Skip to content

minor: extend device state for secureboot and FDE status #1977

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
aethernet wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

minor: extend device state for secureboot and FDE status #1977

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions src/balena-model.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -717,7 +717,10 @@ export interface Device {
mac_address: Types['Short Text']['Read'] | null;
memory_usage: Types['Integer']['Read'] | null;
memory_total: Types['Integer']['Read'] | null;
is_secureboot_enabled: Types['Boolean']['Read'] | null;
secureboot_keys_metadata: Types['Short Text']['Read'] | null;
storage_block_device: Types['Short Text']['Read'] | null;
is_storage_encrypted: Types['Boolean']['Read'] | null;
storage_usage: Types['Integer']['Read'] | null;
storage_total: Types['Integer']['Read'] | null;
cpu_usage: Types['Integer']['Read'] | null;
Expand Down Expand Up @@ -828,7 +831,10 @@ export interface Device {
mac_address: Types['Short Text']['Write'] | null;
memory_usage: Types['Integer']['Write'] | null;
memory_total: Types['Integer']['Write'] | null;
is_secureboot_enabled: Types['Boolean']['Write'] | null;
secureboot_keys_metadata: Types['Short Text']['Write'] | null;
storage_block_device: Types['Short Text']['Write'] | null;
is_storage_encrypted: Types['Boolean']['Write'] | null;
storage_usage: Types['Integer']['Write'] | null;
storage_total: Types['Integer']['Write'] | null;
cpu_usage: Types['Integer']['Write'] | null;
Expand Down
7 changes: 7 additions & 0 deletions src/balena.sbvr
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,6 +193,9 @@ Term: memory usage
Term: memory total
Concept Type: Integer (Type)

Term= secureboot keys metadata
Concept Type: Short Text (Type)

@Page- Page- Mar 20, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Concept Type: Short Text (Type)
Concept Type: JSON (Type)


Term: storage block device
Concept Type: Short Text (Type)

Expand Down Expand Up @@ -549,8 +552,12 @@ Fact type: device has memory usage
Necessity: each device has at most one memory usage
Fact type: device has memory total
Necessity: each device has at most one memory total
Fact type: device is secureboot enabled
Fact type: device has secureboot key metadata
Necessity: each device has at most one secureboot key metadata
Fact type: device has storage block device
Necessity: each device has at most one storage block device
Fact type: device is storage encrypted
Fact type: device has storage usage
Necessity: each device has at most one storage usage
Fact type: device has storage total
Expand Down
3 changes: 3 additions & 0 deletions src/features/device-state/routes/state-patch-v2.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,9 @@ export type StatePatchV2Body = {
api_secret?: string;
memory_usage?: number;
memory_total?: number;
is_secureboot_enabled?: boolean;
is_storage_encrypted?: boolean;
secureboot_keys_metadata?: string | null;
Comment on lines +52 to +54

@Page- Page- Mar 20, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

State-patch v2 will never report these props:

Suggested change
is_secureboot_enabled?: boolean;
is_storage_encrypted?: boolean;
secureboot_keys_metadata?: string | null;

storage_block_device?: string;
storage_usage?: number;
storage_total?: number;
Expand Down
3 changes: 3 additions & 0 deletions src/features/device-state/routes/state-patch-v3.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,9 @@ export type StatePatchV3Body = {
api_secret?: string;
memory_usage?: number;
memory_total?: number;
is_secureboot_enabled?: boolean;
is_storage_encrypted?: boolean;
secureboot_keys_metadata?: string | null;
storage_block_device?: string;
storage_usage?: number;
storage_total?: number;
Expand Down
3 changes: 3 additions & 0 deletions src/features/device-state/state-patch-utils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,9 @@ export const v3ValidPatchFields = [
'cpu_id',
'is_undervolted',
'update_status',
'is_secureboot_enabled',
'is_storage_encrypted',
'secureboot_keys_metadata',
] satisfies Array<
Exclude<keyof StatePatchV3Body[string], 'apps'> | 'update_status'
>;
Expand Down
3 changes: 3 additions & 0 deletions src/migrations/00102-device-add-secureboot-fde-status.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
ALTER TABLE "device" ADD COLUMN IF NOT EXISTS "is secureboot enabled" BOOLEAN NULL;
ALTER TABLE "device" ADD COLUMN IF NOT EXISTS "is storage encrypted" BOOLEAN NULL;
ALTER TABLE "device" ADD COLUMN IF NOT EXISTS "secureboot keys metadata" JSONB NULL;

@Page- Page- Mar 20, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't actually match the generated schema from the sbvr so this would be an invalid migration, it's better to fix at the sbvr level but it's worth noting that you can generate the schema via npm run generate-model-schema and make sure the column types match

7 changes: 7 additions & 0 deletions src/translations/v6/v6.sbvr
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,6 +187,9 @@ Term: memory usage
Term: memory total
Concept Type: Integer (Type)

Term= secureboot keys metadata

@Page- Page- Mar 20, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Personally I wouldn't expose this on v6, if it's info people want then they can update to using v7

Concept Type: Short Text (Type)

Term: storage block device
Concept Type: Short Text (Type)

Expand Down Expand Up @@ -567,10 +570,14 @@ Fact type: device has memory usage
Necessity: each device has at most one memory usage
Fact type: device has memory total
Necessity: each device has at most one memory total
Fact type: device is secureboot enabled
Fact type: device has secureboot key metadata
Necessity: each device has at most one secureboot key metadata
Fact type: device has storage block device
Necessity: each device has at most one storage block device
Fact type: device has storage usage
Necessity: each device has at most one storage usage
Fact type: device is storage encrypted
Fact type: device has storage total
Necessity: each device has at most one storage total
Fact type: device has cpu usage
Expand Down
7 changes: 7 additions & 0 deletions src/translations/v7/v7.sbvr
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,6 +187,9 @@ Term: memory usage
Term: memory total
Concept Type: Integer (Type)

Term= secureboot keys metadata
Concept Type: Short Text (Type)

Term: storage block device
Concept Type: Short Text (Type)

Expand Down Expand Up @@ -557,10 +560,14 @@ Fact type: device has memory usage
Necessity: each device has at most one memory usage
Fact type: device has memory total
Necessity: each device has at most one memory total
Fact type: device is secureboot enabled
Fact type: device has secureboot key metadata
Necessity: each device has at most one secureboot key metadata
Fact type: device has storage block device
Necessity: each device has at most one storage block device
Fact type: device has storage usage
Necessity: each device has at most one storage usage
Fact type: device is storage encrypted
Fact type: device has storage total
Necessity: each device has at most one storage total
Fact type: device has cpu usage
Expand Down
4 changes: 4 additions & 0 deletions test/03_device-state.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1465,8 +1465,12 @@ export default () => {
api_port: 48484,
cpu_usage: 34,
cpu_temp: 56,
is_secureboot_enabled: false,
memory_usage: 1000, // 1GB in MiB
memory_total: 4000, // 4GB in MiB
is_storage_encrypted: false,
secureboot_keys_metadata:
'[{"type":"PK","issuer":"CN = balenaOS PK","subject":"CN = balenaOS PK","validity":"notBefore=Apr 11 14:23:52 2023 GMT notAfter=Apr 11 14:23:52 2043 GMT","serial":"11AFA8270B745848117A4649E7D42B2FB8876F62","sha256":"A25DBA1EE7D0FF6E77ED267AE782FDED2237E0F057E418A43B05F5C702D74FD3"},{"type":"KEK","issuer":"CN = balenaOS KEK","subject":"CN = balenaOS KEK","validity":"notBefore=Apr 11 14:23:52 2023 GMT notAfter=Apr 11 14:23:52 2043 GMT","serial":"3F89E8613C09E7813BA0020BAF8D649769FFD491","sha256":"3AD25718D2A3652FFEF0AC0868D8586CD7DD96A3EBDB64174E6950934E6E954F"}]',
storage_block_device: '/dev/mmcblk0',
storage_usage: 1000, // 1GB in MiB
storage_total: 64000, // 64GB in MiB
Expand Down