attestation, at worst it doesn't improve
security but certainly doesn't hurt it.
docs/ENVIRONMENT.md
src/core/namespace.c
src/dissect/dissect.c
src/mountfsd/mountwork.c
src/nspawn/nspawn.c
src/shared/dissect-image.c
src/shared/dissect-image.h
src/sysext/sysext.c
src/udev/udev-builtin-dissect_image.c