diff --git a/nixos/lib/make-disk-image.nix b/nixos/lib/make-disk-image.nix index 1a33abd01ea1..047e72e2ac0d 100644 --- a/nixos/lib/make-disk-image.nix +++ b/nixos/lib/make-disk-image.nix @@ -536,6 +536,9 @@ let format' = format; in let concatStringsSep " " (lib.optional useEFIBoot "-drive if=pflash,format=raw,unit=0,readonly=on,file=${efiFirmware}" ++ lib.optionals touchEFIVars [ "-drive if=pflash,format=raw,unit=1,file=$efiVars" + ] ++ lib.optionals (OVMF.systemManagementModeRequired or false) [ + "-machine" "q35,smm=on" + "-global" "driver=cfi.pflash01,property=secure,value=on" ] ); inherit memSize; diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix index 55a214325118..75ba6dacc122 100644 --- a/nixos/modules/virtualisation/qemu-vm.nix +++ b/nixos/modules/virtualisation/qemu-vm.nix @@ -877,9 +877,11 @@ in type = types.package; default = (pkgs.OVMF.override { secureBoot = cfg.useSecureBoot; + systemManagementModeRequired = cfg.useSecureBoot; }).fd; defaultText = ''(pkgs.OVMF.override { secureBoot = cfg.useSecureBoot; + systemManagementModeRequired = cfg.useSecureBoot; }).fd''; description = lib.mdDoc "OVMF firmware package, defaults to OVMF configured with secure boot if needed."; @@ -1183,6 +1185,10 @@ in "-tpmdev emulator,id=tpm_dev_0,chardev=chrtpm" "-device ${cfg.tpm.deviceModel},tpmdev=tpm_dev_0" ]) + (mkIf (cfg.efi.OVMF.systemManagementModeRequired or false) [ + "-machine" "q35,smm=on" + "-global" "driver=cfi.pflash01,property=secure,value=on" + ]) ]; virtualisation.qemu.drives = mkMerge [ diff --git a/nixos/tests/systemd-boot.nix b/nixos/tests/systemd-boot.nix index c0b37a230df0..ce3245f3d862 100644 --- a/nixos/tests/systemd-boot.nix +++ b/nixos/tests/systemd-boot.nix @@ -39,6 +39,32 @@ in ''; }; + # Test that systemd-boot works with secure boot + secureBoot = makeTest { + name = "systemd-boot-secure-boot"; + + nodes.machine = { + imports = [ common ]; + environment.systemPackages = [ pkgs.sbctl ]; + virtualisation.useSecureBoot = true; + }; + + testScript = '' + machine.start(allow_reboot=True) + machine.wait_for_unit("multi-user.target") + + machine.succeed("sbctl create-keys") + machine.succeed("sbctl enroll-keys --yes-this-might-brick-my-machine") + machine.succeed('sbctl sign /boot/EFI/systemd/systemd-bootx64.efi') + machine.succeed('sbctl sign /boot/EFI/BOOT/BOOTX64.EFI') + machine.succeed('sbctl sign /boot/EFI/nixos/*bzImage.efi') + + machine.reboot() + + assert "Secure Boot: enabled (user)" in machine.succeed("bootctl status") + ''; + }; + # Check that specialisations create corresponding boot entries. specialisation = makeTest { name = "systemd-boot-specialisation"; diff --git a/pkgs/applications/emulators/ripes/default.nix b/pkgs/applications/emulators/ripes/default.nix index b3e58658b44f..e1438b1d0a80 100644 --- a/pkgs/applications/emulators/ripes/default.nix +++ b/pkgs/applications/emulators/ripes/default.nix @@ -1,5 +1,5 @@ { lib -, mkDerivation +, stdenv , fetchFromGitHub , pkg-config , qtbase @@ -8,19 +8,20 @@ , wrapQtAppsHook , cmake , python3 -, stdenv +, unstableGitUpdater }: -mkDerivation rec { +stdenv.mkDerivation rec { pname = "ripes"; - version = "2.2.6"; + # Pulling unstable version as latest stable does not build against gcc-13. + version = "2.2.6-unstable-2024-01-02"; src = fetchFromGitHub { owner = "mortbopet"; repo = "Ripes"; - rev = "v${version}"; + rev = "0faf41b669a93a1944707cd7d111a5e9241425fe"; fetchSubmodules = true; - sha256 = "sha256-fRkab0G2zjK1VYzH21yhL7Cr0rS4I8ir8gwH9ALy60A="; + hash = "sha256-3+jibS1mGYBy9jmucytc7GvB1ZKRfh7aXtDty77hA3k="; }; nativeBuildInputs = [ @@ -49,11 +50,14 @@ mkDerivation rec { runHook postInstall ''; + passthru.updateScript = unstableGitUpdater { }; + meta = with lib; { description = "A graphical processor simulator and assembly editor for the RISC-V ISA"; homepage = "https://github.com/mortbopet/Ripes"; license = licenses.mit; platforms = platforms.unix; + mainProgram = "Ripes"; maintainers = with maintainers; [ rewine ]; }; } diff --git a/pkgs/applications/search/re-isearch/default.nix b/pkgs/applications/search/re-isearch/default.nix index 85f2186efade..45dbedcd466d 100644 --- a/pkgs/applications/search/re-isearch/default.nix +++ b/pkgs/applications/search/re-isearch/default.nix @@ -11,6 +11,11 @@ stdenv.mkDerivation rec { sha256 = "sha256-D0PDqlWzIOHqdS2MlNzR2T5cyhiLcFlf30v6eFokoRQ="; }; + postPatch = '' + # Fix gcc-13 build due to missing include. + sed -e '1i #include ' -i src/mmap.cxx + ''; + buildinputs = [ db file # libmagic @@ -25,7 +30,7 @@ stdenv.mkDerivation rec { preBuild = '' cd build makeFlagsArray+=( - EXTRA_INC="-I${db.dev}/include -I${file}/include" + EXTRA_INC="-I${db.dev}/include -I${lib.getDev file}/include" LD_PATH="-L../lib -L${db.out}/lib -L${file}/lib -L${libnsl}/lib" ) ''; diff --git a/pkgs/applications/virtualization/OVMF/default.nix b/pkgs/applications/virtualization/OVMF/default.nix index 63c137c220c2..cff31a759a2b 100644 --- a/pkgs/applications/virtualization/OVMF/default.nix +++ b/pkgs/applications/virtualization/OVMF/default.nix @@ -1,8 +1,23 @@ { stdenv, nixosTests, lib, edk2, util-linux, nasm, acpica-tools, llvmPackages +, fetchurl, python3, pexpect, xorriso, qemu, dosfstools, mtools , csmSupport ? false, seabios , fdSize2MB ? csmSupport -, fdSize4MB ? false +, fdSize4MB ? secureBoot , secureBoot ? false +, systemManagementModeRequired ? secureBoot && stdenv.hostPlatform.isx86 +# Whether to create an nvram variables template +# which includes the MSFT secure boot keys +, msVarsTemplate ? false +# When creating the nvram variables template with +# the MSFT keys, we also must provide a certificate +# to use as the PK and first KEK for the keystore. +# +# By default, we use Debian's cert. This default +# should chnage to a NixOS cert once we have our +# own secure boot signing infrastructure. +# +# Ignored if msVarsTemplate is false. +, vendorPkKek ? "$NIX_BUILD_TOP/debian/PkKek-1-Debian.pem" , httpSupport ? false , tpmSupport ? false , tlsSupport ? false @@ -14,28 +29,56 @@ let - projectDscPath = if stdenv.isi686 then - "OvmfPkg/OvmfPkgIa32.dsc" - else if stdenv.isx86_64 then - "OvmfPkg/OvmfPkgX64.dsc" - else if stdenv.hostPlatform.isAarch then - "ArmVirtPkg/ArmVirtQemu.dsc" - else if stdenv.hostPlatform.isRiscV then - "OvmfPkg/RiscVVirt/RiscVVirtQemu.dsc" - else - throw "Unsupported architecture"; + platformSpecific = { + i686 = { + projectDscPath = "OvmfPkg/OvmfPkgIa32.dsc"; + fwPrefix = "OVMF"; + }; + x86_64 = { + projectDscPath = "OvmfPkg/OvmfPkgX64.dsc"; + fwPrefix = "OVMF"; + msVarsArgs = { + flavor = "OVMF_4M"; + archDir = "X64"; + }; + }; + aarch64 = { + projectDscPath = "ArmVirtPkg/ArmVirtQemu.dsc"; + fwPrefix = "AAVMF"; + msVarsArgs = { + flavor = "AAVMF"; + archDir = "AARCH64"; + }; + }; + riscv64 = { + projectDscPath = "OvmfPkg/RiscVVirt/RiscVVirtQemu.dsc"; + fwPrefix = "RISCV_VIRT"; + }; + }; + + cpuName = stdenv.hostPlatform.parsed.cpu.name; + + inherit (platformSpecific.${cpuName}) + projectDscPath fwPrefix msVarsArgs; version = lib.getVersion edk2; - suffixes = { - i686 = "FV/OVMF"; - x86_64 = "FV/OVMF"; - aarch64 = "FV/AAVMF"; - riscv64 = "FV/RISCV_VIRT"; + OvmfPkKek1AppPrefix = "4e32566d-8e9e-4f52-81d3-5bb9715f9727"; + + debian-edk-src = fetchurl { + url = "http://deb.debian.org/debian/pool/main/e/edk2/edk2_2023.11-5.debian.tar.xz"; + sha256 = "1yxlab4md30pxvjadr6b4xn6cyfw0c292q63pyfv4vylvhsb24g4"; }; + buildPrefix = "Build/*/*"; + in +assert platformSpecific ? ${cpuName}; +assert systemManagementModeRequired -> stdenv.hostPlatform.isx86; +assert msVarsTemplate -> fdSize4MB; +assert msVarsTemplate -> platformSpecific.${cpuName} ? msVarsArgs; + edk2.mkDerivation projectDscPath (finalAttrs: { pname = "OVMF"; inherit version; @@ -43,7 +86,8 @@ edk2.mkDerivation projectDscPath (finalAttrs: { outputs = [ "out" "fd" ]; nativeBuildInputs = [ util-linux nasm acpica-tools ] - ++ lib.optionals stdenv.cc.isClang [ llvmPackages.bintools llvmPackages.llvm ]; + ++ lib.optionals stdenv.cc.isClang [ llvmPackages.bintools llvmPackages.llvm ] + ++ lib.optionals msVarsTemplate [ python3 pexpect xorriso qemu dosfstools mtools ]; strictDeps = true; hardeningDisable = [ "format" "stackprotector" "pic" "fortify" ]; @@ -54,6 +98,7 @@ edk2.mkDerivation projectDscPath (finalAttrs: { ++ lib.optionals debug [ "-D DEBUG_ON_SERIAL_PORT=TRUE" ] ++ lib.optionals sourceDebug [ "-D SOURCE_DEBUG_ENABLE=TRUE" ] ++ lib.optionals secureBoot [ "-D SECURE_BOOT_ENABLE=TRUE" ] + ++ lib.optionals systemManagementModeRequired [ "-D SMM_REQUIRE=TRUE" ] ++ lib.optionals csmSupport [ "-D CSM_ENABLE" ] ++ lib.optionals fdSize2MB ["-D FD_SIZE_2MB"] ++ lib.optionals fdSize4MB ["-D FD_SIZE_4MB"] @@ -66,49 +111,75 @@ edk2.mkDerivation projectDscPath (finalAttrs: { env.PYTHON_COMMAND = "python3"; + postUnpack = lib.optionalDrvAttr msVarsTemplate '' + unpackFile ${debian-edk-src} + ''; + postPatch = lib.optionalString csmSupport '' cp ${seabios}/share/seabios/Csm16.bin OvmfPkg/Csm/Csm16/Csm16.bin ''; - postFixup = ( - if stdenv.hostPlatform.isAarch then '' + postConfigure = lib.optionalDrvAttr msVarsTemplate '' + tr -d '\n' < ${vendorPkKek} | sed \ + -e 's/.*-----BEGIN CERTIFICATE-----/${OvmfPkKek1AppPrefix}:/' \ + -e 's/-----END CERTIFICATE-----//' > vendor-cert-string + export PYTHONPATH=$NIX_BUILD_TOP/debian/python:$PYTHONPATH + ''; + + postBuild = lib.optionalString stdenv.hostPlatform.isAarch '' + ( + cd ${buildPrefix}/FV + cp QEMU_EFI.fd ${fwPrefix}_CODE.fd + cp QEMU_VARS.fd ${fwPrefix}_VARS.fd + + # QEMU expects 64MiB CODE and VARS files on ARM/AARCH64 architectures + # Truncate the firmware files to the expected size + truncate -s 64M ${fwPrefix}_CODE.fd + truncate -s 64M ${fwPrefix}_VARS.fd + ) + '' + lib.optionalString stdenv.hostPlatform.isRiscV '' + truncate -s 32M ${buildPrefix}/FV/${fwPrefix}_CODE.fd + truncate -s 32M ${buildPrefix}/FV/${fwPrefix}_VARS.fd + '' + lib.optionalString msVarsTemplate '' + ( + cd ${buildPrefix} + python3 $NIX_BUILD_TOP/debian/edk2-vars-generator.py \ + --flavor ${msVarsArgs.flavor} \ + --enrolldefaultkeys ${msVarsArgs.archDir}/EnrollDefaultKeys.efi \ + --shell ${msVarsArgs.archDir}/Shell.efi \ + --code FV/${fwPrefix}_CODE.fd \ + --vars-template FV/${fwPrefix}_VARS.fd \ + --certificate `< $NIX_BUILD_TOP/$sourceRoot/vendor-cert-string` \ + --out-file FV/${fwPrefix}_VARS.ms.fd + ) + ''; + + postInstall = '' mkdir -vp $fd/FV - mkdir -vp $fd/AAVMF + mv -v $out/FV/${fwPrefix}_{CODE,VARS}.fd $fd/FV + '' + lib.optionalString msVarsTemplate '' + mv -v $out/FV/${fwPrefix}_VARS.ms.fd $fd/FV + ln -sv $fd/FV/${fwPrefix}_CODE{,.ms}.fd + '' + lib.optionalString stdenv.hostPlatform.isAarch '' mv -v $out/FV/QEMU_{EFI,VARS}.fd $fd/FV - - # Use Debian dir layout: https://salsa.debian.org/qemu-team/edk2/blob/debian/debian/rules - dd of=$fd/FV/AAVMF_CODE.fd if=/dev/zero bs=1M count=64 - dd of=$fd/FV/AAVMF_CODE.fd if=$fd/FV/QEMU_EFI.fd conv=notrunc - dd of=$fd/FV/AAVMF_VARS.fd if=/dev/zero bs=1M count=64 - - # Also add symlinks for Fedora dir layout: https://src.fedoraproject.org/cgit/rpms/edk2.git/tree/edk2.spec + # Add symlinks for Fedora dir layout: https://src.fedoraproject.org/cgit/rpms/edk2.git/tree/edk2.spec + mkdir -vp $fd/AAVMF ln -s $fd/FV/AAVMF_CODE.fd $fd/AAVMF/QEMU_EFI-pflash.raw ln -s $fd/FV/AAVMF_VARS.fd $fd/AAVMF/vars-template-pflash.raw - '' - else if stdenv.hostPlatform.isRiscV then '' - mkdir -vp $fd/FV - - mv -v $out/FV/RISCV_VIRT_{CODE,VARS}.fd $fd/FV/ - truncate -s 32M $fd/FV/RISCV_VIRT_CODE.fd - truncate -s 32M $fd/FV/RISCV_VIRT_VARS.fd - '' - else '' - mkdir -vp $fd/FV - mv -v $out/FV/OVMF{,_CODE,_VARS}.fd $fd/FV - ''); + ''; dontPatchELF = true; passthru = let - cpuName = stdenv.hostPlatform.parsed.cpu.name; - suffix = suffixes."${cpuName}" or (throw "Host cpu name `${cpuName}` is not supported in this OVMF derivation!"); - prefix = "${finalAttrs.finalPackage.fd}/${suffix}"; + prefix = "${finalAttrs.finalPackage.fd}/FV/${fwPrefix}"; in { firmware = "${prefix}_CODE.fd"; variables = "${prefix}_VARS.fd"; # This will test the EFI firmware for the host platform as part of the NixOS Tests setup. tests.basic-systemd-boot = nixosTests.systemd-boot.basic; + tests.secureBoot-systemd-boot = nixosTests.systemd-boot.secureBoot; + inherit secureBoot systemManagementModeRequired; }; meta = { diff --git a/pkgs/development/libraries/aspell/dictionaries.nix b/pkgs/development/libraries/aspell/dictionaries.nix index ea8a2133c82b..ba5b3d6ddd51 100644 --- a/pkgs/development/libraries/aspell/dictionaries.nix +++ b/pkgs/development/libraries/aspell/dictionaries.nix @@ -103,8 +103,9 @@ let homepage = "http://ftp.gnu.org/gnu/aspell/dict/0index.html"; } // (args.meta or {}); - } // lib.optionalAttrs (stdenv.isDarwin && lib.elem language [ "is" "nb" ]) { - # tar: Cannot open: Illegal byte sequence + } // lib.optionalAttrs (lib.elem language [ "is" "nb" ]) { + # These have Windows-1251 encoded non-ASCII characters, + # so need some special handling. unpackPhase = '' runHook preUnpack diff --git a/pkgs/development/libraries/dqlite/default.nix b/pkgs/development/libraries/dqlite/default.nix index 2ed5417c8026..2746c53e6a01 100644 --- a/pkgs/development/libraries/dqlite/default.nix +++ b/pkgs/development/libraries/dqlite/default.nix @@ -3,13 +3,13 @@ stdenv.mkDerivation rec { pname = "dqlite"; - version = "1.16.2"; + version = "1.16.4"; src = fetchFromGitHub { owner = "canonical"; repo = pname; rev = "refs/tags/v${version}"; - hash = "sha256-rzKZvVybKLQKT9ZiGT/9LgU7hxI6knVXkPawNhbW/DQ="; + hash = "sha256-Q90wVqb6321+SWW5j52fb6mVRf25nExqgN/+s6OwoMk="; }; nativeBuildInputs = [ autoreconfHook file pkg-config ]; diff --git a/pkgs/tools/networking/whois/default.nix b/pkgs/tools/networking/whois/default.nix index 1fd5cb97383e..1b29b0889b64 100644 --- a/pkgs/tools/networking/whois/default.nix +++ b/pkgs/tools/networking/whois/default.nix @@ -1,14 +1,14 @@ { lib, stdenv, fetchFromGitHub, fetchpatch, perl, gettext, pkg-config, libidn2, libiconv }: stdenv.mkDerivation rec { - version = "5.5.20"; + version = "5.5.21"; pname = "whois"; src = fetchFromGitHub { owner = "rfc1036"; repo = "whois"; rev = "v${version}"; - hash = "sha256-0vQ6GBBtNA6Phlqhl3NZvEJqoyZ1um7VdkpsIRKhsm4="; + hash = "sha256-iVt/4rxOgF1wZBy+Lnh7jR7HDk2Y7hwljt9FrFuXdHg="; }; patches = [ diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 74ef4d169809..9c19f93fae8c 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -2804,7 +2804,7 @@ with pkgs; retrofe = callPackage ../applications/emulators/retrofe { }; - ripes = libsForQt5.callPackage ../applications/emulators/ripes { }; + ripes = qt6Packages.callPackage ../applications/emulators/ripes { }; rpcemu = callPackage ../applications/emulators/rpcemu { }; @@ -26829,12 +26829,16 @@ with pkgs; rust-hypervisor-firmware = callPackage ../applications/virtualization/rust-hypervisor-firmware { }; - OVMF = callPackage ../applications/virtualization/OVMF { }; + OVMF = callPackage ../applications/virtualization/OVMF { + inherit (python3Packages) pexpect; + }; OVMFFull = callPackage ../applications/virtualization/OVMF { + inherit (python3Packages) pexpect; secureBoot = true; httpSupport = true; tpmSupport = true; tlsSupport = true; + msVarsTemplate = stdenv.isx86_64 || stdenv.isAarch64; }; ops = callPackage ../applications/virtualization/ops { };