From 8446dfc3c92c82dbd13f39e3ede2b9be8b4890fb Mon Sep 17 00:00:00 2001 From: mlyxshi Date: Wed, 11 Feb 2026 09:12:25 +0800 Subject: [PATCH 1/2] pkgs/build-support/kernel/make-initrd-ng.nix: unsafeDiscardReferences.out = true --- pkgs/build-support/kernel/make-initrd-ng.nix | 67 +++++++++++--------- 1 file changed, 36 insertions(+), 31 deletions(-) diff --git a/pkgs/build-support/kernel/make-initrd-ng.nix b/pkgs/build-support/kernel/make-initrd-ng.nix index 0b1db74f0449..768af8f5c48d 100644 --- a/pkgs/build-support/kernel/make-initrd-ng.nix +++ b/pkgs/build-support/kernel/make-initrd-ng.nix @@ -16,7 +16,6 @@ in pkgsBuildHost, makeInitrdNGTool, binutils, - runCommand, # Name of the derivation (not of the resulting file!) name ? "initrd", @@ -74,47 +73,53 @@ in _compressorMeta.ubootName or (throw "Unrecognised compressor ${_compressorName}, please specify uInitrdCompression"), }: -runCommand name - { - compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}"; - passthru = { - compressorExecutableFunction = _compressorFunction; - compressorArgs = _compressorArgsReal; - }; +stdenvNoCC.mkDerivation (finalAttrs: { + __structuredAttrs = true; - inherit - extension - makeUInitrd - uInitrdArch - prepend - ; - ${if makeUInitrd then "uInitrdCompression" else null} = uInitrdCompression; + # the initrd will be self-contained so we can drop references + # to the closure that was used to build it + unsafeDiscardReferences.out = true; - passAsFile = [ "contents" ]; - contents = builtins.toJSON contents; + inherit + name + extension + makeUInitrd + uInitrdArch + prepend + ; + ${if makeUInitrd then "uInitrdCompression" else null} = uInitrdCompression; - nativeBuildInputs = [ - makeInitrdNGTool - cpio - ] - ++ lib.optional makeUInitrd ubootTools; - } - '' + compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}"; + contentsJSON = builtins.toJSON contents; + + nativeBuildInputs = [ + makeInitrdNGTool + cpio + ] + ++ lib.optional makeUInitrd ubootTools; + + buildCommand = '' mkdir -p ./root/{run,tmp,var/empty} ln -s ../run ./root/var/run - make-initrd-ng "$contentsPath" ./root + make-initrd-ng <(echo "$contentsJSON") ./root mkdir "$out" (cd root && find . -exec touch -h -d '@1' '{}' +) - for PREP in $prepend; do + for PREP in ''${prepend[@]}; do cat $PREP >> $out/initrd done (cd root && find . -print0 | sort -z | cpio --quiet -o -H newc -R +0:+0 --reproducible --null | eval -- $compress >> "$out/initrd") if [ -n "$makeUInitrd" ]; then - mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img - # Compatibility symlink - ln -sf "initrd.img" "$out/initrd" + mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img + # Compatibility symlink + ln -sf "initrd.img" "$out/initrd" else - ln -s "initrd" "$out/initrd$extension" + ln -s "initrd" "$out/initrd$extension" fi - '' + ''; + + passthru = { + compressorExecutableFunction = _compressorFunction; + compressorArgs = _compressorArgsReal; + }; +}) From de5cb839e4774dace86c102860cdd1d8bdf2300d Mon Sep 17 00:00:00 2001 From: mlyxshi Date: Thu, 12 Feb 2026 15:24:53 +0800 Subject: [PATCH 2/2] pkgs/build-support/kernel/make-initrd.nix: unsafeDiscardReferences.out = true --- pkgs/build-support/kernel/make-initrd.nix | 68 ++++++++++++----------- pkgs/build-support/kernel/make-initrd.sh | 28 ++++------ 2 files changed, 47 insertions(+), 49 deletions(-) diff --git a/pkgs/build-support/kernel/make-initrd.nix b/pkgs/build-support/kernel/make-initrd.nix index 6f300369aa50..364507ba8e7e 100644 --- a/pkgs/build-support/kernel/make-initrd.nix +++ b/pkgs/build-support/kernel/make-initrd.nix @@ -81,42 +81,44 @@ in _compressorMeta.ubootName or (throw "Unrecognised compressor ${_compressorName}, please specify uInitrdCompression"), }: -stdenvNoCC.mkDerivation ( - rec { - inherit - name - makeUInitrd - extension - uInitrdArch - prepend - ; +stdenvNoCC.mkDerivation (finalAttrs: { + __structuredAttrs = true; - builder = ./make-initrd.sh; + # the initrd will be self-contained so we can drop references + # to the closure that was used to build it + unsafeDiscardReferences.out = true; - nativeBuildInputs = [ - cpio - ] - ++ lib.optional makeUInitrd ubootTools; + inherit + name + extension + makeUInitrd + uInitrdArch + prepend + ; + ${if makeUInitrd then "uInitrdCompression" else null} = uInitrdCompression; - compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}"; + builder = ./make-initrd.sh; - # Pass the function through, for reuse in append-initrd-secrets. The - # function is used instead of the string, in order to support - # cross-compilation (append-initrd-secrets running on a different - # architecture than what the main initramfs is built on). - passthru = { - compressorExecutableFunction = _compressorFunction; - compressorArgs = _compressorArgsReal; - }; + nativeBuildInputs = [ + cpio + ] + ++ lib.optional makeUInitrd ubootTools; - # !!! should use XML. - objects = map (x: x.object) contents; - symlinks = map (x: x.symlink) contents; - suffices = map (x: if x ? suffix then x.suffix else "none") contents; + compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}"; - closureInfo = "${pkgsBuildHost.closureInfo { rootPaths = objects; }}"; - } - // lib.optionalAttrs makeUInitrd { - uInitrdCompression = uInitrdCompression; - } -) + # !!! should use XML. + objects = map (x: x.object) contents; + symlinks = map (x: x.symlink) contents; + suffices = map (x: if x ? suffix then x.suffix else "none") contents; + + closureInfo = "${pkgsBuildHost.closureInfo { rootPaths = finalAttrs.objects; }}"; + + # Pass the function through, for reuse in append-initrd-secrets. The + # function is used instead of the string, in order to support + # cross-compilation (append-initrd-secrets running on a different + # architecture than what the main initramfs is built on). + passthru = { + compressorExecutableFunction = _compressorFunction; + compressorArgs = _compressorArgsReal; + }; +}) diff --git a/pkgs/build-support/kernel/make-initrd.sh b/pkgs/build-support/kernel/make-initrd.sh index cc67c14a6a50..f3bc977279b5 100644 --- a/pkgs/build-support/kernel/make-initrd.sh +++ b/pkgs/build-support/kernel/make-initrd.sh @@ -1,9 +1,5 @@ set -o pipefail -objects=($objects) -symlinks=($symlinks) -suffices=($suffices) - mkdir root # Needed for splash_helper, which gets run before init. @@ -12,14 +8,14 @@ mkdir root/sys mkdir root/proc -for ((n = 0; n < ${#objects[*]}; n++)); do - object=${objects[$n]} - symlink=${symlinks[$n]} - suffix=${suffices[$n]} - if test "$suffix" = none; then suffix=; fi +for ((n = 0; n < ${#objects[@]}; n++)); do + object=${objects[n]} + symlink=${symlinks[n]} + suffix=${suffices[n]} + if test "$suffix" = none; then suffix=; fi - mkdir -p $(dirname root/$symlink) - ln -s $object$suffix root/$symlink + mkdir -p $(dirname root/$symlink) + ln -s $object$suffix root/$symlink done @@ -34,16 +30,16 @@ storePaths="$(cat $closureInfo/store-paths)" # Put the closure in a gzipped cpio archive. mkdir -p $out -for PREP in $prepend; do +for PREP in ${prepend[@]}; do cat $PREP >> $out/initrd done (cd root && find * .[^.*] -exec touch -h -d '@1' '{}' +) (cd root && find * .[^.*] -print0 | sort -z | cpio --quiet -o -H newc -R +0:+0 --reproducible --null | eval -- $compress >> "$out/initrd") if [ -n "$makeUInitrd" ]; then - mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img - # Compatibility symlink - ln -sf "initrd.img" "$out/initrd" + mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img + # Compatibility symlink + ln -sf "initrd.img" "$out/initrd" else - ln -s "initrd" "$out/initrd$extension" + ln -s "initrd" "$out/initrd$extension" fi