[PATCH v4 09/14] Use OS version to set partition labels and UKI name

Demi Marie Obenour
2025-11-22T01:28:02Z

systemd-sysupdate has strict requirements on the partition layout:

- The label of the active partition must match the template in the
.transfer file. For instance, the root filesystem of Spectrum 0.0.0
must be in a partition with label "Spectrum_0.0.0", and the verity
partition must have the label "Spectrum_0.0.0.verity".

- The label of the inactive partition must be that of the old version of
Spectrum, or "_empty" for freshly installed systems.

- The partition type UUID must conform to the Discoverable Partition
Specification.

Also, the UKI must have a name that includes the OS version. Otherwise,
it will not be deleted during updates.

Since the partition label includes the OS version, add an OS version
number. Use 0.0.0 to indicate that Spectrum OS is still in very early
development and should not be used. The version number can be
overridden in the build configuration file.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
Changes since v2:
- Split off into separate commit.
---
host/efi.nix | 2 +-
host/initramfs/Makefile | 4 ++--
host/initramfs/shell.nix | 2 ++
host/rootfs/Makefile | 4 ++--
host/rootfs/shell.nix | 2 ++
lib/config.default.nix | 1 +
release/live/Makefile | 6 +++---
release/live/default.nix | 3 +++
8 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/host/efi.nix b/host/efi.nix
index d0ce260bd908c186059b75a1b4f42258b0e62bff..ecedb6bea6bf29c7a7303dc9062fe12b5c7a9fbd 100644
--- a/host/efi.nix
+++ b/host/efi.nix
@@ -3,7 +3,7 @@
# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>

import ../lib/call-package.nix (
-{ callSpectrumPackage, config, cryptsetup, rootfs
+{ callSpectrumPackage, cryptsetup, rootfs
, runCommand, stdenv, systemdUkify
}:
let
diff --git a/host/initramfs/Makefile b/host/initramfs/Makefile
index 735c12fc207f027db2b605309976a832b09335d6..db33ff86e9cd994efd4ce50acdf881d69ba79299 100644
--- a/host/initramfs/Makefile
+++ b/host/initramfs/Makefile
@@ -39,8 +39,8 @@ build/live.img: ../../scripts/format-uuid.awk ../../scripts/make-gpt.sh ../../sc
uuids=$$(awk -f ../../scripts/format-uuid.awk < $(ROOT_FS_VERITY_ROOTHASH)) && \
set -euo pipefail -- $$uuids && \
bash ../../scripts/make-gpt.sh $@.tmp \
- $(ROOT_FS_VERITY):verity:$$3 \
- $(ROOT_FS):root:$$1
+ $(ROOT_FS_VERITY):verity:$$3:Spectrum_'$(VERSION).verity' \
+ $(ROOT_FS):root:$$1:Spectrum_'$(VERSION)'
mv $@.tmp $@

clean:
diff --git a/host/initramfs/shell.nix b/host/initramfs/shell.nix
index ff067354881b480656fae9b339a0a9068475d85f..36e3956a2ebc80fd273da226af253ebe8f7f7b24 100644
--- a/host/initramfs/shell.nix
+++ b/host/initramfs/shell.nix
@@ -4,6 +4,7 @@
import ../../lib/call-package.nix (
{ callSpectrumPackage, rootfs, pkgsStatic, stdenv
, cryptsetup, jq, qemu_kvm, tar2ext4, util-linux
+, config
}:

let
@@ -18,5 +19,6 @@ initramfs.overrideAttrs ({ nativeBuildInputs ? [], env ? {}, ... }: {
env = env // {
KERNEL = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}";
ROOT_FS_DIR = rootfs;
+ VERSION = config.version;
};
})) (_: {})
diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile
index f02bb76371f000e3f65bb7c2a7f217d437845481..d64bce115cc6c306956121b4bcd7271331ba1b7e 100644
--- a/host/rootfs/Makefile
+++ b/host/rootfs/Makefile
@@ -93,8 +93,8 @@ build/live.img: ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scr
uuids=$$(awk -f ../../scripts/format-uuid.awk < $(ROOT_FS_VERITY_ROOTHASH)) && \
set -euo pipefail -- $$uuids && \
bash ../../scripts/make-gpt.sh $@.tmp \
- $(ROOT_FS_VERITY):verity:$$3 \
- $(ROOT_FS):root:$$1
+ $(ROOT_FS_VERITY):verity:$$3:Spectrum_'$(VERSION).verity' \
+ $(ROOT_FS):root:$$1:Spectrum_'$(VERSION)'
mv $@.tmp $@

debug:
diff --git a/host/rootfs/shell.nix b/host/rootfs/shell.nix
index 6df2f575fdfc7cdf8067ccfdb5fecaad9f6ea5e6..27f93e05fce036257d27cf9992fee8c925073f80 100644
--- a/host/rootfs/shell.nix
+++ b/host/rootfs/shell.nix
@@ -5,6 +5,7 @@
import ../../lib/call-package.nix (
{ callSpectrumPackage, rootfs, pkgsStatic, srcOnly, stdenv
, btrfs-progs, cryptsetup, jq, netcat, qemu_kvm, reuse, util-linux
+, config
}:

rootfs.overrideAttrs (
@@ -20,5 +21,6 @@ rootfs.overrideAttrs (
KERNEL = "${passthru.kernel}/${stdenv.hostPlatform.linux-kernel.target}";
LINUX_SRC = srcOnly passthru.kernel.configfile;
VMLINUX = "${passthru.kernel.dev}/vmlinux";
+ VERSION = config.version;
};
})) (_: {})
diff --git a/lib/config.default.nix b/lib/config.default.nix
index b1c4c33f1dca3d503fb8e3ef855d65c49cf5a202..4ea2fead303d9a064fc0ce3a188423d6dbcc6c08 100644
--- a/lib/config.default.nix
+++ b/lib/config.default.nix
@@ -5,4 +5,5 @@
pkgsFun = import ./nixpkgs.default.nix;
pkgsArgs = {};
compressionLevel = 1;
+ version = "0.0.0";
}
diff --git a/release/live/Makefile b/release/live/Makefile
index 78361a48512a37514ba0e57e0cc8b0ec3a71664b..a85edfde2d186716656ed23fe719ca63b31bcd59 100644
--- a/release/live/Makefile
+++ b/release/live/Makefile
@@ -14,8 +14,8 @@ $(dest): ../../scripts/format-uuid.awk ../../scripts/make-gpt.sh ../../scripts/s
set -euo pipefail -- $$uuids && \
bash ../../scripts/make-gpt.sh $@.tmp \
build/boot.fat:c12a7328-f81f-11d2-ba4b-00a0c93ec93b \
- $(ROOT_FS_VERITY):verity:$$3 \
- $(ROOT_FS):root:$$1
+ $(ROOT_FS_VERITY):verity:$$3:Spectrum_'$(VERSION).verity' \
+ $(ROOT_FS):root:$$1:Spectrum_'$(VERSION)'
mv $@.tmp $@

build/empty:
@@ -25,7 +25,7 @@ build/boot.fat: $(SYSTEMD_BOOT_EFI) $(EFI_IMAGE) build/empty
$(TRUNCATE) -s 440401920 $@
$(MKFS_FAT) $@
$(MMD) -i $@ ::/EFI ::/EFI/BOOT ::/EFI/Linux
- $(MCOPY) -i $@ $(EFI_IMAGE) ::/EFI/Linux/spectrum.efi
+ $(MCOPY) -i $@ $(EFI_IMAGE) '::/EFI/Linux/Spectrum_$(VERSION).efi'
$(MCOPY) -i $@ $(SYSTEMD_BOOT_EFI) ::/EFI/BOOT/$(EFINAME)

clean:
diff --git a/release/live/default.nix b/release/live/default.nix
index 98cb4862e239e3ad9ddbd7b5ace5716f57df683b..22e5a00de08ed858522a00f00359890ef52f03e0 100644
--- a/release/live/default.nix
+++ b/release/live/default.nix
@@ -1,11 +1,13 @@
# SPDX-License-Identifier: MIT
# SPDX-FileCopyrightText: 2021-2023, 2025 Alyssa Ross <hi@alyssa.is>
# SPDX-FileCopyrightText: 2022 Unikie
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>

import ../../lib/call-package.nix (
{ callSpectrumPackage, spectrum-build-tools, src
, lib, pkgsStatic, stdenvNoCC
, cryptsetup, dosfstools, jq, mtools, util-linux
+, config
}:

let
@@ -46,6 +48,7 @@ stdenv.mkDerivation {
SYSTEMD_BOOT_EFI = "${systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
EFI_IMAGE = efi;
EFINAME = "BOOT${toUpper efiArch}.EFI";
+ VERSION = config.version;
};

buildFlags = [ "dest=$(out)" ];

--
2.52.0