Send patches - preferably formatted by git format-patch - to patches at archlinux32 dot org.
summaryrefslogtreecommitdiff
path: root/archiso
AgeCommit message (Collapse)Author
2022-08-26mkarchiso: touch clock-epoch for extra hint on date and timeChristian Hesse
This helps on systems with screwed or broken RTC.
2022-08-19mkarchiso: preload more GRUB modules and disable shim_lock verifiernl6720
--disable-shim-lock is required to support Secure Boot with custom signatures without using shim. Otherwise GRUB will trow an error when trying to boot a kernel: error: shim_lock protocol not found. error: you need to load the kernel first. The modules GRUB will use need to be preloaded otherwise the EFI binaries cannot be signed and used for Secure Boot. See https://bugs.archlinux.org/task/71382. GRUB will trow en error: error: verification requested but nobody cares These changes are done to support Secure Boot using custom keys (not shim) by simply extracting the boot loader (BOOTx64.EFI and BOOTIA32.EFI), kernel, UEFI shell, signing them and then repacking the ISO. For example. Extract the files: $ osirrox -indev archlinux-YYYY.MM.DD-x86_64.iso \ -extract_boot_images ./ \ -extract /EFI/BOOT/BOOTx64.EFI BOOTx64.EFI \ -extract /EFI/BOOT/BOOTIA32.EFI BOOTIA32.EFI \ -extract /shellx64.efi shellx64.efi \ -extract /shellia32.efi shellia32.efi \ -extract /arch/boot/x86_64/vmlinuz-linux vmlinuz-linux Make the files writable: $ chmod +w BOOTx64.EFI BOOTIA32.EFI shellx64.efi shellia32.efi vmlinuz-linux Sign the files: $ sbsign --key db.key --cert db.crt --output BOOTx64.EFI BOOTx64.EFI $ sbsign --key db.key --cert db.crt --output BOOTIA32.EFI BOOTIA32.EFI $ sbsign --key db.key --cert db.crt --output shellx64.efi shellx64.efi $ sbsign --key db.key --cert db.crt --output shellia32.efi shellia32.efi $ sbsign --key db.key --cert db.crt --output vmlinuz-linux vmlinuz-linux Copy the boot loader and UEFI shell to the EFI system partition image: $ mcopy -D oO -i eltorito_img2_uefi.img BOOTx64.EFI BOOTIA32.EFI ::/EFI/BOOT/ $ mcopy -D oO -i eltorito_img2_uefi.img shellx64.efi shellia32.efi ::/ Repack the ISO using the modified El Torito UEFI boot image and add the signed boot loader files, UEFI shell and kernel to ISO9660: $ xorriso -indev archlinux-YYYY.MM.DD-x86_64.iso \ -outdev archlinux-YYYY.MM.DD-x86_64-Secure_Boot.iso \ -boot_image any replay \ -append_partition 2 0xef eltorito_img2_uefi.img \ -map BOOTx64.EFI /EFI/BOOT/BOOTx64.EFI \ -map BOOTIA32.EFI /EFI/BOOT/BOOTIA32.EFI \ -map shellx64.efi /shellx64.efi \ -map shellia32.efi /shellia32.efi \ -map vmlinuz-linux /arch/boot/x86_64/vmlinuz-linux Boot the resulting archlinux-YYYY.MM.DD-x86_64-Secure_Boot.iso.
2022-08-17mkarchiso: copy all GRUB files to the ISOnl6720
Do not limit file copying to only grub.cfg and instead copy all GRUB configuration files and assets to both the ISO9660 and FAT image. This will allow for including custom images, fonts, etc. To easily match all non-configuration files (i.e. files without the .cfg extension), bash's extended glob feature will be enabled. Actions common to multiple _make_bootmode_uefi-*.grub are split off into dedicated functions: * _make_common_bootmode_grub_copy_to_efibootimg, * _make_common_bootmode_grub_copy_to_isofs, * _make_common_bootmode_grub_cfg. Use the same du command in all efiboot_imgsize variable assignments. Fixes #185.
2022-08-07mkarchiso: unset LANGUAGEnl6720
LC_ALL=C.UTF-8, unlike LC_ALL=C, does not override LANGUAGE. See https://sourceware.org/bugzilla/show_bug.cgi?id=16621 and https://savannah.gnu.org/bugs/?62815
2022-07-16Add efibootimg variable in place of full pathPellegrino Prevete
Update authors Update CHANGELOG
2022-06-24mkarchiso: work arround GRUB's cmdpath having incorect case on some firmwarenl6720
Fixes #183
2022-06-18mkarchiso: add SBAT metadata to grub-mkstandalone created EFI binariesnl6720
Even though archiso created ISOs do not support Secure Boot, having SBAT would allow users to more easily repack the files in the ISO to add a signed shim. Fixes #174
2022-06-18mkarchiso: improve commentsnl6720
* Fix typos and wording, * Remove impossible TODO.
2022-06-09Add *_uefi-x64.grub.* functions to mkarchisoplainlinen
2022-06-09mkarchiso: use C.UTF-8nl6720
The glibc 2.35-6 package ships with the C.UTF-8 locale included, so mkarchiso does not need to use a non-UTF-8 locale anymore. Implements #175.
2022-05-25Add support for GRUB ia32 UEFI in mkarchiso, update READMEs.Pellegrino Prevete
2022-01-21https://gitlab.archlinux.org/archlinux/archiso/-/issues/163weltio weltio
2022-01-08mkarchiso: Fix mmd-command checkhayao
valication_error variable is not changed when mmd and/or mcopy are missing.
2021-12-10mkarchiso: show "Code signing certificates: None" if no keys/certificates ↵nl6720
are specified Fixes #151.
2021-11-22mkarchiso: use mkfs.erofs --quiet in quiet modenl6720
erofs-utils 1.4 introduced a --quiet option. Related to #148.
2021-11-05mkarchiso: use mksquashfs -quiet instead of redirecting its stdout to /dev/nullnl6720
mksquashfs supports a -quiet option since squashfs-tools 4.4. Use this option in non-verbose mode instead of redirecting stdout of the whole command to /dev/null. This allows to have only one instance of mksquashfs in _run_mksquashfs instead of multiple ones in if-then-else. Related to #148.
2021-11-05mkarchiso: do not show subdirectory sizes in netboot modenl6720
Only the total size is relevant. Related to #148.
2021-11-05mkarchiso: redirect command -v output to /dev/nullnl6720
The output is irrelevant, we only need the return code. Related to #148.
2021-11-05mkarchiso: silence xorriso's note about SOURCE_DATE_EPOCHnl6720
The `xorriso -as mkisofs` option `-quiet` is interpreted too late. Use native xorriso option `-report_about SORRY` instead and ensure it is the first option. Related to #148.
2021-11-04mkarchiso: silence mkfs.fat in quiet modenl6720
mkfs.fat does not have a -q/--quiet option, so redirect its stdout to /dev/null instead. See https://github.com/dosfstools/dosfstools/issues/103 . Related to #148.
2021-11-02mkarchiso: do not require setting boot modes when building only netboot ↵nl6720
artifacts netboot does not need any of the boot loaders or their files. Fixes #150.
2021-11-02mkarchiso: replace external date command with printfnl6720
printf is a bash builtin, so by using it an external command can be avoided. Due to the differences between date(1) and strftime(3), the time zone output will not contain a colon anymore. Fortunately, that is still a supported format according to https://en.wikipedia.org/wiki/ISO_8601#Time_offsets_from_UTC .
2021-08-25mkarchiso: error out of iso and netboot build modes if no boot modes are ↵nl6720
specified
2021-08-25mkarchiso: split out build mode specific checks from _validate_options to ↵nl6720
_validate_requirements_buildmode_* The bootstrap build mode does not use packages.${arch}, ${bootmodes[@]} or $airootfs_image_type so there's no need to validate them. Requirements common to iso and netboot are checked with the _validate_common_requirements_buildmode_iso_netboot function. Fixes #149. * Rename _validate_requirements_buildmode_all to _validate_common_requirements_buildmode_all to prevent potential conflicts since we are using _validate_requirements_buildmode_${_buildmode} to run the functions. * Improve searching in an array. See https://stackoverflow.com/a/15394738.
2021-08-25mkarchiso: fix unbound variable errors in _validate_optionsnl6720
$pkg_list_from_file and $bootstrap_pkg_list_from_file are arrays, they must be referenced as such. Fixes https://bugs.archlinux.org/task/71852. Remove quotes from arithmetic expressions.
2021-08-25mkarchiso: support setting gpg sendernl6720
Add new -G option to set gpg's --sender. This allows to see who signed the rootfs image without needing to import the gpg key from the keyring in initramfs.
2021-08-25mkarchiso: add some sane gpg options to override those set in user's gpg.confnl6720
* Add --batch, since gpg is run in a script. * Add --no-armor (this is the default). Armored output provides no benifit here. * Add --no-include-key-block (this is the default). There is no need to have the gpg key in the signature. The mkinitcpio hook will verify the signature against the included keyring. Remove the output files before running gpg. Otherwise gpg --batch will fail if they exist.
2021-08-24mkarchiso: put version files in netboot artifactsnl6720
Fixes #147.
2021-08-15mkarchiso: ensure there are no existing image files before trying to create themnl6720
This could prevent a few issues when creating an image file when re-running mkarchiso after a failure. Remove useless test before running rm -f. The command will always succeed.
2021-08-15mkarchiso: copy files to ext4 image using mkfs.ext4's -d option instead of ↵nl6720
mounting the file system mkfs.ext4 with its -d option can "copy the contents of the given directory into the root directory of the filesystem". This allows to get rid of the last directly used mount and umount commands in mkarchiso. Additionally try to make the ext4 image somewhat reproducible by setting E2FSPROGS_FAKE_TIME to SOURCE_DATE_EPOCH, clearing the UUID and using a reproducible hash seed. See https://git.kernel.org/pub/scm/fs/ext2/e2fsprogs.git/commit/?id=e1f7100643a46456be107b33098f6034b0835e6d . Place mkfs.ext4 options in an array to avoid duplicating the command. Related to #40.
2021-07-31Remove mkinitcpio-archiso filesDavid Runge
archiso/initcpio/*: Remove mkinitcpio-archiso scripts as they have been split out into a separate project. docs/README.{altbootmethods,bootparams}: Remove mkinitcpio-archiso specific documentation.
2021-07-30mkarchiso: Do not run _build_iso_base onceDavid Runge
archiso/mkarchiso: Do not run `_build_iso_base` with `_run_once`, as it sets variables which are important to functions that are called after it.
2021-07-29mkarchiso: improve functions and commentsnl6720
* Merge _make_efi_dir_on_iso9660 into _make_bootmode_uefi-x64.systemd-boot.eltorito since it's specific to that boot mode. * Split off FAT image creation into _make_efibootimg, so it can be reused by other functions. * Add/improve comments to better document what the script does.
2021-07-11mkarchiso: set LC_ALL instead of LANGnl6720
LC_ALL overrides LANG and all LC_* variables, so use it instead. See https://www.gnu.org/software/gettext/manual/html_node/Locale-Environment-Variables.html#Locale-Environment-Variables .
2021-07-02mkarchiso: unset TMPDIR to work around FS#70580nl6720
Alternative to 3d6651abf74ee4eb91212bd9a7d3478c95126cfb which caused issues. Fixes https://bugs.archlinux.org/task/70580 .
2021-07-02Revert "archiso/mkarchiso: clear environment variables when chrooting"nl6720
This reverts commit 3d6651abf74ee4eb91212bd9a7d3478c95126cfb. A missing $PATH breaks scripts that do not hardcode binary paths. Fixes https://bugs.archlinux.org/task/71416 .
2021-06-30archiso/mkarchiso: Generalize handling of ucodesDavid Runge
archiso/mkarchiso: Generalize the handling of ucode files (e.g. copying, signing, size calculation) by introducing the global readonly array of expected ucode names instead of hardcoding them in various functions. When making use of ucode files in `_make_boot_on_iso9660()`, `_make_bootmode_uef-x86.systemd-boot.esp()` and `_sign_netboot_artifacts()` create a list of files that is guaranteed to contain existing files. Fixes #132
2021-06-22mkarchiso: pass SOURCE_DATE_EPOCH to chrootnl6720
2021-06-18Update ArchWiki article URLsnl6720
Use the new, prettier short URLs.
2021-06-05mkarchiso: fix unbound variable when not using GPG signingnl6720
Fixes #138
2021-06-01archiso/mkarchiso: clear environment variables when chrootingnl6720
Environment variables can interfere with the commands in chroot. This causes issues when the environment variables specify a path that does not exist inside the chroot, e.g. if TMPDIR is set to a custom value. Fixes https://bugs.archlinux.org/task/70580 .
2021-05-14Fence add_binary for pvSimon Wilper
2021-05-14Apply 1 suggestion(s) to 1 file(s)Simon Wilper
2021-05-14add optional pv toolSimon Wilper
use pv to give feedback on copying the airootfs to RAM when copytoram kernel parameter is given
2021-05-10mkarchiso: Also create package list for netbootDavid Runge
archiso/mkarchiso: Change `_make_pkglist()` to also generate the package list when using the netboot build mode.
2021-05-10mkarchiso: Add buildmode to export netboot artifactsDavid Runge
archiso/mkarchiso: Implement a buildmode to export artifacts required for netboot with IPXE. When providing the buildmode 'netboot' via profiledef.sh or the `-m` option, all targets necessary to create an ISO medium are built, but the components required for netboot are exported to the output dir. Optionally, it is possible to provide a set of certificates for codsigning using the `-c` option, where the first file is considered as the signer certificate and the second as the key. Add `_export_netboot_artifacts()` to copy build artifacts to the output directory. Add `_sign_netboot_artifacts()` to codesign the netboot artifacts in the work directory. Add `_validate_requirements_buildmode_netboot()` to check for openssl. Add `_build_iso_base()` to implement common function calls between the 'iso' and the 'netboot' buildmodes. Add `_build_buildmode_netboot()` to make use of `_build_iso_base()`, (optionally) `_sign_netboot_artifacts()` and `_export_netboot_artifacts()`. Change `_build_buildmode_iso()` to make use of `_build_iso_base()`. Add `-c` as an option to mkarchiso to read in a list of file names. Unify the output of `_usage()` by using the same definition style for lists of strings provided to options that accept them (e.g. `-c`, `-m`, `-p`). Closes #128
2021-05-09mkarchiso: Implement buildmodes that allow building bootstrap imagesDavid Runge
archiso/mkarchiso: Introduce a buildmodes array, that can be used to build towards more than one output artifact type. Add a buildmode for building a bootstrap image (a compressed file containing a very minimal Arch installation). The buildmodes can be set either using a `buildmodes` array in a `profiledef.sh` or by using the `-m` option flag to mkarchiso and providing a space delimited, quoted list. The 'iso' buildmode is always the default if no buildmodes are setup. Implement building a bootstrap image, when using the 'bootstrap' `buildmode`, which uses a profile's 'bootstrap_packages.$arch' file to install packages using pacstrap and compressing it to a bootstrap image. The name of the output file is currently constructed from the `iso_name` value by appending `-bootstrap`. Replace the uses of `airootfs_dir` with the more generic `pacstrap_dir`, as the location denotes where pacstrap is being used. Replace uses of `img_name` with `image_name` and removing it from the global scope, so that it can be overridden per each buildmode. Rename `_cleanup_airootfs_dir()` to `_cleanup_pacstrap_dir()`. Make `_run_once()` more generic by prepending the state files with a string defined by `run_once_mode`. Add `_validate_requirements_buildmode_all()`, `_validate_requirements_buildmode_bootstrap()` and `_validate_requirements_buildmode_iso()` to validate the general requirements of the different buildmodes. Add `_build_bootstrap_image()` to generate the bootstrap image using bsdtar. Rename `_build_iso()` to `_build_iso_image()` to fit the naming of the respective bootstrap function. Extend `_read_profile()` to include the reading of bootstrap image specific packages from a file. Extend `_validate_options()` to include testing of the bootstrap packages and running of validation functions for all buildmodes. Change `_set_overrides()` to override the buildmodes if they are specified via the `-m` option flag. Change `_make_version()` to be used generically in all buildmodes. Change `_make_pkglist()` to be used generically in all buildmodes. Rename `_build_profile()` to `_build_buildmode_iso()` and set local variables that are specific to the buildmode, such as `image_name`, `pacstrap_dir`, `run_once_mode` , `buildmode_packages` and `buildmode_pkg_list`. Add `_build_buildmode_bootstrap()` and set local variables that are specific to the buildmode, such as `image_name`, `pacstrap_dir`, `run_once_mode` , `buildmode_packages` and `buildmode_pkg_list`. Add the `-m` option flag to the list of flags. Closes #127
2021-05-01Set more generic output for signaturesDavid Runge
archiso/mkarchiso: Change the help output to reflect that the `-g` option is generically signing a rootfs (which may be e.g. squashfs or erofs). Change the output of `_mksignature()` to be more generic, as it signs any type of understood rootfs image (which may be e.g. squashfs or erofs).
2021-05-01Force PGP signature file extensionDavid Runge
archiso/mkarchiso: Force the file extension in use for the PGP signatures of the rootfs to always be .sig. When gnupg's 'armor' configuration option is used, the output otherwise defaults to using .asc. As the verification hook in mkinitcpio-archiso expects the .sig file extension, verifying the rootfs will fail in that scenario.
2021-04-30mkarchiso: create reproducible gzip archivesnl6720
Use the gzip option -n/--no-name to prevent saving the original file name and timestamp. Fixes #104.