docs: Guide to add new mkosi images for new OS support in sev-certify… by LakshmiSaiHarika · Pull Request #235 · AMDEPYC/sev-certify

LakshmiSaiHarika · 2026-02-12T22:52:03Z

This PR adds documentation on how to create, test and publish new guest/host images to add new OS support in this sev-certify project.

… project Signed-off-by: Harika Nittala <lnittala@amd.com>

benland72 · 2026-02-19T21:10:43Z

docs/how-to-add-mkosi-images.md

+## System Set Up
+Install mkosi-v25.3 on the system to match mkosi version present in sev-certify GH project:
+
+- **Option 1:** Install mkosi version 25.3 directly on the supported operating systems using package manager


What do we do when we move to a new version of mkosi? Will we update the docs or something else?

Also - add a period (.) after the word "manager".

What do we do when we move to a new version of mkosi?

As per the current build-and-release.yaml workflow, we are installing the mkosi package in the Ubuntu Plucky version.

As per mkosi packaging status, mkosi version 25.3 is available in ubuntu plucky (Ubuntu 25.10)

Will we update the docs or something else?

Sure, I can update the docs in future if there is any update in mkosi version.

Would prefer not having to update manually, can we just rely on asking the user to check that link for the latest ubuntu version?

benland72

Overall looks good, but needs a little fine tuning.

benland72 · 2026-02-19T21:12:12Z

docs/how-to-add-mkosi-images.md

+## System Set Up
+Install mkosi-v25.3 on the system to match mkosi version present in sev-certify GH project:
+
+- **Option 1:** Install mkosi version 25.3 directly on the supported operating systems using package manager


Also - add a period (.) after the word "manager".

benland72 · 2026-02-19T21:14:18Z

docs/how-to-add-mkosi-images.md

+    ```
+    Check if mkosi version 25.3 is installed correctly:
+    ```
+    mkosi --version


You should show what the expected output is from the at command so that users can validate that it matches what they see.

benland72 · 2026-02-19T21:15:07Z

docs/how-to-add-mkosi-images.md

+    ```
+    mkosi --version
+    ```
+    Ensure QEMU and OVMF guest firmwares are installed to test the launch of built mkosi images on the system.


Are there instructions some place for how the user can validate this?

Sure, I can add additional lines to validate this

benland72 · 2026-02-19T21:19:15Z

docs/how-to-add-mkosi-images.md

+### Configure and Build new Host Image
+  The new host image for the sev-certify can be built using the following steps:
+
+1. **Create a mkosi config for the new host image:** New mkosi configuration to make new host image should be created under `sev-certify/images/host-<new-os-name>-<new-os-release>` folder:


I'd reword New mkosi configuration to make new host image as The mkosi configuration for creating the new host image....
Is it a configuration file? You don't specify a filename in the example

Sure, I will update this with the filename.

benland72 · 2026-02-19T21:19:59Z

docs/how-to-add-mkosi-images.md

+  ```
+  [Include]
+  # Include required modules in the host image
+  Include=../../modules/host


In the preview all of the configuration details show as underlined. Not sure if that's just a preview issue with the markdown or some other formatting issue?

https://github.com/LakshmiSaiHarika/snpcert/blob/mkosi-doc-add-new-images/docs/how-to-add-mkosi-images.md
I think it's just a preview issue - you can see the normal version in Harika's branch above

benland72 · 2026-02-19T21:20:47Z

docs/how-to-add-mkosi-images.md

+  # Add required host os packages
+  Packages= <add-host-os-packages>
+  ```
+  2.  **Build new host image using mkosi:** New guest image can be built in the system from sev-certify root directory using mkosi tool as follows:


The heading here is to build a new host image, but the sub-heading refers to building a new guest image. Is that on purpose?

Thank you so much for catching this point, it is a typo here.
Sure, I will update

benland72 · 2026-02-19T21:21:36Z

docs/how-to-add-mkosi-images.md

+  Packages= <add-guest-os-packages>
+  ```
+
+2. **Build new host image using mkosi:** New guest image can be built from sev-certify root directory in the system using mkosi tool as follows:


Same comment as line 56

benland72 · 2026-02-19T21:22:39Z

docs/how-to-add-mkosi-images.md

+EOF
+```
+
+Launch the built host/guest image using QEMU on the QEMU enabled KVM hypervisor host:


s/QEMU enabled/QEMU-enabled/

amd-aliem · 2026-02-19T21:54:34Z

docs/how-to-add-mkosi-images.md

@@ -0,0 +1,128 @@
+# Create, test and publish new guest/host images
+
+Users can create and publish new host or guest images in sev-certify with mkosi tool in the following steps:


Would it make sense to mention that this is for new OS support, as in the PR title?

amd-aliem · 2026-02-19T22:00:10Z

docs/how-to-add-mkosi-images.md

+  ```
+  2.  **Build new host image using mkosi:** New guest image can be built in the system from sev-certify root directory using mkosi tool as follows:
+  ```
+  mkosi --image-id=host-<new-distro>-<new-release> \


not sure if other people have run into this often, but on ubuntu there are permission errors out of the box related to apparmor, documented here: systemd/mkosi#3265. Can run sysctl systemwide or make an exception for mkosi. I believe in the build scripts it uses sudo, so may be worth linking to that issue here briefly.

amd-aliem · 2026-02-19T22:07:43Z

docs/how-to-add-mkosi-images.md

+
+  guest_image="$1"
+
+  ovmf_path="${2:-/usr/share/edk2/ovmf/OVMF_CODE.fd}"


I would mention somewhere the other common ovmf path - /usr/share/ovmf/OVMF.amdsev.fd

/usr/share/ovmf/OVMF.amdsev.fd OVMF path requires the use of additional QEMU parameters with SEV.

Are we just testing builthost/guest-mkosi-images using simple guest launch?

ah I see, I didn't realize that was the case, that's probably my other issue. My install didn't come with that version, will try to find it.

Ok on ubuntu it appears to be at: /usr/share/ovmf/OVMF.fd

amd-aliem · 2026-02-19T22:53:11Z

docs/how-to-add-mkosi-images.md

+    -nographic \
+    -m 2G \
+    -bios "${ovmf_path}"  \
+    -kernel "${guest_image}"


this qemu command fails to find the image for me on my ubuntu dev server:

BdsDxe: failed to load Boot0001 "Grub Bootloader" from Fv(7CB8BDC9-F8EB-4F34-AAEA-3EE4AF6516A1)/FvFile(B5AE312C-BC8A-43B1-9C62-EBB826DD5D07): Not Found BdsDxe: No bootable option was found.

If I add all the sev parameters it starts working for guest images for me.

host images appears to fail with some resources issue - tried giving it 16G memory but still got the same error. Not sure if this is some issue with my configuration or ubuntu.

as mentioned earlier, this was b/c I was using the sev-enabled firmware. But even with the non-sev firmware, host image is still not booting for me: ../src/boot/linux.c:153@linux_exec: Error starting kernel image: Out of resources - is this testing method only valid for guest images?

Ok, on my dev box, the host image took a little longer boot time compared to the guest image, but later comes up with a login page.

docs: Guide to add new mkosi images for new OS support in sev-certify…

647ff47

… project Signed-off-by: Harika Nittala <lnittala@amd.com>

LakshmiSaiHarika mentioned this pull request Feb 12, 2026

Document the process to create and test the guest and host images - publish in Github #196

Open

benland72 reviewed Feb 19, 2026

View reviewed changes

benland72 requested changes Feb 19, 2026

View reviewed changes

amd-aliem reviewed Feb 19, 2026

View reviewed changes

		@@ -0,0 +1,128 @@
		# Create, test and publish new guest/host images

		Users can create and publish new host or guest images in sev-certify with mkosi tool in the following steps:


		guest_image="$1"

		ovmf_path="${2:-/usr/share/edk2/ovmf/OVMF_CODE.fd}"

Comments

Conversation

LakshmiSaiHarika commented Feb 12, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

LakshmiSaiHarika Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

benland72 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

LakshmiSaiHarika Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

LakshmiSaiHarika Feb 19, 2026 •

edited

Loading

LakshmiSaiHarika Feb 19, 2026 •

edited

Loading