From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id BDAEBAF7A; Wed, 26 Nov 2025 18:59:16 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id 9C009AF83; Wed, 26 Nov 2025 18:59:13 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 Received: from mail-yx1-xb12d.google.com (mail-yx1-xb12d.google.com [IPv6:2607:f8b0:4864:20::b12d]) by atuin.qyliss.net (Postfix) with ESMTPS id 01F31AEFC for ; Wed, 26 Nov 2025 18:59:11 +0000 (UTC) Received: by mail-yx1-xb12d.google.com with SMTP id 956f58d0204a3-64107188baeso88347d50.3 for ; Wed, 26 Nov 2025 10:59:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1764183549; x=1764788349; darn=spectrum-os.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=rLFCiIq2p4B0GemPG/zRdoKS9fYw7N/MggP4wsqT4pU=; b=BrrP7OBYtfuSWYHwV6wtzBxuWbyyu2Qon4yJd4SRj+Qs2EAU975p6KX+Z7EQgX3QDM /kwsUsEHZXue96LYTWlw5cE+FTflp2gxA8HOoSRCh+NWJAcQ3LXGTDK8x5M8yKUhzH/F hhKG97UHus1jj01+PrPVS6/9ecak0LI2O4UB0p0ZF6hpLFlJVhdjHKwz5banQjgeUqwM zAGwcUBBMculJzITLW/6B/g/9hu5KE+vO3GTLZq87cnHZvd6ZUcUkw0dI06VdC5eoctB BlT20evYv0moNgNLHuGBq5XXjCdbffnXpHIKCg+wihRolPCMmLkDkRTkNTGD5RZ6zQwT XE4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764183549; x=1764788349; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=rLFCiIq2p4B0GemPG/zRdoKS9fYw7N/MggP4wsqT4pU=; b=IAH/RZP5s1ZWDY5j4aI8TWTcGQ6u8/Yah5JlpXUmGih74QF4R5hMizUOkR676qKyrC NcXmk1KwmoiHZXxTi1YfIe9+mjPgilFg5JBL69X39vB9HXOWDHIMoZYWzUWqLTjpwqZ5 HqGPFvK04hLc9c52vbmKz2hA5+eLscZjqvu6+4bZhKBnDQ9k0SOSO3GBpPBV8gX3nP1h 1DaTcfpQrbPE7xem27gtQCM+81EZgbv5q9qhXUScLN5Ql9ORWTmCvzU74jfjqlIvkU57 BTl8jtmAZ+VMY6oHg59zdh9Xs19d+pu8YzhxflHXvA4nX/zZyPuEe3WsHzIqTgvXiR1a Yucw== X-Gm-Message-State: AOJu0YzaNdEapEcccmJK9FiHHloUTxAp5Uw2iQN6P8aQpXI0nh7/WNBo EUX4VwJ616m3FVQ8nLezkicXFfq0jh+6tDDyCC8eFMCCa2Ax1UB8fJQxmtxmbw== X-Gm-Gg: ASbGncvqGHNibV4e6LZMUIiQYZVqHrci4AZFdsNCiJgA4wTNgPRjsAkhj8WzyMKX6ZR 85clfDC64RKwYZ3irQWLcGLUexUUuVtiqXx/cXu2zEmYkA6ePkTaJ0DdI0PQ1RHOy2YJg95Fg+o 4yrh9oFJdAA/Vhdg4awoSGAUaRg/87PBiVI6ZLDO4YQgb81B8ksHqWB7oXLWM//f9i/EGvaMkum csp/VKHKVcF6n5dzLZ/wayr7+8NTuNepRCsW02EkC3mRgT7weO7MMNbdg3+VyqiW9BEPgZPgxWT fslFKG5dL3z3e0ZHjG8GbKUCUeyW5Mf1KD3Ie+J4p/pfW3vS47Xjnl5u8IWTaVdvIqqMuX8Jznv 4KnkN86ti56MHwK1d7HQuoUyAOiLctPq08Sz3wKlBsj46jUClzBnAroTg1Uj30KXrmuAGfaVkCg NgbHI/q82leRNHNdZdchuMPSfJ6AshEbmWG2zcP8UA/cZ1z2bD2Cm0NauVPelBuvOFxRQQ0vEPz t8IjXx0gG6wtdpVoRV+GV/jxUUO9Mr3SPA= X-Google-Smtp-Source: AGHT+IHS6AYbPZVGtQKIeDG0VEAM0JsA52pHAS1pbyFGiZtHX6O/TuAYmKQFRGRO4SWzSME0HJlyhQ== X-Received: by 2002:a05:690e:143:b0:63e:1f47:f504 with SMTP id 956f58d0204a3-64302b11795mr10545572d50.50.1764183548661; Wed, 26 Nov 2025 10:59:08 -0800 (PST) Received: from localhost.localdomain (h96-60-249-169.cncrtn.broadband.dynamic.tds.net. [96.60.249.169]) by smtp.gmail.com with UTF8SMTPSA id 956f58d0204a3-642f7178739sm7648696d50.14.2025.11.26.10.59.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 26 Nov 2025 10:59:08 -0800 (PST) From: Demi Marie Obenour Date: Wed, 26 Nov 2025 13:58:23 -0500 Subject: [PATCH v5 1/2] Build verity images in rootfs Nix derivation MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20251126-refactor-verity-v5-1-0aa3d8bd180d@gmail.com> References: <20251126-refactor-verity-v5-0-0aa3d8bd180d@gmail.com> In-Reply-To: <20251126-refactor-verity-v5-0-0aa3d8bd180d@gmail.com> To: Spectrum OS Development X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1764183502; l=13918; i=demiobenour@gmail.com; s=20250729; h=from:subject:message-id; bh=fDTyWoOrHZBGymvUlqLWdBRMdnbzVS0SCMC1eVWDevM=; b=+kLgQoFoVffw8FToNd6A0VS74zDnDit7BXZHbziUVjL+8C9REtp1kHIcTi10jXqiaSiSAZ8BG QMYS6N9b84fDQ9viS4FOu6totxw22n4f4woWjgab+ZrQIIfftRO1+Wu X-Developer-Key: i=demiobenour@gmail.com; a=ed25519; pk=X57Q4/YQDj9t4SBeKaDwvXYKB6quZJVx/DE2Ly2out0= Message-ID-Hash: G7KHBWUJZR32OZCNT5RH7RTLVUVSLVMQ X-Message-ID-Hash: G7KHBWUJZR32OZCNT5RH7RTLVUVSLVMQ X-MailFrom: demiobenour@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Demi Marie Obenour , Alyssa Ross X-Mailman-Version: 3.3.9 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Avoid redundant rebuilds of the rootfs verity superblock and roothash. Remove duplicate code. Clean up Makefile to avoid temporary files. Signed-off-by: Demi Marie Obenour --- Changes since v5: - Use consistent naming scheme for Make variables: ROOT_FS is the directory containing the artifacts. ROOT_FS_IMAGE is the root filesystem image, ROOT_FS_VERITY is the verity image, and ROOT_FS_VERITY_ROOTHASH is its root filesystem hash. - Do not try to use a file as a directory. - Use $@ where possible. - Use consistent indentation. Signed-off-by: Demi Marie Obenour --- host/initramfs/Makefile | 26 +++++--------------------- host/initramfs/default.nix | 1 + host/rootfs/Makefile | 44 ++++++++++++++++++++++---------------------- host/rootfs/default.nix | 6 ++++-- host/rootfs/shell.nix | 2 +- lib/common.mk | 4 ++++ release/live/Makefile | 26 +++++--------------------- release/live/shell.nix | 3 ++- 8 files changed, 44 insertions(+), 68 deletions(-) diff --git a/host/initramfs/Makefile b/host/initramfs/Makefile index cb13fbb35f065b67d291d4a35591d6f12720060c..f27f5e07c4707914962197b4fea8f385729370aa 100644 --- a/host/initramfs/Makefile +++ b/host/initramfs/Makefile @@ -35,26 +35,10 @@ build/mountpoints: cd build/mountpoints && mkdir -p $(MOUNTPOINTS) find build/mountpoints -mindepth 1 -exec touch -d @0 {} ';' -# veritysetup format produces two files, but Make only (portably) -# supports one output per rule, so we combine the two outputs then -# define two more rules to separate them again. -build/rootfs.verity: $(ROOT_FS) - mkdir -p build - $(VERITYSETUP) format $(ROOT_FS) build/rootfs.verity.superblock.tmp \ - | awk -F ':[[:blank:]]*' '$$1 == "Root hash" {print $$2; exit}' \ - > build/rootfs.verity.roothash.tmp - cat build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp \ - > $@ - rm build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp -build/rootfs.verity.roothash: build/rootfs.verity - head -n 1 build/rootfs.verity > $@ -build/rootfs.verity.superblock: build/rootfs.verity - tail -n +2 build/rootfs.verity > $@ - -build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/rootfs.verity.superblock build/rootfs.verity.roothash $(ROOT_FS) +build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk $(ROOT_FS_IMAGES) ../../scripts/make-gpt.sh $@.tmp \ - build/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \ - $(ROOT_FS):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)") + $(ROOT_FS_VERITY):verity:$$(../../scripts/format-uuid.sh "$$(dd if=$(ROOT_FS_VERITY_ROOTHASH) bs=32 skip=1 count=1 status=none)") \ + $(ROOT_FS_IMAGE):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 $(ROOT_FS_VERITY_ROOTHASH))") mv $@.tmp $@ build/loop.tar: build/live.img @@ -69,12 +53,12 @@ clean: rm -rf build .PHONY: clean -run: $(dest) build/rootfs.verity.roothash $(RUN_IMAGE) +run: $(dest) $(RUN_IMAGE) $(ROOT_FS_VERITY_ROOTHASH) @../../scripts/run-qemu.sh -m 4G \ -machine virtualization=on \ -kernel $(KERNEL) \ -initrd $(dest) \ - -append "ro earlycon console=hvc0 intel_iommu=on roothash=$$(< build/rootfs.verity.roothash) nokaslr" \ + -append "ro earlycon console=hvc0 intel_iommu=on roothash=$$(< $(ROOT_FS_VERITY_ROOTHASH)) nokaslr" \ -cpu max \ -gdb unix:build/gdb.sock,server,nowait \ -parallel none \ diff --git a/host/initramfs/default.nix b/host/initramfs/default.nix index d35e1b514ec48015f5110e65e5ae944b28244c4f..16c932600c0ab54cf439dc7931fc12e863677e0e 100644 --- a/host/initramfs/default.nix +++ b/host/initramfs/default.nix @@ -105,6 +105,7 @@ stdenvNoCC.mkDerivation { env = { PACKAGES_CPIO = packagesCpio; + ROOT_FS = rootfs; } // lib.optionalAttrs stdenvNoCC.hostPlatform.isx86_64 { MICROCODE = microcode; }; diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile index 4067be0c45cc83ce4670ed76e956db58f8e93e02..4cb048ac08b3265b0435d6ff6fc612a58c169ce9 100644 --- a/host/rootfs/Makefile +++ b/host/rootfs/Makefile @@ -1,12 +1,13 @@ # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2021-2024 Alyssa Ross +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour .POSIX: include ../../lib/common.mk include file-list.mk -dest = build/rootfs.erofs +ROOT_FS = build DIRS = \ dev \ @@ -40,8 +41,22 @@ FIFOS = etc/s6-linux-init/run-image/service/s6-svscan-log/fifo BUILD_FILES = build/etc/s6-rc -$(dest): ../../scripts/make-erofs.sh $(PACKAGES_FILE) $(FILES) $(BUILD_FILES) build/empty build/fifo file-list.mk - set -euo pipefail; \ +# This rule produces three files but Make only (portably) +# supports one output per rule. Instead of resorting to temporary +# files, a timestamp file is created as the last step. The actual +# outputs are produced as side-effects. +build/verity-timestamp: $(ROOT_FS_IMAGE) + $(VERITYSETUP) format \ + --root-hash-file $(ROOT_FS_VERITY_ROOTHASH) \ + -- $(ROOT_FS_IMAGE) $(ROOT_FS_VERITY) +# Add trailing newline so that the read < $(ROOT_FS_VERITY_ROOTHASH) succeeds. +# Without the trailing newline it assumes a premature EOF happened and returns +# a nonzero status. + echo >> $(ROOT_FS_VERITY_ROOTHASH) + touch -- $@ + +$(ROOT_FS_IMAGE): ../../scripts/make-erofs.sh $(PACKAGES_FILE) $(FILES) $(BUILD_FILES) build/empty build/fifo file-list.mk + mkdir -p $(ROOT_FS) && \ { \ cat $(PACKAGES_FILE) ;\ for file in $(FILES) $(LINKS); do printf '%s\n%s\n' $$file "$${file#image/}"; done ;\ @@ -77,25 +92,10 @@ clean: rm -rf build .PHONY: clean -# veritysetup format produces two files, but Make only (portably) -# supports one output per rule, so we combine the two outputs then -# define two more rules to separate them again. -build/rootfs.verity: $(dest) - $(VERITYSETUP) format $(dest) build/rootfs.verity.superblock.tmp \ - | awk -F ':[[:blank:]]*' '$$1 == "Root hash" {print $$2; exit}' \ - > build/rootfs.verity.roothash.tmp - cat build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp \ - > $@ - rm build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp -build/rootfs.verity.roothash: build/rootfs.verity - head -n 1 build/rootfs.verity > $@ -build/rootfs.verity.superblock: build/rootfs.verity - tail -n +2 build/rootfs.verity > $@ - -build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/rootfs.verity.superblock build/rootfs.verity.roothash $(dest) +build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/verity-timestamp $(ROOT_FS_IMAGES) ../../scripts/make-gpt.sh $@.tmp \ - build/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \ - $(dest):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)") + $(ROOT_FS_VERITY):verity:$$(../../scripts/format-uuid.sh "$$(dd if=$(ROOT_FS_VERITY_ROOTHASH) bs=32 skip=1 count=1 status=none)") \ + $(ROOT_FS_IMAGE):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 $(ROOT_FS_VERITY_ROOTHASH))") mv $@.tmp $@ debug: @@ -126,7 +126,7 @@ run: build/live.img build/rootfs.verity.roothash -device virtconsole,chardev=virtiocon0 \ -drive file=build/live.img,if=virtio,format=raw,readonly=on \ -drive file=/proc/self/fd/3,if=virtio,format=raw \ - -append "earlycon console=hvc0 roothash=$$(< build/rootfs.verity.roothash) intel_iommu=on nokaslr" \ + -append "earlycon console=hvc0 roothash=$$(< $(ROOT_FS_VERITY_ROOTHASH)) intel_iommu=on nokaslr" \ -device virtio-keyboard \ -device virtio-mouse \ -device virtio-gpu \ diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix index f7974a41052468f9782214f32355dda97af3cd60..941c04e619baa7652d1812f4eb50445c607d5884 100644 --- a/host/rootfs/default.nix +++ b/host/rootfs/default.nix @@ -118,7 +118,7 @@ stdenvNoCC.mkDerivation { }; sourceRoot = "source/host/rootfs"; - nativeBuildInputs = [ erofs-utils spectrum-build-tools s6-rc ]; + nativeBuildInputs = [ cryptsetup erofs-utils spectrum-build-tools s6-rc ]; env = { PACKAGES = runCommand "packages" {} '' @@ -127,7 +127,9 @@ stdenvNoCC.mkDerivation { ''; }; - makeFlags = [ "dest=$(out)" ]; + # The Makefile uses $(ROOT_FS), not $(dest), so it can share code + # with other Makefiles that also use this variable. + makeFlags = [ "ROOT_FS=$(out)" ]; dontInstall = true; diff --git a/host/rootfs/shell.nix b/host/rootfs/shell.nix index 1bf61bebf418333624e799cc8ca231f5783206f4..6df2f575fdfc7cdf8067ccfdb5fecaad9f6ea5e6 100644 --- a/host/rootfs/shell.nix +++ b/host/rootfs/shell.nix @@ -12,7 +12,7 @@ rootfs.overrideAttrs ( { nativeBuildInputs = nativeBuildInputs ++ [ - btrfs-progs cryptsetup jq netcat qemu_kvm reuse util-linux + btrfs-progs jq netcat qemu_kvm reuse util-linux ]; env = env // { diff --git a/lib/common.mk b/lib/common.mk index 277c3544036d9a9057f8ba4ad37fe2207548cc59..84091a8dfd615b2aaa021c7477f34c4dff88ccde 100644 --- a/lib/common.mk +++ b/lib/common.mk @@ -11,6 +11,10 @@ GDB = gdb MCOPY = mcopy MKFS_FAT = mkfs.fat MMD = mmd +ROOT_FS_IMAGE = $(ROOT_FS)/rootfs +ROOT_FS_IMAGES = $(ROOT_FS_IMAGE) $(ROOT_FS_VERITY_ROOTHASH) $(ROOT_FS_VERITY) +ROOT_FS_VERITY = $(ROOT_FS)/rootfs.verity.superblock +ROOT_FS_VERITY_ROOTHASH = $(ROOT_FS)/rootfs.verity.roothash S6_IPCSERVER_SOCKETBINDER = s6-ipcserver-socketbinder TAR = tar TRUNCATE = truncate diff --git a/release/live/Makefile b/release/live/Makefile index 6dcbdeedda5d6ccf293f60dc62043f46c81ecf83..ba81c7e679429e045b24c1591a9f0b72f016cfab 100644 --- a/release/live/Makefile +++ b/release/live/Makefile @@ -9,17 +9,17 @@ DTBS ?= build/empty dest = build/live.img -$(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/boot.fat build/rootfs.verity.superblock build/rootfs.verity.roothash $(ROOT_FS) +$(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/boot.fat $(ROOT_FS_IMAGES) ../../scripts/make-gpt.sh $@.tmp \ build/boot.fat:c12a7328-f81f-11d2-ba4b-00a0c93ec93b \ - build/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \ - $(ROOT_FS):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)") + $(ROOT_FS_VERITY):verity:$$(../../scripts/format-uuid.sh "$$(dd if=$(ROOT_FS_VERITY_ROOTHASH) bs=32 skip=1 count=1 status=none)") \ + $(ROOT_FS_IMAGE):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 $(ROOT_FS_VERITY_ROOTHASH))") mv $@.tmp $@ build/empty: mkdir -p $@ -build/spectrum.efi: build/rootfs.verity.roothash $(DTBS) $(KERNEL) $(INITRAMFS) +build/spectrum.efi: $(DTBS) $(KERNEL) $(INITRAMFS) $(ROOT_FS_VERITY_ROOTHASH) { \ printf "[UKI]\nDeviceTreeAuto=" && \ find $(DTBS) -name '*.dtb' -print0 | tr '\0' ' ' ;\ @@ -29,7 +29,7 @@ build/spectrum.efi: build/rootfs.verity.roothash $(DTBS) $(KERNEL) $(INITRAMFS) --linux $(KERNEL) \ --initrd $(INITRAMFS) \ --os-release $$'NAME="Spectrum"\n' \ - --cmdline "ro intel_iommu=on roothash=$$(cat build/rootfs.verity.roothash)" + --cmdline "ro intel_iommu=on roothash=$$(cat $(ROOT_FS_VERITY_ROOTHASH))" build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi $(TRUNCATE) -s 440401920 $@ @@ -38,22 +38,6 @@ build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi $(MCOPY) -i $@ build/spectrum.efi ::/EFI/Linux $(MCOPY) -i $@ $(SYSTEMD_BOOT_EFI) ::/EFI/BOOT/$(EFINAME) -# veritysetup format produces two files, but Make only (portably) -# supports one output per rule, so we combine the two outputs then -# define two more rules to separate them again. -build/rootfs.verity: $(ROOT_FS) - mkdir -p build - $(VERITYSETUP) format $(ROOT_FS) build/rootfs.verity.superblock.tmp \ - | awk -F ':[[:blank:]]*' '$$1 == "Root hash" {print $$2; exit}' \ - > build/rootfs.verity.roothash.tmp - cat build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp \ - > $@ - rm build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp -build/rootfs.verity.roothash: build/rootfs.verity - head -n 1 build/rootfs.verity > $@ -build/rootfs.verity.superblock: build/rootfs.verity - tail -n +2 build/rootfs.verity > $@ - clean: rm -rf build .PHONY: clean diff --git a/release/live/shell.nix b/release/live/shell.nix index 5acaa8c5b113fd2789aaea9268487b193bab37af..799d575b4f6e6f3dad8ac1a0a8bc2e3fc46aab44 100644 --- a/release/live/shell.nix +++ b/release/live/shell.nix @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT # SPDX-FileCopyrightText: 2021-2024 Alyssa Ross -import ../../lib/call-package.nix ({ callSpectrumPackage, stdenv, qemu_kvm }: +import ../../lib/call-package.nix ({ callSpectrumPackage, stdenv, qemu_kvm, rootfs }: (callSpectrumPackage ./. {}).overrideAttrs ( { nativeBuildInputs ? [], env ? {}, ... }: @@ -10,6 +10,7 @@ import ../../lib/call-package.nix ({ callSpectrumPackage, stdenv, qemu_kvm }: env = env // { OVMF_CODE = "${qemu_kvm}/share/qemu/edk2-${stdenv.hostPlatform.qemuArch}-code.fd"; + ROOT_FS = rootfs; }; } )) (_: {}) -- 2.52.0