feat(launcher): hardened reproducible TDX image build pipeline#75
Open
0xHansLee wants to merge 3 commits into
Open
feat(launcher): hardened reproducible TDX image build pipeline#750xHansLee wants to merge 3 commits into
0xHansLee wants to merge 3 commits into
Conversation
0xHansLee
requested review from
LeoHChen,
barry-peng-story,
jdubpark,
lucas2brh,
ramtinms,
stevemilk,
wo-o and
yingyangxu2026
as code owners
June 17, 2026 10:12
Wiz Scan Summary
To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension. |
|
This revision addresses several prior findings (verify-rtmr3.sh dd cap, verify-reproducible.sh missing files, swtpm service ordering). The Coverage note: the Review iteration 4 · Commit 4ea39a9 · 2026-07-15T00:51:55Z |
![jinn-agent[bot]](https://avatars.githubusercontent.com/u/26201488?s=60&v=4){kind=small}
There was a problem hiding this comment.
_Superseded by new review iteration._~~
_Superseded by new review iteration._~~
_Superseded by new review iteration._~~
_Superseded by new review iteration._~~
_Superseded by new review iteration._~~
_Superseded by new review iteration._~~
_Superseded by new review iteration._~~
_Superseded by new review iteration._
0xHansLee
force-pushed
the
feat/impl-tdx-backend
branch
from
June 20, 2026 07:12
b56583d to
b9dd9f2
Compare
0xHansLee
force-pushed
the
feat/launcher
branch
2 times, most recently
from
June 20, 2026 07:43
b84a7ab to
c0c8911
Compare
There was a problem hiding this comment.
_Superseded by new review iteration._~~
_Superseded by new review iteration._~~
_Superseded by new review iteration._~~
_Superseded by new review iteration._~~
_Superseded by new review iteration._~~
_Superseded by new review iteration._~~
_Superseded by new review iteration._
0xHansLee
force-pushed
the
feat/impl-tdx-backend
branch
from
June 20, 2026 07:53
b9dd9f2 to
4a04e5c
Compare
0xHansLee
force-pushed
the
feat/impl-tdx-backend
branch
from
June 22, 2026 01:52
4a04e5c to
63a2751
Compare
0xHansLee
force-pushed
the
feat/impl-tdx-backend
branch
from
June 22, 2026 02:08
63a2751 to
bef9a75
Compare
0xHansLee
force-pushed
the
feat/impl-tdx-backend
branch
from
June 22, 2026 02:23
bef9a75 to
89a3aa1
Compare
0xHansLee
force-pushed
the
feat/launcher
branch
2 times, most recently
from
June 22, 2026 02:31
a6b22c2 to
31198da
Compare
0xHansLee
force-pushed
the
feat/impl-tdx-backend
branch
from
June 23, 2026 10:06
89a3aa1 to
302cbf1
Compare
0xHansLee
force-pushed
the
feat/impl-tdx-backend
branch
from
June 23, 2026 10:16
302cbf1 to
a60277c
Compare
Add an mkosi-based build that produces a byte-identical, reproducible launcher image: a custom kernel, a read-only dm-verity root, Layer-3 hardening (no remote shell, locked accounts), and UKI boot. Includes the build scripts and a reproducibility guard, attestation/RTMR3 helpers, operator and auditor documentation, and build tests. Point the legacy production-image guide to the launcher docs and un-ignore launcher/build/ so the pipeline is tracked.
yingyangxu2026
approved these changes
Jun 23, 2026
Build the custom TDX kernel with CONFIG_MODULE_SIG=n (lockdown LSM disabled so it cannot re-select signing), so the kernel — and therefore platform_commitment — is reproducible byte-for-byte with no private signing key. Adds launcher/kernel/ (pinned .config + build-kernel.sh) and a CI job that builds it twice and asserts identical + keyless output. Consolidate the launcher docs around the validated GCP CVM flow: merge the GCP deployment guide into operator-guide.md, describe sealing on the GCP confidential-VM vTPM (PCR 7/11/12), and drop intermediate trial/decision narrative.
Address security-review findings on the TDX backend and launcher image.
Sealing:
- Bind each sealed DKG file to its logical slot ({round}/{codeCommitment}/
{file}) via a PathBindingSealer, so a host with write access to the data
partition cannot relocate a sealed blob to another slot or replay a stale
round's blob into the current one. Verified by unseal-time identity check.
- Make SealToFile atomic (temp file + rename) and serialize load-or-generate
key paths, so concurrent requests for the same round cannot orphan a
registered pubkey without a matching sealed private key.
Boot integrity:
- Wire dm-verity into the measured boot via mkosi.repart (root + root-verity
partitions). mkosi injects the roothash into the UKI command line, so the
rootfs is read-only and its roothash is bound into platform_commitment.
build.sh now reads that roothash and fails closed if none is produced.
Platform vTPM:
- Seal against the platform vTPM (/dev/tpmrm0) only. Drop the vestigial in-TD
swtpm service, tpm2-abrmd, and the vtpm-proxy module. measure-binary now
asserts /dev/tpmrm0.
Module lockdown:
- Disable kernel module loading after boot (kernel.modules_disabled=1) as a
keyless, reproducibility-neutral second wall behind the no-root-entry
property, and make story-kernel hard-require the lockdown unit so a failed
lockdown fails the node closed instead of booting with module loading still
enabled. Drop MODULE_FORCE_LOAD and serial SysRq from the kernel config.
Supply chain:
- Pin the kernel tarball to the GPG-verified upstream sha256 (autosigner@
kernel.org) and always rebuild the source tree from clean so the pin cannot
be bypassed by a reused workdir.
Also: fail-closed length guard + argv keccak in verify-platform.sh,
post-condition asserts in hardening/install.sh, reduced console log level,
a systemd-unit test guard for the lockdown dependency, and corrected
sealing/verity/report-data comments and docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
launcher/— the build pipeline and runtime layout that turns story-kernel into a production-grade Intel TDX validator image. The image is byte-for-byte reproducible, boots a measured, read-only root, and exposes no remote entry path, so the sealed validator keys cannot be read back even by a root user on the host.What's included
launcher/mkosi/mkosiimage definition: package set, skeleton rootfs, systemd units (kernel service, swtpm, RTMR3 extend, binary measurement), tmpfiles, post-installlauncher/build/build.sh, pinned builderDockerfile.builder, andverify-reproducible.sh(byte-identical re-build check)launcher/hardening/launcher/boot/,launcher/initrd/launcher/attestation/launcher/tests/run-all.shlauncher/docs/Also un-ignores
launcher/build/in.gitignore(it is build tooling, not build output) and points the legacyenclave/tdx/setup/production-image.mdto the launcher docs.Image properties
verify-reproducible.shasserts this.binary_commitment) and into PCR 12; key sealing is bound to that measured state.dm-verity.Build & verify
Test plan
Docs
See launcher/docs/operator-guide.md (deliver → verify → launch → register → upgrade → recover) and launcher/docs/auditor-guide.md (reproducibility procedure and commitment derivation).