From 139bfb5b5e8bb345e908a00c31a6d79a73243dee Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Thu, 24 Apr 2025 17:57:05 +0200 Subject: [PATCH 1/2] nixos/system/activation/bootspec: generalize the bootspec tooling package After RFC-0125 implementation, Determinate Systems was pinged multiple times to transfer the repository ownership of the tooling to a vendor-neutral repository. Unfortunately, this never manifested. Additionally, the leadership of the NixOS project was too dysfunctional to deal with this sort of problem. It might even still be the case up to this day. Nonetheless, nixpkgs is about enabling end users to enact their own policies. It would be better to live in a world where there is one obvious choice of bootspec tooling, in the meantime, we can live in a world where people can choose their bootspec tooling. The Lix forge possess one fork of the Bootspec tooling: https://git.lix.systems/lix-community/bootspec which will live its own life from now on. Change-Id: I00c4dd64e00b4c24f6641472902e7df60ed13b55 Signed-off-by: Raito Bezarius --- nixos/modules/system/activation/bootspec.nix | 2 + .../boot/loader/systemd-boot/systemd-boot.nix | 2 +- nixos/tests/installer.nix | 164 +++++++++--------- 3 files changed, 86 insertions(+), 82 deletions(-) diff --git a/nixos/modules/system/activation/bootspec.nix b/nixos/modules/system/activation/bootspec.nix index 4f534b240e67..99a859f91829 100644 --- a/nixos/modules/system/activation/bootspec.nix +++ b/nixos/modules/system/activation/bootspec.nix @@ -111,6 +111,8 @@ in Enable this option if you want to ascertain that your documents are correct ''; + package = lib.mkPackageOption pkgs "bootspec" { }; + extensions = lib.mkOption { # NOTE(RaitoBezarius): this is not enough to validate: extensions."osRelease" = drv; those are picked up by cue validation. type = lib.types.attrsOf lib.types.anything; # : { ...namespace-specific fields } diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix index e5080bd8d191..f0afb3b8f575 100644 --- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix +++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix @@ -47,7 +47,7 @@ let systemd = config.systemd.package; - bootspecTools = pkgs.bootspec; + bootspecTools = config.boot.bootspec.package; nix = config.nix.package.out; diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix index db9fccaa2bb4..3a7fe2d16d61 100644 --- a/nixos/tests/installer.nix +++ b/nixos/tests/installer.nix @@ -680,95 +680,97 @@ let in { # The configuration of the system used to run "nixos-install". - installer = { - imports = [ - commonConfig - ../modules/profiles/installation-device.nix - ../modules/profiles/base.nix - extraInstallerConfig - ./common/auto-format-root-device.nix - ]; + installer = + { config, ... }: + { + imports = [ + commonConfig + ../modules/profiles/installation-device.nix + ../modules/profiles/base.nix + extraInstallerConfig + ./common/auto-format-root-device.nix + ]; - # In systemdStage1, also automatically format the device backing the - # root filesystem. - virtualisation.fileSystems."/".autoFormat = systemdStage1; + # In systemdStage1, also automatically format the device backing the + # root filesystem. + virtualisation.fileSystems."/".autoFormat = systemdStage1; - boot.initrd.systemd.enable = systemdStage1; + boot.initrd.systemd.enable = systemdStage1; - # Use a small /dev/vdb as the root disk for the - # installer. This ensures the target disk (/dev/vda) is - # the same during and after installation. - virtualisation.emptyDiskImages = [ 512 ]; - virtualisation.rootDevice = "/dev/vdb"; + # Use a small /dev/vdb as the root disk for the + # installer. This ensures the target disk (/dev/vda) is + # the same during and after installation. + virtualisation.emptyDiskImages = [ 512 ]; + virtualisation.rootDevice = "/dev/vdb"; - hardware.enableAllFirmware = mkForce false; - nix.package = selectNixPackage pkgs; + nix.package = selectNixPackage pkgs; + hardware.enableAllFirmware = mkForce false; - # The test cannot access the network, so any packages we - # need must be included in the VM. - system.extraDependencies = - with pkgs; - [ - bintools - brotli - brotli.dev - brotli.lib - desktop-file-utils - docbook5 - docbook_xsl_ns - kbd.dev - kmod.dev - libarchive.dev - libxml2.bin - libxslt.bin - nixos-artwork.wallpapers.simple-dark-gray-bottom - ntp - perlPackages.ConfigIniFiles - perlPackages.FileSlurp - perlPackages.JSON - perlPackages.ListCompare - perlPackages.XMLLibXML - # make-options-doc/default.nix - (python3.withPackages (p: [ p.mistune ])) - shared-mime-info - sudo - switch-to-configuration-ng - texinfo - unionfs-fuse - xorg.lndir - shellcheck-minimal - - # add curl so that rather than seeing the test attempt to download - # curl's tarball, we see what it's trying to download - curl - ] - ++ optionals (bootLoader == "grub") ( - let - zfsSupport = extraInstallerConfig.boot.supportedFilesystems.zfs or false; - in + # The test cannot access the network, so any packages we + # need must be included in the VM. + system.extraDependencies = + with pkgs; [ - (pkgs.grub2.override { inherit zfsSupport; }) - (pkgs.grub2_efi.override { inherit zfsSupport; }) - pkgs.nixos-artwork.wallpapers.simple-dark-gray-bootloader - pkgs.perlPackages.FileCopyRecursive - pkgs.perlPackages.XMLSAX - pkgs.perlPackages.XMLSAXBase - ] - ) - ++ optionals (bootLoader == "systemd-boot") [ - pkgs.zstd.bin - pkgs.mypy - pkgs.bootspec - ] - ++ optionals clevisTest [ pkgs.klibc ] - ++ optional systemdStage1 pkgs.chroot-realpath; + bintools + brotli + brotli.dev + brotli.lib + desktop-file-utils + docbook5 + docbook_xsl_ns + kbd.dev + kmod.dev + libarchive.dev + libxml2.bin + libxslt.bin + nixos-artwork.wallpapers.simple-dark-gray-bottom + ntp + perlPackages.ConfigIniFiles + perlPackages.FileSlurp + perlPackages.JSON + perlPackages.ListCompare + perlPackages.XMLLibXML + # make-options-doc/default.nix + (python3.withPackages (p: [ p.mistune ])) + shared-mime-info + sudo + switch-to-configuration-ng + texinfo + unionfs-fuse + xorg.lndir + shellcheck-minimal - nix.settings = { - substituters = mkForce [ ]; - hashed-mirrors = null; - connect-timeout = 1; + # add curl so that rather than seeing the test attempt to download + # curl's tarball, we see what it's trying to download + curl + ] + ++ optionals (bootLoader == "grub") ( + let + zfsSupport = extraInstallerConfig.boot.supportedFilesystems.zfs or false; + in + [ + (pkgs.grub2.override { inherit zfsSupport; }) + (pkgs.grub2_efi.override { inherit zfsSupport; }) + pkgs.nixos-artwork.wallpapers.simple-dark-gray-bootloader + pkgs.perlPackages.FileCopyRecursive + pkgs.perlPackages.XMLSAX + pkgs.perlPackages.XMLSAXBase + ] + ) + ++ optionals (bootLoader == "systemd-boot") [ + pkgs.zstd.bin + pkgs.mypy + config.boot.bootspec.package + ] + ++ optionals clevisTest [ pkgs.klibc ] + ++ optional systemdStage1 pkgs.chroot-realpath; + + nix.settings = { + substituters = mkForce [ ]; + hashed-mirrors = null; + connect-timeout = 1; + }; }; - }; target = { imports = [ commonConfig ]; From e9c6d76072075f0df17800a9160e8d448c856404 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Thu, 24 Apr 2025 17:57:51 +0200 Subject: [PATCH 2/2] bootspec-lix: init at 1.0.0 A fork of DeterminateSystems/bootspec moved in a vendor-neutral location. Multiple attempts were done to move into NixOS/bootspec to no avail. I am not interested into working towards that goal under the current leadership structures. Change-Id: I06cbc2272003a1b813ab3a50ebeb9acf90e72f10 Signed-off-by: Raito Bezarius --- pkgs/by-name/bo/bootspec-lix/package.nix | 39 ++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 pkgs/by-name/bo/bootspec-lix/package.nix diff --git a/pkgs/by-name/bo/bootspec-lix/package.nix b/pkgs/by-name/bo/bootspec-lix/package.nix new file mode 100644 index 000000000000..411c3e0f1e85 --- /dev/null +++ b/pkgs/by-name/bo/bootspec-lix/package.nix @@ -0,0 +1,39 @@ +{ + lib, + rustPlatform, + fetchFromGitea, + fetchpatch, +}: +rustPlatform.buildRustPackage rec { + pname = "bootspec-lix"; + version = "1.0.0"; + + src = fetchFromGitea { + domain = "git.lix.systems"; + owner = "lix-community"; + repo = "bootspec"; + rev = "v${version}"; + hash = "sha256-5IGSMHeL0eKfl7teDejAckYQjc8aeLwfwIQSzQ8YaAg="; + }; + + patches = [ + # https://github.com/DeterminateSystems/bootspec/pull/127 + # Fixes the synthesize tool for aarch64-linux + (fetchpatch { + name = "aarch64-support.patch"; + url = "https://github.com/DeterminateSystems/bootspec/commit/1d0e925f360f0199f13422fb7541225fd162fd4f.patch"; + sha256 = "sha256-wU/jWnOqVBrU2swANdXbQfzRpNd/JIS4cxSyCvixZM0="; + }) + ]; + + useFetchCargoVendor = true; + cargoHash = "sha256-65jk8UlXZgQoxuwRcGlMnI4e+LpCJuP2TaqK+Kn4GnQ="; + + meta = with lib; { + description = "Vendor-neutral implementation of RFC-0125's datatype and synthesis tooling"; + homepage = "https://git.lix.systems/lix-community/bootspec"; + license = licenses.mit; + maintainers = [ lib.maintainers.raitobezarius ]; + platforms = platforms.unix; + }; +}