Re: [PATCH v6 2/2] Move UKI creation to a separate derivation

[Demi Marie Obenour <demiobenour@gmail.com>]

[-- Attachment #1.1.1: Type: text/plain, Size: 4612 bytes --]

On 11/28/25 06:02, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> It will be used by the update code later.
>>
>> No functional change intended, other than a trivial shell script
>> refactoring.
>>
>> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
>> ---
>> I kept release/live/default.nix using the UKI's systemd because the old
>> code did it that way.  Changing this would be better in a separate
>> commit.
>>
>> Changes since v5:
>>
>> - Create a temporary symlink named build/spectrum.efi and then run
>>   $(MCOPY) -i $@ build/spectrum.efi ::/EFI/Linux, rather than copying
>>   the file with its original name.  The latter results in an unbootable
>>   image.  I do not know the reason.
>>
>> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
>> ---
>>  host/efi.nix             | 40 ++++++++++++++++++++++++++++++++++++++++
>>  release/live/Makefile    | 17 ++++-------------
>>  release/live/default.nix | 27 +++++++++++----------------
>>  release/live/shell.nix   | 10 ++++++++--
>>  4 files changed, 63 insertions(+), 31 deletions(-)
>>
>> diff --git a/host/efi.nix b/host/efi.nix
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..ecedb6bea6bf29c7a7303dc9062fe12b5c7a9fbd
>> --- /dev/null
>> +++ b/host/efi.nix
>> @@ -0,0 +1,40 @@
>> +# SPDX-License-Identifier: MIT
>> +# SPDX-FileCopyrightText: 2021-2024 Alyssa Ross <hi@alyssa.is>
>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>> +
>> +import ../lib/call-package.nix (
>> +{ callSpectrumPackage, cryptsetup, rootfs
>> +, runCommand, stdenv, systemdUkify
>> +}:
>> +let
>> +  initramfs = callSpectrumPackage ./initramfs {};
>> +  kernel = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}";
>> +  systemd = systemdUkify.overrideAttrs ({ mesonFlags ? [], ... }: {
>> +    # The default limit is too low to build a generic aarch64 distro image:
>> +    # https://github.com/systemd/systemd/pull/37417
>> +    mesonFlags = mesonFlags ++ [ "-Defi-stub-extra-sections=3000" ];
>> +  });
>> +in
>> +
>> +runCommand "spectrum-efi" {
>> +  nativeBuildInputs = [ cryptsetup systemd ];
>> +  __structuredAttrs = true;
>> +  unsafeDiscardReferences = { out = true; };
>> +  dontFixup = true;
>> +  passthru = { inherit initramfs rootfs systemd; };
>> +} ''
>> +  read -r roothash < ${rootfs}/rootfs.verity.roothash
>> +  { \
>> +      printf "[UKI]\nDeviceTreeAuto="
>> +      if [ -d ${rootfs.kernel}/dtbs ]; then
>> +          find ${rootfs.kernel}/dtbs -name '*.dtb' -print0 | tr '\0' ' '
>> +      fi
>> +  } | ukify build \
>> +      --output "$out" \
>> +      --config /dev/stdin \
>> +      --linux ${kernel} \
>> +      --initrd ${initramfs} \
>> +      --os-release $'NAME="Spectrum"\n' \
>> +      --cmdline "ro intel_iommu=on roothash=$roothash"
>> +  ''
>> +) (_: {})
>> diff --git a/release/live/Makefile b/release/live/Makefile
>> index ba81c7e679429e045b24c1591a9f0b72f016cfab..b37ccce42feb3ac7e8ce4faf96a67902b55be808 100644
>> --- a/release/live/Makefile
>> +++ b/release/live/Makefile
>> @@ -19,22 +19,13 @@ $(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sf
>>  build/empty:
>>  	mkdir -p $@
>>  
>> -build/spectrum.efi: $(DTBS) $(KERNEL) $(INITRAMFS) $(ROOT_FS_VERITY_ROOTHASH)
>> -	{ \
>> -	    printf "[UKI]\nDeviceTreeAuto=" && \
>> -	    find $(DTBS) -name '*.dtb' -print0 | tr '\0' ' ' ;\
>> -	} | $(UKIFY) build \
>> -	    --output $@ \
>> -	    --config /dev/stdin \
>> -	    --linux $(KERNEL) \
>> -	    --initrd $(INITRAMFS) \
>> -	    --os-release $$'NAME="Spectrum"\n' \
>> -	    --cmdline "ro intel_iommu=on roothash=$$(cat $(ROOT_FS_VERITY_ROOTHASH))"
>> -
>> -build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi
>> +build/boot.fat: $(SYSTEMD_BOOT_EFI) $(EFI_IMAGE) build/empty
> 
> Why add a build/empty dependency?  It doesn't seem to be used for
> anything any more?  (Neither does the DTBS variable, actually.)

The temporary symlink bodge below.  build/empty isn't needed, but
build is.  DTBS can just be deleted.

>>  	$(TRUNCATE) -s 440401920 $@
>>  	$(MKFS_FAT) $@
>>  	$(MMD) -i $@ ::/EFI ::/EFI/BOOT ::/EFI/Linux
>> +# This symlink is necessary.  Copying $(EFI_IMAGE) directly
>> +# results in an unbootable image.  TODO: figure out why.
>> +	ln -s $(EFI_IMAGE) build/spectrum.efi
>>  	$(MCOPY) -i $@ build/spectrum.efi ::/EFI/Linux
>>  	$(MCOPY) -i $@ $(SYSTEMD_BOOT_EFI) ::/EFI/BOOT/$(EFINAME)
>>  
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]