[PATCH v6 1/2] Build verity images in rootfs Nix derivation

Demi Marie Obenour
2025-11-26T19:11:40Z

Avoid redundant rebuilds of the rootfs verity superblock and roothash.
Remove duplicate code. Clean up Makefile to avoid temporary files.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
Changes since v5:
- Use consistent naming scheme for Make variables: ROOT_FS is the
directory containing the artifacts. ROOT_FS_IMAGE is the root
filesystem image, ROOT_FS_VERITY is the verity image, and
ROOT_FS_VERITY_ROOTHASH is its root filesystem hash.
- Do not try to use a file as a directory.
- Use $@ where possible.
- Use consistent indentation.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
host/initramfs/Makefile | 26 +++++---------------------
host/initramfs/default.nix | 1 +
host/rootfs/Makefile | 44 ++++++++++++++++++++++----------------------
host/rootfs/default.nix | 6 ++++--
host/rootfs/shell.nix | 2 +-
lib/common.mk | 4 ++++
release/live/Makefile | 26 +++++---------------------
release/live/shell.nix | 3 ++-
8 files changed, 44 insertions(+), 68 deletions(-)

diff --git a/host/initramfs/Makefile b/host/initramfs/Makefile
index cb13fbb35f065b67d291d4a35591d6f12720060c..f27f5e07c4707914962197b4fea8f385729370aa 100644
--- a/host/initramfs/Makefile
+++ b/host/initramfs/Makefile
@@ -35,26 +35,10 @@ build/mountpoints:
cd build/mountpoints && mkdir -p $(MOUNTPOINTS)
find build/mountpoints -mindepth 1 -exec touch -d @0 {} ';'

-# veritysetup format produces two files, but Make only (portably)
-# supports one output per rule, so we combine the two outputs then
-# define two more rules to separate them again.
-build/rootfs.verity: $(ROOT_FS)
- mkdir -p build
- $(VERITYSETUP) format $(ROOT_FS) build/rootfs.verity.superblock.tmp \
- | awk -F ':[[:blank:]]*' '$$1 == "Root hash" {print $$2; exit}' \
- > build/rootfs.verity.roothash.tmp
- cat build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp \
- > $@
- rm build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp
-build/rootfs.verity.roothash: build/rootfs.verity
- head -n 1 build/rootfs.verity > $@
-build/rootfs.verity.superblock: build/rootfs.verity
- tail -n +2 build/rootfs.verity > $@
-
-build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/rootfs.verity.superblock build/rootfs.verity.roothash $(ROOT_FS)
+build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk $(ROOT_FS_IMAGES)
../../scripts/make-gpt.sh $@.tmp \
- build/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \
- $(ROOT_FS):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)")
+ $(ROOT_FS_VERITY):verity:$$(../../scripts/format-uuid.sh "$$(dd if=$(ROOT_FS_VERITY_ROOTHASH) bs=32 skip=1 count=1 status=none)") \
+ $(ROOT_FS_IMAGE):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 $(ROOT_FS_VERITY_ROOTHASH))")
mv $@.tmp $@

build/loop.tar: build/live.img
@@ -69,12 +53,12 @@ clean:
rm -rf build
.PHONY: clean

-run: $(dest) build/rootfs.verity.roothash $(RUN_IMAGE)
+run: $(dest) $(RUN_IMAGE) $(ROOT_FS_VERITY_ROOTHASH)
@../../scripts/run-qemu.sh -m 4G \
-machine virtualization=on \
-kernel $(KERNEL) \
-initrd $(dest) \
- -append "ro earlycon console=hvc0 intel_iommu=on roothash=$$(< build/rootfs.verity.roothash) nokaslr" \
+ -append "ro earlycon console=hvc0 intel_iommu=on roothash=$$(< $(ROOT_FS_VERITY_ROOTHASH)) nokaslr" \
-cpu max \
-gdb unix:build/gdb.sock,server,nowait \
-parallel none \
diff --git a/host/initramfs/default.nix b/host/initramfs/default.nix
index d35e1b514ec48015f5110e65e5ae944b28244c4f..16c932600c0ab54cf439dc7931fc12e863677e0e 100644
--- a/host/initramfs/default.nix
+++ b/host/initramfs/default.nix
@@ -105,6 +105,7 @@ stdenvNoCC.mkDerivation {

env = {
PACKAGES_CPIO = packagesCpio;
+ ROOT_FS = rootfs;
} // lib.optionalAttrs stdenvNoCC.hostPlatform.isx86_64 {
MICROCODE = microcode;
};
diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile
index 4067be0c45cc83ce4670ed76e956db58f8e93e02..4cb048ac08b3265b0435d6ff6fc612a58c169ce9 100644
--- a/host/rootfs/Makefile
+++ b/host/rootfs/Makefile
@@ -1,12 +1,13 @@
# SPDX-License-Identifier: EUPL-1.2+
# SPDX-FileCopyrightText: 2021-2024 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>

.POSIX:

include ../../lib/common.mk
include file-list.mk

-dest = build/rootfs.erofs
+ROOT_FS = build

DIRS = \
dev \
@@ -40,8 +41,22 @@ FIFOS = etc/s6-linux-init/run-image/service/s6-svscan-log/fifo

BUILD_FILES = build/etc/s6-rc

-$(dest): ../../scripts/make-erofs.sh $(PACKAGES_FILE) $(FILES) $(BUILD_FILES) build/empty build/fifo file-list.mk
- set -euo pipefail; \
+# This rule produces three files but Make only (portably)
+# supports one output per rule. Instead of resorting to temporary
+# files, a timestamp file is created as the last step. The actual
+# outputs are produced as side-effects.
+build/verity-timestamp: $(ROOT_FS_IMAGE)
+ $(VERITYSETUP) format \
+ --root-hash-file $(ROOT_FS_VERITY_ROOTHASH) \
+ -- $(ROOT_FS_IMAGE) $(ROOT_FS_VERITY)
+# Add trailing newline so that the read < $(ROOT_FS_VERITY_ROOTHASH) succeeds.
+# Without the trailing newline it assumes a premature EOF happened and returns
+# a nonzero status.
+ echo >> $(ROOT_FS_VERITY_ROOTHASH)
+ touch -- $@
+
+$(ROOT_FS_IMAGE): ../../scripts/make-erofs.sh $(PACKAGES_FILE) $(FILES) $(BUILD_FILES) build/empty build/fifo file-list.mk
+ mkdir -p $(ROOT_FS) && \
{ \
cat $(PACKAGES_FILE) ;\
for file in $(FILES) $(LINKS); do printf '%s\n%s\n' $$file "$${file#image/}"; done ;\
@@ -77,25 +92,10 @@ clean:
rm -rf build
.PHONY: clean

-# veritysetup format produces two files, but Make only (portably)
-# supports one output per rule, so we combine the two outputs then
-# define two more rules to separate them again.
-build/rootfs.verity: $(dest)
- $(VERITYSETUP) format $(dest) build/rootfs.verity.superblock.tmp \
- | awk -F ':[[:blank:]]*' '$$1 == "Root hash" {print $$2; exit}' \
- > build/rootfs.verity.roothash.tmp
- cat build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp \
- > $@
- rm build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp
-build/rootfs.verity.roothash: build/rootfs.verity
- head -n 1 build/rootfs.verity > $@
-build/rootfs.verity.superblock: build/rootfs.verity
- tail -n +2 build/rootfs.verity > $@
-
-build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/rootfs.verity.superblock build/rootfs.verity.roothash $(dest)
+build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/verity-timestamp $(ROOT_FS_IMAGES)
../../scripts/make-gpt.sh $@.tmp \
- build/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \
- $(dest):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)")
+ $(ROOT_FS_VERITY):verity:$$(../../scripts/format-uuid.sh "$$(dd if=$(ROOT_FS_VERITY_ROOTHASH) bs=32 skip=1 count=1 status=none)") \
+ $(ROOT_FS_IMAGE):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 $(ROOT_FS_VERITY_ROOTHASH))")
mv $@.tmp $@

debug:
@@ -126,7 +126,7 @@ run: build/live.img build/rootfs.verity.roothash
-device virtconsole,chardev=virtiocon0 \
-drive file=build/live.img,if=virtio,format=raw,readonly=on \
-drive file=/proc/self/fd/3,if=virtio,format=raw \
- -append "earlycon console=hvc0 roothash=$$(< build/rootfs.verity.roothash) intel_iommu=on nokaslr" \
+ -append "earlycon console=hvc0 roothash=$$(< $(ROOT_FS_VERITY_ROOTHASH)) intel_iommu=on nokaslr" \
-device virtio-keyboard \
-device virtio-mouse \
-device virtio-gpu \
diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix
index f7974a41052468f9782214f32355dda97af3cd60..941c04e619baa7652d1812f4eb50445c607d5884 100644
--- a/host/rootfs/default.nix
+++ b/host/rootfs/default.nix
@@ -118,7 +118,7 @@ stdenvNoCC.mkDerivation {
};
sourceRoot = "source/host/rootfs";

- nativeBuildInputs = [ erofs-utils spectrum-build-tools s6-rc ];
+ nativeBuildInputs = [ cryptsetup erofs-utils spectrum-build-tools s6-rc ];

env = {
PACKAGES = runCommand "packages" {} ''
@@ -127,7 +127,9 @@ stdenvNoCC.mkDerivation {
'';
};

- makeFlags = [ "dest=$(out)" ];
+ # The Makefile uses $(ROOT_FS), not $(dest), so it can share code
+ # with other Makefiles that also use this variable.
+ makeFlags = [ "ROOT_FS=$(out)" ];

dontInstall = true;

diff --git a/host/rootfs/shell.nix b/host/rootfs/shell.nix
index 1bf61bebf418333624e799cc8ca231f5783206f4..6df2f575fdfc7cdf8067ccfdb5fecaad9f6ea5e6 100644
--- a/host/rootfs/shell.nix
+++ b/host/rootfs/shell.nix
@@ -12,7 +12,7 @@ rootfs.overrideAttrs (

{
nativeBuildInputs = nativeBuildInputs ++ [
- btrfs-progs cryptsetup jq netcat qemu_kvm reuse util-linux
+ btrfs-progs jq netcat qemu_kvm reuse util-linux
];

env = env // {
diff --git a/lib/common.mk b/lib/common.mk
index 277c3544036d9a9057f8ba4ad37fe2207548cc59..84091a8dfd615b2aaa021c7477f34c4dff88ccde 100644
--- a/lib/common.mk
+++ b/lib/common.mk
@@ -11,6 +11,10 @@ GDB = gdb
MCOPY = mcopy
MKFS_FAT = mkfs.fat
MMD = mmd
+ROOT_FS_IMAGE = $(ROOT_FS)/rootfs
+ROOT_FS_IMAGES = $(ROOT_FS_IMAGE) $(ROOT_FS_VERITY_ROOTHASH) $(ROOT_FS_VERITY)
+ROOT_FS_VERITY = $(ROOT_FS)/rootfs.verity.superblock
+ROOT_FS_VERITY_ROOTHASH = $(ROOT_FS)/rootfs.verity.roothash
S6_IPCSERVER_SOCKETBINDER = s6-ipcserver-socketbinder
TAR = tar
TRUNCATE = truncate
diff --git a/release/live/Makefile b/release/live/Makefile
index 6dcbdeedda5d6ccf293f60dc62043f46c81ecf83..ba81c7e679429e045b24c1591a9f0b72f016cfab 100644
--- a/release/live/Makefile
+++ b/release/live/Makefile
@@ -9,17 +9,17 @@ DTBS ?= build/empty

dest = build/live.img

-$(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/boot.fat build/rootfs.verity.superblock build/rootfs.verity.roothash $(ROOT_FS)
+$(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/boot.fat $(ROOT_FS_IMAGES)
../../scripts/make-gpt.sh $@.tmp \
build/boot.fat:c12a7328-f81f-11d2-ba4b-00a0c93ec93b \
- build/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \
- $(ROOT_FS):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)")
+ $(ROOT_FS_VERITY):verity:$$(../../scripts/format-uuid.sh "$$(dd if=$(ROOT_FS_VERITY_ROOTHASH) bs=32 skip=1 count=1 status=none)") \
+ $(ROOT_FS_IMAGE):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 $(ROOT_FS_VERITY_ROOTHASH))")
mv $@.tmp $@

build/empty:
mkdir -p $@

-build/spectrum.efi: build/rootfs.verity.roothash $(DTBS) $(KERNEL) $(INITRAMFS)
+build/spectrum.efi: $(DTBS) $(KERNEL) $(INITRAMFS) $(ROOT_FS_VERITY_ROOTHASH)
{ \
printf "[UKI]\nDeviceTreeAuto=" && \
find $(DTBS) -name '*.dtb' -print0 | tr '\0' ' ' ;\
@@ -29,7 +29,7 @@ build/spectrum.efi: build/rootfs.verity.roothash $(DTBS) $(KERNEL) $(INITRAMFS)
--linux $(KERNEL) \
--initrd $(INITRAMFS) \
--os-release $$'NAME="Spectrum"\n' \
- --cmdline "ro intel_iommu=on roothash=$$(cat build/rootfs.verity.roothash)"
+ --cmdline "ro intel_iommu=on roothash=$$(cat $(ROOT_FS_VERITY_ROOTHASH))"

build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi
$(TRUNCATE) -s 440401920 $@
@@ -38,22 +38,6 @@ build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi
$(MCOPY) -i $@ build/spectrum.efi ::/EFI/Linux
$(MCOPY) -i $@ $(SYSTEMD_BOOT_EFI) ::/EFI/BOOT/$(EFINAME)

-# veritysetup format produces two files, but Make only (portably)
-# supports one output per rule, so we combine the two outputs then
-# define two more rules to separate them again.
-build/rootfs.verity: $(ROOT_FS)
- mkdir -p build
- $(VERITYSETUP) format $(ROOT_FS) build/rootfs.verity.superblock.tmp \
- | awk -F ':[[:blank:]]*' '$$1 == "Root hash" {print $$2; exit}' \
- > build/rootfs.verity.roothash.tmp
- cat build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp \
- > $@
- rm build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp
-build/rootfs.verity.roothash: build/rootfs.verity
- head -n 1 build/rootfs.verity > $@
-build/rootfs.verity.superblock: build/rootfs.verity
- tail -n +2 build/rootfs.verity > $@
-
clean:
rm -rf build
.PHONY: clean
diff --git a/release/live/shell.nix b/release/live/shell.nix
index 5acaa8c5b113fd2789aaea9268487b193bab37af..799d575b4f6e6f3dad8ac1a0a8bc2e3fc46aab44 100644
--- a/release/live/shell.nix
+++ b/release/live/shell.nix
@@ -1,7 +1,7 @@
# SPDX-License-Identifier: MIT
# SPDX-FileCopyrightText: 2021-2024 Alyssa Ross <hi@alyssa.is>

-import ../../lib/call-package.nix ({ callSpectrumPackage, stdenv, qemu_kvm }:
+import ../../lib/call-package.nix ({ callSpectrumPackage, stdenv, qemu_kvm, rootfs }:

(callSpectrumPackage ./. {}).overrideAttrs (
{ nativeBuildInputs ? [], env ? {}, ... }:
@@ -10,6 +10,7 @@ import ../../lib/call-package.nix ({ callSpectrumPackage, stdenv, qemu_kvm }:

env = env // {
OVMF_CODE = "${qemu_kvm}/share/qemu/edk2-${stdenv.hostPlatform.qemuArch}-code.fd";
+ ROOT_FS = rootfs;
};
}
)) (_: {})

--
2.52.0