1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
| | # SPDX-License-Identifier: MIT
# SPDX-FileCopyrightText: 2026 Colby Russell <colby@colbyt.com>
import ../../lib/call-package.nix (
{ src, spectrum-build-tools, kernel ? null
, lib, stdenvNoCC, makeModulesClosure, runCommand, writeClosure, pkgsStatic
, busybox, cpio
}:
pkgsStatic.callPackage ({ execline, kmod, mdevd, cryptsetup, util-linuxMinimal }:
let
inherit (lib) concatMapStringsSep filter foldl isString last split tail;
emptyFirmware = runCommand "empty-firmware" {} ''
mkdir -p $out/lib/firmware
'';
modules = if kernel == null then null else makeModulesClosure {
firmware = emptyFirmware;
inherit kernel;
rootModules = [ "dm-mod" "dm-verity" ];
};
packages = [
execline kmod mdevd
(cryptsetup.override {
programs = {
cryptsetup = false;
cryptsetup-reencrypt = false;
integritysetup = false;
};
})
(busybox.override {
enableStatic = true;
extraConfig = ''
CONFIG_DEPMOD n
CONFIG_FINDFS n
CONFIG_INSMOD n
CONFIG_LSMOD n
CONFIG_MODINFO n
CONFIG_MODPROBE n
CONFIG_RMMOD n
'';
})
];
packagesSysroot = runCommand "vm-initramfs-packages-sysroot" {} ''
mkdir -p $out/bin
ln -s ${concatMapStringsSep " " (p: "${p}/bin/*") packages} $out/bin
ln -s /bin $out/sbin
${lib.optionalString (modules != null) "cp -R ${modules}/lib $out"}
# TODO: this is a hack and we should just build the util-linux
# programs we want.
# https://lore.kernel.org/util-linux/87zgrl6ufb.fsf@alyssa.is/
cp ${util-linuxMinimal}/bin/{findfs,lsblk} $out/bin
'';
storeComponents = tail (filter isString (split "/" builtins.storeDir));
packagesCpio = runCommand "vm-initramfs-packages.cpio" {
nativeBuildInputs = [ cpio ];
storePaths = writeClosure [ packagesSysroot ];
storePrefixes = foldl
(acc: elem: acc ++ [ "${if acc == [] then "" else last acc}/${elem}" ])
[]
storeComponents;
__structuredAttrs = true;
unsafeDiscardReferences = { out = true; };
dontFixup = true;
} ''
cd ${packagesSysroot}
(printf "%s\n" "''${storePrefixes[@]}" && find . $(< $storePaths)) |
cpio -o -H newc -R +0:+0 --reproducible > $out
'';
in
stdenvNoCC.mkDerivation {
name = "spectrum-vm-initramfs";
src = lib.fileset.toSource {
root = ../..;
fileset = lib.fileset.intersection src (lib.fileset.unions [
./.
../../lib/common.mk
]);
};
sourceRoot = "source/vm/initramfs";
env = {
PACKAGES_CPIO = packagesCpio;
};
nativeBuildInputs = [ cpio spectrum-build-tools ];
makeFlags = [ "dest=$(out)" ];
dontInstall = true;
enableParallelBuilding = true;
__structuredAttrs = true;
unsafeDiscardReferences = { out = true; };
dontFixup = true;
passthru = { inherit packagesSysroot; };
}
) {}) (_: {})
|