- Spectrum Development - spectrum-os.org

[PATCH] host/rootfs: reap sd-notify-adapter
by Alyssa Ross 29 Nov '25

29 Nov '25

systemd-udevd won't reap children, so we double fork so that pid 1 reaps sd-notify-adapter when it exits. Link: https://matrix.to/#/!xSysqhzbOZImdvGpix:fairydust.space/$QL6VucG9rlw_H9iQY9… Fixes: ced08f7 ("host/rootfs: Switch to systemd-udevd") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/image/etc/s6-rc/systemd-udevd/run | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/run b/host/rootfs/image/etc/s6-rc/systemd-udevd/run index fff0d47..2d28d02 100644 --- a/host/rootfs/image/etc/s6-rc/systemd-udevd/run +++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/run @@ -3,7 +3,7 @@ # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> s6-setlock /run/sd-notify-wrapper/systemd-udevd.lock s6-ipcserver-socketbinder -b0 -m -a 0600 /run/sd-notify-wrapper/systemd-udevd.sock -background { +background -d { fdmove 1 3 sd-notify-adapter } base-commit: aa5ab817d6eb990683a88893a6375acef7a585aa -- 2.51.0

2 1

[PATCH] release/checks/integration: handle partial sends
by Alyssa Ross 29 Nov '25

29 Nov '25

Sometimes we see a test failure that looks like this: unexpected connection data: qemu-system-aarch64: terminating on signal 15 from pid 184 () I think this is because, now that the nc command in the networking integration test has a timeout, it's possible for it to time out after having opened the connection, but before having written all its input to it. Therefore, ignore connections that send a prefix of the expected data (including nothing), and just wait for the next connection rather than failing if that happens. Closes: https://spectrum-os.org/lists/archives/spectrum-devel/875xbl33vw.fsf@alyssa… Fixes: c61b297 ("release/checks/integration: add nc timeout") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- Please test! It's difficult to know if I've solved the problem for real, since it happens transiently. release/checks/integration/networking.c | 49 +++++++++++++++---------- 1 file changed, 30 insertions(+), 19 deletions(-) diff --git a/release/checks/integration/networking.c b/release/checks/integration/networking.c index 97d7895..a445af1 100644 --- a/release/checks/integration/networking.c +++ b/release/checks/integration/networking.c @@ -57,32 +57,43 @@ static int setup_server(void) static void expect_connection(int listener) { - int conn_fd; - FILE *conn; + int conn, r; char msg[7]; size_t len; - fputs("waiting for server connection\n", stderr); - if ((conn_fd = accept(listener, nullptr, nullptr)) == -1) { - perror("accept"); - exit(EXIT_FAILURE); - } - fputs("accepted connection!\n", stderr); - if (!(conn = fdopen(conn_fd, "r"))) { - perror("fdopen(server connection)"); - exit(EXIT_FAILURE); - } + for (;;) { + len = 0; - len = fread(msg, 1, sizeof msg, conn); - if (len != 6 || memcmp("hello\n", msg, 6)) { - if (ferror(conn)) - perror("fread(server connection)"); - else + fputs("waiting for server connection\n", stderr); + if ((conn = accept(listener, nullptr, nullptr)) == -1) { + perror("accept"); + exit(EXIT_FAILURE); + } + fputs("accepted connection!\n", stderr); + + for (;;) { + r = read(conn, msg + len, sizeof msg - len); + if (r == -1) { + perror("read"); + exit(EXIT_FAILURE); + } + if (r == 0) + break; + len += r; + } + + if (memcmp("hello\n", msg, len) || len > 6) { fprintf(stderr, "unexpected connection data: %.*s", (int)len, msg); - exit(EXIT_FAILURE); + exit(EXIT_FAILURE); + } + + // If connection was disconnect partway through, try again. + if (len < 6) + continue; + + return; } - fclose(conn); } static void drain_connections(int listener) base-commit: 067c6a5d50971242f9cb8ac0ac76e20d88a9b5c1 -- 2.51.0

2 2

[PATCH v2 0/7] spectrum-router
by Yureka Lilian 29 Nov '25

29 Nov '25

Changes since v1 (non-exhaustive): - Use spectrum-router from pkgsMusl - Refactor router into smaller modules - Parse router advertisements from upstream interfaces - Select active upstream interface based on router advertisements - Assign guest mac addresses based hash of vm id - Fix race condition when assigning driver-router interface - Temporarily disable re-write of mac addresses which would be needed for wifi. It will be added back inside the xdp-forwarder in a future patch. and completely new patches: - Change nameserver & default route in app-vm template - Fix integration tests - Leave dbus in net-vm and add iwd for testing Yureka Lilian (7): vm/sys/net: remove connman vm/sys/net: integrate xdp-forwarder vm/sys/net: add iwd tools: add spectrum-router host: integrate router img/app: change to ipv6 nameserver checks/integration: Adapt networking test for ipv6 host/rootfs/default.nix | 4 +- host/rootfs/file-list.mk | 3 + .../data/service/spectrum-router/down | 0 .../template/data/service/spectrum-router/run | 13 + .../image/usr/bin/assign-driver-router-iface | 11 + host/rootfs/image/usr/bin/run-vmm | 12 +- host/rootfs/image/usr/bin/vm-import | 13 - img/app/image/etc/mdev/iface | 17 - img/app/image/etc/resolv.conf | 2 +- pkgs/default.nix | 2 + pkgs/overlay.nix | 1 + release/checks/integration/default.nix | 2 +- release/checks/integration/networking.c | 32 +- tools/router/Cargo.lock | 807 ++++++++++++++++++ tools/router/Cargo.lock.license | 2 + tools/router/Cargo.toml | 21 + tools/router/default.nix | 18 + tools/router/src/main.rs | 73 ++ tools/router/src/packet.rs | 187 ++++ tools/router/src/protocol.rs | 65 ++ tools/router/src/router.rs | 133 +++ tools/router/src/upstream.rs | 170 ++++ tools/start-vmm/ch.rs | 38 +- tools/start-vmm/lib.rs | 76 +- tools/start-vmm/meson.build | 2 +- tools/start-vmm/net-util.c | 39 - tools/start-vmm/net-util.h | 6 - tools/start-vmm/net.c | 55 -- tools/start-vmm/net.rs | 11 - tools/start-vmm/tests/meson.build | 5 - .../start-vmm/tests/tap_open-name-too-long.c | 20 - tools/start-vmm/tests/tap_open.c | 28 - vm/sys/net/Makefile | 2 +- vm/sys/net/default.nix | 15 +- vm/sys/net/file-list.mk | 3 - vm/sys/net/image/etc/fstab | 2 + vm/sys/net/image/etc/mdev/iface | 28 +- vm/sys/net/image/etc/nftables.conf | 16 +- vm/sys/net/image/etc/s6-rc/connman/run | 19 - vm/sys/net/image/etc/s6-rc/connman/type | 1 - .../net/image/etc/s6-rc/connman/type.license | 2 - 41 files changed, 1627 insertions(+), 329 deletions(-) rename vm/sys/net/image/etc/s6-rc/connman/dependencies.d/dbus => host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down (100%) create mode 100755 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run create mode 100755 host/rootfs/image/usr/bin/assign-driver-router-iface create mode 100644 tools/router/Cargo.lock create mode 100644 tools/router/Cargo.lock.license create mode 100644 tools/router/Cargo.toml create mode 100644 tools/router/default.nix create mode 100644 tools/router/src/main.rs create mode 100644 tools/router/src/packet.rs create mode 100644 tools/router/src/protocol.rs create mode 100644 tools/router/src/router.rs create mode 100644 tools/router/src/upstream.rs delete mode 100644 tools/start-vmm/net-util.c delete mode 100644 tools/start-vmm/net-util.h delete mode 100644 tools/start-vmm/net.c delete mode 100644 tools/start-vmm/tests/tap_open-name-too-long.c delete mode 100644 tools/start-vmm/tests/tap_open.c delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/run delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/type delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/type.license -- 2.51.2

3 18

[PATCH 1/2] scripts/make-gpt.sh: set -o pipefail
by Alyssa Ross 29 Nov '25

29 Nov '25

Wasn't POSIX at the time this script was originally written! Suggested-by: Demi Marie Obenour <demiobenour(a)gmail.com> Link: https://spectrum-os.org/lists/archives/spectrum-devel/20251127174054.205683… Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- scripts/make-gpt.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/scripts/make-gpt.sh b/scripts/make-gpt.sh index 3cae441..e39828b 100755 --- a/scripts/make-gpt.sh +++ b/scripts/make-gpt.sh @@ -1,4 +1,4 @@ -#!/bin/sh -eu +#!/bin/sh -- # # SPDX-FileCopyrightText: 2021-2023 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2022 Unikie @@ -6,6 +6,8 @@ # # usage: make-gpt.sh GPT_PATH PATH:PARTTYPE[:PARTUUID[:PARTLABEL]]... +set -euo pipefail + ONE_MiB=1048576 # Prints the number of 1MiB blocks required to store the file named base-commit: d76e9b29aea9f31238d07e21db50d3fe6a80da5a -- 2.51.0

2 3

[PATCH v2] scripts/make-gpt.sh: allow setting partition size
by Alyssa Ross 28 Nov '25

28 Nov '25

We want non-minimally-sized partitions to leave space for updates. All such partitions will also be labelled, so we can just add another optional field at the end. Since we don't parse partition specifications in sh, we can't keep a running total any more, so instead we just go through the table at the end and add up all the sizes, taking advantage of our knowledge that the size will always be the last thing in each line in our tables. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> Message-ID: <20251127174054.2056835-2-hi(a)alyssa.is> --- v2: fix conflicts after applying Demi's optimization, and avoid awk to sum partition sizes, taking inspiration from the same. v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251127174054.205683… scripts/make-gpt.sh | 30 ++++++++++++++++++------------ scripts/sfdisk-field.awk | 22 +++++++++++++++++----- 2 files changed, 35 insertions(+), 17 deletions(-) diff --git a/scripts/make-gpt.sh b/scripts/make-gpt.sh index 3cae441..cb19868 100755 --- a/scripts/make-gpt.sh +++ b/scripts/make-gpt.sh @@ -1,10 +1,10 @@ #!/bin/sh -eu # -# SPDX-FileCopyrightText: 2021-2023 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2021-2023, 2025 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2022 Unikie # SPDX-License-Identifier: EUPL-1.2+ # -# usage: make-gpt.sh GPT_PATH PATH:PARTTYPE[:PARTUUID[:PARTLABEL]]... +# usage: make-gpt.sh GPT_PATH PATH:PARTTYPE[:PARTUUID[:PARTLABEL[:PARTMiB]]]... ONE_MiB=1048576 @@ -33,21 +33,27 @@ scriptsDir="$(dirname "$0")" out="$1" shift -nl=' -' -table="label: gpt" +table=$(for partition; do + awk -f "$scriptsDir/sfdisk-field.awk" \ + -v partition="$partition" \ + -v size="$(sizeMiB "${partition%%:*}")" +done) # Keep 1MiB free at the start, and 1MiB free at the end. -gptBytes=$((ONE_MiB * 2)) -for partition; do - sizeMiB="$(sizeMiB "${partition%%:*}")" - table="$table${nl}size=${sizeMiB}MiB,$(awk -f "$scriptsDir/sfdisk-field.awk" -v partition="$partition")" - gptBytes="$((gptBytes + sizeMiB * ONE_MiB))" -done +gptMiB=2 +while read -r partition; do + # Here we rely on sfdisk-field.awk always putting size last. + : $((gptMiB += ${partition##*=})) +done <<EOF +$table +EOF rm -f "$out" -truncate -s "$gptBytes" "$out" +truncate -s "${gptMiB}M" "$out" + sfdisk --no-reread --no-tell-kernel "$out" <<EOF +label: gpt +sector-size: $ONE_MiB $table EOF diff --git a/scripts/sfdisk-field.awk b/scripts/sfdisk-field.awk index e13c86d..78b438e 100644 --- a/scripts/sfdisk-field.awk +++ b/scripts/sfdisk-field.awk @@ -1,7 +1,7 @@ #!/usr/bin/awk -f # # SPDX-License-Identifier: EUPL-1.2+ -# SPDX-FileCopyrightText: 2022, 2024 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2022, 2024-2025 Alyssa Ross <hi(a)alyssa.is> BEGIN { types["root.aarch64"] = "b921b045-1df0-41c3-af44-4c6f280d3fae" @@ -9,12 +9,11 @@ BEGIN { types["verity.aarch64"] = "df3300ce-d69f-4c92-978c-9bfb0f38d820" types["verity.x86_64"] = "2c7357ed-ebd2-46d9-aec1-23d437ec2bf5" - # Field #1 is the partition path, which make-gpt.sh will turn into - # the size field. Since it's handled elsewhere, we skip that - # first field. + # Field #1 is the partition path, which is read by make-gpt.sh + # but not relevant for running sfdisk, so skip it. skip=1 - split("type uuid name", keys) + split("type uuid name size", keys) split(partition, fields, ":") arch = ENVIRON["ARCH"] @@ -31,8 +30,21 @@ BEGIN { if (keys[n - skip] == "type") { if (uuid = types[fields[n] "." arch]) fields[n] = uuid + } else if (keys[n - skip] == "size") { + if (fields[n] < size) { + printf "%s MiB partition content is too big for %s MiB partition\n", + size, fields[n] > "/dev/stderr" + exit 1 + } + + size = fields[n] + continue # Handled at the end. } printf "%s=%s,", keys[n - skip], fields[n] } + + # Always output a size field, either supplied in input or + # default value of the size variable. + printf "size=%s\n", size } base-commit: 1970f432152730ec19bf97a8db4613a591ee00be -- 2.51.0

2 7

[PATCH] scripts/make-gpt.sh: allow setting partition size
by Alyssa Ross 28 Nov '25

28 Nov '25

We want non-minimally-sized partitions to leave space for updates. All such partitions will also be labelled, so we can just add another optional field at the end. Since we don't parse partition specifications in sh, we can't keep a running total any more, so instead we just go through the table at the end and add up all the sizes, taking advantage of our knowledge that the size will always be the last thing in each line in our tables. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- This is an alternative to Demi's implementation[1], which required Bash features. [1]: https://spectrum-os.org/lists/archives/spectrum-devel/20251126-updates-v5-3… scripts/make-gpt.sh | 28 +++++++++++++++------------- scripts/sfdisk-field.awk | 22 +++++++++++++++++----- 2 files changed, 32 insertions(+), 18 deletions(-) diff --git a/scripts/make-gpt.sh b/scripts/make-gpt.sh index 96f0d2c..07eac50 100755 --- a/scripts/make-gpt.sh +++ b/scripts/make-gpt.sh @@ -1,10 +1,10 @@ #!/bin/sh -eu # -# SPDX-FileCopyrightText: 2021-2023 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2021-2023, 2025 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2022 Unikie # SPDX-License-Identifier: EUPL-1.2+ # -# usage: make-gpt.sh GPT_PATH PATH:PARTTYPE[:PARTUUID[:PARTLABEL]]... +# usage: make-gpt.sh GPT_PATH PATH:PARTTYPE[:PARTUUID[:PARTLABEL[:PARTMiB]]]... ONE_MiB=1048576 @@ -28,7 +28,8 @@ fillPartition() { lseek -S 1 "$start" cat "$3" 1<>"$1" } -# Prints the partition path from a PATH:PARTTYPE[:PARTUUID[:PARTLABEL]] string. +# Prints the partition path from a +# PATH:PARTTYPE[:PARTUUID[:PARTLABEL[:PARTMiB]]] string. partitionPath() { awk -F: '{print $1}' <<EOF $1 @@ -40,21 +41,22 @@ scriptsDir="$(dirname "$0")" out="$1" shift -nl=' -' -table="label: gpt" +table=$(for partition; do + awk -f "$scriptsDir/sfdisk-field.awk" \ + -v partition="$partition" \ + -v size="$(sizeMiB "$(partitionPath "$partition")")" +done) # Keep 1MiB free at the start, and 1MiB free at the end. -gptBytes=$((ONE_MiB * 2)) -for partition; do - sizeMiB="$(sizeMiB "$(partitionPath "$partition")")" - table="$table${nl}size=${sizeMiB}MiB,$(awk -f "$scriptsDir/sfdisk-field.awk" -v partition="$partition")" - gptBytes="$((gptBytes + sizeMiB * ONE_MiB))" -done +# Here we rely on sfdisk-field.awk always putting size last +gptMiB=$(printf "%s\n" "$table" | awk -F= '{size += $NF} END {print size + 2}') rm -f "$out" -truncate -s "$gptBytes" "$out" +truncate -s "${gptMiB}M" "$out" + sfdisk --no-reread --no-tell-kernel "$out" <<EOF +label: gpt +sector-size: $ONE_MiB $table EOF diff --git a/scripts/sfdisk-field.awk b/scripts/sfdisk-field.awk index e13c86d..78b438e 100644 --- a/scripts/sfdisk-field.awk +++ b/scripts/sfdisk-field.awk @@ -1,7 +1,7 @@ #!/usr/bin/awk -f # # SPDX-License-Identifier: EUPL-1.2+ -# SPDX-FileCopyrightText: 2022, 2024 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2022, 2024-2025 Alyssa Ross <hi(a)alyssa.is> BEGIN { types["root.aarch64"] = "b921b045-1df0-41c3-af44-4c6f280d3fae" @@ -9,12 +9,11 @@ BEGIN { types["verity.aarch64"] = "df3300ce-d69f-4c92-978c-9bfb0f38d820" types["verity.x86_64"] = "2c7357ed-ebd2-46d9-aec1-23d437ec2bf5" - # Field #1 is the partition path, which make-gpt.sh will turn into - # the size field. Since it's handled elsewhere, we skip that - # first field. + # Field #1 is the partition path, which is read by make-gpt.sh + # but not relevant for running sfdisk, so skip it. skip=1 - split("type uuid name", keys) + split("type uuid name size", keys) split(partition, fields, ":") arch = ENVIRON["ARCH"] @@ -31,8 +30,21 @@ BEGIN { if (keys[n - skip] == "type") { if (uuid = types[fields[n] "." arch]) fields[n] = uuid + } else if (keys[n - skip] == "size") { + if (fields[n] < size) { + printf "%s MiB partition content is too big for %s MiB partition\n", + size, fields[n] > "/dev/stderr" + exit 1 + } + + size = fields[n] + continue # Handled at the end. } printf "%s=%s,", keys[n - skip], fields[n] } + + # Always output a size field, either supplied in input or + # default value of the size variable. + printf "size=%s\n", size } base-commit: c43e5c63a028994d5f66a15db19f415bf3cb7736 -- 2.51.0

2 2

[PATCH] host: Configure s6-linux-init-shutdownd
by Johannes Süllner 28 Nov '25

28 Nov '25

Makes shutdown and reboot of the Spectrum host using `s6-linux-init-hpr` possible. Before, it would fail with "fatal: unable to talk to shutdownd: Operation not permitted". Pretty much just copied from commit 18b19f4dfdb1376d90f70f526052011502b97c40, where this was added to application VMs, but not to the host. Signed-off-by: Johannes Süllner <johannes.suellner(a)mailbox.org> --- host/rootfs/Makefile | 4 +++- host/rootfs/file-list.mk | 4 ++++ .../service/s6-linux-init-shutdownd/notification-fd | 1 + .../service/s6-linux-init-shutdownd/notification-fd.license | 2 ++ .../run-image/service/s6-linux-init-shutdownd/run | 5 +++++ host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown | 5 +++++ .../rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final | 3 +++ 7 files changed, 23 insertions(+), 1 deletion(-) create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd.license create mode 100755 host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run create mode 100755 host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown create mode 100755 host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile index d528b12..5e90255 100644 --- a/host/rootfs/Makefile +++ b/host/rootfs/Makefile @@ -37,7 +37,9 @@ DIRS = \ run \ sys -FIFOS = etc/s6-linux-init/run-image/service/s6-svscan-log/fifo +FIFOS = \ + etc/s6-linux-init/run-image/service/s6-svscan-log/fifo \ + etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/fifo BUILD_FILES = build/etc/s6-rc diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index 7625c54..613a9e7 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -15,6 +15,8 @@ FILES = \ image/etc/s6-linux-init/run-image/service/getty-tty2/run \ image/etc/s6-linux-init/run-image/service/getty-tty3/run \ image/etc/s6-linux-init/run-image/service/getty-tty4/run \ + image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd \ + image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run \ image/etc/s6-linux-init/run-image/service/s6-svscan-log/notification-fd \ image/etc/s6-linux-init/run-image/service/s6-svscan-log/run \ image/etc/s6-linux-init/run-image/service/serial-getty-generator/run \ @@ -37,6 +39,8 @@ FILES = \ image/etc/s6-linux-init/run-image/service/vmm/run \ image/etc/s6-linux-init/run-image/service/vmm/template/notification-fd \ image/etc/s6-linux-init/scripts/rc.init \ + image/etc/s6-linux-init/scripts/rc.shutdown \ + image/etc/s6-linux-init/scripts/rc.shutdown.final \ image/etc/udev/rules.d/99-spectrum.rules \ image/etc/xdg/weston/autolaunch \ image/etc/xdg/weston/weston.ini \ diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd new file mode 100644 index 0000000..00750ed --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd @@ -0,0 +1 @@ +3 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd.license new file mode 100644 index 0000000..a941ca4 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run new file mode 100755 index 0000000..228fc6a --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run @@ -0,0 +1,5 @@ +#!/bin/execlineb -P +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> + +s6-linux-init-shutdownd -Bc /etc/s6-linux-init diff --git a/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown new file mode 100755 index 0000000..3b09c02 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown @@ -0,0 +1,5 @@ +#!/bin/execlineb -P +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> + +s6-rc -Dbav2 change diff --git a/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final new file mode 100755 index 0000000..7f48a65 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/scripts/rc.shutdown.final @@ -0,0 +1,3 @@ +#!/bin/execlineb -P +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2023 Alyssa Ross <hi(a)alyssa.is> -- 2.50.1

2 1

[PATCH 0/2] Move verity and EFI creation to separate Nix derivations
by Demi Marie Obenour 28 Nov '25

28 Nov '25

This doesn't have any functional change, other than to use the read builtin instead of a cat command in a shell script. However, it does make the code much cleaner and more reusable. For instance, one can easily build just the verity image or just the UKI. This will be used by the Nix code that generates an update package. The update package needs the root filesystem, the verity superblock, and the UKI. It doesn't need the installer or the live image. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Demi Marie Obenour (2): Create Nix derivation for building verity images Move UKI creation to a separate derivation host/efi.nix | 46 ++++++++++++++++++++++++++++++++++++++++++++++ host/initramfs/Makefile | 25 +++++-------------------- host/initramfs/shell.nix | 4 +++- host/rootfs/Makefile | 24 +++++------------------- host/rootfs/shell.nix | 3 +++ host/verity.nix | 19 +++++++++++++++++++ lib/common.mk | 1 - pkgs/default.nix | 2 ++ release/live/Makefile | 37 +++++-------------------------------- release/live/default.nix | 22 +++++++--------------- 10 files changed, 95 insertions(+), 88 deletions(-) --- base-commit: 43a8c81c58d73967635f57fdd84734d44120bc39 change-id: 20251105-refactor-verity-9c8ca37e021a -- Sincerely, Demi Marie Obenour (she/her/hers)

3 41

[REGRESSION] Backspace no longer works in host/rootfs make run virtiocon0
by Alyssa Ross 28 Nov '25

28 Nov '25

Bisected to the following range: 1e9c681 lib/nixpkgs.default.nix: update to nixos-unstable-small f41b4ab tools: move lsvm out of subdirectory 5ad749b tools: enable clippy::ptr-as-ptr lint a4d7aa9 tools: enable clippy::map-unwrap-or lint 3451250 host/rootfs: group VMM-backing services 99f09ab pkgs: remove dbus overlay Most likely something in the Nixpkgs upgrade. Needs further bisection. To reproduce: cd host/rootfs nix-shell --run 'make clean && make run' View → virtiocon0 Wait for kernel messages to finish Try typing, see that backspace doesn't work

1 6

[PATCH 1/3] host/rootfs: get rid of pkgsGui
by Alyssa Ross 28 Nov '25

28 Nov '25

The original purpose of pkgsGui was to have a dynamically linked package set that used libudev-zero. Now we don't use libudev-zero on the host, so it's no longer necessary. The one remaining override can be moved into the overlay until it's upstreamed[1]. Link: https://gitlab.freedesktop.org/accountsservice/accountsservice/-/merge_requ… [1] Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/default.nix | 31 +++++++++++-------------------- pkgs/overlay.nix | 6 ++++++ 2 files changed, 17 insertions(+), 20 deletions(-) diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix index f7974a4..2af6cbe 100644 --- a/host/rootfs/default.nix +++ b/host/rootfs/default.nix @@ -18,19 +18,10 @@ pkgsStatic.callPackage ( let inherit (nixosAllHardware.config.hardware) firmware; inherit (lib) - concatMapStringsSep concatStrings escapeShellArgs fileset optionalAttrs - mapAttrsToList systems trivial; + concatMapStringsSep concatStrings escapeShellArgs fileset mapAttrsToList + trivial; - pkgsGui = pkgsMusl.extend ( - _: super: - (optionalAttrs (systems.equals pkgsMusl.stdenv.hostPlatform super.stdenv.hostPlatform) { - flatpak = super.flatpak.override { - withMalcontent = false; - }; - }) - ); - - foot = pkgsGui.foot.override { allowPgo = false; }; + foot = pkgsMusl.foot.override { allowPgo = false; }; packages = [ cloud-hypervisor cryptsetup dbus execline inotify-tools iproute2 @@ -42,8 +33,8 @@ let extraConfig = builtins.readFile ./busybox-config; }) - # Take kmod from pkgsGui since we use pkgsGui.kmod.lib below anyway. - ] ++ (with pkgsGui; [ cosmic-files crosvm foot fuse3 kmod systemd ]); + # Take kmod from pkgsMusl since we use pkgsMusl.kmod.lib below anyway. + ] ++ (with pkgsMusl; [ cosmic-files crosvm foot fuse3 kmod systemd ]); nixosAllHardware = nixos ({ modulesPath, ... }: { imports = [ (modulesPath + "/profiles/all-hardware.nix") ]; @@ -64,7 +55,7 @@ let # https://inbox.vuxu.org/musl/20251017-dlopen-use-rpath-of-caller-dso-v1-1-46… usrPackages = [ appvm kernel.modules firmware netvm - ] ++ (with pkgsGui; [ dejavu_fonts kmod.lib mesa westonLite ]); + ] ++ (with pkgsMusl; [ dejavu_fonts kmod.lib mesa westonLite ]); appvms = { appvm-firefox = callSpectrumPackage ../../vm/app/firefox.nix {}; @@ -88,16 +79,16 @@ let # Weston doesn't support SVG icons. inkscape -w 20 -h 20 \ -o $out/usr/share/icons/hicolor/20x20/apps/com.system76.CosmicFiles.png \ - ${pkgsGui.cosmic-files}/share/icons/hicolor/24x24/apps/com.system76.CosmicFiles.svg + ${pkgsMusl.cosmic-files}/share/icons/hicolor/24x24/apps/com.system76.CosmicFiles.svg ln -st $out/usr/bin \ ${concatMapStringsSep " " (p: "${p}/bin/*") packages} \ - ${pkgsGui.xdg-desktop-portal}/libexec/xdg-document-portal \ - ${pkgsGui.xdg-desktop-portal-gtk}/libexec/xdg-desktop-portal-gtk + ${pkgsMusl.xdg-desktop-portal}/libexec/xdg-document-portal \ + ${pkgsMusl.xdg-desktop-portal-gtk}/libexec/xdg-desktop-portal-gtk ln -st $out/usr/share/dbus-1 \ ${dbus}/share/dbus-1/session.conf ln -st $out/usr/share/dbus-1/services \ - ${pkgsGui.xdg-desktop-portal-gtk}/share/dbus-1/services/org.freedesktop.impl.portal.desktop.gtk.service + ${pkgsMusl.xdg-desktop-portal-gtk}/share/dbus-1/services/org.freedesktop.impl.portal.desktop.gtk.service ${concatStrings (mapAttrsToList (name: path: '' ln -s ${path} $out/usr/lib/spectrum/vm/${name} @@ -138,7 +129,7 @@ stdenvNoCC.mkDerivation { dontFixup = true; passthru = { - inherit appvm firmware kernel nixosAllHardware packagesSysroot pkgsGui; + inherit appvm firmware kernel nixosAllHardware packagesSysroot; }; meta = with lib; { diff --git a/pkgs/overlay.nix b/pkgs/overlay.nix index 0ca196c..fdddae0 100644 --- a/pkgs/overlay.nix +++ b/pkgs/overlay.nix @@ -4,5 +4,11 @@ (final: super: { cloud-hypervisor = import ./cloud-hypervisor { inherit final super; }; + flatpak = super.flatpak.override ( + final.lib.optionalAttrs final.stdenv.hostPlatform.isMusl { + withMalcontent = false; + } + ); + skawarePackages = import ./skaware-packages { inherit final super; }; }) base-commit: c43e5c63a028994d5f66a15db19f415bf3cb7736 -- 2.51.0

2 4