October 2025 - Spectrum Development

[PATCH 0/7] System updates based on systemd-sysupdate
by Demi Marie Obenour 30 Nov '25

30 Nov '25

This implements updates via systemd-sysupdate. See individual commit messages for details. There are major changes to the image build process. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Demi Marie Obenour (7): host/rootfs: Use full util-linux and systemd release/combined: Compress installation image tools: Add directory checker for updates Adjust partition layout to support updates release: add install step Factor out dm-verity build rules Support updates via systemd-sysupdate host/initramfs/Makefile | 17 ++-- host/initramfs/default.nix | 2 + host/initramfs/etc/init | 17 ++-- host/initramfs/etc/probe | 20 +++-- host/initramfs/shell.nix | 1 + host/rootfs/Makefile | 54 ++++++------- host/rootfs/default.nix | 64 +++++++-------- host/rootfs/file-list.mk | 5 ++ host/rootfs/image/etc/fstab | 1 + .../image/etc/sysupdate.d/50-verity.transfer | 21 +++++ host/rootfs/image/etc/sysupdate.d/60-root.transfer | 21 +++++ .../image/etc/sysupdate.d/70-kernel.transfer | 25 ++++++ host/rootfs/image/usr/bin/run-update | 54 +++++++++++++ host/rootfs/image/usr/bin/update | 56 +++++++++++++ host/rootfs/image/usr/bin/vm-start | 25 +++++- host/rootfs/os-release.in | 13 +++ host/rootfs/os-release.in.license | 2 + host/rootfs/shell.nix | 3 +- img/app/Makefile | 2 +- img/app/default.nix | 5 +- lib/kcmdline-utils.mk | 8 ++ lib/verity.mk | 18 +++++ lib/version.nix | 15 ++++ release/checks/integration/default.nix | 2 +- release/checks/integration/meson.build | 2 +- release/checks/no-roothash.nix | 2 +- release/combined/eosimages.nix | 16 ++-- release/live/Makefile | 46 +++++------ release/live/default.nix | 17 ++-- release/live/shell.nix | 4 +- scripts/format-uuid.awk | 35 ++++++++ scripts/format-uuid.sh | 1 + scripts/make-gpt.bash | 72 +++++++++++++++++ scripts/make-gpt.sh | 67 +-------------- scripts/make-live-image.sh | 41 ++++++++++ scripts/sfdisk-field.awk | 3 +- tools/default.nix | 1 + tools/meson.build | 1 + tools/updates-dir-check/meson.build | 4 + tools/updates-dir-check/updates-dir-check.c | 94 ++++++++++++++++++++++ update-signing-keys.gpg | 1 + update-signing-keys.gpg.license | 2 + update-url | 1 + update-url.license | 2 + version | 1 + version.license | 2 + vm/app/sysupdate.d/50-verity.transfer | 18 +++++ vm/app/sysupdate.d/60-root.transfer | 18 +++++ vm/app/sysupdate.d/70-kernel.transfer | 18 +++++ vm/app/updates.nix | 57 +++++++++++++ vm/sys/net/Makefile | 2 +- vm/sys/net/default.nix | 5 +- 52 files changed, 782 insertions(+), 202 deletions(-) --- base-commit: 11c411139e006ddf6ce074c22c30a0bb9b6fb76e change-id: 20250928-updates-92e99849e231 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 176

[PATCH 0/2] release/checks/shfmt: init
by Alyssa Ross 09 Nov '25

09 Nov '25

The default formatting seems unobjectionable to me, but if anybody wants to lobby for different sh formatting rules, now's the time. :) Alyssa Ross (2): scripts: format with shfmt release/checks/shfmt: init release/checks/default.nix | 2 + release/checks/shfmt.nix | 15 +++++ scripts/dist-cloud-hypervisor.sh | 4 +- scripts/format-uuid.sh | 2 +- scripts/make-erofs.sh | 8 +-- scripts/run-qemu.sh | 109 ++++++++++++++++--------------- scripts/update-nixpkgs.sh | 4 +- 7 files changed, 81 insertions(+), 63 deletions(-) create mode 100644 release/checks/shfmt.nix base-commit: e9480cfdf8cba16d0e0b8ee2db3a916979804db9 -- 2.51.0

3 6

[PATCH] release/checks/integration: add nc timeout
by Alyssa Ross 02 Nov '25

02 Nov '25

I recently saw a transient timeout of this test. Looking at the logs, it seems like, before netvm was rebooted, nc was already running, and that nc never failed, getting stuck. Presumably, if it had failed, another nc run would have connected successfully. Avoid this by setting a 2 second timeout for nc to ensure this eternal hang can't happen. Reported-by: Demi Marie Obenour <demiobenour(a)gmail.com> Link: https://spectrum-os.org/lists/archives/spectrum-devel/f52c1aa7-96c0-462b-92… Fixes: ae45978 ("release/checks/networking: init") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- release/checks/integration/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/release/checks/integration/default.nix b/release/checks/integration/default.nix index 340fb6e..81db264 100644 --- a/release/checks/integration/default.nix +++ b/release/checks/integration/default.nix @@ -19,7 +19,7 @@ let type = "nix"; run = writeShellScript "run" '' set -x - while :; do echo hello | ${libressl.nc}/bin/nc -N 10.0.2.2 1234; done + while :; do echo hello | ${libressl.nc}/bin/nc -Nw 2 10.0.2.2 1234; done ''; }; base-commit: b1bb4e5050b09a8edcafc0cf1b1b9c9ab42832bc -- 2.51.0

3 2

Partitioning in the installer
by Demi Marie Obenour 01 Nov '25

01 Nov '25

I'm working on updates and am very close to getting something that at least runs. However, the installer doesn't support more than three partitions, so I have to create the others manually. Where would the best place to address this be? I'm not sure if this needs a patch to the installer's C source code, or if I should fix it in a script somewhere. -- Sincerely, Demi Marie Obenour (she/her/hers)

3 5

[PATCH 0/3] Switch from mdevd to systemd-udevd in root filesystem
by Demi Marie Obenour 01 Nov '25

01 Nov '25

systemd-udevd provides support for significantly more hardware than mdevd does. Therefore, switch to it. The last patch intentionally uses some packages built with glibc to avoid having to build the world from source. The use of glibc isn't essential and is just because not using the binary cache to build is very, very slow. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Demi Marie Obenour (3): host/rootfs: Add early serial output tools: Add adapter tool for services using sd_notify host/rootfs: switch to systemd-udevd host/rootfs/Makefile | 18 +- host/rootfs/default.nix | 94 +--- host/rootfs/etc/init | 2 +- host/rootfs/etc/mdev.conf | 7 - host/rootfs/etc/mdev/listen | 2 +- host/rootfs/etc/mdev/net/add | 1 + host/rootfs/etc/s6-rc/mdevd-coldplug/dependencies | 4 - host/rootfs/etc/s6-rc/mdevd-coldplug/up | 4 - host/rootfs/etc/s6-rc/mdevd/run | 5 - host/rootfs/etc/s6-rc/ok-all/contents | 2 +- .../dependencies.d/systemd-udevd | 0 .../type | 0 .../type.license | 0 host/rootfs/etc/s6-rc/systemd-udevd-coldplug/up | 3 + host/rootfs/etc/s6-rc/systemd-udevd/flag-essential | 0 .../s6-rc/{mdevd => systemd-udevd}/notification-fd | 0 .../notification-fd.license | 0 host/rootfs/etc/s6-rc/systemd-udevd/run | 10 + .../rootfs/etc/s6-rc/{mdevd => systemd-udevd}/type | 0 .../s6-rc/{mdevd => systemd-udevd}/type.license | 0 host/rootfs/etc/s6-rc/vmm-env/contents | 1 + host/rootfs/etc/s6-rc/weston/dependencies | 4 - .../weston/dependencies.d/systemd-udevd-coldplug | 0 host/rootfs/etc/udev/rules.d/99-spectrum.rules | 5 + tools/default.nix | 1 + tools/meson.build | 1 + tools/sd-notify-adapter/meson.build | 4 + tools/sd-notify-adapter/sd-notify-adapter.c | 490 +++++++++++++++++++++ 28 files changed, 552 insertions(+), 106 deletions(-) --- base-commit: 31121b718d94229809b53c31bfbb0353b6c3d0d1 change-id: 20250911-udev-24cf4bf68fbe -- Sincerely, Demi Marie Obenour (she/her/hers)

3 50

Best practices for submitting tree-wide changes
by Demi Marie Obenour 01 Nov '25

01 Nov '25

In some cases, the same change should be made to many parts of the codebase. This includes things like adding set -o pipefail to shell scripts or moving command substitutions to their own commands. Should one send a single patch that makes all the changes, or should one send a bunch of tiny patches? Preferably, the answer should be added to the documentation so people don't need to ask again :) -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

[PATCH 1/2] vm/sys/net: build against pkgsMusl
by Yureka Lilian 31 Oct '25

31 Oct '25

Some of the following changes do not work with pkgsStatic, specifically it is difficult to link libbpf statically[1]. [1] https://lists.fedorahosted.org/archives/list/elfutils-devel@lists.fedorahos… Signed-off-by: Yureka Lilian <yureka(a)cyberchaos.dev> Reviewed-by: Alyssa Ross <hi(a)alyssa.is> --- vm/sys/net/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/vm/sys/net/default.nix b/vm/sys/net/default.nix index b8dc964..4cdb1c4 100644 --- a/vm/sys/net/default.nix +++ b/vm/sys/net/default.nix @@ -2,8 +2,8 @@ # SPDX-FileCopyrightText: 2021-2023 Alyssa Ross <hi(a)alyssa.is> import ../../../lib/call-package.nix ( -{ spectrum-build-tools, src, terminfo, pkgsStatic }: -pkgsStatic.callPackage ( +{ spectrum-build-tools, src, terminfo, pkgsMusl }: +pkgsMusl.callPackage ( { lib, stdenvNoCC, nixos, runCommand, writeClosure , erofs-utils, jq, s6-rc, util-linux, xorg -- 2.51.0

4 8

[PATCH] Add dontFixup=true to derivations that build images
by Demi Marie Obenour 28 Oct '25

28 Oct '25

This prevents lengthy and pointless scans of large image files. dontFixup is added to the derivations that already used unsafeDiscardReferences. Both dontFixup and unsafeDiscardReferences are added to a derivation that builds an ext4 filesystem image. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/initramfs/default.nix | 3 +++ host/rootfs/default.nix | 1 + img/app/default.nix | 2 ++ release/checks/integration/default.nix | 2 ++ release/combined/default.nix | 3 +++ release/combined/eosimages.nix | 1 + release/live/default.nix | 2 ++ vm-lib/make-vm.nix | 1 + vm/sys/net/default.nix | 2 ++ 9 files changed, 17 insertions(+) diff --git a/host/initramfs/default.nix b/host/initramfs/default.nix index a3672bfeb7002f81bf67bfc13c0b757d46b93d66..51305a7da1645ca63f1c9b2f07a15aa0d5659ff2 100644 --- a/host/initramfs/default.nix +++ b/host/initramfs/default.nix @@ -63,6 +63,7 @@ let nativeBuildInputs = [ cpio ]; __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; } '' cpio -id < ${microcodeAmd}/amd-ucode.img cpio -id < ${microcodeIntel}/intel-ucode.img @@ -82,6 +83,7 @@ let __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; } '' cd ${packagesSysroot} (printf "%s\n" "''${storePrefixes[@]}" && find . $(< $storePaths)) | @@ -118,6 +120,7 @@ stdenvNoCC.mkDerivation { __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; passthru = { inherit packagesSysroot; }; } diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix index 484a43f372f934e6b3be0c383d12c9eabf2f7171..1673a83e9d70da6f22fa71c4a79e0eaeff309fc2 100644 --- a/host/rootfs/default.nix +++ b/host/rootfs/default.nix @@ -195,6 +195,7 @@ stdenvNoCC.mkDerivation { __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; passthru = { inherit appvm firmware kernel nixosAllHardware packagesSysroot pkgsGui; diff --git a/img/app/default.nix b/img/app/default.nix index 2863cbdfc067c8a6de018e5f0920d00878cf96ff..5cd381e837db3057590c075cf2b33a486cc188bc 100644 --- a/img/app/default.nix +++ b/img/app/default.nix @@ -134,6 +134,8 @@ stdenvNoCC.mkDerivation { unsafeDiscardReferences = { out = true; }; + dontFixup = true; + meta = with lib; { license = licenses.eupl12; platforms = platforms.linux; diff --git a/release/checks/integration/default.nix b/release/checks/integration/default.nix index 570918613e083b0c2d7c82486544b6405ae5ea89..582a4be8df3098ddaf318b7dac60690c2f8b2304 100644 --- a/release/checks/integration/default.nix +++ b/release/checks/integration/default.nix @@ -37,6 +37,8 @@ let userData = runCommand "user-data.img" { nativeBuildInputs = [ e2fsprogs tar2ext4 ]; + unsafeDiscardReferences = true; + dontFixup = true; } '' tar -Pcvf root.tar \ --transform=s,^${appimage},test.appimage, ${appimage} \ diff --git a/release/combined/default.nix b/release/combined/default.nix index 5c917951f845ee94871a0532f3145493f8ee06ba..cb64f34bef9c397014d7303da39497e1216a2a62 100644 --- a/release/combined/default.nix +++ b/release/combined/default.nix @@ -31,6 +31,7 @@ let nativeBuildInputs = [ squashfs-tools-ng ]; __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; } '' sed 's,^${storeDir}/,,' ${writeClosure [ installer.store ]} | tar -C ${storeDir} -c --verbatim-files-from -T - \ @@ -64,6 +65,7 @@ let __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; passthru = { inherit grubCfg; }; } '' @@ -91,6 +93,7 @@ runCommand "spectrum-installer" { nativeBuildInputs = [ grub jq util-linux systemdMinimal ]; __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; passthru = { inherit eosimages esp installer rootfs; }; } '' blockSize() { diff --git a/release/combined/eosimages.nix b/release/combined/eosimages.nix index 351265bbd54a04b1c1fd3aa6f4c23dad57bd4395..0ac4c48374e7098a2b91f61fc07cebb2042ffbdc 100644 --- a/release/combined/eosimages.nix +++ b/release/combined/eosimages.nix @@ -10,6 +10,7 @@ runCommand "eosimages.img" { image = callSpectrumPackage ../live {}; __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; } '' mkdir dir cd dir diff --git a/release/live/default.nix b/release/live/default.nix index 7a856149de4c736fd850fa37b9f09db9715007a0..5320ce0ecbd7e8912d91f725327a4cfd3d456a54 100644 --- a/release/live/default.nix +++ b/release/live/default.nix @@ -63,6 +63,8 @@ stdenv.mkDerivation { unsafeDiscardReferences = { out = true; }; + dontFixup = true; + passthru = { inherit initramfs rootfs; }; } ) (_: {}) diff --git a/vm-lib/make-vm.nix b/vm-lib/make-vm.nix index 0812b8ea53404c620829fc79bb61005e0bc75b8d..ea7ace99034029325405bd237b8fd50e071bb358 100644 --- a/vm-lib/make-vm.nix +++ b/vm-lib/make-vm.nix @@ -31,6 +31,7 @@ runCommand "spectrum-vm" { __structuredAttrs = true; unsafeDiscardReferences = { out = true; }; + dontFixup = true; } '' mkdir -p $out/{blk,fs,providers} pushd "$out" diff --git a/vm/sys/net/default.nix b/vm/sys/net/default.nix index b8dc964dd75eccf230cac285dd2a32e7fd75dc9a..478545d2680025a99c2032689c6cc7011dc851c8 100644 --- a/vm/sys/net/default.nix +++ b/vm/sys/net/default.nix @@ -132,6 +132,8 @@ stdenvNoCC.mkDerivation { unsafeDiscardReferences = { out = true; }; + dontFixup = true; + passthru = { inherit firmware kernel packagesSysroot; }; meta = with lib; { --- base-commit: db54efac07deee32f39bdec4e4b8b73674df18c7 change-id: 20251025-dont-fixup-5389ba1b0b7f -- Sincerely, Demi Marie Obenour (she/her/hers)

3 3

[PATCH] release/checks/integration: adjust timeout when no KVM
by Alyssa Ross 26 Oct '25

26 Oct '25

We never use KVM for these on aarch64, but KVM may also not be used on x86_64 if it's unavailable. Checking for write access to /dev/kvm should be a decent proxy for that. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- Demi, hopefully this can make development on Qubes OS a bit less annoying (albiet still slow). release/checks/integration/default.nix | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/release/checks/integration/default.nix b/release/checks/integration/default.nix index 5709186..eb3be07 100644 --- a/release/checks/integration/default.nix +++ b/release/checks/integration/default.nix @@ -65,10 +65,11 @@ stdenv.mkDerivation (finalAttrs: { doCheck = true; dontAddTimeoutMultiplier = true; - mesonCheckFlags = lib.optionals stdenv.hostPlatform.isAarch64 [ - # Tests are run with TCG on aarch64. - "--timeout-multiplier=15" - ]; + preCheck = '' + if [ -n "$FORCE_LONG_TIMEOUTS" ] || ! [ -w /dev/kvm ]; then + mesonCheckFlagsArray+=(--timeout-multiplier=15) + fi + ''; installPhase = '' runHook preInstall @@ -83,6 +84,7 @@ stdenv.mkDerivation (finalAttrs: { env = { QEMU_SYSTEM = "qemu-system-${stdenv.hostPlatform.qemuArch} -nographic"; EFI_PATH = "${qemu_kvm}/share/qemu/edk2-${stdenv.hostPlatform.qemuArch}-code.fd"; + FORCE_LONG_TIMEOUTS = toString stdenv.buildPlatform.isAarch64; IMG_PATH = live; USER_DATA_PATH = userData; }; -- 2.51.0

1 0

[PATCH] scripts/make-erofs.sh: Standardize file modes in images
by Demi Marie Obenour 25 Oct '25

25 Oct '25

Enforce that anything under /var or /etc is 0755 for directories and executable files and 0644 for anything else. Enforce that anything else is 0555 for directories and executable files and 0444 for anything else. This avoids depending on factors that may depend on the build environment, such as the user's umask. This requires that /var always exist, so add it to img/app/Makefile. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/Makefile | 3 ++- img/app/Makefile | 2 +- scripts/make-erofs.sh | 21 +++++++++++++++++++++ 3 files changed, 24 insertions(+), 2 deletions(-) diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile index aa45ca1d5c18d0dfb78d19267f263cc4222e8e84..ba1beddabb46afa6b20e66177107fbe6b6f42bd2 100644 --- a/host/rootfs/Makefile +++ b/host/rootfs/Makefile @@ -40,7 +40,8 @@ DIRS = \ ext \ proc \ run \ - sys + sys \ + var FIFOS = etc/s6-linux-init/run-image/service/s6-svscan-log/fifo diff --git a/img/app/Makefile b/img/app/Makefile index 981889ebe55d9ba03228977f3dc0ea3f26d5c4fb..2540075fbb2cdcbcde29853cb0ffe676de0b9063 100644 --- a/img/app/Makefile +++ b/img/app/Makefile @@ -30,7 +30,7 @@ $(imgdir)/appvm/blk/root.img: ../../scripts/make-gpt.sh ../../scripts/sfdisk-fie build/rootfs.erofs:root:5460386f-2203-4911-8694-91400125c604:root mv $@.tmp $@ -DIRS = dev run proc sys tmp \ +DIRS = dev run proc sys tmp var \ etc/s6-linux-init/run-image/service \ etc/s6-linux-init/run-image/user \ etc/s6-linux-init/run-image/wait diff --git a/scripts/make-erofs.sh b/scripts/make-erofs.sh index ad04844387c880047a79f2f05e1e985d8bd4229c..5e283a380dbdae3dbfb83d43915e5015a2ae6f04 100755 --- a/scripts/make-erofs.sh +++ b/scripts/make-erofs.sh @@ -68,4 +68,25 @@ while read -r arg1; do cp -RT -- "$arg1" "$root/$arg2" done +# Ensure that the permissions in the image are independent +# of those in the git repository or Nix store, except for +# the executable bit. In particular, the mode of those +# outside the Nix store might depend on the user's umask. +# While the image itself is strictly read-only, it makes +# sense to populate an overlayfs over /etc and /var, and +# this overlayfs should be writable by root and readable +# by all users. The remaining paths should not be writable +# by anyone, but should be world-readable. +find "$root" \ + -path "$root/nix/store" -prune -o \ + -path "$root/etc" -prune -o \ + -path "$root/var" -prune -o \ + -type l -o \ + -type d -a -perm 0555 -o \ + -type f -a -perm 0444 -o \ + -execdir chmod ugo-w,ugo+rX -- '{}' + +find "$root/etc" "$root/var" ! -type l -execdir chmod u+w,go-w,ugo+rX -- '{}' + +chmod 0755 "$root" + +# Make the erofs image. mkfs.erofs -x-1 -b4096 --all-root "$@" "$root" --- base-commit: c5d5786d3dc938af0b279c542d1e43bce381b4b9 change-id: 20251021-fix-permissions-4549d0653368 -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1