November 2025 - Spectrum Development

[PATCH 1/2] scripts/make-gpt.sh: set -o pipefail
by Alyssa Ross 29 Nov '25

29 Nov '25

Wasn't POSIX at the time this script was originally written! Suggested-by: Demi Marie Obenour <demiobenour(a)gmail.com> Link: https://spectrum-os.org/lists/archives/spectrum-devel/20251127174054.205683… Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- scripts/make-gpt.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/scripts/make-gpt.sh b/scripts/make-gpt.sh index 3cae441..e39828b 100755 --- a/scripts/make-gpt.sh +++ b/scripts/make-gpt.sh @@ -1,4 +1,4 @@ -#!/bin/sh -eu +#!/bin/sh -- # # SPDX-FileCopyrightText: 2021-2023 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2022 Unikie @@ -6,6 +6,8 @@ # # usage: make-gpt.sh GPT_PATH PATH:PARTTYPE[:PARTUUID[:PARTLABEL]]... +set -euo pipefail + ONE_MiB=1048576 # Prints the number of 1MiB blocks required to store the file named base-commit: d76e9b29aea9f31238d07e21db50d3fe6a80da5a -- 2.51.0

2 3

[PATCH v2] scripts/make-gpt.sh: allow setting partition size
by Alyssa Ross 28 Nov '25

28 Nov '25

We want non-minimally-sized partitions to leave space for updates. All such partitions will also be labelled, so we can just add another optional field at the end. Since we don't parse partition specifications in sh, we can't keep a running total any more, so instead we just go through the table at the end and add up all the sizes, taking advantage of our knowledge that the size will always be the last thing in each line in our tables. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> Message-ID: <20251127174054.2056835-2-hi(a)alyssa.is> --- v2: fix conflicts after applying Demi's optimization, and avoid awk to sum partition sizes, taking inspiration from the same. v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251127174054.205683… scripts/make-gpt.sh | 30 ++++++++++++++++++------------ scripts/sfdisk-field.awk | 22 +++++++++++++++++----- 2 files changed, 35 insertions(+), 17 deletions(-) diff --git a/scripts/make-gpt.sh b/scripts/make-gpt.sh index 3cae441..cb19868 100755 --- a/scripts/make-gpt.sh +++ b/scripts/make-gpt.sh @@ -1,10 +1,10 @@ #!/bin/sh -eu # -# SPDX-FileCopyrightText: 2021-2023 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2021-2023, 2025 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2022 Unikie # SPDX-License-Identifier: EUPL-1.2+ # -# usage: make-gpt.sh GPT_PATH PATH:PARTTYPE[:PARTUUID[:PARTLABEL]]... +# usage: make-gpt.sh GPT_PATH PATH:PARTTYPE[:PARTUUID[:PARTLABEL[:PARTMiB]]]... ONE_MiB=1048576 @@ -33,21 +33,27 @@ scriptsDir="$(dirname "$0")" out="$1" shift -nl=' -' -table="label: gpt" +table=$(for partition; do + awk -f "$scriptsDir/sfdisk-field.awk" \ + -v partition="$partition" \ + -v size="$(sizeMiB "${partition%%:*}")" +done) # Keep 1MiB free at the start, and 1MiB free at the end. -gptBytes=$((ONE_MiB * 2)) -for partition; do - sizeMiB="$(sizeMiB "${partition%%:*}")" - table="$table${nl}size=${sizeMiB}MiB,$(awk -f "$scriptsDir/sfdisk-field.awk" -v partition="$partition")" - gptBytes="$((gptBytes + sizeMiB * ONE_MiB))" -done +gptMiB=2 +while read -r partition; do + # Here we rely on sfdisk-field.awk always putting size last. + : $((gptMiB += ${partition##*=})) +done <<EOF +$table +EOF rm -f "$out" -truncate -s "$gptBytes" "$out" +truncate -s "${gptMiB}M" "$out" + sfdisk --no-reread --no-tell-kernel "$out" <<EOF +label: gpt +sector-size: $ONE_MiB $table EOF diff --git a/scripts/sfdisk-field.awk b/scripts/sfdisk-field.awk index e13c86d..78b438e 100644 --- a/scripts/sfdisk-field.awk +++ b/scripts/sfdisk-field.awk @@ -1,7 +1,7 @@ #!/usr/bin/awk -f # # SPDX-License-Identifier: EUPL-1.2+ -# SPDX-FileCopyrightText: 2022, 2024 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2022, 2024-2025 Alyssa Ross <hi(a)alyssa.is> BEGIN { types["root.aarch64"] = "b921b045-1df0-41c3-af44-4c6f280d3fae" @@ -9,12 +9,11 @@ BEGIN { types["verity.aarch64"] = "df3300ce-d69f-4c92-978c-9bfb0f38d820" types["verity.x86_64"] = "2c7357ed-ebd2-46d9-aec1-23d437ec2bf5" - # Field #1 is the partition path, which make-gpt.sh will turn into - # the size field. Since it's handled elsewhere, we skip that - # first field. + # Field #1 is the partition path, which is read by make-gpt.sh + # but not relevant for running sfdisk, so skip it. skip=1 - split("type uuid name", keys) + split("type uuid name size", keys) split(partition, fields, ":") arch = ENVIRON["ARCH"] @@ -31,8 +30,21 @@ BEGIN { if (keys[n - skip] == "type") { if (uuid = types[fields[n] "." arch]) fields[n] = uuid + } else if (keys[n - skip] == "size") { + if (fields[n] < size) { + printf "%s MiB partition content is too big for %s MiB partition\n", + size, fields[n] > "/dev/stderr" + exit 1 + } + + size = fields[n] + continue # Handled at the end. } printf "%s=%s,", keys[n - skip], fields[n] } + + # Always output a size field, either supplied in input or + # default value of the size variable. + printf "size=%s\n", size } base-commit: 1970f432152730ec19bf97a8db4613a591ee00be -- 2.51.0

2 7

[PATCH] scripts/make-gpt.sh: allow setting partition size
by Alyssa Ross 28 Nov '25

28 Nov '25

We want non-minimally-sized partitions to leave space for updates. All such partitions will also be labelled, so we can just add another optional field at the end. Since we don't parse partition specifications in sh, we can't keep a running total any more, so instead we just go through the table at the end and add up all the sizes, taking advantage of our knowledge that the size will always be the last thing in each line in our tables. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- This is an alternative to Demi's implementation[1], which required Bash features. [1]: https://spectrum-os.org/lists/archives/spectrum-devel/20251126-updates-v5-3… scripts/make-gpt.sh | 28 +++++++++++++++------------- scripts/sfdisk-field.awk | 22 +++++++++++++++++----- 2 files changed, 32 insertions(+), 18 deletions(-) diff --git a/scripts/make-gpt.sh b/scripts/make-gpt.sh index 96f0d2c..07eac50 100755 --- a/scripts/make-gpt.sh +++ b/scripts/make-gpt.sh @@ -1,10 +1,10 @@ #!/bin/sh -eu # -# SPDX-FileCopyrightText: 2021-2023 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2021-2023, 2025 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2022 Unikie # SPDX-License-Identifier: EUPL-1.2+ # -# usage: make-gpt.sh GPT_PATH PATH:PARTTYPE[:PARTUUID[:PARTLABEL]]... +# usage: make-gpt.sh GPT_PATH PATH:PARTTYPE[:PARTUUID[:PARTLABEL[:PARTMiB]]]... ONE_MiB=1048576 @@ -28,7 +28,8 @@ fillPartition() { lseek -S 1 "$start" cat "$3" 1<>"$1" } -# Prints the partition path from a PATH:PARTTYPE[:PARTUUID[:PARTLABEL]] string. +# Prints the partition path from a +# PATH:PARTTYPE[:PARTUUID[:PARTLABEL[:PARTMiB]]] string. partitionPath() { awk -F: '{print $1}' <<EOF $1 @@ -40,21 +41,22 @@ scriptsDir="$(dirname "$0")" out="$1" shift -nl=' -' -table="label: gpt" +table=$(for partition; do + awk -f "$scriptsDir/sfdisk-field.awk" \ + -v partition="$partition" \ + -v size="$(sizeMiB "$(partitionPath "$partition")")" +done) # Keep 1MiB free at the start, and 1MiB free at the end. -gptBytes=$((ONE_MiB * 2)) -for partition; do - sizeMiB="$(sizeMiB "$(partitionPath "$partition")")" - table="$table${nl}size=${sizeMiB}MiB,$(awk -f "$scriptsDir/sfdisk-field.awk" -v partition="$partition")" - gptBytes="$((gptBytes + sizeMiB * ONE_MiB))" -done +# Here we rely on sfdisk-field.awk always putting size last +gptMiB=$(printf "%s\n" "$table" | awk -F= '{size += $NF} END {print size + 2}') rm -f "$out" -truncate -s "$gptBytes" "$out" +truncate -s "${gptMiB}M" "$out" + sfdisk --no-reread --no-tell-kernel "$out" <<EOF +label: gpt +sector-size: $ONE_MiB $table EOF diff --git a/scripts/sfdisk-field.awk b/scripts/sfdisk-field.awk index e13c86d..78b438e 100644 --- a/scripts/sfdisk-field.awk +++ b/scripts/sfdisk-field.awk @@ -1,7 +1,7 @@ #!/usr/bin/awk -f # # SPDX-License-Identifier: EUPL-1.2+ -# SPDX-FileCopyrightText: 2022, 2024 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2022, 2024-2025 Alyssa Ross <hi(a)alyssa.is> BEGIN { types["root.aarch64"] = "b921b045-1df0-41c3-af44-4c6f280d3fae" @@ -9,12 +9,11 @@ BEGIN { types["verity.aarch64"] = "df3300ce-d69f-4c92-978c-9bfb0f38d820" types["verity.x86_64"] = "2c7357ed-ebd2-46d9-aec1-23d437ec2bf5" - # Field #1 is the partition path, which make-gpt.sh will turn into - # the size field. Since it's handled elsewhere, we skip that - # first field. + # Field #1 is the partition path, which is read by make-gpt.sh + # but not relevant for running sfdisk, so skip it. skip=1 - split("type uuid name", keys) + split("type uuid name size", keys) split(partition, fields, ":") arch = ENVIRON["ARCH"] @@ -31,8 +30,21 @@ BEGIN { if (keys[n - skip] == "type") { if (uuid = types[fields[n] "." arch]) fields[n] = uuid + } else if (keys[n - skip] == "size") { + if (fields[n] < size) { + printf "%s MiB partition content is too big for %s MiB partition\n", + size, fields[n] > "/dev/stderr" + exit 1 + } + + size = fields[n] + continue # Handled at the end. } printf "%s=%s,", keys[n - skip], fields[n] } + + # Always output a size field, either supplied in input or + # default value of the size variable. + printf "size=%s\n", size } base-commit: c43e5c63a028994d5f66a15db19f415bf3cb7736 -- 2.51.0

2 2

[PATCH] host: Configure s6-linux-init-shutdownd
by Johannes Süllner 28 Nov '25

28 Nov '25

Makes shutdown and reboot of the Spectrum host using `s6-linux-init-hpr` possible. Before, it would fail with "fatal: unable to talk to shutdownd: Operation not permitted". Pretty much just copied from commit 18b19f4dfdb1376d90f70f526052011502b97c40, where this was added to application VMs, but not to the host. Signed-off-by: Johannes Süllner <johannes.suellner(a)mailbox.org> --- host/rootfs/Makefile | 4 +++- host/rootfs/file-list.mk | 4 ++++ .../service/s6-linux-init-shutdownd/notification-fd | 1 + .../service/s6-linux-init-shutdownd/notification-fd.license | 2 ++ .../run-image/service/s6-linux-init-shutdownd/run | 5 +++++ host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown | 5 +++++ .../rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final | 3 +++ 7 files changed, 23 insertions(+), 1 deletion(-) create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd.license create mode 100755 host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run create mode 100755 host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown create mode 100755 host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile index d528b12..5e90255 100644 --- a/host/rootfs/Makefile +++ b/host/rootfs/Makefile @@ -37,7 +37,9 @@ DIRS = \ run \ sys -FIFOS = etc/s6-linux-init/run-image/service/s6-svscan-log/fifo +FIFOS = \ + etc/s6-linux-init/run-image/service/s6-svscan-log/fifo \ + etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/fifo BUILD_FILES = build/etc/s6-rc diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index 7625c54..613a9e7 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -15,6 +15,8 @@ FILES = \ image/etc/s6-linux-init/run-image/service/getty-tty2/run \ image/etc/s6-linux-init/run-image/service/getty-tty3/run \ image/etc/s6-linux-init/run-image/service/getty-tty4/run \ + image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd \ + image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run \ image/etc/s6-linux-init/run-image/service/s6-svscan-log/notification-fd \ image/etc/s6-linux-init/run-image/service/s6-svscan-log/run \ image/etc/s6-linux-init/run-image/service/serial-getty-generator/run \ @@ -37,6 +39,8 @@ FILES = \ image/etc/s6-linux-init/run-image/service/vmm/run \ image/etc/s6-linux-init/run-image/service/vmm/template/notification-fd \ image/etc/s6-linux-init/scripts/rc.init \ + image/etc/s6-linux-init/scripts/rc.shutdown \ + image/etc/s6-linux-init/scripts/rc.shutdown.final \ image/etc/udev/rules.d/99-spectrum.rules \ image/etc/xdg/weston/autolaunch \ image/etc/xdg/weston/weston.ini \ diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd new file mode 100644 index 0000000..00750ed --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd @@ -0,0 +1 @@ +3 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd.license new file mode 100644 index 0000000..a941ca4 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run new file mode 100755 index 0000000..228fc6a --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run @@ -0,0 +1,5 @@ +#!/bin/execlineb -P +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> + +s6-linux-init-shutdownd -Bc /etc/s6-linux-init diff --git a/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown new file mode 100755 index 0000000..3b09c02 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown @@ -0,0 +1,5 @@ +#!/bin/execlineb -P +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> + +s6-rc -Dbav2 change diff --git a/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final new file mode 100755 index 0000000..7f48a65 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final @@ -0,0 +1,3 @@ +#!/bin/execlineb -P +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> -- 2.50.1

2 1

[PATCH 0/2] Move verity and EFI creation to separate Nix derivations
by Demi Marie Obenour 28 Nov '25

28 Nov '25

This doesn't have any functional change, other than to use the read builtin instead of a cat command in a shell script. However, it does make the code much cleaner and more reusable. For instance, one can easily build just the verity image or just the UKI. This will be used by the Nix code that generates an update package. The update package needs the root filesystem, the verity superblock, and the UKI. It doesn't need the installer or the live image. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Demi Marie Obenour (2): Create Nix derivation for building verity images Move UKI creation to a separate derivation host/efi.nix | 46 ++++++++++++++++++++++++++++++++++++++++++++++ host/initramfs/Makefile | 25 +++++-------------------- host/initramfs/shell.nix | 4 +++- host/rootfs/Makefile | 24 +++++------------------- host/rootfs/shell.nix | 3 +++ host/verity.nix | 19 +++++++++++++++++++ lib/common.mk | 1 - pkgs/default.nix | 2 ++ release/live/Makefile | 37 +++++-------------------------------- release/live/default.nix | 22 +++++++--------------- 10 files changed, 95 insertions(+), 88 deletions(-) --- base-commit: 43a8c81c58d73967635f57fdd84734d44120bc39 change-id: 20251105-refactor-verity-9c8ca37e021a -- Sincerely, Demi Marie Obenour (she/her/hers)

3 41

[REGRESSION] Backspace no longer works in host/rootfs make run virtiocon0
by Alyssa Ross 28 Nov '25

28 Nov '25

Bisected to the following range: 1e9c681 lib/nixpkgs.default.nix: update to nixos-unstable-small f41b4ab tools: move lsvm out of subdirectory 5ad749b tools: enable clippy::ptr-as-ptr lint a4d7aa9 tools: enable clippy::map-unwrap-or lint 3451250 host/rootfs: group VMM-backing services 99f09ab pkgs: remove dbus overlay Most likely something in the Nixpkgs upgrade. Needs further bisection. To reproduce: cd host/rootfs nix-shell --run 'make clean && make run' View → virtiocon0 Wait for kernel messages to finish Try typing, see that backspace doesn't work

1 6

[PATCH 1/3] host/rootfs: get rid of pkgsGui
by Alyssa Ross 28 Nov '25

28 Nov '25

The original purpose of pkgsGui was to have a dynamically linked package set that used libudev-zero. Now we don't use libudev-zero on the host, so it's no longer necessary. The one remaining override can be moved into the overlay until it's upstreamed[1]. Link: https://gitlab.freedesktop.org/accountsservice/accountsservice/-/merge_requ… [1] Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/default.nix | 31 +++++++++++-------------------- pkgs/overlay.nix | 6 ++++++ 2 files changed, 17 insertions(+), 20 deletions(-) diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix index f7974a4..2af6cbe 100644 --- a/host/rootfs/default.nix +++ b/host/rootfs/default.nix @@ -18,19 +18,10 @@ pkgsStatic.callPackage ( let inherit (nixosAllHardware.config.hardware) firmware; inherit (lib) - concatMapStringsSep concatStrings escapeShellArgs fileset optionalAttrs - mapAttrsToList systems trivial; + concatMapStringsSep concatStrings escapeShellArgs fileset mapAttrsToList + trivial; - pkgsGui = pkgsMusl.extend ( - _: super: - (optionalAttrs (systems.equals pkgsMusl.stdenv.hostPlatform super.stdenv.hostPlatform) { - flatpak = super.flatpak.override { - withMalcontent = false; - }; - }) - ); - - foot = pkgsGui.foot.override { allowPgo = false; }; + foot = pkgsMusl.foot.override { allowPgo = false; }; packages = [ cloud-hypervisor cryptsetup dbus execline inotify-tools iproute2 @@ -42,8 +33,8 @@ let extraConfig = builtins.readFile ./busybox-config; }) - # Take kmod from pkgsGui since we use pkgsGui.kmod.lib below anyway. - ] ++ (with pkgsGui; [ cosmic-files crosvm foot fuse3 kmod systemd ]); + # Take kmod from pkgsMusl since we use pkgsMusl.kmod.lib below anyway. + ] ++ (with pkgsMusl; [ cosmic-files crosvm foot fuse3 kmod systemd ]); nixosAllHardware = nixos ({ modulesPath, ... }: { imports = [ (modulesPath + "/profiles/all-hardware.nix") ]; @@ -64,7 +55,7 @@ let # https://inbox.vuxu.org/musl/20251017-dlopen-use-rpath-of-caller-dso-v1-1-46… usrPackages = [ appvm kernel.modules firmware netvm - ] ++ (with pkgsGui; [ dejavu_fonts kmod.lib mesa westonLite ]); + ] ++ (with pkgsMusl; [ dejavu_fonts kmod.lib mesa westonLite ]); appvms = { appvm-firefox = callSpectrumPackage ../../vm/app/firefox.nix {}; @@ -88,16 +79,16 @@ let # Weston doesn't support SVG icons. inkscape -w 20 -h 20 \ -o $out/usr/share/icons/hicolor/20x20/apps/com.system76.CosmicFiles.png \ - ${pkgsGui.cosmic-files}/share/icons/hicolor/24x24/apps/com.system76.CosmicFiles.svg + ${pkgsMusl.cosmic-files}/share/icons/hicolor/24x24/apps/com.system76.CosmicFiles.svg ln -st $out/usr/bin \ ${concatMapStringsSep " " (p: "${p}/bin/*") packages} \ - ${pkgsGui.xdg-desktop-portal}/libexec/xdg-document-portal \ - ${pkgsGui.xdg-desktop-portal-gtk}/libexec/xdg-desktop-portal-gtk + ${pkgsMusl.xdg-desktop-portal}/libexec/xdg-document-portal \ + ${pkgsMusl.xdg-desktop-portal-gtk}/libexec/xdg-desktop-portal-gtk ln -st $out/usr/share/dbus-1 \ ${dbus}/share/dbus-1/session.conf ln -st $out/usr/share/dbus-1/services \ - ${pkgsGui.xdg-desktop-portal-gtk}/share/dbus-1/services/org.freedesktop.impl.portal.desktop.gtk.service + ${pkgsMusl.xdg-desktop-portal-gtk}/share/dbus-1/services/org.freedesktop.impl.portal.desktop.gtk.service ${concatStrings (mapAttrsToList (name: path: '' ln -s ${path} $out/usr/lib/spectrum/vm/${name} @@ -138,7 +129,7 @@ stdenvNoCC.mkDerivation { dontFixup = true; passthru = { - inherit appvm firmware kernel nixosAllHardware packagesSysroot pkgsGui; + inherit appvm firmware kernel nixosAllHardware packagesSysroot; }; meta = with lib; { diff --git a/pkgs/overlay.nix b/pkgs/overlay.nix index 0ca196c..fdddae0 100644 --- a/pkgs/overlay.nix +++ b/pkgs/overlay.nix @@ -4,5 +4,11 @@ (final: super: { cloud-hypervisor = import ./cloud-hypervisor { inherit final super; }; + flatpak = super.flatpak.override ( + final.lib.optionalAttrs final.stdenv.hostPlatform.isMusl { + withMalcontent = false; + } + ); + skawarePackages = import ./skaware-packages { inherit final super; }; }) base-commit: c43e5c63a028994d5f66a15db19f415bf3cb7736 -- 2.51.0

2 4

[PATCH 1/5] pkgs: mdevd: backport bugfix
by Alyssa Ross 26 Nov '25

26 Nov '25

Without this, we can't tell mdevd to leave permissions of device nodes created by devtmpfs alone. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- pkgs/overlay.nix | 2 ++ pkgs/skaware-packages/default.nix | 15 +++++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 pkgs/skaware-packages/default.nix diff --git a/pkgs/overlay.nix b/pkgs/overlay.nix index 2987e7c..b3dfcc1 100644 --- a/pkgs/overlay.nix +++ b/pkgs/overlay.nix @@ -5,4 +5,6 @@ cloud-hypervisor = import ./cloud-hypervisor { inherit final super; }; dbus = import ./dbus { inherit final super; }; + + skawarePackages = import ./skaware-packages { inherit final super; }; }) diff --git a/pkgs/skaware-packages/default.nix b/pkgs/skaware-packages/default.nix new file mode 100644 index 0000000..f0d924b --- /dev/null +++ b/pkgs/skaware-packages/default.nix @@ -0,0 +1,15 @@ +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> +# SPDX-License-Identifier: MIT + +import ../../lib/overlay-package.nix [ "skawarePackages" ] ({ final, super }: + +super.skawarePackages.overrideScope (_: prev: { + mdevd = prev.mdevd.overrideAttrs ({ patches ? [], ... }: { + patches = patches ++ [ + (final.fetchpatch { + url = "https://git.skarnet.org/cgi-bin/cgit.cgi/mdevd/patch/?id=252f241e425bf09ddf…"; + hash = "sha256-0tEC+yJGyPapsxBqzBXPztF3bl7OwjVAGjhNXtwZQ0g="; + }) + ]; + }); +})) -- 2.51.0

2 9

[PATCH v1 RFC 0/4] spectrum-router
by Yureka Lilian 26 Nov '25

26 Nov '25

A first version of the spectrum user-space router & its integration into the spectrum system. Many details of the router itself are not yet finalized, and the main focus of this patch series is getting feedback on the integration into the spectrum system. Yureka Lilian (4): vm/sys/net: remove connman & dbus vm/sys/net: integrate xdp-forwarder tools: add spectrum-router host: integrate router host/rootfs/default.nix | 4 +- host/rootfs/file-list.mk | 2 + .../data/service/spectrum-router/down | 0 .../template/data/service/spectrum-router/run | 13 + host/rootfs/image/usr/bin/run-vmm | 12 - host/rootfs/image/usr/bin/vm-import | 13 - pkgs/default.nix | 2 + pkgs/overlay.nix | 1 + tools/router/Cargo.lock | 785 ++++++++++++++++++ tools/router/Cargo.toml | 18 + tools/router/default.nix | 18 + tools/router/src/main.rs | 235 ++++++ tools/start-vmm/ch.rs | 40 +- tools/start-vmm/lib.rs | 68 +- tools/start-vmm/meson.build | 2 +- tools/start-vmm/net-util.c | 39 - tools/start-vmm/net-util.h | 6 - tools/start-vmm/net.c | 55 -- tools/start-vmm/net.rs | 10 - tools/start-vmm/tests/meson.build | 5 - .../start-vmm/tests/tap_open-name-too-long.c | 20 - tools/start-vmm/tests/tap_open.c | 28 - vm/sys/net/Makefile | 2 +- vm/sys/net/default.nix | 15 +- vm/sys/net/file-list.mk | 13 +- vm/sys/net/image/etc/dbus-1/system.conf | 8 - vm/sys/net/image/etc/fstab | 2 + vm/sys/net/image/etc/mdev/iface | 27 +- vm/sys/net/image/etc/nftables.conf | 16 +- vm/sys/net/image/etc/s6-rc/connman/run | 19 - vm/sys/net/image/etc/s6-rc/connman/type | 1 - .../net/image/etc/s6-rc/connman/type.license | 2 - .../net/image/etc/s6-rc/dbus/notification-fd | 1 - .../etc/s6-rc/dbus/notification-fd.license | 2 - vm/sys/net/image/etc/s6-rc/dbus/run | 10 - vm/sys/net/image/etc/s6-rc/dbus/type | 1 - vm/sys/net/image/etc/s6-rc/dbus/type.license | 2 - .../image/etc/s6-rc/ok-all/contents.d/sysctl | 0 vm/sys/net/image/etc/s6-rc/sysctl/type | 1 - .../net/image/etc/s6-rc/sysctl/type.license | 2 - vm/sys/net/image/etc/s6-rc/sysctl/up | 4 - vm/sys/net/image/etc/sysctl.conf | 4 - 42 files changed, 1157 insertions(+), 351 deletions(-) rename vm/sys/net/image/etc/s6-rc/connman/dependencies.d/dbus => host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down (100%) create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run create mode 100644 tools/router/Cargo.lock create mode 100644 tools/router/Cargo.toml create mode 100644 tools/router/default.nix create mode 100644 tools/router/src/main.rs delete mode 100644 tools/start-vmm/net-util.c delete mode 100644 tools/start-vmm/net-util.h delete mode 100644 tools/start-vmm/net.c delete mode 100644 tools/start-vmm/tests/tap_open-name-too-long.c delete mode 100644 tools/start-vmm/tests/tap_open.c delete mode 100644 vm/sys/net/image/etc/dbus-1/system.conf delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/run delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/type delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/type.license delete mode 100644 vm/sys/net/image/etc/s6-rc/dbus/notification-fd delete mode 100644 vm/sys/net/image/etc/s6-rc/dbus/notification-fd.license delete mode 100644 vm/sys/net/image/etc/s6-rc/dbus/run delete mode 100644 vm/sys/net/image/etc/s6-rc/dbus/type delete mode 100644 vm/sys/net/image/etc/s6-rc/dbus/type.license delete mode 100644 vm/sys/net/image/etc/s6-rc/ok-all/contents.d/sysctl delete mode 100644 vm/sys/net/image/etc/s6-rc/sysctl/type delete mode 100644 vm/sys/net/image/etc/s6-rc/sysctl/type.license delete mode 100644 vm/sys/net/image/etc/s6-rc/sysctl/up delete mode 100644 vm/sys/net/image/etc/sysctl.conf -- 2.51.2

4 11

Can't get minijail0 working without bind-mounting /
by Demi Marie Obenour 24 Nov '25

24 Nov '25

I'm trying to get minijail0 to work without bind-mounting /, and I'm running into lots of problems. So far: - Unprivileged user namespaces fail due to -EPERM in a mount syscall. - Mounting a tmpfs over / always causes the program to be executed to not be found. - `sudo ./minijail0.sh -v --profile=minimalistic-mountns /bin/ls` works, but doesn't actually do any sandboxing as it bind-mounts `/`. Are there examples of how to use minijail0 properly? Alternatively, can I use it purely for seccomp and Landlock, and use bubblewrap to handle namespacing? -- Sincerely, Demi Marie Obenour (she/her/hers)

2 2