New OpenSUSE OS: Add OpenSUSE Tumbleweed OS to verify SNP certification.

.github/workflows/build-and-release.yml

@@ -71,6 +71,8 @@ jobs:
             release: 10
           - distro: debian
             release: forky
+          - distro: opensuse
+            release: tumbleweed
 
     steps:
       - name: Checkout

images/guest-opensuse-tumbleweed/mkosi.conf

@@ -0,0 +1,23 @@
+[Include]
+Include=../../modules/load-kernel-modules
+Include=../../modules/guest
+
+[Distribution]
+Distribution=opensuse
+Release=tumbleweed
+
+[Content]
+Packages=
+        kernel-default
+        systemd
+        systemd-boot
+        systemd-networkd
+        systemd-resolved
+        vim
+        zypper
+        udev
+        iputils
+        ca-certificates
+        p11-kit-tools
+        jq
+	patterns-devel-base-devel_basis

images/guest-opensuse-tumbleweed/mkosi.extra/etc/systemd/network/80-dhcp.network

@@ -0,0 +1,6 @@
+[Match]
+Name=en*
+
+[Network]
+DHCP=yes
+

images/host-opensuse-tumbleweed/mkosi.conf

@@ -0,0 +1,48 @@
+[Include]
+Include=../../modules/load-kernel-modules
+# Host Components
+Include=../../modules/host
+
+[Distribution]
+Distribution=opensuse
+Release=tumbleweed
+
+[Content]
+Packages=
+        kernel-default
+        systemd
+        systemd-boot
+        systemd-networkd
+        systemd-resolved
+        vim
+        openssh-clients
+        openssh
+        openssh-server
+        zypper
+        udev
+        iputils
+        ca-certificates
+        p11-kit-tools
+        jq
+        patterns-devel-base-devel_basis
+        iputils
+        NetworkManager
+        systemd-networkd
+        SUSEConnect
+        shadow
+        qemu
+        kernel
+        systemd
+        systemd-boot
+        systemd-resolved
+        qemu-ovmf-x86_64
+        qemu
+        rpm
+        systemd-journal-remote
+        xxd
+        python3
+        python3-pip
+        python3-emoji
+        jq
+        avahi
+KernelCommandLine="kvm_amd.sev_snp=1 iommu=nopt"

images/host-opensuse-tumbleweed/mkosi.extra/etc/systemd/network/80-dhcp.network

@@ -0,0 +1,6 @@
+[Match]
+Name=en*
+
+[Network]
+DHCP=yes
+

modules/guest-measurement/mkosi.extra/usr/local/lib/scripts/guest_measurement.sh

@@ -7,7 +7,7 @@ MEASUREMENT_FILE="/usr/local/lib/guest-image/guest_measurement.txt"
 
 # Check which OVMF binary to use
 OVMF_PATH=""
-for path in /usr/share/ovmf/OVMF.amdsev.fd /usr/share/edk2/ovmf/OVMF.amdsev.fd; do
+for path in /usr/share/ovmf/OVMF.amdsev.fd /usr/share/edk2/ovmf/OVMF.amdsev.fd /usr/share/qemu/ovmf-x86_64-sev.bin; do
   if [ -f "$path" ]; then
     OVMF_PATH="$path"
     break

modules/launch-snp-guest/mkosi.extra/usr/local/lib/scripts/launch-guest.sh

@@ -8,7 +8,7 @@ GUEST_ERROR_LOG="/tmp/guest-error.log"
 
 # Check which OVMF binary to use
 OVMF_PATH=""
-for path in /usr/share/ovmf/OVMF.amdsev.fd /usr/share/edk2/ovmf/OVMF.amdsev.fd; do
+for path in /usr/share/ovmf/OVMF.amdsev.fd /usr/share/edk2/ovmf/OVMF.amdsev.fd /usr/share/qemu/ovmf-x86_64-sev.bin; do
   if [ -f "${path}" ]; then
     OVMF_PATH="${path}"
     break

modules/logging/sev-certificate-generator/mkosi.extra/usr/local/lib/scripts/generate_sev_certificate/service/service.py

@@ -34,11 +34,22 @@ def get_service_description(self, service, platform):
                 guest_service_description = f"journalctl -D {self.guest_logs_path} -o cat | grep -i {description_line_keyterm} | grep -i {service} | head -1"
                 service_description_command = guest_service_description
 
+       # Get service description for host/guest platform using journalctl
         command = subprocess.run(service_description_command, shell=True, check=True, text=True, capture_output=True)
 
         # Receive "<service name>-<service description>" text from the command output
         service_detail = command.stdout
 
+        # Get service description using alternative linux command in case journalctl command gives empty result
+        if service_detail == "":
+                match platform:
+                  case "host" :
+                    host_service_description = f"systemctl cat {service} | grep -i Description= | cut -d = -f 2"
+                    service_description_command = host_service_description
+                    command = subprocess.run(service_description_command, shell=True, check=True, text=True, capture_output=True)
+                    service_detail = command.stdout
+                    return service_detail
+
         # Parse the <service description> part
         match = re.split(r'(?i)-\s+', service_detail, maxsplit=1)
         service_description=match[1].strip()
@@ -62,6 +73,23 @@ def extract_service_status(self, service, platform):
         for status, pattern in PATTERNS:
             if pattern.search(service_message):
                 return status
+
+        # Check for service description in the OpenSUSE service logs when a service fails.
+        service_description = self.get_service_description(service, platform)
+        service_description = service_description.strip()
+        print("service_description=", service_description)
+
+        PATTERNS = [
+            ("failed", re.compile(rf'Failed to start {service_description}', re.IGNORECASE)),
+            ("skipped", re.compile(rf'was skipped', re.IGNORECASE)),
+            ("passed", re.compile(rf'{service}: Deactivated successfully', re.IGNORECASE)),
+        ]
+
+        # Evaluate in PATTERNS order which already has desired priority
+        for status, pattern in PATTERNS:
+            if pattern.search(service_message):
+                return status
+
         return "?"
 
     def extract_service_error(self, failed_service, platform="guest"):
@@ -85,3 +113,4 @@ def extract_service_error(self, failed_service, platform="guest"):
         service_error = "\n".join(clean_lines)
 
         return service_error
+

modules/logging/sev-certificate-generator/mkosi.extra/usr/local/lib/scripts/generate_sev_certificate/test_environment/sev_version_3_0_0/host_environment/host_os_package.py

@@ -11,11 +11,12 @@ class HostOSPackage:
     qemu["debian"]="qemu-system"
     qemu["centos"]="qemu-kvm-core"
     qemu["rocky"]="qemu-kvm-core"
+    qemu["opensuse-tumbleweed"]="qemu"
 
     ovmf={}
     ovmf["fedora"]="edk2-ovmf"
     ovmf["ubuntu"]="ovmf"
     ovmf["debian"]="ovmf"
     ovmf["centos"]="edk2-ovmf"
     ovmf["rocky"]="edk2-ovmf"
-
+    ovmf["opensuse-tumbleweed"]="qemu-ovmf-x86_64"

modules/logging/sev-certificate-generator/mkosi.extra/usr/local/lib/scripts/generate_sev_certificate/test_environment/sev_version_3_0_0/host_environment/package_version.sh

@@ -13,7 +13,7 @@ fi
 package="$1"
 
 declare -A package_managers
-package_managers=( ["fedora"]="rpm" ["ubuntu"]="apt" ["debian"]="apt" ["centos"]="rpm" ["rocky"]="rpm" )
+package_managers=( ["fedora"]="rpm" ["ubuntu"]="apt" ["debian"]="apt" ["centos"]="rpm" ["rocky"]="rpm" ["opensuse-tumbleweed"]="rpm" )
 
 os_name=$(grep '^ID=' /etc/os-release | cut -d'=' -f2 | tr -d '"')
 os_package_manager=${package_managers[${os_name}]}