feat: enable ABUpdate for UKI-based ACL images - #28

Open

bfjelds (bfjelds) wants to merge 32 commits into

user/bfjelds/ab-verity-partuuid-uki-addons-20260708

Commits on Aug 14, 2026

feat: dedicated verity hash partitions, UUID-based boot, and trident integration

bfjelds (bfjelds)
and
Copilot
committed
f7a9084
feat: move verity slot identity into PARTUUID-based UKI addons

bfjelds (bfjelds)
and
Copilot
committed
f48bd11
fix: restore UUID validation, move mount.usr to main UKI, reject non-verity

bfjelds (bfjelds)
and
Copilot
committed
3f37071
fix: harden jq lookups, validate JSON structure, improve temp cleanup

bfjelds (bfjelds)
and
Copilot
committed
3857985
Re-enable SELinux policy minimization
bfjelds (bfjelds)
committed
08a261e
fix: address Copilot review feedback on A/B verity boot

bfjelds (bfjelds)
and
Copilot
committed
b396009
fix: write FS UUID in both verity modes; unify verity paths

bfjelds (bfjelds)
and
Copilot
committed
159dd99
fix: raise InvalidLayout for missing verity_hash partition reference

bfjelds (bfjelds)
and
Copilot
committed
9e2d158
fix: drop unused 'count' local in _lookup_partuuid

bfjelds (bfjelds)
and
Copilot
committed
625a18a
fix: normalize verity_hash cross-reference to str before lookup

bfjelds (bfjelds)
and
Copilot
committed
566a92f
Increase UKI ESP size from 128 MiB to 256 MiB

bfjelds (bfjelds)
and
Copilot
committed
6485eb7
fix: address PR #28 review comments

bfjelds (bfjelds)
and
Copilot
committed
2e17ae6
Revert grub verity-hash die back to pre-existing warn

bfjelds (bfjelds)
and
Copilot
committed
1f7abae
fix: drop jq -e in _lookup_partuuid so explicit null check runs

bfjelds (bfjelds)
and
Copilot
committed
5b82902
uki: add arm64 test-image device-timeout addon

bfjelds (bfjelds)
and
Copilot
committed
aa12a3e
Address review: harden UKI timeout addon + tridentd.socket enablement

bfjelds (bfjelds)
and
Copilot
committed
8b072ba
Address review: fail fast on empty verity_hash in disk_util Verity

bfjelds (bfjelds)
and
Copilot
committed
a0fc553
Address review: guard ukify build under strict mode; genericize FS UUID wording

bfjelds (bfjelds)
and
Copilot
committed
e28a115
Address review: use sudo rm -rf for ukify temp-dir cleanup

bfjelds (bfjelds)
and
Copilot
committed
3e502b5
acl-grub: use dedicated /usr verity hash partitions, consistent with UKI

Brian Fjeldstad
authored and
bfjelds (bfjelds)
committed
8cdc0c7
vm_image_util: extend device-init timeout to GRUB arm64 test images too

Brian Fjeldstad
authored and
bfjelds (bfjelds)
committed
97fcc37
grub timeout override: fail if sed substitution does not take effect
bfjelds (bfjelds)
committed
1e0b995
validate_qemu: avoid pipefail/SIGPIPE race in libvirt network active check
bfjelds (bfjelds)
committed
1528eb5
rpm mode: disable auditd.service by default

bfjelds (bfjelds)
and
Copilot
committed
abea204
rpm mode: install trident-acl-agent instead of trident

bfjelds (bfjelds)
and
Copilot
committed
a4ac985

Commits on Aug 24, 2026

include trident RPM (not trident-acl-agent) initially
bfjelds (bfjelds)
committed
c59aa94

Commits on Aug 27, 2026

Address PR #28 review feedback

bfjelds (bfjelds)
and
Copilot
committed
41b7f26

Commits on Aug 28, 2026

rpm mode: uninstall auditd instead of just disabling it

bfjelds (bfjelds)
and
Copilot
committed
1f81d57
prod_image_util.sh: initialize rootdev/usrdev to avoid unbound-var crash

bfjelds (bfjelds)
and
Copilot
committed
fee4ee4
uki_install.sh: rename verity slot addons to slot-*.addon.efi, add acl.slot cmdline

bfjelds (bfjelds)
and
Copilot
committed
c46dc7f
uki_install.sh: fix stray trailing slash in doc comment

bfjelds (bfjelds)
and
Copilot
committed
6a3c132
Merge pull request #64 from microsoft/user/bfjelds/acl-slot-addon-rename
bfjelds (bfjelds)
authored
8a450f2