Repository navigation
feat: probe the runtime platform and network state - #287
Merged
Merged
Conversation
Two probes, with no caller yet and no transcript change: - detect_platform: the operating system, the Rite Live system (version, dm-verity root hash, ceremony layer digest), a container and a virtual machine. On Linux everything comes from files any user can read. - network_snapshot: every interface but loopback with its kind, state, carrier, MAC, addresses and traffic counters; whether an IPv4 and an IPv6 default route exist; the radios registered with rfkill. Nothing is sent: the route check connects a UDP socket, which only queries the routing table. Interfaces, addresses and counters come from sysinfo, whose network feature is now enabled. On Linux, sysfs adds the interface kind, carrier and radios; elsewhere the kind is unknown and radios are not probed. A probe that cannot see the answer says so rather than report a negative: Secure Boot is unknown when /sys/firmware is hidden or efivarfs is not mounted, DMA protection when /sys/class is not visible, RAM encryption without an AMD or Intel CPU vendor, radios when rfkill shows nothing while a radio link exists, the default route when the socket fails for another reason than an unreachable network. A container or virtual machine without a marker reads "not detected". machine_info now reports the UEFI Secure Boot state. On AMD, RAM encryption is read from the `sme` CPU flag, which Linux clears unless Secure Memory Encryption is active, so it no longer needs dmesg. Intel TME is read from the `tme` flag from Linux 6.10, and from dmesg before. The Linux readers take the root of the file system as a parameter. scripts/capture-probe-fixture.sh copies, on a Linux system, the files they read and nothing that identifies the machine; each capture is a fixture under crates/rite-stdlib/tests/fixtures/probes/ with the result the probes give from it, and a test compares (RITE_UPDATE_PROBE_FIXTURES=1 accepts a change). The fixtures are Docker Desktop containers on Apple Silicon (arm64, and amd64 under Rosetta) and Debian 13 guests in QEMU (arm64 with HVF, amd64 emulated). The hidden `rite system` command prints what every probe reports on the machine it runs on, addresses and MAC addresses counted, not printed, for the live checks on systems a fixture cannot hold, Windows included.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Probes for where Rite runs and what network the machine has. Nothing calls them yet and the transcript does not change.
detect_platform: the OS, a Rite Live system (version, root hash, ceremony layer), a container, a virtual machine.network_snapshot: interfaces with kind, state, carrier and counters; IPv4 and IPv6 default routes; rfkill radios. Nothing is sent.machine_infoadds Secure Boot, and reads AMD SME and Intel TME (Linux 6.10+) from the CPU flags.A probe that cannot see the answer reports unknown or "not detected", not a negative.
The Linux probes read under a root directory, so a test replays them over files captured on real systems (
scripts/capture-probe-fixture.sh, fixtures incrates/rite-stdlib/tests/fixtures/probes/). The hiddenrite systemcommand prints what every probe reports on the machine it runs on, for the systems a fixture cannot hold.