feat: don't build ovmf

.devcontainer/devcontainer.json

@@ -1,5 +1,5 @@
 {
-  "image": "ghcr.io/dfinity/ic-dev@sha256:eae27468101cff14340905c9b6d1fc6caebe339c7ed474d8fee6d35015c04d61",
+  "image": "ghcr.io/dfinity/ic-dev@sha256:9d622eb47c59dd4aed1031903831c63edbcc81ebafa3f2c80d8db98c8b771db9",
   "remoteUser": "ubuntu",
   "privileged": true,
   "runArgs": [

.github/workflows/api-bn-recovery-test.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host
         --mount type=tmpfs,target="/home/buildifier/.local/share/containers"

.github/workflows/ci-main.yml

@@ -33,7 +33,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
          -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 90

.github/workflows/ci-pr-only.yml

@@ -37,7 +37,7 @@ jobs:
     runs-on: &dind-small-setup
       labels: dind-small
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
          -e NODE_NAME --mount type=tmpfs,target="/tmp/containers"
     steps:

.github/workflows/container-api-bn-recovery.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host
         --mount type=tmpfs,target="/home/buildifier/.local/share/containers"

.github/workflows/container-scan-nightly.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 60

.github/workflows/local-system-tests.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
          -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 600

.github/workflows/pocket-ic-tests-windows.yml

@@ -45,7 +45,7 @@ jobs:
   bazel-build-pocket-ic:
     name: Bazel Build PocketIC
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 90

.github/workflows/rate-limits-backend-release.yml

@@ -32,7 +32,7 @@ jobs:
       labels: dind-large
 
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info --mount type=tmpfs,target="/tmp/containers"
 

.github/workflows/release-testing.yml

@@ -35,7 +35,7 @@ jobs:
       group: dm1
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
          -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 180

.github/workflows/rosetta-release.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     environment: DockerHub

.github/workflows/salt-sharing-canister-release.yml

@@ -32,7 +32,7 @@ jobs:
       labels: dind-large
 
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info --mount type=tmpfs,target="/tmp/containers"
 

.github/workflows/schedule-daily-bare-metal.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     environment: Bare Metal Tests

.github/workflows/schedule-daily.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 720 # 12 hours

.github/workflows/schedule-rust-bench.yml

@@ -24,7 +24,7 @@ jobs:
       # see linux-x86-64 runner group
       labels: rust-benchmarks
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       # running on bare metal machine using ubuntu user
       options: --user ubuntu --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 720 # 12 hours

.github/workflows/system-tests-benchmarks-nightly.yml

@@ -17,7 +17,7 @@ jobs:
       group: dm1
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 480

.github/workflows/update-mainnet-canister-revisions.yaml

@@ -25,7 +25,7 @@ jobs:
       labels: dind-small
     environment: CREATE_PR
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:88eab17245eb00929dddf0eadbab2e359952e06c440c890420ba257409e30149
+      image: ghcr.io/dfinity/ic-build@sha256:78e4ccf43ec2cac7a3812a28ea34bccb74bed8c35af361737af9ce42a73eb48d
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info --mount type=tmpfs,target="/tmp/containers"
     env:

BUILD.bazel

@@ -391,3 +391,19 @@ genrule(
         "@platforms//os:linux",  # technically: Ubuntu/Debian with dpkg-deb
     ],
 )
+
+# OVMF_SEV.fd -- AMD SEV-SNP confidential VM firmware, extracted the same way
+# from the `ovmf-amdsev` `.deb` (see MODULE.bazel for the `ovmf_amdsev_deb`
+# http_file). That package is currently only available in Debian sid
+# (https://packages.debian.org/sid/ovmf-amdsev), hence pulling it from a
+# snapshot.debian.org snapshot rather than a stable release mirror.
+genrule(
+    name = "ovmfsev_code",
+    srcs = ["@ovmf_amdsev_deb//file"],
+    outs = ["OVMF_SEV.fd"],
+    cmd = "dpkg-deb --fsys-tarfile $(execpath @ovmf_amdsev_deb//file) | tar -xO ./usr/share/ovmf/OVMF.amdsev.fd > $@",
+    tags = ["manual"],
+    target_compatible_with = [
+        "@platforms//os:linux",  # technically: Ubuntu/Debian with dpkg-deb
+    ],
+)

MODULE.bazel

@@ -337,6 +337,18 @@ http_file(
     url = "https://snapshot.ubuntu.com/ubuntu/20260422T000000Z/pool/main/e/edk2-hwe/ovmf-generic-hwe_2025.11-3ubuntu8_all.deb",
 )
 
+# OVMF (UEFI) firmware for AMD SEV-SNP confidential VMs, extracted from the
+# `ovmf-amdsev` `.deb` (see https://packages.debian.org/sid/ovmf-amdsev). Same
+# rationale as `ovmf_deb` above: no official prebuilt firmware, so we pull it
+# from a `.deb` snapshot instead of `rules_distroless` to avoid bloating the
+# lockfile.
+http_file(
+    name = "ovmf_amdsev_deb",
+    downloaded_file_path = "ovmf-amdsev.deb",
+    sha256 = "4655196c4e3131c77f172a17d422beba350f09e8385f2e55e3abda83276781fe",
+    url = "https://snapshot.debian.org/archive/debian/20260403T143651Z/pool/main/e/edk2/ovmf-amdsev_2025.11-5_all.deb",
+)
+
 # TLA+ tools
 bazel_dep(name = "rules_java", version = "9.3.0")
 

ci/container/TAG

@@ -1 +1 @@
-285e2d5f1b7bc3735765c70b70504aad04c171c7ee7ebae00c03f24d608cd688
+134e4606f2dcedf81ada22866dc2df2a26fda5ccac2caf61e682d7da1c51185b

ci/container/files/packages.common

@@ -20,7 +20,7 @@ pkg-config
 libclang-dev
 libunwind-dev # required for the cargo build of ic-canister-sandbox-backend-lib crate (see: rs/canister_sandbox/src/backtrace.c)
 libusb-1.0-0-dev # required for HSM
-lld # required for ovmf_sev genrule
+lld # used as the default system linker for cargo builds (see ci/container/Dockerfile)
 protobuf-compiler # needed by cargo for prost-build/tonic-build (Bazel brings its own)
 llvm
 
@@ -29,15 +29,13 @@ clang
 cryptsetup-bin
 faketime
 fdisk
-iasl # to build OVMF
 ipmitool # to connect to baremetal test instances
  # Linked in by IC-OS binaries for managing encrypted disks.
 libcryptsetup-dev
 libselinux-dev
 libsystemd-dev
  # Linked in by IC-OS binaries for managing virtual machines programmatically.
 libvirt-dev
-nasm # to build OVMF
 podman
 rsync
 zstd

ic-os/defs.bzl

@@ -283,7 +283,7 @@ def icos_build(
             native.genrule(
                 name = "generate-" + launch_measurements,
                 outs = [launch_measurements],
-                srcs = ["//ic-os/components/ovmf:ovmf_sev", boot_args, ":extracted_initrd.img", ":extracted_vmlinuz"],
+                srcs = ["//:ovmfsev_code", boot_args, ":extracted_initrd.img", ":extracted_vmlinuz"],
                 visibility = visibility,
                 tools = ["//ic-os:sev-snp-measure"],
                 tags = ["manual"],
@@ -295,7 +295,7 @@ def icos_build(
                             # Note: We only create launch measurements for the TEE boot arg variants
                             # (BOOT_ARGS_TEE_A and BOOT_ARGS_TEE_B)
                             for cmdline in "$$BOOT_ARGS_TEE_A" "$$BOOT_ARGS_TEE_B"; do
-                                hex=$$($(execpath //ic-os:sev-snp-measure) --mode snp --vcpus $$vcpus --ovmf "$(execpath //ic-os/components/ovmf:ovmf_sev)" --vcpu-type "$$vcpu_type" --append "$$cmdline" --initrd "$(location extracted_initrd.img)" --kernel "$(location extracted_vmlinuz)")
+                                hex=$$($(execpath //ic-os:sev-snp-measure) --mode snp --vcpus $$vcpus --ovmf "$(execpath //:ovmfsev_code)" --vcpu-type "$$vcpu_type" --append "$$cmdline" --initrd "$(location extracted_initrd.img)" --kernel "$(location extracted_vmlinuz)")
                                 # Convert hex string to decimal list, e.g. "abcd" ->  171\\n205
                                 measurement=$$(echo -n "$$hex" | fold -w2 | sed "s/^/0x/" | xargs printf "%d\n")
                                 jq -na --arg cmd "$$cmdline" --arg m "$$measurement" --arg vcpu_type "$$vcpu_type" '{

ic-os/guestos/defs.bzl

@@ -26,7 +26,7 @@ def image_deps(mode, malicious = False):
 
         # Extra files to be added to rootfs and bootfs
         "bootfs": {
-            "//ic-os/components/ovmf:ovmf_sev": "/OVMF_SEV.fd:0644",
+            "//:ovmfsev_code": "/OVMF_SEV.fd:0644",
         },
         "rootfs": {
             # additional files to install