Add new variants

Cargo.toml

@@ -15,6 +15,10 @@ members = [
     "variants/aws-ecs-3-nvidia-fips",
     "variants/aws-ecs-4",
     "variants/aws-ecs-4-nvidia",
+    "variants/aws-mantle-1",
+    "variants/aws-mantle-1-fips",
+    "variants/aws-mantle-1-nvidia",
+    "variants/aws-mantle-1-nvidia-fips",
     "variants/aws-k8s-1.31",
     "variants/aws-k8s-1.31-fips",
     "variants/aws-k8s-1.32",

Makefile.toml

@@ -8,13 +8,17 @@ BUILDSYS_ROOT_DIR = "${CARGO_MAKE_WORKING_DIRECTORY}"
 # For binary installation, this should be a released version (prefixed with a v,
 # for example v0.1.0). For the git sourcecode installation method, this can be
 # any git rev, e.g. a tag, sha, or branch name.
-TWOLITER_VERSION = "v0.22.1"
+TWOLITER_VERSION = "ac85c5b9e4b922ab520c1aff58f89e00a29ce64c"
 TWOLITER_SHA256_AARCH64 = "1c14d29c8306890ce7fce06448b5239f026c0644358a2c4b1527a1e67117bfbb"
 TWOLITER_SHA256_X86_64 = "5322462570aff496f1fe6af1815d415b754177e3313a13951ddfaa88d5a0ee89"
 
 # For binary installation, this is the GitHub repository that has binary release artifacts attached
 # to it, for example https://github.com/bottlerocket-os/twoliter. For git sourcecode installation,
 # this is any URI that can be used in a git clone command.
+# Points at the grove `twoliter/` member (a local working branch carrying the
+# UKI boot-chain fix). A `file://` path triggers install-twoliter.sh's
+# local-path build (`cargo install --path`), so the custom twoliter is built
+# reproducibly from source and does not depend on a pre-placed binary.
 TWOLITER_REPO = "https://github.com/bottlerocket-os/twoliter"
 
 # Skip installing Twoliter if it is already installed and its version
@@ -23,14 +27,14 @@ TWOLITER_REUSE_EXISTING_INSTALL="true"
 
 # Allow Twoliter to be installed from a binary distribution if binaries are expected to exist for
 # the host OS and architecture.
-TWOLITER_ALLOW_BINARY_INSTALL="true"
+TWOLITER_ALLOW_BINARY_INSTALL="false"
 
 # Allow Twoliter to be installed by building from sourcecode.
 TWOLITER_ALLOW_SOURCE_INSTALL="true"
 
 # If you know the version string returned by Twoliter will not match TWOLITER_VERSION (e.g. when you
 # are testing changes to Twoliter itself), set this to true to prevent re-installation.
-TWOLITER_SKIP_VERSION_CHECK="false"
+TWOLITER_SKIP_VERSION_CHECK="true"
 
 # Where Twoliter will be installed.
 TWOLITER_INSTALL_DIR = "${BUILDSYS_ROOT_DIR}/tools/twoliter"

Twoliter.lock

@@ -10,14 +10,14 @@ digest = "6dm8z91Cwe5BgAudM4XlkWPaF88bspeLBrjZ38VhKUs="
 
 [[kit]]
 name = "bottlerocket-kernel-kit"
-version = "7.4.0"
-vendor = "bottlerocket"
-source = "public.ecr.aws/bottlerocket/bottlerocket-kernel-kit:v7.4.0"
-digest = "SQedSOyMa9kju9EwTwqWXsKfJ/LnnEKja9VkDEOzYro="
+version = "9.0.0"
+vendor = "piyush"
+source = "public.ecr.aws/s2v1a1q8/bottlerocket-kernel-kit:v9.0.0"
+digest = "vNrQCJj6UwTe3SiQkXRHoEtn9vSlTsjgR/4co6VYOC0="
 
 [[kit]]
 name = "bottlerocket-core-kit"
-version = "15.1.0"
-vendor = "bottlerocket"
-source = "public.ecr.aws/bottlerocket/bottlerocket-core-kit:v15.1.0"
-digest = "5xtWzYbApP6t1M918AHSduu4tOZWMrM3O0IzntCycEw="
+version = "17.0.0"
+vendor = "piyush"
+source = "public.ecr.aws/s2v1a1q8/bottlerocket-core-kit:v17.0.0"
+digest = "Y/4/JfrfuxRmXDb2fBJTC5jopKu6qVExFyP3iXroq90="

Twoliter.toml

@@ -5,17 +5,20 @@ project-vendor = "Bottlerocket"
 [vendor.bottlerocket]
 registry = "public.ecr.aws/bottlerocket"
 
+[vendor.piyush]
+registry = "public.ecr.aws/s2v1a1q8"
+
 [sdk]
 name = "bottlerocket-sdk"
 version = "0.78.0"
 vendor = "bottlerocket"
 
 [[kit]]
 name = "bottlerocket-kernel-kit"
-version = "7.4.0"
-vendor = "bottlerocket"
+version = "9.0.0"
+vendor = "piyush"
 
 [[kit]]
 name = "bottlerocket-core-kit"
-version = "15.1.0"
-vendor = "bottlerocket"
+version = "17.0.0"
+vendor = "piyush"

packages/settings-defaults/settings-defaults.spec

@@ -107,6 +107,34 @@ Conflicts: %{_cross_os}settings-defaults(any)
 %description aws-ecs-4-nvidia
 %{summary}.
 
+%package aws-mantle-1
+Summary: Settings defaults for the aws-mantle-1 FIPS and non-FIPS variants
+Requires: (%{shrink:
+           %{_cross_os}variant(aws-mantle-1) or
+           %{_cross_os}variant(aws-mantle-1-fips)
+          %{nil}})
+Provides: %{_cross_os}settings-defaults(any)
+Provides: %{_cross_os}settings-defaults(aws-mantle-1)
+Provides: %{_cross_os}settings-defaults(aws-mantle-1-fips)
+Conflicts: %{_cross_os}settings-defaults(any)
+
+%description aws-mantle-1
+%{summary}.
+
+%package aws-mantle-1-nvidia
+Summary: Settings defaults for the aws-mantle-1-nvidia variant
+Requires: (%{shrink:
+           %{_cross_os}variant(aws-mantle-1-nvidia) or
+           %{_cross_os}variant(aws-mantle-1-nvidia-fips)
+           %{nil}})
+Provides: %{_cross_os}settings-defaults(any)
+Provides: %{_cross_os}settings-defaults(aws-mantle-1-nvidia)
+Provides: %{_cross_os}settings-defaults(aws-mantle-1-nvidia-fips)
+Conflicts: %{_cross_os}settings-defaults(any)
+
+%description aws-mantle-1-nvidia
+%{summary}.
+
 %package aws-k8s-1.31
 Summary: Settings defaults for the aws-k8s 1.31 variants
 Requires: (%{shrink:
@@ -383,6 +411,8 @@ for defaults in \
   aws-ecs-3-nvidia \
   aws-ecs-4 \
   aws-ecs-4-nvidia \
+  aws-mantle-1 \
+  aws-mantle-1-nvidia \
   aws-k8s-1.31 \
   aws-k8s-1.31-nvidia \
   aws-k8s-1.32 \
@@ -429,6 +459,8 @@ for defaults in \
   aws-ecs-3-nvidia \
   aws-ecs-4 \
   aws-ecs-4-nvidia \
+  aws-mantle-1 \
+  aws-mantle-1-nvidia \
   aws-k8s-1.31 \
   aws-k8s-1.31-nvidia \
   aws-k8s-1.32 \
@@ -490,6 +522,14 @@ done
 %{_cross_defaultsdir}/aws-ecs-4-nvidia.toml
 %{_cross_tmpfilesdir}/storewolf-defaults-aws-ecs-4-nvidia.conf
 
+%files aws-mantle-1
+%{_cross_defaultsdir}/aws-mantle-1.toml
+%{_cross_tmpfilesdir}/storewolf-defaults-aws-mantle-1.conf
+
+%files aws-mantle-1-nvidia
+%{_cross_defaultsdir}/aws-mantle-1-nvidia.toml
+%{_cross_tmpfilesdir}/storewolf-defaults-aws-mantle-1-nvidia.conf
+
 %files aws-k8s-1.31
 %{_cross_defaultsdir}/aws-k8s-1.31.toml
 %{_cross_tmpfilesdir}/storewolf-defaults-aws-k8s-1.31.conf

packages/settings-plugins/settings-plugins.spec

@@ -80,6 +80,24 @@ Conflicts: %{_cross_os}settings-plugin(any)
 %description aws-ecs-4
 %{summary}.
 
+%package aws-mantle-1
+Summary: Settings plugin for the aws-mantle-1 variant
+Requires: (%{shrink:
+           %{_cross_os}variant(aws-mantle-1) or
+           %{_cross_os}variant(aws-mantle-1-fips) or
+           %{_cross_os}variant(aws-mantle-1-nvidia) or
+           %{_cross_os}variant(aws-mantle-1-nvidia-fips)
+           %{nil}})
+Provides: %{_cross_os}settings-plugin(any)
+Provides: %{_cross_os}settings-plugin(aws-mantle-1)
+Provides: %{_cross_os}settings-plugin(aws-mantle-1-nvidia)
+Provides: %{_cross_os}settings-plugin(aws-mantle-1-fips)
+Provides: %{_cross_os}settings-plugin(aws-mantle-1-nvidia-fips)
+Conflicts: %{_cross_os}settings-plugin(any)
+
+%description aws-mantle-1
+%{summary}.
+
 %package aws-k8s
 Summary: Settings plugin for the aws-k8s variants
 Requires: %{_cross_os}variant-family(aws-k8s)
@@ -175,6 +193,7 @@ Conflicts: %{_cross_os}settings-plugin(any)
   -p settings-plugin-aws-ecs-2 \
   -p settings-plugin-aws-ecs-3 \
   -p settings-plugin-aws-ecs-4 \
+  -p settings-plugin-aws-mantle-1 \
   -p settings-plugin-aws-k8s \
   -p settings-plugin-aws-k8s-nvidia \
   -p settings-plugin-metal-dev \
@@ -192,6 +211,7 @@ for plugin in \
   aws-ecs-2 \
   aws-ecs-3 \
   aws-ecs-4 \
+  aws-mantle-1 \
   aws-k8s-nvidia \
   aws-k8s \
   metal-dev \
@@ -235,6 +255,11 @@ done
 %{_cross_factorydir}%{_cross_sysconfdir}/ld.so.conf.d/aws-ecs-4.conf
 %{_cross_tmpfilesdir}/settings-plugin-aws-ecs-4.conf
 
+%files aws-mantle-1
+%{_cross_pluginsdir}/aws-mantle-1/libsettings.so
+%{_cross_factorydir}%{_cross_sysconfdir}/ld.so.conf.d/aws-mantle-1.conf
+%{_cross_tmpfilesdir}/settings-plugin-aws-mantle-1.conf
+
 %files aws-k8s
 %{_cross_pluginsdir}/aws-k8s/libsettings.so
 %{_cross_factorydir}%{_cross_sysconfdir}/ld.so.conf.d/aws-k8s.conf

sources/Cargo.toml

@@ -20,6 +20,8 @@ members = [
     "settings-defaults/aws-ecs-3-nvidia",
     "settings-defaults/aws-ecs-4",
     "settings-defaults/aws-ecs-4-nvidia",
+    "settings-defaults/aws-mantle-1",
+    "settings-defaults/aws-mantle-1-nvidia",
     "settings-defaults/aws-k8s-1.31",
     "settings-defaults/aws-k8s-1.31-nvidia",
     "settings-defaults/aws-k8s-1.32",
@@ -72,6 +74,7 @@ members = [
     "settings-plugins/aws-ecs-2",
     "settings-plugins/aws-ecs-3",
     "settings-plugins/aws-ecs-4",
+    "settings-plugins/aws-mantle-1",
     "settings-plugins/aws-k8s",
     "settings-plugins/aws-k8s-nvidia",
     "settings-plugins/metal-dev",

sources/settings-defaults/aws-mantle-1-nvidia/Cargo.toml

@@ -0,0 +1,13 @@
+[package]
+name = "settings-defaults-aws-mantle-1-nvidia"
+version = "0.1.0"
+edition = "2021"
+license = "Apache-2.0 OR MIT"
+publish = false
+build = "../build-defaults.rs"
+
+[lib]
+path = "../defaults-toml.rs"
+
+[build-dependencies]
+bottlerocket-defaults-helper.workspace = true

sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/10-defaults.toml

@@ -0,0 +1 @@
+../../../shared-defaults/defaults.toml

sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/11-network.toml

@@ -0,0 +1 @@
+../../../shared-defaults/network.toml

sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/20-aws-host-containers.toml

@@ -0,0 +1 @@
+../../../shared-defaults/aws-host-containers.toml

sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/21-aws-bootstrap-container.toml

@@ -0,0 +1 @@
+../../../shared-defaults/aws-bootstrap-container.toml

sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/25-cf-signal.toml

@@ -0,0 +1 @@
+../../../shared-defaults/cf-signal.toml

sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/40-aws-creds.toml

@@ -0,0 +1 @@
+../../../shared-defaults/aws-creds.toml

sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/51-registry-metadata.toml

@@ -0,0 +1 @@
+../../../shared-defaults/registry-metadata.toml

sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/52-new-variant.toml

@@ -0,0 +1 @@
+../../../shared-defaults/new-variant.toml

sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/54-pki.toml

@@ -0,0 +1 @@
+../../../shared-defaults/pki.toml

sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/55-image-verification.toml

@@ -0,0 +1 @@
+../../../shared-defaults/image-verification.toml

sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/60-lockdown-none.toml

@@ -0,0 +1 @@
+../../../shared-defaults/lockdown-none.toml

sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/70-oci-hooks.toml

@@ -0,0 +1 @@
+../../../shared-defaults/oci-hooks.toml

sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/76-oci-defaults-capabilities.toml

@@ -0,0 +1 @@
+../../../shared-defaults/oci-defaults-capabilities.toml

sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/77-oci-defaults-docker-resource-limits.toml

@@ -0,0 +1 @@
+../../../shared-defaults/oci-defaults-docker-resource-limits.toml

sources/settings-defaults/aws-mantle-1/Cargo.toml

@@ -0,0 +1,13 @@
+[package]
+name = "settings-defaults-aws-mantle-1"
+version = "0.1.0"
+edition = "2021"
+license = "Apache-2.0 OR MIT"
+publish = false
+build = "../build-defaults.rs"
+
+[lib]
+path = "../defaults-toml.rs"
+
+[build-dependencies]
+bottlerocket-defaults-helper.workspace = true

sources/settings-defaults/aws-mantle-1/defaults.d/10-defaults.toml

@@ -0,0 +1 @@
+../../../shared-defaults/defaults.toml

sources/settings-defaults/aws-mantle-1/defaults.d/11-network.toml

@@ -0,0 +1 @@
+../../../shared-defaults/network.toml

sources/settings-defaults/aws-mantle-1/defaults.d/20-aws-host-containers.toml

@@ -0,0 +1 @@
+../../../shared-defaults/aws-host-containers.toml

sources/settings-defaults/aws-mantle-1/defaults.d/21-aws-bootstrap-container.toml

@@ -0,0 +1 @@
+../../../shared-defaults/aws-bootstrap-container.toml

sources/settings-defaults/aws-mantle-1/defaults.d/25-cf-signal.toml

@@ -0,0 +1 @@
+../../../shared-defaults/cf-signal.toml