packaging: coco-guest-components: add TEE_PLATFORM arg #9817
Conversation
katacontainersbot
added
size/small
huoqifeng
force-pushed
the
guest-builder
branch
2 times, most recently
from
ebc4e35
to
be84fe9
Compare
|
FYI: I was able to reach the following build step and got the artifacts successfully built: with the following changes: |
katacontainersbot
added
size/tiny
|
@BbolroC yes, the sh file is the minimal change required. |
katacontainersbot
added
size/small
huoqifeng
changed the title
Signed-off-by: Qi Feng Huo <huoqif@cn.ibm.com>
|
@fidencio may you help have a look at it? |
| @@ -39,17 +39,17 @@ docker pull ${container_image} || \ | |||
| push_to_registry "${container_image}") | |||
|
|
|||
| # Temp settings until we have a matching TEE_PLATFORM | |||
| TEE_PLATFORM="" | |||
| RESOURCE_PROVIDER="kbs,sev" | |||
| TEE_PLATFORM="${TEE_PLATFORM:-all}" | |||
There was a problem hiding this comment.
Hi @huoqifeng - when I originally wrote this I had to explicitly override the TEE_PLATFORM to blank (and instead specify the KBC_PROVIDER and ATTESTER fields) as all forced the tss to be build into for the vTPM attesters and that wasn't required, or working. I was told there were plans to create a separate TEE_PLATFORM that didn't bring on there dependencies, but I don't think that has been done (or is under ALL).
Have things changes in guest-components where we expect this to work now?
There was a problem hiding this comment.
@stevenhorsman I want bring the option TEE_PLATFORM=se when build guest components.
There was a problem hiding this comment.
Ok, could you achieve this with setting ${TEE_PLATFORM:+all} (so if it isn't set it won't be overridden. Similarly I assume you want RESOURCE_PROVIDER="${RESOURCE_PROVIDER:+kbs,sev}", so that if you set TEE_PLATFORM=se then this isn't run?
The alternative without using TEE_PLATFORM is to set RESOURCE_PROVIDER=se for secure execution?
There was a problem hiding this comment.
@stevenhorsman I was wondering if the following is what you wanted to achieve:
$ echo $SHELL
/bin/bash
$ TEE_PLATFORM=se
$ TEE_PLATFORM=${TEE_PLATFORM:+all}
$ echo $TEE_PLATFORM
all
$ unset TEE_PLATFORM
$ TEE_PLATFORM=${TEE_PLATFORM:+all}
$ echo $TEE_PLATFORM
So, ${TEE_PLATFORM:+all} wouldn't be able to achieve what @huoqifeng wants to do, I guess. If TEE_PLATFORM is set to all, we cannot build a binary due to a compilation error on s390x.
There was a problem hiding this comment.
Hmm, it looks like that operator doesn't work in the way I was expecting. Back to the drawing board I guess...
There was a problem hiding this comment.
Maybe we just set TEE_PLATFORM=${TEE_PLATFORM:-} and don't worry about the defaulting to all if unset (which clearly doesn't work anyway!)?
There was a problem hiding this comment.
Oh, I can see se-attester is not included in all-attesters: https://github.com/confidential-containers/guest-components/blob/dd2984d6c8bbb30205bbbff67cbb4c95c516224f/attestation-agent/attestation-agent/Cargo.toml#L61 So I am fine with either TEE_PLATFORM=${TEE_PLATFORM:-} or TEE_PLATFORM=${TEE_PLATFORM:-all}. 😉
@huoqifeng I think https://github.com/confidential-containers/guest-components/blob/dd2984d6c8bbb30205bbbff67cbb4c95c516224f/README.md?plain=1#L38 should be updated to reflect the current Cargo.toml for AA.
There was a problem hiding this comment.
Yes, let me open a PR to do this -- there is a problem to build some other attesters on s390x although it should ne OK to build IBM SE attester on x86. I think build all attester on x86 is our case.
There was a problem hiding this comment.
export TEE_PLATFORM="xx" did not take effect