From 2cc4829c01053701b5af1cffc8dfe45f4f1931e4 Mon Sep 17 00:00:00 2001 From: Colin Walters Date: Mon, 14 Sep 2026 13:56:34 -0400 Subject: [PATCH 1/2] bootc-ubuntu-setup: Exclude AMD-SEV OVMF on Ubuntu 26.04 Ubuntu Resolute's OVMF metapackage selects AMD-SEV firmware by default, which is not the generic firmware expected by libvirt on these runners. Keep apt's normal recommendations while explicitly installing ovmf-generic and excluding ovmf-amdsev. Assisted-by: AI Signed-off-by: Colin Walters --- bootc-ubuntu-setup/action.yml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/bootc-ubuntu-setup/action.yml b/bootc-ubuntu-setup/action.yml index 4308c43..044351c 100644 --- a/bootc-ubuntu-setup/action.yml +++ b/bootc-ubuntu-setup/action.yml @@ -123,10 +123,23 @@ runs: shell: bash run: | set -xeuo pipefail + idv=$(. /usr/lib/os-release && printf '%s-%s' "$ID" "$VERSION_ID") + firmware_packages=() + if [ "$idv" = ubuntu-26.04 ]; then + # Unsealed bootc tests request bcvk's uefi-insecure mode: + # https://github.com/bootc-dev/bootc/blob/12f03a042b868f40ec850c2496babda1d66775d5/crates/xtask/src/bcvk.rs#L113-L120 + # This becomes a libvirt secure=no firmware request. Resolute's + # stateless AMD-SEV descriptor satisfies that request and may win + # auto-selection, but without NVRAM it cannot restore the installed + # GRUB boot entry. Keep generic OVMF and the other recommendations + # while removing that descriptor by excluding its package. + # https://libvirt.org/formatdomain.html#guest-firmware + firmware_packages=(ovmf-generic ovmf-amdsev-) + fi # Let libvirt select its QEMU dependency; qemu-kvm has ambiguous # providers on Ubuntu 26.04 when requested explicitly. # see https://github.com/bootc-dev/bcvk/issues/176 - /bin/time -f '%E %C' sudo apt install -y libkrb5-dev pkg-config libvirt-dev genisoimage qemu-utils virtiofsd libvirt-daemon-system python3-virt-firmware + /bin/time -f '%E %C' sudo apt install -y libkrb5-dev pkg-config libvirt-dev genisoimage qemu-utils virtiofsd libvirt-daemon-system python3-virt-firmware "${firmware_packages[@]}" # bcvk requires KVM and v0.19.0 has no arm64 release asset. - name: Install bcvk From 57151edcc4e2081a48fe639e9a07737a4317e16c Mon Sep 17 00:00:00 2001 From: Colin Walters Date: Mon, 14 Sep 2026 13:57:08 -0400 Subject: [PATCH 2/2] ci: Test Ubuntu 26.04 generic OVMF with libvirt Verify that Ubuntu 26.04 retains normal virtualization recommendations while selecting generic OVMF and excluding AMD-SEV firmware. Pull-request validation checks package state; manual dispatch carries the CentOS Stream 10 bcvk conversion and SSH probe separately from the required PR gate. Assisted-by: AI Signed-off-by: Colin Walters --- .github/scripts/ubuntu-2604-ovmf-smoke.mjs | 46 +++++++++++++++++++++ .github/workflows/test-ubuntu-2604-ovmf.yml | 46 +++++++++++++++++++++ 2 files changed, 92 insertions(+) create mode 100644 .github/scripts/ubuntu-2604-ovmf-smoke.mjs create mode 100644 .github/workflows/test-ubuntu-2604-ovmf.yml diff --git a/.github/scripts/ubuntu-2604-ovmf-smoke.mjs b/.github/scripts/ubuntu-2604-ovmf-smoke.mjs new file mode 100644 index 0000000..47961bd --- /dev/null +++ b/.github/scripts/ubuntu-2604-ovmf-smoke.mjs @@ -0,0 +1,46 @@ +import { spawnSync } from 'node:child_process'; + +const image = 'quay.io/centos-bootc/centos-bootc:stream10'; +const localImage = 'localhost/bcvk-libvirt-smoke:latest'; +const vmName = process.env.VM_NAME; + +function run(command, args, timeout = '2m') { + const result = spawnSync('timeout', [ + '--foreground', '--signal=TERM', '--kill-after=30s', timeout, command, ...args, + ], { stdio: 'inherit' }); + if (result.error || result.status !== 0) { + const status = result.status ?? 1; + throw Object.assign( + new Error(`${command} failed (${result.signal ?? `status ${status}`})`), + { status }, + ); + } +} + +if (!vmName) throw new Error('VM_NAME must be set'); + +let failure; +try { + run('podman', ['pull', image], '12m'); + run('podman', ['tag', image, localImage]); + run('bcvk', [ + 'libvirt', 'run', '--connect', 'qemu:///session', '--name', vmName, + '--firmware=uefi-insecure', '--disable-tpm', '--ssh-wait', + '--memory=2048', '--cpus=2', '--disk-size=12G', localImage, + ], '12m'); + run('bcvk', ['libvirt', 'ssh', '--connect', 'qemu:///session', vmName, '--', 'hostname']); + console.log('CentOS Stream 10 bootc guest reached SSH through libvirt'); +} catch (error) { + failure = error; +} finally { + try { + run('bcvk', ['libvirt', 'rm', '--connect', 'qemu:///session', '--force', vmName]); + } catch (error) { + console.warn(`Warning: VM cleanup failed: ${error.message}`); + } +} + +if (failure) { + console.error(`Probe failed: ${failure.message}`); + process.exitCode = failure.status; +} diff --git a/.github/workflows/test-ubuntu-2604-ovmf.yml b/.github/workflows/test-ubuntu-2604-ovmf.yml new file mode 100644 index 0000000..3f14552 --- /dev/null +++ b/.github/workflows/test-ubuntu-2604-ovmf.yml @@ -0,0 +1,46 @@ +name: Test Ubuntu 26.04 generic OVMF selection + +on: + pull_request: + branches: + - main + workflow_dispatch: + +permissions: + contents: read + +jobs: + libvirt: + runs-on: ubuntu-26.04 + timeout-minutes: 45 + steps: + - uses: actions/checkout@v7 + + - name: Run bootc-ubuntu-setup + uses: ./bootc-ubuntu-setup + with: + libvirt: true + + - name: Verify generic OVMF package state + shell: bash + run: | + set -euo pipefail + test "$(dpkg-query -W -f='${db:Status-Abbrev}' ovmf-generic)" = 'ii ' + test "$(dpkg-query -W -f='${db:Status-Abbrev}' ovmf-amdsev 2>/dev/null || true)" != 'ii ' + test ! -e /usr/share/qemu/firmware/60-edk2-x86_64-amdsev.json + for package in qemu-block-extra qemu-system-gui; do + test "$(dpkg-query -W -f='${db:Status-Abbrev}' "${package}")" = 'ii ' + dpkg-query -W -f='${Package} ${Version} ${db:Status-Abbrev}\n' "${package}" + done + dpkg-query -W -f='${Package} ${Version} ${db:Status-Abbrev}\n' ovmf-generic + printf '%s\n' 'ovmf-amdsev is absent and its AMD-SEV descriptor is absent' + + - name: Check OVMF smoke script syntax + run: node --check .github/scripts/ubuntu-2604-ovmf-smoke.mjs + + - name: Probe CentOS Stream 10 libvirt conversion and SSH + if: github.event_name == 'workflow_dispatch' + env: + RUST_LOG: bcvk=debug + VM_NAME: actions-ovmf-${{ github.run_id }} + run: node .github/scripts/ubuntu-2604-ovmf-smoke.mjs