[PATCH v5 0/2] Move verity and EFI creation to separate Nix derivations

Demi Marie Obenour
2025-11-26T18:59:14Z

This doesn't have any functional change, other than to use the read
builtin instead of a cat command in a shell script. However, it does
make the code much cleaner and more reusable. For instance, one can
easily build just the verity image or just the UKI.

This will be used by the Nix code that generates an update package. The
update package needs the root filesystem, the verity superblock, and the
UKI. It doesn't need the installer or the live image.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
Changes in v5:
- Rebase
- Fix shell.nix files
- Link to v4: https://spectrum-os.org/lists/archives/spectrum-devel/20251119-refactor-verity-v4-0-9bc56d5216c0@gmail.com

Changes in v4:
- Many cleanups.
- Respond to suggestions from code review.
- Link to v3: https://spectrum-os.org/lists/archives/spectrum-devel/20251111-refactor-verity-v3-0-575726639f9e@gmail.com

Changes in v3:
- Rebase on main
- Link to v2: https://spectrum-os.org/lists/archives/spectrum-devel/20251107-refactor-verity-v2-0-2af58b1a4a87@gmail.com

Changes in v2:
- Do not break interactive rootfs development.
- Link to v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251105-refactor-verity-v1-0-b8ba27dfdf06@gmail.com

---
Demi Marie Obenour (2):
Build verity images in rootfs Nix derivation
Move UKI creation to a separate derivation

host/efi.nix | 40 ++++++++++++++++++++++++++++++++++++++++
host/initramfs/Makefile | 26 +++++---------------------
host/initramfs/default.nix | 1 +
host/rootfs/Makefile | 44 ++++++++++++++++++++++----------------------
host/rootfs/default.nix | 6 ++++--
host/rootfs/shell.nix | 2 +-
lib/common.mk | 4 ++++
release/live/Makefile | 39 +++++++--------------------------------
release/live/default.nix | 27 +++++++++++----------------
release/live/shell.nix | 9 ++++++++-
10 files changed, 103 insertions(+), 95 deletions(-)
---
base-commit: c3d53b92c32636736c6585cd934210e29613e38e
change-id: 20251105-refactor-verity-9c8ca37e021a

--
Sincerely,
Demi Marie Obenour (she/her/hers)