From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id 6D1E31D299; Sat, 08 Nov 2025 04:49:04 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id BAA191D1DA; Sat, 08 Nov 2025 04:48:58 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 Received: from mail-yx1-xb12d.google.com (mail-yx1-xb12d.google.com [IPv6:2607:f8b0:4864:20::b12d]) by atuin.qyliss.net (Postfix) with ESMTPS id D5A8F1D1D7 for ; Sat, 08 Nov 2025 04:48:50 +0000 (UTC) Received: by mail-yx1-xb12d.google.com with SMTP id 956f58d0204a3-63fd0bf1f4aso1066570d50.3 for ; Fri, 07 Nov 2025 20:48:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1762577329; x=1763182129; darn=spectrum-os.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=/GeApoqoiwNURqEzaARtVZpf/iGAe20273QZOgBhuCo=; b=MCm1JhGivXG3Mu5JZpxjKtZGfU84c3T5H3EKikL57fVO3UzMQwn52zLfu+LbbbGSt9 xNBcrHYUUA8n8S+07UG8PfDNo+BUmQVxFQptt0+OwNcuSB8+LI4R8CtL0S5YCeK0zLrF wZgJsmwSYUDDVBGMJCNlAKALh9cyNnTsel0+26xRgfEhTe6Vfg86kDf59g7aONPZ7nP4 gg+Ng1N7uEhG3MZWKjdENwQomSsgFjQaOgZGyvUq2keUQsz9HphozFoY9T3JYAzXLmov oi4Zy/HWNPGTMb+Hmodz/wvNqpBM2anlCTAp750Qq6pWuZ7+UxBv4l/4LUHpdJPiBaNE 2FJw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1762577329; x=1763182129; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=/GeApoqoiwNURqEzaARtVZpf/iGAe20273QZOgBhuCo=; b=j4gTF9DwqRtXJtYZiAMPc85/KdwnzA0Dr59hFauTj0rMo5GDp4a/iUNBN5pkjV+793 kpp8IN2JfkEEUDd2NosbNKWCRLGlpEUsGW/6m3VgD9QeAU47r0PDq/4cOtuL0V49xzn7 NypxCXZFGFO2t/p0qkRG3ZLs8pcOum/d+0H+BCc9nstE7xq/qUwblmfsQFvmqvWWJE4a 71zDz7np+b4uhFO6Is5ij7Lh76WDl49QXhkwpjAfSWXLDKvZLuHpdOLUlkH6hBRPUa09 tHdpoCAVI1HAEu9cILRlo5vPs/p27E85rwNVs5g5nBkL9U2Nu+z7TkID4GlqZK4LTDCV 3sOg== X-Gm-Message-State: AOJu0YyHmIy4CB0/eOvwAXqhUA7ymqXIFUvRZnMe5PDXuXnvLZgZI3gC JnYlbx66P6hTlp/Y7daZm61KragIFK9cVKDptWJhCFNnYLq2HeL4mGG+rbNKpA== X-Gm-Gg: ASbGncvYz1zDUe8+MwvkMheNYzbaAHBjypE8h3f/0dVE2dcJxx5M0/t5oc+3OzLfuKZ beBX6vhlwI6XDeNrlJUPN5nTtgEmKEx4ruxCFXxKNMOS8FpNkB6VCrX+tQTwB3TITg6rkLs22i6 HZwmQz4q0Rbc7Og7ibKLWwKW3fwqDTcLrd2JFwYfXAKrq3f7dxylftbxq4GuYpKbKshV3HJBWIv AH+HcCaV4OrXUNHxeJB5hwVpZDNEQx0Sh3wa+g/kw2AGILodeQv2FxAqA6sRk/7uRvvlIXCzoXr 0I84ME6VOW7iA7rLt4M3Zn0cyGTif8I7WOPBQ/7mfRd4ZfOQS3qA9M100Ted9zchNJ1BmMWE6yQ RJNcriO7WluqHONQzPzpJbuBIGYR5eNIptHijENfe/MGnd7HaAA6ShFc46erd98kFgHWfQD/fej VGVxlJHpjv7hr64athokZTI806j3cZfO0MjeyaCaTqgbbR/Blw89+EgW06mUkff5XEFDzlEBxIJ 6OW0AB8zz4yOpxDSPDgs75/ X-Google-Smtp-Source: AGHT+IHGBVUBBhNeOAJ1oMPorKT6/CD626tAC/1CXQmGdh4otre5bOC5eMU4tl1wrvQK9FOC/HlHqQ== X-Received: by 2002:a05:690e:42c6:b0:63f:a8db:47b4 with SMTP id 956f58d0204a3-640d4522b0cmr998121d50.3.1762577328808; Fri, 07 Nov 2025 20:48:48 -0800 (PST) Received: from localhost.localdomain (h96-60-249-169.cncrtn.broadband.dynamic.tds.net. [96.60.249.169]) by smtp.gmail.com with UTF8SMTPSA id 956f58d0204a3-640b5dacc52sm2447157d50.26.2025.11.07.20.48.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 07 Nov 2025 20:48:48 -0800 (PST) From: Demi Marie Obenour Date: Fri, 07 Nov 2025 23:47:11 -0500 Subject: [PATCH v2 1/2] Build verity images in rootfs Nix derivation MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20251107-refactor-verity-v2-1-2af58b1a4a87@gmail.com> References: <20251107-refactor-verity-v2-0-2af58b1a4a87@gmail.com> In-Reply-To: <20251107-refactor-verity-v2-0-2af58b1a4a87@gmail.com> To: Spectrum OS Development X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1762577231; l=12898; i=demiobenour@gmail.com; s=20250729; h=from:subject:message-id; bh=DekhdANQIL54bIS7zUoxGk048X0HPVgKvSs45uwWEOI=; b=3m+VhoSC6jtCW7ZWezATctu9ziXyCEM11mmEXOTf8nKEFkJegEz8D24tAADJmKpdvtx2ze9eH s7ESseIGlc8CGfLlrlzUWu2KY+++zUKC3iAd5vNrp1EK7AyrgVIy/8X X-Developer-Key: i=demiobenour@gmail.com; a=ed25519; pk=X57Q4/YQDj9t4SBeKaDwvXYKB6quZJVx/DE2Ly2out0= Message-ID-Hash: 3X3EPXWCA3K7ELPFOA4ILR66QS5VJY4Z X-Message-ID-Hash: 3X3EPXWCA3K7ELPFOA4ILR66QS5VJY4Z X-MailFrom: demiobenour@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Demi Marie Obenour , Alyssa Ross X-Mailman-Version: 3.3.9 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Avoid redundant rebuilds of the rootfs verity superblock and roothash. Remove duplicate code. Clean up Makefile to avoid temporary files. Signed-off-by: Demi Marie Obenour --- host/initramfs/Makefile | 26 +++++--------------------- host/initramfs/shell.nix | 4 +++- host/rootfs/Makefile | 44 +++++++++++++++++++++----------------------- host/rootfs/default.nix | 2 +- host/rootfs/shell.nix | 2 +- release/live/Makefile | 26 +++++--------------------- release/live/default.nix | 4 +++- 7 files changed, 39 insertions(+), 69 deletions(-) diff --git a/host/initramfs/Makefile b/host/initramfs/Makefile index cb13fbb35f065b67d291d4a35591d6f12720060c..102870ecba4456303414e2531ea592473ddfc1cf 100644 --- a/host/initramfs/Makefile +++ b/host/initramfs/Makefile @@ -35,26 +35,10 @@ build/mountpoints: cd build/mountpoints && mkdir -p $(MOUNTPOINTS) find build/mountpoints -mindepth 1 -exec touch -d @0 {} ';' -# veritysetup format produces two files, but Make only (portably) -# supports one output per rule, so we combine the two outputs then -# define two more rules to separate them again. -build/rootfs.verity: $(ROOT_FS) - mkdir -p build - $(VERITYSETUP) format $(ROOT_FS) build/rootfs.verity.superblock.tmp \ - | awk -F ':[[:blank:]]*' '$$1 == "Root hash" {print $$2; exit}' \ - > build/rootfs.verity.roothash.tmp - cat build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp \ - > $@ - rm build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp -build/rootfs.verity.roothash: build/rootfs.verity - head -n 1 build/rootfs.verity > $@ -build/rootfs.verity.superblock: build/rootfs.verity - tail -n +2 build/rootfs.verity > $@ - -build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/rootfs.verity.superblock build/rootfs.verity.roothash $(ROOT_FS) +build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk $(ROOT_FS_VERITY) $(ROOT_FS_VERITY_ROOTHASH) $(ROOT_FS) ../../scripts/make-gpt.sh $@.tmp \ - build/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \ - $(ROOT_FS):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)") + "$$ROOT_FS_VERITY:verity:$$(../../scripts/format-uuid.sh "$$(dd "if=$$ROOT_FS_VERITY_ROOTHASH" bs=32 skip=1 count=1 status=none)")" \ + $(dest):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 "$$ROOT_FS_VERITY_ROOTHASH")") mv $@.tmp $@ build/loop.tar: build/live.img @@ -69,12 +53,12 @@ clean: rm -rf build .PHONY: clean -run: $(dest) build/rootfs.verity.roothash $(RUN_IMAGE) +run: $(dest) $(RUN_IMAGE) $(ROOT_FS_VERITY_ROOTHASH) @../../scripts/run-qemu.sh -m 4G \ -machine virtualization=on \ -kernel $(KERNEL) \ -initrd $(dest) \ - -append "ro earlycon console=hvc0 intel_iommu=on roothash=$$(< build/rootfs.verity.roothash) nokaslr" \ + -append "ro earlycon console=hvc0 intel_iommu=on roothash=$$(< "$$ROOT_FS_VERITY_ROOTHASH") nokaslr" \ -cpu max \ -gdb unix:build/gdb.sock,server,nowait \ -parallel none \ diff --git a/host/initramfs/shell.nix b/host/initramfs/shell.nix index 8b47aa53bc19a818ebf563e281f22e82202a8ea5..fef8198685564bef2d8d673e0dc9403ee9c9a444 100644 --- a/host/initramfs/shell.nix +++ b/host/initramfs/shell.nix @@ -17,6 +17,8 @@ initramfs.overrideAttrs ({ nativeBuildInputs ? [], env ? {}, ... }: { env = env // { KERNEL = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}"; - ROOT_FS = rootfs; + ROOT_FS = "${rootfs}/rootfs"; + ROOT_FS_VERITY = "${rootfs}/rootfs.verity.superblock"; + ROOT_FS_VERITY_ROOTHASH = "${rootfs}/rootfs.verity.roothash"; }; })) (_: {}) diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile index 00d125774bb7b98736d0928c69cb307740cee034..d7764d9b796f1773b4bebd0d50eec52b9be29e42 100644 --- a/host/rootfs/Makefile +++ b/host/rootfs/Makefile @@ -6,7 +6,7 @@ include ../../lib/common.mk include file-list.mk -dest = build/rootfs.erofs +dest = build DIRS = \ dev \ @@ -46,14 +46,27 @@ FIFOS = etc/s6-linux-init/run-image/service/s6-svscan-log/fifo BUILD_FILES = build/etc/s6-rc -$(dest): ../../scripts/make-erofs.sh $(PACKAGES_FILE) $(FILES) $(BUILD_FILES) build/empty build/fifo file-list.mk +# This rule produces three files but Make only (portably) +# supports one output per rule. Instead of resorting to temporary +# files, a timestamp file is created as the last step. The actual +# outputs are produced as side-effects. +$(dest)/timestamp: ../../scripts/make-erofs.sh $(PACKAGES_FILE) $(FILES) $(BUILD_FILES) build/empty build/fifo file-list.mk $(dest) { \ cat $(PACKAGES_FILE) ;\ for file in $(FILES) $(LINKS); do printf '%s\n%s\n' $$file "$${file#image/}"; done ;\ for file in $(BUILD_FILES); do printf '%s\n%s\n' $$file $${file#build/}; done ;\ printf 'build/empty\n%s\n' $(DIRS) ;\ printf 'build/fifo\n%s\n' $(FIFOS) ;\ - } | ../../scripts/make-erofs.sh $@ + } | ../../scripts/make-erofs.sh $(dest)/rootfs + $(VERITYSETUP) format \ + --root-hash-file $(dest)/rootfs.verity.roothash \ + -- $(dest)/rootfs $(dest)/rootfs.verity.superblock + # Add trailing newline + echo >> $(dest)/rootfs.verity.roothash + touch -- $(dest)/timestamp + +$(dest): + mkdir -p $(dest) build/fifo: mkdir -p build @@ -82,25 +95,10 @@ clean: rm -rf build .PHONY: clean -# veritysetup format produces two files, but Make only (portably) -# supports one output per rule, so we combine the two outputs then -# define two more rules to separate them again. -build/rootfs.verity: $(dest) - $(VERITYSETUP) format $(dest) build/rootfs.verity.superblock.tmp \ - | awk -F ':[[:blank:]]*' '$$1 == "Root hash" {print $$2; exit}' \ - > build/rootfs.verity.roothash.tmp - cat build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp \ - > $@ - rm build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp -build/rootfs.verity.roothash: build/rootfs.verity - head -n 1 build/rootfs.verity > $@ -build/rootfs.verity.superblock: build/rootfs.verity - tail -n +2 build/rootfs.verity > $@ - -build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/rootfs.verity.superblock build/rootfs.verity.roothash $(dest) +build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk $(dest)/timestamp ../../scripts/make-gpt.sh $@.tmp \ - build/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \ - $(dest):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)") + $(dest)/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=$(dest)/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \ + $(dest)/rootfs:root:$$(../../scripts/format-uuid.sh "$$(head -c 32 $(dest)/rootfs.verity.roothash)") mv $@.tmp $@ debug: @@ -110,7 +108,7 @@ debug: $(VMLINUX) .PHONY: debug -run: build/live.img $(EXT_FS) build/rootfs.verity.roothash +run: build/live.img @set -x && \ ext="$$(mktemp build/spectrum-rootfs-extfs.XXXXXXXXXX.img)" && \ truncate -s 10G "$$ext" && \ @@ -131,7 +129,7 @@ run: build/live.img $(EXT_FS) build/rootfs.verity.roothash -device virtconsole,chardev=virtiocon0 \ -drive file=build/live.img,if=virtio,format=raw,readonly=on \ -drive file=/proc/self/fd/3,if=virtio,format=raw \ - -append "earlycon console=hvc0 roothash=$$(< build/rootfs.verity.roothash) intel_iommu=on nokaslr" \ + -append "earlycon console=hvc0 roothash=$$(< $(dest)/rootfs.verity.roothash) intel_iommu=on nokaslr" \ -device virtio-keyboard \ -device virtio-mouse \ -device virtio-gpu \ diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix index 0d79f7ca54ccc86eb0fa6e743f2011237d365f24..453629d03d4b2b7e6bc49de5419321fc6b27f431 100644 --- a/host/rootfs/default.nix +++ b/host/rootfs/default.nix @@ -145,7 +145,7 @@ stdenvNoCC.mkDerivation { }; sourceRoot = "source/host/rootfs"; - nativeBuildInputs = [ erofs-utils spectrum-build-tools s6-rc ]; + nativeBuildInputs = [ cryptsetup erofs-utils spectrum-build-tools s6-rc ]; env = { PACKAGES = runCommand "packages" {} '' diff --git a/host/rootfs/shell.nix b/host/rootfs/shell.nix index 1bf61bebf418333624e799cc8ca231f5783206f4..6df2f575fdfc7cdf8067ccfdb5fecaad9f6ea5e6 100644 --- a/host/rootfs/shell.nix +++ b/host/rootfs/shell.nix @@ -12,7 +12,7 @@ rootfs.overrideAttrs ( { nativeBuildInputs = nativeBuildInputs ++ [ - btrfs-progs cryptsetup jq netcat qemu_kvm reuse util-linux + btrfs-progs jq netcat qemu_kvm reuse util-linux ]; env = env // { diff --git a/release/live/Makefile b/release/live/Makefile index 6dcbdeedda5d6ccf293f60dc62043f46c81ecf83..191b44944af0adf965e1d5f2785719b236bfd99c 100644 --- a/release/live/Makefile +++ b/release/live/Makefile @@ -9,17 +9,17 @@ DTBS ?= build/empty dest = build/live.img -$(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/boot.fat build/rootfs.verity.superblock build/rootfs.verity.roothash $(ROOT_FS) +$(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/boot.fat $(ROOT_FS_VERITY) $(ROOT_FS_VERITY_ROOTHASH) $(ROOT_FS) ../../scripts/make-gpt.sh $@.tmp \ build/boot.fat:c12a7328-f81f-11d2-ba4b-00a0c93ec93b \ - build/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \ - $(ROOT_FS):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)") + "$$ROOT_FS_VERITY":verity:$$(../../scripts/format-uuid.sh "$$(dd if="$$ROOT_FS_VERITY_ROOTHASH" bs=32 skip=1 count=1 status=none)") \ + $(ROOT_FS):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 "$$ROOT_FS_VERITY_ROOTHASH")") mv $@.tmp $@ build/empty: mkdir -p $@ -build/spectrum.efi: build/rootfs.verity.roothash $(DTBS) $(KERNEL) $(INITRAMFS) +build/spectrum.efi: $(DTBS) $(KERNEL) $(INITRAMFS) $(ROOT_FS_VERITY_ROOTHASH) { \ printf "[UKI]\nDeviceTreeAuto=" && \ find $(DTBS) -name '*.dtb' -print0 | tr '\0' ' ' ;\ @@ -29,7 +29,7 @@ build/spectrum.efi: build/rootfs.verity.roothash $(DTBS) $(KERNEL) $(INITRAMFS) --linux $(KERNEL) \ --initrd $(INITRAMFS) \ --os-release $$'NAME="Spectrum"\n' \ - --cmdline "ro intel_iommu=on roothash=$$(cat build/rootfs.verity.roothash)" + --cmdline "ro intel_iommu=on roothash=$$(cat "$$ROOT_FS_VERITY_ROOTHASH")" build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi $(TRUNCATE) -s 440401920 $@ @@ -38,22 +38,6 @@ build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi $(MCOPY) -i $@ build/spectrum.efi ::/EFI/Linux $(MCOPY) -i $@ $(SYSTEMD_BOOT_EFI) ::/EFI/BOOT/$(EFINAME) -# veritysetup format produces two files, but Make only (portably) -# supports one output per rule, so we combine the two outputs then -# define two more rules to separate them again. -build/rootfs.verity: $(ROOT_FS) - mkdir -p build - $(VERITYSETUP) format $(ROOT_FS) build/rootfs.verity.superblock.tmp \ - | awk -F ':[[:blank:]]*' '$$1 == "Root hash" {print $$2; exit}' \ - > build/rootfs.verity.roothash.tmp - cat build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp \ - > $@ - rm build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp -build/rootfs.verity.roothash: build/rootfs.verity - head -n 1 build/rootfs.verity > $@ -build/rootfs.verity.superblock: build/rootfs.verity - tail -n +2 build/rootfs.verity > $@ - clean: rm -rf build .PHONY: clean diff --git a/release/live/default.nix b/release/live/default.nix index 2a1dc3e1dd939f21edac582bf39737eb4d46eb0c..9a62d4da9cfea11d94d2a1d5764d41587efd5ad5 100644 --- a/release/live/default.nix +++ b/release/live/default.nix @@ -46,7 +46,9 @@ stdenv.mkDerivation { env = { INITRAMFS = initramfs; KERNEL = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}"; - ROOT_FS = rootfs; + ROOT_FS = "${rootfs}/rootfs"; + ROOT_FS_VERITY = "${rootfs}/rootfs.verity.superblock"; + ROOT_FS_VERITY_ROOTHASH = "${rootfs}/rootfs.verity.roothash"; SYSTEMD_BOOT_EFI = "${systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi"; EFINAME = "BOOT${toUpper efiArch}.EFI"; } // lib.optionalAttrs stdenv.hostPlatform.linux-kernel.DTB or false { -- 2.51.2