From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id B9E2B1D2CE; Sat, 08 Nov 2025 04:49:12 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id B20081D29F; Sat, 08 Nov 2025 04:49:04 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 Received: from mail-yw1-x1133.google.com (mail-yw1-x1133.google.com [IPv6:2607:f8b0:4864:20::1133]) by atuin.qyliss.net (Postfix) with ESMTPS id 194A31D1D8 for ; Sat, 08 Nov 2025 04:48:52 +0000 (UTC) Received: by mail-yw1-x1133.google.com with SMTP id 00721157ae682-7866aca9ff4so16604607b3.3 for ; Fri, 07 Nov 2025 20:48:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1762577330; x=1763182130; darn=spectrum-os.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=/2Dt7mb/MZQanRi8DqS+9ULxt1N1Cth0v0MNfufBil0=; b=MA7KwZCfxVIkrdf1ZzKG359lOWPyg3kRBZKub5RgbERkERV2/pmbtZw5QRx5k/03eq K5KCZc1e9CU2Vfy1/Kj19lanpreWQfNUcUVKffVWRGQ5E9iHhqwtqpHInToHfW/d6l9a 3vasw5cJ1YXFl1QwkyyV0FyRbVj4FtTAiLBQtDjTWizE6gtSYTsSXcCow47yW4+6/iWf lv/TJN4c9FmqO2u3tLD8owPYIqOcSdPOSkkTo3NWDcWVxeumovdK5Lv5zk63fQ+tBxe1 g4sFmmEzAcdtidFWJY9meGont2OjvreGnJhmY08+6Y7hSK+HGZV8vIEhbeqD9wDpnptq jFAQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1762577330; x=1763182130; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=/2Dt7mb/MZQanRi8DqS+9ULxt1N1Cth0v0MNfufBil0=; b=B+rN8TeHEC9mc+0daVgxbeQwWOvrDSvKk696ZdZ0dVvej1j68M3Twj9Pu92t+HqWRi VvWru4fdKLWHwOjgmi44Sf9woK1L1L6bvIkpZGpZYdS0Tv//fqXYzD2O6wITcT7N00xx +vdFwCceK6dG0th5vJi2i9MV1Np299H3NcYe66P0A78MgDRwJ1/c2OzaSLizXcDDSiLK z0Sq5iD79LRGeFfWazI3lQvgL0ytfBi6f7fcOR+jFEU0GbLEQBnzDAP3CCg5mOfpjZI7 +8TFOfWU7j++BgpN0JDwfkYHP/G6ilqidZE134qtR/RCl9BoFWHQ1Gkvgupagb9LEFSq +pTg== X-Gm-Message-State: AOJu0YzAmr1LViWaUvyUEhhq2rfzlO/6It4JV5gI+3jTf8Hets3at9o6 eUFF8Ydz83NXoA8Ps2+ZbBllnVZzlxx1XcDM7D5TXXcp5mW6sJaj/kobdFE/KQ== X-Gm-Gg: ASbGncutNPTXXlpjMZHmzzGQHfoHxUxC95lSODY25VYi32DuxAdYz+iPz6KVknW4aPg KbGJSKCPhi5QUxTM9LNk7wGWvQeXaJ8Zmw6KBM/WPk3O33EO4lWaY1eAQ/IJ5TIcvu9bN1SgCSK 5HXpKlEFgHJ7xmgzgDsxukpOPi37p/2yTlJwLi+Cgtp0/kr+g7k+qPFZixJE5vsIsbf+S8RkdMD i8j24mCoGjFn0A/LjN4Dor6nkyViHKVoCu8QFI4I5D5IV7CQ/mPXydOyBLFNer1HWtS0e4b9w6s vCdVw8kwAoOc35ymfnxNpqOHjknf47fJGBQbc8v77FQnwcVVIRNbitCPX2LP2yyaGJ50Gg1aghC buh0Aii628RLQlZQ59Rg795W0io8gXOLC2rB+a73V3fKDyKO2lEKPQgn7hf6KOncPpR8S+tJlC7 9+bYW/MWdo5qhVJ1P885Lx6yksYiDYPtDTOuF9Ni+ZQn5c4gUib+Cw46msy5+ITMItZJBBaKQYv qdzRuvd0AtuRgEws5SjiIZZ X-Google-Smtp-Source: AGHT+IH7W4yNUhKw5sO8fHlYaOcY2dNvmtlxzgR22MGfLjHQUNDpv74bPWFfCk5gyg8G//aJ1ApoQw== X-Received: by 2002:a05:690c:6993:b0:786:5a5d:b473 with SMTP id 00721157ae682-787d54a29d7mr15524307b3.66.1762577330492; Fri, 07 Nov 2025 20:48:50 -0800 (PST) Received: from localhost.localdomain (h96-60-249-169.cncrtn.broadband.dynamic.tds.net. [96.60.249.169]) by smtp.gmail.com with UTF8SMTPSA id 00721157ae682-787d680d03esm3921217b3.5.2025.11.07.20.48.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 07 Nov 2025 20:48:50 -0800 (PST) From: Demi Marie Obenour Date: Fri, 07 Nov 2025 23:47:12 -0500 Subject: [PATCH v2 2/2] Move UKI creation to a separate derivation MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20251107-refactor-verity-v2-2-2af58b1a4a87@gmail.com> References: <20251107-refactor-verity-v2-0-2af58b1a4a87@gmail.com> In-Reply-To: <20251107-refactor-verity-v2-0-2af58b1a4a87@gmail.com> To: Spectrum OS Development X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1762577231; l=5927; i=demiobenour@gmail.com; s=20250729; h=from:subject:message-id; bh=oYb4pKOFmIiLHYwvZJJQBzVY14osr+g10EDXznM438I=; b=vTBkdxSxUdbZTIG9Pp+gAvYmkEOYqxgzWqCEr4V9TvkZwDzNogWjWmdIuNanyfQjkR9Bzg6/q IuGCTlWgaX1AyclLiCBKK2/T11QsNf317vbObNg2gmJA1RNCbcNE9o/ X-Developer-Key: i=demiobenour@gmail.com; a=ed25519; pk=X57Q4/YQDj9t4SBeKaDwvXYKB6quZJVx/DE2Ly2out0= Message-ID-Hash: ZYSST4VMPIMXFOISUEYEM2FWACTYWOE5 X-Message-ID-Hash: ZYSST4VMPIMXFOISUEYEM2FWACTYWOE5 X-MailFrom: demiobenour@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Demi Marie Obenour , Alyssa Ross X-Mailman-Version: 3.3.9 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: It will be used by the update code later. No functional change intended, other than a trivial shell script refactoring. Signed-off-by: Demi Marie Obenour --- host/efi.nix | 46 ++++++++++++++++++++++++++++++++++++++++++++++ pkgs/default.nix | 1 + release/live/Makefile | 15 ++------------- release/live/default.nix | 19 +++++-------------- 4 files changed, 54 insertions(+), 27 deletions(-) diff --git a/host/efi.nix b/host/efi.nix new file mode 100644 index 0000000000000000000000000000000000000000..a2b47fd050fbf00050473a0d5a1373eb96c341b5 --- /dev/null +++ b/host/efi.nix @@ -0,0 +1,46 @@ +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2021-2024 Alyssa Ross +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour + +import ../lib/call-package.nix ( +{ bash, callSpectrumPackage, cryptsetup, runCommand +, stdenv, systemdUkify, rootfs +}: +let + initramfs = callSpectrumPackage ./initramfs {}; + kernel = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}"; + systemd = systemdUkify.overrideAttrs ({ mesonFlags ? [], ... }: { + # The default limit is too low to build a generic aarch64 distro image: + # https://github.com/systemd/systemd/pull/37417 + mesonFlags = mesonFlags ++ [ "-Defi-stub-extra-sections=3000" ]; + }); +in + +runCommand "spectrum-efi" { + nativeBuildInputs = [ cryptsetup systemd bash ]; + __structuredAttrs = true; + unsafeDiscardReferences = { out = true; }; + dontFixup = true; + passthru = { inherit systemd; }; + env = { + DTBS = "${rootfs.kernel}/dtbs"; + KERNEL = kernel; + INITRAMFS = initramfs; + ROOTFS = rootfs; + }; +} '' + read -r roothash < "$ROOTFS/rootfs.verity.roothash" + { \ + printf "[UKI]\nDeviceTreeAuto=" + if [ -d "$DTBS" ]; then + find "$DTBS" -name '*.dtb' -print0 | tr '\0' ' ' + fi + } | ukify build \ + --output "$out" \ + --config /dev/stdin \ + --linux "$KERNEL" \ + --initrd "$INITRAMFS" \ + --os-release $'NAME="Spectrum"\n' \ + --cmdline "ro intel_iommu=on roothash=$roothash" + '' +) (_: {}) diff --git a/pkgs/default.nix b/pkgs/default.nix index cc60228a10cddcb70e5ab9faa1bab7d74f3ebb35..c9f6dcfad9369567468b30d1c5697e3551a7b236 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -36,6 +36,7 @@ let path: (import path { inherit (self) callPackage; }).override; rootfs = self.callSpectrumPackage ../host/rootfs {}; + efi = self.callSpectrumPackage ../host/efi.nix {}; spectrum-build-tools = self.callSpectrumPackage ../tools { appSupport = false; buildSupport = true; diff --git a/release/live/Makefile b/release/live/Makefile index 191b44944af0adf965e1d5f2785719b236bfd99c..4de8743f42dec65aa863c3020cd70124316a6118 100644 --- a/release/live/Makefile +++ b/release/live/Makefile @@ -19,19 +19,8 @@ $(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sf build/empty: mkdir -p $@ -build/spectrum.efi: $(DTBS) $(KERNEL) $(INITRAMFS) $(ROOT_FS_VERITY_ROOTHASH) - { \ - printf "[UKI]\nDeviceTreeAuto=" && \ - find $(DTBS) -name '*.dtb' -print0 | tr '\0' ' ' ;\ - } | $(UKIFY) build \ - --output $@ \ - --config /dev/stdin \ - --linux $(KERNEL) \ - --initrd $(INITRAMFS) \ - --os-release $$'NAME="Spectrum"\n' \ - --cmdline "ro intel_iommu=on roothash=$$(cat "$$ROOT_FS_VERITY_ROOTHASH")" - -build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi +build/boot.fat: $(SYSTEMD_BOOT_EFI) $(EFI_IMAGE) build/empty + ln -sf -- "$$EFI_IMAGE" build/spectrum.efi $(TRUNCATE) -s 440401920 $@ $(MKFS_FAT) $@ $(MMD) -i $@ ::/EFI ::/EFI/BOOT ::/EFI/Linux diff --git a/release/live/default.nix b/release/live/default.nix index 9a62d4da9cfea11d94d2a1d5764d41587efd5ad5..c234d87e62cc9ae65ba60f94bab6e58b43beddbc 100644 --- a/release/live/default.nix +++ b/release/live/default.nix @@ -6,7 +6,7 @@ import ../../lib/call-package.nix ( { callSpectrumPackage, spectrum-build-tools, rootfs, src , lib, pkgsStatic, stdenvNoCC , cryptsetup, dosfstools, jq, mtools, util-linux -, systemdUkify +, systemdUkify, efi }: let @@ -14,13 +14,6 @@ let stdenv = stdenvNoCC; - systemd = systemdUkify.overrideAttrs ({ mesonFlags ? [], ... }: { - # The default limit is too low to build a generic aarch64 distro image: - # https://github.com/systemd/systemd/pull/37417 - mesonFlags = mesonFlags ++ [ "-Defi-stub-extra-sections=3000" ]; - }); - - initramfs = callSpectrumPackage ../../host/initramfs {}; efiArch = stdenv.hostPlatform.efiArch; in @@ -40,19 +33,17 @@ stdenv.mkDerivation { sourceRoot = "source/release/live"; nativeBuildInputs = [ - cryptsetup dosfstools jq spectrum-build-tools mtools systemd util-linux + cryptsetup dosfstools jq spectrum-build-tools mtools util-linux ]; env = { - INITRAMFS = initramfs; KERNEL = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}"; ROOT_FS = "${rootfs}/rootfs"; ROOT_FS_VERITY = "${rootfs}/rootfs.verity.superblock"; ROOT_FS_VERITY_ROOTHASH = "${rootfs}/rootfs.verity.roothash"; - SYSTEMD_BOOT_EFI = "${systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi"; + SYSTEMD_BOOT_EFI = "${efi.systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi"; + EFI_IMAGE = efi; EFINAME = "BOOT${toUpper efiArch}.EFI"; - } // lib.optionalAttrs stdenv.hostPlatform.linux-kernel.DTB or false { - DTBS = "${rootfs.kernel}/dtbs"; }; buildFlags = [ "dest=$(out)" ]; @@ -65,6 +56,6 @@ stdenv.mkDerivation { unsafeDiscardReferences = { out = true; }; dontFixup = true; - passthru = { inherit initramfs rootfs; }; + passthru = { inherit rootfs; }; } ) (_: {}) -- 2.51.2