From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id ED5E0CBA7; Sat, 22 Nov 2025 01:22:39 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id 16AF9CB27; Sat, 22 Nov 2025 01:22:36 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 Received: from mail-yw1-x112a.google.com (mail-yw1-x112a.google.com [IPv6:2607:f8b0:4864:20::112a]) by atuin.qyliss.net (Postfix) with ESMTPS id 6B280CB1F for ; Sat, 22 Nov 2025 01:22:34 +0000 (UTC) Received: by mail-yw1-x112a.google.com with SMTP id 00721157ae682-78a6c7ac38fso29777637b3.0 for ; Fri, 21 Nov 2025 17:22:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1763774552; x=1764379352; darn=spectrum-os.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=ydb/VPa8PnDa3v1EplBPXJFP3zZS9JLZJiV7uCJZDXo=; b=PUEZAb/CcWEyLEsHbADXCgYgb+WDAJ8pg7NzCOCFeP6mTCN4otDGt4J7UNI03OANoW qq50xadq62y7ZW3kY1WEuLqcbmQcJ94xoIEcoLrXaxrKz4NLBg2ZYfV8ivHCJnLFaRFh 0tDp/vJgPe3amb+YZZF5RuLOkhlUIsF1g5jOWbhz9qbJsxQ8L7/FxkJeI3IaIres6QFu BqVPJYAmkyT2Mp3Jl0/lw+RTrZhKKZKkPCOxfM8YXbNVXP6BWYtu9pZWWNxBSdXNm6RS I3b3urxPt7tky0W2trsKA0g7kvogUakfUpiyD1fWRg6wG3yVdPCu9hS058btt2Lmo6rt jAdA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763774552; x=1764379352; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=ydb/VPa8PnDa3v1EplBPXJFP3zZS9JLZJiV7uCJZDXo=; b=mTMHXN1a54jG0rolvPz0Z8jSmAne/+r1OoKeoPp3WZE/gVqxJxgvIANBwmxcn/inL0 w6hvwZv53OmLY+NGhMPOR+pje1SdOQGEL3SqPqMK8UYGRv2JV/wV+ml8843Obulb6Nhn HA4qAc3Mpj/G1Wz9hyvu82kBbpaFFayVVzir5SRWwIMfKOVE9z9B9ZgtbT+CoPFSzg5E qUgDWmJirH1inmQFbtmTzRqGpoQw14w30jBf7bu6GUa6Hf3bBXgsyTBdDFaTmeuuE56Q AFIqCZP3HEryVDob6nn5Nmoi+XbG5ROsTQlFRTeor+64zpgazCaXI5apVhCujG2hV9Tu zdDQ== X-Gm-Message-State: AOJu0YxEbInWU0dQTrdG4AJsswNakrIMdBuDtfRi7QzJrR4BP4DnIu7r SRI9NViyYvOUWnjGfkC8xjjvMHml2NOxuOOkLG8ielPUuMUY5s7YFXSPHRMl8w== X-Gm-Gg: ASbGncskuweot98PaKD7crYzoKH5FAXXRmVy58xTUM+bCCv065aF2cGRXMpy0ozLerE IlDFbgJL85K+WvMJXKCQFJp86bb6SYDcswiNm7tMlRU9S5mQdrSsB4duEtKoPpl9IdATw5ySU4O RSX2EadU0I543+BG7mFZgbxc9kEl7ibnn2Nq55Glj/GYISAJKPFgDBtrr8/a5qflOK8QtA3kwsm bZieZmLhZzFtIEStIV2qCv0baCtgB6+w414Wbm9thWFoSFD1Nln+GvobTgIIO8xhR2PGQr1a3+A 3V86ZhlTUy+WLvOsD6fjNVwx4IXqg/e0agVJhB4gPPCYHCAmnrCaN7zBowOMnE3ud0haSOI8MCd bx7bvozzKhQZye4WY39Yl+7iJUms3QF8wikemLT5Ebh6d69CAqVCDagLdALcfYiDHS5+VMF1BSL hcA3A8X61dxvzZ0YI3IwVstNh/wFAkVtkUa+LLHqQaDMSF7kDhACXefji7aFML13eTCkRlGYhpb iwn/7Mg4e9nGXbAhScahIxaSTRfRvcbj0g= X-Google-Smtp-Source: AGHT+IEdbw/9Lfrr+NEqEA2YATfoAZc6uJHKk0Pe0g4HIw2NkIdOhcTw/8A0vahjiXMTWNGiEUxGkQ== X-Received: by 2002:a05:690c:d0b:b0:786:449a:176b with SMTP id 00721157ae682-78a8b4936d0mr32791317b3.21.1763774551953; Fri, 21 Nov 2025 17:22:31 -0800 (PST) Received: from localhost.localdomain (h96-60-249-169.cncrtn.broadband.dynamic.tds.net. [96.60.249.169]) by smtp.gmail.com with UTF8SMTPSA id 00721157ae682-78a7993b2afsm20659817b3.38.2025.11.21.17.22.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Nov 2025 17:22:31 -0800 (PST) From: Demi Marie Obenour Date: Fri, 21 Nov 2025 20:21:52 -0500 Subject: [PATCH v5 2/2] Move UKI creation to a separate derivation MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20251121-refactor-verity-v5-2-938fc95f9752@gmail.com> References: <20251121-refactor-verity-v5-0-938fc95f9752@gmail.com> In-Reply-To: <20251121-refactor-verity-v5-0-938fc95f9752@gmail.com> To: Spectrum OS Development X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1763774511; l=8052; i=demiobenour@gmail.com; s=20250729; h=from:subject:message-id; bh=8JsOi7KWQEipulGNnFU3wJH4BAyvQFiHnpQKvcwg0/s=; b=dHggo6n1WENiW6Z2iriDiGcZAdPv5G4XGX41aA/MZrOS+RZPTC2Yp+jaJh+ZSqRL9FWb8iF5B v/v6WikWc6XBP2DY7/K/K5ZASnnxGdosPqhqNzrIlH5/hq75Z5iMwFC X-Developer-Key: i=demiobenour@gmail.com; a=ed25519; pk=X57Q4/YQDj9t4SBeKaDwvXYKB6quZJVx/DE2Ly2out0= Message-ID-Hash: J7PMWC7JYT3BUBB2OWS2H2M26XFQFTE5 X-Message-ID-Hash: J7PMWC7JYT3BUBB2OWS2H2M26XFQFTE5 X-MailFrom: demiobenour@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Demi Marie Obenour , Alyssa Ross X-Mailman-Version: 3.3.9 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: It will be used by the update code later. No functional change intended, other than a trivial shell script refactoring. Signed-off-by: Demi Marie Obenour --- I kept release/live/default.nix using the UKI's systemd because the old code did it that way. Changing this would be better in a separate commit. --- host/efi.nix | 40 ++++++++++++++++++++++++++++++++++++++++ host/rootfs/Makefile | 8 ++++---- release/live/Makefile | 16 ++-------------- release/live/default.nix | 27 +++++++++++---------------- release/live/shell.nix | 10 ++++++++-- 5 files changed, 65 insertions(+), 36 deletions(-) diff --git a/host/efi.nix b/host/efi.nix new file mode 100644 index 0000000000000000000000000000000000000000..d0ce260bd908c186059b75a1b4f42258b0e62bff --- /dev/null +++ b/host/efi.nix @@ -0,0 +1,40 @@ +# SPDX-License-Identifier: MIT +# SPDX-FileCopyrightText: 2021-2024 Alyssa Ross +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour + +import ../lib/call-package.nix ( +{ callSpectrumPackage, config, cryptsetup, rootfs +, runCommand, stdenv, systemdUkify +}: +let + initramfs = callSpectrumPackage ./initramfs {}; + kernel = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}"; + systemd = systemdUkify.overrideAttrs ({ mesonFlags ? [], ... }: { + # The default limit is too low to build a generic aarch64 distro image: + # https://github.com/systemd/systemd/pull/37417 + mesonFlags = mesonFlags ++ [ "-Defi-stub-extra-sections=3000" ]; + }); +in + +runCommand "spectrum-efi" { + nativeBuildInputs = [ cryptsetup systemd ]; + __structuredAttrs = true; + unsafeDiscardReferences = { out = true; }; + dontFixup = true; + passthru = { inherit initramfs rootfs systemd; }; +} '' + read -r roothash < ${rootfs}/rootfs.verity.roothash + { \ + printf "[UKI]\nDeviceTreeAuto=" + if [ -d ${rootfs.kernel}/dtbs ]; then + find ${rootfs.kernel}/dtbs -name '*.dtb' -print0 | tr '\0' ' ' + fi + } | ukify build \ + --output "$out" \ + --config /dev/stdin \ + --linux ${kernel} \ + --initrd ${initramfs} \ + --os-release $'NAME="Spectrum"\n' \ + --cmdline "ro intel_iommu=on roothash=$roothash" + '' +) (_: {}) diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile index 5e3c9238f0e00f86aa5943212b8fc8fd896ce54a..aac915ffb2781aee0997c169e86e3fd1983aa3b3 100644 --- a/host/rootfs/Makefile +++ b/host/rootfs/Makefile @@ -40,6 +40,10 @@ FIFOS = etc/s6-linux-init/run-image/service/s6-svscan-log/fifo BUILD_FILES = build/etc/s6-rc +# This rule produces three files but Make only (portably) +# supports one output per rule. Instead of resorting to temporary +# files, a timestamp file is created as the last step. The actual +# outputs are produced as side-effects. build/verity-timestamp: $(ROOT_FS) $(VERITYSETUP) format \ --root-hash-file $(ROOT_FS_VERITY_ROOTHASH) \ @@ -48,10 +52,6 @@ build/verity-timestamp: $(ROOT_FS) echo >> $(ROOT_FS_VERITY_ROOTHASH) touch -- $(ROOT_FS_DIR)/verity-timestamp -# This rule produces three files but Make only (portably) -# supports one output per rule. Instead of resorting to temporary -# files, a timestamp file is created as the last step. The actual -# outputs are produced as side-effects. $(ROOT_FS): ../../scripts/make-erofs.sh $(PACKAGES_FILE) $(FILES) $(BUILD_FILES) build/empty build/fifo file-list.mk mkdir -p $(ROOT_FS_DIR) && \ { \ diff --git a/release/live/Makefile b/release/live/Makefile index 7372b41d94bfb10f7761955d9d1a246e9785b7f8..d61248e94599adc5229d0ad38d54b9f649d66ca1 100644 --- a/release/live/Makefile +++ b/release/live/Makefile @@ -19,23 +19,11 @@ $(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sf build/empty: mkdir -p $@ -build/spectrum.efi: $(DTBS) $(KERNEL) $(INITRAMFS) $(ROOT_FS_VERITY_ROOTHASH) - { \ - printf "[UKI]\nDeviceTreeAuto=" && \ - find $(DTBS) -name '*.dtb' -print0 | tr '\0' ' ' ;\ - } | $(UKIFY) build \ - --output $@ \ - --config /dev/stdin \ - --linux $(KERNEL) \ - --initrd $(INITRAMFS) \ - --os-release $$'NAME="Spectrum"\n' \ - --cmdline "ro intel_iommu=on roothash=$$(cat $(ROOT_FS_VERITY_ROOTHASH))" - -build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi +build/boot.fat: $(SYSTEMD_BOOT_EFI) $(EFI_IMAGE) build/empty $(TRUNCATE) -s 440401920 $@ $(MKFS_FAT) $@ $(MMD) -i $@ ::/EFI ::/EFI/BOOT ::/EFI/Linux - $(MCOPY) -i $@ build/spectrum.efi ::/EFI/Linux + $(MCOPY) -i $@ $(EFI_IMAGE) ::/EFI/Linux/spectrum.efi $(MCOPY) -i $@ $(SYSTEMD_BOOT_EFI) ::/EFI/BOOT/$(EFINAME) clean: diff --git a/release/live/default.nix b/release/live/default.nix index 7adaefef330daf11372cff0d2d04cca400efba1f..ac2d7a55fd4fe0c02108309ecea20e368000af0d 100644 --- a/release/live/default.nix +++ b/release/live/default.nix @@ -3,10 +3,9 @@ # SPDX-FileCopyrightText: 2022 Unikie import ../../lib/call-package.nix ( -{ callSpectrumPackage, spectrum-build-tools, rootfs, src +{ callSpectrumPackage, spectrum-build-tools, src , lib, pkgsStatic, stdenvNoCC , cryptsetup, dosfstools, jq, mtools, util-linux -, systemdUkify }: let @@ -14,14 +13,12 @@ let stdenv = stdenvNoCC; - systemd = systemdUkify.overrideAttrs ({ mesonFlags ? [], ... }: { - # The default limit is too low to build a generic aarch64 distro image: - # https://github.com/systemd/systemd/pull/37417 - mesonFlags = mesonFlags ++ [ "-Defi-stub-extra-sections=3000" ]; - }); - - initramfs = callSpectrumPackage ../../host/initramfs {}; efiArch = stdenv.hostPlatform.efiArch; + + efi = callSpectrumPackage ../../host/efi.nix {}; + + # The initramfs and rootfs must match those used to build the UKI. + inherit (efi) initramfs rootfs systemd; in stdenv.mkDerivation { @@ -40,17 +37,15 @@ stdenv.mkDerivation { sourceRoot = "source/release/live"; nativeBuildInputs = [ - cryptsetup dosfstools jq spectrum-build-tools mtools systemd util-linux + cryptsetup dosfstools jq spectrum-build-tools mtools util-linux ]; env = { - INITRAMFS = initramfs; - KERNEL = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}"; - ROOT_FS_DIR = rootfs; + KERNEL = "${efi.rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}"; + ROOT_FS_DIR = "${efi.rootfs}"; SYSTEMD_BOOT_EFI = "${systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi"; + EFI_IMAGE = efi; EFINAME = "BOOT${toUpper efiArch}.EFI"; - } // lib.optionalAttrs stdenv.hostPlatform.linux-kernel.DTB or false { - DTBS = "${rootfs.kernel}/dtbs"; }; buildFlags = [ "dest=$(out)" ]; @@ -63,6 +58,6 @@ stdenv.mkDerivation { unsafeDiscardReferences = { out = true; }; dontFixup = true; - passthru = { inherit initramfs rootfs; }; + passthru = { inherit efi initramfs rootfs; }; } ) (_: {}) diff --git a/release/live/shell.nix b/release/live/shell.nix index c5db7b732ef048b4c0cb87a4c5ea614e993db516..ffaa9a571c662810348822a5952d479d251a25e5 100644 --- a/release/live/shell.nix +++ b/release/live/shell.nix @@ -1,7 +1,12 @@ # SPDX-License-Identifier: MIT # SPDX-FileCopyrightText: 2021-2024 Alyssa Ross -import ../../lib/call-package.nix ({ callSpectrumPackage, stdenv, qemu_kvm, rootfs }: +import ../../lib/call-package.nix ( +{ callSpectrumPackage, stdenv, qemu_kvm }: + +let + efi = callSpectrumPackage ../../host/efi.nix {}; +in (callSpectrumPackage ./. {}).overrideAttrs ( { nativeBuildInputs ? [], env ? {}, ... }: @@ -10,7 +15,8 @@ import ../../lib/call-package.nix ({ callSpectrumPackage, stdenv, qemu_kvm, root env = env // { OVMF_CODE = "${qemu_kvm}/share/qemu/edk2-${stdenv.hostPlatform.qemuArch}-code.fd"; - ROOT_FS_DIR = rootfs; + ROOT_FS_DIR = efi.rootfs; + EFI_IMAGE = efi; }; } )) (_: {}) -- 2.52.0