diff options
Diffstat (limited to '')
| -rw-r--r-- | modules/by-name/bo/boot/module.nix | 98 | ||||
| -rw-r--r-- | pkgs/by-name/ta/tails-iso/package.nix (renamed from modules/by-name/bo/boot/tails_iso.nix) | 45 |
2 files changed, 90 insertions, 53 deletions
diff --git a/modules/by-name/bo/boot/module.nix b/modules/by-name/bo/boot/module.nix index ebf58a97..2667b385 100644 --- a/modules/by-name/bo/boot/module.nix +++ b/modules/by-name/bo/boot/module.nix @@ -19,37 +19,65 @@ }: let cfg = config.soispha.boot; - tailsPrefix = "EFI/tails"; - iso = import ./tails_iso.nix {inherit pkgs;}; + tails = let + tailsPrefix = "/EFI/tails"; + in { + root = "${tailsPrefix}/tails.iso"; + initrd = "${tailsPrefix}/initrd.img"; + vmlinuz = "${tailsPrefix}/vmlinuz-linux"; + }; - iso_options = [ - "initrd=/${tailsPrefix}/initrd.img" - "boot=live" - "config" - "live-media=removable" - "nopersistence" - "noprompt" - "timezone=Etc/UTC" - "splash" - "noautologin" - "module=Tails" - "slab_nomerge" - "slub_debug=FZ" - "mce=0" - "vsyscall=none" - "init_on_free=1" - "mds=full,nosmt" - "page_alloc.shuffle=1" - "randomize_kstack_offset=on" - "efi_pstore.pstore_disable=1" - "erst_disable" - "spec_store_bypass_disable=on" - "systemd.condition_needs_update=no" - "quiet" + iso = pkgs.tails-iso; - "rootflags=loop" - "root=/${tailsPrefix}/filesystem.squashfs" - ]; + # From: + # - The extracted ISO's boot dir + # - Reverse engineered from: + # - `<tails iso squashfs>/usr/share/initramfs-tools/init` + # - `<tails iso squashfs>/usr/lib/live/boot/` + iso_options = + ## General options? + [ + "initrd=${tails.initrd}" + "noprompt" + "timezone=Etc/UTC" + "config" + "noautologin" + "slab_nomerge" + "slub_debug=FZ" + "mce=0" + "vsyscall=none" + "init_on_free=1" + "mds=full,nosmt" + "page_alloc.shuffle=1" + "randomize_kstack_offset=on" + "efi_pstore.pstore_disable=1" + "erst_disable" + "spec_store_bypass_disable=on" + "systemd.condition_needs_update=no" + ] + ## Options for the first `init` script + ++ [ + # Use the `*-live` scripts + "boot=live" + + # "splash" + "plymouth.enable=0" + + # "quiet" + "debug" + ] + ## Options for the `*-live` `init` scripts + ++ [ + "module=Tails" + + # TODO: RO-makes the fromiso not work <2026-06-08> + # "live-boot.read-only=/dev/nvme0*" + + # Don't store things persistently + "nopersistence" + + "fromiso=/dev/nvme0n1p1/${tails.root}" + ]; in { options.soispha.boot = { enable = lib.mkEnableOption "Bootloader configuration"; @@ -143,7 +171,7 @@ in { systemdCfg.extraFiles )} - ${lib.getExe pkgs.sbctl} sign "${bootMountPoint}/${tailsPrefix}/vmlinuz-linux" + ${lib.getExe pkgs.sbctl} sign "${bootMountPoint}/${tails.vmlinuz}" ${concatStrings ( mapAttrsToList (n: v: '' @@ -164,16 +192,16 @@ in { extraEntries = { "live.conf" = '' title Tails ${iso.passthru.version} Live ISO - linux /${tailsPrefix}/vmlinuz - initrd /${tailsPrefix}/initrd.img + linux ${tails.vmlinuz} + initrd ${tails.initrd} options ${builtins.concatStringsSep " " iso_options} ''; }; extraFiles = { - "/${tailsPrefix}/filesystem.squashfs" = "${iso}/live/filesystem.squashfs"; - "/${tailsPrefix}/vmlinuz" = "${iso}/live/vmlinuz"; - "/${tailsPrefix}/initrd.img" = "${iso}/live/initrd.img"; + "${tails.root}" = "${iso}/tails.iso"; + "${tails.vmlinuz}" = "${iso}/live/vmlinuz-linux"; + "${tails.initrd}" = "${iso}/live/initrd.img"; }; }; diff --git a/modules/by-name/bo/boot/tails_iso.nix b/pkgs/by-name/ta/tails-iso/package.nix index 03f97577..87bfd0b2 100644 --- a/modules/by-name/bo/boot/tails_iso.nix +++ b/pkgs/by-name/ta/tails-iso/package.nix @@ -7,22 +7,28 @@ # # You should have received a copy of the License along with this program. # If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>. -{pkgs ? (builtins.getFlake "nixpkgs").legacyPackages."x86_64-linux"}: let - version = "7.8"; - checked_iso = pkgs.stdenv.mkDerivation (finalAttrs: { - pname = "tails-iso"; - version = "amd64-${version}"; +{ + stdenv, + fetchurl, + sequoia-sq, + libarchive, # for bsdtar +}: let + files = builtins.fromJSON (builtins.readFile (./files.json)); + + checked_iso = stdenv.mkDerivation (finalAttrs: { + pname = "raw-tails-iso"; + version = "amd64-${files.version}"; srcs = [ - (pkgs.fetchurl { + (fetchurl { url = "https://tails.net/torrents/files/tails-${finalAttrs.version}.iso.sig"; - hash = "sha256-58vDQdXQYYqeVUHzupmDPtVVpSrxtT25+gwHe2OfvkA="; + hash = files.files."iso.sig"; }) - (pkgs.fetchurl { + (fetchurl { url = "https://download.tails.net/tails/stable/tails-${finalAttrs.version}/tails-${finalAttrs.version}.iso"; - hash = "sha256-ewLHQ+3iI3aHgvKdBgysQ9QAudQ7AM83WP+VdYFmxt0="; + hash = files.files."iso"; }) - (pkgs.fetchurl { + (fetchurl { url = "https://tails.net/tails-signing.key"; hash = "sha256-OwdqyM7o7K6F5Km0U1RU3hzsnaT+Yw0sjQk/thMeq1k="; }) @@ -31,7 +37,7 @@ dontUnpack = true; nativeBuildInputs = [ - pkgs.sequoia-sq + sequoia-sq ]; buildPhase = @@ -54,15 +60,16 @@ ''; }); in - pkgs.stdenv.mkDerivation { - name = "live_iso_boot_entry"; + stdenv.mkDerivation { + pname = "tails-iso-package"; + inherit (checked_iso) version; src = checked_iso; dontUnpack = true; - nativeBuildInputs = with pkgs; [ - libarchive # for bsdtar + nativeBuildInputs = [ + libarchive ]; buildPhase = '' @@ -71,12 +78,14 @@ in ''; passthru = { - inherit version; + inherit (files) version; }; installPhase = '' + install -D "$src" "$out/tails.iso" + install -D ./iso/live/vmlinuz "$out/live/vmlinuz-linux" install -D ./iso/live/initrd.img "$out/live/initrd.img" - install -D ./iso/live/vmlinuz "$out/live/vmlinuz" - install -D ./iso/live/filesystem.squashfs "$out/live/filesystem.squashfs" + + chmod --recursive -x $out/tails.iso $out/live/* ''; } |