[PATCH v3 1/2] Build verity images in rootfs Nix derivation

Demi Marie Obenour
2025-11-12T01:00:55Z

Avoid redundant rebuilds of the rootfs verity superblock and roothash.
Remove duplicate code. Clean up Makefile to avoid temporary files.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
host/initramfs/Makefile | 26 +++++---------------------
host/initramfs/shell.nix | 4 +++-
host/rootfs/Makefile | 45 +++++++++++++++++++++------------------------
host/rootfs/default.nix | 2 +-
host/rootfs/shell.nix | 2 +-
release/live/Makefile | 26 +++++---------------------
release/live/default.nix | 4 +++-
7 files changed, 39 insertions(+), 70 deletions(-)

diff --git a/host/initramfs/Makefile b/host/initramfs/Makefile
index cb13fbb35f065b67d291d4a35591d6f12720060c..102870ecba4456303414e2531ea592473ddfc1cf 100644
--- a/host/initramfs/Makefile
+++ b/host/initramfs/Makefile
@@ -35,26 +35,10 @@ build/mountpoints:
cd build/mountpoints && mkdir -p $(MOUNTPOINTS)
find build/mountpoints -mindepth 1 -exec touch -d @0 {} ';'

-# veritysetup format produces two files, but Make only (portably)
-# supports one output per rule, so we combine the two outputs then
-# define two more rules to separate them again.
-build/rootfs.verity: $(ROOT_FS)
- mkdir -p build
- $(VERITYSETUP) format $(ROOT_FS) build/rootfs.verity.superblock.tmp \
- | awk -F ':[[:blank:]]*' '$$1 == "Root hash" {print $$2; exit}' \
- > build/rootfs.verity.roothash.tmp
- cat build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp \
- > $@
- rm build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp
-build/rootfs.verity.roothash: build/rootfs.verity
- head -n 1 build/rootfs.verity > $@
-build/rootfs.verity.superblock: build/rootfs.verity
- tail -n +2 build/rootfs.verity > $@
-
-build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/rootfs.verity.superblock build/rootfs.verity.roothash $(ROOT_FS)
+build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk $(ROOT_FS_VERITY) $(ROOT_FS_VERITY_ROOTHASH) $(ROOT_FS)
../../scripts/make-gpt.sh $@.tmp \
- build/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \
- $(ROOT_FS):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)")
+ "$$ROOT_FS_VERITY:verity:$$(../../scripts/format-uuid.sh "$$(dd "if=$$ROOT_FS_VERITY_ROOTHASH" bs=32 skip=1 count=1 status=none)")" \
+ $(dest):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 "$$ROOT_FS_VERITY_ROOTHASH")")
mv $@.tmp $@

build/loop.tar: build/live.img
@@ -69,12 +53,12 @@ clean:
rm -rf build
.PHONY: clean

-run: $(dest) build/rootfs.verity.roothash $(RUN_IMAGE)
+run: $(dest) $(RUN_IMAGE) $(ROOT_FS_VERITY_ROOTHASH)
@../../scripts/run-qemu.sh -m 4G \
-machine virtualization=on \
-kernel $(KERNEL) \
-initrd $(dest) \
- -append "ro earlycon console=hvc0 intel_iommu=on roothash=$$(< build/rootfs.verity.roothash) nokaslr" \
+ -append "ro earlycon console=hvc0 intel_iommu=on roothash=$$(< "$$ROOT_FS_VERITY_ROOTHASH") nokaslr" \
-cpu max \
-gdb unix:build/gdb.sock,server,nowait \
-parallel none \
diff --git a/host/initramfs/shell.nix b/host/initramfs/shell.nix
index 8b47aa53bc19a818ebf563e281f22e82202a8ea5..fef8198685564bef2d8d673e0dc9403ee9c9a444 100644
--- a/host/initramfs/shell.nix
+++ b/host/initramfs/shell.nix
@@ -17,6 +17,8 @@ initramfs.overrideAttrs ({ nativeBuildInputs ? [], env ? {}, ... }: {

env = env // {
KERNEL = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}";
- ROOT_FS = rootfs;
+ ROOT_FS = "${rootfs}/rootfs";
+ ROOT_FS_VERITY = "${rootfs}/rootfs.verity.superblock";
+ ROOT_FS_VERITY_ROOTHASH = "${rootfs}/rootfs.verity.roothash";
};
})) (_: {})
diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile
index f107ca44fcf1ad85af5788d87f6c772910d40072..d7764d9b796f1773b4bebd0d50eec52b9be29e42 100644
--- a/host/rootfs/Makefile
+++ b/host/rootfs/Makefile
@@ -6,7 +6,7 @@
include ../../lib/common.mk
include file-list.mk

-dest = build/rootfs.erofs
+dest = build

DIRS = \
dev \
@@ -46,15 +46,27 @@ FIFOS = etc/s6-linux-init/run-image/service/s6-svscan-log/fifo

BUILD_FILES = build/etc/s6-rc

-$(dest): ../../scripts/make-erofs.sh $(PACKAGES_FILE) $(FILES) $(BUILD_FILES) build/empty build/fifo file-list.mk
- set -euo pipefail; \
+# This rule produces three files but Make only (portably)
+# supports one output per rule. Instead of resorting to temporary
+# files, a timestamp file is created as the last step. The actual
+# outputs are produced as side-effects.
+$(dest)/timestamp: ../../scripts/make-erofs.sh $(PACKAGES_FILE) $(FILES) $(BUILD_FILES) build/empty build/fifo file-list.mk $(dest)
{ \
cat $(PACKAGES_FILE) ;\
for file in $(FILES) $(LINKS); do printf '%s\n%s\n' $$file "$${file#image/}"; done ;\
for file in $(BUILD_FILES); do printf '%s\n%s\n' $$file $${file#build/}; done ;\
printf 'build/empty\n%s\n' $(DIRS) ;\
printf 'build/fifo\n%s\n' $(FIFOS) ;\
- } | ../../scripts/make-erofs.sh $@
+ } | ../../scripts/make-erofs.sh $(dest)/rootfs
+ $(VERITYSETUP) format \
+ --root-hash-file $(dest)/rootfs.verity.roothash \
+ -- $(dest)/rootfs $(dest)/rootfs.verity.superblock
+ # Add trailing newline
+ echo >> $(dest)/rootfs.verity.roothash
+ touch -- $(dest)/timestamp
+
+$(dest):
+ mkdir -p $(dest)

build/fifo:
mkdir -p build
@@ -83,25 +95,10 @@ clean:
rm -rf build
.PHONY: clean

-# veritysetup format produces two files, but Make only (portably)
-# supports one output per rule, so we combine the two outputs then
-# define two more rules to separate them again.
-build/rootfs.verity: $(dest)
- $(VERITYSETUP) format $(dest) build/rootfs.verity.superblock.tmp \
- | awk -F ':[[:blank:]]*' '$$1 == "Root hash" {print $$2; exit}' \
- > build/rootfs.verity.roothash.tmp
- cat build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp \
- > $@
- rm build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp
-build/rootfs.verity.roothash: build/rootfs.verity
- head -n 1 build/rootfs.verity > $@
-build/rootfs.verity.superblock: build/rootfs.verity
- tail -n +2 build/rootfs.verity > $@
-
-build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/rootfs.verity.superblock build/rootfs.verity.roothash $(dest)
+build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk $(dest)/timestamp
../../scripts/make-gpt.sh $@.tmp \
- build/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \
- $(dest):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)")
+ $(dest)/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=$(dest)/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \
+ $(dest)/rootfs:root:$$(../../scripts/format-uuid.sh "$$(head -c 32 $(dest)/rootfs.verity.roothash)")
mv $@.tmp $@

debug:
@@ -111,7 +108,7 @@ debug:
$(VMLINUX)
.PHONY: debug

-run: build/live.img $(EXT_FS) build/rootfs.verity.roothash
+run: build/live.img
@set -x && \
ext="$$(mktemp build/spectrum-rootfs-extfs.XXXXXXXXXX.img)" && \
truncate -s 10G "$$ext" && \
@@ -132,7 +129,7 @@ run: build/live.img $(EXT_FS) build/rootfs.verity.roothash
-device virtconsole,chardev=virtiocon0 \
-drive file=build/live.img,if=virtio,format=raw,readonly=on \
-drive file=/proc/self/fd/3,if=virtio,format=raw \
- -append "earlycon console=hvc0 roothash=$$(< build/rootfs.verity.roothash) intel_iommu=on nokaslr" \
+ -append "earlycon console=hvc0 roothash=$$(< $(dest)/rootfs.verity.roothash) intel_iommu=on nokaslr" \
-device virtio-keyboard \
-device virtio-mouse \
-device virtio-gpu \
diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix
index 0ac70c7c077c0656c5820a5d8b3c7ce0e7c78e54..eb6c64067091ef3802596ce581f82f322f5bfe34 100644
--- a/host/rootfs/default.nix
+++ b/host/rootfs/default.nix
@@ -138,7 +138,7 @@ stdenvNoCC.mkDerivation {
};
sourceRoot = "source/host/rootfs";

- nativeBuildInputs = [ erofs-utils spectrum-build-tools s6-rc ];
+ nativeBuildInputs = [ cryptsetup erofs-utils spectrum-build-tools s6-rc ];

env = {
PACKAGES = runCommand "packages" {} ''
diff --git a/host/rootfs/shell.nix b/host/rootfs/shell.nix
index 1bf61bebf418333624e799cc8ca231f5783206f4..6df2f575fdfc7cdf8067ccfdb5fecaad9f6ea5e6 100644
--- a/host/rootfs/shell.nix
+++ b/host/rootfs/shell.nix
@@ -12,7 +12,7 @@ rootfs.overrideAttrs (

{
nativeBuildInputs = nativeBuildInputs ++ [
- btrfs-progs cryptsetup jq netcat qemu_kvm reuse util-linux
+ btrfs-progs jq netcat qemu_kvm reuse util-linux
];

env = env // {
diff --git a/release/live/Makefile b/release/live/Makefile
index 6dcbdeedda5d6ccf293f60dc62043f46c81ecf83..191b44944af0adf965e1d5f2785719b236bfd99c 100644
--- a/release/live/Makefile
+++ b/release/live/Makefile
@@ -9,17 +9,17 @@ DTBS ?= build/empty

dest = build/live.img

-$(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/boot.fat build/rootfs.verity.superblock build/rootfs.verity.roothash $(ROOT_FS)
+$(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/boot.fat $(ROOT_FS_VERITY) $(ROOT_FS_VERITY_ROOTHASH) $(ROOT_FS)
../../scripts/make-gpt.sh $@.tmp \
build/boot.fat:c12a7328-f81f-11d2-ba4b-00a0c93ec93b \
- build/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \
- $(ROOT_FS):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)")
+ "$$ROOT_FS_VERITY":verity:$$(../../scripts/format-uuid.sh "$$(dd if="$$ROOT_FS_VERITY_ROOTHASH" bs=32 skip=1 count=1 status=none)") \
+ $(ROOT_FS):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 "$$ROOT_FS_VERITY_ROOTHASH")")
mv $@.tmp $@

build/empty:
mkdir -p $@

-build/spectrum.efi: build/rootfs.verity.roothash $(DTBS) $(KERNEL) $(INITRAMFS)
+build/spectrum.efi: $(DTBS) $(KERNEL) $(INITRAMFS) $(ROOT_FS_VERITY_ROOTHASH)
{ \
printf "[UKI]\nDeviceTreeAuto=" && \
find $(DTBS) -name '*.dtb' -print0 | tr '\0' ' ' ;\
@@ -29,7 +29,7 @@ build/spectrum.efi: build/rootfs.verity.roothash $(DTBS) $(KERNEL) $(INITRAMFS)
--linux $(KERNEL) \
--initrd $(INITRAMFS) \
--os-release $$'NAME="Spectrum"\n' \
- --cmdline "ro intel_iommu=on roothash=$$(cat build/rootfs.verity.roothash)"
+ --cmdline "ro intel_iommu=on roothash=$$(cat "$$ROOT_FS_VERITY_ROOTHASH")"

build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi
$(TRUNCATE) -s 440401920 $@
@@ -38,22 +38,6 @@ build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi
$(MCOPY) -i $@ build/spectrum.efi ::/EFI/Linux
$(MCOPY) -i $@ $(SYSTEMD_BOOT_EFI) ::/EFI/BOOT/$(EFINAME)

-# veritysetup format produces two files, but Make only (portably)
-# supports one output per rule, so we combine the two outputs then
-# define two more rules to separate them again.
-build/rootfs.verity: $(ROOT_FS)
- mkdir -p build
- $(VERITYSETUP) format $(ROOT_FS) build/rootfs.verity.superblock.tmp \
- | awk -F ':[[:blank:]]*' '$$1 == "Root hash" {print $$2; exit}' \
- > build/rootfs.verity.roothash.tmp
- cat build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp \
- > $@
- rm build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp
-build/rootfs.verity.roothash: build/rootfs.verity
- head -n 1 build/rootfs.verity > $@
-build/rootfs.verity.superblock: build/rootfs.verity
- tail -n +2 build/rootfs.verity > $@
-
clean:
rm -rf build
.PHONY: clean
diff --git a/release/live/default.nix b/release/live/default.nix
index 2a1dc3e1dd939f21edac582bf39737eb4d46eb0c..9a62d4da9cfea11d94d2a1d5764d41587efd5ad5 100644
--- a/release/live/default.nix
+++ b/release/live/default.nix
@@ -46,7 +46,9 @@ stdenv.mkDerivation {
env = {
INITRAMFS = initramfs;
KERNEL = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}";
- ROOT_FS = rootfs;
+ ROOT_FS = "${rootfs}/rootfs";
+ ROOT_FS_VERITY = "${rootfs}/rootfs.verity.superblock";
+ ROOT_FS_VERITY_ROOTHASH = "${rootfs}/rootfs.verity.roothash";
SYSTEMD_BOOT_EFI = "${systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
EFINAME = "BOOT${toUpper efiArch}.EFI";
} // lib.optionalAttrs stdenv.hostPlatform.linux-kernel.DTB or false {

--
2.51.2