feat(ipe): add signed policy loading and Azure mode selection

[aadhar-agarwal]

Problem

IPE runtime selection and signing provenance were coupled, while enforcing is not implemented yet.

Fix

Split runtime intent into ipeMode: disabled|audit|enforcing and signing provenance into ipeSigningMode: ephemeral|esrp. Builds reject enforcing; a manual runtime request logs that it is unsupported and remains inactive. The sole optional artifact marker is ipe-signing-mode, and runtime mode is never persisted.

Canonical disabled/audit tags and legacy off/permissive aliases remain supported. Azure smoke validation checks the exact initial audit tag, active state, reboot transitions, and enforcing fallback. No enforce=1 behavior is added.

Verification

github-acl-pr-validation 1194641 passed. Exact-ref audit/ephemeral Azure smoke 1194640 passed, including both VM conversions and all reboot transitions. Local IPE suites and final code review passed.

Shared landing timeline

The full implementation in PR 28754 will land as five reviewable PRs.

• Validate exact ACL and ACL Pipelines refs with production defaults disabled.
• Merge Mantle PR 34 and validate Trusted Launch/VHD fallback.
• Complete direct dev-image boot validation.
• 1/5 Candidate contract — PR 29034.
• 2/5 Offline IPE signing tools.
• 3/5 Definition 5425 ESRP signing transaction.
• 4/5 Exact gallery certificate publication.
• 5/5 Final gallery trust and exact-image validation.
• Merge ACL PR 52 and backport to release/3.0.
• Enable audit/ESRP IPE in a follow-up PR.

[Copilot]

Pull request overview

Adds opt-in IPE support to Azure Secure Boot UKI images, including signed policies, dm-verity signatures, and IMDS-based permissive mode.

Changes:

• Builds and loads signed IPE policies with signed /usr root hashes.
• Adds Azure Trusted Launch certificate forwarding and runtime validation.
• Adds supporting tests, CI parameters, documentation, and package fixes.

Reviewed changes

Copilot reviewed 35 out of 35 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
sdk_lib/sdk_entry.sh	Forwards validated IPE settings.
sdk_lib/sdk_container_common.sh	Adds version-file fallback.
run_sdk_container	Streams external policies into containers.
run_azure_tests.sh	Forwards Trusted Launch settings.
image_to_vm.sh	Reuses IPE signing certificates.
ci-automation/vendor-testing/azure.sh	Configures Trusted Launch and certificates.
build_library/rpm/uki_install.sh	Signs and installs verity companions.
build_library/rpm/sign_uki_ephemeral.sh	Supports shared signing certificates.
build_library/rpm/rpm_install.sh	Installs signed policies and multi-RPM mappings.
build_library/rpm/package_catalog.yaml	Adds explicit libgomp dependencies.
build_library/rpm/ipe_verity.sh	Serializes validated root hashes.
build_library/rpm/ensure_ephemeral_cert.sh	Generates shared ephemeral certificates.
build_library/rpm/dracut_install.sh	Installs the IPE loader module.
build_library/rpm/additional_files/ipe/acl-ipe-boot-policy.pol	Defines the IPE execution policy.
build_library/rpm/additional_files/dracut-acl-selinux-toggle/module-setup.sh	Installs the shared profile helper.
build_library/rpm/additional_files/dracut-acl-selinux-toggle/acl-selinux-toggle.sh	Uses shared IMDS parsing.
build_library/rpm/additional_files/dracut-acl-ipe-load/module-setup.sh	Defines the IPE dracut module.
build_library/rpm/additional_files/dracut-acl-ipe-load/acl-ipe-load.sh	Selects and activates IPE mode.
build_library/rpm/additional_files/dracut-acl-ipe-load/acl-ipe-load.service	Orders early policy loading.
build_library/rpm/additional_files/acl-node-security-profile.sh	Fetches and caches IMDS profiles.
build_library/build_image_util.sh	Integrates policy installation.
acl/validate/validate_common.sh	Forwards host-test timeouts.
acl/tests/test-run-sdk-container-ipe-policy.sh	Tests policy streaming and reuse.
acl/tests/test-rpm-provider-selection.sh	Tests multi-package mappings.
acl/tests/test-ipe-policy-input.sh	Tests policy preparation and validation.
acl/tests/test-ipe-loader-runtime.sh	Tests runtime mode selection.
acl/tests/test-azure-security-profile-test-common.sh	Tests timeout contracts.
acl/tests/run-selinux-toggle-test.sh	Reuses shared Azure helpers.
acl/tests/run-ipe-permissive-test.sh	Validates permissive IPE behavior.
acl/tests/run-ipe-mode-toggle-test.sh	Tests reboot-based IPE selection.
acl/tests/azure-security-profile-test-common.sh	Shares Azure tag/reboot logic.
acl/docs/BUILD_RPM_IMAGE_README.md	Documents policy build inputs.
acl/docs/architecture.md	Documents IPE and verity architecture.
acl/build_rpm_image.sh	Adds IPE configuration and validation.
.pipelines/github-pr-validation.yml	Adds validation parameters.

Suppressed comments (1)

acl/docs/BUILD_RPM_IMAGE_README.md:173

• The external-policy example also omits ACL_IPE_CAPABLE=true, so the supplied artifact is validated but never installed because rpm_install_ipe_policy returns immediately for the default disabled capability. Update this command to opt into IPE explicitly.

./acl/build_rpm_image.sh --rebuild \
  --ipe-policy-mode=external \
  --ipe-policy-path=/secure/input/acl.pol.p7b

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.