[PATCH v6 5/8] release: Create directory with system update

Demi Marie Obenour
2025-11-29T09:51:24Z

Whenever a release is made, create a directory with the release files to
be used for an update. After its SHA256SSUMS file is signed, the file
is ready to be uploaded to a server for users to update from.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
Reviewed-by: Alyssa Ross <hi@alyssa.is>
---
Changes since v4:
- Only set -u because stdenv sets the reset. Update comment.

Changes since v2:
- Use UUIDs to name the rootfs and verity superblock.
This will allow systemd-sysupdate to set the correct UUIDs on the
rootfs and verity partitions, avoiding the need to use labels to find
these partitions.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
release.nix | 2 ++
release/update.nix | 33 +++++++++++++++++++++++++++++++++
2 files changed, 35 insertions(+)

diff --git a/release.nix b/release.nix
index a4fe66ee5925aeee3a1f5f1fac249c595cee0885..704abb39a3d01152eac3dfe313066834c3cd0a66 100644
--- a/release.nix
+++ b/release.nix
@@ -8,5 +8,7 @@ import lib/call-package.nix ({ callSpectrumPackage }: {

checks = callSpectrumPackage release/checks {};

+ updates = callSpectrumPackage release/update.nix {};
+
combined = callSpectrumPackage release/combined/run-vm.nix {};
}) (_: {})
diff --git a/release/update.nix b/release/update.nix
new file mode 100644
index 0000000000000000000000000000000000000000..18a91ac1eea56e9b2a941eb08244b3dee613b721
--- /dev/null
+++ b/release/update.nix
@@ -0,0 +1,33 @@
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: 2021-2024 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+
+import ../lib/call-package.nix (
+{ callSpectrumPackage, config, runCommand, stdenv }:
+
+let
+ efi = import ../host/efi.nix {};
+in
+runCommand "spectrum-update-directory" {
+ __structuredAttrs = true;
+ unsafeDiscardReferences = { out = true; };
+ dontFixup = true;
+ env = { VERSION = config.version; };
+} ''
+ # stdenv sets -eo pipefail, but not -u
+ set -u
+ mkdir -- "$out"
+ cd -- "$out"
+ read -r roothash < ${efi.rootfs}/rootfs.verity.roothash
+ if ! [[ "$roothash" =~ ^[0-9a-f]{64}$ ]]; then
+ printf 'Internal error: bad root hash %q\n' "$roothash"
+ exit 1
+ fi
+ cp -- ${efi} "Spectrum_$VERSION.efi"
+ cp -- ${efi.rootfs}/rootfs.verity.superblock "Spectrum_''${VERSION}_''${roothash:32:32}.verity"
+ cp -- ${efi.rootfs}/rootfs "Spectrum_''${VERSION}_''${roothash:0:32}.root"
+ sha256sum -b "Spectrum_$VERSION.efi" \
+ "Spectrum_''${VERSION}_''${roothash:32:32}.verity" \
+ "Spectrum_''${VERSION}_''${roothash:0:32}.root" > SHA256SUMS
+ ''
+) (_: {})

--
2.52.0