ryan77627/guix-dotfiles
1
0
Fork 0
mirror of https://git.in.rschanz.org/ryan77627/guix-config.git synced 2025-02-11 12:11:17 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

added uki bootloader maybe

Browse source
This commit is contained in:
Ryan 2025-01-12 21:19:05 -05:00
parent 67da316096
commit ce1c24e310
Signed by: ryan77627
GPG key ID: 81B0E222A3E2308E
2 changed files with 225 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

115
modules/ryan-bootloader/uki.scm Normal file
View file

@ -0,0 +1,115 @@
(define-module (ryan-bootloader uki)
#:use-module (gnu bootloader)
#:use-module (ryan-packages bootloaders)
#:use-module (gnu packages bootloaders)
#:use-module (gnu packages efi)
#:use-module (gnu packages linux)
#:use-module (guix gexp)
#:use-module (guix modules)
#:use-module (srfi srfi-1)
#:export (uefi-uki-bootloader uefi-uki-signed-bootloader))
;; config generator makes script creating uki images
;; install runs script
;; install device is path to uefi dir
(define vendor "Guix")
(define script-loc "/boot/install-uki.scm")
(define* (uefi-uki-configuration-file #:optional cert privkey)
(lambda* (config entries #:key (old-entries '()) #:allow-other-keys)
(define (menu-entry->args e)
(let* ((boot (bootloader-configuration-bootloader config))
(stub (bootloader-package boot)))
#~(list "--os-release" #$(menu-entry-label e)
"--linux" #$(menu-entry-linux e) "--initrd" #$(menu-entry-initrd e)
"--cmdline" (string-join (list #$@(menu-entry-linux-arguments e)))
"--stub" #$(file-append stub "/libexec/" (systemd-stub-name))
#$@(if cert #~("--secureboot-certificate" #$cert) #~())
#$@(if privkey #~("--secureboot-private-key" #$privkey) #~()))))
(define (enum-filenames . args) ; same args as iota
(map (lambda (n) (string-append (number->string n) ".efi"))
(apply iota (map length args))))
(program-file "install-uki"
(with-imported-modules (source-module-closure '((guix build syscalls)
(guix build utils)))
#~(let* ((target (cadr (command-line)))
(vendir (string-append target "/EFI/" #$vendor))
(schema (string-append vendir "/boot.mgr"))
(findmnt #$(file-append util-linux "/bin/findmnt"))
(efibootmgr #$(file-append efibootmgr "/sbin/efibootmgr")))
(use-modules (guix build syscalls) (guix build utils)
(ice-9 popen) (ice-9 textual-ports))
(define (out name) (string-append vendir "/" name))
(define disk
(call-with-port
(open-pipe* OPEN_READ findmnt "-fnro" "SOURCE" "-T" target)
(lambda (port) (get-line port)))) ; only 1 line: the device
(define part
(substring disk (- (string-length disk) 1)))
;; delete all boot entries and files we control
(when (file-exists? schema)
(call-with-input-file schema
(lambda (port)
(for-each (lambda (l)
(unless (string-null? l)
(system* efibootmgr "-B" "-L" l "-q")))
(string-split (get-string-all port) #\lf)))))
(when (directory-exists? vendir) (delete-file-recursively vendir))
(mkdir-p vendir)
(define (install port boot? oos)
(lambda (args label name)
(let ((minbytes (* 2 (stat:size (stat #$script-loc)))))
(put-string port label)
(put-char port #\lf)
(force-output port) ; make sure space is alloc'd
(apply invoke #$(file-append ukify "/bin/ukify")
"build" "-o" (out name) args)
;; make sure we have enough space for next install-uki.scm
(when (and oos (< (free-disk-space vendir) minbytes)) (oos))
(invoke efibootmgr (if boot? "-c" "-C") "-L" label "--disk" disk "--part" part
"--loader" (string-append "\\EFI\\" #$vendor "\\" name) "-q"))))
(call-with-output-file schema
(lambda (port) ; prioritize latest UKIs in limited ESP space
(for-each (install port #t #f)
(list #$@(map-in-order menu-entry->args entries))
(list #$@(map-in-order menu-entry-label entries))
(list #$@(enum-filenames entries)))
(for-each ; old-entries can fail (out of space) we don't care
(lambda (args label name)
(define (cleanup . _) ; do exit early if out of space tho
(when (file-exists? (out name)) (delete-file (out name)))
(exit))
(with-exception-handler cleanup
(lambda _ ((install port #f cleanup) args label name))))
(list #$@(map-in-order menu-entry->args old-entries))
(list #$@(map-in-order menu-entry-label old-entries))
(list #$@(enum-filenames old-entries entries))))))))))
(define install-uefi-uki
#~(lambda (bootloader target mount-point)
(invoke (string-append mount-point #$script-loc)
(string-append mount-point target))))
(define* (make-uefi-uki-bootloader #:optional cert privkey)
(bootloader
(name 'uefi-uki)
(package systemd-stub)
(installer install-uefi-uki)
(disk-image-installer #f)
(configuration-file script-loc)
(configuration-file-generator (uefi-uki-configuration-file cert privkey))))
;; IMPORTANT NOTE: if bootloader install fails, do not turn off your computer! until
;; install succeeds, your system is unbootable.
(define uefi-uki-bootloader (make-uefi-uki-bootloader))
;; use ukify genkey to generate cert and privkey. DO NOT include in store.
(define (uefi-uki-signed-bootloader cert privkey)
(make-uefi-uki-bootloader cert privkey))

110
modules/ryan-packages/bootloaders.scm Normal file
View file

@ -0,0 +1,110 @@
(define-module (ryan-packages bootloaders)
#:use-module ((guix licenses) #:prefix license:)
#:use-module (gnu packages efi)
#:use-module (gnu packages base)
#:use-module (gnu packages linux)
#:use-module (gnu packages gperf)
#:use-module (gnu packages crypto)
#:use-module (gnu packages python)
#:use-module (gnu packages python-xyz)
#:use-module (gnu packages python-crypto)
#:use-module (gnu packages pkg-config)
#:use-module (guix gexp)
#:use-module (guix utils)
#:use-module (guix modules)
#:use-module (guix packages)
#:use-module (guix git-download)
#:use-module (guix build-system gnu)
#:use-module (guix build-system meson)
#:use-module (guix build-system python))
(define systemd-version "255")
(define systemd-source
(origin
(method git-fetch)
(uri (git-reference
(url "https://github.com/systemd/systemd")
(commit (string-append "v" systemd-version))))
(file-name (git-file-name "systemd" systemd-version))
(sha256
(base32
"1qdyw9g3jgvsbc1aryr11gpc3075w5pg00mqv4pyf3hwixxkwaq6"))))
(define-public (systemd-stub-name)
(let ((arch (cond ((target-x86-32?) "ia32")
((target-x86-64?) "x64")
((target-arm32?) "arm")
((target-aarch64?) "aa64")
((target-riscv64?) "riscv64"))))
(string-append "linux" arch ".efi.stub")))
(define-public systemd-stub
(package
(name "systemd-stub")
(version systemd-version)
(source systemd-source)
(build-system meson-build-system)
(arguments
(list
#:configure-flags
`(list "-Defi=true" "-Dsbat-distro=guix"
"-Dsbat-distro-generation=1" ; package revision!
"-Dsbat-distro-summary=Guix System"
"-Dsbat-distro-url=https://guix.gnu.org"
,(string-append "-Dsbat-distro-pkgname=" name)
,(string-append "-Dsbat-distro-version=" version))
#:phases
#~(let ((stub #$(string-append "src/boot/efi/" (systemd-stub-name))))
(modify-phases %standard-phases
(replace 'build
(lambda* (#:key parallel-build? #:allow-other-keys)
(invoke "ninja" stub
"-j" (if parallel-build?
(number->string (parallel-job-count)) "1"))))
(replace 'install
(lambda _
(install-file stub (string-append #$output "/libexec"))))
(delete 'check)))))
(inputs (list libcap python-pyelftools `(,util-linux "lib")))
(native-inputs (list libxcrypt gperf pkg-config python-3 python-jinja2))
(home-page "https://systemd.io")
(synopsis "Unified kernel image UEFI stub")
(description "Simple UEFi boot stub that loads a conjoined kernel image and
supporting data to their proper locations, before chainloading to the kernel.
Supports measured and/or verified boot environments.")
(license license:lgpl2.1+)))
(define-public ukify
(package
(name "ukify")
(version systemd-version)
(source systemd-source)
(build-system python-build-system)
(arguments
(list #:phases
#~(modify-phases %standard-phases
(replace 'build
(lambda _
(substitute* "src/ukify/ukify.py" ; added in python 3.11
(("datetime\\.UTC") "datetime.timezone.utc"))))
(delete 'check)
(replace 'install
(lambda* (#:key inputs #:allow-other-keys)
(let* ((bin (string-append #$output "/bin"))
(file (string-append bin "/ukify"))
(binutils (assoc-ref inputs "binutils"))
(sbsign (assoc-ref inputs "sbsigntools")))
(mkdir-p bin)
(copy-file "src/ukify/ukify.py" file)
(wrap-program file
`("PATH" ":" prefix
(,(string-append binutils "/bin")
,(string-append sbsign "/bin"))))))))))
(inputs (list binutils python-cryptography python-pefile sbsigntools))
(home-page "https://systemd.io")
(synopsis "Unified kernel image UEFI tool")
(description "@command{ukify} joins together a UKI stub, linux kernel, initrd,
kernel arguments, and optional secure boot signatures into a single, UEFI-bootable
image.")
(license license:lgpl2.1+)))