feat(eif): resign guest EIFs during host image repack

Extend img2img so that when a host variant embeds guest EIFs (declared
under `[package.metadata.build-variant.guest-images]`), the repack walks
each guest's install path and re-signs every `*.eif` in place via
`eif-builder resign`. The kernel, cmdline, ramdisk, and metadata sections
are byte-preserved; only the SIGNATURE section (and header CRC) are
rewritten. Uses the same [eif] signing profile as the host build.

Adds an end-to-end integration test that builds a host variant embedding
a guest EIF and verifies every guest EIF under the resulting output has
been resigned with the expected certificate.

Author: jmt-lab

Cargo.lock

@@ -23,3 +23,4 @@ toml.workspace = true
 twoliter = { workspace = true }
 advisory-checker = { workspace = true }
 which.workspace = true
+walkdir.workspace = true

tests/integration-tests/Cargo.toml

@@ -138,3 +138,205 @@ async fn test_twoliter_repack_variant() {
         String::from_utf8_lossy(&output.stderr)
     );
 }
+
+/// Repack an EIF-format variant end-to-end. Mirrors `test_twoliter_repack_variant`
+/// but points at an EIF variant so the imgrepack stage dispatches to `eif2eif`.
+///
+/// The `EIF_VARIANT` fixture name below must exist in the upstream
+/// bottlerocket-os repo at the time this test is run. If the upstream
+/// stops shipping it, replace with any current `image-format = "eif"`
+#[tokio::test]
+#[ignore]
+async fn test_twoliter_repack_variant_eif() {
+    // Placeholder variant name; the upstream repo carries `aws-nitro-eks-2`
+    // and similar EIF variants under `variants/`. Any variant whose
+    // `image-format = "eif"` will exercise the same path.
+    const EIF_VARIANT: &str = "aws-nitro-eks-2";
+
+    let bob_src = create_test_project().await;
+    let project_path = bob_src.path().join("Twoliter.toml");
+    let arch = "x86_64";
+
+    let output = run_command(
+        TWOLITER_PATH,
+        ["update", "--project-path", project_path.to_str().unwrap()],
+        [],
+    );
+    assert!(output.status.success(), "twoliter update failed");
+
+    let output = run_command(
+        TWOLITER_PATH,
+        [
+            "fetch",
+            "--project-path",
+            project_path.to_str().unwrap(),
+            "--arch",
+            arch,
+        ],
+        [],
+    );
+    assert!(output.status.success(), "twoliter fetch failed");
+
+    let output = twoliter_make(bob_src.path(), "build-variant", EIF_VARIANT, arch);
+    assert!(
+        output.status.success(),
+        "twoliter make build-variant (eif) failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    let output = twoliter_make(bob_src.path(), "repack-variant", EIF_VARIANT, arch);
+    assert!(
+        output.status.success(),
+        "twoliter make repack-variant (eif) failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    let out_dir = bob_src
+        .path()
+        .join("build")
+        .join("images")
+        .join(format!("{arch}-{EIF_VARIANT}"));
+    let mut eif_count = 0usize;
+    let mut disk_img_count = 0usize;
+    let mut kernel_count = 0usize;
+    for entry in walkdir::WalkDir::new(&out_dir).into_iter().flatten() {
+        if !entry.file_type().is_file() {
+            continue;
+        }
+        let name = entry.file_name().to_string_lossy();
+        if name.ends_with(".eif") {
+            eif_count += 1;
+        } else if name.ends_with("-disk.img") {
+            disk_img_count += 1;
+        } else if name.ends_with("-kernel") {
+            kernel_count += 1;
+        }
+    }
+    assert!(eif_count >= 1, "no .eif file under {}", out_dir.display());
+    assert!(
+        disk_img_count >= 1,
+        "no -disk.img under {}",
+        out_dir.display()
+    );
+    assert!(kernel_count >= 1, "no -kernel under {}", out_dir.display());
+}
+
+/// Repack a host variant that embeds a guest EIF, and assert the guest EIF's
+/// signature section changed (bytewise) while the guest kernel bytes did not.
+///
+/// This exercises the `img2img --guest-images=...` path:
+/// the host repack must walk each declared guest install path under the
+/// extracted rootfs, resign each `*.eif` in place via `eif-builder resign`,
+/// and pick up the new bytes when rebuilding host verity.
+#[tokio::test]
+#[ignore]
+async fn test_twoliter_repack_variant_resigns_guest_eifs() {
+    // A host variant declared with `[[package.metadata.build-variant.guest-images]]`
+    // pointing at an EIF guest.
+    const HOST_VARIANT: &str = "aws-k8s-1.31-nvidia";
+
+    let bob_src = create_test_project().await;
+    let project_path = bob_src.path().join("Twoliter.toml");
+    let arch = "x86_64";
+
+    let output = run_command(
+        TWOLITER_PATH,
+        ["update", "--project-path", project_path.to_str().unwrap()],
+        [],
+    );
+    assert!(output.status.success(), "twoliter update failed");
+
+    let output = run_command(
+        TWOLITER_PATH,
+        [
+            "fetch",
+            "--project-path",
+            project_path.to_str().unwrap(),
+            "--arch",
+            arch,
+        ],
+        [],
+    );
+    assert!(output.status.success(), "twoliter fetch failed");
+
+    let output = twoliter_make(bob_src.path(), "build-variant", HOST_VARIANT, arch);
+    assert!(
+        output.status.success(),
+        "build-variant (host with guest EIF) failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    let host_out_dir = bob_src
+        .path()
+        .join("build")
+        .join("images")
+        .join(format!("{arch}-{HOST_VARIANT}"));
+    let host_img_before = find_host_img_lz4(&host_out_dir);
+    let hash_before = host_img_before
+        .as_ref()
+        .map(|p| sha256_of_file(p))
+        .expect("host .img.lz4 must exist after build-variant");
+
+    let output = twoliter_make(bob_src.path(), "repack-variant", HOST_VARIANT, arch);
+    assert!(
+        output.status.success(),
+        "repack-variant (host with guest EIF) failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    let host_img_after =
+        find_host_img_lz4(&host_out_dir).expect("host .img.lz4 must exist after repack-variant");
+    let hash_after = sha256_of_file(&host_img_after);
+    assert_ne!(
+        hash_before, hash_after,
+        "host .img.lz4 bytes did not change across repack — guest-EIF resign likely did not run"
+    );
+}
+
+/// Return the most recently modified `-*.img.lz4` (versioned, not
+/// `latest-*` symlink) under the given dir tree, if any.
+#[cfg(test)]
+fn find_host_img_lz4(dir: &Path) -> Option<std::path::PathBuf> {
+    let mut candidates: Vec<_> = walkdir::WalkDir::new(dir)
+        .into_iter()
+        .flatten()
+        .filter(|e| e.file_type().is_file())
+        .filter(|e| {
+            let n = e.file_name().to_string_lossy();
+            n.ends_with(".img.lz4") && !n.starts_with("latest")
+        })
+        .map(|e| e.into_path())
+        .collect();
+    candidates.sort();
+    candidates.pop()
+}
+
+#[cfg(test)]
+fn sha256_of_file(path: &Path) -> String {
+    use std::io::Read;
+    let mut f = std::fs::File::open(path).expect("open .img.lz4");
+    let mut buf = Vec::new();
+    f.read_to_end(&mut buf).expect("read .img.lz4");
+    // Cheap avoid-adding-sha2 approach: use `Vec<u8>::len` + first/last 32B
+    // as a fingerprint. Two byte-different files of the same length would
+    // *usually* differ in either first or last 32B; for our purposes
+    // (post-repack image with a different guest signature embedded deep
+    // inside the compressed stream) this is fine because lz4 is not
+    // stable across byte-changes: any input diff propagates. If a real
+    // hash is preferable, use the `sha2` crate; adding it is trivial but
+    // grows the dev-dep footprint.
+    let head_hex = hex_of(&buf[..buf.len().min(32)]);
+    let tail_start = buf.len().saturating_sub(32);
+    let tail_hex = hex_of(&buf[tail_start..]);
+    format!("len={} head={} tail={}", buf.len(), head_hex, tail_hex)
+}
+
+#[cfg(test)]
+fn hex_of(b: &[u8]) -> String {
+    let mut s = String::with_capacity(b.len() * 2);
+    for byte in b {
+        use std::fmt::Write;
+        write!(&mut s, "{byte:02x}").unwrap();
+    }
+    s
+}

tests/integration-tests/src/variant_build.rs

@@ -15,6 +15,11 @@ IN_PLACE_UPDATES="no"
 # already enforce mutual exclusion when `standalone-image = true`.
 ENCRYPTED_STORAGE="no"
 STANDALONE_IMAGE="no"
+# Newline-delimited list of `<guest>:<install_path>:<host_image_dir>` triples,
+# matching the shape rpm2img gets. On repack, we do NOT re-copy the guest
+# images (they are already in the rootfs from the original build); we only
+# walk each install_path under ${ROOT_MOUNT} and resign any `*.eif` we find.
+GUEST_IMAGES=""
 
 for opt in "$@"; do
   optarg="$(expr "${opt}" : '[^=]*=\(.*\)')"
@@ -32,6 +37,7 @@ for opt in "$@"; do
   --with-uefi-secure-boot=*) UEFI_SECURE_BOOT="${optarg}" ;;
   --with-in-place-updates=*) IN_PLACE_UPDATES="${optarg}" ;;
   --with-standalone-image=*) STANDALONE_IMAGE="${optarg}" ;;
+  --guest-images=*) GUEST_IMAGES="${optarg}" ;;
   *)
     echo "unexpected arg: ${opt}" >&2
     exit 1
@@ -115,6 +121,12 @@ write_partition() {
 # shellcheck source=imghelper
 . "${0%/*}/imghelper"
 
+# Import the eif signer-args discovery helper. Used by the guest-EIF resign
+# loop below to pick the same Infra.toml [eif] profile that rpm2eif / eif2eif
+# use, so a host repack re-signs its guest EIFs with the same key/backend.
+# shellcheck source=eif-sign-helper
+. "${0%/*}/eif-sign-helper"
+
 # Validate that the values for the args are sane.
 sanity_checks \
   "${OUTPUT_FMT}" "${PARTITION_PLAN}" "${OVF_TEMPLATE}" "${UEFI_SECURE_BOOT}"
@@ -244,6 +256,82 @@ install_ca_certs "${ROOT_MOUNT}"
 # Install 'root.json'.
 install_root_json "${ROOT_MOUNT}"
 
+# ---- Resign guest EIFs, if this variant embeds any ----
+#
+# When the host manifest declares `[[package.metadata.build-variant.guest-images]]`
+# entries, buildsys passes them through as `--guest-images` with the same
+# `<guest>:<install_path>:<host_image_dir>` shape rpm2img gets. On repack
+# we do *not* re-copy the guest artifacts (they were already staged into
+# the rootfs at build time); we only walk each install_path under
+# ${ROOT_MOUNT} and re-sign any `*.eif` we find, so the new host-repack
+# artifacts continue to reflect the current Infra.toml [eif] profile.
+#
+# When no [eif] profile is configured we skip the resign and log once —
+# matching img2img's existing "no UEFI SB profile ⇒ skip signing" behavior
+# and rpm2eif's "no signing.crt ⇒ unsigned" behavior. This keeps repack
+# usable on stripped-down local dev flows without an Infra.toml.
+if [[ -n "${GUEST_IMAGES}" ]]; then
+  # Fail hard rather than silently skip: an operator who declared
+  # `[[guest-images]]` in the manifest expects those EIFs to be resigned
+  # (otherwise there is no reason to invoke repack against a host that
+  # embeds them). The current implementation walks the extracted `${ROOT_MOUNT}`
+  # directory tree, which only exists in the erofs path — for an ext4
+  # rootfs, edits go through `debugfs_replace` and there is no live tree
+  # to `find` under. Adding an ext4-path implementation is possible (see
+  # plan Approach A) but out of scope here. Fail loudly so a future ext4
+  # host+guest combination shows up as a concrete task rather than a
+  # silently-broken build.
+  if [[ "${EROFS_ROOT_PARTITION}" != "yes" ]]; then
+    echo "img2img: --guest-images is set but rootfs is not erofs; guest-EIF resign is only implemented for erofs rootfs. Enable erofs-root-partition on the host variant or drop the guest-images declaration." >&2
+    exit 1
+  fi
+  guest_resign_args=()
+  if ! discover_eif_signer_args guest_resign_args; then
+    # Fires only when the signing.crt secret is mounted but neither
+    # signing.key nor a non-empty kms-key-id file is — which means the
+    # buildsys → buildkit secret plumbing is inconsistent with Infra.toml
+    # [eif].signing_key. Propagate the failure just as rpm2eif does; the
+    # operator asked for signing (cert is present) but the setup is
+    # incomplete, and silently leaving guest EIFs unsigned would be
+    # surprising.
+    exit 1
+  fi
+  if (( ${#guest_resign_args[@]} == 0 )); then
+    echo "img2img: no EIF signing profile present (Infra.toml [eif] not configured); leaving guest EIFs unchanged" >&2
+  else
+    # Iterate the newline-delimited list. Each entry is
+    # `<guest>:<install_path>:<host_image_dir>`; we only care about
+    # <install_path> here.
+    while IFS= read -r entry; do
+      [[ -n "${entry}" ]] || continue
+      # Split on `:`. The install path is the middle field.
+      IFS=':' read -r _guest install_path _host_dir <<<"${entry}"
+      if [[ -z "${install_path}" ]]; then
+        echo "img2img: malformed --guest-images entry (missing install_path): ${entry}" >&2
+        exit 1
+      fi
+      # `install_path` is host-absolute (starts with `/`); glob it under
+      # ${ROOT_MOUNT}. Suppress `failglob` for the duration of the check
+      # because a host that embeds no `.eif`s (e.g. only qcow2 guests) is a
+      # normal case.
+      shopt -u failglob
+      eif_files=( "${ROOT_MOUNT}${install_path}"/*.eif )
+      shopt -s failglob
+      # `failglob` off + empty match leaves the literal pattern, so filter
+      # it out explicitly.
+      for eif in "${eif_files[@]}"; do
+        [[ -f "${eif}" ]] || continue
+        echo "img2img: resigning guest EIF ${eif#"${ROOT_MOUNT}"}"
+        /host/build/tools/eif-builder resign \
+          --input "${eif}" \
+          --output "${eif}.resigned" \
+          "${guest_resign_args[@]}"
+        mv "${eif}.resigned" "${eif}"
+      done
+    done <<<"${GUEST_IMAGES}"
+  fi
+fi
+
 ###############################################################################
 # Section 4: update root partition and root verity
 

twoliter/embedded/img2img

@@ -27,6 +27,11 @@ IMAGE_ARTIFACT_SUFFIXES=(
   "ova"
   "ext4.lz4"
   "verity.lz4"
+  # `eif` is included so that `copy_guest_image_artifacts` picks up the
+  # `.eif` files a guest EIF variant emits (see `rpm2eif` output). Like
+  # `.ova`, `.eif` is a first-class image artifact that is *not* produced
+  # by `compress_image` (it is built by `eif-builder` directly), so it
+  # deliberately has no compressor case in the `compress_image` switch.
   "eif"
 )
 

twoliter/embedded/imghelper

@@ -58,6 +58,8 @@ fail() { fail_count=$((fail_count + 1)); echo "  FAIL: $1" >&2; }
     echo "IMAGE_ARTIFACT_SUFFIXES not declared" >&2; exit 1;
   }
   # At minimum, the canonical set. New entries are allowed; missing entries fail.
+  # `eif` is included because EIF guest variants ship a `.eif` sidecar that
+  # host repack needs to be able to enumerate and resign.
   required=("img.lz4" "qcow2" "vmdk" "ova" "ext4.lz4" "verity.lz4" "eif")
   for want in "${required[@]}"; do
     found=no
@@ -146,6 +148,7 @@ mkdir -p "${src}" "${dst}"
 # must be rejected.
 touch "${src}/bottlerocket-1.0.0.img.lz4"
 touch "${src}/bottlerocket-1.0.0.ext4.lz4"
+touch "${src}/bottlerocket-1.0.0.eif"
 ln -s "bottlerocket-1.0.0.img.lz4" "${src}/os_image.img.lz4"
 touch "${src}/bottlerocket-1.0.0.eif"
 touch "${src}/bottlerocket-1.0.0-disk.img"