···

       
10
       
 
       


     

       
11
       
 
       
  realGrub = if cfg.version == 1 then pkgs.grub

     

       
12
       
 
       
    else if cfg.zfsSupport then pkgs.grub2.override { zfsSupport = true; }

     

       
13
       
-
       
    else if cfg.enableTrustedBoot then pkgs.trustedGrub

     

       
14
       
-
       
           else pkgs.grub2;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
15
       
 
       


     

       
16
       
 
       
  grub =

     

       
17
       
 
       
    # Don't include GRUB if we're only generating a GRUB menu (e.g.,

     
···

       
369
       
 
       
        '';

     

       
370
       
 
       
      };

     

       
371
       
 
       


     

       
372
       
-
       
      enableTrustedBoot = mkOption {

     

       
373
       
-
       
        default = false;

     

       
374
       
-
       
        type = types.bool;

     

       
375
       
-
       
        description = ''

     

       
376
       
-
       
          Enable trusted boot. GRUB will measure all critical components during

     

       
377
       
-
       
          the boot process to offer TCG (TPM) support.

     

       
378
       
-
       
        '';

     

       
379
       
-
       
      };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
380
       
 
       


     

       
381
       
-
       
      systemHasTPM = mkOption {

     

       
382
       
-
       
        default = "";

     

       
383
       
-
       
        example = "YES_TPM_is_activated";

     

       
384
       
-
       
        type = types.string;

     

       
385
       
-
       
        description = ''

     

       
386
       
-
       
          Assertion that the target system has an activated TPM. It is a safety

     

       
387
       
-
       
          check before allowing the activation of 'enableTrustedBoot'. TrustedBoot

     

       
388
       
-
       
          WILL FAIL TO BOOT YOUR SYSTEM if no TPM is available.

     

       
389
       
-
       
        '';

     

       
390
       
 
       
      };

     

       
391
       
 
       


     

       
392
       
 
       
    };

     
···

       
452
       
 
       
          message = "You cannot have duplicated devices in mirroredBoots";

     

       
453
       
 
       
        }

     

       
454
       
 
       
        {

     

       
455
       
-
       
          assertion = !cfg.enableTrustedBoot || cfg.version == 2;

     

       
456
       
 
       
          message = "Trusted GRUB is only available for GRUB 2";

     

       
457
       
 
       
        }

     

       
458
       
 
       
        {

     

       
459
       
-
       
          assertion = !cfg.efiSupport || !cfg.enableTrustedBoot;

     

       
460
       
 
       
          message = "Trusted GRUB does not have EFI support";

     

       
461
       
 
       
        }

     

       
462
       
 
       
        {

     

       
463
       
-
       
          assertion = !cfg.zfsSupport || !cfg.enableTrustedBoot;

     

       
464
       
 
       
          message = "Trusted GRUB does not have ZFS support";

     

       
465
       
 
       
        }

     

       
466
       
 
       
        {

     

       
467
       
-
       
          assertion = !cfg.enableTrustedBoot || cfg.systemHasTPM == "YES_TPM_is_activated";

     

       
468
       
 
       
          message = "Trusted GRUB can break the system! Confirm that the system has an activated TPM by setting 'systemHasTPM'.";

     

       
469
       
 
       
        }

     

       
470
       
 
       
      ] ++ flip concatMap cfg.mirroredBoots (args: [

     

···

       
10
       
 
       


     

       
11
       
 
       
  realGrub = if cfg.version == 1 then pkgs.grub

     

       
12
       
 
       
    else if cfg.zfsSupport then pkgs.grub2.override { zfsSupport = true; }

     

       
13
       
+
       
    else if cfg.trustedBoot.enable

     

       
14
       
+
       
         then if cfg.trustedBoot.isHPLaptop

     

       
15
       
+
       
              then pkgs.trustedGrub-for-HP

     

       
16
       
+
       
              else pkgs.trustedGrub

     

       
17
       
+
       
         else pkgs.grub2;

     

       
18
       
 
       


     

       
19
       
 
       
  grub =

     

       
20
       
 
       
    # Don't include GRUB if we're only generating a GRUB menu (e.g.,

     
···

       
372
       
 
       
        '';

     

       
373
       
 
       
      };

     

       
374
       
 
       


     

       
375
       
+
       
      trustedBoot = {

     

       
376
       
+
       


     

       
377
       
+
       
        enable = mkOption {

     

       
378
       
+
       
          default = false;

     

       
379
       
+
       
          type = types.bool;

     

       
380
       
+
       
          description = ''

     

       
381
       
+
       
            Enable trusted boot. GRUB will measure all critical components during

     

       
382
       
+
       
            the boot process to offer TCG (TPM) support.

     

       
383
       
+
       
          '';

     

       
384
       
+
       
        };

     

       
385
       
+
       


     

       
386
       
+
       
        systemHasTPM = mkOption {

     

       
387
       
+
       
          default = "";

     

       
388
       
+
       
          example = "YES_TPM_is_activated";

     

       
389
       
+
       
          type = types.string;

     

       
390
       
+
       
          description = ''

     

       
391
       
+
       
            Assertion that the target system has an activated TPM. It is a safety

     

       
392
       
+
       
            check before allowing the activation of 'trustedBoot.enable'. TrustedBoot

     

       
393
       
+
       
            WILL FAIL TO BOOT YOUR SYSTEM if no TPM is available.

     

       
394
       
+
       
          '';

     

       
395
       
+
       
        };

     

       
396
       
+
       


     

       
397
       
+
       
        isHPLaptop = mkOption {

     

       
398
       
+
       
          default = false;

     

       
399
       
+
       
          type = types.bool;

     

       
400
       
+
       
          description = ''

     

       
401
       
+
       
            Use a special version of TrustedGRUB that is needed by some HP laptops

     

       
402
       
+
       
            and works only for the HP laptops.

     

       
403
       
+
       
          '';

     

       
404
       
+
       
        };

     

       
405
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
406
       
 
       
      };

     

       
407
       
 
       


     

       
408
       
 
       
    };

     
···

       
468
       
 
       
          message = "You cannot have duplicated devices in mirroredBoots";

     

       
469
       
 
       
        }

     

       
470
       
 
       
        {

     

       
471
       
+
       
          assertion = !cfg.trustedBoot.enable || cfg.version == 2;

     

       
472
       
 
       
          message = "Trusted GRUB is only available for GRUB 2";

     

       
473
       
 
       
        }

     

       
474
       
 
       
        {

     

       
475
       
+
       
          assertion = !cfg.efiSupport || !cfg.trustedBoot.enable;

     

       
476
       
 
       
          message = "Trusted GRUB does not have EFI support";

     

       
477
       
 
       
        }

     

       
478
       
 
       
        {

     

       
479
       
+
       
          assertion = !cfg.zfsSupport || !cfg.trustedBoot.enable;

     

       
480
       
 
       
          message = "Trusted GRUB does not have ZFS support";

     

       
481
       
 
       
        }

     

       
482
       
 
       
        {

     

       
483
       
+
       
          assertion = !cfg.trustedBoot.enable || cfg.trustedBoot.systemHasTPM == "YES_TPM_is_activated";

     

       
484
       
 
       
          message = "Trusted GRUB can break the system! Confirm that the system has an activated TPM by setting 'systemHasTPM'.";

     

       
485
       
 
       
        }

     

       
486
       
 
       
      ] ++ flip concatMap cfg.mirroredBoots (args: [

     

···

       
1
       
 
       
{ stdenv, fetchurl, fetchgit, autogen, flex, bison, python, autoconf, automake

     

       
2
       
 
       
, gettext, ncurses, libusb, freetype, qemu, devicemapper

     

       
0
       
 
       

     

       
3
       
 
       
}:

     

       
4
       
 
       


     

       
5
       
 
       
with stdenv.lib;

     
···

       
11
       
 
       


     

       
12
       
 
       
  inPCSystems = any (system: stdenv.system == system) (mapAttrsToList (name: _: name) pcSystems);

     

       
13
       
 
       


     

       
14
       
-
       
  version = "1.2.1";

     

       
15
       
 
       


     

       
16
       
 
       
  unifont_bdf = fetchurl {

     

       
17
       
 
       
    url = "http://unifoundry.com/unifont-5.1.20080820.bdf.gz";

     
···

       
25
       
 
       


     

       
26
       
 
       
  };

     

       
27
       
 
       


     

       
28
       
-
       
in (

     

       
29
       
 
       


     

       
30
       
 
       
stdenv.mkDerivation rec {

     

       
31
       
 
       
  name = "trustedGRUB2-${version}";

     

       
32
       
 
       


     

       
33
       
-
       
  src = fetchgit {

     

       
34
       
-
       
    url = "https://github.com/Sirrix-AG/TrustedGRUB2";

     

       
35
       
-
       
    rev = "ab483d389bda3115ca0ae4202fd71f2e4a31ad41";

     

       
36
       
-
       
    sha256 = "4b715837f8632278720d8b29aec06332f5302c6ba78183ced5f48d3c376d89c0";

     

       
37
       
-
       
  };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
38
       
 
       


     

       
39
       
 
       
  nativeBuildInputs = [ autogen flex bison python autoconf automake ];

     

       
40
       
 
       
  buildInputs = [ ncurses libusb freetype gettext devicemapper ]

     
···

       
89
       
 
       
    license = licenses.gpl3Plus;

     

       
90
       
 
       
    platforms = platforms.gnu;

     

       
91
       
 
       
  };

     

       
92
       
-
       
})

     

···

       
1
       
 
       
{ stdenv, fetchurl, fetchgit, autogen, flex, bison, python, autoconf, automake

     

       
2
       
 
       
, gettext, ncurses, libusb, freetype, qemu, devicemapper

     

       
3
       
+
       
, for_HP_laptop ? false

     

       
4
       
 
       
}:

     

       
5
       
 
       


     

       
6
       
 
       
with stdenv.lib;

     
···

       
12
       
 
       


     

       
13
       
 
       
  inPCSystems = any (system: stdenv.system == system) (mapAttrsToList (name: _: name) pcSystems);

     

       
14
       
 
       


     

       
15
       
+
       
  version = if for_HP_laptop then "1.2.1" else "1.2.0";

     

       
16
       
 
       


     

       
17
       
 
       
  unifont_bdf = fetchurl {

     

       
18
       
 
       
    url = "http://unifoundry.com/unifont-5.1.20080820.bdf.gz";

     
···

       
26
       
 
       


     

       
27
       
 
       
  };

     

       
28
       
 
       


     

       
29
       
+
       
in

     

       
30
       
 
       


     

       
31
       
 
       
stdenv.mkDerivation rec {

     

       
32
       
 
       
  name = "trustedGRUB2-${version}";

     

       
33
       
 
       


     

       
34
       
+
       
  src = if for_HP_laptop

     

       
35
       
+
       
        then fetchgit {

     

       
36
       
+
       
          url = "https://github.com/Sirrix-AG/TrustedGRUB2";

     

       
37
       
+
       
          rev = "ab483d389bda3115ca0ae4202fd71f2e4a31ad41";

     

       
38
       
+
       
          sha256 = "4b715837f8632278720d8b29aec06332f5302c6ba78183ced5f48d3c376d89c0";

     

       
39
       
+
       
        }

     

       
40
       
+
       
        else fetchgit {

     

       
41
       
+
       
          url = "https://github.com/Sirrix-AG/TrustedGRUB2";

     

       
42
       
+
       
          rev = "1ff54a5fbe02ea01df5a7de59b1e0201e08d4f76";

     

       
43
       
+
       
          sha256 = "8c17bd7e14dd96ae9c4e98723f4e18ec6b21d45ac486ecf771447649829d0b34";

     

       
44
       
+
       
        };

     

       
45
       
 
       


     

       
46
       
 
       
  nativeBuildInputs = [ autogen flex bison python autoconf automake ];

     

       
47
       
 
       
  buildInputs = [ ncurses libusb freetype gettext devicemapper ]

     
···

       
96
       
 
       
    license = licenses.gpl3Plus;

     

       
97
       
 
       
    platforms = platforms.gnu;

     

       
98
       
 
       
  };

     

       
99
       
+
       
}

     

···

       
1741
       
 
       


     

       
1742
       
 
       
  trustedGrub = callPackage_i686 ../tools/misc/grub/trusted.nix { };

     

       
1743
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
1744
       
 
       
  grub2 = grub2_full;

     

       
1745
       
 
       


     

       
1746
       
 
       
  grub2_full = callPackage ../tools/misc/grub/2.0x.nix { };

     

···

       
1741
       
 
       


     

       
1742
       
 
       
  trustedGrub = callPackage_i686 ../tools/misc/grub/trusted.nix { };

     

       
1743
       
 
       


     

       
1744
       
+
       
  trustedGrub-for-HP = callPackage_i686 ../tools/misc/grub/trusted.nix { for_HP_laptop = true; };

     

       
1745
       
+
       


     

       
1746
       
 
       
  grub2 = grub2_full;

     

       
1747
       
 
       


     

       
1748
       
 
       
  grub2_full = callPackage ../tools/misc/grub/2.0x.nix { };