| Age | Commit message (Collapse) | Author |
|---|
|
Even if GRUB is not used as a boot loader for the ISO, create a
`/boot/grub/grubenv` file in the ISO 9660 file system. If a
`loopback.cfg` file exists in the profile's `grub` directory, copy it
to `/boot/grub/loopback.cfg` on the ISO.
This ensures the funtionality will not be lost if the used boot loaders
are changed.
|
|
uefi-ia32.systemd-boot.eltorito boot modes
The systemd 254.2-1 package ships with IA32 systemd-boot, so it is
possible to use for booting on IA32 UEFI.
Perhaps they will be useful in the future.
At least for now, the baseline and releng profiles are not changed to
use them. When the issues and headaches caused with GRUB reach a
critical point, then we will switch.
|
|
Additionally fix a few code style issues found with shfmt.
|
|
Options set in xorriso startup files (~/.xorrisorc) could interfere with the xorriso command run by mkarchiso.
For example, if ~root/.xorrisorc contains -dummy on, then the ISO file will be empty.
Pass -no_rc as the first option to xorriso to prevent interference and unintended behavior.
Fixes #153.
|
|
Since `_build_buildmode_netboot` runs `_build_iso_base` which runs
`_prepare_airootfs_image`, the call to `_cms_sign_artifact` in
`_build_buildmode_netboot` can be removed.
Fixes #197
|
|
`-r` will instruct to delete the working directory at the end of a
`mkarchiso` run.
If the specified directory already exists, then it will not be deleted
and instead produce a warning.
Implements #211
|
|
|
|
When restarting an interrupted build, SOURCE_DATE_EPOCH needs to be
available before `profiledef.sh` is read, since it may reference it.
Fixes 7c6f266ec94e3eff23466ed8d0c45e4bee0ddae4
|
|
It will be replaced with the ISO's modification date in UTC, i.e.
its "UUID".
This allows to replace `archisolabel=%ARCHISO_LABEL%` with
`archisodevice=UUID=%ARCHISO_UUID%` in boot loader configurations.
Related to #202
|
|
to the GNU Coreutils update. Fixes Issue #214
|
|
|
|
This allows to reduce the number of top-level directories by one and
matches with the GRUB directory move.
Most boot loader related things will now be in the /boot/ directory.
Fixes #207
|
|
To prevent the file from being accidentally missed when someone copies
the ISO's contents, let's not place it in a directory that starts with a
dot. Since all GRUB related files are in /boot/grub/, put it there too.
Instead of using a more unique UUID for the file name, use
`YYYY-mm-dd-HH-MM-SS-00.uuid` which matches the ISO's modification date
in UTC,i.e. its "UUID". If multiple ISOs would be generated in the exact
same second, the ISO 9660 modification date (i.e. its "UUID") would be
the same, so there would be not way to distinguish between the volumes
anyway. This also makes the file look less suspicious to the casual
glance.
|
|
Add all variables that we replace with values in configuration files.
Keep `${isofs_dir}/${install_dir}/grubenv` with fewer variables for
backwards compatibility. It will be removed in the future.
|
|
Move the location of GRUB files so that there is boot-platform
(BIOS vs EFI) neutral place for GRUB-specific files (e.g. configuration
files, background images, etc.).
The EFI binaries are obviosly staying in the default/fallback boot path
`/EFI/BOOT/BOOT*.EFI`, otherwise there will be no UEFI booting.
The /boot/grub/ directory will be used to store BIOS (i386-pc) GRUB
bootsector images, if we get to that.
It is also a requirement for implementing `loopback.cfg` support, since
the file's path must be `/boot/grub/loopback.cfg`.
Implements #206
|
|
Instruct the embeded grub.cfg to search for a volume with a
`/.disk/%UUID_SEARCH_FILENAME%.uuid` file and load `/EFI/BOOT/grub.cfg`
from it.
This avoid duplicating GRUB configuration files in two places (ISO 9660
and FAT) and ensures there is no confusion about which is the _correct_
configuration file.
Since nothing besides EFI binaries is copied to `efibootimg`, the
`_make_common_bootmode_grub_copy_to_efibootimg` function is removed.
Fixes #208
|
|
Link to the upstream issue report.
|
|
Move memtest86+ to `/boot/memtest86+/` on ISO 9660. That directory is
not copied to netboot artifact output.
Netboot boot menu https://ipxe.archlinux.org/releng/netboot/archlinux.ipxe
does not have entries for memtest and archiso-manager removes these files
(not the EFI one, though) before uploading the release files anyway.
|
|
There are claims that some UEFI allegedly natively support NTFS.
Preload the required GRUB modules to support booting from NTFS on such
systems.
Additionally preload the exFAT and UEF modules, because, why not?
|
|
for it
Create a `/.disk/INSERT_UUID_HERE.uuid` file to implement something
called "file system transposition".
See https://www.mail-archive.com/grub-devel@gnu.org/msg34346.html for
the proposal of it for grub-mkrescue.
This will allow GRUB to search for the volume containing the file instead
of hardcoding the ISO volume label or another file system or
partition attribute in GRUB configuration.
By only relying on the directory structure simplifies supporting medium
preparation methods with manual partitioning such as
https://wiki.archlinux.org/title/USB_flash_installation_medium#In_GNU/Linux_4
|
|
This is a new value introduced in systemd v247. It makes sure a new
machine-id is generated, but is handled as first boot as well.
See "First Boot Semantics" in machine-id(5) for details.
|
|
Look for the files in `*_validate_options` and error out early if they do
not exist.
|
|
file descriptors only for reading
Nothing should ever be written to these files, so let's make sure it cannot happen.
|
|
The `bootstrap` build mode never calls `_export_gpg_publickey`, so even if
the GPG key is passed with the `-g` option and thus the `gpg_key` variable
is set, the `${work_dir}/pubkey.gpg` file will not exist.
This has not caused any issue so far because the `ARCHISO_GNUPG_FD` file
descriptor opens the file for both reading and writing, which means the
file gets created if it does not exist.
Assign the exported public key file name to a `gpg_publickey` variable in
`_export_gpg_publickey` and check for it when the file is used.
Since the exist status of the gpg command cannot be checked, look for the
exported public key file instead.
|
|
The warning about SC2076 does not apply here.
|
|
Implements #203.
|
|
Make sure existing sig files are deleted before creating new ones and make sure to not sign any sig files.
This allows retrying failed mkarchiso runs without ending up with files such as vmlinuz.ipxe.sig.ipxe.sig.
Fixes #198
|
|
``-c`` is given.
(gitlab ci)
Added a CA structure to the codesigning certificates.
This to test the functionality of optional CA being in the signing message.
(mkarchiso)
Removed the ``sign_netboot_artifacts`` variable and instead
we'll now rely on ``if [[ -v cert_list ]]; then``.
Added ``ARCHISO_TLS_FD`` and ``ARCHISO_TLSCA_FD`` environment variables
to override the certificates used. This is so that third party CA's can
be used during building in a meaningful way without distrupting the
CA trust that is shipped by default.
_cms_sign_artifact() was added which signs the rootfs using OpenSSL CMS.
The files will be saved as "${artifact}.cms.sig". That would be for instance
"${isofs_dir}/${install_dir}/${arch}/airootfs.sfs.cms.sig".
|
|
This helps on systems with screwed or broken RTC.
|
|
--disable-shim-lock is required to support Secure Boot with custom signatures without using shim.
Otherwise GRUB will trow an error when trying to boot a kernel:
error: shim_lock protocol not found.
error: you need to load the kernel first.
The modules GRUB will use need to be preloaded otherwise the EFI binaries cannot be signed and used for Secure Boot.
See https://bugs.archlinux.org/task/71382.
GRUB will trow en error:
error: verification requested but nobody cares
These changes are done to support Secure Boot using custom keys (not shim) by simply extracting the boot loader
(BOOTx64.EFI and BOOTIA32.EFI), kernel, UEFI shell, signing them and then repacking the ISO.
For example.
Extract the files:
$ osirrox -indev archlinux-YYYY.MM.DD-x86_64.iso \
-extract_boot_images ./ \
-extract /EFI/BOOT/BOOTx64.EFI BOOTx64.EFI \
-extract /EFI/BOOT/BOOTIA32.EFI BOOTIA32.EFI \
-extract /shellx64.efi shellx64.efi \
-extract /shellia32.efi shellia32.efi \
-extract /arch/boot/x86_64/vmlinuz-linux vmlinuz-linux
Make the files writable:
$ chmod +w BOOTx64.EFI BOOTIA32.EFI shellx64.efi shellia32.efi vmlinuz-linux
Sign the files:
$ sbsign --key db.key --cert db.crt --output BOOTx64.EFI BOOTx64.EFI
$ sbsign --key db.key --cert db.crt --output BOOTIA32.EFI BOOTIA32.EFI
$ sbsign --key db.key --cert db.crt --output shellx64.efi shellx64.efi
$ sbsign --key db.key --cert db.crt --output shellia32.efi shellia32.efi
$ sbsign --key db.key --cert db.crt --output vmlinuz-linux vmlinuz-linux
Copy the boot loader and UEFI shell to the EFI system partition image:
$ mcopy -D oO -i eltorito_img2_uefi.img BOOTx64.EFI BOOTIA32.EFI ::/EFI/BOOT/
$ mcopy -D oO -i eltorito_img2_uefi.img shellx64.efi shellia32.efi ::/
Repack the ISO using the modified El Torito UEFI boot image and add the signed boot loader files, UEFI shell and
kernel to ISO9660:
$ xorriso -indev archlinux-YYYY.MM.DD-x86_64.iso \
-outdev archlinux-YYYY.MM.DD-x86_64-Secure_Boot.iso \
-boot_image any replay \
-append_partition 2 0xef eltorito_img2_uefi.img \
-map BOOTx64.EFI /EFI/BOOT/BOOTx64.EFI \
-map BOOTIA32.EFI /EFI/BOOT/BOOTIA32.EFI \
-map shellx64.efi /shellx64.efi \
-map shellia32.efi /shellia32.efi \
-map vmlinuz-linux /arch/boot/x86_64/vmlinuz-linux
Boot the resulting archlinux-YYYY.MM.DD-x86_64-Secure_Boot.iso.
|
|
Do not limit file copying to only grub.cfg and instead copy all GRUB configuration files and assets to both the ISO9660 and FAT image.
This will allow for including custom images, fonts, etc.
To easily match all non-configuration files (i.e. files without the .cfg extension), bash's extended glob feature will be enabled.
Actions common to multiple _make_bootmode_uefi-*.grub are split off into dedicated functions:
* _make_common_bootmode_grub_copy_to_efibootimg,
* _make_common_bootmode_grub_copy_to_isofs,
* _make_common_bootmode_grub_cfg.
Use the same du command in all efiboot_imgsize variable assignments.
Fixes #185.
|
|
LC_ALL=C.UTF-8, unlike LC_ALL=C, does not override LANGUAGE.
See https://sourceware.org/bugzilla/show_bug.cgi?id=16621 and https://savannah.gnu.org/bugs/?62815
|
|
Update authors
Update CHANGELOG
|
|
Fixes #183
|
|
Even though archiso created ISOs do not support Secure Boot, having SBAT would allow users to more easily repack the files in the ISO to add a signed shim.
Fixes #174
|
|
* Fix typos and wording,
* Remove impossible TODO.
|
|
|
|
The glibc 2.35-6 package ships with the C.UTF-8 locale included, so mkarchiso does not need to use a non-UTF-8 locale anymore.
Implements #175.
|
|
|
|
|
|
valication_error variable is not changed when mmd and/or mcopy are missing.
|
|
are specified
Fixes #151.
|
|
erofs-utils 1.4 introduced a --quiet option.
Related to #148.
|
|
mksquashfs supports a -quiet option since squashfs-tools 4.4.
Use this option in non-verbose mode instead of redirecting stdout of the whole command to /dev/null.
This allows to have only one instance of mksquashfs in _run_mksquashfs instead of multiple ones in if-then-else.
Related to #148.
|
|
Only the total size is relevant.
Related to #148.
|
|
The output is irrelevant, we only need the return code.
Related to #148.
|
|
The `xorriso -as mkisofs` option `-quiet` is interpreted too late. Use native xorriso option `-report_about SORRY` instead and ensure it is the first option.
Related to #148.
|
|
mkfs.fat does not have a -q/--quiet option, so redirect its stdout to /dev/null instead.
See https://github.com/dosfstools/dosfstools/issues/103 .
Related to #148.
|
|
artifacts
netboot does not need any of the boot loaders or their files.
Fixes #150.
|
|
printf is a bash builtin, so by using it an external command can be avoided.
Due to the differences between date(1) and strftime(3), the time zone output will not contain a colon anymore. Fortunately, that is still a supported format according to https://en.wikipedia.org/wiki/ISO_8601#Time_offsets_from_UTC .
|