From fc53809803cd2bc2434e312b19a18fa36776da12 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Wed, 12 Jun 2024 05:50:40 +0200 Subject: Adding upstream version 256. Signed-off-by: Daniel Baumann --- mkosi.images/base/mkosi.build.chroot | 224 --------------------- mkosi.images/base/mkosi.conf | 34 ---- mkosi.images/base/mkosi.conf.d/10-arch.conf | 32 --- .../base/mkosi.conf.d/10-centos-fedora.conf | 75 ------- .../base/mkosi.conf.d/10-debian-ubuntu.conf | 69 ------- mkosi.images/base/mkosi.conf.d/10-debian.conf | 11 - mkosi.images/base/mkosi.conf.d/10-fedora.conf | 9 - mkosi.images/base/mkosi.conf.d/10-opensuse.conf | 90 --------- mkosi.images/base/mkosi.conf.d/10-ubuntu.conf | 12 -- .../usr/lib/systemd/system-preset/00-mkosi.preset | 30 --- .../usr/lib/systemd/system-preset/99-mkosi.preset | 4 - .../mkosi.extra/usr/lib/tmpfiles.d/locale.conf | 1 - mkosi.images/exitrd/mkosi.conf | 22 ++ mkosi.images/exitrd/mkosi.conf.d/10-arch.conf | 29 +++ .../exitrd/mkosi.conf.d/10-centos-fedora.conf | 9 + .../exitrd/mkosi.conf.d/10-debian-ubuntu.conf | 9 + mkosi.images/exitrd/mkosi.conf.d/10-opensuse.conf | 8 + mkosi.images/exitrd/mkosi.extra/shutdown | 12 ++ mkosi.images/initrd/mkosi.conf | 30 --- mkosi.images/initrd/mkosi.conf.d/10-centos.conf | 12 -- mkosi.images/initrd/mkosi.conf.d/10-default.conf | 12 -- mkosi.images/initrd/mkosi.conf.d/10-opensuse.conf | 11 - mkosi.images/initrd/mkosi.postinst | 7 - mkosi.images/minimal-0/mkosi.conf | 25 +++ mkosi.images/minimal-0/mkosi.extra/opt/some_file | 1 + .../usr/lib/systemd/system/minimal-app0.service | 5 + mkosi.images/minimal-0/mkosi.postinst | 11 + mkosi.images/minimal-1/mkosi.conf | 25 +++ mkosi.images/minimal-1/mkosi.extra/opt/some_file | 1 + .../usr/lib/systemd/system/minimal-app0.service | 5 + mkosi.images/minimal-1/mkosi.postinst | 11 + mkosi.images/minimal-base/mkosi.conf | 24 +++ .../minimal-base/mkosi.conf.d/10-arch.conf | 31 +++ .../mkosi.conf.d/10-centos-fedora.conf | 12 ++ .../mkosi.conf.d/10-debian-ubuntu-opensuse.conf | 12 ++ .../minimal-base/mkosi.conf.d/10-opensuse.conf | 11 + .../minimal-base/mkosi.extra/etc/os-release | 1 + .../minimal-base/mkosi.extra/etc/resolv.conf | 3 + mkosi.images/minimal-base/mkosi.postinst | 11 + mkosi.images/system/coredump-journal-storage.conf | 4 + mkosi.images/system/initrd/mkosi.conf | 7 + .../usr/lib/encrypted-var.repart.d/00-root.conf | 15 ++ .../usr/lib/systemd/system/encrypted-var.service | 20 ++ .../lib/systemd/system/initrd-run-mount.service | 11 + .../usr/lib/systemd/system/initrdcred.service | 9 + mkosi.images/system/leak-sanitizer-suppressions | 1 + mkosi.images/system/mkosi.clean | 5 + mkosi.images/system/mkosi.conf | 48 ++++- mkosi.images/system/mkosi.conf.d/05-initrd.conf | 12 -- mkosi.images/system/mkosi.conf.d/10-arch.conf | 27 --- .../system/mkosi.conf.d/10-arch/mkosi.build.chroot | 93 +++++++++ .../system/mkosi.conf.d/10-arch/mkosi.conf | 71 +++++++ .../10-arch/mkosi.conf.d/10-debug.conf | 7 + .../system/mkosi.conf.d/10-arch/mkosi.prepare | 29 +++ .../system/mkosi.conf.d/10-centos-fedora.conf | 32 --- .../10-centos-fedora/mkosi.build.chroot | 116 +++++++++++ .../mkosi.conf.d/10-centos-fedora/mkosi.conf | 75 +++++++ .../10-centos-fedora/mkosi.conf.d/10-debug.conf | 17 ++ .../10-centos-fedora/mkosi.conf.d/10-selinux.conf | 20 ++ .../mkosi.conf.d/10-centos-fedora/mkosi.prepare | 65 ++++++ .../system/mkosi.conf.d/10-centos/mkosi.conf | 11 +- .../usr/lib/repart.d/20-root.conf.d/xfs.conf | 5 - .../mkosi.repart/10-usr.conf.d/squashfs.conf | 5 - .../system/mkosi.conf.d/10-debian-amd64.conf | 10 - .../system/mkosi.conf.d/10-debian-arm64.conf | 10 - .../system/mkosi.conf.d/10-debian-ubuntu.conf | 29 --- .../10-debian-ubuntu/mkosi.build.chroot | 142 +++++++++++++ .../mkosi.conf.d/10-debian-ubuntu/mkosi.conf | 93 +++++++++ .../10-debian-ubuntu/mkosi.conf.d/10-debug.conf | 27 +++ .../10-debian-ubuntu/mkosi.conf.d/network.conf | 7 + .../mkosi.conf.d/10-debian-ubuntu/mkosi.postinst | 29 +++ .../mkosi.conf.d/10-debian-ubuntu/mkosi.prepare | 18 ++ .../system/mkosi.conf.d/10-debian/mkosi.conf | 4 + .../mkosi.conf.d/10-debian/mkosi.conf.d/arm64.conf | 8 + .../10-debian/mkosi.conf.d/x86-64.conf | 8 + mkosi.images/system/mkosi.conf.d/10-fedora.conf | 10 - .../system/mkosi.conf.d/10-fedora/mkosi.conf | 23 +++ mkosi.images/system/mkosi.conf.d/10-opensuse.conf | 23 --- .../mkosi.conf.d/10-opensuse/initrd/mkosi.postinst | 7 + .../mkosi.conf.d/10-opensuse/mkosi.build.chroot | 132 ++++++++++++ .../system/mkosi.conf.d/10-opensuse/mkosi.conf | 100 +++++++++ .../10-opensuse/mkosi.conf.d/10-debug.conf | 22 ++ .../system/mkosi.conf.d/10-opensuse/mkosi.prepare | 61 ++++++ mkosi.images/system/mkosi.conf.d/10-ubuntu.conf | 11 - .../system/mkosi.conf.d/10-ubuntu/mkosi.conf | 13 ++ .../mkosi.conf.d/10-ubuntu/noble-backports.sources | 6 + mkosi.images/system/mkosi.conf.d/20-images.conf | 22 ++ .../system/mkosi.conf.d/20-particle/mkosi.conf | 15 ++ .../mkosi.extra/usr/lib/repart.d/15-swap.conf | 6 + .../mkosi.extra/usr/lib/repart.d/20-root.conf | 6 + .../mkosi.extra/usr/lib/tmpfiles.d/99-mkosi.conf | 3 + .../system/mkosi.conf.d/20-particle/mkosi.finalize | 6 + .../mkosi.conf.d/20-particle/mkosi.postinst.chroot | 12 ++ .../20-particle/mkosi.repart/00-esp.conf | 9 + .../20-particle/mkosi.repart/10-usr.conf | 9 + .../20-particle/mkosi.repart/11-usr-verity.conf | 7 + .../mkosi.repart/12-usr-verity-sig.conf | 6 + mkosi.images/system/mkosi.extra/.autorelabel | 1 + .../system/mkosi.extra/etc/iscsi/iscsid.conf | 3 + .../mkosi.extra/usr/lib/repart.d/15-swap.conf | 6 - .../mkosi.extra/usr/lib/repart.d/20-root.conf | 8 - .../lib/systemd/journald.conf.d/50-persistent.conf | 8 - .../usr/lib/systemd/journald.conf.d/ratelimit.conf | 5 + .../usr/lib/systemd/mkosi-check-and-shutdown.sh | 19 -- .../usr/lib/systemd/system-preset/00-mkosi.preset | 41 ++++ .../usr/lib/systemd/system-preset/99-mkosi.preset | 4 + .../systemd/system/iscsi-init.service.d/asan.conf | 7 + .../system/mkosi-check-and-shutdown.service | 15 -- .../user@.service.d/99-SYSTEMD_UNIT_PATH.conf | 4 + .../mkosi.extra/usr/lib/tmpfiles.d/99-mkosi.conf | 3 - .../mkosi.extra/usr/lib/tmpfiles.d/locale.conf | 1 + .../dbus-1/system.d/systemd.test.ExecStopPost.conf | 13 ++ .../usr/share/factory/mkosi/gdbinit.d/systemd.gdb | 3 - mkosi.images/system/mkosi.finalize | 4 - mkosi.images/system/mkosi.postinst.chroot | 211 +++++++++++++------ mkosi.images/system/mkosi.repart/00-esp.conf | 4 +- mkosi.images/system/mkosi.repart/10-root.conf | 8 + mkosi.images/system/mkosi.repart/10-usr.conf | 9 - .../system/mkosi.repart/11-usr-verity.conf | 7 - .../system/mkosi.repart/12-usr-verity-sig.conf | 6 - mkosi.images/system/mkosi.sanitizers.chroot | 127 ++++++++++++ mkosi.images/system/mkosi.sync | 36 ++++ 122 files changed, 2089 insertions(+), 1004 deletions(-) delete mode 100755 mkosi.images/base/mkosi.build.chroot delete mode 100644 mkosi.images/base/mkosi.conf delete mode 100644 mkosi.images/base/mkosi.conf.d/10-arch.conf delete mode 100644 mkosi.images/base/mkosi.conf.d/10-centos-fedora.conf delete mode 100644 mkosi.images/base/mkosi.conf.d/10-debian-ubuntu.conf delete mode 100644 mkosi.images/base/mkosi.conf.d/10-debian.conf delete mode 100644 mkosi.images/base/mkosi.conf.d/10-fedora.conf delete mode 100644 mkosi.images/base/mkosi.conf.d/10-opensuse.conf delete mode 100644 mkosi.images/base/mkosi.conf.d/10-ubuntu.conf delete mode 100644 mkosi.images/base/mkosi.extra/usr/lib/systemd/system-preset/00-mkosi.preset delete mode 100644 mkosi.images/base/mkosi.extra/usr/lib/systemd/system-preset/99-mkosi.preset delete mode 100644 mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/locale.conf create mode 100644 mkosi.images/exitrd/mkosi.conf create mode 100644 mkosi.images/exitrd/mkosi.conf.d/10-arch.conf create mode 100644 mkosi.images/exitrd/mkosi.conf.d/10-centos-fedora.conf create mode 100644 mkosi.images/exitrd/mkosi.conf.d/10-debian-ubuntu.conf create mode 100644 mkosi.images/exitrd/mkosi.conf.d/10-opensuse.conf create mode 100755 mkosi.images/exitrd/mkosi.extra/shutdown delete mode 100644 mkosi.images/initrd/mkosi.conf delete mode 100644 mkosi.images/initrd/mkosi.conf.d/10-centos.conf delete mode 100644 mkosi.images/initrd/mkosi.conf.d/10-default.conf delete mode 100644 mkosi.images/initrd/mkosi.conf.d/10-opensuse.conf delete mode 100755 mkosi.images/initrd/mkosi.postinst create mode 100644 mkosi.images/minimal-0/mkosi.conf create mode 100644 mkosi.images/minimal-0/mkosi.extra/opt/some_file create mode 100644 mkosi.images/minimal-0/mkosi.extra/usr/lib/systemd/system/minimal-app0.service create mode 100755 mkosi.images/minimal-0/mkosi.postinst create mode 100644 mkosi.images/minimal-1/mkosi.conf create mode 100644 mkosi.images/minimal-1/mkosi.extra/opt/some_file create mode 100644 mkosi.images/minimal-1/mkosi.extra/usr/lib/systemd/system/minimal-app0.service create mode 100755 mkosi.images/minimal-1/mkosi.postinst create mode 100644 mkosi.images/minimal-base/mkosi.conf create mode 100644 mkosi.images/minimal-base/mkosi.conf.d/10-arch.conf create mode 100644 mkosi.images/minimal-base/mkosi.conf.d/10-centos-fedora.conf create mode 100644 mkosi.images/minimal-base/mkosi.conf.d/10-debian-ubuntu-opensuse.conf create mode 100644 mkosi.images/minimal-base/mkosi.conf.d/10-opensuse.conf create mode 120000 mkosi.images/minimal-base/mkosi.extra/etc/os-release create mode 100644 mkosi.images/minimal-base/mkosi.extra/etc/resolv.conf create mode 100755 mkosi.images/minimal-base/mkosi.postinst create mode 100644 mkosi.images/system/coredump-journal-storage.conf create mode 100644 mkosi.images/system/initrd/mkosi.conf create mode 100644 mkosi.images/system/initrd/mkosi.extra/usr/lib/encrypted-var.repart.d/00-root.conf create mode 100644 mkosi.images/system/initrd/mkosi.extra/usr/lib/systemd/system/encrypted-var.service create mode 100644 mkosi.images/system/initrd/mkosi.extra/usr/lib/systemd/system/initrd-run-mount.service create mode 100644 mkosi.images/system/initrd/mkosi.extra/usr/lib/systemd/system/initrdcred.service create mode 100644 mkosi.images/system/leak-sanitizer-suppressions create mode 100755 mkosi.images/system/mkosi.clean delete mode 100644 mkosi.images/system/mkosi.conf.d/05-initrd.conf delete mode 100644 mkosi.images/system/mkosi.conf.d/10-arch.conf create mode 100755 mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot create mode 100644 mkosi.images/system/mkosi.conf.d/10-arch/mkosi.conf create mode 100644 mkosi.images/system/mkosi.conf.d/10-arch/mkosi.conf.d/10-debug.conf create mode 100755 mkosi.images/system/mkosi.conf.d/10-arch/mkosi.prepare delete mode 100644 mkosi.images/system/mkosi.conf.d/10-centos-fedora.conf create mode 100755 mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot create mode 100644 mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf create mode 100644 mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-debug.conf create mode 100644 mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-selinux.conf create mode 100755 mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.prepare delete mode 100644 mkosi.images/system/mkosi.conf.d/10-centos/mkosi.extra/usr/lib/repart.d/20-root.conf.d/xfs.conf delete mode 100644 mkosi.images/system/mkosi.conf.d/10-centos/mkosi.repart/10-usr.conf.d/squashfs.conf delete mode 100644 mkosi.images/system/mkosi.conf.d/10-debian-amd64.conf delete mode 100644 mkosi.images/system/mkosi.conf.d/10-debian-arm64.conf delete mode 100644 mkosi.images/system/mkosi.conf.d/10-debian-ubuntu.conf create mode 100755 mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot create mode 100644 mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf create mode 100644 mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/10-debug.conf create mode 100644 mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/network.conf create mode 100755 mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.postinst create mode 100755 mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.prepare create mode 100644 mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf create mode 100644 mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf.d/arm64.conf create mode 100644 mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf.d/x86-64.conf delete mode 100644 mkosi.images/system/mkosi.conf.d/10-fedora.conf create mode 100644 mkosi.images/system/mkosi.conf.d/10-fedora/mkosi.conf delete mode 100644 mkosi.images/system/mkosi.conf.d/10-opensuse.conf create mode 100755 mkosi.images/system/mkosi.conf.d/10-opensuse/initrd/mkosi.postinst create mode 100755 mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot create mode 100644 mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf create mode 100644 mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf.d/10-debug.conf create mode 100755 mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.prepare delete mode 100644 mkosi.images/system/mkosi.conf.d/10-ubuntu.conf create mode 100644 mkosi.images/system/mkosi.conf.d/10-ubuntu/mkosi.conf create mode 100644 mkosi.images/system/mkosi.conf.d/10-ubuntu/noble-backports.sources create mode 100644 mkosi.images/system/mkosi.conf.d/20-images.conf create mode 100644 mkosi.images/system/mkosi.conf.d/20-particle/mkosi.conf create mode 100644 mkosi.images/system/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/15-swap.conf create mode 100644 mkosi.images/system/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/20-root.conf create mode 100644 mkosi.images/system/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/tmpfiles.d/99-mkosi.conf create mode 100755 mkosi.images/system/mkosi.conf.d/20-particle/mkosi.finalize create mode 100755 mkosi.images/system/mkosi.conf.d/20-particle/mkosi.postinst.chroot create mode 100644 mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/00-esp.conf create mode 100644 mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/10-usr.conf create mode 100644 mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/11-usr-verity.conf create mode 100644 mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/12-usr-verity-sig.conf create mode 100644 mkosi.images/system/mkosi.extra/.autorelabel create mode 100644 mkosi.images/system/mkosi.extra/etc/iscsi/iscsid.conf delete mode 100644 mkosi.images/system/mkosi.extra/usr/lib/repart.d/15-swap.conf delete mode 100644 mkosi.images/system/mkosi.extra/usr/lib/repart.d/20-root.conf delete mode 100644 mkosi.images/system/mkosi.extra/usr/lib/systemd/journald.conf.d/50-persistent.conf create mode 100644 mkosi.images/system/mkosi.extra/usr/lib/systemd/journald.conf.d/ratelimit.conf delete mode 100755 mkosi.images/system/mkosi.extra/usr/lib/systemd/mkosi-check-and-shutdown.sh create mode 100644 mkosi.images/system/mkosi.extra/usr/lib/systemd/system-preset/00-mkosi.preset create mode 100644 mkosi.images/system/mkosi.extra/usr/lib/systemd/system-preset/99-mkosi.preset create mode 100644 mkosi.images/system/mkosi.extra/usr/lib/systemd/system/iscsi-init.service.d/asan.conf delete mode 100644 mkosi.images/system/mkosi.extra/usr/lib/systemd/system/mkosi-check-and-shutdown.service create mode 100644 mkosi.images/system/mkosi.extra/usr/lib/systemd/system/user@.service.d/99-SYSTEMD_UNIT_PATH.conf delete mode 100644 mkosi.images/system/mkosi.extra/usr/lib/tmpfiles.d/99-mkosi.conf create mode 100644 mkosi.images/system/mkosi.extra/usr/lib/tmpfiles.d/locale.conf create mode 100644 mkosi.images/system/mkosi.extra/usr/share/dbus-1/system.d/systemd.test.ExecStopPost.conf delete mode 100644 mkosi.images/system/mkosi.extra/usr/share/factory/mkosi/gdbinit.d/systemd.gdb delete mode 100755 mkosi.images/system/mkosi.finalize create mode 100644 mkosi.images/system/mkosi.repart/10-root.conf delete mode 100644 mkosi.images/system/mkosi.repart/10-usr.conf delete mode 100644 mkosi.images/system/mkosi.repart/11-usr-verity.conf delete mode 100644 mkosi.images/system/mkosi.repart/12-usr-verity-sig.conf create mode 100755 mkosi.images/system/mkosi.sanitizers.chroot create mode 100755 mkosi.images/system/mkosi.sync (limited to 'mkosi.images') diff --git a/mkosi.images/base/mkosi.build.chroot b/mkosi.images/base/mkosi.build.chroot deleted file mode 100755 index 02dcbc7..0000000 --- a/mkosi.images/base/mkosi.build.chroot +++ /dev/null @@ -1,224 +0,0 @@ -#!/bin/bash -# SPDX-License-Identifier: LGPL-2.1-or-later -set -e - -# This is a build script for OS image generation using mkosi (https://github.com/systemd/mkosi). -# Simply invoke "mkosi" in the project directory to build an OS image. - -# We don't want to install our build of systemd in the base image, but use it as an extra tree for the -# initrd and system images, so override DESTDIR to store it in the output directory so we can reference it as -# an extra tree in the initrd and system image builds. -DESTDIR="$OUTPUTDIR/systemd" - -# If mkosi.builddir/ exists mkosi will set $BUILDDIR to it, let's then use it -# as out-of-tree build dir. Otherwise, let's make up our own builddir. -[ -z "$BUILDDIR" ] && BUILDDIR="$PWD"/build - -# Let's make sure we're using stuff from the build directory first if available there. -PATH="$BUILDDIR:$PATH" -export PATH - -# The bpftool script shipped by Ubuntu tries to find the actual program to run via querying `uname -r` and -# using the current kernel version. This obviously doesn't work in containers. As a workaround, we override -# the ubuntu script with a symlink to the first bpftool program we can find. -for bpftool in /usr/lib/linux-tools/*/bpftool; do - [ -x "$bpftool" ] || continue - ln -sf "$bpftool" "$BUILDDIR"/bpftool - break -done - -# CentOS Stream 8 includes bpftool 4.18.0 which is lower than what we need. However, they've backported the -# specific feature we need ("gen skeleton") to this version, so we replace bpftool with a script that reports -# version 5.6.0 to satisfy meson which makes bpf work on CentOS Stream 8 as well. -. /usr/lib/os-release -if [ "$ID" = "centos" ] && [ "$VERSION" = "8" ]; then - cat >"$BUILDDIR"/bpftool </. - # It is important to use the right one especially for cryptsetup plugins, otherwise they will be - # installed in the wrong directory and not be found by cryptsetup. Assume native build. - if grep -q -e "ID=debian" -e "ID_LIKE=debian" /usr/lib/os-release && command -v dpkg 2>/dev/null; then - CONFIGURE_OPTS+=( - -D libdir="/usr/lib/$(dpkg-architecture -qDEB_HOST_MULTIARCH)" - -D pamlibdir="/usr/lib/$(dpkg-architecture -qDEB_HOST_MULTIARCH)/security" - ) - fi - - # Set various uids and gids for which Fedora has "soft static" allocations. - # Without this, we would get warning about mismatched sysusers.d entries - # between the files that we and Fedora's setup package install. - if grep -q '^ID=fedora' /usr/lib/os-release; then - CONFIGURE_OPTS+=( - -Dadm-gid=4 - -Daudio-gid=63 - -Dcdrom-gid=11 - -Ddialout-gid=18 - -Ddisk-gid=6 - -Dinput-gid=104 - -Dkmem-gid=9 - -Dkvm-gid=36 - -Dlp-gid=7 - -Drender-gid=105 - -Dsgx-gid=106 - -Dtape-gid=33 - -Dtty-gid=5 - -Dusers-gid=100 - -Dutmp-gid=22 - -Dvideo-gid=39 - -Dwheel-gid=10 - -Dsystemd-journal-gid=190 - -Dsystemd-network-uid=192 - -Dsystemd-resolve-uid=193 - ) - fi - - ( set -x; meson setup "$BUILDDIR" "$SRCDIR" "${CONFIGURE_OPTS[@]}" ) -fi - -( set -x; ninja -C "$BUILDDIR" "$@" ) -if [ "$WITH_TESTS" = 1 ]; then - if [ -n "$SANITIZERS" ]; then - export ASAN_OPTIONS="$MKOSI_ASAN_OPTIONS" - export UBSAN_OPTIONS="$MKOSI_UBSAN_OPTIONS" - TIMEOUT_MULTIPLIER=3 - else - TIMEOUT_MULTIPLIER=1 - fi - - ( set -x; meson test -C "$BUILDDIR" --print-errorlogs --timeout-multiplier=$TIMEOUT_MULTIPLIER ) -fi - -( set -x; meson install -C "$BUILDDIR" --quiet --no-rebuild --only-changed ) - -# Ensure that side-loaded PE addons are loaded if signed, and ignored if not -if [ -d "${DESTDIR}/boot/loader" ]; then - addons_dir="${DESTDIR}/boot/loader/addons" -elif [ -d "${DESTDIR}/efi/loader" ]; then - addons_dir="${DESTDIR}/efi/loader/addons" -fi -if [ -n "${addons_dir}" ]; then - mkdir -p "${addons_dir}" - ukify --secureboot-private-key mkosi.secure-boot.key --secureboot-certificate mkosi.secure-boot.crt --cmdline this_should_be_here -o "${addons_dir}/good.addon.efi" - ukify --cmdline this_should_not_be_here -o "${addons_dir}/bad.addon.efi" -fi diff --git a/mkosi.images/base/mkosi.conf b/mkosi.images/base/mkosi.conf deleted file mode 100644 index 6c6d045..0000000 --- a/mkosi.images/base/mkosi.conf +++ /dev/null @@ -1,34 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Output] -Format=directory - -[Content] -Bootable=no -CleanPackageMetadata=no - -Packages= -Packages= - kmod - less - util-linux - -BuildPackages= - acl - diffutils - gawk - binutils - clang - gettext - git - gperf - grep - lld - llvm - make - meson - pkgconf - rsync - sed - tar - zstd diff --git a/mkosi.images/base/mkosi.conf.d/10-arch.conf b/mkosi.images/base/mkosi.conf.d/10-arch.conf deleted file mode 100644 index 7ab0c71..0000000 --- a/mkosi.images/base/mkosi.conf.d/10-arch.conf +++ /dev/null @@ -1,32 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Distribution=arch - -[Content] -Packages= - cryptsetup - dbus - gnutls - libbpf - libfido2 - libmicrohttpd - libnftnl - libpwquality - libseccomp - libxkbcommon - openssl - qrencode - tpm2-tss - -BuildPackages= - bpf - docbook-xsl - glib2 - libxslt - linux-api-headers - python - python-jinja - python-lxml - python-pefile - python-pyelftools diff --git a/mkosi.images/base/mkosi.conf.d/10-centos-fedora.conf b/mkosi.images/base/mkosi.conf.d/10-centos-fedora.conf deleted file mode 100644 index 8ada9b0..0000000 --- a/mkosi.images/base/mkosi.conf.d/10-centos-fedora.conf +++ /dev/null @@ -1,75 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Distribution=|centos -Distribution=|fedora - -[Content] -Packages= - audit-libs - cryptsetup-libs - gnutls - libasan - libbpf - libfido2 - libgcrypt - libmicrohttpd - libnftnl - libubsan - libxcrypt - libxkbcommon - openssl-libs - qrencode-libs - tpm2-tss - util-linux - -BuildPackages= - pkgconf - bpftool - docbook-xsl - findutils - libgcrypt-devel # CentOS Stream 8 libgcrypt-devel doesn't ship a pkg-config file. - libxslt - pam-devel - pkgconfig(audit) - pkgconfig(blkid) - pkgconfig(bzip2) - pkgconfig(dbus-1) - pkgconfig(fdisk) - pkgconfig(glib-2.0) - pkgconfig(gnutls) - pkgconfig(libacl) - pkgconfig(libbpf) - pkgconfig(libcap) - pkgconfig(libcryptsetup) - pkgconfig(libcurl) - pkgconfig(libdw) - pkgconfig(libfido2) - pkgconfig(libidn2) - pkgconfig(libkmod) - pkgconfig(libmicrohttpd) - pkgconfig(libnftnl) - pkgconfig(libpcre2-8) - pkgconfig(libqrencode) - pkgconfig(libseccomp) - pkgconfig(libselinux) - pkgconfig(libzstd) - pkgconfig(mount) - pkgconfig(numa) - pkgconfig(openssl) - pkgconfig(openssl) - pkgconfig(p11-kit-1) - pkgconfig(pwquality) - pkgconfig(tss2-esys) - pkgconfig(tss2-mu) - pkgconfig(tss2-rc) - pkgconfig(tss2-tcti-device) - pkgconfig(valgrind) - pkgconfig(xkbcommon) - python3 - python3dist(jinja2) - python3dist(lxml) - python3dist(pefile) - python3dist(pyelftools) - python3dist(pytest) - rpm diff --git a/mkosi.images/base/mkosi.conf.d/10-debian-ubuntu.conf b/mkosi.images/base/mkosi.conf.d/10-debian-ubuntu.conf deleted file mode 100644 index c529e0b..0000000 --- a/mkosi.images/base/mkosi.conf.d/10-debian-ubuntu.conf +++ /dev/null @@ -1,69 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Distribution=|debian -Distribution=|ubuntu - -[Content] -Packages= - dmsetup - libapparmor1 - libfdisk1 - libfido2-1 - libglib2.0-0 - libgnutls30 - libidn2-0 - libmicrohttpd12 - libnftnl11 - libp11-kit0 - libpam0g - libpwquality1 - libqrencode4 - libssl3 - libip4tc2 - libtss2-dev # Use the -dev package to avoid churn in updating version numbers - tzdata - -BuildPackages= - docbook-xsl - dpkg-dev - g++ - libacl1-dev - libapparmor-dev - libaudit-dev - libblkid-dev - libbpf-dev - libbz2-dev - libcap-dev - libcryptsetup-dev - libcurl4-openssl-dev - libdbus-1-dev - libdw-dev - libfdisk-dev - libfido2-dev - libgcrypt20-dev - libglib2.0-dev - libgnutls28-dev - libidn2-dev - libiptc-dev - libkmod-dev - libmicrohttpd-dev - libmount-dev - libnftnl-dev - libp11-kit-dev - libpam0g-dev - libpwquality-dev - libqrencode-dev - libseccomp-dev - libsmartcols-dev - libssl-dev - libxen-dev - libxkbcommon-dev - libzstd-dev - python3 - python3-jinja2 - python3-lxml - python3-pefile - python3-pyelftools - python3-pytest - xsltproc diff --git a/mkosi.images/base/mkosi.conf.d/10-debian.conf b/mkosi.images/base/mkosi.conf.d/10-debian.conf deleted file mode 100644 index 020b02b..0000000 --- a/mkosi.images/base/mkosi.conf.d/10-debian.conf +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Distribution=debian - -[Content] -Packages= - libbpf1 - -BuildPackages= - bpftool diff --git a/mkosi.images/base/mkosi.conf.d/10-fedora.conf b/mkosi.images/base/mkosi.conf.d/10-fedora.conf deleted file mode 100644 index a8fbce4..0000000 --- a/mkosi.images/base/mkosi.conf.d/10-fedora.conf +++ /dev/null @@ -1,9 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Distribution=fedora - -[Content] -BuildPackages= - python3dist(pytest-flakes) - pkgconfig(xencontrol) diff --git a/mkosi.images/base/mkosi.conf.d/10-opensuse.conf b/mkosi.images/base/mkosi.conf.d/10-opensuse.conf deleted file mode 100644 index 5aae0ed..0000000 --- a/mkosi.images/base/mkosi.conf.d/10-opensuse.conf +++ /dev/null @@ -1,90 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Distribution=opensuse - -[Content] -# We install gawk, gzip, grep, xz, sed, rsync and docbook-xsl-stylesheets here explicitly so that the busybox -# versions don't get installed instead. -Packages= - device-mapper - distribution-release - docbook-xsl-stylesheets - gawk - grep - gzip - libbpf1 - libcrypt1 - libcryptsetup12 - libdw1 - libelf1 - libfido2 - libgcrypt20 - libglib-2_0-0 - libkmod2 - libmount1 - libnftnl11 - libopenssl3 - libp11-kit0 - libqrencode4 - libseccomp2 - libtss2-esys0 - libtss2-mu0 - libtss2-rc0 - libtss2-tcti-device0 - libxkbcommon0 - libzstd1 - pam - rsync - sed - shadow - tpm2-0-tss - xz - -BuildPackages= - audit-devel - bpftool - dbus-1-devel - fdupes - gcc-c++ - glib2-devel - glibc-locale - intltool - libacl-devel - libapparmor-devel - libblkid-devel - libbpf-devel - libcap-devel - libcryptsetup-devel - libcurl-devel - libdw-devel - libelf-devel - libfdisk-devel - libfido2-devel - libgcrypt-devel - libgnutls-devel - libkmod-devel - libmicrohttpd-devel - libmount-devel - libnftnl-devel - libpwquality-devel - libseccomp-devel - libselinux-devel - libxkbcommon-devel - libxslt-tools - libzstd-devel - openssl-devel - pam-devel - pciutils-devel - python3 - python3-Jinja2 - python3-lxml - python3-pefile - python3-pyelftools - python3-pytest - python3-pytest-flakes - qrencode-devel - shadow - timezone - tpm2-0-tss-devel - xen-devel diff --git a/mkosi.images/base/mkosi.conf.d/10-ubuntu.conf b/mkosi.images/base/mkosi.conf.d/10-ubuntu.conf deleted file mode 100644 index 717809f..0000000 --- a/mkosi.images/base/mkosi.conf.d/10-ubuntu.conf +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Distribution=ubuntu - -[Content] -Packages= - libbpf0 - -BuildPackages= - linux-tools-common - linux-tools-generic diff --git a/mkosi.images/base/mkosi.extra/usr/lib/systemd/system-preset/00-mkosi.preset b/mkosi.images/base/mkosi.extra/usr/lib/systemd/system-preset/00-mkosi.preset deleted file mode 100644 index 070af4c..0000000 --- a/mkosi.images/base/mkosi.extra/usr/lib/systemd/system-preset/00-mkosi.preset +++ /dev/null @@ -1,30 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -# mkosi adds its own ssh units via the --ssh switch so disable the default ones. -disable ssh.service -disable sshd.service - -# These are started manually in integration tests so don't start them by default. -disable dnsmasq.service -disable isc-dhcp-server.service -disable isc-dhcp-server6.service - -# Pulled in via dracut-network by kexec-tools on Fedora. -disable NetworkManager* - -# Make sure dbus-broker is started by default on Debian/Ubuntu. -enable dbus-broker.service - -# systemd-networkd is disabled by default on Fedora so make sure it is enabled. -enable systemd-networkd.service -enable systemd-networkd-wait-online.service - -# We install dnf in some images but it's only going to be used rarely, -# so let's not have dnf create its cache. -disable dnf-makecache.* - -# We have journald to receive audit data so let's make sure we're not running auditd as well -disable auditd.service - -# systemd-timesyncd is not enabled by default in the default systemd preset so enable it here instead. -enable systemd-timesyncd.service diff --git a/mkosi.images/base/mkosi.extra/usr/lib/systemd/system-preset/99-mkosi.preset b/mkosi.images/base/mkosi.extra/usr/lib/systemd/system-preset/99-mkosi.preset deleted file mode 100644 index 710ee7c..0000000 --- a/mkosi.images/base/mkosi.extra/usr/lib/systemd/system-preset/99-mkosi.preset +++ /dev/null @@ -1,4 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -# Make sure that services are disabled by default (primarily for Debian/Ubuntu). -disable * diff --git a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/locale.conf b/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/locale.conf deleted file mode 100644 index e1a8e81..0000000 --- a/mkosi.images/base/mkosi.extra/usr/lib/tmpfiles.d/locale.conf +++ /dev/null @@ -1 +0,0 @@ -L /etc/default/locale - - - - ../locale.conf diff --git a/mkosi.images/exitrd/mkosi.conf b/mkosi.images/exitrd/mkosi.conf new file mode 100644 index 0000000..2e867cb --- /dev/null +++ b/mkosi.images/exitrd/mkosi.conf @@ -0,0 +1,22 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Config] +ConfigureScripts= + +[Output] +Format=directory + +[Content] +Bootable=no +@Locale=C.UTF-8 +WithDocs=no +CleanPackageMetadata=yes +MakeInitrd=yes + +BuildSources= +Packages= +BuildPackages= +VolatilePackages= + +Packages= + bash diff --git a/mkosi.images/exitrd/mkosi.conf.d/10-arch.conf b/mkosi.images/exitrd/mkosi.conf.d/10-arch.conf new file mode 100644 index 0000000..c8b1904 --- /dev/null +++ b/mkosi.images/exitrd/mkosi.conf.d/10-arch.conf @@ -0,0 +1,29 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Distribution=arch + +[Content] +Packages= + systemd + +RemoveFiles= + # Arch Linux doesn't split their gcc-libs package so we manually remove + # unneeded stuff here to make sure it doesn't end up in the image. + /usr/lib/libgfortran.so* + /usr/lib/libgo.so* + /usr/lib/libgomp.so* + /usr/lib/libgphobos.so* + /usr/lib/libobjc.so* + /usr/lib/libgdruntime.so* + + # Remove all files that are only required for development. + /usr/lib/*.a + /usr/include/* + + /usr/share/i18n/* + /usr/share/hwdata/* + /usr/share/iana-etc/* + /usr/share/locale/* + /usr/share/terminfo/* + /usr/share/zoneinfo/* diff --git a/mkosi.images/exitrd/mkosi.conf.d/10-centos-fedora.conf b/mkosi.images/exitrd/mkosi.conf.d/10-centos-fedora.conf new file mode 100644 index 0000000..8458dee --- /dev/null +++ b/mkosi.images/exitrd/mkosi.conf.d/10-centos-fedora.conf @@ -0,0 +1,9 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Distribution=|centos +Distribution=|fedora + +[Content] +Packages= + systemd-standalone-shutdown diff --git a/mkosi.images/exitrd/mkosi.conf.d/10-debian-ubuntu.conf b/mkosi.images/exitrd/mkosi.conf.d/10-debian-ubuntu.conf new file mode 100644 index 0000000..babde60 --- /dev/null +++ b/mkosi.images/exitrd/mkosi.conf.d/10-debian-ubuntu.conf @@ -0,0 +1,9 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Distribution=|debian +Distribution=|ubuntu + +[Content] +Packages= + systemd diff --git a/mkosi.images/exitrd/mkosi.conf.d/10-opensuse.conf b/mkosi.images/exitrd/mkosi.conf.d/10-opensuse.conf new file mode 100644 index 0000000..3f6df21 --- /dev/null +++ b/mkosi.images/exitrd/mkosi.conf.d/10-opensuse.conf @@ -0,0 +1,8 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Distribution=opensuse + +[Content] +Packages= + systemd diff --git a/mkosi.images/exitrd/mkosi.extra/shutdown b/mkosi.images/exitrd/mkosi.extra/shutdown new file mode 100755 index 0000000..e4c6087 --- /dev/null +++ b/mkosi.images/exitrd/mkosi.extra/shutdown @@ -0,0 +1,12 @@ +#!/usr/bin/bash +# SPDX-License-Identifier: LGPL-2.1-or-later +set -eux + +EXIT_CODE=() + +# Translate a successful exit code to 124 so that we can detect that the exitrd was actually used. +if [[ "$*" == *"--exit-code=123"* ]]; then + EXIT_CODE+=("--exit-code=124") +fi + +exec /usr/lib/systemd/systemd-shutdown "$@" "${EXIT_CODE[@]}" diff --git a/mkosi.images/initrd/mkosi.conf b/mkosi.images/initrd/mkosi.conf deleted file mode 100644 index 8e38dc1..0000000 --- a/mkosi.images/initrd/mkosi.conf +++ /dev/null @@ -1,30 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Config] -Dependencies=base - -[Output] -Format=cpio - -[Content] -BaseTrees=../../mkosi.output/base -ExtraTrees=../../mkosi.output/base-systemd -MakeInitrd=yes -Bootable=no -BuildPackages= - -Packages= -Packages= - gzip - systemd - udev - -# Arch Linux doesn't split their gcc-libs package so we manually remove unneeded stuff here to make sure it -# doesn't end up in the initrd. -RemoveFiles= - /usr/lib/libgfortran.so* - /usr/lib/libgo.so* - /usr/lib/libgomp.so* - /usr/lib/libgphobos.so* - /usr/lib/libobjc.so* - /usr/lib/libstdc++.so* diff --git a/mkosi.images/initrd/mkosi.conf.d/10-centos.conf b/mkosi.images/initrd/mkosi.conf.d/10-centos.conf deleted file mode 100644 index 3f92e52..0000000 --- a/mkosi.images/initrd/mkosi.conf.d/10-centos.conf +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Distribution=centos - -[Output] -# TODO: Switch to zstd once we stop building CentOS Stream 8. -CompressOutput=xz - -[Content] -Packages=xfsprogs - tpm2-tools diff --git a/mkosi.images/initrd/mkosi.conf.d/10-default.conf b/mkosi.images/initrd/mkosi.conf.d/10-default.conf deleted file mode 100644 index 9224b92..0000000 --- a/mkosi.images/initrd/mkosi.conf.d/10-default.conf +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Distribution=!centos -Distribution=!opensuse - -[Output] -CompressOutput=zst - -[Content] -Packages=btrfs-progs - tpm2-tools diff --git a/mkosi.images/initrd/mkosi.conf.d/10-opensuse.conf b/mkosi.images/initrd/mkosi.conf.d/10-opensuse.conf deleted file mode 100644 index 5cf2df3..0000000 --- a/mkosi.images/initrd/mkosi.conf.d/10-opensuse.conf +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Distribution=opensuse - -[Output] -CompressOutput=zst - -[Content] -Packages=btrfs-progs - tpm2.0-tools diff --git a/mkosi.images/initrd/mkosi.postinst b/mkosi.images/initrd/mkosi.postinst deleted file mode 100755 index de610df..0000000 --- a/mkosi.images/initrd/mkosi.postinst +++ /dev/null @@ -1,7 +0,0 @@ -#!/bin/sh -# SPDX-License-Identifier: LGPL-2.1-or-later -set -e - -# OpenSUSE insists on blacklisting erofs by default because its supposedly a legacy filesystem. -# See https://github.com/openSUSE/suse-module-tools/pull/71 -rm -f "$BUILDROOT/usr/lib/modprobe.d/60-blacklist_fs-erofs.conf" diff --git a/mkosi.images/minimal-0/mkosi.conf b/mkosi.images/minimal-0/mkosi.conf new file mode 100644 index 0000000..a929fb6 --- /dev/null +++ b/mkosi.images/minimal-0/mkosi.conf @@ -0,0 +1,25 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Config] +Dependencies=minimal-base +ConfigureScripts= + +[Distribution] +CacheOnly=always + +[Output] +Format=portable +SplitArtifacts=yes + +[Content] +BaseTrees=%O/minimal-base +Environment=SYSTEMD_REPART_OVERRIDE_FSTYPE=squashfs +Bootable=no + +BuildSources= +Packages= +BuildPackages= +VolatilePackages= + +[Host] +Incremental=no diff --git a/mkosi.images/minimal-0/mkosi.extra/opt/some_file b/mkosi.images/minimal-0/mkosi.extra/opt/some_file new file mode 100644 index 0000000..bd4fba4 --- /dev/null +++ b/mkosi.images/minimal-0/mkosi.extra/opt/some_file @@ -0,0 +1 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later diff --git a/mkosi.images/minimal-0/mkosi.extra/usr/lib/systemd/system/minimal-app0.service b/mkosi.images/minimal-0/mkosi.extra/usr/lib/systemd/system/minimal-app0.service new file mode 100644 index 0000000..0532112 --- /dev/null +++ b/mkosi.images/minimal-0/mkosi.extra/usr/lib/systemd/system/minimal-app0.service @@ -0,0 +1,5 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Service] +ExecStartPre=cat /usr/lib/os-release +ExecStart=sleep 120 diff --git a/mkosi.images/minimal-0/mkosi.postinst b/mkosi.images/minimal-0/mkosi.postinst new file mode 100755 index 0000000..a66cf68 --- /dev/null +++ b/mkosi.images/minimal-0/mkosi.postinst @@ -0,0 +1,11 @@ +#!/bin/sh +# SPDX-License-Identifier: LGPL-2.1-or-later +set -eux + +mkdir -p "$BUILDROOT/var/lib/app1" + +cat >>"$BUILDROOT/usr/lib/os-release" <>"$BUILDROOT/usr/lib/os-release" <"$BUILDROOT/sbin/init" < /run/credentials/@initrd/myinitrdcred" diff --git a/mkosi.images/system/leak-sanitizer-suppressions b/mkosi.images/system/leak-sanitizer-suppressions new file mode 100644 index 0000000..639abb8 --- /dev/null +++ b/mkosi.images/system/leak-sanitizer-suppressions @@ -0,0 +1 @@ +leak:libselinux diff --git a/mkosi.images/system/mkosi.clean b/mkosi.images/system/mkosi.clean new file mode 100755 index 0000000..64810b7 --- /dev/null +++ b/mkosi.images/system/mkosi.clean @@ -0,0 +1,5 @@ +#!/bin/bash +set -e +set -o nounset + +rm -f "$OUTPUTDIR"/*.{rpm,deb,pkg.tar} diff --git a/mkosi.images/system/mkosi.conf b/mkosi.images/system/mkosi.conf index 7612f22..562650a 100644 --- a/mkosi.images/system/mkosi.conf +++ b/mkosi.images/system/mkosi.conf @@ -1,48 +1,76 @@ # SPDX-License-Identifier: LGPL-2.1-or-later [Config] -Dependencies=base +InitrdInclude=initrd/ + +[Output] +@Format=directory +RepartDirectories=mkosi.repart [Content] Autologin=yes -BaseTrees=../../mkosi.output/base -ExtraTrees=../../mkosi.output/base-systemd +ExtraTrees= + %D/mkosi.crt:/usr/lib/verity.d/mkosi.crt # sysext verification key + leak-sanitizer-suppressions:/usr/lib/systemd/leak-sanitizer-suppressions + coredump-journal-storage.conf:/usr/lib/systemd/coredump.conf.d/10-coredump-journal-storage.conf + +PostInstallationScripts=mkosi.sanitizers.chroot + +InitrdPackages= + findutils + grep + sed + Packages= acl + attr bash-completion + bpftrace + clang coreutils + curl diffutils dnsmasq dosfstools e2fsprogs findutils - gcc # Sanitizer libraries gdb grep gzip + jq kbd kexec-tools + kmod + knot less + lld + llvm + lvm2 + man + mdadm mtools nano nftables + nvme-cli + opensc openssl + p11-kit + python3 qrencode + radvd + rsync sed socat strace systemd + tar tmux tree udev util-linux valgrind + which wireguard-tools xfsprogs zsh - -BuildPackages= - -[Validation] -@SecureBoot=yes -@SignExpectedPcr=yes + zstd diff --git a/mkosi.images/system/mkosi.conf.d/05-initrd.conf b/mkosi.images/system/mkosi.conf.d/05-initrd.conf deleted file mode 100644 index 9f21754..0000000 --- a/mkosi.images/system/mkosi.conf.d/05-initrd.conf +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Bootable=!no -Format=|disk -Format=|directory - -[Config] -Dependencies=initrd - -[Content] -Initrds=../../mkosi.output/initrd diff --git a/mkosi.images/system/mkosi.conf.d/10-arch.conf b/mkosi.images/system/mkosi.conf.d/10-arch.conf deleted file mode 100644 index e1a511c..0000000 --- a/mkosi.images/system/mkosi.conf.d/10-arch.conf +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Distribution=arch - -[Content] -Packages= - bpf - btrfs-progs - compsize - dhcp - f2fs-tools - glib2 - iproute - linux - man-db - openbsd-netcat - openssh - pacman - polkit - python-pefile - python-psutil - python-pytest - python3 - quota-tools - shadow - vim diff --git a/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot new file mode 100755 index 0000000..1f6e0c3 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot @@ -0,0 +1,93 @@ +#!/bin/bash +# SPDX-License-Identifier: LGPL-2.1-or-later +set -e + +if ((NO_BUILD)); then + exit 0 +fi + +# shellcheck source=/dev/null +. /usr/lib/os-release + +if [ ! -f "pkg/$ID/PKGBUILD" ]; then + echo "PKGBUILD not found at pkg/$ID/PKGBUILD, run mkosi once with -ff to make sure the PKGBUILD is cloned" >&2 + exit 1 +fi + +# We can't configure the source or build directory so we use symlinks instead to make sure they are in the +# expected locations. +ln --symbolic "$SRCDIR" "pkg/$ID/systemd-stable" +ln --symbolic "$BUILDDIR" "pkg/$ID/build" +# Because we run with --noextract we are responsible for making sure the source files appear in src/. +ln --symbolic . "pkg/$ID/src" + +MKOSI_CFLAGS="-O0 -Wp,-U_FORTIFY_SOURCE" +if ((LLVM)); then + # TODO: Remove -fno-sanitize-function when https://github.com/systemd/systemd/issues/29972 is fixed. + MKOSI_CFLAGS="$MKOSI_CFLAGS -shared-libasan -fno-sanitize=function" +fi + +MKOSI_LDFLAGS="" +if ((LLVM)) && [[ -n "$SANITIZERS" ]]; then + MKOSI_LDFLAGS="$MKOSI_LDFLAGS -Wl,-rpath=$(clang --print-file-name="")lib/linux" +fi + +MKOSI_MESON_OPTIONS="-D mode=developer -D b_sanitize=${SANITIZERS:-none}" +if ((WIPE)); then + MKOSI_MESON_OPTIONS="$MKOSI_MESON_OPTIONS --wipe" +fi + +# Override the default options. We specifically disable "strip", "zipman" and "lto" as they slow down builds +# significantly. OPTIONS= cannot be overridden on the makepkg command line so we append to /etc/makepkg.conf +# instead. The rootfs is overlaid with a writable tmpfs during the build script so these changes don't end up +# in the image itself. +tee --append /etc/makepkg.conf >/dev/null <&2 + exit 1 +fi + +# We get depends and optdepends from .SRCINFO as getting them from the PKGBUILD is rather complex. +sed --expression 's/^[ \t]*//' "pkg/$ID/.SRCINFO" | + grep --regexp '^depends =' --regexp '^optdepends =' | + sed --expression 's/^depends = //' --expression 's/^optdepends = //' --expression 's/:.*//' --expression 's/=.*//' | + xargs --delimiter '\n' mkosi-install + +# We get makedepends from the PKGBUILD as .SRCINFO can't encode conditional dependencies depending on +# whether some environment variable is set or not. +# shellcheck source=/dev/null +_systemd_UPSTREAM=1 . "pkg/$ID/PKGBUILD" + +# shellcheck disable=SC2154 +mkosi-install "${makedepends[@]}" diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora.conf b/mkosi.images/system/mkosi.conf.d/10-centos-fedora.conf deleted file mode 100644 index 67d4643..0000000 --- a/mkosi.images/system/mkosi.conf.d/10-centos-fedora.conf +++ /dev/null @@ -1,32 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Distribution=|centos -Distribution=|fedora - -[Content] -Packages= - bpftool - cryptsetup - dhcp-server - dnf - glib2 - integritysetup - iproute - iproute-tc - kernel-core - libcap-ng-utils - netcat - openssh-server - p11-kit - pam - passwd - polkit - procps-ng - python3 - python3dist(pefile) - python3dist(pluggy) # python3-pluggy is a pytest dependency that's not installed for some reason. - python3dist(psutil) - python3dist(pytest) - quota - vim-common diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot new file mode 100755 index 0000000..2c05787 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot @@ -0,0 +1,116 @@ +#!/bin/bash +# SPDX-License-Identifier: LGPL-2.1-or-later +set -e + +if ((NO_BUILD)); then + exit 0 +fi + +# shellcheck source=/dev/null +. /usr/lib/os-release + +if [ ! -f "pkg/$ID/systemd.spec" ]; then + echo "spec not found at pkg/$ID/systemd.spec, run mkosi once with -ff to make sure the spec is cloned" >&2 + exit 1 +fi + +if [ -d .git/ ] && [ -z "$(git status --porcelain)" ]; then + TS="$(git show --no-patch --format=%ct HEAD)" +else + TS="${SOURCE_DATE_EPOCH:-$(date +%s)}" +fi + +if systemd-analyze compare-versions "$(rpm --version | cut -d ' ' -f3)" lt "4.19.91"; then + # Fix the %install override so debuginfo packages are generated even when --build-in-place is used. + # See https://github.com/rpm-software-management/rpm/issues/3042. + tee --append /usr/lib/rpm/redhat/macros <<'EOF' +%install %{?_enable_debug_packages:%{debug_package}}\ +%%install\ +%{nil} +EOF +fi + +VERSION="$(cat meson.version)" +RELEASE="$(date "+%Y%m%d%H%M%S" --date "@$TS")" + +DIST="$(rpm --eval %dist)" +ARCH="$(rpm --eval %_arch)" +SRCDEST="/usr/src/debug/systemd-$VERSION-${RELEASE}${DIST}.$ARCH" + +COMMON_MACRO_OVERRIDES=( + --define "toolchain $( ((LLVM)) && echo clang || echo gcc)" + --define "_fortify_level 0" + --undefine _lto_cflags + # TODO: Remove once redhat-rpm-config 292 is available everywhere. + --define "_hardening_clang_cflags --config=/usr/lib/rpm/redhat/redhat-hardened-clang.cfg" + --define "_hardening_clang_ldflags --config=/usr/lib/rpm/redhat/redhat-hardened-clang-ld.cfg" +) + +# TODO: Drop -U_FORTIFY_SOURCE when we switch to CentOS Stream 10. +MKOSI_CFLAGS="-O0 -Wp,-U_FORTIFY_SOURCE" +if ((WITH_DEBUG)); then + MKOSI_CFLAGS="$MKOSI_CFLAGS -fdebug-prefix-map=../src=$SRCDEST" +fi +if ((LLVM)); then + # TODO: Remove -fno-sanitize-function when https://github.com/systemd/systemd/issues/29972 is fixed. + MKOSI_CFLAGS="$MKOSI_CFLAGS -shared-libasan -fno-sanitize=function" +fi + +MKOSI_LDFLAGS="" +if ((LLVM)) && [[ -n "$SANITIZERS" ]]; then + MKOSI_LDFLAGS="$MKOSI_LDFLAGS -Wl,-rpath=$(dirname "$(clang --print-file-name=libclang_rt.asan.so)")" +fi + +MKOSI_MESON_OPTIONS="-D mode=developer -D b_sanitize=${SANITIZERS:-none}" +if ((WIPE)); then + MKOSI_MESON_OPTIONS="$MKOSI_MESON_OPTIONS --wipe" +fi + +IFS= +# TODO: Replace meson_build and meson_install overrides with "--undefine __meson_verbose" once +# https://github.com/mesonbuild/meson/pull/12835 is available. +# shellcheck disable=SC2046 +env \ +--unset=CFLAGS \ +--unset=CXXFLAGS \ +--unset=LDFLAGS \ +ANNOBIN="no-active-checks" \ +CC_LD="$( ((LLVM)) && echo lld)" \ +CXX_LD="$( ((LLVM)) && echo lld)" \ + rpmbuild \ + -bb \ + --build-in-place \ + --with upstream \ + $( ((WITH_TESTS)) || echo "--nocheck") \ + $( ((WITH_DOCS)) || echo "--without=docs") \ + --define "_topdir /var/tmp" \ + --define "_sourcedir pkg/$ID" \ + --define "_rpmdir $OUTPUTDIR" \ + ${BUILDDIR:+"--define=_vpath_builddir $BUILDDIR"} \ + --define "_build_name_fmt %%{NAME}-%%{VERSION}-%%{RELEASE}.%%{ARCH}.rpm" \ + --define "_binary_payload w.ufdio" \ + $( ((WITH_DEBUG)) || echo "--define=debug_package %{nil}") \ + --define "version_override $VERSION" \ + --define "release_override $RELEASE" \ + "${COMMON_MACRO_OVERRIDES[@]}" \ + --define "build_cflags $(rpm "${COMMON_MACRO_OVERRIDES[@]}" --eval "%{?build_cflags}") $MKOSI_CFLAGS $CFLAGS" \ + --define "build_cxxflags $(rpm "${COMMON_MACRO_OVERRIDES[@]}" --eval "%{?build_cxxflags}") $MKOSI_CFLAGS $CFLAGS" \ + --define "build_ldflags $(rpm "${COMMON_MACRO_OVERRIDES[@]}" --eval "%{?build_ldflags}") $MKOSI_LDFLAGS $LDFLAGS" \ + --define "meson_build %{shrink:%{__meson} compile -C %{_vpath_builddir} -j %{_smp_build_ncpus} $( ((MESON_VERBOSE)) && echo --verbose) %{nil}}" \ + --define "meson_install %{shrink:DESTDIR=%{buildroot} %{__meson} install -C %{_vpath_builddir} --no-rebuild --quiet %{nil}}" \ + --define "meson_extra_configure_options $MKOSI_MESON_OPTIONS $MESON_OPTIONS" \ + $( ((WITH_DEBUG)) || echo "--define=__brp_strip %{nil}") \ + --define "__brp_compress %{nil}" \ + --define "__brp_mangle_shebangs %{nil}" \ + --define "__brp_strip_comment_note %{nil}" \ + --define "__brp_strip_static_archive %{nil}" \ + --define "__brp_check_rpaths %{nil}" \ + --define "__elf_exclude_path ^/usr/lib/systemd/tests/unit-tests/.*$" \ + --define "__script_requires %{nil}" \ + --define "_find_debuginfo_dwz_opts %{nil}" \ + --define "_fixperms true" \ + --undefine _package_note_flags \ + --noclean \ + "pkg/$ID/systemd.spec" + +cp "$OUTPUTDIR"/*.rpm "$PACKAGEDIR" diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf new file mode 100644 index 0000000..6fbd507 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf @@ -0,0 +1,75 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Distribution=|centos +Distribution=|fedora + +[Content] +VolatilePackages= + systemd + systemd-boot + systemd-container + systemd-devel + systemd-journal-remote + systemd-networkd + systemd-networkd-defaults + systemd-oomd-defaults + systemd-pam + systemd-resolved + systemd-tests + systemd-udev + systemd-ukify + +Packages= + bind-utils + bpftool + compiler-rt + cryptsetup + device-mapper-event + device-mapper-multipath + dfuzzer + dhcp-server + dnf + git-core + glibc-langpack-de + glibc-langpack-en + gnutls + gnutls-utils + integritysetup + iproute + iproute-tc + iputils + iscsi-initiator-utils + kernel-core + libasan + libcap-ng-utils + libubsan + man-db + netcat + openssh-clients + openssh-server + pam + passwd + policycoreutils + polkit + procps-ng + python3-pexpect + quota + rpm + rpm-build + rpmautospec + sbsigntools + softhsm + squashfs-tools + stress + tpm2-tools + util-linux + veritysetup + vim-common + +InitrdPackages= + tpm2-tools + +InitrdVolatilePackages= + systemd + systemd-udev diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-debug.conf b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-debug.conf new file mode 100644 index 0000000..0c3707b --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-debug.conf @@ -0,0 +1,17 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Environment=WITH_DEBUG=1 + +[Content] +VolatilePackages= + systemd-container-debuginfo + systemd-debuginfo + systemd-debugsource + systemd-journal-remote-debuginfo + systemd-libs-debuginfo + systemd-networkd-debuginfo + systemd-pam-debuginfo + systemd-resolved-debuginfo + systemd-tests-debuginfo + systemd-udev-debuginfo diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-selinux.conf b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-selinux.conf new file mode 100644 index 0000000..9fe5509 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-selinux.conf @@ -0,0 +1,20 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Profile=!particle + +[Content] +# libselinux does not work in the slightest with /usr-only images so don't install the packages if we're +# building a /usr-only image. +Packages= + selinux-policy + selinux-policy-targeted + setools-console + +# We relabel on first boot instead of at build time because it is only possible to label without root +# if the labels exist in the host system, and we want to be able to cross-build to other distributions. +SELinuxRelabel=no + +InitrdPackages= + selinux-policy + selinux-policy-targeted diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.prepare b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.prepare new file mode 100755 index 0000000..1b86073 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.prepare @@ -0,0 +1,65 @@ +#!/bin/bash +# SPDX-License-Identifier: LGPL-2.1-or-later +set -e + +if [ "$1" = "build" ] || ((NO_BUILD)); then + exit 0 +fi + +# shellcheck source=/dev/null +. "$BUILDROOT/usr/lib/os-release" + +if [ ! -f "pkg/$ID/systemd.spec" ]; then + echo "spec not found at pkg/$ID/systemd.spec, run mkosi with -ff to make sure the spec is cloned" >&2 + exit 1 +fi + +for DEPS in --requires --buildrequires; do + mkosi-chroot \ + rpmspec \ + --with upstream \ + --query \ + "$DEPS" \ + --define "_topdir /var/tmp" \ + --define "_sourcedir pkg/$ID" \ + "pkg/$ID/systemd.spec" | + grep --invert-match --regexp systemd --regexp /bin/sh --regexp "rpmlib(" --regexp udev --regexp grubby --regexp sdubby | + sort --unique | + tee /tmp/buildrequires | + xargs --delimiter '\n' mkosi-install +done + +# rpmbuild -br tries to build a source package which means all source files have to exist which isn't the +# case when using --build-in-place so we get rid of the source file that doesn't exist to make it happy. +# TODO: Use -bd instead of -br and get rid of this once we don't need to build on CentOS Stream 9 anymore. +sed '/Source0/d' --in-place "pkg/$ID/systemd.spec" + +until mkosi-chroot \ + rpmbuild \ + -br \ + --build-in-place \ + --with upstream \ + --define "_topdir /var/tmp" \ + --define "_sourcedir pkg/$ID" \ + --define "_build_name_fmt %%{NAME}-%%{VERSION}-%%{RELEASE}.%%{ARCH}.rpm" \ + "pkg/$ID/systemd.spec" +do + EXIT_STATUS=$? + if [ $EXIT_STATUS -ne 11 ]; then + exit $EXIT_STATUS + fi + + mkosi-chroot \ + rpm \ + --query \ + --package \ + --requires \ + /var/tmp/SRPMS/systemd-*.buildreqs.nosrc.rpm | + grep --invert-match '^rpmlib(' | + sort --unique >/tmp/dynamic-buildrequires + + sort /tmp/buildrequires /tmp/dynamic-buildrequires | + uniq --unique | + tee --append /tmp/buildrequires | + xargs --delimiter '\n' mkosi-install +done diff --git a/mkosi.images/system/mkosi.conf.d/10-centos/mkosi.conf b/mkosi.images/system/mkosi.conf.d/10-centos/mkosi.conf index 146e03a..25059c2 100644 --- a/mkosi.images/system/mkosi.conf.d/10-centos/mkosi.conf +++ b/mkosi.images/system/mkosi.conf.d/10-centos/mkosi.conf @@ -4,5 +4,14 @@ Distribution=centos [Content] +Environment= + # The kernel versions in CentOS Stream 9 doesn't support orphan_file, but later versions of + # mkfs.ext4 enabled it by default, so we disable it explicitly. + Environment=SYSTEMD_REPART_MKFS_OPTIONS_EXT4="-O ^orphan_file" + GIT_URL=https://git.centos.org/rpms/systemd.git + GIT_BRANCH=c9s-sig-hyperscale + GIT_COMMIT=8cf2aed0181920611421384f7374720db269d6c7 + Packages= - kernel-modules # For squashfs support + kernel-modules # For squashfs + rpmautospec-rpm-macros diff --git a/mkosi.images/system/mkosi.conf.d/10-centos/mkosi.extra/usr/lib/repart.d/20-root.conf.d/xfs.conf b/mkosi.images/system/mkosi.conf.d/10-centos/mkosi.extra/usr/lib/repart.d/20-root.conf.d/xfs.conf deleted file mode 100644 index 99b846d..0000000 --- a/mkosi.images/system/mkosi.conf.d/10-centos/mkosi.extra/usr/lib/repart.d/20-root.conf.d/xfs.conf +++ /dev/null @@ -1,5 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -# CentOS does not support btrfs so we use xfs instead. -[Partition] -Format=xfs diff --git a/mkosi.images/system/mkosi.conf.d/10-centos/mkosi.repart/10-usr.conf.d/squashfs.conf b/mkosi.images/system/mkosi.conf.d/10-centos/mkosi.repart/10-usr.conf.d/squashfs.conf deleted file mode 100644 index 393d5f0..0000000 --- a/mkosi.images/system/mkosi.conf.d/10-centos/mkosi.repart/10-usr.conf.d/squashfs.conf +++ /dev/null @@ -1,5 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -# CentOS does not support erofs so we use squashfs instead. -[Partition] -Format=squashfs diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-amd64.conf b/mkosi.images/system/mkosi.conf.d/10-debian-amd64.conf deleted file mode 100644 index d3c89f3..0000000 --- a/mkosi.images/system/mkosi.conf.d/10-debian-amd64.conf +++ /dev/null @@ -1,10 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Distribution=debian -Architecture=x86-64 - -[Content] -Packages= - bpftool - linux-image-cloud-amd64 diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-arm64.conf b/mkosi.images/system/mkosi.conf.d/10-debian-arm64.conf deleted file mode 100644 index 76a6898..0000000 --- a/mkosi.images/system/mkosi.conf.d/10-debian-arm64.conf +++ /dev/null @@ -1,10 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Distribution=debian -Architecture=arm64 - -[Content] -Packages= - bpftool - linux-image-cloud-arm64 diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu.conf b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu.conf deleted file mode 100644 index 588f833..0000000 --- a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu.conf +++ /dev/null @@ -1,29 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Distribution=|debian -Distribution=|ubuntu - -[Content] -Packages= - apt - btrfs-progs - cryptsetup-bin - dbus-broker - default-dbus-session-bus - f2fs-tools - fdisk - iproute2 - isc-dhcp-server - libcap-ng-utils - netcat-openbsd - openssh-server - passwd - policykit-1 - procps - python3 - python3-pefile - python3-psutil - python3-pytest - quota - xxd diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot new file mode 100755 index 0000000..7e4eab9 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot @@ -0,0 +1,142 @@ +#!/bin/bash +# SPDX-License-Identifier: LGPL-2.1-or-later +set -e + +if ((NO_BUILD)); then + exit 0 +fi + +# shellcheck source=/dev/null +. /usr/lib/os-release + +if [ ! -d "pkg/$ID/debian" ]; then + echo "deb rules not found at pkg/$ID/debian, run mkosi once with -ff to make sure the rules are cloned" >&2 + exit 1 +fi + +# We transplant the debian/ folder from the deb package sources into the upstream sources. +mount --mkdir --bind "$SRCDIR/pkg/$ID/debian" "$SRCDIR"/debian + +# We remove the patches so they don't get applied. +rm -rf "$SRCDIR"/debian/patches/* + +# While the build directory can be specified through DH_OPTIONS, the default one is hardcoded everywhere so +# we have to use that. Because it is architecture dependent, we query it using dpkg-architecture first. +DEB_HOST_GNU_TYPE="$(dpkg-architecture --query DEB_HOST_GNU_TYPE)" +mount --mkdir --bind "$BUILDDIR" "$SRCDIR/obj-$DEB_HOST_GNU_TYPE" + +if [ -d .git/ ] && [ -z "$(git status --porcelain)" ]; then + TS="$(git show --no-patch --format=%ct HEAD)" +else + TS="${SOURCE_DATE_EPOCH:-$(date +%s)}" +fi + +# Add a new changelog entry to update the version. We use a fixed date since a dynamic one causes a full +# rebuild every time. +cat >debian/changelog.new < $(date --rfc-email --date "@$TS") + +EOF +cat debian/changelog >>debian/changelog.new +mv debian/changelog.new debian/changelog + +MKOSI_CFLAGS="-O0" +if ((LLVM)); then + # TODO: Remove -fno-sanitize-function when https://github.com/systemd/systemd/issues/29972 is fixed. + MKOSI_CFLAGS="$MKOSI_CFLAGS -shared-libasan -fno-sanitize=function" +fi + +MKOSI_LDFLAGS="" +if ((LLVM)) && [[ -n "$SANITIZERS" ]]; then + MKOSI_LDFLAGS="$MKOSI_LDFLAGS -Wl,-rpath=$(clang --print-file-name="")lib/linux" +fi + +MKOSI_MESON_OPTIONS="-D mode=developer -D b_sanitize=${SANITIZERS:-none}" +if ((WIPE)); then + MKOSI_MESON_OPTIONS="$MKOSI_MESON_OPTIONS --wipe" +fi + +# TODO: Drop GENSYMBOLS_LEVEL once https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=986746 is fixed. +build() { + env \ + CC="$( ((LLVM)) && echo clang || echo gcc)" \ + CXX="$( ((LLVM)) && echo clang++ || echo g++)" \ + CC_LD="$( ((LLVM)) && echo lld)" \ + CXX_LD="$( ((LLVM)) && echo lld)" \ + DEB_BUILD_OPTIONS="$(awk '$1=$1' <<<"\ + $( ((WITH_TESTS)) || echo nocheck) \ + $( ((WITH_DOCS)) || echo nodoc) \ + $( ((WITH_DEBUG)) && echo debug || echo nostrip) \ + $( ! ((MESON_VERBOSE)) && echo terse) \ + optimize=-lto \ + hardening=-fortify \ + ")" \ + DEB_BUILD_PROFILES="$(awk '$1=$1' <<<"\ + $( ((WITH_TESTS)) || echo nocheck) \ + $( ((WITH_DOCS)) || echo nodoc) \ + pkg.systemd.upstream \ + ")" \ + DEB_CFLAGS_APPEND="$MKOSI_CFLAGS $CFLAGS" \ + DEB_CXXFLAGS_APPEND="$MKOSI_CFLAGS $CFLAGS" \ + DEB_LDFLAGS_APPEND="$MKOSI_LDFLAGS $LDFLAGS" \ + DPKG_FORCE="unsafe-io" \ + DPKG_DEB_COMPRESSOR_TYPE="none" \ + DH_MISSING="--fail-missing" \ + CONFFLAGS_UPSTREAM="$MKOSI_MESON_OPTIONS $MESON_OPTIONS" \ + GENSYMBOLS_LEVEL="$( ((LLVM)) && echo 0 || echo 1)" \ + dpkg-buildpackage \ + --no-pre-clean \ + --unsigned-changes \ + --build=binary + + EXIT_STATUS=$? + + # Make sure we don't reconfigure twice. + MKOSI_MESON_OPTIONS="${MKOSI_MESON_OPTIONS//"--wipe"/}" + + return $EXIT_STATUS +} + +if ! build; then + # debhelper installs files for each package to debian/ so we figure out which files were + # packaged by querying all the package names from debian/control and running find on each of the + # corresponding package directory in debian/. + grep "Package:" debian/control | + sed "s/Package: //" | + xargs -d '\n' -I {} sh -c "[ -d debian/{} ] && (cd debian/{} && find . ! -type d ! -path "*dh-exec*" -printf '%P\n')" | + # Remove compression suffix from compressed manpages as the manpages in debian/tmp will be uncompressed. + sed --regexp-extended 's/([0-9])\.gz$/\1/' | + sort --unique >/tmp/packaged-files + + # We figure out the installed files by running find on debian/tmp/ which contains the files installed + # by meson install. + (cd debian/tmp/ && find . ! -type d ! -path "*dh-exec*" -printf '%P\n') >/tmp/installed-files + + if [ -f debian/not-installed ]; then + grep --invert-match "^#" debian/not-installed >>/tmp/installed-files + fi + + sort --unique --output /tmp/installed-files /tmp/installed-files + + # We get all the installed files that were not packaged by finding entries in the installed file that are + # not in the packaged file. + comm -23 /tmp/installed-files /tmp/packaged-files > /tmp/unpackaged-files + # If there are no unpackaged files something else went wrong. + if [ ! -s /tmp/unpackaged-files ]; then + exit 1 + fi + + # Otherwise, we append the unpackaged files to the filelist for the systemd package and retry the build. + cat /tmp/unpackaged-files >>debian/systemd.install + build +fi + +( + shopt -s nullglob + cp ../*.deb ../*.ddeb "$PACKAGEDIR" + cp ../*.deb ../*.ddeb "$OUTPUTDIR" +) diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf new file mode 100644 index 0000000..ae014fa --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf @@ -0,0 +1,93 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Distribution=|debian +Distribution=|ubuntu + +[Content] +Environment= + GIT_URL=https://salsa.debian.org/systemd-team/systemd.git + GIT_SUBDIR=debian + GIT_BRANCH=debian/master + GIT_COMMIT=596a70511736d78c1d8a5a27dca3989806cfa733 + +VolatilePackages= + libnss-myhostname + libnss-mymachines + libnss-resolve + libnss-systemd + libpam-systemd + libsystemd-dev + libudev-dev + systemd + systemd-boot + systemd-boot-efi + systemd-container + systemd-coredump + systemd-dev + systemd-homed + systemd-journal-remote + systemd-oomd + systemd-resolved + systemd-sysv + systemd-tests + systemd-timesyncd + systemd-ukify + systemd-userdbd + udev + +Packages= + ^libasan[0-9]+$ + ^libtss2-esys-[0-9.]+-0$ + ^libtss2-mu-[0-9.]+-0$ + ^libubsan[0-9]+$ + apt + bind9-dnsutils + btrfs-progs + cryptsetup-bin + dbus-broker + dbus-user-session + dmsetup + dpkg-dev + f2fs-tools + fdisk + git-core + gnutls-bin + iproute2 + iputils-ping + isc-dhcp-server + libcap-ng-utils + libclang-rt-dev + libtss2-rc0 + libtss2-tcti-device0 + locales + man-db + multipath-tools + netcat-openbsd + open-iscsi + openssh-client + openssh-server + passwd + policykit-1 + procps + psmisc + python3-pexpect + python3-psutil + quota + sbsigntool + softhsm2 + squashfs-tools + stress + tgt + tpm2-tools + tzdata + xxd + +InitrdPackages= + btrfs-progs + libclang-rt-dev + tpm2-tools + +InitrdVolatilePackages= + systemd + udev diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/10-debug.conf b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/10-debug.conf new file mode 100644 index 0000000..b53b3dc --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/10-debug.conf @@ -0,0 +1,27 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Environment=WITH_DEBUG=1 + +[Content] +VolatilePackages= + libnss-myhostname-dbgsym + libnss-mymachines-dbgsym + libnss-resolve-dbgsym + libnss-systemd-dbgsym + libpam-systemd-dbgsym + libsystemd-shared-dbgsym + libsystemd0-dbgsym + libudev1-dbgsym + systemd-boot-dbgsym + systemd-container-dbgsym + systemd-coredump-dbgsym + systemd-dbgsym + systemd-homed-dbgsym + systemd-journal-remote-dbgsym + systemd-oomd-dbgsym + systemd-resolved-dbgsym + systemd-tests-dbgsym + systemd-timesyncd-dbgsym + systemd-userdbd-dbgsym + udev-dbgsym diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/network.conf b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/network.conf new file mode 100644 index 0000000..4fb4f46 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/network.conf @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Environment=NO_BUILD=1 + +[Content] +WithNetwork=yes diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.postinst b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.postinst new file mode 100755 index 0000000..314f235 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.postinst @@ -0,0 +1,29 @@ +#!/bin/bash +# SPDX-License-Identifier: LGPL-2.1-or-later +set -e + +# By default Suggests are not installed (and often Recommends are disabled too), which means we will miss +# the dlopen optional dependencies, but the tests need them, so parse them from the package metadata and +# install them. This is not an issue when building locally, as the build and runtime images are the same, +# so they would get installed as build dependencies anyway. + +if [ "$1" = "build" ] || ! ((NO_BUILD)); then + exit 0 +fi + +# Query the Recommends and Suggests of all systemd packages, by matching on the version +systemd_version="$(dpkg-query --showformat '${Version}' --show systemd)" +mapfile -t systemd_packages < <( dpkg --list | grep '^ii' | grep "$systemd_version" | awk '{print $2}' | tr '\n' ' ' ) +extra_packages=() +# shellcheck disable=SC2068 +for package in ${systemd_packages[@]}; do + # We are looking for dlopens, so filter for libraries + mapfile -t -O "${#extra_packages[@]}" extra_packages < <(dpkg-query --showformat '${Suggests}' --show "$package" | sed -e "s/, /\n/g" -e "s/|.*//" | grep "lib") + mapfile -t -O "${#extra_packages[@]}" extra_packages < <(dpkg-query --showformat '${Recommends}' --show "$package" | sed -e "s/, /\n/g" -e "s/|.*//" | grep "lib") +done + +if [ "${#extra_packages[@]}" -eq 0 ]; then + exit 0 +fi + +apt install "${extra_packages[@]}" diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.prepare b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.prepare new file mode 100755 index 0000000..645671a --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.prepare @@ -0,0 +1,18 @@ +#!/bin/bash +# SPDX-License-Identifier: LGPL-2.1-or-later +set -e + +if [ "$1" = "build" ] || ((NO_BUILD)); then + exit 0 +fi + +# shellcheck source=/dev/null +. "$BUILDROOT/usr/lib/os-release" + +if [ ! -d "pkg/$ID/debian" ]; then + echo "deb rules not found at pkg/$ID/debian, run mkosi once with -ff to make sure the rules are cloned" >&2 + exit 1 +fi + +cd "pkg/$ID" +DEB_BUILD_PROFILES="pkg.systemd.upstream" apt-get build-dep . diff --git a/mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf b/mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf new file mode 100644 index 0000000..c6b6155 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf @@ -0,0 +1,4 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Distribution=debian diff --git a/mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf.d/arm64.conf b/mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf.d/arm64.conf new file mode 100644 index 0000000..af923fa --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf.d/arm64.conf @@ -0,0 +1,8 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Architecture=arm64 + +[Content] +Packages= + linux-image-cloud-arm64 diff --git a/mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf.d/x86-64.conf b/mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf.d/x86-64.conf new file mode 100644 index 0000000..615de52 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-debian/mkosi.conf.d/x86-64.conf @@ -0,0 +1,8 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Architecture=x86-64 + +[Content] +Packages= + linux-image-cloud-amd64 diff --git a/mkosi.images/system/mkosi.conf.d/10-fedora.conf b/mkosi.images/system/mkosi.conf.d/10-fedora.conf deleted file mode 100644 index 42d0093..0000000 --- a/mkosi.images/system/mkosi.conf.d/10-fedora.conf +++ /dev/null @@ -1,10 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Distribution=fedora - -[Content] -Packages= - btrfs-progs - compsize - f2fs-tools diff --git a/mkosi.images/system/mkosi.conf.d/10-fedora/mkosi.conf b/mkosi.images/system/mkosi.conf.d/10-fedora/mkosi.conf new file mode 100644 index 0000000..689fe7d --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-fedora/mkosi.conf @@ -0,0 +1,23 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Distribution=fedora + +[Content] +Environment= + GIT_URL=https://src.fedoraproject.org/rpms/systemd.git + GIT_BRANCH=rawhide + GIT_COMMIT=1f94b56cee818068f57debfd78f035edd29f0e61 + +Packages= + btrfs-progs + compsize + dnf5 + f2fs-tools + scsi-target-utils + # Required for systemd-networkd-tests.py (netdevsim and sch_xxx modules) + kernel-modules-extra + kernel-modules-internal + +InitrdPackages= + btrfs-progs diff --git a/mkosi.images/system/mkosi.conf.d/10-opensuse.conf b/mkosi.images/system/mkosi.conf.d/10-opensuse.conf deleted file mode 100644 index 60a2b6d..0000000 --- a/mkosi.images/system/mkosi.conf.d/10-opensuse.conf +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Distribution=opensuse - -[Content] -Packages= - bpftool - btrfs-progs - cryptsetup - dbus-broker - f2fs-tools - glibc-locale-base - kernel-kvmsmall - libcap-ng-utils - openssh-server - python3 - python3-pefile - python3-psutil - python3-pytest - quota - shadow - vim diff --git a/mkosi.images/system/mkosi.conf.d/10-opensuse/initrd/mkosi.postinst b/mkosi.images/system/mkosi.conf.d/10-opensuse/initrd/mkosi.postinst new file mode 100755 index 0000000..417132f --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-opensuse/initrd/mkosi.postinst @@ -0,0 +1,7 @@ +#!/bin/bash +# SPDX-License-Identifier: LGPL-2.1-or-later +set -e + +# OpenSUSE insists on blacklisting erofs by default because its supposedly a legacy filesystem. +# See https://github.com/openSUSE/suse-module-tools/pull/71 +rm -f "$BUILDROOT/usr/lib/modprobe.d/60-blacklist_fs-erofs.conf" diff --git a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot new file mode 100755 index 0000000..3d6cc58 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot @@ -0,0 +1,132 @@ +#!/bin/bash +# SPDX-License-Identifier: LGPL-2.1-or-later +set -e + +if ((NO_BUILD)); then + exit 0 +fi + +# shellcheck source=/dev/null +. /usr/lib/os-release +ID="${ID%-*}" + +if [ ! -f "pkg/$ID/systemd.spec" ]; then + echo "spec not found at pkg/$ID/systemd.spec, run mkosi once with -ff to make sure the spec is cloned" >&2 + exit 1 +fi + +if [ -d .git/ ] && [ -z "$(git status --porcelain)" ]; then + TS="$(git show --no-patch --format=%ct HEAD)" +else + TS="${SOURCE_DATE_EPOCH:-$(date +%s)}" +fi + +# The openSUSE filelists hardcode the manpage compression extension. This causes rpmbuild errors since we +# disable manpage compression as the files cannot be found. Fix the issue by removing the compression +# extension. +find "pkg/$ID" -name "files.*" -exec sed --in-place 's/\.gz$//' {} \; + +if systemd-analyze compare-versions "$(rpm --version | cut -d ' ' -f3)" lt "4.20"; then + # Fix the %install override so debuginfo packages are generated. + tee --append /usr/lib/rpm/suse/macros <<'EOF' +%install %{debug_package}\ +%%install\ +%{nil} +EOF +fi + +VERSION="$(cat meson.version)" +RELEASE="$(date "+%Y%m%d%H%M%S" --date "@$TS")" + +DIST="$(rpm --eval %dist)" +ARCH="$(rpm --eval %_arch)" +SRCDEST="/usr/src/debug/systemd-$VERSION-${RELEASE}${DIST}.$ARCH" + +MKOSI_CFLAGS="-O0 -Wp,-U_FORTIFY_SOURCE" +if ((WITH_DEBUG)); then + MKOSI_CFLAGS="$MKOSI_CFLAGS -fdebug-prefix-map=../src=$SRCDEST" +fi +if ((LLVM)); then + # TODO: Remove -fno-sanitize-function when https://github.com/systemd/systemd/issues/29972 is fixed. + MKOSI_CFLAGS="$MKOSI_CFLAGS -shared-libasan -fno-sanitize=function" +fi + +MKOSI_LDFLAGS="$(rpm --eval "%{?build_ldflags}")" +if ((LLVM)) && [[ -n "$SANITIZERS" ]]; then + MKOSI_LDFLAGS="$MKOSI_LDFLAGS -Wl,-rpath=$(clang --print-file-name="")lib/linux" +fi + +# A macro can't have an empty body and currently opensuse does not specify any of its own linker flags so +# set LDFLAGS to %{nil} if there are no linker flags. +if [[ -z "${MKOSI_LDFLAGS// }" ]]; then + MKOSI_LDFLAGS="%{nil}" +fi + +MKOSI_MESON_OPTIONS="-D mode=developer -D b_sanitize=${SANITIZERS:-none}" +if ((WIPE)); then + MKOSI_MESON_OPTIONS="$MKOSI_MESON_OPTIONS --wipe" +fi + +build() { + IFS= + # shellcheck disable=SC2046 + env \ + --unset CFLAGS \ + --unset CXXFLAGS \ + --unset LDFLAGS \ + CC="$( ((LLVM)) && echo clang || echo gcc)" \ + CXX="$( ((LLVM)) && echo clang++ || echo g++)" \ + CC_LD="$( ((LLVM)) && echo lld)" \ + CXX_LD="$( ((LLVM)) && echo lld)" \ + rpmbuild \ + -bb \ + --build-in-place \ + --with upstream \ + $( ((WITH_TESTS)) || echo "--nocheck") \ + --define "_topdir /var/tmp" \ + --define "_sourcedir pkg/$ID" \ + --define "_rpmdir $OUTPUTDIR" \ + ${BUILDDIR:+"--define=_vpath_builddir $BUILDDIR"} \ + --define "_build_name_fmt %%{NAME}-%%{VERSION}-%%{RELEASE}.%%{ARCH}.rpm" \ + --define "_binary_payload w.ufdio" \ + $( ((WITH_DEBUG)) || echo "--define=debug_package %{nil}") \ + --define "vendor openSUSE" \ + --define "version_override $VERSION" \ + --define "release_override $RELEASE" \ + --define "__check_files sh -c '$(rpm --define "_topdir /var/tmp" --eval %__check_files) | tee /tmp/unpackaged-files'" \ + --define "build_cflags $(rpm --eval "%{?build_cflags}") $MKOSI_CFLAGS $CFLAGS" \ + --define "build_cxxflags $(rpm --eval "%{?build_cxxflags}") $MKOSI_CFLAGS $CFLAGS" \ + --define "build_ldflags $MKOSI_LDFLAGS $LDFLAGS" \ + $( ((MESON_VERBOSE)) || echo "--undefine=__meson_verbose") \ + --define "meson_extra_configure_options $MKOSI_MESON_OPTIONS $MESON_OPTIONS" \ + --define "__os_install_post /usr/lib/rpm/brp-suse %{nil}" \ + --define "__elf_exclude_path ^/usr/lib/systemd/tests/unit-tests/.*$" \ + --define "__script_requires %{nil}" \ + --define "_find_debuginfo_dwz_opts %{nil}" \ + --define "_fixperms true" \ + --noclean \ + "$@" \ + "pkg/$ID/systemd.spec" + + EXIT_STATUS=$? + + # Make sure we don't reconfigure twice. + MKOSI_MESON_OPTIONS="${MKOSI_MESON_OPTIONS//"--wipe"/}" + + return $EXIT_STATUS +} + +if ! build; then + if [ ! -s /tmp/unpackaged-files ]; then + exit 1 + fi + + # rpm will append to any existing systemd.lang so delete it explicitly so we don't get duplicate file + # warnings. + rm systemd.lang + + grep -v ".debug" /tmp/unpackaged-files >>"pkg/$ID/files.systemd" + build --noprep --nocheck +fi + +cp "$OUTPUTDIR"/*.rpm "$PACKAGEDIR" diff --git a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf new file mode 100644 index 0000000..38ae052 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf @@ -0,0 +1,100 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Distribution=opensuse + +[Config] +InitrdInclude=initrd/ + +[Content] +Environment= + GIT_URL=https://src.opensuse.org/rpm/systemd + GIT_BRANCH=factory + GIT_COMMIT=973534fe1a0a5746ead5bbb6dff8b9ccb9e010982997ed56eba8e44a41c5895d + +VolatilePackages= + systemd + systemd-boot + systemd-container + systemd-devel + systemd-doc + systemd-experimental + systemd-homed + systemd-lang + systemd-network + systemd-portable + systemd-sysvcompat + systemd-testsuite + udev + +# We install gawk, gzip, grep, xz, sed, rsync and docbook-xsl-stylesheets here explicitly so that the busybox +# versions don't get installed instead. +Packages= + bind-utils + bpftool + btrfs-progs + cryptsetup + device-mapper + dhcp-server + docbook-xsl-stylesheets + f2fs-tools + gawk + gcc-c++ + git-core + glibc-locale-base + gnutls + grep + group(bin) + group(daemon) + group(games) + group(nobody) + group(root) + gzip + iputils + kernel-default + kmod + libasan8 + libkmod2 + libubsan1 + multipath-tools + open-iscsi + openssh-clients + openssh-server + pam + patterns-base-minimal_base + procps4 + psmisc + python3-pefile + python3-pexpect + python3-psutil + quota + rpm-build + rsync + sbsigntools + sed + shadow + softhsm + squashfs + tgt + timezone + tpm2.0-tools + user(bin) + user(daemon) + user(games) + user(nobody) + user(root) + veritysetup + vim + xz + +InitrdPackages= + btrfs-progs + clang + kmod + libkmod2 + tpm2.0-tools + +InitrdVolatilePackages= + systemd + udev + systemd-experimental diff --git a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf.d/10-debug.conf b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf.d/10-debug.conf new file mode 100644 index 0000000..2262eae --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf.d/10-debug.conf @@ -0,0 +1,22 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Environment=WITH_DEBUG=1 + +[Content] +VolatilePackages= + libsystemd0-debuginfo + libudev1-debuginfo + systemd-boot-debuginfo + systemd-container-debuginfo + systemd-coredump-debuginfo + systemd-debuginfo + systemd-debugsource + systemd-experimental-debuginfo + systemd-homed-debuginfo + systemd-journal-remote-debuginfo + systemd-network-debuginfo + systemd-portable-debuginfo + systemd-sysvcompat-debuginfo + systemd-testsuite-debuginfo + udev-debuginfo diff --git a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.prepare b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.prepare new file mode 100755 index 0000000..282a360 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.prepare @@ -0,0 +1,61 @@ +#!/bin/bash +# SPDX-License-Identifier: LGPL-2.1-or-later +set -e + +if [ "$1" = "build" ] || ((NO_BUILD)); then + exit 0 +fi + +# shellcheck source=/dev/null +. "$BUILDROOT/usr/lib/os-release" +ID="${ID%-*}" + +if [ ! -f "pkg/$ID/systemd.spec" ]; then + echo "spec not found at pkg/$ID/systemd.spec, run mkosi once with -ff to make sure the spec is cloned" >&2 + exit 1 +fi + +for DEPS in --requires --buildrequires; do + mkosi-chroot \ + rpmspec \ + --with upstream \ + --query \ + "$DEPS" \ + --define "_topdir /var/tmp" \ + --define "_sourcedir pkg/$ID" \ + "pkg/$ID/systemd.spec" | + grep --invert-match --regexp systemd --regexp /bin/sh --regexp "rpmlib(" --regexp udev | + sort --unique | + tee /tmp/buildrequires | + xargs --delimiter '\n' mkosi-install +done + +until mkosi-chroot \ + rpmbuild \ + -bd \ + --build-in-place \ + --with upstream \ + --define "_topdir /var/tmp" \ + --define "_sourcedir pkg/$ID" \ + --define "_build_name_fmt %%{NAME}-%%{VERSION}-%%{RELEASE}.%%{ARCH}.rpm" \ + "pkg/$ID/systemd.spec" +do + EXIT_STATUS=$? + if [ $EXIT_STATUS -ne 11 ]; then + exit $EXIT_STATUS + fi + + mkosi-chroot \ + rpm \ + --query \ + --package \ + --requires \ + /var/tmp/SRPMS/systemd-*.buildreqs.nosrc.rpm | + grep --invert-match '^rpmlib(' | + sort --unique >/tmp/dynamic-buildrequires + + sort /tmp/buildrequires /tmp/dynamic-buildrequires | + uniq --unique | + tee --append /tmp/buildrequires | + xargs --delimiter '\n' mkosi-install +done diff --git a/mkosi.images/system/mkosi.conf.d/10-ubuntu.conf b/mkosi.images/system/mkosi.conf.d/10-ubuntu.conf deleted file mode 100644 index f58ee7e..0000000 --- a/mkosi.images/system/mkosi.conf.d/10-ubuntu.conf +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Match] -Distribution=ubuntu - -[Content] -Packages= - # We would like to use linux-image-kvm but it does not have support for SMBIOS credentials. - linux-image-generic - linux-tools-common - linux-tools-generic diff --git a/mkosi.images/system/mkosi.conf.d/10-ubuntu/mkosi.conf b/mkosi.images/system/mkosi.conf.d/10-ubuntu/mkosi.conf new file mode 100644 index 0000000..25957b1 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-ubuntu/mkosi.conf @@ -0,0 +1,13 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Distribution=ubuntu + +[Distribution] +PackageManagerTrees=noble-backports.sources:/etc/apt/sources.list.d/noble-backports.sources + +[Content] +Packages= + linux-image-generic + linux-tools-common + linux-tools-virtual diff --git a/mkosi.images/system/mkosi.conf.d/10-ubuntu/noble-backports.sources b/mkosi.images/system/mkosi.conf.d/10-ubuntu/noble-backports.sources new file mode 100644 index 0000000..d10c1e8 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/10-ubuntu/noble-backports.sources @@ -0,0 +1,6 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later +Types: deb +URIs: http://archive.ubuntu.com/ubuntu +Suites: noble-backports +Components: main universe +Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg diff --git a/mkosi.images/system/mkosi.conf.d/20-images.conf b/mkosi.images/system/mkosi.conf.d/20-images.conf new file mode 100644 index 0000000..8641984 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/20-images.conf @@ -0,0 +1,22 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Format=!none + +[Config] +Dependencies= + exitrd + minimal-base + minimal-0 + minimal-1 + +[Content] +ExtraTrees= + %O/minimal-0.root-%a.raw:/usr/share/minimal_0.raw + %O/minimal-0.root-%a-verity.raw:/usr/share/minimal_0.verity + %O/minimal-0.root-%a-verity-sig.raw:/usr/share/minimal_0.verity.sig + %O/minimal-1.root-%a.raw:/usr/share/minimal_1.raw + %O/minimal-1.root-%a-verity.raw:/usr/share/minimal_1.verity + %O/minimal-1.root-%a-verity-sig.raw:/usr/share/minimal_1.verity.sig + %O/minimal-base:/usr/share/TEST-13-NSPAWN-container-template + %O/exitrd:/exitrd diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.conf b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.conf new file mode 100644 index 0000000..8c1920b --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.conf @@ -0,0 +1,15 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Match] +Profile=particle + +[Output] +RepartDirectories= +RepartDirectories=mkosi.repart + +[Validation] +@SecureBoot=yes +@SignExpectedPcr=yes + +[Host] +@RuntimeSize=8G diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/15-swap.conf b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/15-swap.conf new file mode 100644 index 0000000..3755278 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/15-swap.conf @@ -0,0 +1,6 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Partition] +Type=swap +SizeMinBytes=100M +SizeMaxBytes=100M diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/20-root.conf b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/20-root.conf new file mode 100644 index 0000000..2f92af2 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/20-root.conf @@ -0,0 +1,6 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Partition] +Type=root +Format=btrfs +SizeMinBytes=1G diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/tmpfiles.d/99-mkosi.conf b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/tmpfiles.d/99-mkosi.conf new file mode 100644 index 0000000..dac79ba --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.extra/usr/lib/tmpfiles.d/99-mkosi.conf @@ -0,0 +1,3 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +C+! /etc - - - - /usr/share/factory/mkosi diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.finalize b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.finalize new file mode 100755 index 0000000..69f9554 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.finalize @@ -0,0 +1,6 @@ +#!/bin/bash +# SPDX-License-Identifier: LGPL-2.1-or-later +set -e + +mkdir -p "$BUILDROOT"/usr/share/factory/mkosi +cp --archive --recursive --no-target-directory --reflink=auto "$BUILDROOT"/etc "$BUILDROOT"/usr/share/factory/mkosi diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.postinst.chroot b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.postinst.chroot new file mode 100755 index 0000000..95e0552 --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.postinst.chroot @@ -0,0 +1,12 @@ +#!/bin/bash +# SPDX-License-Identifier: LGPL-2.1-or-later +set -e + +# sbsign is not available on CentOS Stream +if command -v sbsign &>/dev/null; then + # Ensure that side-loaded PE addons are loaded if signed, and ignored if not + addons_dir=/efi/loader/addons + mkdir -p "$addons_dir" + ukify build --secureboot-private-key mkosi.key --secureboot-certificate mkosi.crt --cmdline this_should_be_here -o "$addons_dir/good.addon.efi" + ukify build --cmdline this_should_not_be_here -o "$addons_dir/bad.addon.efi" +fi diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/00-esp.conf b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/00-esp.conf new file mode 100644 index 0000000..391543d --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/00-esp.conf @@ -0,0 +1,9 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Partition] +Type=esp +Format=vfat +CopyFiles=/boot:/ +CopyFiles=/efi:/ +SizeMinBytes=1G +SizeMaxBytes=1G diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/10-usr.conf b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/10-usr.conf new file mode 100644 index 0000000..343761d --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/10-usr.conf @@ -0,0 +1,9 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Partition] +Type=usr +Format=erofs +CopyFiles=/usr:/ +Verity=data +VerityMatchKey=usr +Minimize=yes diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/11-usr-verity.conf b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/11-usr-verity.conf new file mode 100644 index 0000000..b4d45dd --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/11-usr-verity.conf @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Partition] +Type=usr-verity +Verity=hash +VerityMatchKey=usr +Minimize=yes diff --git a/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/12-usr-verity-sig.conf b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/12-usr-verity-sig.conf new file mode 100644 index 0000000..1841d0a --- /dev/null +++ b/mkosi.images/system/mkosi.conf.d/20-particle/mkosi.repart/12-usr-verity-sig.conf @@ -0,0 +1,6 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Partition] +Type=usr-verity-sig +Verity=signature +VerityMatchKey=usr diff --git a/mkosi.images/system/mkosi.extra/.autorelabel b/mkosi.images/system/mkosi.extra/.autorelabel new file mode 100644 index 0000000..bd4fba4 --- /dev/null +++ b/mkosi.images/system/mkosi.extra/.autorelabel @@ -0,0 +1 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later diff --git a/mkosi.images/system/mkosi.extra/etc/iscsi/iscsid.conf b/mkosi.images/system/mkosi.extra/etc/iscsi/iscsid.conf new file mode 100644 index 0000000..fcf4cd9 --- /dev/null +++ b/mkosi.images/system/mkosi.extra/etc/iscsi/iscsid.conf @@ -0,0 +1,3 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +iscsid.startup = /usr/bin/systemctl start iscsid.socket diff --git a/mkosi.images/system/mkosi.extra/usr/lib/repart.d/15-swap.conf b/mkosi.images/system/mkosi.extra/usr/lib/repart.d/15-swap.conf deleted file mode 100644 index 3755278..0000000 --- a/mkosi.images/system/mkosi.extra/usr/lib/repart.d/15-swap.conf +++ /dev/null @@ -1,6 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Partition] -Type=swap -SizeMinBytes=100M -SizeMaxBytes=100M diff --git a/mkosi.images/system/mkosi.extra/usr/lib/repart.d/20-root.conf b/mkosi.images/system/mkosi.extra/usr/lib/repart.d/20-root.conf deleted file mode 100644 index 71eb9e3..0000000 --- a/mkosi.images/system/mkosi.extra/usr/lib/repart.d/20-root.conf +++ /dev/null @@ -1,8 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -[Partition] -Type=root -Format=btrfs -SizeMinBytes=1G -Subvolumes=/home /var -MakeDirectories=/home /var diff --git a/mkosi.images/system/mkosi.extra/usr/lib/systemd/journald.conf.d/50-persistent.conf b/mkosi.images/system/mkosi.extra/usr/lib/systemd/journald.conf.d/50-persistent.conf deleted file mode 100644 index 2f95329..0000000 --- a/mkosi.images/system/mkosi.extra/usr/lib/systemd/journald.conf.d/50-persistent.conf +++ /dev/null @@ -1,8 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -# We only ship /usr in the image so /var/log/journal won't exist on boot which means systemd-journald won't -# persist any logs as the default Storage= setting is "auto". We can't create /var/log/journal using tmpfiles -# as systemd-journal-flush.service runs before systemd-tmpfiles-setup.service so instead we explicitly set -# Storage= to persistent to have systemd-journald create /var/log/journal itself. -[Journal] -Storage=persistent diff --git a/mkosi.images/system/mkosi.extra/usr/lib/systemd/journald.conf.d/ratelimit.conf b/mkosi.images/system/mkosi.extra/usr/lib/systemd/journald.conf.d/ratelimit.conf new file mode 100644 index 0000000..3baede4 --- /dev/null +++ b/mkosi.images/system/mkosi.extra/usr/lib/systemd/journald.conf.d/ratelimit.conf @@ -0,0 +1,5 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Journal] +RateLimitIntervalSec=0 +RateLimitBurst=0 diff --git a/mkosi.images/system/mkosi.extra/usr/lib/systemd/mkosi-check-and-shutdown.sh b/mkosi.images/system/mkosi.extra/usr/lib/systemd/mkosi-check-and-shutdown.sh deleted file mode 100755 index 9bb2462..0000000 --- a/mkosi.images/system/mkosi.extra/usr/lib/systemd/mkosi-check-and-shutdown.sh +++ /dev/null @@ -1,19 +0,0 @@ -#!/bin/bash -eux -# SPDX-License-Identifier: LGPL-2.1-or-later - -# TODO: Figure out why this is failing -systemctl reset-failed systemd-vconsole-setup.service - -systemctl --failed --no-legend | tee /failed-services - -# Check that secure boot keys were properly enrolled. -if ! systemd-detect-virt --container; then - cmp /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c <(printf '\6\0\0\0\1') - cmp /sys/firmware/efi/efivars/SetupMode-8be4df61-93ca-11d2-aa0d-00e098032b8c <(printf '\6\0\0\0\0') - # TODO: Figure out why this is failing - # grep -q this_should_be_here /proc/cmdline - # grep -q this_should_not_be_here /proc/cmdline && exit 1 -fi - -# Exit with non-zero EC if the /failed-services file is not empty (we have -e set) -[[ ! -s /failed-services ]] diff --git a/mkosi.images/system/mkosi.extra/usr/lib/systemd/system-preset/00-mkosi.preset b/mkosi.images/system/mkosi.extra/usr/lib/systemd/system-preset/00-mkosi.preset new file mode 100644 index 0000000..c364058 --- /dev/null +++ b/mkosi.images/system/mkosi.extra/usr/lib/systemd/system-preset/00-mkosi.preset @@ -0,0 +1,41 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +# mkosi adds its own ssh units via the --ssh switch so disable the default ones. +disable ssh.service +disable sshd.service + +# These are started manually in integration tests so don't start them by default. +disable dnsmasq.service +disable isc-dhcp-server.service +disable isc-dhcp-server6.service + +# Pulled in via dracut-network by kexec-tools on Fedora. +disable NetworkManager* + +# Make sure dbus-broker is started by default on Debian/Ubuntu. +enable dbus-broker.service + +# systemd-networkd is disabled by default on Fedora so make sure it is enabled. +enable systemd-networkd.service +enable systemd-networkd-wait-online.service + +# systemd-resolved is disable by default on CentOS so make sure it is enabled. +enable systemd-resolved.service + +# We install dnf in some images but it's only going to be used rarely, +# so let's not have dnf create its cache. +disable dnf-makecache.* + +# We have journald to receive audit data so let's make sure we're not running auditd as well +disable auditd.service + +# systemd-timesyncd is not enabled by default in the default systemd preset so enable it here instead. +enable systemd-timesyncd.service + +# Skipped if selinux is not enabled, required for TEST-06-SELINUX. +enable autorelabel.service + +# Enabled by default on OpenSUSE and not conditioned out in containers, so let's disable these here instead. +disable iscsi.service +disable iscsid.socket +disable iscsiuio.socket diff --git a/mkosi.images/system/mkosi.extra/usr/lib/systemd/system-preset/99-mkosi.preset b/mkosi.images/system/mkosi.extra/usr/lib/systemd/system-preset/99-mkosi.preset new file mode 100644 index 0000000..710ee7c --- /dev/null +++ b/mkosi.images/system/mkosi.extra/usr/lib/systemd/system-preset/99-mkosi.preset @@ -0,0 +1,4 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +# Make sure that services are disabled by default (primarily for Debian/Ubuntu). +disable * diff --git a/mkosi.images/system/mkosi.extra/usr/lib/systemd/system/iscsi-init.service.d/asan.conf b/mkosi.images/system/mkosi.extra/usr/lib/systemd/system/iscsi-init.service.d/asan.conf new file mode 100644 index 0000000..ebf7899 --- /dev/null +++ b/mkosi.images/system/mkosi.extra/usr/lib/systemd/system/iscsi-init.service.d/asan.conf @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +# The iscsi-init.service calls `sh` which might, in certain circumstances, pull in instrumented systemd NSS +# modules causing `sh` to fail. Avoid the issue by setting LD_PRELOAD to load the sanitizer libraries if +# needed. +[Service] +EnvironmentFile=-/usr/lib/systemd/systemd-asan-env diff --git a/mkosi.images/system/mkosi.extra/usr/lib/systemd/system/mkosi-check-and-shutdown.service b/mkosi.images/system/mkosi.extra/usr/lib/systemd/system/mkosi-check-and-shutdown.service deleted file mode 100644 index 7942cbf..0000000 --- a/mkosi.images/system/mkosi.extra/usr/lib/systemd/system/mkosi-check-and-shutdown.service +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later -[Unit] -Description=Check if any service failed and then shutdown the machine -After=multi-user.target network-online.target -Requires=multi-user.target -Wants=systemd-resolved.service systemd-networkd.service network-online.target -SuccessAction=exit -FailureAction=exit -# On success, exit with 123 so that we can check that we receive the actual exit code from the script on the -# host. -SuccessActionExitStatus=123 - -[Service] -Type=oneshot -ExecStart=/usr/lib/systemd/mkosi-check-and-shutdown.sh diff --git a/mkosi.images/system/mkosi.extra/usr/lib/systemd/system/user@.service.d/99-SYSTEMD_UNIT_PATH.conf b/mkosi.images/system/mkosi.extra/usr/lib/systemd/system/user@.service.d/99-SYSTEMD_UNIT_PATH.conf new file mode 100644 index 0000000..d0093b7 --- /dev/null +++ b/mkosi.images/system/mkosi.extra/usr/lib/systemd/system/user@.service.d/99-SYSTEMD_UNIT_PATH.conf @@ -0,0 +1,4 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +[Service] +PassEnvironment=SYSTEMD_UNIT_PATH diff --git a/mkosi.images/system/mkosi.extra/usr/lib/tmpfiles.d/99-mkosi.conf b/mkosi.images/system/mkosi.extra/usr/lib/tmpfiles.d/99-mkosi.conf deleted file mode 100644 index dac79ba..0000000 --- a/mkosi.images/system/mkosi.extra/usr/lib/tmpfiles.d/99-mkosi.conf +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: LGPL-2.1-or-later - -C+! /etc - - - - /usr/share/factory/mkosi diff --git a/mkosi.images/system/mkosi.extra/usr/lib/tmpfiles.d/locale.conf b/mkosi.images/system/mkosi.extra/usr/lib/tmpfiles.d/locale.conf new file mode 100644 index 0000000..e1a8e81 --- /dev/null +++ b/mkosi.images/system/mkosi.extra/usr/lib/tmpfiles.d/locale.conf @@ -0,0 +1 @@ +L /etc/default/locale - - - - ../locale.conf diff --git a/mkosi.images/system/mkosi.extra/usr/share/dbus-1/system.d/systemd.test.ExecStopPost.conf b/mkosi.images/system/mkosi.extra/usr/share/dbus-1/system.d/systemd.test.ExecStopPost.conf new file mode 100644 index 0000000..ddd36ed --- /dev/null +++ b/mkosi.images/system/mkosi.extra/usr/share/dbus-1/system.d/systemd.test.ExecStopPost.conf @@ -0,0 +1,13 @@ + + + + + + + + + + diff --git a/mkosi.images/system/mkosi.extra/usr/share/factory/mkosi/gdbinit.d/systemd.gdb b/mkosi.images/system/mkosi.extra/usr/share/factory/mkosi/gdbinit.d/systemd.gdb deleted file mode 100644 index 26f882b..0000000 --- a/mkosi.images/system/mkosi.extra/usr/share/factory/mkosi/gdbinit.d/systemd.gdb +++ /dev/null @@ -1,3 +0,0 @@ -set debuginfod enabled off -set build-id-verbose 0 -set substitute-path ../src /root/src/systemd diff --git a/mkosi.images/system/mkosi.finalize b/mkosi.images/system/mkosi.finalize deleted file mode 100755 index 74b810c..0000000 --- a/mkosi.images/system/mkosi.finalize +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/sh -# SPDX-License-Identifier: LGPL-2.1-or-later - -cp --archive --recursive --no-target-directory --reflink=auto "$BUILDROOT"/etc "$BUILDROOT"/usr/share/factory/mkosi diff --git a/mkosi.images/system/mkosi.postinst.chroot b/mkosi.images/system/mkosi.postinst.chroot index 0cb9b9c..4686802 100755 --- a/mkosi.images/system/mkosi.postinst.chroot +++ b/mkosi.images/system/mkosi.postinst.chroot @@ -1,68 +1,9 @@ -#!/bin/sh +#!/bin/bash # SPDX-License-Identifier: LGPL-2.1-or-later set -e +set -o nounset -if [ "$1" = "build" ]; then - exit 0 -fi - -if [ -n "$SANITIZERS" ]; then - LD_PRELOAD=$(ldd /usr/lib/systemd/systemd | grep libasan.so | awk '{print $3}') - - mkdir -p /etc/systemd/system.conf.d - - cat >/etc/systemd/system.conf.d/10-asan.conf </etc/systemd/system/systemd-journald.service.d/10-stdout-tty.conf </etc/systemd/system/console-getty.service.d/10-no-vhangup.conf < 50s when built with sanitizers so let's not run it by default. - systemctl mask systemd-hwdb-update.service -fi - -if [ -n "$IMAGE_ID" ] ; then - sed -n \ - -i \ - -e '/^IMAGE_ID=/!p' \ - -e "\$aIMAGE_ID=$IMAGE_ID" \ - /usr/lib/os-release -fi - -if [ -n "$IMAGE_VERSION" ] ; then - sed -n \ - -i \ - -e '/^IMAGE_VERSION=/!p' \ - -e "\$aIMAGE_VERSION=$IMAGE_VERSION" \ - /usr/lib/os-release -fi +useradd --uid 4711 --create-home --user-group testuser if command -v authselect >/dev/null; then # authselect 1.5.0 renamed the minimal profile to the local profile without keeping backwards compat so @@ -85,9 +26,147 @@ fi mountpoint -q /etc/resolv.conf && umount /etc/resolv.conf rm -f /etc/resolv.conf -. /usr/lib/os-release +for f in "$BUILDROOT"/usr/share/*.verity.sig; do + jq --join-output '.rootHash' "$f" >"${f%.verity.sig}.roothash" +done + +# We want /var/log/journal to be created on first boot so it can be created with the right chattr settings by +# systemd-journald. +rm -r "$BUILDROOT/var/log/journal" + +rm -f /etc/nsswitch.conf +cp "$SRCDIR/factory/etc/nsswitch.conf" /etc/nsswitch.conf + +# Remove to make TEST-73-LOCALE pass on Ubuntu. +rm -f /etc/default/keyboard + +# This is executed inside the chroot so no need to disable any features as the default features will match +# the kernel's supported features. +SYSTEMD_REPART_MKFS_OPTIONS_EXT4="" \ + systemd-repart \ + --empty=create \ + --dry-run=no \ + --size=auto \ + --offline=true \ + --root test/TEST-24-CRYPTSETUP \ + --definitions test/TEST-24-CRYPTSETUP/keydev.repart \ + "$OUTPUTDIR/keydev.raw" + +can_test_pkcs11() { + if ! command -v "softhsm2-util" >/dev/null; then + echo "softhsm2-util not available, skipping the PKCS#11 test" >&2 + return 1 + fi + if ! command -v "pkcs11-tool" >/dev/null; then + echo "pkcs11-tool not available, skipping the PKCS#11 test" >&2 + return 1 + fi + if ! command -v "certtool" >/dev/null; then + echo "certtool not available, skipping the PKCS#11 test" >&2 + return 1 + fi + if ! systemctl --version | grep -q "+P11KIT"; then + echo "Support for p11-kit is disabled, skipping the PKCS#11 test" >&2 + return 1 + fi + if ! systemctl --version | grep -q "+OPENSSL"; then + echo "Support for openssl is disabled, skipping the PKCS#11 test" >&2 + return 1 + fi + if ! systemctl --version | grep -q "+LIBCRYPTSETUP\b"; then + echo "Support for libcryptsetup is disabled, skipping the PKCS#11 test" >&2 + return 1 + fi + if ! systemctl --version | grep -q "+LIBCRYPTSETUP_PLUGINS"; then + echo "Support for libcryptsetup plugins is disabled, skipping the PKCS#11 test" >&2 + return 1 + fi + + return 0 +} + +setup_pkcs11_token() { + echo "Setup PKCS#11 token" >&2 + local P11_MODULE_CONFIGS_DIR P11_MODULE_DIR SOFTHSM_MODULE + + export SOFTHSM2_CONF="/tmp/softhsm2.conf" + mkdir -p /usr/lib/softhsm/tokens/ + cat >$SOFTHSM2_CONF <&2 + P11_MODULE_CONFIGS_DIR="/usr/share/p11-kit/modules" + fi + + if ! P11_MODULE_DIR=$(pkg-config --variable=p11_module_path p11-kit-1); then + echo "WARNING! Cannot get p11_module_path from p11-kit-1.pc, assuming /usr/lib/pkcs11" >&2 + P11_MODULE_DIR="/usr/lib/pkcs11" + fi + + SOFTHSM_MODULE=$(grep -F 'module:' "$P11_MODULE_CONFIGS_DIR/softhsm2.module"| cut -d ':' -f 2| xargs) + if [[ "$SOFTHSM_MODULE" =~ ^[^/] ]]; then + SOFTHSM_MODULE="$P11_MODULE_DIR/$SOFTHSM_MODULE" + fi + + # RSA ##################################################### + pkcs11-tool --module "$SOFTHSM_MODULE" --token-label "TestToken" --pin "env:GNUTLS_PIN" --so-pin "env:GNUTLS_SO_PIN" --keypairgen --key-type "RSA:2048" --label "RSATestKey" --usage-decrypt + + certtool --generate-self-signed \ + --load-privkey="pkcs11:token=TestToken;object=RSATestKey;type=private" \ + --load-pubkey="pkcs11:token=TestToken;object=RSATestKey;type=public" \ + --template "test/TEST-24-CRYPTSETUP/template.cfg" \ + --outder --outfile "/tmp/rsa_test.crt" + + pkcs11-tool --module "$SOFTHSM_MODULE" --token-label "TestToken" --pin "env:GNUTLS_PIN" --so-pin "env:GNUTLS_SO_PIN" --write-object "/tmp/rsa_test.crt" --type cert --label "RSATestKey" + rm "/tmp/rsa_test.crt" + + # prime256v1 ############################################## + pkcs11-tool --module "$SOFTHSM_MODULE" --token-label "TestToken" --pin "env:GNUTLS_PIN" --so-pin "env:GNUTLS_SO_PIN" --keypairgen --key-type "EC:prime256v1" --label "ECTestKey" --usage-derive + + certtool --generate-self-signed \ + --load-privkey="pkcs11:token=TestToken;object=ECTestKey;type=private" \ + --load-pubkey="pkcs11:token=TestToken;object=ECTestKey;type=public" \ + --template "test/TEST-24-CRYPTSETUP/template.cfg" \ + --outder --outfile "/tmp/ec_test.crt" + + pkcs11-tool --module "$SOFTHSM_MODULE" --token-label "TestToken" --pin "env:GNUTLS_PIN" --so-pin "env:GNUTLS_SO_PIN" --write-object "/tmp/ec_test.crt" --type cert --label "ECTestKey" + rm "/tmp/ec_test.crt" + + ########################################################### + rm "$SOFTHSM2_CONF" + unset SOFTHSM2_CONF + + cat >/etc/softhsm2.conf </etc/systemd/system/systemd-cryptsetup@.service.d/PKCS11.conf </etc/systemd/system/systemd-journald.service.d/10-stdout-tty.conf < 50s when built with sanitizers so let's not run it by default. +systemctl mask systemd-hwdb-update.service + +ASAN_RT_PATH="$(grep libasan.so < <(ldd /usr/lib/systemd/systemd) | cut -d ' ' -f 3)" +if [[ -z "$ASAN_RT_PATH" ]]; then + ASAN_RT_PATH="$(grep libclang_rt.asan < <(ldd /usr/lib/systemd/systemd) | cut -d ' ' -f 3)" + + # As clang's ASan DSO is usually in a non-standard path, let's check if the RUNPATH is set accordingly. + if ldd /usr/lib/systemd/systemd | grep -q "libclang_rt.asan.*not found"; then + echo >&2 "clang's ASan DSO libclang_rt.asan is not present in the runtime library path" + exit 1 + fi +fi +if [[ -z "$ASAN_RT_PATH" ]]; then + echo >&2 "systemd is not linked against the ASan DSO" + echo >&2 "gcc does this by default, for clang compile with -shared-libasan" + exit 1 +fi + +wrap=( + /usr/lib/polkit-1/polkitd + /usr/libexec/polkit-1/polkitd + agetty + btrfs + capsh + chgrp + chown + cryptsetup + curl + dbus-broker-launch + dbus-daemon + delv + dhcpd + dig + dmsetup + dnsmasq + findmnt + getent + getfacl + id + integritysetup + iscsid + kpartx + logger + login + ls + lsblk + lvm + mdadm + mkfs.btrfs + mkfs.erofs + mkfs.ext4 + mkfs.vfat + mkfs.xfs + mksquashfs + mkswap + multipath + multipathd + nvme + p11-kit + pkill + ps + setfacl + setpriv + sshd + stat + su + tar + tgtd + useradd + userdel + veritysetup +) + +for bin in "${wrap[@]}"; do + if ! command -v "$bin" >/dev/null; then + continue + fi + + if [[ "$bin" == getent ]]; then + enable_lsan=1 + else + enable_lsan=0 + fi + + target="$(command -v "$bin")" + + mv "$target" "$target.orig" + + cat >"$target" </usr/lib/systemd/systemd-asan-env <