Self-update, stage 1: signed A/B slots, ssh … update < image, swap over exec

.github/workflows/ci.yml

@@ -4,12 +4,11 @@ name: ci
 # is `cargo run -- --ci <job>` (src/ci.rs), which runs the same on a dev host;
 # nightly.yml boots the guests.
 #
-# The two required checks read different events, and neither is absent on the
-# other — it is skipped, which a required check counts as passing: `abi-split`
-# runs on the pull request alone, where the branch's own commits are; `host`
-# runs only in the merge queue, where every branch has already been judged as
-# a pull request. That is how each half enters the queue it does not itself
-# run in.
+# `abi-split` runs on both events: against main on the pull request, and in
+# the merge queue against the group's base, where two branches that took one
+# version meet. `host` runs only in the merge queue, where every branch has
+# already been judged as a pull request; on the pull request it is skipped,
+# which a required check counts as passing.
 
 on:
   pull_request:
@@ -21,15 +20,14 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # The published crates' versions, read from the branch against its merge
-  # base — a merge group's branches were each already judged this way as a
-  # pull request, so this does not run there. The name is the required check's.
+  # The published crates' versions; `src/ci.rs`'s `abi_split` reads which
+  # event it judges. The name is the required check's.
   abi-split:
-    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      # Full history: `sdkversion::judge` needs the merge base with origin/main.
+      # Full history: the judge needs the merge base with origin/main, or the
+      # group's base.
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0

Cargo.toml

@@ -55,6 +55,7 @@ members = [
     "toyos-tco",
     "toyos-tmpdir",
     "toyos-untrusted",
+    "toyos-update",
     "toyos-userbound",
     "toyos-userpin",
     "toyos-wallclock",
@@ -142,6 +143,11 @@ toyos-tco = { path = "toyos-tco" }
 # every test here; `--ci host` holds the host tests to leaving nothing behind.
 toyos-tmpdir = { path = "toyos-tmpdir" }
 toyos-blackbox = { path = "toyos-blackbox" }
+# The signed image, the slot table and the signer: `src/signing.rs` signs with
+# the same crate the loader and `/system/bin/update` verify with.
+toyos-update = { path = "toyos-update", features = ["sign"] }
+# A throwaway key's seed, from the operating system. Already resolved here.
+getrandom = "0.3"
 # `classify`, so the host reading a log volume and `logd` writing it cannot
 # disagree about which files on it are `logd`'s.
 toyos-wallclock = { path = "toyos-wallclock" }

bootloader/.cargo/config.toml

@@ -1,6 +1,13 @@
 [build]
 target = "x86_64-unknown-uefi"
-rustflags = ["-Dwarnings", "-Cforce-frame-pointers=yes"]
+rustflags = [
+    "-Dwarnings",
+    "-Cforce-frame-pointers=yes",
+    # `ed25519-dalek`'s field arithmetic in plain 64-bit integers: its default
+    # on x86-64 is the AVX2 backend, which this soft-float target has no
+    # registers for.
+    "--cfg=curve25519_dalek_backend=\"serial\"",
+]
 
 [target.x86_64-unknown-uefi]
 linker = "toyos-ld"