[PATCH v3 11/14] release: Create directory with system update

[Demi Marie Obenour <demiobenour@gmail.com>]

Whenever a release is made, create a directory with the release files to
be used for an update.  After its SHA256SSUMS file is signed, the file
is ready to be uploaded to a server for users to update from.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
Changes since v2:
- Use UUIDs to name the rootfs and verity superblock.
  This will allow systemd-sysupdate to set the correct UUIDs on the
  rootfs and verity partitions, avoiding the need to use labels to find
  these partitions.
---
 release.nix        |  2 ++
 release/update.nix | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/release.nix b/release.nix
index a4fe66ee5925aeee3a1f5f1fac249c595cee0885..704abb39a3d01152eac3dfe313066834c3cd0a66 100644
--- a/release.nix
+++ b/release.nix
@@ -8,5 +8,7 @@ import lib/call-package.nix ({ callSpectrumPackage }: {
 
   checks = callSpectrumPackage release/checks {};
 
+  updates = callSpectrumPackage release/update.nix {};
+
   combined = callSpectrumPackage release/combined/run-vm.nix {};
 }) (_: {})
diff --git a/release/update.nix b/release/update.nix
new file mode 100644
index 0000000000000000000000000000000000000000..77eb5fc422baa7d13e8e3ccb823c2fe69d2c39cc
--- /dev/null
+++ b/release/update.nix
@@ -0,0 +1,33 @@
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: 2021-2024 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+
+import ../lib/call-package.nix (
+{ callSpectrumPackage, config, runCommand, stdenv }:
+
+let
+  efi = import ../host/efi.nix {};
+in
+runCommand "spectrum-update-directory" {
+  __structuredAttrs = true;
+  unsafeDiscardReferences = { out = true; };
+  dontFixup = true;
+  env = { VERSION = config.version; };
+} ''
+  # One would expect that this is enabled already but it is not.
+  set -euo pipefail
+  mkdir -- "$out"
+  cd -- "$out"
+  read -r roothash < ${efi.rootfs}/rootfs.verity.roothash
+  if ! [[ "$roothash" =~ ^[0-9a-f]{64}$ ]]; then
+    printf 'Internal error: bad root hash %q\n' "$roothash"
+    exit 1
+  fi
+  cp -- ${efi} "Spectrum_$VERSION.efi"
+  cp -- ${efi.rootfs}/rootfs.verity.superblock "Spectrum_''${VERSION}_''${roothash:32:32}.verity"
+  cp -- ${efi.rootfs}/rootfs "Spectrum_''${VERSION}_''${roothash:0:32}.root"
+  sha256sum -b "Spectrum_$VERSION.efi" \
+    "Spectrum_''${VERSION}_''${roothash:32:32}.verity" \
+    "Spectrum_''${VERSION}_''${roothash:0:32}.root" > SHA256SUMS
+  ''
+) (_: {})

-- 
2.52.0