feat: enable ABUpdate for UKI-based ACL images

acl/docs/architecture.md

@@ -53,8 +53,9 @@ ACL's primary boot path uses **systemd-boot** with **Unified Kernel Images (UKI)
 
 The `/usr` partition (USR-A) is a read-only btrfs filesystem with zstd compression. **dm-verity** provides block-level integrity verification:
 
-- The verity hash tree is appended to the USR partition data.
-- At boot, `systemd-veritysetup` activates the verity device using kernel command-line parameters embedded in the UKI: `systemd.verity_usr_data`, `systemd.verity_usr_hash`, and `systemd.verity_usr_options=hash-offset=<N>,panic-on-corruption`.
+- The verity hash tree is stored in a dedicated hash partition (HASH-A, immediately following USR-A on disk).
+- At boot, `systemd-veritysetup` activates the verity device using slot-specific parameters delivered via a per-slot systemd-stub addon: `systemd.verity_usr_data=PARTUUID=<usr-data-partition>`, `systemd.verity_usr_hash=PARTUUID=<usr-hash-partition>`, and `systemd.verity_usr_options=panic-on-corruption`.
+- The main UKI cmdline stays slot-independent (`mount.usr=/dev/mapper/usr`); Trident switches slots by swapping which addon is active in `<uki>.efi.extra.d/`, so the same signed UKI boots either A or B. (The secondary GRUB boot path instead builds the verity cmdline from filesystem/verity UUIDs, `UUID=<btrfs-uuid>` / `UUID=<verity-uuid>`.)
 - Any corruption of `/usr` causes an immediate kernel panic, preventing the system from running a tampered image.
 
 The A/B partition scheme (USR-A / USR-B) enables safe updates: the inactive slot is written, verified, and then atomically switched on reboot.

acl/validate/validate_qemu.sh

@@ -49,7 +49,12 @@ ensure_libvirt_network() {
             return 1
         fi
     fi
-    if ! virsh net-info default 2>/dev/null | grep -q 'Active:.*yes'; then
+    # Capture output first instead of piping directly into grep: under `set -o pipefail`
+    # (inherited from validate_common.sh, since this file is sourced not executed),
+    # grep -q can exit as soon as it matches while virsh is still writing, causing a
+    # SIGPIPE in virsh and a false pipeline failure even though the pattern matched.
+    net_info="$(virsh net-info default 2>/dev/null)"
+    if ! grep -q 'Active:.*yes' <<< "$net_info"; then
         info "Starting libvirt default network..."
         if sudo virsh net-start default; then
             sudo virsh net-autostart default 2>/dev/null || true

build_library/build_image_util.sh

@@ -886,6 +886,8 @@ EOF
 
     "${BUILD_LIBRARY_DIR}/disk_util" --disk_layout="${disk_layout}" --arch="${BOARD}" verity \
         --root_hash="${BUILD_DIR}/${image_name%.bin}_verity.txt" \
+        --verity_uuid="${BUILD_DIR}/${image_name%.bin}_verity_uuid.txt" \
+        --fs_uuid="${BUILD_DIR}/${image_name%.bin}_fs_uuid.txt" \
         "${BUILD_DIR}/${image_name}"
 
     # Magic alert!  Root hash injection works by writing the hash value to a
@@ -953,6 +955,15 @@ EOF
         if [[ -f "${verity_hash_file}" ]]; then
           bootloader_args+=(--verity_hash="${verity_hash_file}")
         fi
+        # Pass UUID files for UUID-based cmdline construction
+        local verity_uuid_file="${BUILD_DIR}/${image_name%.bin}_verity_uuid.txt"
+        if [[ -f "${verity_uuid_file}" ]]; then
+          bootloader_args+=(--verity_uuid="${verity_uuid_file}")
+        fi
+        local fs_uuid_file="${BUILD_DIR}/${image_name%.bin}_fs_uuid.txt"
+        if [[ -f "${fs_uuid_file}" ]]; then
+          bootloader_args+=(--fs_uuid="${fs_uuid_file}")
+        fi
       fi
     else
       bootloader_args+=(--noverity)

build_library/disk_layout.json

@@ -32,22 +32,38 @@
         "fs_type":"btrfs",
         "fs_compression":"zstd",
         "mount":"/usr",
+        "verity_hash":"4",
+        "legacy_verity_offset":true,
         "features": ["prioritize", "verity"]
       },
       "4":{
+        "label":"HASH-A",
+        "uuid":"1fae528b-6baf-4efc-a226-2a23f9291ce6",
+        "type":"dps-usr-verity",
+        "blocks":"20480"
+      },
+      "5":{
         "label":"USR-B",
         "uuid":"e03dd35c-7c2d-4a47-b3fe-27f15780a57c",
         "type":"flatcar-rootfs",
         "blocks":"2097152",
-        "fs_blocks":"262144"
+        "fs_blocks":"262144",
+        "verity_hash":"6",
+        "legacy_verity_offset":true
       },
-      "5":{
+      "6":{
+        "label":"HASH-B",
+        "uuid":"accb60b1-1d72-4e05-9363-6fd51e2ce788",
+        "type":"dps-usr-verity",
+        "blocks":"20480"
+      },
+      "7":{
         "label":"ROOT-C",
         "uuid":"d82521b4-07ac-4f1c-8840-ddefedc332f3",
         "type":"blank",
         "blocks":"0"
       },
-      "6":{
+      "8":{
         "label":"OEM",
         "fs_label":"OEM",
         "type":"data",
@@ -56,17 +72,17 @@
         "fs_compression":"zlib",
         "mount":"/oem"
       },
-      "7":{
+      "9":{
         "label":"OEM-CONFIG",
         "type":"flatcar-reserved",
         "blocks":"131072"
       },
-      "8":{
+      "10":{
         "type":"blank",
         "label":"flatcar-reserved",
         "blocks":"0"
       },
-      "9":{
+      "11":{
         "label":"ROOT",
         "fs_label":"ROOT",
         "type":"dps-root",
@@ -76,28 +92,28 @@
       }
     },
     "vm":{
-      "9":{
+      "11":{
         "label":"ROOT",
         "fs_label":"ROOT",
         "blocks":"12943360"
       }
     },
     "azure":{
-      "9":{
+      "11":{
         "label":"ROOT",
         "fs_label":"ROOT",
         "blocks":"58875904"
       }
     },
     "vagrant":{
-      "9":{
+      "11":{
         "label":"ROOT",
         "fs_label":"ROOT",
         "blocks":"33845248"
       }
     },
     "onmetal":{
-      "7":{
+      "9":{
         "label":"config-2",
         "fs_label":"config-2",
         "type":"data",
@@ -130,6 +146,12 @@
         "type":"blank"
       },
       "9":{
+        "type":"blank"
+      },
+      "10":{
+        "type":"blank"
+      },
+      "11":{
         "label":"ROOT",
         "fs_label":"ROOT",
         "type":"0fc63daf-8483-4772-8e79-3d69d8477de4",

build_library/disk_layout_uki.json

@@ -10,11 +10,11 @@
     "layouts": {
         "base": {
             "1": {
-                "_comment": "128 MiB -> 192 MiB (blocks are 512-byte sectors). UKI boot keeps kernel+initramfs on the ESP, and the acl-t UKI rebuilt by Image Customizer needs more headroom than stock.",
+                "_comment": "128 MiB -> 256 MiB (blocks are 512-byte sectors). UKI boot keeps kernel+initramfs on the ESP; the acl-t UKI rebuilt by Image Customizer and Trident A/B update addons both need more headroom than stock.",
                 "label": "EFI-SYSTEM",
                 "fs_label": "EFI-SYSTEM",
                 "type": "efi",
-                "blocks": "393216",
+                "blocks": "524288",
                 "fs_type": "vfat",
                 "mount": "/boot",
                 "features": []
@@ -24,23 +24,37 @@
                 "uuid": "7130c94a-213a-4e5a-8e26-6cce9662f132",
                 "type": "flatcar-rootfs",
                 "blocks": "2097152",
-                "fs_blocks": "260094",
+                "fs_blocks": "262144",
                 "fs_type": "btrfs",
                 "fs_compression": "zstd",
                 "mount": "/usr",
+                "verity_hash": "3",
                 "features": [
                     "prioritize",
                     "verity"
                 ]
             },
             "3": {
+                "label": "HASH-A",
+                "uuid": "b736baf1-cdb4-4535-beba-ddaaa30ad7b7",
+                "type": "dps-usr-verity",
+                "blocks": "20480"
+            },
+            "4": {
                 "label": "USR-B",
                 "uuid": "e03dd35c-7c2d-4a47-b3fe-27f15780a57c",
                 "type": "flatcar-rootfs",
                 "blocks": "2097152",
-                "fs_blocks": "262144"
+                "fs_blocks": "262144",
+                "verity_hash": "5"
             },
-            "4": {
+            "5": {
+                "label": "HASH-B",
+                "uuid": "35bdf78b-c453-4661-98e6-f834f534ef5b",
+                "type": "dps-usr-verity",
+                "blocks": "20480"
+            },
+            "6": {
                 "label": "OEM",
                 "fs_label": "OEM",
                 "type": "data",
@@ -49,7 +63,7 @@
                 "fs_compression": "zlib",
                 "mount": "/oem"
             },
-            "5": {
+            "7": {
                 "label": "ROOT",
                 "fs_label": "ROOT",
                 "type": "dps-root",
@@ -59,21 +73,21 @@
             }
         },
         "vm": {
-            "5": {
+            "7": {
                 "label": "ROOT",
                 "fs_label": "ROOT",
                 "blocks": "12943360"
             }
         },
         "azure": {
-            "5": {
+            "7": {
                 "label": "ROOT",
                 "fs_label": "ROOT",
                 "blocks": "58875904"
             }
         },
         "vagrant": {
-            "5": {
+            "7": {
                 "label": "ROOT",
                 "fs_label": "ROOT",
                 "blocks": "33845248"
@@ -93,6 +107,12 @@
                 "type": "blank"
             },
             "5": {
+                "type": "blank"
+            },
+            "6": {
+                "type": "blank"
+            },
+            "7": {
                 "label": "ROOT",
                 "fs_label": "ROOT",
                 "type": "0fc63daf-8483-4772-8e79-3d69d8477de4",