1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
| | # SPDX-FileCopyrightText: 2021-2025 Alyssa Ross <hi@alyssa.is>
# SPDX-License-Identifier: MIT
import ../../lib/call-package.nix (
{ src, spectrum-build-tools, rootfs
, lib, stdenvNoCC, makeModulesClosure, runCommand, writeClosure, pkgsStatic
, busybox, cpio, microcodeAmd, microcodeIntel
}:
pkgsStatic.callPackage ({ execline, kmod, mdevd, cryptsetup, util-linuxMinimal }:
let
inherit (lib) concatMapStringsSep filter foldl isString last split tail;
modules = makeModulesClosure {
inherit (rootfs) firmware;
kernel = rootfs.kernel.modules;
rootModules = with rootfs.nixosAllHardware.config.boot.initrd;
lib.subtractLists [ "virtio_net" "vmxnet3" ]
(availableKernelModules ++ kernelModules ++ [
"dm-verity" "erofs" "loop"
]);
};
packages = [
execline kmod mdevd
(cryptsetup.override {
programs = {
cryptsetup = false;
cryptsetup-reencrypt = false;
integritysetup = false;
};
})
(busybox.override {
enableStatic = true;
extraConfig = ''
CONFIG_DEPMOD n
CONFIG_FINDFS n
CONFIG_INSMOD n
CONFIG_LSMOD n
CONFIG_MODINFO n
CONFIG_MODPROBE n
CONFIG_RMMOD n
'';
})
];
packagesSysroot = runCommand "packages-sysroot" {} ''
mkdir -p $out/bin
ln -s ${concatMapStringsSep " " (p: "${p}/bin/*") packages} $out/bin
cp -R ${modules}/lib $out
ln -s /bin $out/sbin
# TODO: this is a hack and we should just build the util-linux
# programs we want.
# https://lore.kernel.org/util-linux/87zgrl6ufb.fsf@alyssa.is/
cp ${util-linuxMinimal}/bin/{findfs,lsblk} $out/bin
'';
microcode = runCommand "microcode.cpio" {
nativeBuildInputs = [ cpio ];
__structuredAttrs = true;
unsafeDiscardReferences = { out = true; };
dontFixup = true;
} ''
cpio -id < ${microcodeAmd}/amd-ucode.img
cpio -id < ${microcodeIntel}/intel-ucode.img
find kernel | cpio -oH newc -R +0:+0 --reproducible > $out
'';
storeComponents = tail (filter isString (split "/" builtins.storeDir));
packagesCpio = runCommand "packages.cpio" {
nativeBuildInputs = [ cpio ];
storePaths = writeClosure [ packagesSysroot ];
storePrefixes = foldl
(acc: elem: acc ++ [ "${if acc == [] then "" else last acc}/${elem}" ])
[]
storeComponents;
__structuredAttrs = true;
unsafeDiscardReferences = { out = true; };
dontFixup = true;
} ''
cd ${packagesSysroot}
(printf "%s\n" "''${storePrefixes[@]}" && find . $(< $storePaths)) |
cpio -o -H newc -R +0:+0 --reproducible > $out
'';
in
stdenvNoCC.mkDerivation {
name = "initramfs";
src = lib.fileset.toSource {
root = ../..;
fileset = lib.fileset.intersection src (lib.fileset.unions [
./.
../../lib/common.mk
../../lib/kcmdline-utils.mk
]);
};
sourceRoot = "source/host/initramfs";
env = {
PACKAGES_CPIO = packagesCpio;
VERSION = import ../../lib/version.nix;
} // lib.optionalAttrs stdenvNoCC.hostPlatform.isx86_64 {
MICROCODE = microcode;
};
nativeBuildInputs = [ cpio spectrum-build-tools ];
makeFlags = [ "dest=$(out)" ];
dontInstall = true;
enableParallelBuilding = true;
__structuredAttrs = true;
unsafeDiscardReferences = { out = true; };
dontFixup = true;
passthru = { inherit packagesSysroot; };
}
) {}) (_: {})
|