[reconfigurator] RoT planner support #8421

karencfv · 2025-06-23T07:12:43Z

This commit implements support for RoT updates in the planner and support for reconfigurator-cli updates as well.

TODO:

sign verification to know how to choose artifacts
more tests

dev-tools/reconfigurator-cli/tests/output/target-release-stdout

karencfv · 2025-06-26T08:38:04Z

@davepacheco just as an FYI this is what I have for the RoT planner support so far. It's not finished yet, but the main bulk of it is done. I just need to refine some bits and add more tests. A big chunk of the lines of code are generated test files btw.

karencfv · 2025-06-27T04:40:02Z

I'm not sure how soon we're planning to demo this as part of the update bring-up. As you all know, I'll be out next week. So, if you'd like to use this as part of the demo soon, please feel free to modify/merge/close/superseed this PR as you all see fit, if this is something you'd like to do to speed up things 😄

karencfv · 2025-07-07T08:05:58Z

dev-tools/reconfigurator-cli/tests/input/target-release.txt

#8478 may change the way this test works if implemented before I merge this PR

karencfv · 2025-07-07T08:18:17Z

Heya! 👋 Just a tiny ping that this is ready to review :)

davepacheco

Nice! This is looking good but there are a few details to nail down.

dev-tools/reconfigurator-cli/src/lib.rs

dev-tools/reconfigurator-cli/tests/output/target-release-stdout

nexus/reconfigurator/planning/src/planner.rs

davepacheco · 2025-07-08T03:56:43Z

nexus/reconfigurator/planning/src/mgs_updates/mod.rs

+            let found_active_version =
+                ArtifactVersion::new(active_caboose.caboose.version.clone())
+                    .map_err(|e| {
+                        MgsUpdateStatusError::FailedArtifactVersionParse(e)
+                    })?;


This isn't very important but it looks like for the SP case we just operated on strings without assuming we could parse them. Do we need to parse the RoT versions?

Just to populate ExpectedActiveRotSlot. I thought it'd be cleaner to use the same type as
expected_active_slot since it is a struct containing two fields rather than just a version or a slot.

Don't have a super strong opinion about this though. Happy to change if you think what I did doesn't make sense

nexus/reconfigurator/planning/src/mgs_updates/mod.rs

davepacheco · 2025-07-08T04:03:00Z

nexus/reconfigurator/planning/src/mgs_updates/mod.rs

+            // - "name" matching the board name (found above from caboose)
+            // - "kind" matching one of the known RoT kinds


For the RoT, don't we need to check that it's signed with the same key (SIGN in caboose matches something in the metadata)?

I think the corresponding Wicket code path uses a common verify function to do this (sorry, I don't have the reference handy at the moment). I wonder if we need to be using the same thing. (I wouldn't say we necessarily do. We already duplicate some of the Wicket behavior because the shape of the code is different. But we should at least make sure it covers the same logic, and if it's non-trivial, think about commonizing it.)

Ah, aha! I took a look at the code and I think you mean I need to verify the CMPA/CFPA pages?

omicron/wicketd/src/update_tracker.rs

Lines 2027 to 2036 in b7b24d5

/// Via `client`, ask the target RoT for its CMPA/CFPA pages, then loop

/// through our `available_artifacts` to find one that verifies.

///

/// For backwards compatibility with RoTs that do not know how to return

/// their CMPA/CFPA pages, if we fail to fetch them _and_

/// `available_artifacts` has exactly one item, we will return that one

/// item.

///

/// This is also applicable to the RoT bootloader which follows the

/// same vaildation method

I couldn't really find anything about checking SIGN. Unless I'm looking in the wrong place?

To do this I'll need to make API calls directly to MGS, this isn't done in the planner yet. I'm assuming it's OK to do so.

To do this I'll need to make API calls directly to MGS, this isn't done in the planner yet. I'm assuming it's OK to do so.

I think we should strongly prefer not doing so; the planner currently operates as essentially a pure function of its inputs, and it'd be very nice to not lose that. I think in this case, the latest inventory may already have what you need: inventory collections include CMPA/CFPA pages. If we need more than that from MGS, can we add it to inventory instead of making the planner ask directly?

I think the verification against CMPA/CFPA is achieving the same thing as the signature check I was thinking of. Agreed with John here -- we should already have this in inventory and if we don't then we should add it.

Got it! I almost went in an unnecessary rabbit hole there 😅

I took a look at both options:

Verifying the CMPA/CFPA the same way wicket does would be kind of complicated because, we're only using the Tuf repo metadata here, so I can't really create a RawHubrisArchive to verify against without massively changing the way we handle artifacts.

I would love to use the option of making sure SIGN in caboose matches something in the metadata. But I don't really know what to match it against lol. There's only the artifact's hash in the metadata, but that won't be the same. Am I missing something really obvious here?

I would love to use the option of making sure SIGN in caboose matches something in the metadata. But I don't really know what to match it against lol. There's only the artifact's hash in the metadata, but that won't be the same. Am I missing something really obvious here?

I doubt there is a straightforward way to verify the signature in Omicron. It's not a comparison. You'd need to hash the image and then verify it given some RSA public key. Personally, I wouldn't worry about it right now.

We chatted about this in the update watercooler. We don't want to pass the entire artifacts to the planner and came up with a couple of possible paths forward:

The planner could give a list of all the possible artifacts to the executor, and the executor verifies the artifacts the same way wicket does today.

We somehow extract this information from an artifact before, and include it as part of the TUF metadata.

I'll catch up with @plotnick next week to take a swing at option 2 which is much nicer.

nexus/reconfigurator/planning/src/mgs_updates/mod.rs

davepacheco · 2025-07-08T04:06:05Z

nexus/reconfigurator/planning/src/mgs_updates/mod.rs

+        artifact_version: artifact.id.version.clone(),
+    })
+}
+
 #[cfg(test)]
 mod test {


I think we could augment a lot of the unit tests here and add new ones to cover the new RoT logic.

karencfv added 3 commits June 23, 2025 19:11

[reconfigurator] CLI support for setting RoT versions

f2e8de3

expectorate

fd098df

planner support for configuring RoT update

799b169

karencfv changed the title ~~[reconfigurator] CLI support for setting RoT versions~~ [reconfigurator] RoT planner support Jun 25, 2025

set update hierarchy and clean up

914d4d5

karencfv commented Jun 25, 2025

View reviewed changes

dev-tools/reconfigurator-cli/tests/output/target-release-stdout Outdated Show resolved Hide resolved

karencfv added 4 commits June 25, 2025 21:25

Remove unnecessary todo

3c7cc8b

Merge main

13c7934

Add additional checks

d9ca092

clean up

7f8904e

karencfv added 4 commits June 27, 2025 15:13

Remove additional arguments

6bee79f

Add information to sled-show command

6e0f444

clean up

4827e16

clean up

e045766

karencfv marked this pull request as ready for review June 27, 2025 04:34

karencfv requested review from davepacheco, plotnick and jgallagher June 27, 2025 04:34

davepacheco assigned karencfv Jul 1, 2025

karencfv commented Jul 7, 2025

View reviewed changes

davepacheco reviewed Jul 8, 2025

View reviewed changes

davepacheco modified the milestones: 15, 16 Jul 8, 2025

karencfv added 3 commits July 9, 2025 13:50

merge main

3c4fe9f

fixes after merge

f515fb7

address style comments

c44d9bf

karencfv added 15 commits July 9, 2025 18:31

fix target-release test

031a18f

Address comments

642fa92

address comments

0434297

fmt

599589f

working test_basic

1ab8622

Adapt sequential test

88702d0

get all the tests passing

ce03cca

get all the tests passing

4f3b735

clean up

413ade6

clean up

6899baa

clippy and fmt

4013357

Merge main

e6c655d

expectorate

4abbd8e

why did I change this in the first place?

91fea61

add some more tests

370bceb

karencfv mentioned this pull request Jul 17, 2025

Planner to verify the RoT artifacts and choose correct one for environment #8630

Open

3 tasks

plotnick mentioned this pull request Jul 17, 2025

Planning reports #8631

Draft

5 tasks

		// - "name" matching the board name (found above from caboose)
		// - "kind" matching one of the known RoT kinds

	/// Via `client`, ask the target RoT for its CMPA/CFPA pages, then loop
	/// through our `available_artifacts` to find one that verifies.
	///
	/// For backwards compatibility with RoTs that do not know how to return
	/// their CMPA/CFPA pages, if we fail to fetch them _and_
	/// `available_artifacts` has exactly one item, we will return that one
	/// item.
	///
	/// This is also applicable to the RoT bootloader which follows the
	/// same vaildation method

[reconfigurator] RoT planner support #8421

Are you sure you want to change the base?

[reconfigurator] RoT planner support #8421

Conversation

karencfv commented Jun 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

karencfv commented Jun 26, 2025

Uh oh!

karencfv commented Jun 27, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

karencfv commented Jul 7, 2025

Uh oh!

davepacheco left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jgallagher Jul 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andrewjstone Jul 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

karencfv Jul 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

karencfv commented Jun 23, 2025 •

edited

Loading

jgallagher Jul 9, 2025 •

edited

Loading

andrewjstone Jul 10, 2025 •

edited

Loading

karencfv Jul 10, 2025 •

edited

Loading