kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

rust/pvimg: Add '--(enable|disable)-image-encryption' flags to 'pvimg create'

Browse Source 
With runtime attestation it might be useful to have non-encrypted Secure
Execution images. This patch adds the support for this to the 'pvimg
create' and 'genprotimg' commands.

Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Acked-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2024-12-11 19:25:59 +01:00
committed by Jan Höppner
parent cf5560a100
commit cf51ac7860
7 changed files with 85 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rust/pvimg/src/cmd/create.rs
+10
View File
@@ -80,6 +80,12 @@ fn parse_flags(
lf.enable_backup_keys
.filter(|x| *x)
.and(Some(PcfV1::all_enabled([PcfV1::BackupTargetKeys]))),
lf.disable_image_encryption
.filter(|x| *x)
.and(Some(PcfV1::all_enabled([PcfV1::NoComponentEncryption]))),
lf.enable_image_encryption
.filter(|x| *x)
.and(Some(PcfV1::all_disabled([PcfV1::NoComponentEncryption]))),
]
.into_iter()
.flatten()
@@ -135,6 +141,10 @@ pub fn create(opt: &CreateBootImageArgs) -> Result<OwnExitCode> {
read_user_provided_keys(opt.comm_key.as_deref(), &opt.experimental_args)?;
let (plaintext_flags, secret_flags) = parse_flags(opt)?;
if plaintext_flags.is_set(PcfV1::NoComponentEncryption) {
warn!("The components encryption is disabled, make sure that the components do not contain any confidential content.");
}
let mut components = components(&opt.component_paths)?;
if opt.no_component_check {
warn!("The component check is turned off!");