Skip to content

release: the verdict sees machine/, not only the files it hashes #98

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aledbf merged 1 commit into from
Oct 2, 2026
+22 −11
Merged

release: the verdict sees machine/, not only the files it hashes #98

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 8 additions & 7 deletions hack/fingerprint-diff
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,11 @@
# Whether this build is still the machine the fleet's checkpoints were taken against.
#
# `machine.Spec.Fingerprint` hashes by content the files a guest runs - QEMU, the kernel, the
# initrd and the firmware - together with the machine's shape. The initrd is brought by whoever
# runs guests and the shape is decided per VM, so between two releases the question collapses
# to the checksums bears_on_fingerprint names below: **checkpoints carry over if and only if
# none of them changed.**
# initrd and the firmware - together with the machine's shape and devices, as machine/ defines
# them. The initrd is brought by whoever runs guests, so between two releases the question
# collapses to the checksums FP_KEYS names below, fingerprint_sha256 among them - Fingerprint
# itself, of one fixed machine, which also moves when machine/ changes what it hashes or how:
# **checkpoints carry over if and only if none of them changed.**
#
# image_sha256 is deliberately not one of them. The base image is mapped read-only through
# a backing chain and is not hashed into the fingerprint - a checkpoint resumes with its own
Expand All @@ -21,7 +22,7 @@
# exactly once here already: a comment edited in kernel/Dockerfile, a rebuilt vmlinux, and a
# fleet-wide invalidation that nothing announced.
#
# hack/fingerprint-diff qemu_sha256=<hex> [kernel_sha256=<hex>] [bios_sha256=<hex>] [pvh_sha256=<hex>] [image_sha256=<hex>]
# hack/fingerprint-diff qemu_sha256=<hex> [kernel_sha256=<hex>] [bios_sha256=<hex>] [pvh_sha256=<hex>] [fingerprint_sha256=<hex>] [image_sha256=<hex>]
#
# Writes a Markdown verdict to stdout — meant to be pasted into release notes or a step
# summary — and its workings to stderr.
Expand Down Expand Up @@ -49,7 +50,7 @@ fi
# The classification this script exists to hold in one place. Adding a file to the
# fingerprint means adding it here; anything else is a number that is reported and does not
# bear on whether a checkpoint resumes.
FP_KEYS=(qemu_sha256 kernel_sha256 bios_sha256 pvh_sha256)
FP_KEYS=(qemu_sha256 kernel_sha256 bios_sha256 pvh_sha256 fingerprint_sha256)
bears_on_fingerprint() {
local k
for k in "${FP_KEYS[@]}"; do [ "$1" = "${k}" ] && return 0; done
Expand Down Expand Up @@ -156,7 +157,7 @@ elif [ "${#unchecked_fp[@]}" -eq 0 ]; then
say "### Checkpoints taken against \`${reference}\` still resume on this machine"
say
say "$(printf '`%s` ' "${FP_KEYS[@]}")are unchanged, and they are the whole of what"
say "this repository contributes to the fingerprint — the initrd and the machine's shape"
say "this repository contributes to the fingerprint — the initrd and each VM's own sizes"
say "come from whoever runs the guests and are untouched by a release."
else
say "### Nothing compared here moves the fingerprint"
Expand Down
18 changes: 14 additions & 4 deletions hack/release
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,10 +110,19 @@ require "${OUTPUT_DIR}/packages.txt" "${SHARE}/packages.txt" "the image's packag
require "${OUTPUT_DIR}/licenses.txt" "${SHARE}/licenses.txt" "the image's licence texts"

# What this release is, in a form something other than a human can read. The qemu, kernel,
# bios and pvh checksums are the machine's identity — the same numbers
# `machine.Spec.Fingerprint` hashes (with the initrd's, which is not in this tarball) to decide
# whether a checkpoint may be resumed; the image's is reported beside them and is not. A host
# wondering why its checkpoints stopped resuming diffs this against the previous release's.
# bios and pvh checksums are the files `machine.Spec.Fingerprint` hashes (with the initrd's,
# which is not in this tarball) to decide whether a checkpoint may be resumed; the image's is
# reported beside them and is not. fingerprint_sha256 is Fingerprint itself, of the machine
# `spin-machine fingerprint` describes with a named CPU, so no runner's own CPU enters it: it
# moves with those files and also with machine/ - its devices, its shape, how it hashes - which
# a consumer builds from this release's commit. A host wondering why its checkpoints stopped
# resuming diffs this against the previous release's.
fingerprint=$(go run ./cmd/spin-machine fingerprint --release "${SHARE}" --cpu Skylake-Server-v4 |
sed -n 's/^ "fingerprint": "\([0-9a-f]\{64\}\)",$/\1/p')
if [ -z "${fingerprint}" ]; then
echo "ERROR: spin-machine fingerprint gave no fingerprint for ${SHARE}" >&2
exit 1
fi
{
echo "version=${VERSION}"
# Which tree this came out of. The version alone does not answer it: for a tagged
Expand All @@ -129,6 +138,7 @@ require "${OUTPUT_DIR}/licenses.txt" "${SHARE}/licenses.txt" "the image's licenc
echo "kernel_sha256=$(sha256sum "${SHARE}/kernel/vmlinux" | cut -d' ' -f1)"
echo "bios_sha256=$(sha256sum "${SHARE}/qemu/qboot.bin" | cut -d' ' -f1)"
echo "pvh_sha256=$(sha256sum "${SHARE}/qemu/pvh.bin" | cut -d' ' -f1)"
echo "fingerprint_sha256=${fingerprint}"
echo "image_sha256=$(sha256sum "${SHARE}/image/rootfs.qcow2" | cut -d' ' -f1)"
} > "${SHARE}/machine.env"
echo "Manifest:"
Expand Down