Re: [PATCH v6 2/2] Move UKI creation to a separate derivation

Alyssa Ross
2025-11-28T11:02:50Z

[-- Attachment #1: Type: text/plain, Size: 4303 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> It will be used by the update code later.
>
> No functional change intended, other than a trivial shell script
> refactoring.
>
> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
> ---
> I kept release/live/default.nix using the UKI's systemd because the old
> code did it that way. Changing this would be better in a separate
> commit.
>
> Changes since v5:
>
> - Create a temporary symlink named build/spectrum.efi and then run
> $(MCOPY) -i $@ build/spectrum.efi ::/EFI/Linux, rather than copying
> the file with its original name. The latter results in an unbootable
> image. I do not know the reason.
>
> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
> ---
> host/efi.nix | 40 ++++++++++++++++++++++++++++++++++++++++
> release/live/Makefile | 17 ++++-------------
> release/live/default.nix | 27 +++++++++++----------------
> release/live/shell.nix | 10 ++++++++--
> 4 files changed, 63 insertions(+), 31 deletions(-)
>
> diff --git a/host/efi.nix b/host/efi.nix
> new file mode 100644
> index 0000000000000000000000000000000000000000..ecedb6bea6bf29c7a7303dc9062fe12b5c7a9fbd
> --- /dev/null
> +++ b/host/efi.nix
> @@ -0,0 +1,40 @@
> +# SPDX-License-Identifier: MIT
> +# SPDX-FileCopyrightText: 2021-2024 Alyssa Ross <hi@alyssa.is>
> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +
> +import ../lib/call-package.nix (
> +{ callSpectrumPackage, cryptsetup, rootfs
> +, runCommand, stdenv, systemdUkify
> +}:
> +let
> + initramfs = callSpectrumPackage ./initramfs {};
> + kernel = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}";
> + systemd = systemdUkify.overrideAttrs ({ mesonFlags ? [], ... }: {
> + # The default limit is too low to build a generic aarch64 distro image:
> + # https://github.com/systemd/systemd/pull/37417
> + mesonFlags = mesonFlags ++ [ "-Defi-stub-extra-sections=3000" ];
> + });
> +in
> +
> +runCommand "spectrum-efi" {
> + nativeBuildInputs = [ cryptsetup systemd ];
> + __structuredAttrs = true;
> + unsafeDiscardReferences = { out = true; };
> + dontFixup = true;
> + passthru = { inherit initramfs rootfs systemd; };
> +} ''
> + read -r roothash < ${rootfs}/rootfs.verity.roothash
> + { \
> + printf "[UKI]\nDeviceTreeAuto="
> + if [ -d ${rootfs.kernel}/dtbs ]; then
> + find ${rootfs.kernel}/dtbs -name '*.dtb' -print0 | tr '\0' ' '
> + fi
> + } | ukify build \
> + --output "$out" \
> + --config /dev/stdin \
> + --linux ${kernel} \
> + --initrd ${initramfs} \
> + --os-release $'NAME="Spectrum"\n' \
> + --cmdline "ro intel_iommu=on roothash=$roothash"
> + ''
> +) (_: {})
> diff --git a/release/live/Makefile b/release/live/Makefile
> index ba81c7e679429e045b24c1591a9f0b72f016cfab..b37ccce42feb3ac7e8ce4faf96a67902b55be808 100644
> --- a/release/live/Makefile
> +++ b/release/live/Makefile
> @@ -19,22 +19,13 @@ $(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sf
> build/empty:
> mkdir -p $@
>
> -build/spectrum.efi: $(DTBS) $(KERNEL) $(INITRAMFS) $(ROOT_FS_VERITY_ROOTHASH)
> - { \
> - printf "[UKI]\nDeviceTreeAuto=" && \
> - find $(DTBS) -name '*.dtb' -print0 | tr '\0' ' ' ;\
> - } | $(UKIFY) build \
> - --output $@ \
> - --config /dev/stdin \
> - --linux $(KERNEL) \
> - --initrd $(INITRAMFS) \
> - --os-release $$'NAME="Spectrum"\n' \
> - --cmdline "ro intel_iommu=on roothash=$$(cat $(ROOT_FS_VERITY_ROOTHASH))"
> -
> -build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi
> +build/boot.fat: $(SYSTEMD_BOOT_EFI) $(EFI_IMAGE) build/empty

Why add a build/empty dependency? It doesn't seem to be used for
anything any more? (Neither does the DTBS variable, actually.)

> $(TRUNCATE) -s 440401920 $@
> $(MKFS_FAT) $@
> $(MMD) -i $@ ::/EFI ::/EFI/BOOT ::/EFI/Linux
> +# This symlink is necessary. Copying $(EFI_IMAGE) directly
> +# results in an unbootable image. TODO: figure out why.
> + ln -s $(EFI_IMAGE) build/spectrum.efi
> $(MCOPY) -i $@ build/spectrum.efi ::/EFI/Linux
> $(MCOPY) -i $@ $(SYSTEMD_BOOT_EFI) ::/EFI/BOOT/$(EFINAME)
>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]