Re: [PATCH v4 11/14] release: Create directory with system update

Alyssa Ross
2025-11-25T16:50:54Z

[-- Attachment #1: Type: text/plain, Size: 2343 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> Whenever a release is made, create a directory with the release files to
> be used for an update. After its SHA256SSUMS file is signed, the file
> is ready to be uploaded to a server for users to update from.
>
> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
> ---
> Changes since v2:
> - Use UUIDs to name the rootfs and verity superblock.
> This will allow systemd-sysupdate to set the correct UUIDs on the
> rootfs and verity partitions, avoiding the need to use labels to find
> these partitions.
> ---
> release.nix | 2 ++
> release/update.nix | 33 +++++++++++++++++++++++++++++++++
> 2 files changed, 35 insertions(+)

Reviewed-by: Alyssa Ross <hi@alyssa.is>

But I think we should be clearer about set, see below.

> diff --git a/release.nix b/release.nix
> index a4fe66ee5925aeee3a1f5f1fac249c595cee0885..704abb39a3d01152eac3dfe313066834c3cd0a66 100644
> --- a/release.nix
> +++ b/release.nix
> @@ -8,5 +8,7 @@ import lib/call-package.nix ({ callSpectrumPackage }: {
>
> checks = callSpectrumPackage release/checks {};
>
> + updates = callSpectrumPackage release/update.nix {};
> +
> combined = callSpectrumPackage release/combined/run-vm.nix {};
> }) (_: {})
> diff --git a/release/update.nix b/release/update.nix
> new file mode 100644
> index 0000000000000000000000000000000000000000..77eb5fc422baa7d13e8e3ccb823c2fe69d2c39cc
> --- /dev/null
> +++ b/release/update.nix
> @@ -0,0 +1,33 @@
> +# SPDX-License-Identifier: MIT
> +# SPDX-FileCopyrightText: 2021-2024 Alyssa Ross <hi@alyssa.is>
> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +
> +import ../lib/call-package.nix (
> +{ callSpectrumPackage, config, runCommand, stdenv }:
> +
> +let
> + efi = import ../host/efi.nix {};
> +in
> +runCommand "spectrum-update-directory" {
> + __structuredAttrs = true;
> + unsafeDiscardReferences = { out = true; };
> + dontFixup = true;
> + env = { VERSION = config.version; };
> +} ''
> + # One would expect that this is enabled already but it is not.
> + set -euo pipefail

I see. stdenv leaves -eo pipefail set, but not -u.

In that case, we should just set -u so it's clearer what change is
actually intended to be made to the environment.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]