chore: uki code restructure

UKI code re-structure, no-op.

Signed-off-by: Noel Georgi <git@frezbo.dev>

Author: frezbo

hack/release.toml

@@ -73,6 +73,7 @@ cluster:
 ```
 
 Usage of `authorization-mode` CLI argument will not support this form of customization.
+"""
 
 [make_deps]
 

internal/app/init/main.go

@@ -60,8 +60,8 @@ func run() error {
 	}
 
 	// extend PCR 11 with enter-initrd
-	if err := tpm2.PCRExtend(secureboot.UKIPCR, []byte(secureboot.EnterInitrd)); err != nil {
-		return fmt.Errorf("failed to extend PCR %d with enter-initrd: %v", secureboot.UKIPCR, err)
+	if err := tpm2.PCRExtend(constants.UKIPCR, []byte(secureboot.EnterInitrd)); err != nil {
+		return fmt.Errorf("failed to extend PCR %d with enter-initrd: %v", constants.UKIPCR, err)
 	}
 
 	log.Printf("booting Talos %s", version.Tag)

internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_sequencer_tasks.go

@@ -328,7 +328,7 @@ func WriteUdevRules(runtime.Sequence, any) (runtime.TaskExecutionFunc, string) {
 // StartMachined represents the task to start machined.
 func StartMachined(_ runtime.Sequence, _ any) (runtime.TaskExecutionFunc, string) {
 	return func(ctx context.Context, logger *log.Logger, r runtime.Runtime) error {
-		if err := tpm2.PCRExtend(secureboot.UKIPCR, []byte(secureboot.EnterMachined)); err != nil {
+		if err := tpm2.PCRExtend(constants.UKIPCR, []byte(secureboot.EnterMachined)); err != nil {
 			return err
 		}
 
@@ -423,7 +423,7 @@ func StartUdevd(runtime.Sequence, any) (runtime.TaskExecutionFunc, string) {
 // ExtendPCRStartAll represents the task to extend the PCR with the StartTheWorld PCR phase.
 func ExtendPCRStartAll(runtime.Sequence, any) (runtime.TaskExecutionFunc, string) {
 	return func(ctx context.Context, logger *log.Logger, r runtime.Runtime) (err error) {
-		return tpm2.PCRExtend(secureboot.UKIPCR, []byte(secureboot.StartTheWorld))
+		return tpm2.PCRExtend(constants.UKIPCR, []byte(secureboot.StartTheWorld))
 	}, "extendPCRStartAll"
 }
 

internal/pkg/encryption/keys/tpm2.go

@@ -16,8 +16,8 @@ import (
 	"github.com/siderolabs/go-blockdevice/v2/encryption/luks"
 	"github.com/siderolabs/go-blockdevice/v2/encryption/token"
 
-	"github.com/siderolabs/talos/internal/pkg/secureboot"
 	"github.com/siderolabs/talos/internal/pkg/secureboot/tpm2"
+	"github.com/siderolabs/talos/pkg/machinery/constants"
 )
 
 // TPMToken is the userdata stored in the partition token metadata.
@@ -74,7 +74,7 @@ func (h *TPMKeyHandler) NewKey(ctx context.Context) (*encryption.Key, token.Toke
 			KeySlots:          []int{h.slot},
 			SealedBlobPrivate: resp.SealedBlobPrivate,
 			SealedBlobPublic:  resp.SealedBlobPublic,
-			PCRs:              []int{secureboot.UKIPCR},
+			PCRs:              []int{constants.UKIPCR},
 			Alg:               "sha256",
 			PolicyHash:        resp.PolicyDigest,
 			KeyName:           resp.KeyName,

…reboot/measure/internal/pcr/bank_data.go …al/pkg/measure/internal/pcr/bank_data.gointernal/pkg/secureboot/measure/internal/pcr/bank_data.go renamed to internal/pkg/measure/internal/pcr/bank_data.go internal/pkg/secureboot/measure/internal/pcr/bank_data.go renamed to internal/pkg/measure/internal/pcr/bank_data.go

@@ -17,6 +17,7 @@ import (
 
 	"github.com/siderolabs/talos/internal/pkg/secureboot"
 	tpm2internal "github.com/siderolabs/talos/internal/pkg/secureboot/tpm2"
+	"github.com/siderolabs/talos/pkg/machinery/constants"
 )
 
 // RSAKey is the input for the CalculateBankData function.
@@ -30,7 +31,7 @@ type RSAKey interface {
 // This mimics the process happening happening in the TPM when the UKI is being loaded.
 //
 //nolint:gocyclo
-func CalculateBankData(pcrNumber int, alg tpm2.TPMAlgID, sectionData map[secureboot.Section]string, rsaKey RSAKey) ([]tpm2internal.BankData, error) {
+func CalculateBankData(pcrNumber int, alg tpm2.TPMAlgID, sectionData map[string]string, rsaKey RSAKey) ([]tpm2internal.BankData, error) {
 	// get fingerprint of public key
 	pubKeyFingerprint := sha256.Sum256(x509.MarshalPKCS1PublicKey(rsaKey.PublicRSAKey()))
 
@@ -39,7 +40,7 @@ func CalculateBankData(pcrNumber int, alg tpm2.TPMAlgID, sectionData map[secureb
 		return nil, err
 	}
 
-	pcrSelector, err := tpm2internal.CreateSelector([]int{secureboot.UKIPCR})
+	pcrSelector, err := tpm2internal.CreateSelector([]int{constants.UKIPCR})
 	if err != nil {
 		return nil, fmt.Errorf("failed to create PCR selection: %v", err)
 	}
@@ -55,7 +56,7 @@ func CalculateBankData(pcrNumber int, alg tpm2.TPMAlgID, sectionData map[secureb
 
 	hashData := NewDigest(hashAlg)
 
-	for _, section := range secureboot.OrderedSections() {
+	for _, section := range OrderedSections() {
 		if file := sectionData[section]; file != "" {
 			hashData.Extend(append([]byte(section), 0))
 

…t/measure/internal/pcr/bank_data_test.go …g/measure/internal/pcr/bank_data_test.gointernal/pkg/secureboot/measure/internal/pcr/bank_data_test.go renamed to internal/pkg/measure/internal/pcr/bank_data_test.go internal/pkg/secureboot/measure/internal/pcr/bank_data_test.go renamed to internal/pkg/measure/internal/pcr/bank_data_test.go

@@ -14,8 +14,7 @@ import (
 	"github.com/google/go-tpm/tpm2"
 	"github.com/stretchr/testify/require"
 
-	"github.com/siderolabs/talos/internal/pkg/secureboot"
-	"github.com/siderolabs/talos/internal/pkg/secureboot/measure/internal/pcr"
+	"github.com/siderolabs/talos/internal/pkg/measure/internal/pcr"
 	tpm2internal "github.com/siderolabs/talos/internal/pkg/secureboot/tpm2"
 )
 
@@ -40,10 +39,10 @@ func TestCalculateBankData(t *testing.T) {
 	require.NoError(t, err)
 
 	bankData, err := pcr.CalculateBankData(15, tpm2.TPMAlgSHA256,
-		map[secureboot.Section]string{
-			secureboot.Initrd: "testdata/a",
-			secureboot.Linux:  "testdata/b",
-			secureboot.DTB:    "testdata/c",
+		map[string]string{
+			".initrd": "testdata/a",
+			".linux":  "testdata/b",
+			".dtb":    "testdata/c",
 		},
 		keyWrapper{key})
 	require.NoError(t, err)

…ecureboot/measure/internal/pcr/extend.go …ernal/pkg/measure/internal/pcr/extend.gointernal/pkg/secureboot/measure/internal/pcr/extend.go renamed to internal/pkg/measure/internal/pcr/extend.go internal/pkg/secureboot/measure/internal/pcr/extend.go renamed to internal/pkg/measure/internal/pcr/extend.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"github.com/siderolabs/talos/internal/pkg/secureboot/measure/internal/pcr"
+	"github.com/siderolabs/talos/internal/pkg/measure/internal/pcr"
 )
 
 func TestExtend(t *testing.T) {

…boot/measure/internal/pcr/extend_test.go …/pkg/measure/internal/pcr/extend_test.gointernal/pkg/secureboot/measure/internal/pcr/extend_test.go renamed to internal/pkg/measure/internal/pcr/extend_test.go internal/pkg/secureboot/measure/internal/pcr/extend_test.go renamed to internal/pkg/measure/internal/pcr/extend_test.go

@@ -0,0 +1,28 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package pcr
+
+// OrderedSections returns the sections that are measured into PCR.
+//
+// Derived from https://github.com/systemd/systemd/blob/v257.1/src/fundamental/uki.h#L6
+// .pcrsig section is omitted here since that's what we are calulating here.
+func OrderedSections() []string {
+	// DO NOT REARRANGE
+	return []string{
+		".linux",
+		".osrel",
+		".cmdline",
+		".initrd",
+		".ucode",
+		".splash",
+		".dtb",
+		".uname",
+		".sbat",
+		".pcrpkey",
+		".profile",
+		".dtbauto",
+		".hwids",
+	}
+}