Re: [PATCH v6 2/2] Move UKI creation to a separate derivation

[Alyssa Ross <hi@alyssa.is>]

[-- Attachment #1: Type: text/plain, Size: 4303 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> It will be used by the update code later.
>
> No functional change intended, other than a trivial shell script
> refactoring.
>
> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
> ---
> I kept release/live/default.nix using the UKI's systemd because the old
> code did it that way.  Changing this would be better in a separate
> commit.
>
> Changes since v5:
>
> - Create a temporary symlink named build/spectrum.efi and then run
>   $(MCOPY) -i $@ build/spectrum.efi ::/EFI/Linux, rather than copying
>   the file with its original name.  The latter results in an unbootable
>   image.  I do not know the reason.
>
> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
> ---
>  host/efi.nix             | 40 ++++++++++++++++++++++++++++++++++++++++
>  release/live/Makefile    | 17 ++++-------------
>  release/live/default.nix | 27 +++++++++++----------------
>  release/live/shell.nix   | 10 ++++++++--
>  4 files changed, 63 insertions(+), 31 deletions(-)
>
> diff --git a/host/efi.nix b/host/efi.nix
> new file mode 100644
> index 0000000000000000000000000000000000000000..ecedb6bea6bf29c7a7303dc9062fe12b5c7a9fbd
> --- /dev/null
> +++ b/host/efi.nix
> @@ -0,0 +1,40 @@
> +# SPDX-License-Identifier: MIT
> +# SPDX-FileCopyrightText: 2021-2024 Alyssa Ross <hi@alyssa.is>
> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +
> +import ../lib/call-package.nix (
> +{ callSpectrumPackage, cryptsetup, rootfs
> +, runCommand, stdenv, systemdUkify
> +}:
> +let
> +  initramfs = callSpectrumPackage ./initramfs {};
> +  kernel = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}";
> +  systemd = systemdUkify.overrideAttrs ({ mesonFlags ? [], ... }: {
> +    # The default limit is too low to build a generic aarch64 distro image:
> +    # https://github.com/systemd/systemd/pull/37417
> +    mesonFlags = mesonFlags ++ [ "-Defi-stub-extra-sections=3000" ];
> +  });
> +in
> +
> +runCommand "spectrum-efi" {
> +  nativeBuildInputs = [ cryptsetup systemd ];
> +  __structuredAttrs = true;
> +  unsafeDiscardReferences = { out = true; };
> +  dontFixup = true;
> +  passthru = { inherit initramfs rootfs systemd; };
> +} ''
> +  read -r roothash < ${rootfs}/rootfs.verity.roothash
> +  { \
> +      printf "[UKI]\nDeviceTreeAuto="
> +      if [ -d ${rootfs.kernel}/dtbs ]; then
> +          find ${rootfs.kernel}/dtbs -name '*.dtb' -print0 | tr '\0' ' '
> +      fi
> +  } | ukify build \
> +      --output "$out" \
> +      --config /dev/stdin \
> +      --linux ${kernel} \
> +      --initrd ${initramfs} \
> +      --os-release $'NAME="Spectrum"\n' \
> +      --cmdline "ro intel_iommu=on roothash=$roothash"
> +  ''
> +) (_: {})
> diff --git a/release/live/Makefile b/release/live/Makefile
> index ba81c7e679429e045b24c1591a9f0b72f016cfab..b37ccce42feb3ac7e8ce4faf96a67902b55be808 100644
> --- a/release/live/Makefile
> +++ b/release/live/Makefile
> @@ -19,22 +19,13 @@ $(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sf
>  build/empty:
>  	mkdir -p $@
>  
> -build/spectrum.efi: $(DTBS) $(KERNEL) $(INITRAMFS) $(ROOT_FS_VERITY_ROOTHASH)
> -	{ \
> -	    printf "[UKI]\nDeviceTreeAuto=" && \
> -	    find $(DTBS) -name '*.dtb' -print0 | tr '\0' ' ' ;\
> -	} | $(UKIFY) build \
> -	    --output $@ \
> -	    --config /dev/stdin \
> -	    --linux $(KERNEL) \
> -	    --initrd $(INITRAMFS) \
> -	    --os-release $$'NAME="Spectrum"\n' \
> -	    --cmdline "ro intel_iommu=on roothash=$$(cat $(ROOT_FS_VERITY_ROOTHASH))"
> -
> -build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi
> +build/boot.fat: $(SYSTEMD_BOOT_EFI) $(EFI_IMAGE) build/empty

Why add a build/empty dependency?  It doesn't seem to be used for
anything any more?  (Neither does the DTBS variable, actually.)

>  	$(TRUNCATE) -s 440401920 $@
>  	$(MKFS_FAT) $@
>  	$(MMD) -i $@ ::/EFI ::/EFI/BOOT ::/EFI/Linux
> +# This symlink is necessary.  Copying $(EFI_IMAGE) directly
> +# results in an unbootable image.  TODO: figure out why.
> +	ln -s $(EFI_IMAGE) build/spectrum.efi
>  	$(MCOPY) -i $@ build/spectrum.efi ::/EFI/Linux
>  	$(MCOPY) -i $@ $(SYSTEMD_BOOT_EFI) ::/EFI/BOOT/$(EFINAME)
>  

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]