From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id DDAAEEC3C; Wed, 05 Nov 2025 22:34:36 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id E5BB8EBFD; Wed, 05 Nov 2025 22:34:34 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 Received: from mail-yw1-x112f.google.com (mail-yw1-x112f.google.com [IPv6:2607:f8b0:4864:20::112f]) by atuin.qyliss.net (Postfix) with ESMTPS id 9288BEB65 for ; Wed, 05 Nov 2025 22:34:33 +0000 (UTC) Received: by mail-yw1-x112f.google.com with SMTP id 00721157ae682-781421f5be6so3575297b3.0 for ; Wed, 05 Nov 2025 14:34:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1762382072; x=1762986872; darn=spectrum-os.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=UIvx+yskczecid3skQtU0V/fKtvnK/lFZVHxkuj7DWA=; b=ioEl3ogmepqXyftskirDfSIqH0rLLhwV5PNGrfi9x6e/d19wXqc68EFgrYY+3W/ft/ o+2ZodBl2isgTwB/rO79iGNrGCrll0G7j+DrSkQAl+r7ydnqkMNouufSJHEfI+j86bv4 gUweIJTsaGfxOI7PjZp9r2sLjfB+PIU0B7K18PcRpz0FaP+HDQ7bgXEVO6ZQWqiyyo3o ETQP1Fx1HSClTKd21+YjX0hBumHw1ExOn8WJnf5qka0dZeTvdX+fNDTAxPdRi3U8dnEO 3iu0vsOOIQu7pqifgHZp9xF+5cTi8GX0rHiTgUZ9OUT2hg4khclm7+IBL3AbgvtqJzwI CyRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1762382072; x=1762986872; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=UIvx+yskczecid3skQtU0V/fKtvnK/lFZVHxkuj7DWA=; b=p/FawvTWfdJd+erbspBbfpEdy/6v5j/KWPc2TynX1lwgEhxsMSCOKDV0yeOcCGutvx oHjyDNYDom34V6sQxc2fxZUDBW4F2YqaEYa71/oGSNWkXMxUmB2aTu6IHqVXx4ODJQwz rW6y02+eTI7yaH/rPyVCLCA//C7EzibFUzBbWTCuIsknqjCx7F5K75e44qcPSnoAXm6K ZSPCp8/rWbz0Cv0yWwGq5cqIHuVtQhRndxu01t8qMuf4DXTy2NckZuHfZdH3FNNv7y7Z 4KnTbDj863/0v4KoRNgBlsgUkoAsYgCYd85DePRxnzZUtDHyMkfFWRl0Q8mKzAnjGmy9 6njA== X-Gm-Message-State: AOJu0YyeF8dKPTYBSqvPCUczl5Od8/mQx6NcovudA8nHnv6eVnbcrCbr XrHiTEMXPAiHPPgeRebNLWgv0gE1HhjiB+Wvl2AH9xpqMiH3x0X8uI/8yeq3FFBv X-Gm-Gg: ASbGnctvxfdgqpcvvulU8nS3vP/46zMtca31Tef/UoUZlGFeedBRbTh+7iMF0/BsJBD IDTU6juN5YSo6ayoRA5cJbPY79C1Ns0BCN1WMax+EweO5HHBnBMy9NX697IxLWyOiRjNAT5/T4g +vfudCcQFMZLIjTBWSOjtbQiR1D6IO/hWs2qQ+Ukqtl+8fWveHzfkk5cBe1Z9Svaq/uf9c28+WX 7CTyWBdtTz1BpbHQLQDo8t8AmgGkQjUhUrILzt91cJjNn6YIsxm421Oqz2tUosawDsK6qXthfb9 090iS+GGh4IgL8KrcPuXTV2qPSa7bYyuRdZpwfEU1Eu+uSDyPESsO9+e2LNEez/hTZtkAEtW7rA KzfHotlDl4HaVuPk7EoCE7cYzm+UOlXi70kWy1vCEiJSunV2md8YotHLpCt8yx1ZL9//1kj49d9 r5VG3fn1RiPu2lOJCyF3x1/YuoV7Wwnh8mftW5z3PvF7HolvaXc91KIWUjBzs1fGsbk4IXtj3iN Ea902hcew8aVkzKzVih59Ku X-Google-Smtp-Source: AGHT+IEjayXHnrEyJ692BOMb617Vmho03iPrXK3x7ExhUUP/5dGFdCqJbKO/EZdIzGF4wsmZlQppdA== X-Received: by 2002:a05:690c:b0b:b0:786:8172:e21 with SMTP id 00721157ae682-786a41a3b83mr47579747b3.56.1762382071852; Wed, 05 Nov 2025 14:34:31 -0800 (PST) Received: from localhost.localdomain (h96-60-249-169.cncrtn.broadband.dynamic.tds.net. [96.60.249.169]) by smtp.gmail.com with UTF8SMTPSA id 00721157ae682-787b159b659sm2680897b3.28.2025.11.05.14.34.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 05 Nov 2025 14:34:31 -0800 (PST) From: Demi Marie Obenour Date: Wed, 05 Nov 2025 17:33:32 -0500 Subject: [PATCH 1/2] Create Nix derivation for building verity images MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20251105-refactor-verity-v1-1-b8ba27dfdf06@gmail.com> References: <20251105-refactor-verity-v1-0-b8ba27dfdf06@gmail.com> In-Reply-To: <20251105-refactor-verity-v1-0-b8ba27dfdf06@gmail.com> To: Spectrum OS Development X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1762382012; l=13902; i=demiobenour@gmail.com; s=20250729; h=from:subject:message-id; bh=nBJILqi/MHV2P/VTVK+7MQlg/rWjZR5d3n9EBv6yPIg=; b=vEmdP1/goOhXCIlPBgmXS7JGxJnmYSb8m6htVCwlPpmNGGg3Z4UCAM5p/8+MWcRD0jgYc5b5L V6ROto0AvX4Dn26TmS4GY/uU8Xru3LPgjM9I0aMWXjRAyp/mIlnICf8 X-Developer-Key: i=demiobenour@gmail.com; a=ed25519; pk=X57Q4/YQDj9t4SBeKaDwvXYKB6quZJVx/DE2Ly2out0= Message-ID-Hash: WN5VPHFFTVLZDQYJO6YW57HY76GTKS6H X-Message-ID-Hash: WN5VPHFFTVLZDQYJO6YW57HY76GTKS6H X-MailFrom: demiobenour@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Demi Marie Obenour , Alyssa Ross X-Mailman-Version: 3.3.9 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This gets rid of a lot of duplicated code and allows building the verity roothash and superblock only when needed. It also removes a hack used to work around make limitations. Furthermore, 'veritysetup --root-hash-file' is used to avoid an awk script. Signed-off-by: Demi Marie Obenour --- nix-shell --pure --run 'make run' in host/initramfs fails. This is a preexisting bug and I will send a separate patch for it. --- host/initramfs/Makefile | 25 +++++-------------------- host/initramfs/shell.nix | 4 +++- host/rootfs/Makefile | 24 +++++------------------- host/rootfs/shell.nix | 3 +++ host/verity.nix | 19 +++++++++++++++++++ lib/common.mk | 1 - pkgs/default.nix | 1 + release/live/Makefile | 26 +++++--------------------- release/live/default.nix | 4 +++- 9 files changed, 44 insertions(+), 63 deletions(-) diff --git a/host/initramfs/Makefile b/host/initramfs/Makefile index cb13fbb35f065b67d291d4a35591d6f12720060c..5c8c0eb2e50efcef33d78f91b562d8e79a76a900 100644 --- a/host/initramfs/Makefile +++ b/host/initramfs/Makefile @@ -35,26 +35,11 @@ build/mountpoints: cd build/mountpoints && mkdir -p $(MOUNTPOINTS) find build/mountpoints -mindepth 1 -exec touch -d @0 {} ';' -# veritysetup format produces two files, but Make only (portably) -# supports one output per rule, so we combine the two outputs then -# define two more rules to separate them again. -build/rootfs.verity: $(ROOT_FS) - mkdir -p build - $(VERITYSETUP) format $(ROOT_FS) build/rootfs.verity.superblock.tmp \ - | awk -F ':[[:blank:]]*' '$$1 == "Root hash" {print $$2; exit}' \ - > build/rootfs.verity.roothash.tmp - cat build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp \ - > $@ - rm build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp -build/rootfs.verity.roothash: build/rootfs.verity - head -n 1 build/rootfs.verity > $@ -build/rootfs.verity.superblock: build/rootfs.verity - tail -n +2 build/rootfs.verity > $@ -build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/rootfs.verity.superblock build/rootfs.verity.roothash $(ROOT_FS) +build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk $(ROOT_FS_VERITY) $(ROOT_FS_VERITY_ROOTHASH) $(ROOT_FS) ../../scripts/make-gpt.sh $@.tmp \ - build/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \ - $(ROOT_FS):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)") + "$$ROOT_FS_VERITY:verity:$$(../../scripts/format-uuid.sh "$$(dd "if=$$ROOT_FS_VERITY_ROOTHASH" bs=32 skip=1 count=1 status=none)")" \ + $(dest):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 "$$ROOT_FS_VERITY_ROOTHASH")") mv $@.tmp $@ build/loop.tar: build/live.img @@ -69,12 +54,12 @@ clean: rm -rf build .PHONY: clean -run: $(dest) build/rootfs.verity.roothash $(RUN_IMAGE) +run: $(dest) $(RUN_IMAGE) $(ROOT_FS_VERITY_ROOTHASH) @../../scripts/run-qemu.sh -m 4G \ -machine virtualization=on \ -kernel $(KERNEL) \ -initrd $(dest) \ - -append "ro earlycon console=hvc0 intel_iommu=on roothash=$$(< build/rootfs.verity.roothash) nokaslr" \ + -append "ro earlycon console=hvc0 intel_iommu=on roothash=$$(< "$$ROOT_FS_VERITY_ROOTHASH") nokaslr" \ -cpu max \ -gdb unix:build/gdb.sock,server,nowait \ -parallel none \ diff --git a/host/initramfs/shell.nix b/host/initramfs/shell.nix index eeba865e3ac793f67ae1808a92cf5eb1b37d57af..3e2abd17d2a989aa056d6f20633c624717e6b775 100644 --- a/host/initramfs/shell.nix +++ b/host/initramfs/shell.nix @@ -3,7 +3,7 @@ import ../../lib/call-package.nix ( { callSpectrumPackage, rootfs, pkgsStatic, stdenv -, cryptsetup, qemu_kvm, tar2ext4, util-linux +, cryptsetup, qemu_kvm, tar2ext4, util-linux, verity }: let @@ -18,5 +18,7 @@ initramfs.overrideAttrs ({ nativeBuildInputs ? [], env ? {}, ... }: { env = env // { KERNEL = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}"; ROOT_FS = rootfs; + ROOT_FS_VERITY = "${verity}/rootfs.verity.superblock"; + ROOT_FS_VERITY_ROOTHASH = "${verity}/rootfs.verity.roothash"; }; })) (_: {}) diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile index 00d125774bb7b98736d0928c69cb307740cee034..bb602e2745fb5873204f453b35fc529c5c96f64a 100644 --- a/host/rootfs/Makefile +++ b/host/rootfs/Makefile @@ -82,25 +82,11 @@ clean: rm -rf build .PHONY: clean -# veritysetup format produces two files, but Make only (portably) -# supports one output per rule, so we combine the two outputs then -# define two more rules to separate them again. -build/rootfs.verity: $(dest) - $(VERITYSETUP) format $(dest) build/rootfs.verity.superblock.tmp \ - | awk -F ':[[:blank:]]*' '$$1 == "Root hash" {print $$2; exit}' \ - > build/rootfs.verity.roothash.tmp - cat build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp \ - > $@ - rm build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp -build/rootfs.verity.roothash: build/rootfs.verity - head -n 1 build/rootfs.verity > $@ -build/rootfs.verity.superblock: build/rootfs.verity - tail -n +2 build/rootfs.verity > $@ -build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/rootfs.verity.superblock build/rootfs.verity.roothash $(dest) +build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk $(ROOT_FS_VERITY) $(ROOT_FS_VERITY_ROOTHASH) $(dest) ../../scripts/make-gpt.sh $@.tmp \ - build/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \ - $(dest):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)") + "$$ROOT_FS_VERITY:verity:$$(../../scripts/format-uuid.sh "$$(dd "if=$$ROOT_FS_VERITY_ROOTHASH" bs=32 skip=1 count=1 status=none)")" \ + $(dest):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 "$$ROOT_FS_VERITY_ROOTHASH")") mv $@.tmp $@ debug: @@ -110,7 +96,7 @@ debug: $(VMLINUX) .PHONY: debug -run: build/live.img $(EXT_FS) build/rootfs.verity.roothash +run: build/live.img $(EXT_FS) $(ROOT_FS_VERITY_ROOTHASH) @set -x && \ ext="$$(mktemp build/spectrum-rootfs-extfs.XXXXXXXXXX.img)" && \ truncate -s 10G "$$ext" && \ @@ -131,7 +117,7 @@ run: build/live.img $(EXT_FS) build/rootfs.verity.roothash -device virtconsole,chardev=virtiocon0 \ -drive file=build/live.img,if=virtio,format=raw,readonly=on \ -drive file=/proc/self/fd/3,if=virtio,format=raw \ - -append "earlycon console=hvc0 roothash=$$(< build/rootfs.verity.roothash) intel_iommu=on nokaslr" \ + -append "earlycon console=hvc0 roothash=$$(< "$$ROOT_FS_VERITY_ROOTHASH") intel_iommu=on nokaslr" \ -device virtio-keyboard \ -device virtio-mouse \ -device virtio-gpu \ diff --git a/host/rootfs/shell.nix b/host/rootfs/shell.nix index 1bf61bebf418333624e799cc8ca231f5783206f4..f16e4905adfbc8faebde19d0a1364ad9df90219b 100644 --- a/host/rootfs/shell.nix +++ b/host/rootfs/shell.nix @@ -5,6 +5,7 @@ import ../../lib/call-package.nix ( { callSpectrumPackage, rootfs, pkgsStatic, srcOnly, stdenv , btrfs-progs, cryptsetup, jq, netcat, qemu_kvm, reuse, util-linux +, verity }: rootfs.overrideAttrs ( @@ -20,5 +21,7 @@ rootfs.overrideAttrs ( KERNEL = "${passthru.kernel}/${stdenv.hostPlatform.linux-kernel.target}"; LINUX_SRC = srcOnly passthru.kernel.configfile; VMLINUX = "${passthru.kernel.dev}/vmlinux"; + ROOT_FS_VERITY = "${verity}/rootfs.verity.superblock"; + ROOT_FS_VERITY_ROOTHASH = "${verity}/rootfs.verity.roothash"; }; })) (_: {}) diff --git a/host/verity.nix b/host/verity.nix new file mode 100644 index 0000000000000000000000000000000000000000..b144c4e270e8aa874b38c0aec69b6d99393a14b9 --- /dev/null +++ b/host/verity.nix @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2021-2024 Alyssa Ross +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour + +import ../lib/call-package.nix ({ cryptsetup, runCommand, rootfs }: +runCommand "spectrum-verity" { + nativeBuildInputs = [ cryptsetup ]; + __structuredAttrs = true; + unsafeDiscardReferences = { out = true; }; + dontFixup = true; + env = { ROOTFS = rootfs; }; +} '' + mkdir -- "$out" + veritysetup format "--root-hash-file=$out/rootfs.verity.roothash" \ + -- "$ROOTFS" "$out/rootfs.verity.superblock" + # veritysetup doesn't append a newline, so the shell read command fails + echo >> "$out/rootfs.verity.roothash" + '' +) (_: {}) diff --git a/lib/common.mk b/lib/common.mk index 277c3544036d9a9057f8ba4ad37fe2207548cc59..f4aa15ef8fc053ae61a8d875eac4fc6a094411c6 100644 --- a/lib/common.mk +++ b/lib/common.mk @@ -15,7 +15,6 @@ S6_IPCSERVER_SOCKETBINDER = s6-ipcserver-socketbinder TAR = tar TRUNCATE = truncate UKIFY = ukify -VERITYSETUP = veritysetup VIRTIOFSD = virtiofsd PACKAGES_FILE != \ diff --git a/pkgs/default.nix b/pkgs/default.nix index cc60228a10cddcb70e5ab9faa1bab7d74f3ebb35..bc02f6b2f532f3ee1a2ea3aa45de3c9561bbb6ab 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -36,6 +36,7 @@ let path: (import path { inherit (self) callPackage; }).override; rootfs = self.callSpectrumPackage ../host/rootfs {}; + verity = self.callSpectrumPackage ../host/verity.nix {}; spectrum-build-tools = self.callSpectrumPackage ../tools { appSupport = false; buildSupport = true; diff --git a/release/live/Makefile b/release/live/Makefile index 6dcbdeedda5d6ccf293f60dc62043f46c81ecf83..191b44944af0adf965e1d5f2785719b236bfd99c 100644 --- a/release/live/Makefile +++ b/release/live/Makefile @@ -9,17 +9,17 @@ DTBS ?= build/empty dest = build/live.img -$(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/boot.fat build/rootfs.verity.superblock build/rootfs.verity.roothash $(ROOT_FS) +$(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/boot.fat $(ROOT_FS_VERITY) $(ROOT_FS_VERITY_ROOTHASH) $(ROOT_FS) ../../scripts/make-gpt.sh $@.tmp \ build/boot.fat:c12a7328-f81f-11d2-ba4b-00a0c93ec93b \ - build/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \ - $(ROOT_FS):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)") + "$$ROOT_FS_VERITY":verity:$$(../../scripts/format-uuid.sh "$$(dd if="$$ROOT_FS_VERITY_ROOTHASH" bs=32 skip=1 count=1 status=none)") \ + $(ROOT_FS):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 "$$ROOT_FS_VERITY_ROOTHASH")") mv $@.tmp $@ build/empty: mkdir -p $@ -build/spectrum.efi: build/rootfs.verity.roothash $(DTBS) $(KERNEL) $(INITRAMFS) +build/spectrum.efi: $(DTBS) $(KERNEL) $(INITRAMFS) $(ROOT_FS_VERITY_ROOTHASH) { \ printf "[UKI]\nDeviceTreeAuto=" && \ find $(DTBS) -name '*.dtb' -print0 | tr '\0' ' ' ;\ @@ -29,7 +29,7 @@ build/spectrum.efi: build/rootfs.verity.roothash $(DTBS) $(KERNEL) $(INITRAMFS) --linux $(KERNEL) \ --initrd $(INITRAMFS) \ --os-release $$'NAME="Spectrum"\n' \ - --cmdline "ro intel_iommu=on roothash=$$(cat build/rootfs.verity.roothash)" + --cmdline "ro intel_iommu=on roothash=$$(cat "$$ROOT_FS_VERITY_ROOTHASH")" build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi $(TRUNCATE) -s 440401920 $@ @@ -38,22 +38,6 @@ build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi $(MCOPY) -i $@ build/spectrum.efi ::/EFI/Linux $(MCOPY) -i $@ $(SYSTEMD_BOOT_EFI) ::/EFI/BOOT/$(EFINAME) -# veritysetup format produces two files, but Make only (portably) -# supports one output per rule, so we combine the two outputs then -# define two more rules to separate them again. -build/rootfs.verity: $(ROOT_FS) - mkdir -p build - $(VERITYSETUP) format $(ROOT_FS) build/rootfs.verity.superblock.tmp \ - | awk -F ':[[:blank:]]*' '$$1 == "Root hash" {print $$2; exit}' \ - > build/rootfs.verity.roothash.tmp - cat build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp \ - > $@ - rm build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp -build/rootfs.verity.roothash: build/rootfs.verity - head -n 1 build/rootfs.verity > $@ -build/rootfs.verity.superblock: build/rootfs.verity - tail -n +2 build/rootfs.verity > $@ - clean: rm -rf build .PHONY: clean diff --git a/release/live/default.nix b/release/live/default.nix index 2a1dc3e1dd939f21edac582bf39737eb4d46eb0c..32901f00a270f6dae005563b2e4082ad225c61e1 100644 --- a/release/live/default.nix +++ b/release/live/default.nix @@ -6,7 +6,7 @@ import ../../lib/call-package.nix ( { callSpectrumPackage, spectrum-build-tools, rootfs, src , lib, pkgsStatic, stdenvNoCC , cryptsetup, dosfstools, jq, mtools, util-linux -, systemdUkify +, systemdUkify, verity }: let @@ -47,6 +47,8 @@ stdenv.mkDerivation { INITRAMFS = initramfs; KERNEL = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}"; ROOT_FS = rootfs; + ROOT_FS_VERITY = "${verity}/rootfs.verity.superblock"; + ROOT_FS_VERITY_ROOTHASH = "${verity}/rootfs.verity.roothash"; SYSTEMD_BOOT_EFI = "${systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi"; EFINAME = "BOOT${toUpper efiArch}.EFI"; } // lib.optionalAttrs stdenv.hostPlatform.linux-kernel.DTB or false { -- 2.51.2