diff options
Diffstat (limited to '')
| -rw-r--r-- | modules/by-name/bo/boot/module.nix | 27 | ||||
| -rw-r--r-- | pkgs/by-name/ta/tails-iso/files.json | 7 | ||||
| -rw-r--r-- | pkgs/by-name/ta/tails-iso/package.nix (renamed from modules/by-name/bo/boot/tails_iso.nix) | 34 | ||||
| -rwxr-xr-x | pkgs/by-name/ta/tails-iso/update.sh | 66 |
4 files changed, 110 insertions, 24 deletions
diff --git a/modules/by-name/bo/boot/module.nix b/modules/by-name/bo/boot/module.nix index ebf58a97..673faf70 100644 --- a/modules/by-name/bo/boot/module.nix +++ b/modules/by-name/bo/boot/module.nix @@ -19,11 +19,18 @@ }: let cfg = config.soispha.boot; - tailsPrefix = "EFI/tails"; - iso = import ./tails_iso.nix {inherit pkgs;}; + tails = let + tailsPrefix = "/EFI/tails"; + in { + root = "${tailsPrefix}/filesystem.squashfs"; + initrd = "${tailsPrefix}/initrd.img"; + vmlinuz = "${tailsPrefix}/vmlinuz-linux"; + }; + + iso = pkgs.tails-iso; iso_options = [ - "initrd=/${tailsPrefix}/initrd.img" + "initrd=${tails.initrd}" "boot=live" "config" "live-media=removable" @@ -48,7 +55,7 @@ "quiet" "rootflags=loop" - "root=/${tailsPrefix}/filesystem.squashfs" + "root=${tails.root}" ]; in { options.soispha.boot = { @@ -143,7 +150,7 @@ in { systemdCfg.extraFiles )} - ${lib.getExe pkgs.sbctl} sign "${bootMountPoint}/${tailsPrefix}/vmlinuz-linux" + ${lib.getExe pkgs.sbctl} sign "${bootMountPoint}/${tails.vmlinuz}" ${concatStrings ( mapAttrsToList (n: v: '' @@ -164,16 +171,16 @@ in { extraEntries = { "live.conf" = '' title Tails ${iso.passthru.version} Live ISO - linux /${tailsPrefix}/vmlinuz - initrd /${tailsPrefix}/initrd.img + linux ${tails.vmlinuz} + initrd ${tails.initrd} options ${builtins.concatStringsSep " " iso_options} ''; }; extraFiles = { - "/${tailsPrefix}/filesystem.squashfs" = "${iso}/live/filesystem.squashfs"; - "/${tailsPrefix}/vmlinuz" = "${iso}/live/vmlinuz"; - "/${tailsPrefix}/initrd.img" = "${iso}/live/initrd.img"; + "${tails.root}" = "${iso}/live/filesystem.squashfs"; + "${tails.vmlinuz}" = "${iso}/live/vmlinuz"; + "${tails.initrd}" = "${iso}/live/initrd.img"; }; }; diff --git a/pkgs/by-name/ta/tails-iso/files.json b/pkgs/by-name/ta/tails-iso/files.json new file mode 100644 index 00000000..0e42badf --- /dev/null +++ b/pkgs/by-name/ta/tails-iso/files.json @@ -0,0 +1,7 @@ +{ + "version": "7.8.1", + "files": { + "iso.sig": "sha256-DQm+EHe0KllmzLQzGU61cqaRDNjhU3KUCtDzHKDwWck=", + "iso": "sha256-Y4Sch1ZgWUODi9rxcXimVrFvicXPCN6SgLvINvJGcvw=" + } +} diff --git a/modules/by-name/bo/boot/tails_iso.nix b/pkgs/by-name/ta/tails-iso/package.nix index 03f97577..b74e4023 100644 --- a/modules/by-name/bo/boot/tails_iso.nix +++ b/pkgs/by-name/ta/tails-iso/package.nix @@ -7,22 +7,28 @@ # # You should have received a copy of the License along with this program. # If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>. -{pkgs ? (builtins.getFlake "nixpkgs").legacyPackages."x86_64-linux"}: let - version = "7.8"; - checked_iso = pkgs.stdenv.mkDerivation (finalAttrs: { +{ + stdenv, + fetchurl, + sequoia-sq, + libarchive, # for bsdtar +}: let + files = builtins.fromJSON (builtins.readFile (./files.json)); + + checked_iso = stdenv.mkDerivation (finalAttrs: { pname = "tails-iso"; - version = "amd64-${version}"; + version = "amd64-${files.version}"; srcs = [ - (pkgs.fetchurl { + (fetchurl { url = "https://tails.net/torrents/files/tails-${finalAttrs.version}.iso.sig"; - hash = "sha256-58vDQdXQYYqeVUHzupmDPtVVpSrxtT25+gwHe2OfvkA="; + hash = files.files."iso.sig"; }) - (pkgs.fetchurl { + (fetchurl { url = "https://download.tails.net/tails/stable/tails-${finalAttrs.version}/tails-${finalAttrs.version}.iso"; - hash = "sha256-ewLHQ+3iI3aHgvKdBgysQ9QAudQ7AM83WP+VdYFmxt0="; + hash = files.files."iso"; }) - (pkgs.fetchurl { + (fetchurl { url = "https://tails.net/tails-signing.key"; hash = "sha256-OwdqyM7o7K6F5Km0U1RU3hzsnaT+Yw0sjQk/thMeq1k="; }) @@ -31,7 +37,7 @@ dontUnpack = true; nativeBuildInputs = [ - pkgs.sequoia-sq + sequoia-sq ]; buildPhase = @@ -54,15 +60,15 @@ ''; }); in - pkgs.stdenv.mkDerivation { + stdenv.mkDerivation { name = "live_iso_boot_entry"; src = checked_iso; dontUnpack = true; - nativeBuildInputs = with pkgs; [ - libarchive # for bsdtar + nativeBuildInputs = [ + libarchive ]; buildPhase = '' @@ -71,7 +77,7 @@ in ''; passthru = { - inherit version; + inherit (files) version; }; installPhase = '' diff --git a/pkgs/by-name/ta/tails-iso/update.sh b/pkgs/by-name/ta/tails-iso/update.sh new file mode 100755 index 00000000..5a2a81cd --- /dev/null +++ b/pkgs/by-name/ta/tails-iso/update.sh @@ -0,0 +1,66 @@ +#! /usr/bin/env sh + +set -e + +tmpHomePath="$(mktemp -d "${TMPDIR:-/tmp}/nix-prefetch-url-XXXXXXXXXX")" +cleanup() { + chmod -R u+w "$tmpHomePath" + rm -rf "$tmpHomePath" +} +trap cleanup EXIT + +info() { + echo "$1" 1>&2 +} + +# Returns a name based on the url and reference +# +# This function needs to be in sync with nix's fetchgit implementation +# of urlToName() to re-use the same nix store paths. +url_to_name() { + url=$1 + + basename "$url" .git | cut -d: -f2 +} + +get_sha256() { + url="$1" + storePathName="$(url_to_name "$url")" + hashType="sha256" + + tmpOut="$tmpHomePath/$storePathName" + info "Prefetching '$url'..." + + curl --follow "$url" >"$tmpOut" + + # Compute the hash. + hash=$(nix-hash --flat --type "$hashType" --sri "$tmpOut") + + # Add the downloaded file to the Nix store. + finalPath=$(nix-store --add-fixed "$hashType" "$tmpOut") + + info " -> Downloaded to '$finalPath'" + echo "$hash" +} + +old_version="$(jq .version --raw-output <./files.json)" +new_version="$(curl --follow https://download.tails.net/tails/stable/ 2>/dev/null | html2text -links | grep --regexp='\s*[0-9]\. tails-amd64-' | sed 's/\s*[0-9]\. tails-amd64-\(.*\)\//\1/')" + +if [ "$old_version" = "$new_version" ]; then + # No need to update. + info exit 0 +fi + +final_version="amd64-$new_version" + +cat <<EOF | jq . | tee ./files.json +{ + "version": "$new_version", + "files": { + "iso.sig": "$(get_sha256 "https://tails.net/torrents/files/tails-$final_version.iso.sig")", + "iso": "$(get_sha256 "https://download.tails.net/tails/stable/tails-$final_version/tails-$final_version.iso")" + } +} +EOF + +# vim: ft=sh |