Initial text for the SCS chapter by alextserepov · Pull Request #1 · tiiuae/ghaf

alextserepov · 2022-12-09T10:16:41Z

Signed-off-by: Aleksandr Tserepov-Savolainen alextserepov@gmail.com

Signed-off-by: Aleksandr Tserepov-Savolainen <alextserepov@gmail.com>

jenninikko · 2022-12-09T10:53:11Z

src/scs/scs.md

@@ -1,3 +1,7 @@
 # SCS


Let's make the full name here.

Agree. Better always open acronyms on topic level.

vilvo · 2022-12-09T10:56:23Z

src/scs/scs.md


+Supply Chain Security is a process of securitng the machinery of the development, build and release environment, in other words, securing every component that a software artifact might be touching on its way from the developer towards the consumer. The software artifact should be encrypted on each possilbe transition phase and the integrity of it should be verified at each destination.

+The SBOM (Software Bill Of Materials) containing reference to each dependency, its source and version togerher with provenance, containing build information are collected at the build time, signed and used for vulnerability analysis during the next steps. The SBOM is also published together with the final image, thus making further analysis of the software possible by the end customer.


Can agree on introducing acronyms this way instead?
Software Bill of Materials (SBOM)
If yes, I'll also align all text that way.

vilvo · 2022-12-09T10:57:07Z

src/scs/scs.md

@@ -1,3 +1,7 @@
 # SCS

+Supply Chain Security is a process of securitng the machinery of the development, build and release environment, in other words, securing every component that a software artifact might be touching on its way from the developer towards the consumer. The software artifact should be encrypted on each possilbe transition phase and the integrity of it should be verified at each destination.


And here, Supply Chain Security (SCS).
After that, you can use SCS to your heart's extent :-)

I will add this information to our Style Guide.

vilvo · 2022-12-09T10:58:06Z

src/scs/scs.md


+The SBOM (Software Bill Of Materials) containing reference to each dependency, its source and version togerher with provenance, containing build information are collected at the build time, signed and used for vulnerability analysis during the next steps. The SBOM is also published together with the final image, thus making further analysis of the software possible by the end customer.
+
+The software artifact, SBOM and provenance are signed by the build machinery at the build time and the signature is verifiable at every destination of the package. The certificates that are used for signing and verification are provided by the PKI system and are signed by the same root CA, thus making it possible to easily confirm the signature author (build machinery) and guarantee that the package has not been tampered with since the build time.


Public-Key Infrastructure (PKI).
Certfiicate Authority (CA)

vilvo

Please address the comments on the first introduction of acronyms. At least on topic.

jenninikko · 2022-12-09T11:05:43Z

src/scs/scs.md

@@ -1,3 +1,7 @@
 # SCS

+Supply Chain Security is a process of securitng the machinery of the development, build and release environment, in other words, securing every component that a software artifact might be touching on its way from the developer towards the consumer. The software artifact should be encrypted on each possilbe transition phase and the integrity of it should be verified at each destination.


The first sentence is too long. Let's do the following:

Let's end the first sentence with the words "release environment". Also, please change it to the following: Supply Chain Security (SCS) is a process of securing the machinery of the development, building and release environment.

The next sentence should be something like this: That means every component that a software artifact might be touching on its way from the developer to the consumer will be secured.

jenninikko · 2022-12-09T11:08:25Z

src/scs/scs.md

@@ -1,3 +1,7 @@
 # SCS

+Supply Chain Security is a process of securitng the machinery of the development, build and release environment, in other words, securing every component that a software artifact might be touching on its way from the developer towards the consumer. The software artifact should be encrypted on each possilbe transition phase and the integrity of it should be verified at each destination.


In the last sentence:

Misspelling: possilbe -> possible

... and its integrity should be verified at each destination.

jenninikko · 2022-12-09T11:23:23Z

src/scs/scs.md


+Supply Chain Security is a process of securitng the machinery of the development, build and release environment, in other words, securing every component that a software artifact might be touching on its way from the developer towards the consumer. The software artifact should be encrypted on each possilbe transition phase and the integrity of it should be verified at each destination.

+The SBOM (Software Bill Of Materials) containing reference to each dependency, its source and version togerher with provenance, containing build information are collected at the build time, signed and used for vulnerability analysis during the next steps. The SBOM is also published together with the final image, thus making further analysis of the software possible by the end customer.


In the first paragraph, you tell about the SCS for the first time. Now we know what is it. How did you go from SCS to SBOM? What is the connection?

Misspelling: togerher -> together

will try to come up with a couple of sentences to connect those 2.

jenninikko · 2022-12-09T11:28:34Z

src/scs/scs.md


+The SBOM (Software Bill Of Materials) containing reference to each dependency, its source and version togerher with provenance, containing build information are collected at the build time, signed and used for vulnerability analysis during the next steps. The SBOM is also published together with the final image, thus making further analysis of the software possible by the end customer.
+
+The software artifact, SBOM and provenance are signed by the build machinery at the build time and the signature is verifiable at every destination of the package. The certificates that are used for signing and verification are provided by the PKI system and are signed by the same root CA, thus making it possible to easily confirm the signature author (build machinery) and guarantee that the package has not been tampered with since the build time.


What is the connection with the previous paragraphs?
Are SBOM and software artifacts parts of the process?

Signed-off-by: Aleksandr Tserepov-Savolainen <alextserepov@gmail.com>

jenninikko

Thank you! Let's add the first version and see how it goes.

Signed-off-by: Aleksandr Tserepov-Savolainen <alextserepov@gmail.com>

virt: updated bpmp-virt to kernel 6.6

Add XDG_DATA_DIRS and LIBGL_ALWAYS_SOFTWARE to wrapper env

Some WiFi drivers require at least 1GB of memory to function properly. The default is updated to improve compatibility while still allowing overrides via vmConfig. Resolves the kernel crashes outlined below that are related to memory: awk: page allocation failure: order:4, mode:0x40820(GFP_ATOMIC|__GFP_COMP), nodemask=(null),cpuset=msFetchUrl.service,mems_allowed=0 CPU: 1 UID: 994 PID: 918 Comm: awk Not tainted 6.18.8 tiiuae#1-NixOS PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 warn_alloc+0x163/0x190 ? wakeup_kswapd+0xa3/0x1d0 __alloc_frozen_pages_noprof+0xc47/0x10f0 ? get_page_from_freelist+0x1a06/0x1c20 alloc_pages_mpol+0x86/0x170 ? virtio_fs_enqueue_req+0x214/0x600 [virtiofs] ___kmalloc_large_node+0x99/0xb0 __kmalloc_large_node_noprof+0x1d/0xb0 __kmalloc_noprof+0x4dd/0x700 ? __alloc_frozen_pages_noprof+0x478/0x10f0 ? virtio_fs_enqueue_req+0x214/0x600 [virtiofs] virtio_fs_enqueue_req+0x214/0x600 [virtiofs] virtio_fs_send_req+0x51/0x110 [virtiofs] __fuse_simple_request+0x118/0x310 [fuse] fuse_readdir_uncached+0x16f/0x8c0 [fuse] ? virtqueue_add_sgs+0xb5/0xd0 [virtio_ring] ? vp_notify+0x16/0x20 [virtio_pci] ? virtqueue_notify+0x1f/0x40 [virtio_ring] ? virtio_fs_enqueue_req+0x50c/0x600 [virtiofs] iterate_dir+0xaa/0x270 ovl_iterate+0x168/0x3a0 [overlay] ? __pfx_ovl_iterate+0x10/0x10 [overlay] wrap_directory_iterator+0x4b/0x70 iterate_dir+0xaa/0x270 __x64_sys_getdents64+0x7b/0x110 ? __pfx_filldir64+0x10/0x10 do_syscall_64+0xb6/0x7e0 ? exc_page_fault+0x6a/0x150 Signed-off-by: Vunny Sodhi <vunny.sodhi@unikie.com>

Some WiFi drivers require at least 1GB of memory to function properly. The default is updated to improve compatibility while still allowing overrides via vmConfig. Resolves the kernel crashes outlined below that are related to memory: awk: page allocation failure: order:4, mode:0x40820(GFP_ATOMIC|__GFP_COMP), nodemask=(null),cpuset=msFetchUrl.service,mems_allowed=0 CPU: 1 UID: 994 PID: 918 Comm: awk Not tainted 6.18.8 #1-NixOS PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 warn_alloc+0x163/0x190 ? wakeup_kswapd+0xa3/0x1d0 __alloc_frozen_pages_noprof+0xc47/0x10f0 ? get_page_from_freelist+0x1a06/0x1c20 alloc_pages_mpol+0x86/0x170 ? virtio_fs_enqueue_req+0x214/0x600 [virtiofs] ___kmalloc_large_node+0x99/0xb0 __kmalloc_large_node_noprof+0x1d/0xb0 __kmalloc_noprof+0x4dd/0x700 ? __alloc_frozen_pages_noprof+0x478/0x10f0 ? virtio_fs_enqueue_req+0x214/0x600 [virtiofs] virtio_fs_enqueue_req+0x214/0x600 [virtiofs] virtio_fs_send_req+0x51/0x110 [virtiofs] __fuse_simple_request+0x118/0x310 [fuse] fuse_readdir_uncached+0x16f/0x8c0 [fuse] ? virtqueue_add_sgs+0xb5/0xd0 [virtio_ring] ? vp_notify+0x16/0x20 [virtio_pci] ? virtqueue_notify+0x1f/0x40 [virtio_ring] ? virtio_fs_enqueue_req+0x50c/0x600 [virtiofs] iterate_dir+0xaa/0x270 ovl_iterate+0x168/0x3a0 [overlay] ? __pfx_ovl_iterate+0x10/0x10 [overlay] wrap_directory_iterator+0x4b/0x70 iterate_dir+0xaa/0x270 __x64_sys_getdents64+0x7b/0x110 ? __pfx_filldir64+0x10/0x10 do_syscall_64+0xb6/0x7e0 ? exc_page_fault+0x6a/0x150 Signed-off-by: Vunny Sodhi <vunny.sodhi@unikie.com>

Add a Unified Kernel Image (UKI) option for the SD card image ESP. When ghaf.image.sdcard.uki.enable is set, the ESP is populated with a single UKI binary instead of the traditional Type tiiuae#1 BLS entries produced by mk-esp-contents.py. The UKI bundles kernel, initrd, cmdline, DTB, and os-release into a PE/COFF binary that systemd-boot discovers automatically from EFI/Linux/. This is a prerequisite for secure boot, which can authenticate all bundled components as a single signed image. Signed-off-by: Theodore Karatapanis <tkaratapanis@census-labs.com>

Add a Unified Kernel Image (UKI) option for the SD card image ESP. When ghaf.image.sdcard.uki.enable is set, the ESP is populated with a single UKI binary instead of the traditional Type tiiuae#1 BLS entries produced by mk-esp-contents.py with separate kernel, initrd and DTB binaries. The UKI (Type tiiuae#2 BLS entry) bundles kernel, initrd, cmdline, DTB, and os-release into a single binary that systemd-boot discovers automatically from EFI/Linux/. Signed-off-by: Theodore Karatapanis <tkaratapanis@census-labs.com>

Add a Unified Kernel Image (UKI) option for the SD card image ESP. When ghaf.image.sdcard.uki.enable is set, the ESP is populated with a single UKI binary instead of the traditional Type tiiuae#1 BLS entry produced by mk-esp-contents.py with separate kernel, initrd and DTB binaries. The UKI (Type tiiuae#2 BLS entry) bundles kernel, initrd, cmdline, DTB, and os-release into a single binary that systemd-boot discovers automatically from EFI/Linux/. Signed-off-by: Theodore Karatapanis <tkaratapanis@census-labs.com>

Initial text for the SCS chapter

ff2381f

Signed-off-by: Aleksandr Tserepov-Savolainen <alextserepov@gmail.com>

alextserepov requested review from jenninikko and vilvo December 9, 2022 10:16

jenninikko reviewed Dec 9, 2022

View reviewed changes

vilvo reviewed Dec 9, 2022

View reviewed changes

vilvo suggested changes Dec 9, 2022

View reviewed changes

jenninikko reviewed Dec 9, 2022

View reviewed changes

Fixing comments, trying to connect paragraphs together.

3f89e3e

Signed-off-by: Aleksandr Tserepov-Savolainen <alextserepov@gmail.com>

vilvo approved these changes Dec 12, 2022

View reviewed changes

Fixing typos

fc2858d

Signed-off-by: Aleksandr Tserepov-Savolainen <alextserepov@gmail.com>

jenninikko approved these changes Dec 13, 2022

View reviewed changes

jenninikko merged commit 3b92b2f into main Dec 13, 2022

alextserepov pushed a commit that referenced this pull request Dec 21, 2022

Fixing comments #1

ef84336

Signed-off-by: Aleksandr Tserepov-Savolainen <alextserepov@gmail.com>

jenninikko deleted the feature/scs_intro branch December 29, 2022 11:47

jenninikko added the documentation Improvements or additions to documentation label Jan 9, 2023

jpruiz84 pushed a commit to jpruiz84/ghaf that referenced this pull request Jan 23, 2025

Merge pull request tiiuae#1 from jpruiz84/tii-jetpack-jp36-virt-on

c25f28c

virt: updated bpmp-virt to kernel 6.6

enesoztrk pushed a commit to enesoztrk/ghaf that referenced this pull request Mar 26, 2025

Merge pull request tiiuae#1 from riskuuse/various-fixes

3f4133e

Add XDG_DATA_DIRS and LIBGL_ALWAYS_SOFTWARE to wrapper env

kajusnau mentioned this pull request Aug 12, 2025

feat(cosmic): propagate locale changes #1264

Merged

18 tasks

emrahbillur mentioned this pull request Mar 4, 2026

NVidia AGX: 2 stage initrd install #1787

Open

19 tasks

tkaratapanis mentioned this pull request Mar 24, 2026

jetson: Add support for UKI image generation #1852

Open

19 tasks


		Supply Chain Security is a process of securitng the machinery of the development, build and release environment, in other words, securing every component that a software artifact might be touching on its way from the developer towards the consumer. The software artifact should be encrypted on each possilbe transition phase and the integrity of it should be verified at each destination.

		The SBOM (Software Bill Of Materials) containing reference to each dependency, its source and version togerher with provenance, containing build information are collected at the build time, signed and used for vulnerability analysis during the next steps. The SBOM is also published together with the final image, thus making further analysis of the software possible by the end customer.

		@@ -1,3 +1,7 @@
		# SCS

		Supply Chain Security is a process of securitng the machinery of the development, build and release environment, in other words, securing every component that a software artifact might be touching on its way from the developer towards the consumer. The software artifact should be encrypted on each possilbe transition phase and the integrity of it should be verified at each destination.


		The SBOM (Software Bill Of Materials) containing reference to each dependency, its source and version togerher with provenance, containing build information are collected at the build time, signed and used for vulnerability analysis during the next steps. The SBOM is also published together with the final image, thus making further analysis of the software possible by the end customer.

		The software artifact, SBOM and provenance are signed by the build machinery at the build time and the signature is verifiable at every destination of the package. The certificates that are used for signing and verification are provided by the PKI system and are signed by the same root CA, thus making it possible to easily confirm the signature author (build machinery) and guarantee that the package has not been tampered with since the build time.

Conversation

alextserepov commented Dec 9, 2022

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vilvo Dec 9, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vilvo left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jenninikko left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

vilvo Dec 9, 2022 •

edited

Loading