Send patches - preferably formatted by git format-patch - to patches at archlinux32 dot org.
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--CHANGELOG.rst21
-rwxr-xr-xarchiso/mkarchiso43
-rw-r--r--configs/baseline/profiledef.sh2
-rw-r--r--configs/releng/grub/grub.cfg5
-rw-r--r--configs/releng/packages.x86_641
-rw-r--r--configs/releng/syslinux/archiso_pxe-linux.cfg6
-rw-r--r--docs/README.profile.rst2
7 files changed, 65 insertions, 15 deletions
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 0e9d737..f4ad972 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -14,6 +14,27 @@ Changed
Removed
-------
+[69] - 2022-12-24
+=================
+
+Added
+-----
+
+- Add Memtest86+ to x86_64 UEFI GRUB boot menu.
+
+Changed
+-------
+
+- Check if the GPG public key file was successfully placed in the work directory before trying to use it.
+- Open the file descriptors for code signing certificates and GPG public key as read only. Nothing from the within the
+ ``pacstrap`` invoked chroot should ever be allowed to write outside of it.
+- Error out early if any of the code signing certificate files passed with option ``-c`` do not exist.
+- Use LZMA compressed EROFS image for the baseline profile. Now that xz 5.4 is out and erofs-utils is built with LZMA
+ support, using a higher compression is possible.
+- Add ``/etc/machine-id`` with special value ``uninitialized``. The final id is generated at boot time, and systemd's
+ first-boot mechanim (see ``First Boot Semantics`` in ``machine-id(5)``) applies. No functional change unless that
+ ``ConditionFirstBoot=yes`` is true and passive unit ``first-boot-complete.target`` activates for ordering.
+
[68] - 2022-10-30
=================
diff --git a/archiso/mkarchiso b/archiso/mkarchiso
index 820688d..7f6de7c 100755
--- a/archiso/mkarchiso
+++ b/archiso/mkarchiso
@@ -165,9 +165,10 @@ _cleanup_pacstrap_dir() {
[[ -d "${pacstrap_dir}/var/tmp" ]] && find "${pacstrap_dir}/var/tmp" -mindepth 1 -delete
# Delete package pacman related files.
find "${work_dir}" \( -name '*.pacnew' -o -name '*.pacsave' -o -name '*.pacorig' \) -delete
- # Create an empty /etc/machine-id
+ # Create /etc/machine-id with special value 'uninitialized': the final id is
+ # generated on first boot, systemd's first-boot mechanism applies (see machine-id(5))
rm -f -- "${pacstrap_dir}/etc/machine-id"
- printf '' > "${pacstrap_dir}/etc/machine-id"
+ printf 'uninitialized\n' > "${pacstrap_dir}/etc/machine-id"
_msg_info "Done!"
}
@@ -337,16 +338,16 @@ _make_custom_airootfs() {
_make_packages() {
_msg_info "Installing packages to '${pacstrap_dir}/'..."
- if [[ -n "${gpg_key}" ]]; then
- exec {ARCHISO_GNUPG_FD}<>"${work_dir}/pubkey.gpg"
+ if [[ -v gpg_publickey ]]; then
+ exec {ARCHISO_GNUPG_FD}<"$gpg_publickey"
export ARCHISO_GNUPG_FD
fi
if [[ -v cert_list[0] ]]; then
- exec {ARCHISO_TLS_FD}<>"${cert_list[0]}"
+ exec {ARCHISO_TLS_FD}<"${cert_list[0]}"
export ARCHISO_TLS_FD
fi
if [[ -v cert_list[2] ]]; then
- exec {ARCHISO_TLSCA_FD}<>"${cert_list[2]}"
+ exec {ARCHISO_TLSCA_FD}<"${cert_list[2]}"
export ARCHISO_TLSCA_FD
fi
@@ -366,7 +367,7 @@ _make_packages() {
exec {ARCHISO_TLSCA_FD}<&-
unset ARCHISO_TLSCA_FD
fi
- if [[ -n "${gpg_key}" ]]; then
+ if [[ -v gpg_publickey ]]; then
exec {ARCHISO_GNUPG_FD}<&-
unset ARCHISO_GNUPG_FD
fi
@@ -714,6 +715,14 @@ _make_bootmode_uefi-x64.grub.esp() {
mcopy -i "${efibootimg}" "${pacstrap_dir}/usr/share/edk2-shell/x64/Shell_Full.efi" ::/shellx64.efi
fi
+ # Add other aditional/extra files to ${install_dir}/boot/
+ if [[ -e "${pacstrap_dir}/boot/memtest86+/memtest.efi" ]]; then
+ install -m 0644 -- "${pacstrap_dir}/boot/memtest86+/memtest.efi" "${isofs_dir}/${install_dir}/boot/memtest.efi"
+ install -d -m 0755 -- "${isofs_dir}/${install_dir}/boot/licenses/memtest86+/"
+ install -m 0644 -- "${pacstrap_dir}/usr/share/licenses/common/GPL2/license.txt" \
+ "${isofs_dir}/${install_dir}/boot/licenses/memtest86+/"
+ fi
+
_msg_info "Done! GRUB set up for UEFI booting successfully."
}
@@ -999,6 +1008,10 @@ _validate_requirements_bootmode_uefi-x64.grub.esp() {
if [[ ! " ${pkg_list[*]} " =~ ' edk2-shell ' ]]; then
_msg_info "'edk2-shell' is not in the package list. The ISO will not contain a bootable UEFI shell."
fi
+ # shellcheck disable=SC2076
+ if [[ ! " ${pkg_list[*]} " =~ ' memtest86+-efi ' ]]; then
+ _msg_info "Validating '${bootmode}': 'memtest86+-efi' is not in the package list. Memory testing will not be available from GRUB."
+ fi
}
_validate_requirements_bootmode_uefi-x64.grub.eltorito() {
@@ -1512,7 +1525,7 @@ _read_profile() {
# Validate set options
_validate_options() {
- local validation_error=0 _buildmode
+ local validation_error=0 _buildmode certfile
_msg_info "Validating options..."
@@ -1522,6 +1535,14 @@ _validate_options() {
_msg_error "File '${pacman_conf}' does not exist." 0
fi
+ # Check if the code signing certificate files exist
+ for certfile in "${cert_list[@]}"; do
+ if [[ ! -e "$certfile" ]]; then
+ (( validation_error=validation_error+1 ))
+ _msg_error "Code signing certificate '${certfile}' does not exist." 0
+ fi
+ done
+
# Check if the specified buildmodes are supported
for _buildmode in "${buildmodes[@]}"; do
if typeset -f "_build_buildmode_${_buildmode}" &> /dev/null; then
@@ -1604,8 +1625,10 @@ _set_overrides() {
}
_export_gpg_publickey() {
- rm -f -- "${work_dir}/pubkey.gpg"
- gpg --batch --no-armor --output "${work_dir}/pubkey.gpg" --export "${gpg_key}"
+ gpg_publickey="${work_dir}/pubkey.gpg"
+ rm -f -- "$gpg_publickey"
+ gpg --batch --no-armor --output "$gpg_publickey" --export "${gpg_key}"
+ [[ -s "$gpg_publickey" ]] || return
}
_make_version() {
diff --git a/configs/baseline/profiledef.sh b/configs/baseline/profiledef.sh
index 4115581..ed486ca 100644
--- a/configs/baseline/profiledef.sh
+++ b/configs/baseline/profiledef.sh
@@ -14,7 +14,7 @@ bootmodes=('bios.syslinux.mbr' 'bios.syslinux.eltorito'
arch="x86_64"
pacman_conf="pacman.conf"
airootfs_image_type="erofs"
-airootfs_image_tool_options=('-zlz4hc,12' -E ztailpacking)
+airootfs_image_tool_options=('-zlzma,9' -E ztailpacking)
file_permissions=(
["/etc/shadow"]="0:0:400"
)
diff --git a/configs/releng/grub/grub.cfg b/configs/releng/grub/grub.cfg
index 43fad0e..79ea2d2 100644
--- a/configs/releng/grub/grub.cfg
+++ b/configs/releng/grub/grub.cfg
@@ -46,6 +46,11 @@ menuentry "Arch Linux install medium with speakup screen reader (x86_64, UEFI)"
if [ "${grub_platform}" == "efi" ]; then
if [ "${grub_cpu}" == "x86_64" ]; then
+ menuentry "Run Memtest86+ (RAM test)" --class memtest86 --class gnu --class tool {
+ set gfxpayload=800x600,1024x768
+ search --fs-uuid --no-floppy --set=root --label %ARCHISO_LABEL%
+ linux /%INSTALL_DIR%/boot/memtest.efi
+ }
menuentry "UEFI Shell" {
insmod chain
search --no-floppy --set=root --label %ARCHISO_LABEL%
diff --git a/configs/releng/packages.x86_64 b/configs/releng/packages.x86_64
index 02ef538..5771920 100644
--- a/configs/releng/packages.x86_64
+++ b/configs/releng/packages.x86_64
@@ -60,6 +60,7 @@ man-pages
mc
mdadm
memtest86+
+memtest86+-efi
mkinitcpio
mkinitcpio-archiso
mkinitcpio-nfs-utils
diff --git a/configs/releng/syslinux/archiso_pxe-linux.cfg b/configs/releng/syslinux/archiso_pxe-linux.cfg
index 1e119e8..c18333f 100644
--- a/configs/releng/syslinux/archiso_pxe-linux.cfg
+++ b/configs/releng/syslinux/archiso_pxe-linux.cfg
@@ -6,7 +6,7 @@ ENDTEXT
MENU LABEL Arch Linux install medium (i686, NBD)
LINUX ::/%INSTALL_DIR%/boot/i686/vmlinuz-linux
INITRD ::/%INSTALL_DIR%/boot/intel-ucode.img,::/%INSTALL_DIR%/boot/amd-ucode.img,::/%INSTALL_DIR%/boot/i686/initramfs-linux.img
-APPEND archisobasedir=%INSTALL_DIR% archisolabel=%ARCHISO_LABEL% archiso_nbd_srv=${pxeserver} checksum verify
+APPEND archisobasedir=%INSTALL_DIR% archisolabel=%ARCHISO_LABEL% archiso_nbd_srv=${pxeserver} cms_verify=y
SYSAPPEND 3
LABEL arch32_nfs
@@ -17,7 +17,7 @@ ENDTEXT
MENU LABEL Arch Linux install medium (i686, NFS)
LINUX ::/%INSTALL_DIR%/boot/i686/vmlinuz-linux
INITRD ::/%INSTALL_DIR%/boot/intel-ucode.img,::/%INSTALL_DIR%/boot/amd-ucode.img,::/%INSTALL_DIR%/boot/i686/initramfs-linux.img
-APPEND archisobasedir=%INSTALL_DIR% archiso_nfs_srv=${pxeserver}:/run/archiso/bootmnt checksum verify
+APPEND archisobasedir=%INSTALL_DIR% archiso_nfs_srv=${pxeserver}:/run/archiso/bootmnt cms_verify=y
SYSAPPEND 3
LABEL arch32_http
@@ -28,5 +28,5 @@ ENDTEXT
MENU LABEL Arch Linux install medium (i686, HTTP)
LINUX ::/%INSTALL_DIR%/boot/i686/vmlinuz-linux
INITRD ::/%INSTALL_DIR%/boot/intel-ucode.img,::/%INSTALL_DIR%/boot/amd-ucode.img,::/%INSTALL_DIR%/boot/i686/initramfs-linux.img
-APPEND archisobasedir=%INSTALL_DIR% archiso_http_srv=http://${pxeserver}/ checksum verify
+APPEND archisobasedir=%INSTALL_DIR% archiso_http_srv=http://${pxeserver}/ cms_verify=y
SYSAPPEND 3
diff --git a/docs/README.profile.rst b/docs/README.profile.rst
index efcb861..f1fd717 100644
--- a/docs/README.profile.rst
+++ b/docs/README.profile.rst
@@ -137,7 +137,7 @@ The following *custom template identifiers* are understood and will be replaced
respective variables in ``profiledef.sh``:
* ``%ARCHISO_LABEL%``: Set this using the ``iso_label`` variable in ``profiledef.sh``.
-* ``%INSTALL_DIR%``: Set this using the ``iso_label`` variable in ``profiledef.sh``.
+* ``%INSTALL_DIR%``: Set this using the ``install_dir`` variable in ``profiledef.sh``.
* ``%ARCH%``: Set this using the ``arch`` variable in ``profiledef.sh``.