* [Buildroot] [PATCH v3 2/3] fs/squashfs: add options to build verity tree
2026-09-19 21:35 [Buildroot] [PATCH v3 1/3] fs/common.mk: add optional hook to build a verity hash tree Fiona Klute via buildroot
@ 2026-09-19 21:35 ` Fiona Klute via buildroot
2026-09-19 21:35 ` [Buildroot] [PATCH v3 3/3] support/testing/tests/fs/test_squashfs.py: add test with dm-verity Fiona Klute via buildroot
2026-09-20 10:14 ` [Buildroot] [PATCH v3 1/3] fs/common.mk: add optional hook to build a verity hash tree Julien Olivain via buildroot
2 siblings, 0 replies; 4+ messages in thread
From: Fiona Klute via buildroot @ 2026-09-19 21:35 UTC (permalink / raw)
To: buildroot; +Cc: Julien Olivain, Fiona Klute (othermo GmbH)
From: "Fiona Klute (othermo GmbH)" <fiona.klute@gmx.de>
Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
---
Changes v2 -> v3:
* set ROOTFS_SQUASHFS_VERITY_EXTRA_ARGS from
BR2_TARGET_ROOTFS_SQUASHFS_VERITY_EXTRA_ARGS in squashfs.mk
Changes v1 -> v2:
* add BR2_TARGET_ROOTFS_SQUASHFS_VERITY_EXTRA_ARGS
fs/squashfs/Config.in | 23 +++++++++++++++++++++++
fs/squashfs/squashfs.mk | 4 ++++
2 files changed, 27 insertions(+)
diff --git a/fs/squashfs/Config.in b/fs/squashfs/Config.in
index cb2f5ec969..9773f5af20 100644
--- a/fs/squashfs/Config.in
+++ b/fs/squashfs/Config.in
@@ -121,4 +121,27 @@ config BR2_TARGET_ROOTFS_SQUASHFS_COMP_OPTS
default "-Xcompression-level 22" if BR2_TARGET_ROOTFS_SQUASHFS4_ZSTD
depends on BR2_TARGET_ROOTFS_SQUASHFS_EXTREME_COMP
+config BR2_TARGET_ROOTFS_SQUASHFS_VERITY
+ bool "create verity hash data for root filesystem"
+ select BR2_PACKAGE_HOST_CRYPTSETUP
+ help
+ Create verity hash tree for the root filesystem. This allows
+ setting up a dm-verity device for the root filesystem, to
+ ensure data integrity. The root hash must be provided from a
+ trusted source, or with a kernel-verifiable signature.
+
+ The verity hash image will be called rootfs.squashfs.verity,
+ with the root hash in rootfs.squashfs.verity.root-hash.
+
+if BR2_TARGET_ROOTFS_SQUASHFS_VERITY
+
+config BR2_TARGET_ROOTFS_SQUASHFS_VERITY_EXTRA_ARGS
+ string "Additional arguments for veritysetup"
+ help
+ Additional arguments for the "veritysetup format" call. Use
+ this if you want to set options, e.g. the hash algorithm,
+ instead of using defaults.
+
+endif # BR2_TARGET_ROOTFS_SQUASHFS_VERITY
+
endif
diff --git a/fs/squashfs/squashfs.mk b/fs/squashfs/squashfs.mk
index 3b9d0efbbe..bd283a6be5 100644
--- a/fs/squashfs/squashfs.mk
+++ b/fs/squashfs/squashfs.mk
@@ -32,6 +32,10 @@ else
ROOTFS_SQUASHFS_ARGS += -comp gzip
endif
+ifeq ($(BR2_TARGET_ROOTFS_SQUASHFS_VERITY),y)
+ROOTFS_SQUASHFS_VERITY_EXTRA_ARGS = $(call qstrip,$(BR2_TARGET_ROOTFS_SQUASHFS_VERITY_EXTRA_ARGS))
+endif
+
define ROOTFS_SQUASHFS_CMD
$(HOST_DIR)/bin/mksquashfs $(TARGET_DIR) $@ $(ROOTFS_SQUASHFS_ARGS)
endef
--
2.55.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [Buildroot] [PATCH v3 3/3] support/testing/tests/fs/test_squashfs.py: add test with dm-verity
2026-09-19 21:35 [Buildroot] [PATCH v3 1/3] fs/common.mk: add optional hook to build a verity hash tree Fiona Klute via buildroot
2026-09-19 21:35 ` [Buildroot] [PATCH v3 2/3] fs/squashfs: add options to build verity tree Fiona Klute via buildroot
@ 2026-09-19 21:35 ` Fiona Klute via buildroot
2026-09-20 10:14 ` [Buildroot] [PATCH v3 1/3] fs/common.mk: add optional hook to build a verity hash tree Julien Olivain via buildroot
2 siblings, 0 replies; 4+ messages in thread
From: Fiona Klute via buildroot @ 2026-09-19 21:35 UTC (permalink / raw)
To: buildroot; +Cc: Julien Olivain, Fiona Klute (othermo GmbH)
From: "Fiona Klute (othermo GmbH)" <fiona.klute@gmx.de>
This test uses the option added in the previous commits to build a
disk image with squashfs root and matching verity tree, and boots from
it. Building a kernel is necessary to get the required device-mapper
and squashfs support.
The test also serves to demonstrate usage of a verity image, more
complex setup may use an initramfs instead of dm-mod.create.
Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
---
Changes v1 -> v2:
* use BR2_TARGET_ROOTFS_SQUASHFS_VERITY_EXTRA_ARGS to set hash
algorithm and check if the value was used
* update kernel to 6.18.52
support/testing/tests/fs/test_squashfs.py | 90 +++++++++++++++++++
.../fs/test_squashfs/genimage-verity.cfg | 14 +++
.../fs/test_squashfs/linux-verity.fragment | 8 ++
3 files changed, 112 insertions(+)
create mode 100644 support/testing/tests/fs/test_squashfs/genimage-verity.cfg
create mode 100644 support/testing/tests/fs/test_squashfs/linux-verity.fragment
diff --git a/support/testing/tests/fs/test_squashfs.py b/support/testing/tests/fs/test_squashfs.py
index 0ceb4cab58..62ae8d6c7c 100644
--- a/support/testing/tests/fs/test_squashfs.py
+++ b/support/testing/tests/fs/test_squashfs.py
@@ -1,4 +1,5 @@
import os
+import re
import infra.basetest
@@ -55,3 +56,92 @@ class TestSquashfsMaxBlocksize(TestSquashfs):
# BR2_TARGET_ROOTFS_TAR is not set
"""
expected_blocksize_in_bytes = 1024*1024
+
+
+class TestSquashfsVerity(infra.basetest.BRTest):
+ kernel_fragment = \
+ infra.filepath("tests/fs/test_squashfs/linux-verity.fragment")
+ genimage_config = \
+ infra.filepath("tests/fs/test_squashfs/genimage-verity.cfg")
+ hash_algo = "sha384"
+ config = \
+ f"""
+ BR2_aarch64=y
+ BR2_TOOLCHAIN_EXTERNAL=y
+ BR2_TARGET_GENERIC_GETTY_PORT="ttyAMA0"
+ BR2_LINUX_KERNEL=y
+ BR2_LINUX_KERNEL_CUSTOM_VERSION=y
+ BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.52"
+ BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+ BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="board/qemu/aarch64-virt/linux.config"
+ BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="{kernel_fragment}"
+ BR2_TARGET_ROOTFS_SQUASHFS=y
+ BR2_TARGET_ROOTFS_SQUASHFS4_LZO=y
+ BR2_TARGET_ROOTFS_SQUASHFS_VERITY=y
+ BR2_TARGET_ROOTFS_SQUASHFS_VERITY_EXTRA_ARGS="--hash {hash_algo}"
+ BR2_ROOTFS_POST_IMAGE_SCRIPT="support/scripts/genimage.sh"
+ BR2_ROOTFS_POST_SCRIPT_ARGS="-c {genimage_config}"
+ BR2_PACKAGE_CRYPTSETUP=y
+ BR2_PACKAGE_HOST_GENIMAGE=y
+ # BR2_TARGET_ROOTFS_TAR is not set
+ """
+
+ def test_run(self) -> None:
+ img = os.path.join(self.builddir, "images", "rootfs.squashfs")
+ hash_img = f"{img}.verity"
+ root_hash_file = f"{hash_img}.root-hash"
+ verify_cmd = [
+ "host/sbin/veritysetup", "verify",
+ "--root-hash-file", root_hash_file, img, hash_img
+ ]
+ infra.run_cmd_on_host(self.builddir, verify_cmd)
+
+ dump_cmd = ["host/sbin/veritysetup", "dump", hash_img]
+ out = infra.run_cmd_on_host(self.builddir, dump_cmd)
+ params = dict()
+ for line in out.splitlines():
+ m = re.match(r"^(.*):\s+(\S+)", line)
+ if m is None:
+ continue
+ params[m.group(1)] = m.group(2)
+
+ data_block_size = int(params["Data block size"])
+ data_blocks = int(params["Data blocks"])
+ sector_size = 512 # default
+ data_sectors = data_blocks * data_block_size // sector_size
+ hash_algorithm = params["Hash algorithm"]
+ hash_start_block = 1 # skip header
+ hash_block_size = int(params["Hash block size"])
+ salt = params["Salt"]
+ with open(root_hash_file) as fh:
+ root_hash = fh.read()
+
+ # check if setting --hash in
+ # BR2_TARGET_ROOTFS_SQUASHFS_VERITY_EXTRA_ARGS worked
+ self.assertEqual(hash_algorithm, self.hash_algo)
+
+ disk_img = os.path.join(self.builddir, "images", "disk.img")
+ kern = os.path.join(self.builddir, "images", "Image")
+ self.emulator.boot(
+ arch="aarch64",
+ kernel=kern,
+ kernel_cmdline=[
+ "console=ttyAMA0",
+ "root=/dev/dm-0",
+ "rootfstype=squashfs",
+ f'dm-mod.create="verity,,,ro,0 {data_sectors} verity 1 '
+ f'/dev/vda1 /dev/vda2 {data_block_size} {hash_block_size} '
+ f'{data_blocks} {hash_start_block} {hash_algorithm} '
+ f'{root_hash} {salt}"',
+ ],
+ options=[
+ "-M", "virt", "-cpu", "cortex-a57", "-m", "256M",
+ "-drive", f"file={disk_img},if=virtio,format=raw",
+ ])
+ self.emulator.login()
+
+ self.assertRunOk("mount | grep '/dev/root on / type squashfs'")
+ out, ret = self.emulator.run("dmsetup info verity", 5)
+ self.assertEqual(ret, 0)
+ state = next(filter(lambda s: s.startswith("State:"), out))
+ self.assertRegex(state, r"^State:\s+ACTIVE \(READ-ONLY\)$")
diff --git a/support/testing/tests/fs/test_squashfs/genimage-verity.cfg b/support/testing/tests/fs/test_squashfs/genimage-verity.cfg
new file mode 100644
index 0000000000..13761dca8e
--- /dev/null
+++ b/support/testing/tests/fs/test_squashfs/genimage-verity.cfg
@@ -0,0 +1,14 @@
+image disk.img {
+ hdimage {
+ }
+
+ partition root {
+ partition-type = 0x83
+ image = "rootfs.squashfs"
+ }
+
+ partition verity {
+ partition-type = 0x83
+ image = "rootfs.squashfs.verity"
+ }
+}
diff --git a/support/testing/tests/fs/test_squashfs/linux-verity.fragment b/support/testing/tests/fs/test_squashfs/linux-verity.fragment
new file mode 100644
index 0000000000..a559a51ee2
--- /dev/null
+++ b/support/testing/tests/fs/test_squashfs/linux-verity.fragment
@@ -0,0 +1,8 @@
+CONFIG_MD=y
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_VERITY=y
+CONFIG_DM_INIT=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_MISC_FILESYSTEMS=y
+CONFIG_SQUASHFS=y
+CONFIG_SQUASHFS_LZO=y
--
2.55.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 4+ messages in thread