Repository navigation
feat(init): sync the clock from /dev/ptp0 and drop chrony #12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: [master] | |
| # Nothing here reads or writes anything through the API; CodeQL flagged the | |
| # default write-all token. | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| rust: | |
| # Pinned rather than ubuntu-latest: GitHub is rolling that label from 24.04 to | |
| # 26.04 between 2026-10-19 and 2026-11-19, so it is unpredictable right now. | |
| # Revisit once the rollout has finished. | |
| runs-on: ubuntu-24.04 | |
| # Higher than the other branches': the PTP ioctl check below downloads and | |
| # unpacks a kernel tree on top of the lint, test and musl build. | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install the pinned toolchain | |
| run: rustup show active-toolchain || rustup toolchain install | |
| - run: cargo fmt --check | |
| - run: cargo clippy --all-targets --locked -- -D warnings | |
| - run: cargo test --workspace --locked | |
| # eiffel-init is what the enclave runs, and the bootstrap initrd carries no | |
| # dynamic loader for it. Build it the way the image does and prove it needs none. | |
| - name: Build eiffel-init static for musl | |
| env: | |
| RUSTFLAGS: -C target-feature=+crt-static | |
| run: | | |
| set -eux | |
| cargo build --release --locked -p eiffel-init --target x86_64-unknown-linux-musl | |
| ! readelf -lW target/x86_64-unknown-linux-musl/release/eiffel-init | grep -q interpreter | |
| # eiffel-init derives the PTP ioctl request numbers from nix's ioc macros and | |
| # its own struct definitions. This compiles the same ioctls out of the header | |
| # of the kernel the image pins and checks the two agree, so a uapi change fails | |
| # here rather than leaving an enclave unable to set its clock. kernel-src stops | |
| # at the unpacked tree, so this costs a download and not a kernel build. | |
| - name: Check the PTP ioctl numbers against the pinned kernel's header | |
| run: | | |
| set -eux | |
| docker build --target kernel-src -t eiffel-kernel-src:ci . | |
| docker run --rm -v "$PWD/.github:/check:ro" eiffel-kernel-src:ci sh -ec ' | |
| gcc -I/linux/include/uapi -I/linux/include/generated/uapi \ | |
| -I/linux/arch/x86/include/uapi -I/linux/arch/x86/include/generated/uapi \ | |
| -o /tmp/numbers /check/ptp-ioctl-numbers.c | |
| /tmp/numbers' > /tmp/ptp-numbers.txt | |
| diff -u .github/ptp-ioctl-numbers.txt /tmp/ptp-numbers.txt |