commit b1fc18363968c4ca5dcbffd81699de378f35f6aa · pyrox.dev/nixpkgs

+1 -1

lib/systems/default.nix

···

       83
       83
        
               if final.isAarch32 then "arm"

     

       84
       84
        
               else if final.isAarch64 then "arm64"

     

       85
       85
        
               else if final.isx86_32 then "x86"

     

       86
       86
       -
               else if final.isx86_64 then "ia64"

     

       86
       86
       +
               else if final.isx86_64 then "x86"

     

       87
       87
        
               else if final.isMips then "mips"

     

       88
       88
        
               else final.parsed.cpu.name;

     

       89
       89

+24 -7

nixos/modules/system/boot/stage-1.nix

···

       308
       308
        
         # the initial RAM disk.

     

       309
       309
        
         initialRamdisk = pkgs.makeInitrd {

     

       310
       310
        
           name = "initrd-${kernel-name}";

     

       311
       311
       -
           inherit (config.boot.initrd) compressor prepend;

     

       311
       311
       +
           inherit (config.boot.initrd) compressor compressorArgs prepend;

     

       312
       312
        
       

     

       313
       313
        
           contents =

     

       314
       314
        
             [ { object = bootStage1;

     
···

       334
       334
        
       

     

       335
       335
        
         # Script to add secret files to the initrd at bootloader update time

     

       336
       336
        
         initialRamdiskSecretAppender =

     

       337
       337
       -
           pkgs.writeScriptBin "append-initrd-secrets"

     

       337
       337
       +
           let

     

       338
       338
       +
             compressorExe = initialRamdisk.compressorExecutableFunction pkgs;

     

       339
       339
       +
           in pkgs.writeScriptBin "append-initrd-secrets"

     

       338
       340
        
             ''

     

       339
       341
        
               #!${pkgs.bash}/bin/bash -e

     

       340
       342
        
               function usage {

     
···

       376
       378
        
                }

     

       377
       379
        
       

     

       378
       380
        
               (cd "$tmp" && find . -print0 | sort -z | cpio -o -H newc -R +0:+0 --reproducible --null) | \

     

       379
       379
       -
                 ${config.boot.initrd.compressor} >> "$1"

     

       381
       381
       +
                 ${compressorExe} ${lib.escapeShellArgs initialRamdisk.compressorArgs} >> "$1"

     

       380
       382
        
             '';

     

       381
       383
        
       

     

       382
       384
        
       in

     
···

       511
       513
        
           };

     

       512
       514
        
       

     

       513
       515
        
           boot.initrd.compressor = mkOption {

     

       514
       514
       -
             internal = true;

     

       515
       515
       -
             default = "gzip -9n";

     

       516
       516
       -
             type = types.str;

     

       517
       517
       -
             description = "The compressor to use on the initrd image.";

     

       516
       516
       +
             default = "gzip";

     

       517
       517
       +
             type = types.unspecified; # We don't have a function type...

     

       518
       518
       +
             description = ''

     

       519
       519
       +
               The compressor to use on the initrd image. May be any of:

     

       520
       520
       +
       

     

       521
       521
       +
               <itemizedlist>

     

       522
       522
       +
                <listitem><para>The name of one of the predefined compressors, see <filename>pkgs/build-support/kernel/initrd-compressor-meta.nix</filename> for the definitions.</para></listitem>

     

       523
       523
       +
                <listitem><para>A function which, given the nixpkgs package set, returns the path to a compressor tool, e.g. <literal>pkgs: "''${pkgs.pigz}/bin/pigz"</literal></para></listitem>

     

       524
       524
       +
                <listitem><para>(not recommended, because it does not work when cross-compiling) the full path to a compressor tool, e.g. <literal>"''${pkgs.pigz}/bin/pigz"</literal></para></listitem>

     

       525
       525
       +
               </itemizedlist>

     

       526
       526
       +
       

     

       527
       527
       +
               The given program should read data from stdin and write it to stdout compressed.

     

       528
       528
       +
             '';

     

       518
       529
        
             example = "xz";

     

       530
       530
       +
           };

     

       531
       531
       +
       

     

       532
       532
       +
           boot.initrd.compressorArgs = mkOption {

     

       533
       533
       +
             default = null;

     

       534
       534
       +
             type = types.nullOr (types.listOf types.str);

     

       535
       535
       +
             description = "Arguments to pass to the compressor for the initrd image, or null to use the compressor's defaults.";

     

       519
       536
        
           };

     

       520
       537
        
       

     

       521
       538
        
           boot.initrd.secrets = mkOption

nixos/tests/all-tests.nix

···

       168
       168
        
         initrd-network-openvpn = handleTest ./initrd-network-openvpn {};

     

       169
       169
        
         initrd-network-ssh = handleTest ./initrd-network-ssh {};

     

       170
       170
        
         initrdNetwork = handleTest ./initrd-network.nix {};

     

       171
       171
       +
         initrd-secrets = handleTest ./initrd-secrets.nix {};

     

       171
       172
        
         installer = handleTest ./installer.nix {};

     

       172
       173
        
         iodine = handleTest ./iodine.nix {};

     

       173
       174
        
         ipfs = handleTest ./ipfs.nix {};

+35

nixos/tests/initrd-secrets.nix

···

       1
       1
       +
       { system ? builtins.currentSystem

     

       2
       2
       +
       , config ? {}

     

       3
       3
       +
       , pkgs ? import ../.. { inherit system config; }

     

       4
       4
       +
       , lib ? pkgs.lib

     

       5
       5
       +
       , testing ? import ../lib/testing-python.nix { inherit system pkgs; }

     

       6
       6
       +
       }:

     

       7
       7
       +
       let

     

       8
       8
       +
         secretInStore = pkgs.writeText "topsecret" "iamasecret";

     

       9
       9
       +
         testWithCompressor = compressor: testing.makeTest {

     

       10
       10
       +
           name = "initrd-secrets-${compressor}";

     

       11
       11
       +
       

     

       12
       12
       +
           meta.maintainers = [ lib.maintainers.lheckemann ];

     

       13
       13
       +
       

     

       14
       14
       +
           machine = { ... }: {

     

       15
       15
       +
             virtualisation.useBootLoader = true;

     

       16
       16
       +
             boot.initrd.secrets."/test" = secretInStore;

     

       17
       17
       +
             boot.initrd.postMountCommands = ''

     

       18
       18
       +
               cp /test /mnt-root/secret-from-initramfs

     

       19
       19
       +
             '';

     

       20
       20
       +
             boot.initrd.compressor = compressor;

     

       21
       21
       +
             # zstd compression is only supported from 5.9 onwards. Remove when 5.10 becomes default.

     

       22
       22
       +
             boot.kernelPackages = pkgs.linuxPackages_latest;

     

       23
       23
       +
           };

     

       24
       24
       +
       

     

       25
       25
       +
           testScript = ''

     

       26
       26
       +
             start_all()

     

       27
       27
       +
             machine.wait_for_unit("multi-user.target")

     

       28
       28
       +
             machine.succeed(

     

       29
       29
       +
                 "cmp ${secretInStore} /secret-from-initramfs"

     

       30
       30
       +
             )

     

       31
       31
       +
           '';

     

       32
       32
       +
         };

     

       33
       33
       +
       in lib.flip lib.genAttrs testWithCompressor [

     

       34
       34
       +
         "cat" "gzip" "bzip2" "xz" "lzma" "lzop" "pigz" "pixz" "zstd"

     

       35
       35
       +
       ]

+53

pkgs/build-support/kernel/initrd-compressor-meta.nix

···

       1
       1
       +
       rec {

     

       2
       2
       +
         cat = {

     

       3
       3
       +
           executable = pkgs: "cat";

     

       4
       4
       +
           ubootName = "none";

     

       5
       5
       +
           extension = ".cpio";

     

       6
       6
       +
         };

     

       7
       7
       +
         gzip = {

     

       8
       8
       +
           executable = pkgs: "${pkgs.gzip}/bin/gzip";

     

       9
       9
       +
           defaultArgs = ["-9n"];

     

       10
       10
       +
           ubootName = "gzip";

     

       11
       11
       +
           extension = ".gz";

     

       12
       12
       +
         };

     

       13
       13
       +
         bzip2 = {

     

       14
       14
       +
           executable = pkgs: "${pkgs.bzip2}/bin/bzip2";

     

       15
       15
       +
           ubootName = "bzip2";

     

       16
       16
       +
           extension = ".bz2";

     

       17
       17
       +
         };

     

       18
       18
       +
         xz = {

     

       19
       19
       +
           executable = pkgs: "${pkgs.xz}/bin/xz";

     

       20
       20
       +
           defaultArgs = ["--check=crc32" "--lzma2=dict=512KiB"];

     

       21
       21
       +
           extension = ".xz";

     

       22
       22
       +
         };

     

       23
       23
       +
         lzma = {

     

       24
       24
       +
           executable = pkgs: "${pkgs.xz}/bin/lzma";

     

       25
       25
       +
           defaultArgs = ["--check=crc32" "--lzma1=dict=512KiB"];

     

       26
       26
       +
           ubootName = "lzma";

     

       27
       27
       +
           extension = ".lzma";

     

       28
       28
       +
         };

     

       29
       29
       +
         lz4 = {

     

       30
       30
       +
           executable = pkgs: "${pkgs.lz4}/bin/lz4";

     

       31
       31
       +
           defaultArgs = ["-l"];

     

       32
       32
       +
           ubootName = "lz4";

     

       33
       33
       +
           extension = ".lz4";

     

       34
       34
       +
         };

     

       35
       35
       +
         lzop = {

     

       36
       36
       +
           executable = pkgs: "${pkgs.lzop}/bin/lzop";

     

       37
       37
       +
           ubootName = "lzo";

     

       38
       38
       +
           extension = ".lzo";

     

       39
       39
       +
         };

     

       40
       40
       +
         zstd = {

     

       41
       41
       +
           executable = pkgs: "${pkgs.zstd}/bin/zstd";

     

       42
       42
       +
           defaultArgs = ["-10"];

     

       43
       43
       +
           ubootName = "zstd";

     

       44
       44
       +
           extension = ".zst";

     

       45
       45
       +
         };

     

       46
       46
       +
         pigz = gzip // {

     

       47
       47
       +
           executable = pkgs: "${pkgs.pigz}/bin/pigz";

     

       48
       48
       +
         };

     

       49
       49
       +
         pixz = xz // {

     

       50
       50
       +
           executable = pkgs: "${pkgs.pixz}/bin/pixz";

     

       51
       51
       +
           defaultArgs = [];

     

       52
       52
       +
         };

     

       53
       53
       +
       }

+77 -16

pkgs/build-support/kernel/make-initrd.nix

···

       1
       1
       -
       # Create an initial ramdisk containing the closure of the specified

     

       2
       2
       -
       # file system objects.  An initial ramdisk is used during the initial

     

       1
       1
       +
       # Create an initramfs containing the closure of the specified

     

       2
       2
       +
       # file system objects.  An initramfs is used during the initial

     

       3
       3
        
       # stages of booting a Linux system.  It is loaded by the boot loader

     

       4
       4
        
       # along with the kernel image.  It's supposed to contain everything

     

       5
       5
        
       # (such as kernel modules) necessary to allow us to mount the root

     

       6
       6
        
       # file system.  Once the root file system is mounted, the `real' boot

     

       7
       7
        
       # script can be called.

     

       8
       8
        
       #

     

       9
       9
       -
       # An initrd is really just a gzipped cpio archive.

     

       10
       10
       -
       #

     

       11
       11
       -
       # Symlinks are created for each top-level file system object.  E.g.,

     

       12
       12
       -
       # `contents = {object = ...; symlink = /init;}' is a typical

     

       13
       13
       -
       # argument.

     

       9
       9
       +
       # An initramfs is a cpio archive, and may be compressed with a number

     

       10
       10
       +
       # of algorithms.

     

       11
       11
       +
       let

     

       12
       12
       +
         # Some metadata on various compression programs, relevant to naming

     

       13
       13
       +
         # the initramfs file and, if applicable, generating a u-boot image

     

       14
       14
       +
         # from it.

     

       15
       15
       +
         compressors = import ./initrd-compressor-meta.nix;

     

       16
       16
       +
         # Get the basename of the actual compression program from the whole

     

       17
       17
       +
         # compression command, for the purpose of guessing the u-boot

     

       18
       18
       +
         # compression type and filename extension.

     

       19
       19
       +
         compressorName = fullCommand: builtins.elemAt (builtins.match "([^ ]*/)?([^ ]+).*" fullCommand) 1;

     

       20
       20
       +
       in

     

       21
       21
       +
       { stdenvNoCC, perl, cpio, ubootTools, lib, pkgsBuildHost

     

       22
       22
       +
       # Name of the derivation (not of the resulting file!)

     

       23
       23
       +
       , name ? "initrd"

     

       24
       24
       +
       

     

       25
       25
       +
       # Program used to compress the cpio archive; use "cat" for no compression.

     

       26
       26
       +
       # This can also be a function which takes a package set and returns the path to the compressor,

     

       27
       27
       +
       # such as `pkgs: "${pkgs.lzop}/bin/lzop"`.

     

       28
       28
       +
       , compressor ? "gzip"

     

       29
       29
       +
       , _compressorFunction ?

     

       30
       30
       +
         if lib.isFunction compressor then compressor

     

       31
       31
       +
         else if ! builtins.hasContext compressor && builtins.hasAttr compressor compressors then compressors.${compressor}.executable

     

       32
       32
       +
         else _: compressor

     

       33
       33
       +
       , _compressorExecutable ? _compressorFunction pkgsBuildHost

     

       34
       34
       +
       , _compressorName ? compressorName _compressorExecutable

     

       35
       35
       +
       , _compressorMeta ? compressors.${_compressorName} or {}

     

       36
       36
       +
       

     

       37
       37
       +
       # List of arguments to pass to the compressor program, or null to use its defaults

     

       38
       38
       +
       , compressorArgs ? null

     

       39
       39
       +
       , _compressorArgsReal ? if compressorArgs == null then _compressorMeta.defaultArgs or [] else compressorArgs

     

       40
       40
       +
       

     

       41
       41
       +
       # Filename extension to use for the compressed initramfs. This is

     

       42
       42
       +
       # included for clarity, but $out/initrd will always be a symlink to

     

       43
       43
       +
       # the final image.

     

       44
       44
       +
       # If this isn't guessed, you may want to complete the metadata above and send a PR :)

     

       45
       45
       +
       , extension ? _compressorMeta.extension or

     

       46
       46
       +
           (throw "Unrecognised compressor ${_compressorName}, please specify filename extension")

     

       47
       47
       +
       

     

       48
       48
       +
       # List of { object = path_or_derivation; symlink = "/path"; }

     

       49
       49
       +
       # The paths are copied into the initramfs in their nix store path

     

       50
       50
       +
       # form, then linked at the root according to `symlink`.

     

       51
       51
       +
       , contents

     

       14
       52
        
       

     

       15
       15
       -
       { stdenvNoCC, perl, cpio, contents, ubootTools

     

       16
       16
       -
       , name ? "initrd"

     

       17
       17
       -
       , compressor ? "gzip -9n"

     

       53
       53
       +
       # List of uncompressed cpio files to prepend to the initramfs. This

     

       54
       54
       +
       # can be used to add files in specified paths without them becoming

     

       55
       55
       +
       # symlinks to store paths.

     

       18
       56
        
       , prepend ? []

     

       19
       19
       -
       , lib

     

       57
       57
       +
       

     

       58
       58
       +
       # Whether to wrap the initramfs in a u-boot image.

     

       59
       59
       +
       , makeUInitrd ? stdenvNoCC.hostPlatform.platform.kernelTarget == "uImage"

     

       60
       60
       +
       

     

       61
       61
       +
       # If generating a u-boot image, the architecture to use. The default

     

       62
       62
       +
       # guess may not align with u-boot's nomenclature correctly, so it can

     

       63
       63
       +
       # be overridden.

     

       64
       64
       +
       # See https://gitlab.denx.de/u-boot/u-boot/-/blob/9bfb567e5f1bfe7de8eb41f8c6d00f49d2b9a426/common/image.c#L81-106 for a list.

     

       65
       65
       +
       , uInitrdArch ? stdenvNoCC.hostPlatform.kernelArch

     

       66
       66
       +
       

     

       67
       67
       +
       # The name of the compression, as recognised by u-boot.

     

       68
       68
       +
       # See https://gitlab.denx.de/u-boot/u-boot/-/blob/9bfb567e5f1bfe7de8eb41f8c6d00f49d2b9a426/common/image.c#L195-204 for a list.

     

       69
       69
       +
       # If this isn't guessed, you may want to complete the metadata above and send a PR :)

     

       70
       70
       +
       , uInitrdCompression ? _compressorMeta.ubootName or

     

       71
       71
       +
           (throw "Unrecognised compressor ${_compressorName}, please specify uInitrdCompression")

     

       20
       72
        
       }:

     

       21
       73
        
       let

     

       22
       74
        
         # !!! Move this into a public lib function, it is probably useful for others

     
···

       24
       76
        
           lib.concatStringsSep "-" (filter (x: !(isList x)) (split "[^a-zA-Z0-9_=.?-]+" x));

     

       25
       77
        
       

     

       26
       78
        
       in stdenvNoCC.mkDerivation rec {

     

       27
       27
       -
         inherit name;

     

       79
       79
       +
         inherit name makeUInitrd extension uInitrdArch prepend;

     

       28
       80
        
       

     

       29
       29
       -
         builder = ./make-initrd.sh;

     

       81
       81
       +
         ${if makeUInitrd then "uinitrdCompression" else null} = uInitrdCompression;

     

       30
       82
        
       

     

       31
       31
       -
         makeUInitrd = stdenvNoCC.hostPlatform.platform.kernelTarget == "uImage";

     

       83
       83
       +
         builder = ./make-initrd.sh;

     

       32
       84
        
       

     

       33
       85
        
         nativeBuildInputs = [ perl cpio ]

     

       34
       86
        
           ++ stdenvNoCC.lib.optional makeUInitrd ubootTools;

     

       35
       87
        
       

     

       88
       88
       +
         compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";

     

       89
       89
       +
       

     

       90
       90
       +
         # Pass the function through, for reuse in append-initrd-secrets. The

     

       91
       91
       +
         # function is used instead of the string, in order to support

     

       92
       92
       +
         # cross-compilation (append-initrd-secrets running on a different

     

       93
       93
       +
         # architecture than what the main initramfs is built on).

     

       94
       94
       +
         passthru = {

     

       95
       95
       +
           compressorExecutableFunction = _compressorFunction;

     

       96
       96
       +
           compressorArgs = _compressorArgsReal;

     

       97
       97
       +
         };

     

       98
       98
       +
       

     

       36
       99
        
         # !!! should use XML.

     

       37
       100
        
         objects = map (x: x.object) contents;

     

       38
       101
        
         symlinks = map (x: x.symlink) contents;

     
···

       47
       110
        
             contents

     

       48
       111
        
             (lib.range 0 (lib.length contents - 1));

     

       49
       112
        
         pathsFromGraph = ./paths-from-graph.pl;

     

       50
       50
       -
       

     

       51
       51
       -
         inherit compressor prepend;

     

       52
       113
        
       }

+7 -4

pkgs/build-support/kernel/make-initrd.sh

···

       39
       39
        
       for PREP in $prepend; do

     

       40
       40
        
         cat $PREP >> $out/initrd

     

       41
       41
        
       done

     

       42
       42
       -
       (cd root && find * -print0 | xargs -0r touch -h -d '@1')

     

       43
       43
       -
       (cd root && find * -print0 | sort -z | cpio -o -H newc -R +0:+0 --reproducible --null | $compressor >> $out/initrd)

     

       42
       42
       +
       (cd root && find * .[^.*] -exec touch -h -d '@1' '{}' +)

     

       43
       43
       +
       (cd root && find * .[^.*] -print0 | sort -z | cpio -o -H newc -R +0:+0 --reproducible --null | eval -- $compress >> "$out/initrd")

     

       44
       44
        
       

     

       45
       45
        
       if [ -n "$makeUInitrd" ]; then

     

       46
       46
       -
           mv $out/initrd $out/initrd.gz

     

       47
       47
       -
           mkimage -A arm -O linux -T ramdisk -C gzip -d $out/initrd.gz $out/initrd

     

       46
       46
       +
           mkimage -A $uInitrdArch -O linux -T ramdisk -C "$uInitrdCompression" -d $out/initrd"$extension" $out/initrd.img

     

       47
       47
       +
           # Compatibility symlink

     

       48
       48
       +
           ln -s "initrd.img" "$out/initrd"

     

       49
       49
       +
       else

     

       50
       50
       +
           ln -s "initrd" "$out/initrd$extension"

     

       48
       51
        
       fi