Age | Commit message (Collapse) | Author |
|
--disable-shim-lock is required to support Secure Boot with custom signatures without using shim.
Otherwise GRUB will trow an error when trying to boot a kernel:
error: shim_lock protocol not found.
error: you need to load the kernel first.
The modules GRUB will use need to be preloaded otherwise the EFI binaries cannot be signed and used for Secure Boot.
See https://bugs.archlinux.org/task/71382.
GRUB will trow en error:
error: verification requested but nobody cares
These changes are done to support Secure Boot using custom keys (not shim) by simply extracting the boot loader
(BOOTx64.EFI and BOOTIA32.EFI), kernel, UEFI shell, signing them and then repacking the ISO.
For example.
Extract the files:
$ osirrox -indev archlinux-YYYY.MM.DD-x86_64.iso \
-extract_boot_images ./ \
-extract /EFI/BOOT/BOOTx64.EFI BOOTx64.EFI \
-extract /EFI/BOOT/BOOTIA32.EFI BOOTIA32.EFI \
-extract /shellx64.efi shellx64.efi \
-extract /shellia32.efi shellia32.efi \
-extract /arch/boot/x86_64/vmlinuz-linux vmlinuz-linux
Make the files writable:
$ chmod +w BOOTx64.EFI BOOTIA32.EFI shellx64.efi shellia32.efi vmlinuz-linux
Sign the files:
$ sbsign --key db.key --cert db.crt --output BOOTx64.EFI BOOTx64.EFI
$ sbsign --key db.key --cert db.crt --output BOOTIA32.EFI BOOTIA32.EFI
$ sbsign --key db.key --cert db.crt --output shellx64.efi shellx64.efi
$ sbsign --key db.key --cert db.crt --output shellia32.efi shellia32.efi
$ sbsign --key db.key --cert db.crt --output vmlinuz-linux vmlinuz-linux
Copy the boot loader and UEFI shell to the EFI system partition image:
$ mcopy -D oO -i eltorito_img2_uefi.img BOOTx64.EFI BOOTIA32.EFI ::/EFI/BOOT/
$ mcopy -D oO -i eltorito_img2_uefi.img shellx64.efi shellia32.efi ::/
Repack the ISO using the modified El Torito UEFI boot image and add the signed boot loader files, UEFI shell and
kernel to ISO9660:
$ xorriso -indev archlinux-YYYY.MM.DD-x86_64.iso \
-outdev archlinux-YYYY.MM.DD-x86_64-Secure_Boot.iso \
-boot_image any replay \
-append_partition 2 0xef eltorito_img2_uefi.img \
-map BOOTx64.EFI /EFI/BOOT/BOOTx64.EFI \
-map BOOTIA32.EFI /EFI/BOOT/BOOTIA32.EFI \
-map shellx64.efi /shellx64.efi \
-map shellia32.efi /shellia32.efi \
-map vmlinuz-linux /arch/boot/x86_64/vmlinuz-linux
Boot the resulting archlinux-YYYY.MM.DD-x86_64-Secure_Boot.iso.
|
|
Do not limit file copying to only grub.cfg and instead copy all GRUB configuration files and assets to both the ISO9660 and FAT image.
This will allow for including custom images, fonts, etc.
To easily match all non-configuration files (i.e. files without the .cfg extension), bash's extended glob feature will be enabled.
Actions common to multiple _make_bootmode_uefi-*.grub are split off into dedicated functions:
* _make_common_bootmode_grub_copy_to_efibootimg,
* _make_common_bootmode_grub_copy_to_isofs,
* _make_common_bootmode_grub_cfg.
Use the same du command in all efiboot_imgsize variable assignments.
Fixes #185.
|
|
LC_ALL=C.UTF-8, unlike LC_ALL=C, does not override LANGUAGE.
See https://sourceware.org/bugzilla/show_bug.cgi?id=16621 and https://savannah.gnu.org/bugs/?62815
|
|
* origin/merge-requests/273:
Add efibootimg variable in place of full path
See merge request https://gitlab.archlinux.org/archlinux/archiso/-/merge_requests/273
|
|
Update authors
Update CHANGELOG
|
|
|
|
Try to initialize a serial device and use it for input and output.
Add more comments to grub.cfg to explain what is done.
Related to #75
|
|
Fixes #183
|
|
* Set the default boot entry and its timeout.
* Add classes to menu entries to allow theming them.
Fixes #179
|
|
By Alexander Epaneshnikov
* origin/merge-requests/266:
change grub init tune
Closes #180
See merge request https://gitlab.archlinux.org/archlinux/archiso/-/merge_requests/266
|
|
yes it was descriptive but too large. this fixes #180
|
|
Even though archiso created ISOs do not support Secure Boot, having SBAT would allow users to more easily repack the files in the ISO to add a signed shim.
Fixes #174
|
|
* Fix typos and wording,
* Remove impossible TODO.
|
|
airootfs_image_tool_options for mkfs.erofs
As the man page says, it saves more space, although the feature is experimental.
|
|
By plainlinen
* origin/merge-requests/261:
Add implicit package dependencies to PACKAGE_LIST in .gitlab-ci.yml
Closes #176
See merge request https://gitlab.archlinux.org/archlinux/archiso/-/merge_requests/261
|
|
After more than ten years, archiso is once again using GRUB. GRUB! Only this time, it's for UEFI not BIOS boot.
By plainlinen
* origin/merge-requests/256:
Update documentation for uefi x64 grub boot modes
Use grub for uefi x64 boot modes in profiledef.sh
Add *_uefi-x64.grub.* functions to mkarchiso
Add useful grub menu entries to grub.cfg
Closes #63 and #159
See merge request https://gitlab.archlinux.org/archlinux/archiso/-/merge_requests/256.
|
|
CI was working before because these dependencies were already in
the official ISO but include them explicitly to be safe.
|
|
|
|
|
|
|
|
|
|
The glibc 2.35-6 package ships with the C.UTF-8 locale included, so mkarchiso does not need to use a non-UTF-8 locale anymore.
Implements #175.
|
|
The glibc 2.35-6 package ships with the C.UTF-8 locale included.
This means there is now a UTF-8 locale available by default and en_US.UTF-8, which requires editing /etc/locale.gen and running locale-gen, is not needed anymore.
Implements #175.
|
|
* .cer, .crt, .key and .pem are typical file name extensions for TLS certificates and keys. They are used when codesigning with openssl and should never be commited in the repo.
* .img is a generic image file. Such files could be used when repacking an ISO to attach cloud-init CIDATA.
|
|
|
|
|
|
By Alexander Epaneshnikov
* origin/merge-requests/254:
fix boot menu entry sorting
add accessible copytoram entry
enable beeps in boot menu
See merge request !254
|
|
I guess new systemd changed this
|
|
|
|
|
|
* origin/merge-requests/216:
Update CHANGELOG.
Update baseline and releng profiledef.sh to support ia32 uefi mode.
Add GRUB configuration files to baseline and releng profiles.
Add support for GRUB ia32 UEFI in mkarchiso, update READMEs.
Closes #107
See merge request !216
|
|
|
|
|
|
|
|
|
|
* origin/merge-requests/250:
bind-tools has been replaced with bind
See merge request !250
|
|
|
|
|
|
* open-vm-tools package, vmtoolsd.service and vmware-vmblock-fuse.service for VMware.
* hyperv package, hv_fcopy_daemon.service, hv_kvp_daemon.service and hv_vss_daemon.service for Hyper-V.
Related to #118.
|
|
support both IPv4 & IPv6
This ensures that IPv6-only systems get working mirrors.
|
|
It is needed for installing Arch on an iSCSI target.
|
|
It is useful for finding information about the system's hardware and firmware.
|
|
When using tmpfs, it is possible that parts of it end up getting put in swap space (only if there is one).
This may not be desired, so use ramfs instead.
|
|
CHANGELOG.rst:
Add changelog for 62.1
|
|
* tpowa/crda:
remove crda, removed from core recently
|
|
|
|
People get scared by it. See https://gitlab.archlinux.org/archlinux/archiso/-/merge_requests/239#note_61954.
This reverts commit b5011af3f4ac63214fdecef442550cce5ae4a971, reversing
changes made to 07d8035624cff64e28f1148ddec9e970e26173da.
|
|
|
|
* origin/merge-requests/239:
add needed files
See merge request !239
|
|
* origin/merge-requests/240:
configs/releng: Improve motd
See merge request !240
|