- Spectrum Development - spectrum-os.org

[PATCH 0/3] Switch from mdevd to systemd-udevd in root filesystem
by Demi Marie Obenour 01 Nov '25

01 Nov '25

systemd-udevd provides support for significantly more hardware than mdevd does. Therefore, switch to it. The last patch intentionally uses some packages built with glibc to avoid having to build the world from source. The use of glibc isn't essential and is just because not using the binary cache to build is very, very slow. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Demi Marie Obenour (3): host/rootfs: Add early serial output tools: Add adapter tool for services using sd_notify host/rootfs: switch to systemd-udevd host/rootfs/Makefile | 18 +- host/rootfs/default.nix | 94 +--- host/rootfs/etc/init | 2 +- host/rootfs/etc/mdev.conf | 7 - host/rootfs/etc/mdev/listen | 2 +- host/rootfs/etc/mdev/net/add | 1 + host/rootfs/etc/s6-rc/mdevd-coldplug/dependencies | 4 - host/rootfs/etc/s6-rc/mdevd-coldplug/up | 4 - host/rootfs/etc/s6-rc/mdevd/run | 5 - host/rootfs/etc/s6-rc/ok-all/contents | 2 +- .../dependencies.d/systemd-udevd | 0 .../type | 0 .../type.license | 0 host/rootfs/etc/s6-rc/systemd-udevd-coldplug/up | 3 + host/rootfs/etc/s6-rc/systemd-udevd/flag-essential | 0 .../s6-rc/{mdevd => systemd-udevd}/notification-fd | 0 .../notification-fd.license | 0 host/rootfs/etc/s6-rc/systemd-udevd/run | 10 + .../rootfs/etc/s6-rc/{mdevd => systemd-udevd}/type | 0 .../s6-rc/{mdevd => systemd-udevd}/type.license | 0 host/rootfs/etc/s6-rc/vmm-env/contents | 1 + host/rootfs/etc/s6-rc/weston/dependencies | 4 - .../weston/dependencies.d/systemd-udevd-coldplug | 0 host/rootfs/etc/udev/rules.d/99-spectrum.rules | 5 + tools/default.nix | 1 + tools/meson.build | 1 + tools/sd-notify-adapter/meson.build | 4 + tools/sd-notify-adapter/sd-notify-adapter.c | 490 +++++++++++++++++++++ 28 files changed, 552 insertions(+), 106 deletions(-) --- base-commit: 31121b718d94229809b53c31bfbb0353b6c3d0d1 change-id: 20250911-udev-24cf4bf68fbe -- Sincerely, Demi Marie Obenour (she/her/hers)

3 50

Best practices for submitting tree-wide changes
by Demi Marie Obenour 01 Nov '25

01 Nov '25

In some cases, the same change should be made to many parts of the codebase. This includes things like adding set -o pipefail to shell scripts or moving command substitutions to their own commands. Should one send a single patch that makes all the changes, or should one send a bunch of tiny patches? Preferably, the answer should be added to the documentation so people don't need to ask again :) -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

[PATCH 1/2] vm/sys/net: build against pkgsMusl
by Yureka Lilian 31 Oct '25

31 Oct '25

Some of the following changes do not work with pkgsStatic, specifically it is difficult to link libbpf statically[1]. [1] https://lists.fedorahosted.org/archives/list/elfutils-devel@lists.fedorahos… Signed-off-by: Yureka Lilian <yureka(a)cyberchaos.dev> Reviewed-by: Alyssa Ross <hi(a)alyssa.is> --- vm/sys/net/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/vm/sys/net/default.nix b/vm/sys/net/default.nix index b8dc964..4cdb1c4 100644 --- a/vm/sys/net/default.nix +++ b/vm/sys/net/default.nix @@ -2,8 +2,8 @@ # SPDX-FileCopyrightText: 2021-2023 Alyssa Ross <hi(a)alyssa.is> import ../../../lib/call-package.nix ( -{ spectrum-build-tools, src, terminfo, pkgsStatic }: -pkgsStatic.callPackage ( +{ spectrum-build-tools, src, terminfo, pkgsMusl }: +pkgsMusl.callPackage ( { lib, stdenvNoCC, nixos, runCommand, writeClosure , erofs-utils, jq, s6-rc, util-linux, xorg -- 2.51.0

4 8

[PATCH] Add dontFixup=true to derivations that build images
by Demi Marie Obenour 28 Oct '25

28 Oct '25

This prevents lengthy and pointless scans of large image files. dontFixup is added to the derivations that already used unsafeDiscardReferences. Both dontFixup and unsafeDiscardReferences are added to a derivation that builds an ext4 filesystem image. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/initramfs/default.nix | 3 +++ host/rootfs/default.nix | 1 + img/app/default.nix | 2 ++ release/checks/integration/default.nix | 2 ++ release/combined/default.nix | 3 +++ release/combined/eosimages.nix | 1 + release/live/default.nix | 2 ++ vm-lib/make-vm.nix | 1 + vm/sys/net/default.nix | 2 ++ 9 files changed, 17 insertions(+) diff --git a/host/initramfs/default.nix b/host/initramfs/default.nix index a3672bfeb7002f81bf67bfc13c0b757d46b93d66..51305a7da1645ca63f1c9b2f07a15aa0d5659ff2 100644 --- a/host/initramfs/default.nix +++ b/host/initramfs/default.nix @@ -63,6 +63,7 @@ let nativeBuildInputs = [ cpio ]; __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; } '' cpio -id < ${microcodeAmd}/amd-ucode.img cpio -id < ${microcodeIntel}/intel-ucode.img @@ -82,6 +83,7 @@ let __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; } '' cd ${packagesSysroot} (printf "%s\n" "''${storePrefixes[@]}" && find . $(< $storePaths)) | @@ -118,6 +120,7 @@ stdenvNoCC.mkDerivation { __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; passthru = { inherit packagesSysroot; }; } diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix index 484a43f372f934e6b3be0c383d12c9eabf2f7171..1673a83e9d70da6f22fa71c4a79e0eaeff309fc2 100644 --- a/host/rootfs/default.nix +++ b/host/rootfs/default.nix @@ -195,6 +195,7 @@ stdenvNoCC.mkDerivation { __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; passthru = { inherit appvm firmware kernel nixosAllHardware packagesSysroot pkgsGui; diff --git a/img/app/default.nix b/img/app/default.nix index 2863cbdfc067c8a6de018e5f0920d00878cf96ff..5cd381e837db3057590c075cf2b33a486cc188bc 100644 --- a/img/app/default.nix +++ b/img/app/default.nix @@ -134,6 +134,8 @@ stdenvNoCC.mkDerivation { unsafeDiscardReferences = { out = true; }; + dontFixup = true; + meta = with lib; { license = licenses.eupl12; platforms = platforms.linux; diff --git a/release/checks/integration/default.nix b/release/checks/integration/default.nix index 570918613e083b0c2d7c82486544b6405ae5ea89..582a4be8df3098ddaf318b7dac60690c2f8b2304 100644 --- a/release/checks/integration/default.nix +++ b/release/checks/integration/default.nix @@ -37,6 +37,8 @@ let userData = runCommand "user-data.img" { nativeBuildInputs = [ e2fsprogs tar2ext4 ]; + unsafeDiscardReferences = true; + dontFixup = true; } '' tar -Pcvf root.tar \ --transform=s,^${appimage},test.appimage, ${appimage} \ diff --git a/release/combined/default.nix b/release/combined/default.nix index 5c917951f845ee94871a0532f3145493f8ee06ba..cb64f34bef9c397014d7303da39497e1216a2a62 100644 --- a/release/combined/default.nix +++ b/release/combined/default.nix @@ -31,6 +31,7 @@ let nativeBuildInputs = [ squashfs-tools-ng ]; __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; } '' sed 's,^${storeDir}/,,' ${writeClosure [ installer.store ]} | tar -C ${storeDir} -c --verbatim-files-from -T - \ @@ -64,6 +65,7 @@ let __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; passthru = { inherit grubCfg; }; } '' @@ -91,6 +93,7 @@ runCommand "spectrum-installer" { nativeBuildInputs = [ grub jq util-linux systemdMinimal ]; __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; passthru = { inherit eosimages esp installer rootfs; }; } '' blockSize() { diff --git a/release/combined/eosimages.nix b/release/combined/eosimages.nix index 351265bbd54a04b1c1fd3aa6f4c23dad57bd4395..0ac4c48374e7098a2b91f61fc07cebb2042ffbdc 100644 --- a/release/combined/eosimages.nix +++ b/release/combined/eosimages.nix @@ -10,6 +10,7 @@ runCommand "eosimages.img" { image = callSpectrumPackage ../live {}; __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; } '' mkdir dir cd dir diff --git a/release/live/default.nix b/release/live/default.nix index 7a856149de4c736fd850fa37b9f09db9715007a0..5320ce0ecbd7e8912d91f725327a4cfd3d456a54 100644 --- a/release/live/default.nix +++ b/release/live/default.nix @@ -63,6 +63,8 @@ stdenv.mkDerivation { unsafeDiscardReferences = { out = true; }; + dontFixup = true; + passthru = { inherit initramfs rootfs; }; } ) (_: {}) diff --git a/vm-lib/make-vm.nix b/vm-lib/make-vm.nix index 0812b8ea53404c620829fc79bb61005e0bc75b8d..ea7ace99034029325405bd237b8fd50e071bb358 100644 --- a/vm-lib/make-vm.nix +++ b/vm-lib/make-vm.nix @@ -31,6 +31,7 @@ runCommand "spectrum-vm" { __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; } '' mkdir -p $out/{blk,fs,providers} pushd "$out" diff --git a/vm/sys/net/default.nix b/vm/sys/net/default.nix index b8dc964dd75eccf230cac285dd2a32e7fd75dc9a..478545d2680025a99c2032689c6cc7011dc851c8 100644 --- a/vm/sys/net/default.nix +++ b/vm/sys/net/default.nix @@ -132,6 +132,8 @@ stdenvNoCC.mkDerivation { unsafeDiscardReferences = { out = true; }; + dontFixup = true; + passthru = { inherit firmware kernel packagesSysroot; }; meta = with lib; { --- base-commit: db54efac07deee32f39bdec4e4b8b73674df18c7 change-id: 20251025-dont-fixup-5389ba1b0b7f -- Sincerely, Demi Marie Obenour (she/her/hers)

3 3

[PATCH] release/checks/integration: adjust timeout when no KVM
by Alyssa Ross 26 Oct '25

26 Oct '25

We never use KVM for these on aarch64, but KVM may also not be used on x86_64 if it's unavailable. Checking for write access to /dev/kvm should be a decent proxy for that. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- Demi, hopefully this can make development on Qubes OS a bit less annoying (albiet still slow). release/checks/integration/default.nix | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/release/checks/integration/default.nix b/release/checks/integration/default.nix index 5709186..eb3be07 100644 --- a/release/checks/integration/default.nix +++ b/release/checks/integration/default.nix @@ -65,10 +65,11 @@ stdenv.mkDerivation (finalAttrs: { doCheck = true; dontAddTimeoutMultiplier = true; - mesonCheckFlags = lib.optionals stdenv.hostPlatform.isAarch64 [ - # Tests are run with TCG on aarch64. - "--timeout-multiplier=15" - ]; + preCheck = '' + if [ -n "$FORCE_LONG_TIMEOUTS" ] || ! [ -w /dev/kvm ]; then + mesonCheckFlagsArray+=(--timeout-multiplier=15) + fi + ''; installPhase = '' runHook preInstall @@ -83,6 +84,7 @@ stdenv.mkDerivation (finalAttrs: { env = { QEMU_SYSTEM = "qemu-system-${stdenv.hostPlatform.qemuArch} -nographic"; EFI_PATH = "${qemu_kvm}/share/qemu/edk2-${stdenv.hostPlatform.qemuArch}-code.fd"; + FORCE_LONG_TIMEOUTS = toString stdenv.buildPlatform.isAarch64; IMG_PATH = live; USER_DATA_PATH = userData; }; -- 2.51.0

1 0

[PATCH] scripts/make-erofs.sh: Standardize file modes in images
by Demi Marie Obenour 25 Oct '25

25 Oct '25

Enforce that anything under /var or /etc is 0755 for directories and executable files and 0644 for anything else. Enforce that anything else is 0555 for directories and executable files and 0444 for anything else. This avoids depending on factors that may depend on the build environment, such as the user's umask. This requires that /var always exist, so add it to img/app/Makefile. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/Makefile | 3 ++- img/app/Makefile | 2 +- scripts/make-erofs.sh | 21 +++++++++++++++++++++ 3 files changed, 24 insertions(+), 2 deletions(-) diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile index aa45ca1d5c18d0dfb78d19267f263cc4222e8e84..ba1beddabb46afa6b20e66177107fbe6b6f42bd2 100644 --- a/host/rootfs/Makefile +++ b/host/rootfs/Makefile @@ -40,7 +40,8 @@ DIRS = \ ext \ proc \ run \ - sys + sys \ + var FIFOS = etc/s6-linux-init/run-image/service/s6-svscan-log/fifo diff --git a/img/app/Makefile b/img/app/Makefile index 981889ebe55d9ba03228977f3dc0ea3f26d5c4fb..2540075fbb2cdcbcde29853cb0ffe676de0b9063 100644 --- a/img/app/Makefile +++ b/img/app/Makefile @@ -30,7 +30,7 @@ $(imgdir)/appvm/blk/root.img: ../../scripts/make-gpt.sh ../../scripts/sfdisk-fie build/rootfs.erofs:root:5460386f-2203-4911-8694-91400125c604:root mv $@.tmp $@ -DIRS = dev run proc sys tmp \ +DIRS = dev run proc sys tmp var \ etc/s6-linux-init/run-image/service \ etc/s6-linux-init/run-image/user \ etc/s6-linux-init/run-image/wait diff --git a/scripts/make-erofs.sh b/scripts/make-erofs.sh index ad04844387c880047a79f2f05e1e985d8bd4229c..5e283a380dbdae3dbfb83d43915e5015a2ae6f04 100755 --- a/scripts/make-erofs.sh +++ b/scripts/make-erofs.sh @@ -68,4 +68,25 @@ while read -r arg1; do cp -RT -- "$arg1" "$root/$arg2" done +# Ensure that the permissions in the image are independent +# of those in the git repository or Nix store, except for +# the executable bit. In particular, the mode of those +# outside the Nix store might depend on the user's umask. +# While the image itself is strictly read-only, it makes +# sense to populate an overlayfs over /etc and /var, and +# this overlayfs should be writable by root and readable +# by all users. The remaining paths should not be writable +# by anyone, but should be world-readable. +find "$root" \ + -path "$root/nix/store" -prune -o \ + -path "$root/etc" -prune -o \ + -path "$root/var" -prune -o \ + -type l -o \ + -type d -a -perm 0555 -o \ + -type f -a -perm 0444 -o \ + -execdir chmod ugo-w,ugo+rX -- '{}' + +find "$root/etc" "$root/var" ! -type l -execdir chmod u+w,go-w,ugo+rX -- '{}' + +chmod 0755 "$root" + +# Make the erofs image. mkfs.erofs -x-1 -b4096 --all-root "$@" "$root" --- base-commit: c5d5786d3dc938af0b279c542d1e43bce381b4b9 change-id: 20251021-fix-permissions-4549d0653368 -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

[PATCH v4 0/2] Fix build of forwarder, then improve it
by Demi Marie Obenour 25 Oct '25

25 Oct '25

The first patch fixes the build of the XDP forwarder and ensures it does not include any libc headers. The second patch is a significant cleanup and also should improve performance a tiny amount. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Changes in v4: - Use find_program instead of passing clang path as Meson option. - Use path to Linux kernel package instead of path to include directory. - Split the patch into two parts: a minimal one that just fixes the build, and a bigger one that refactors the BPF programs. - Link to v3: https://spectrum-os.org/lists/archives/spectrum-devel/20251008-fix-forwarde… Changes in v3: - Fix build. - Clean up XDP programs. - Link to v2: https://spectrum-os.org/lists/archives/spectrum-devel/20251006-fix-forwarde… Changes in v2: - Rewrite the programs to not use the helpers. - This doesn't build. Link to v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251003-fix-forwarde… --- Demi Marie Obenour (2): tools/xdp-forwarder: Do not include libc headers in eBPF programs tools/xdp-forwarder: Simplify forwarder programs tools/default.nix | 11 +- tools/meson.options | 4 + tools/xdp-forwarder/helpers.h | 54 +++++++ tools/xdp-forwarder/meson.build | 11 +- tools/xdp-forwarder/parsing_helpers.h | 274 ---------------------------------- tools/xdp-forwarder/prog_physical.c | 52 ++++--- tools/xdp-forwarder/prog_router.c | 48 ++++-- tools/xdp-forwarder/rewrite_helpers.h | 146 ------------------ 8 files changed, 138 insertions(+), 462 deletions(-) --- base-commit: c5d5786d3dc938af0b279c542d1e43bce381b4b9 change-id: 20251003-fix-forwarder-build-2889ea9aec91 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 4

Re: [systemd-devel] With UEFI secure boot and dm-verity, how does one find the user data partition?
by Demi Marie Obenour 20 Oct '25

20 Oct '25

On 10/20/25 14:20, Andrei Borzenkov wrote: > 20.10.2025 21:02, Demi Marie Obenour wrote: >> On 10/20/25 13:57, Andrei Borzenkov wrote: >>> 20.10.2025 20:33, Demi Marie Obenour wrote: >>>> On 10/19/25 11:36, Feli Flitzberg wrote: >>>>> Hi, long time watcher, first time poster. If the bootloader supports the Discoverable Partitions Specification, all that's needed is the correct partition GUID assigned to every partition. After that, you don't need to pass any partitions or use /etc/fstab as the bootloader will read the disk it came from to mount everything. The only major limitation is that your bootloader partition MUST live on the same disk as root and usr, otherwise they won't be found. Hope this helps! >>>> >>>> How can the OS know which block device the system was booted from? >>>> >>> >>> >>> Bootloader compliant with BLI sets the LoaderDevicePartUUID EFI >>> variable. Otherwise I assume it possible to get the current boot entry >>> number from the BootCurrent EFI variable and parse the corresponding >>> BootXXXX entry. >> >> Is this EFI variable the partition table UUID (which identifies a device) >> or a partition UUID (which does not)? > > It is what is printed by lsblk as partuuid. Unfortunately this isn't what is needed. Looks like UEFI variable storage is the best option. -- Sincerely, Demi Marie Obenour (she/her/hers)

3 3

[PATCH] tools/xdp-forwarder: Fix build
by Demi Marie Obenour 18 Oct '25

18 Oct '25

Clang complains that it can't fine gnu-stubs32.h. Drop the ICMP parsing code to avoid this error. No functional change as the code is not actually used. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- tools/xdp-forwarder/parsing_helpers.h | 57 ----------------------------------- 1 file changed, 57 deletions(-) diff --git a/tools/xdp-forwarder/parsing_helpers.h b/tools/xdp-forwarder/parsing_helpers.h index da099346008bd58485af8308feb4d3391ceef8f5..1ea822100fdb9a75c2d28d34d93e6bb2b5d3ae26 100644 --- a/tools/xdp-forwarder/parsing_helpers.h +++ b/tools/xdp-forwarder/parsing_helpers.h @@ -26,8 +26,6 @@ #include <linux/if_packet.h> #include <linux/ip.h> #include <linux/ipv6.h> -#include <linux/icmp.h> -#include <linux/icmpv6.h> #include <linux/udp.h> #include <linux/tcp.h> @@ -46,16 +44,6 @@ struct vlan_hdr { __be16 h_vlan_encapsulated_proto; }; -/* - * Struct icmphdr_common represents the common part of the icmphdr and icmp6hdr - * structures. - */ -struct icmphdr_common { - __u8 type; - __u8 code; - __sum16 cksum; -}; - /* Allow users of header file to redefine VLAN max depth */ #ifndef VLAN_MAX_DEPTH #define VLAN_MAX_DEPTH 2 @@ -175,51 +163,6 @@ static __always_inline int parse_iphdr(struct hdr_cursor *nh, return iph->protocol; } -static __always_inline int parse_icmp6hdr(struct hdr_cursor *nh, - void *data_end, - struct icmp6hdr **icmp6hdr) -{ - struct icmp6hdr *icmp6h = nh->pos; - - if (icmp6h + 1 > data_end) - return -1; - - nh->pos = icmp6h + 1; - *icmp6hdr = icmp6h; - - return icmp6h->icmp6_type; -} - -static __always_inline int parse_icmphdr(struct hdr_cursor *nh, - void *data_end, - struct icmphdr **icmphdr) -{ - struct icmphdr *icmph = nh->pos; - - if (icmph + 1 > data_end) - return -1; - - nh->pos = icmph + 1; - *icmphdr = icmph; - - return icmph->type; -} - -static __always_inline int parse_icmphdr_common(struct hdr_cursor *nh, - void *data_end, - struct icmphdr_common **icmphdr) -{ - struct icmphdr_common *h = nh->pos; - - if (h + 1 > data_end) - return -1; - - nh->pos = h + 1; - *icmphdr = h; - - return h->type; -} - /* * parse_udphdr: parse the udp header and return the length of the udp payload */ --- base-commit: c5d5786d3dc938af0b279c542d1e43bce381b4b9 change-id: 20251003-fix-forwarder-build-2889ea9aec91 -- Sincerely, Demi Marie Obenour (she/her/hers)

2 6

Build failures against staging
by Yureka 12 Oct '25

12 Oct '25

Hello everyone, I attempted to build a spectrum (rev. c5d5786d3dc938af0b279c542d1e43bce381b4b9) image against nixpkgs staging (rev eb681f8139a93020f51b8256fc7dfe057b44747f) on x86_64. Here are the derivations which failed to build, for further investigation: - /nix/store/cbjmszj7r5r0abka3jsr6pijxba0sd2q-iproute2-6.17.0.drv (pkgsMusl.iproute2) - /nix/store/f1cc5abbfjslqvy6wkzrzsmsjj4hpk6h-openssl-static-x86_64-unknown-linux-musl-3.6.0.drv (pkgsStatic.openssl) The following also fail, but seem to have no specific connection spectrum or pkgsMusl/pkgsStatic (the GNU counterparts are broken on staging with the same error): - /nix/store/g0bklsp2daxxq74pkb3mqjcrb919194i-python3.13-inkex-1.4.2.drv (python3.pkgs.inkex) - /nix/store/nfwcjnbp6rv4cgzrxdqljc1k1h72z3kk-python3.13-cryptography-vectors-46.0.1.drv (python3.pkgs.cryptography.vectors) - /nix/store/36674wi2rkanm2ds2bx1183w7knj9mr0-wasilibc-static-wasm32-unknown-wasi-27.drv (pkgsCross.wasi32.stdenv.cc.libc, needed for firefox) I hope this is useful to catch any problems affecting spectrum before the following staging-next cycle. — Yureka

2 2