Prepare to support UKIs

packages/os/os.spec

@@ -105,7 +105,6 @@ Requires: %{_cross_os}metricdog
 Requires: %{_cross_os}prairiedog
 Requires: %{_cross_os}schnauzer
 Requires: %{_cross_os}settings-committer
-Requires: %{_cross_os}signpost
 Requires: %{_cross_os}storewolf
 Requires: %{_cross_os}sundog
 Requires: %{_cross_os}xfscli
@@ -120,6 +119,8 @@ Requires: (%{_cross_os}migration or %{_cross_os}image-feature(no-in-place-update
 Requires: (%{_cross_os}thar-be-updates or %{_cross_os}image-feature(no-in-place-updates))
 Requires: (%{_cross_os}updog or %{_cross_os}image-feature(no-in-place-updates))
 
+Requires: (%{_cross_os}signpost or %{_cross_os}image-feature(uki-image))
+
 Requires: (%{_cross_os}pluto if %{_cross_os}variant-family(aws-k8s))
 Requires: (%{_cross_os}shibaken if %{_cross_os}variant-platform(aws))
 Requires: (%{_cross_os}cfsignal if %{_cross_os}variant-platform(aws))
@@ -239,6 +240,7 @@ Requires: %{_cross_os}nvme-cli
 
 %package -n %{_cross_os}signpost
 Summary: Bottlerocket GPT priority querier/switcher
+Conflicts: %{_cross_os}image-feature(uki-image)
 %description -n %{_cross_os}signpost
 %{summary}.
 

packages/release/check-kernel-integrity.service

@@ -12,7 +12,8 @@ ConditionPathExists=!/etc/.fips-kernel-check-passed
 [Service]
 Type=oneshot
 WorkingDirectory=/boot
-ExecStart=/usr/bin/sha512hmac -q -c /boot/.vmlinuz.hmac
+EnvironmentFile=/etc/fips-hmac-path.env
+ExecStart=/usr/bin/sha512hmac -q -c ${HMAC_PATH}
 ExecStart=/usr/bin/touch /etc/.fips-kernel-check-passed
 RemainAfterExit=true
 StandardOutput=tty

packages/release/generate-fips-hmac-path-uki.service

@@ -0,0 +1,20 @@
+[Unit]
+Description=Determine FIPS HMAC in UKI image
+RefuseManualStart=true
+RefuseManualStop=true
+DefaultDependencies=no
+Before=fipscheck.target check-kernel-integrity.service
+ConditionKernelCommandLine=fips=1
+
+[Service]
+Type=oneshot
+EnvironmentFile=-/usr/share/bottlerocket/image-format.env
+# Only run on UKI images; the vmlinuz producer handles the other case.
+ExecCondition=[ "${UKI_IMAGE}" = "true" ]
+ExecStart=/usr/bin/echo "HMAC_PATH=/boot/EFI/Linux/.bottlerocket.efi.hmac"
+RemainAfterExit=true
+StandardOutput=file:/etc/fips-hmac-path.env
+StandardError=journal+console
+
+[Install]
+RequiredBy=fipscheck.target

packages/release/generate-fips-hmac-path-vmlinuz.service

@@ -0,0 +1,19 @@
+[Unit]
+Description=Determine FIPS HMAC in vmlinuz image
+RefuseManualStart=true
+RefuseManualStop=true
+DefaultDependencies=no
+Before=fipscheck.target check-kernel-integrity.service
+ConditionKernelCommandLine=fips=1
+
+[Service]
+Type=oneshot
+EnvironmentFile=-/usr/share/bottlerocket/image-format.env
+ExecCondition=[ "${UKI_IMAGE}" != "true" ]
+ExecStart=/usr/bin/echo "HMAC_PATH=/boot/.vmlinuz.hmac"
+RemainAfterExit=true
+StandardOutput=file:/etc/fips-hmac-path.env
+StandardError=journal+console
+
+[Install]
+RequiredBy=fipscheck.target

packages/release/measure-cmdline.service

@@ -10,6 +10,12 @@ RefuseManualStop=true
 
 [Service]
 Type=oneshot
+EnvironmentFile=-/usr/share/bottlerocket/image-format.env
+
+# Skip on UKI images; the kernel command line is measured as part of the
+# UKI PE binary itself, not extended separately here.
+ExecCondition=[ "${UKI_IMAGE}" != "true" ]
+
 ExecStart=/usr/bin/rottweiler measure kernel-command-line
 RemainAfterExit=true
 

packages/release/prepare-boot.service

@@ -6,6 +6,7 @@ DefaultDependencies=no
 
 [Service]
 Type=oneshot
+EnvironmentFile=-/usr/share/bottlerocket/image-format.env
 # We need a helper program to mount the boot partition since it isn't
 # trivial to figure out which partition set is active
 ExecStart=/usr/bin/prairiedog prepare-boot

packages/release/release.spec

@@ -88,6 +88,8 @@ Source1065: check-kernel-integrity.service
 Source1066: check-fips-modules.service
 Source1067: fips-modprobe@.service
 Source1068: configure-snapshotter.service
+Source1069: generate-fips-hmac-path-uki.service
+Source1070: generate-fips-hmac-path-vmlinuz.service
 
 # Mounts that require build-time edits.
 Source1080: var-lib-kernel-devel-lower.mount.in
@@ -165,7 +167,10 @@ Requires: %{_cross_os}filesystem
 Requires: %{_cross_os}findutils
 Requires: %{_cross_os}glibc
 Requires: %{_cross_os}grep
-Requires: %{_cross_os}grub
+# For newer versions of twoliter that support UKIs, explicitly request the bootloader(efi) capability
+Requires: (%{_cross_os}bootloader(efi) if (%{_cross_os}image-feature(uki-image) or %{_cross_os}image-feature(no-uki-image)))
+# Older versions of twoliter that don't support UKIs always get GRUB
+Requires: (%{_cross_os}grub or %{_cross_os}image-feature(uki-image) or %{_cross_os}image-feature(no-uki-image))
 Requires: %{_cross_os}iproute
 Requires: %{_cross_os}iptables
 Requires: %{_cross_os}kexec-tools
@@ -278,6 +283,7 @@ install -p -m 0644 \
   %{S:1065} %{S:1066} %{S:1067} %{S:1068} \
   %{S:1600} %{S:1601} %{S:1602} %{S:1603} %{S:1604} \
   %{S:1605} %{S:1606} %{S:1607} %{S:1608} %{S:1609} \
+  %{S:1069} %{S:1070} \
   %{buildroot}%{_cross_unitdir}
 
 install -d %{buildroot}%{_cross_unitdir}/systemd-tmpfiles-setup.service.d
@@ -493,6 +499,8 @@ ln -s preconfigured.target %{buildroot}%{_cross_unitdir}/default.target
 %{_cross_unitdir}/fipscheck.target
 %{_cross_unitdir}/activate-preconfigured.service
 %{_cross_unitdir}/check-kernel-integrity.service
+%{_cross_unitdir}/generate-fips-hmac-path-uki.service
+%{_cross_unitdir}/generate-fips-hmac-path-vmlinuz.service
 %{_cross_unitdir}/check-fips-modules.service
 %dir %{_cross_unitdir}/check-fips-modules.service.d
 %{_cross_unitdir}/fips-modprobe@.service

packages/systemd-257/9018-build-correct-sd-boot-EFI-arch-on-the-Bottlerocket-S.patch

@@ -0,0 +1,95 @@
+From 0bab5fb1dfe436727eecf531bcfa24b06ca72561 Mon Sep 17 00:00:00 2001
+From: Arnaldo Garcia Rincon <agarrcia@amazon.com>
+Date: Tue, 4 Aug 2026 03:50:03 +0000
+Subject: [PATCH] build: correct sd-boot EFI arch on the Bottlerocket SDK
+
+The SDK cross sysroot mis-reports host_machine.cpu_family(), so systemd's
+efi_arch lookup resolves to the wrong EFI target: 'ia32' on x86_64 and 'arm' on
+aarch64. Correct both from host_machine.cpu(), and drop the IA-32 mixed-mode
+alternate build, which cannot link in this sysroot.
+
+Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>
+---
+ meson.build          | 40 ++++++++++++++++++++++++++++++++--------
+ src/boot/meson.build |  4 ++--
+ 2 files changed, 34 insertions(+), 10 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index b9d8d5266f..a928ed22cb 100644
+--- a/meson.build
++++ b/meson.build
+@@ -1942,6 +1942,36 @@ efi_arch = {
+         'x86'         : 'ia32',
+ }.get(host_machine.cpu_family(), '')
+
++# Bottlerocket SDK fix: the cross sysroot reports cpu_family 'x86' even for
++# x86_64 targets, which makes efi_arch resolve to 'ia32'. Force x64 when the
++# real target cpu is x86_64.
++if efi_arch == 'ia32' and host_machine.cpu() == 'x86_64'
++    efi_arch = 'x64'
++endif
++
++# The same SDK quirk applies on 64-bit ARM: cpu_family is reported as 'arm',
++# so efi_arch resolves to the 32-bit 'arm' EFI target and sd-boot is emitted as
++# systemd-bootarm.efi with EFI_MACHINE_TYPE_NAME=arm. Force aa64 when the real
++# target cpu is aarch64, so the binary is named and typed per the EFI spec and
++# matches the bootaa64.efi/grubaa64.efi convention used by shim and GRUB.
++# Note: efi_cpu_family is deliberately left resolving to 'arm' below, since the
++# 'arm' and 'aarch64' entries of efi_arch_c_args are identical
++# (-mgeneral-regs-only) and the extra 'arm' link arg
++# (-Wl,--no-wchar-size-warning) is harmless here.
++if efi_arch == 'arm' and host_machine.cpu() == 'aarch64'
++    efi_arch = 'aa64'
++endif
++
++# Single corrected arch key for all EFI flag lookups, so no flag site can
++# silently regress to the -m32 (ia32) path on this SDK.
++if efi_arch == 'x64'
++    efi_cpu_family = 'x86_64'
++elif efi_arch == 'ia32'
++    efi_cpu_family = 'x86'
++else
++    efi_cpu_family = host_machine.cpu_family()
++endif
++
+ pyelftools = pymod.find_installation('python3',
+                                      required : get_option('bootloader'),
+                                      modules : ['elftools'])
+@@ -1954,14 +1984,8 @@ conf.set_quoted('EFI_MACHINE_TYPE_NAME', have ? efi_arch : '')
+
+ efi_arch_alt = ''
+ efi_cpu_family_alt = ''
+-if have and efi_arch == 'x64' and cc.links('''
+-                #include <limits.h>
+-                int main(int argc, char *argv[]) {
+-                        return __builtin_popcount(argc - CHAR_MAX);
+-                }''', args : ['-m32', '-march=i686'], name : '32bit build possible')
+-        efi_arch_alt = 'ia32'
+-        efi_cpu_family_alt = 'x86'
+-endif
++# IA-32 mixed-mode alternate build disabled for Bottlerocket: the SDK cross
++# sysroot lacks 32-bit glibc headers (gnu/stubs-32.h), so -m32 cannot build.
+
+ pefile = pymod.find_installation('python3', required: false, modules : ['pefile'])
+
+diff --git a/src/boot/meson.build b/src/boot/meson.build
+index 632771777b..28089efed2 100644
+--- a/src/boot/meson.build
++++ b/src/boot/meson.build
+@@ -313,11 +313,11 @@ efi_archspecs = [
+                 'c_args' : [
+                         efi_c_args,
+                         '-DEFI_MACHINE_TYPE_NAME="' + efi_arch + '"',
+-                        efi_arch_c_args.get(host_machine.cpu_family(), []),
++                        efi_arch_c_args.get(efi_cpu_family, []),
+                 ],
+                 'link_args' : [
+                         efi_c_ld_args,
+-                        efi_arch_c_ld_args.get(host_machine.cpu_family(), []),
++                        efi_arch_c_ld_args.get(efi_cpu_family, []),
+                 ],
+         },
+ ]
+-- 
+2.52.0
+