[piyush-jena]

Description of changes:

• Add bootconfig library which provides support functions for the following
  • parse bootconfig.data and construct kernel command line for UKI images
  • decode .cmdline section in the PE image of UKI
  • parse grub.cfg to read grub config
  • encode UKI LoadOptions for PCR 9 calculation
  • merge_parameters to merge the contributions from the drop-ins.
• Update pcrsys
  • enable prediction for SHA384 PCR bank
  • predict PCRs for UKI images
• Add sub-commands in ukisys
  • merge-bootconfig
  • cmdline

rpm2img: the build path
rpm2img sets up BOOTCONFIG_DIR, installs RPMs into ROOT_MOUNT/BOOT_MOUNT, builds the root filesystem, then calls generate_verity_root from imghelper.

Next comes the block the middle commit moved /boot/boot-config.d drop-ins shipped by packages are validated (single-line key = value only), concatenated, sorted, passed through ukisys merge-bootconfig. This calls bootconfig::merge_parameters which collapses duplicate keys into one sorted quoted value.

x.a=k1
x.a=k2

is collapsed to

x.a="k1,k2"

This is compiled to binary bootconfig.data by the kernel's bootconfig -a. In case of UKI images, ukisys cmdline reads that binary data and kernel and init args and writes a file; ukify build --cmdline "@${file}". This data is embedded into the UKI in .cmdline section.

img2img: the repack path
img2img decompresses an existing image, re-extracts the partitions, optionally replaces root contents, and then mirrors rpm2img's ordering: it reads EFI-A's PARTUUID calls the same generate_verity_root to get a fresh DM_VERITY_ROOT. It never regenerates bootconfig. For GRUB images Section 6 just seds the new verity table into grub.cfg and re-signs it. For UKI images it calls repack_uki: ukify inspect extracts .linux, .cmdline, .osrel, .uname, .sbat; ukisys derive-stubstrips the Authenticode signature and the trailing payload sections to recover a stub ukify build will accept; the old.cmdline` is string-surgeried so only the dm-mod.create="..." value changes (the literal quotes are matched deliberately, since the table contains spaces); the UKI is rebuilt, re-signed with sign_uki, verified section-by-section.

pcrsys:
pcrsys disk --image "${OS_IMAGE}" --efi-vars ... --platform ...emitspcr-predictions.json`. It reads the real disk rather than trusting build variables and generates PCR predictions.

Some refactoring was done to move certain functions to more logical locations. They are detailed below:
tools/bootconfig/src/parsers/bootconfig.pest
tools/bootconfig/src/parsers/grub.pest
tools/bootconfig/src/parsers/grub.rs

• These files are moved from tools/pcrsys/src/parsers

tools/bootconfig/src/parsers/bootconfig.rs

• extract_values - returns vector of strings instead of comma separated strings
• process_entry - BootconfigRule::bool_key errors out because rpm2img enforces the fact that boot parameters have to be key value pairs.
• the rest of the functions are a copy

tools/bootconfig/src/grub_cmdline.rs

• repair_quotes from tools/bootconfig/src/parsers/bootconfig.rs

tools/bootconfig/src/params.rs

• format_params from tools/bootconfig/src/parsers/bootconfig.rs

Testing done:
Tested alongside bottlerocket-os/bottlerocket-core-kit#1076

• Built aws-mantle-1, aws-ecs-3, aws-ecs-4 - both arches, nvidia and fips variants included
  • Launched instances and ensured it boots
  • Ensured the kernel command line is as expected
  • Ensured both pcr banks are predicted and it matches the measured value

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[jmt-lab]

Can we do a pass for your AI to remove narrative comments, its not that bad right now but i see a few places where it is more narrative then helpful

[jmt-lab]

[P1] Don't split, sort and dedupe the inside of bootconfig values when merging drop-ins

merge_parameters splits every value on ,, trims each piece, puts the pieces in a BTreeSet (sorted, deduplicated) and joins them back into one quoted value. That changes what the kernel sees for any value where commas or order matter. rpm2img now runs ukisys merge-bootconfig for every image, GRUB images included, so this affects both boot paths:

• kernel.console = ttyS0,115200n8 becomes kernel.console = "115200n8,ttyS0", so the kernel gets console=115200n8,ttyS0 and the serial console breaks.
• kernel.console = tty0, ttyS0 (an array, which the rpm2img grep check allows) used to expand to console=tty0 console=ttyS0. It now becomes the single argument console=tty0,ttyS0, which means device tty0 with options ttyS0. The an_array_becomes_one_value test locks this in, while the ukisys test cmdline_joins_bootconfig_with_image_builder_arguments (no merge step) expects the expanded form, so the two code paths disagree.
• Values where order matters, such as lsm=, get alphabetised. Values with empty fields, like a,,b or dm-style tables, lose those fields.

Suggested fix: merge only identical repeated assignments, or keep each contribution's raw value as an array element in first-seen order (emit key = v1, v2, so the kernel gets one argument per contribution). Don't re-split inside a quoted value. If comma-joining is really intended for list-valued keys like module_blacklist, limit it to an explicit allow-list of those keys and keep the original order.

[jmt-lab]

I don't have scope to know if this is a real finding or not, let me know if not

[jmt-lab]

[P1] Gate pcrsys on platform for UKI images, or non-AWS secure-boot UKI builds now fail

This hunk drops the UKI_IMAGE == no guard, so pcrsys disk now runs for every secure-boot image, UKI images included. The step can't fail quietly: stdout is redirected into pcr-predictions.json, and rpm2img runs with errexit. On the UKI path, predict_pcrs in tools/pcrsys/src/main.rs bails with ensure_whatever!(platform == Platform::Aws, "direct UKI prediction supports AWS only"). Neither rpm2img nor img2img limits --with-uki-image=yes to AWS. So a metal or vmware variant built with UKI_IMAGE=yes and UEFI_SECURE_BOOT=yes, which used to build (prediction was skipped), now fails at the end of the build.

The same change is in twoliter/embedded/img2img (~line 679).

Suggested fix: keep skipping prediction for non-AWS UKI images, e.g. if [[ "${UEFI_SECURE_BOOT}" == "yes" && ( "${UKI_IMAGE}" == "no" || "${VARIANT_PLATFORM,,}" == "aws" ) ]]. Alternatively, reject UKI_IMAGE=yes for non-AWS platforms up front with a clear error.

[jmt-lab]

[P3] Remove the duplicated crate doc paragraph

The new module doc text (lines 5-8) was added next to the old paragraph (lines 1-4) instead of replacing it, so rustdoc now shows "ukisys: ..." twice with nearly the same text. Delete lines 1-4 and keep the new wording that mentions command-line construction.