[24.04 FEAT] Secure Execution - Secure guest tool to bind and associate APQNs (s390-tools)

[bugproxy]

Feature Description:

Provide a tool that associates HSM names with to APQNs based on APQN type,card generation, serial number and MKVP.

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2023-08-16 11:49 EDT-------
This feature is not yet available, therefore, we need to postpone it to the next Ubuntu release.

==> Changing target milestone to: "24.04"

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2024-01-17 04:31 EDT-------
Pvapconfig is a new tool for automatically configuring the APQNs
within an Secure Execution KVM guest with AP pass-through support.
Based on a given AP configuration it tries to find a matching
APQN and bind and associate it with the correct secret.

Pvapconfig is now available upstream and will be part of the
upcomming s390-tools release version 2.31.

Backports on top of s390-tools version 2.30 require at least these
two commits:

0764460e rust/pv: Provide access for SecretList members
https://github.ibm.com/linuxonz/s390-tools/commit/0764460eafdfd91f78bbed5ac818f19d60e14b70

94a38ebc rust/pvapconfig: Introduce new tool pvapconfig
https://github.ibm.com/linuxonz/s390-tools/commit/94a38ebc3aec9ee954f1ae9a4a0a09ea7f29f11c

Optional maybe this commit may be applied as well:

6fd02279 rust/Makefile: Fix CC/AR variables for TEST_TARGETS
https://github.ibm.com/linuxonz/s390-tools/commit/6fd02279da20acba882426496e3b87e556bdeabc

If Ubuntu 24.04 simple picks the upcomming s390-tools version 2.31, there
is nothing more to do :-)

[Frank Heimes (fheimes)]

Yes, we recently upgraded the s390-tools in the 24.04 release that is still in development to 2.30.0, but just to not let the delta become too big.
You are right, the planned target release is 2.31.0 (availability planned for CW 5), hence we'll not take the effort to backport these new things, but will just introduce them with the next version bump.

But thanks for the heads-up and details !

[Launchpad Janitor (janitor)]

This bug was fixed in the package s390-tools - 2.31.0-0ubuntu1

---------------
s390-tools (2.31.0-0ubuntu1) noble; urgency=medium

  [ Frank Heimes ]
  * New upstream release, requested in LP: #2049612
    - Includes 'Secure Execution - Secure guest tool to bind and associate
      APQNs'. LP: #2003672
    - No new crates and no significant changes in size of the vendored crates
      tar ball.
    - Update XS-Vendored-Sources-Rust field in d/control.
    - Modify d/s390-tools.install to add targets for the new pvapconfig tool.
    - Rewrote and updated d/copyright according to DEP-5 aka
      debian.org/doc/packaging-manuals/copyright-format/1.0/
    - Add d/s390-tools.lintian-overrides to override a known false positive
      detection of lintian of libyaml in rust code.
    - Add d/gzip-files-without-timestamps-or-names.patch to
      avoid timestampes in gzip that will lead to lintian warning
      'package-contains-timestamped-gzip' and will harm reproducible builds.

  [ Simon Chopin ]
  * d/control: replace dh-cargo by dh-cargo-tools and explicit cargo
    dependency as we're not using the dh plugin

 -- Simon Chopin <email address hidden> Mon, 26 Feb 2024 15:44:15 +0100