fdo-rs / fido-device-onboard-rs

An implementation of the FIDO Device Onboard (FDO) spec written in Rust.
BSD 3-Clause "New" or "Revised" License
56 stars 31 forks source link

Extend the 'per-device serviceinfo configuration' feature with files #617

Open RZandvoort opened 5 months ago

RZandvoort commented 5 months ago

Implemented the files part of the per-device serviceinfo configuration feature:

Configration example

Current example yml

initial_user:
  username: username_per_device
  sshkeys:
  - "testkeyperdevice"
files: null
commands: null
diskencryption_clevis: null
additional_serviceinfo: null
after_onboarding_reboot: false

New example yml

initial_user:
  username: username_per_device
  sshkeys:
  - "testkeyperdevice"
files:
- path: /var/lib/fdo/service-info-api/files/hosts
  permissions: 644
  source_path: /server/local/etc/hosts
commands: null
diskencryption_clevis: null
additional_serviceinfo: null
after_onboarding_reboot: false

It will write both base and per-device configured files. If duplicate files are defined, it will choose the per-device file over the base file.

nullr0ute commented 5 months ago

Can we please have a description in PR, it's useful for justification etc.

Also note we're moving to DB backends so I think this would be a better fit in the DB from a layout and performance PoV.

I think also the commits could have better explanations rather than just "Update fileX". I'm going to set this to a draft.

RZandvoort commented 5 months ago

Can we please have a description in PR, it's useful for justification etc.

Also note we're moving to DB backends so I think this would be a better fit in the DB from a layout and performance PoV.

I think also the commits could have better explanations rather than just "Update fileX". I'm going to set this to a draft.

This pull request was supposed to be for trying stuff out, but then I accidentally clicked on the big green 'create PR' button. If we eventually could squash commit, it will look like nothing happend 🤐

nullr0ute commented 4 months ago

The DB support has now landed so it will need to be part of that. I am going to convert this to a draft, once there is DB support and everything is squashed feel free to convert it back to ready then.