Changed files
| File | Changes | |
|---|---|---|
| modules/ryan-bootloader/uki.scm | +115 −0 | raw |
| modules/ryan-packages/bootloaders.scm | +110 −0 | raw |
added uki bootloader maybe
ce1c24e3100d…
· Ryan Schanzenbacher ·
@@ -0,0 +1,115 @@
+(define-module (ryan-bootloader uki)
+ #:use-module (gnu bootloader)
+ #:use-module (ryan-packages bootloaders)
+ #:use-module (gnu packages bootloaders)
+ #:use-module (gnu packages efi)
+ #:use-module (gnu packages linux)
+ #:use-module (guix gexp)
+ #:use-module (guix modules)
+ #:use-module (srfi srfi-1)
+ #:export (uefi-uki-bootloader uefi-uki-signed-bootloader))
+
+;; config generator makes script creating uki images
+;; install runs script
+;; install device is path to uefi dir
+(define vendor "Guix")
+(define script-loc "/boot/install-uki.scm")
+
+(define* (uefi-uki-configuration-file #:optional cert privkey)
+ (lambda* (config entries #:key (old-entries '()) #:allow-other-keys)
+
+ (define (menu-entry->args e)
+ (let* ((boot (bootloader-configuration-bootloader config))
+ (stub (bootloader-package boot)))
+ #~(list "--os-release" #$(menu-entry-label e)
+ "--linux" #$(menu-entry-linux e) "--initrd" #$(menu-entry-initrd e)
+ "--cmdline" (string-join (list #$@(menu-entry-linux-arguments e)))
+ "--stub" #$(file-append stub "/libexec/" (systemd-stub-name))
+ #$@(if cert #~("--secureboot-certificate" #$cert) #~())
+ #$@(if privkey #~("--secureboot-private-key" #$privkey) #~()))))
+
+ (define (enum-filenames . args) ; same args as iota
+ (map (lambda (n) (string-append (number->string n) ".efi"))
+ (apply iota (map length args))))
+
+ (program-file "install-uki"
+ (with-imported-modules (source-module-closure '((guix build syscalls)
+ (guix build utils)))
+ #~(let* ((target (cadr (command-line)))
+ (vendir (string-append target "/EFI/" #$vendor))
+ (schema (string-append vendir "/boot.mgr"))
+ (findmnt #$(file-append util-linux "/bin/findmnt"))
+ (efibootmgr #$(file-append efibootmgr "/sbin/efibootmgr")))
+ (use-modules (guix build syscalls) (guix build utils)
+ (ice-9 popen) (ice-9 textual-ports))
+
+ (define (out name) (string-append vendir "/" name))
+ (define disk
+ (call-with-port
+ (open-pipe* OPEN_READ findmnt "-fnro" "SOURCE" "-T" target)
+ (lambda (port) (get-line port)))) ; only 1 line: the device
+ (define part
+ (substring disk (- (string-length disk) 1)))
+
+ ;; delete all boot entries and files we control
+ (when (file-exists? schema)
+ (call-with-input-file schema
+ (lambda (port)
+ (for-each (lambda (l)
+ (unless (string-null? l)
+ (system* efibootmgr "-B" "-L" l "-q")))
+ (string-split (get-string-all port) #\lf)))))
+ (when (directory-exists? vendir) (delete-file-recursively vendir))
+ (mkdir-p vendir)
+
+ (define (install port boot? oos)
+ (lambda (args label name)
+ (let ((minbytes (* 2 (stat:size (stat #$script-loc)))))
+ (put-string port label)
+ (put-char port #\lf)
+ (force-output port) ; make sure space is alloc'd
+ (apply invoke #$(file-append ukify "/bin/ukify")
+ "build" "-o" (out name) args)
+ ;; make sure we have enough space for next install-uki.scm
+ (when (and oos (< (free-disk-space vendir) minbytes)) (oos))
+ (invoke efibootmgr (if boot? "-c" "-C") "-L" label "--disk" disk "--part" part
+ "--loader" (string-append "\\EFI\\" #$vendor "\\" name) "-q"))))
+
+ (call-with-output-file schema
+ (lambda (port) ; prioritize latest UKIs in limited ESP space
+ (for-each (install port #t #f)
+ (list #$@(map-in-order menu-entry->args entries))
+ (list #$@(map-in-order menu-entry-label entries))
+ (list #$@(enum-filenames entries)))
+ (for-each ; old-entries can fail (out of space) we don't care
+ (lambda (args label name)
+ (define (cleanup . _) ; do exit early if out of space tho
+ (when (file-exists? (out name)) (delete-file (out name)))
+ (exit))
+ (with-exception-handler cleanup
+ (lambda _ ((install port #f cleanup) args label name))))
+ (list #$@(map-in-order menu-entry->args old-entries))
+ (list #$@(map-in-order menu-entry-label old-entries))
+ (list #$@(enum-filenames old-entries entries))))))))))
+
+(define install-uefi-uki
+ #~(lambda (bootloader target mount-point)
+ (invoke (string-append mount-point #$script-loc)
+ (string-append mount-point target))))
+
+(define* (make-uefi-uki-bootloader #:optional cert privkey)
+ (bootloader
+ (name 'uefi-uki)
+ (package systemd-stub)
+ (installer install-uefi-uki)
+ (disk-image-installer #f)
+ (configuration-file script-loc)
+ (configuration-file-generator (uefi-uki-configuration-file cert privkey))))
+
+;; IMPORTANT NOTE: if bootloader install fails, do not turn off your computer! until
+;; install succeeds, your system is unbootable.
+(define uefi-uki-bootloader (make-uefi-uki-bootloader))
+;; use ukify genkey to generate cert and privkey. DO NOT include in store.
+(define (uefi-uki-signed-bootloader cert privkey)
+ (make-uefi-uki-bootloader cert privkey))
+
@@ -0,0 +1,110 @@
+(define-module (ryan-packages bootloaders)
+ #:use-module ((guix licenses) #:prefix license:)
+ #:use-module (gnu packages efi)
+ #:use-module (gnu packages base)
+ #:use-module (gnu packages linux)
+ #:use-module (gnu packages gperf)
+ #:use-module (gnu packages crypto)
+ #:use-module (gnu packages python)
+ #:use-module (gnu packages python-xyz)
+ #:use-module (gnu packages python-crypto)
+ #:use-module (gnu packages pkg-config)
+ #:use-module (guix gexp)
+ #:use-module (guix utils)
+ #:use-module (guix modules)
+ #:use-module (guix packages)
+ #:use-module (guix git-download)
+ #:use-module (guix build-system gnu)
+ #:use-module (guix build-system meson)
+ #:use-module (guix build-system python))
+
+(define systemd-version "255")
+(define systemd-source
+ (origin
+ (method git-fetch)
+ (uri (git-reference
+ (url "https://github.com/systemd/systemd")
+ (commit (string-append "v" systemd-version))))
+ (file-name (git-file-name "systemd" systemd-version))
+ (sha256
+ (base32
+ "1qdyw9g3jgvsbc1aryr11gpc3075w5pg00mqv4pyf3hwixxkwaq6"))))
+
+(define-public (systemd-stub-name)
+ (let ((arch (cond ((target-x86-32?) "ia32")
+ ((target-x86-64?) "x64")
+ ((target-arm32?) "arm")
+ ((target-aarch64?) "aa64")
+ ((target-riscv64?) "riscv64"))))
+ (string-append "linux" arch ".efi.stub")))
+
+(define-public systemd-stub
+ (package
+ (name "systemd-stub")
+ (version systemd-version)
+ (source systemd-source)
+ (build-system meson-build-system)
+ (arguments
+ (list
+ #:configure-flags
+ `(list "-Defi=true" "-Dsbat-distro=guix"
+ "-Dsbat-distro-generation=1" ; package revision!
+ "-Dsbat-distro-summary=Guix System"
+ "-Dsbat-distro-url=https://guix.gnu.org"
+ ,(string-append "-Dsbat-distro-pkgname=" name)
+ ,(string-append "-Dsbat-distro-version=" version))
+ #:phases
+ #~(let ((stub #$(string-append "src/boot/efi/" (systemd-stub-name))))
+ (modify-phases %standard-phases
+ (replace 'build
+ (lambda* (#:key parallel-build? #:allow-other-keys)
+ (invoke "ninja" stub
+ "-j" (if parallel-build?
+ (number->string (parallel-job-count)) "1"))))
+ (replace 'install
+ (lambda _
+ (install-file stub (string-append #$output "/libexec"))))
+ (delete 'check)))))
+ (inputs (list libcap python-pyelftools `(,util-linux "lib")))
+ (native-inputs (list libxcrypt gperf pkg-config python-3 python-jinja2))
+ (home-page "https://systemd.io")
+ (synopsis "Unified kernel image UEFI stub")
+ (description "Simple UEFi boot stub that loads a conjoined kernel image and
+supporting data to their proper locations, before chainloading to the kernel.
+Supports measured and/or verified boot environments.")
+ (license license:lgpl2.1+)))
+
+(define-public ukify
+ (package
+ (name "ukify")
+ (version systemd-version)
+ (source systemd-source)
+ (build-system python-build-system)
+ (arguments
+ (list #:phases
+ #~(modify-phases %standard-phases
+ (replace 'build
+ (lambda _
+ (substitute* "src/ukify/ukify.py" ; added in python 3.11
+ (("datetime\\.UTC") "datetime.timezone.utc"))))
+ (delete 'check)
+ (replace 'install
+ (lambda* (#:key inputs #:allow-other-keys)
+ (let* ((bin (string-append #$output "/bin"))
+ (file (string-append bin "/ukify"))
+ (binutils (assoc-ref inputs "binutils"))
+ (sbsign (assoc-ref inputs "sbsigntools")))
+ (mkdir-p bin)
+ (copy-file "src/ukify/ukify.py" file)
+ (wrap-program file
+ `("PATH" ":" prefix
+ (,(string-append binutils "/bin")
+ ,(string-append sbsign "/bin"))))))))))
+ (inputs (list binutils python-cryptography python-pefile sbsigntools))
+ (home-page "https://systemd.io")
+ (synopsis "Unified kernel image UEFI tool")
+ (description "@command{ukify} joins together a UKI stub, linux kernel, initrd,
+kernel arguments, and optional secure boot signatures into a single, UEFI-bootable
+image.")
+ (license license:lgpl2.1+)))
+