- Spectrum Development - spectrum-os.org

config.nix validation?
by Demi Marie Obenour 09 Nov '25

09 Nov '25

Should the values from config.nix be validated in any way? They are obviously trusted, but it is very easy for the users to make mistakes that could cause extremely confusing problems. For instance, the update patch doesn't support URLs with a query string or a fragment specifier. In fact, such URLs could get mangled. There are other URLs that tools like curl will accept but which will break the build. Should these be validated with regular expressions before use? That will result in build-time errors that at least somewhat point to the source of the problem, rather than mysterious build-time or runtime misbehavior. -- Sincerely, Demi Marie Obenour (she/her/hers)

2 3

[PATCH 0/2] release/checks/shfmt: init
by Alyssa Ross 09 Nov '25

09 Nov '25

The default formatting seems unobjectionable to me, but if anybody wants to lobby for different sh formatting rules, now's the time. :) Alyssa Ross (2): scripts: format with shfmt release/checks/shfmt: init release/checks/default.nix | 2 + release/checks/shfmt.nix | 15 +++++ scripts/dist-cloud-hypervisor.sh | 4 +- scripts/format-uuid.sh | 2 +- scripts/make-erofs.sh | 8 +-- scripts/run-qemu.sh | 109 ++++++++++++++++--------------- scripts/update-nixpkgs.sh | 4 +- 7 files changed, 81 insertions(+), 63 deletions(-) create mode 100644 release/checks/shfmt.nix base-commit: e9480cfdf8cba16d0e0b8ee2db3a916979804db9 -- 2.51.0

3 6

[PATCH] img/app: Use set -euo pipefail for building the erofs
by Demi Marie Obenour 09 Nov '25

09 Nov '25

This caught problems when I was trying to filter the set of files to be built. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- img/app/Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/img/app/Makefile b/img/app/Makefile index 981889ebe55d9ba03228977f3dc0ea3f26d5c4fb..48eba871339d314479f730101246ace3fa39e2db 100644 --- a/img/app/Makefile +++ b/img/app/Makefile @@ -46,6 +46,7 @@ build/empty: mkdir -p $@ build/rootfs.erofs: ../../scripts/make-erofs.sh $(PACKAGES_FILE) $(FILES) $(BUILD_FILES) build/empty build/fifo file-list.mk + set -euo pipefail; \ { \ cat $(PACKAGES_FILE) ;\ for file in $(FILES) $(LINKS); do printf '%s\n%s\n' $$file "$${file#image/}"; done ;\ --- base-commit: 22e216712322cdfb85094bbd27ff34c4366fad41 change-id: 20251107-pipefail-92dd75264707 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 2

[PATCH 0/2] host/rootfs: remove unnecessary coldplug dependencies
by Alyssa Ross 09 Nov '25

09 Nov '25

I didn't want to block the udev series on this, but I really don't think these dependencies are necessary. Rationale in each patch. Alyssa Ross (2): host/rootfs: remove vmm-env coldplug dependency host/rootfs: remove vm-env coldplug dependency host/rootfs/file-list.mk | 2 -- .../image/etc/s6-rc/vm-env/contents.d/systemd-udevd-coldplug | 0 .../image/etc/s6-rc/vmm-env/contents.d/systemd-udevd-coldplug | 0 3 files changed, 2 deletions(-) delete mode 100644 host/rootfs/image/etc/s6-rc/vm-env/contents.d/systemd-udevd-coldplug delete mode 100644 host/rootfs/image/etc/s6-rc/vmm-env/contents.d/systemd-udevd-coldplug base-commit: 36d2f0bd5caf297efec0e41f42e5983ae9dc1cb1 -- 2.51.0

1 2

[PATCH v6 0/2] Switch from mdevd to systemd-udevd in root filesystem
by Demi Marie Obenour 09 Nov '25

09 Nov '25

systemd-udevd provides support for significantly more hardware than mdevd does. Therefore, switch to it. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Changes in v6: - Avoid using GOTO and LABEL in udev rules. Changes in v5: - Use -D_GNU_SOURCE in build system instead of #define _GNU_SOURCE 1 in C files. - Do not check for EAGAIN or EWOULDBLOCK after poll() has reported FD as ready. - Do not use MSG_NONBLOCK. - Use static variable for iovec. - Network hotplug script is safe to call more than once, so do not check for it having already been called. - Do not try to prevent /run/user from being created with wrong mode when it is known to already exist. - Fix copyright texts. - Link to v4: https://spectrum-os.org/lists/archives/spectrum-devel/20251003-udev-v4-0-7d… Changes in v4: - Use 'udevadm trigger --action=add' at coldplug time. - Ensure that the wrapper does not exit after the first message. - Include the hardware database. - sd-notify-adapter should not exit if it receives a message without READY=1. - Link to v3: https://spectrum-os.org/lists/archives/spectrum-devel/20250928-udev-v3-0-bb… Changes in v3: - Try to avoid net-add running twice. - Use full systemd instead of systemdMinimal, as something else already pulls it into the image. - Hopefully fix integration tests. - Link to v2: https://spectrum-os.org/lists/archives/spectrum-devel/20250924-udev-v2-2-60… Changes in v2: - Use more optional arguments instead of positional parameters in sd-notify-wrapper. - Explain why explicit modprobe is needed. - Link to v1: https://spectrum-os.org/lists/archives/spectrum-devel/20250913-udev-v1-0-ea… --- Demi Marie Obenour (2): tools: Add adapter tool for services using sd_notify host/rootfs: Switch to systemd-udevd host/rootfs/Makefile | 2 +- host/rootfs/default.nix | 118 ++++++++------------- host/rootfs/file-list.mk | 33 +++--- host/rootfs/image/etc/mdev.conf | 7 -- host/rootfs/image/etc/mdev/listen | 11 -- host/rootfs/image/etc/mdev/wait | 14 --- host/rootfs/image/etc/s6-rc/card0/type.license | 2 - host/rootfs/image/etc/s6-rc/card0/up | 4 - host/rootfs/image/etc/s6-rc/kvm/timeout-up | 1 - host/rootfs/image/etc/s6-rc/kvm/timeout-up.license | 2 - host/rootfs/image/etc/s6-rc/kvm/type | 1 - host/rootfs/image/etc/s6-rc/kvm/type.license | 2 - host/rootfs/image/etc/s6-rc/kvm/up | 4 - host/rootfs/image/etc/s6-rc/mdevd-coldplug/type | 1 - host/rootfs/image/etc/s6-rc/mdevd-coldplug/up | 4 - .../image/etc/s6-rc/mdevd/notification-fd.license | 2 - host/rootfs/image/etc/s6-rc/mdevd/run | 5 - .../contents.d/systemd-udevd-coldplug} | 0 .../dependencies.d/systemd-udevd} | 0 .../s6-rc/{card0 => systemd-udevd-coldplug}/type | 0 .../type.license | 0 .../image/etc/s6-rc/systemd-udevd-coldplug/up | 3 + .../s6-rc/{mdevd => systemd-udevd}/notification-fd | 0 .../s6-rc/systemd-udevd/notification-fd.license | 2 + host/rootfs/image/etc/s6-rc/systemd-udevd/run | 14 +++ .../image/etc/s6-rc/{mdevd => systemd-udevd}/type | 0 .../s6-rc/{mdevd => systemd-udevd}/type.license | 0 .../contents.d/systemd-udevd-coldplug} | 0 .../contents.d/systemd-udevd-coldplug} | 0 .../weston/dependencies.d/systemd-udevd-coldplug | 0 host/rootfs/image/etc/s6-rc/weston/run | 6 +- .../image/etc/udev/rules.d/99-spectrum.rules | 5 + host/rootfs/image/usr/bin/run-vmm | 1 + host/rootfs/image/usr/bin/systemd-udevd | 1 + .../{etc/mdev/net/add => usr/libexec/net-add} | 0 tools/default.nix | 1 + tools/meson.build | 1 + tools/sd-notify-adapter/meson.build | 4 + tools/sd-notify-adapter/sd-notify-adapter.c | 107 +++++++++++++++++++ 39 files changed, 199 insertions(+), 159 deletions(-) --- base-commit: 22e216712322cdfb85094bbd27ff34c4366fad41 change-id: 20250911-udev-24cf4bf68fbe -- Sincerely, Demi Marie Obenour (she/her/hers)

3 16

[BUG] Spurious test failure in networking integration test
by Alyssa Ross 07 Nov '25

07 Nov '25

I'm seeing a test failure sometimes that looks like this: unexpected connection data: qemu-system-aarch64: terminating on signal 15 from pid 184 () I think this is because, now that the nc command in the networking integration test has a timeout, it's possible for it to time out after having opened the connection, but before having written all its input to it. I think the test should therefore ignore connections that send a prefix of the expected data (including nothing), and just wait for the next connection rather than failing if that happens.

1 0

[PATCH] host/initramfs: Fix 'nix-shell --pure --run "make run"'
by Demi Marie Obenour 06 Nov '25

06 Nov '25

Add the needed build-dependency on jq. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/initramfs/shell.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/host/initramfs/shell.nix b/host/initramfs/shell.nix index eeba865e3ac793f67ae1808a92cf5eb1b37d57af..8b47aa53bc19a818ebf563e281f22e82202a8ea5 100644 --- a/host/initramfs/shell.nix +++ b/host/initramfs/shell.nix @@ -3,7 +3,7 @@ import ../../lib/call-package.nix ( { callSpectrumPackage, rootfs, pkgsStatic, stdenv -, cryptsetup, qemu_kvm, tar2ext4, util-linux +, cryptsetup, jq, qemu_kvm, tar2ext4, util-linux }: let @@ -12,7 +12,7 @@ in initramfs.overrideAttrs ({ nativeBuildInputs ? [], env ? {}, ... }: { nativeBuildInputs = nativeBuildInputs ++ [ - cryptsetup qemu_kvm tar2ext4 util-linux + cryptsetup jq qemu_kvm tar2ext4 util-linux ]; env = env // { --- base-commit: 1d666582892fbdf812662b4490caf7821078eaf9 change-id: 20251105-fix-nix-shell-initramfs-244323043a9d -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

[PATCH v6 0/2] Switch from mdevd to systemd-udevd in root filesystem
by Demi Marie Obenour 06 Nov '25

06 Nov '25

systemd-udevd provides support for significantly more hardware than mdevd does. Therefore, switch to it. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Changes in v5: - Use -D_GNU_SOURCE in build system instead of #define _GNU_SOURCE 1 in C files. - Do not check for EAGAIN or EWOULDBLOCK after poll() has reported FD as ready. - Do not use MSG_NONBLOCK. - Use static variable for iovec. - Network hotplug script is safe to call more than once, so do not check for it having already been called. - Do not try to prevent /run/user from being created with wrong mode when it is known to already exist. - Fix copyright texts. - Link to v4: https://spectrum-os.org/lists/archives/spectrum-devel/20251003-udev-v4-0-7d… Changes in v4: - Use 'udevadm trigger --action=add' at coldplug time. - Ensure that the wrapper does not exit after the first message. - Include the hardware database. - sd-notify-adapter should not exit if it receives a message without READY=1. - Link to v3: https://spectrum-os.org/lists/archives/spectrum-devel/20250928-udev-v3-0-bb… Changes in v3: - Try to avoid net-add running twice. - Use full systemd instead of systemdMinimal, as something else already pulls it into the image. - Hopefully fix integration tests. - Link to v2: https://spectrum-os.org/lists/archives/spectrum-devel/20250924-udev-v2-2-60… Changes in v2: - Use more optional arguments instead of positional parameters in sd-notify-wrapper. - Explain why explicit modprobe is needed. - Link to v1: https://spectrum-os.org/lists/archives/spectrum-devel/20250913-udev-v1-0-ea… --- Demi Marie Obenour (2): tools: Add adapter tool for services using sd_notify host/rootfs: Switch to systemd-udevd host/rootfs/Makefile | 2 +- host/rootfs/default.nix | 118 ++++++++------------- host/rootfs/file-list.mk | 33 +++--- host/rootfs/image/etc/mdev.conf | 7 -- host/rootfs/image/etc/mdev/listen | 11 -- host/rootfs/image/etc/mdev/wait | 14 --- host/rootfs/image/etc/s6-rc/card0/type.license | 2 - host/rootfs/image/etc/s6-rc/card0/up | 4 - host/rootfs/image/etc/s6-rc/kvm/timeout-up | 1 - host/rootfs/image/etc/s6-rc/kvm/timeout-up.license | 2 - host/rootfs/image/etc/s6-rc/kvm/type | 1 - host/rootfs/image/etc/s6-rc/kvm/type.license | 2 - host/rootfs/image/etc/s6-rc/kvm/up | 4 - host/rootfs/image/etc/s6-rc/mdevd-coldplug/type | 1 - host/rootfs/image/etc/s6-rc/mdevd-coldplug/up | 4 - .../image/etc/s6-rc/mdevd/notification-fd.license | 2 - host/rootfs/image/etc/s6-rc/mdevd/run | 5 - .../contents.d/systemd-udevd-coldplug} | 0 .../dependencies.d/systemd-udevd} | 0 .../s6-rc/{card0 => systemd-udevd-coldplug}/type | 0 .../type.license | 0 .../image/etc/s6-rc/systemd-udevd-coldplug/up | 3 + .../s6-rc/{mdevd => systemd-udevd}/notification-fd | 0 .../s6-rc/systemd-udevd/notification-fd.license | 2 + host/rootfs/image/etc/s6-rc/systemd-udevd/run | 14 +++ .../image/etc/s6-rc/{mdevd => systemd-udevd}/type | 0 .../s6-rc/{mdevd => systemd-udevd}/type.license | 0 .../contents.d/systemd-udevd-coldplug} | 0 .../contents.d/systemd-udevd-coldplug} | 0 .../weston/dependencies.d/systemd-udevd-coldplug | 0 host/rootfs/image/etc/s6-rc/weston/run | 6 +- .../image/etc/udev/rules.d/99-spectrum.rules | 9 ++ host/rootfs/image/usr/bin/run-vmm | 1 + host/rootfs/image/usr/bin/systemd-udevd | 1 + .../{etc/mdev/net/add => usr/libexec/net-add} | 0 tools/default.nix | 1 + tools/meson.build | 1 + tools/sd-notify-adapter/meson.build | 4 + tools/sd-notify-adapter/sd-notify-adapter.c | 107 +++++++++++++++++++ 39 files changed, 203 insertions(+), 159 deletions(-) --- base-commit: 1d666582892fbdf812662b4490caf7821078eaf9 change-id: 20250911-udev-24cf4bf68fbe -- Sincerely, Demi Marie Obenour (she/her/hers)

2 6

[PATCH v5 0/2] Switch from mdevd to systemd-udevd in root filesystem
by Demi Marie Obenour 03 Nov '25

03 Nov '25

systemd-udevd provides support for significantly more hardware than mdevd does. Therefore, switch to it. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Changes in v5: - Use -D_GNU_SOURCE in build system instead of #define _GNU_SOURCE 1 in C files. - Do not check for EAGAIN or EWOULDBLOCK after poll() has reported FD as ready. - Do not use MSG_NONBLOCK. - Use static variable for iovec. - Network hotplug script is safe to call more than once, so do not check for it having already been called. - Do not try to prevent /run/user from being created with wrong mode when it is known to already exist. - Fix copyright texts. - Link to v4: https://spectrum-os.org/lists/archives/spectrum-devel/20251003-udev-v4-0-7d… Changes in v4: - Use 'udevadm trigger --action=add' at coldplug time. - Ensure that the wrapper does not exit after the first message. - Include the hardware database. - sd-notify-adapter should not exit if it receives a message without READY=1. - Link to v3: https://spectrum-os.org/lists/archives/spectrum-devel/20250928-udev-v3-0-bb… Changes in v3: - Try to avoid net-add running twice. - Use full systemd instead of systemdMinimal, as something else already pulls it into the image. - Hopefully fix integration tests. - Link to v2: https://spectrum-os.org/lists/archives/spectrum-devel/20250924-udev-v2-2-60… Changes in v2: - Use more optional arguments instead of positional parameters in sd-notify-wrapper. - Explain why explicit modprobe is needed. - Link to v1: https://spectrum-os.org/lists/archives/spectrum-devel/20250913-udev-v1-0-ea… --- Demi Marie Obenour (2): tools: Add adapter tool for services using sd_notify host/rootfs: Switch to systemd-udevd host/rootfs/Makefile | 2 +- host/rootfs/default.nix | 118 ++++++++------------- host/rootfs/file-list.mk | 33 +++--- host/rootfs/image/etc/mdev.conf | 7 -- host/rootfs/image/etc/mdev/listen | 11 -- host/rootfs/image/etc/mdev/wait | 14 --- host/rootfs/image/etc/s6-rc/card0/type.license | 2 - host/rootfs/image/etc/s6-rc/card0/up | 4 - host/rootfs/image/etc/s6-rc/kvm/timeout-up | 1 - host/rootfs/image/etc/s6-rc/kvm/timeout-up.license | 2 - host/rootfs/image/etc/s6-rc/kvm/type | 1 - host/rootfs/image/etc/s6-rc/kvm/type.license | 2 - host/rootfs/image/etc/s6-rc/kvm/up | 4 - host/rootfs/image/etc/s6-rc/mdevd-coldplug/type | 1 - host/rootfs/image/etc/s6-rc/mdevd-coldplug/up | 4 - .../image/etc/s6-rc/mdevd/notification-fd.license | 2 - host/rootfs/image/etc/s6-rc/mdevd/run | 5 - .../contents.d/systemd-udevd-coldplug} | 0 .../dependencies.d/systemd-udevd} | 0 .../s6-rc/{card0 => systemd-udevd-coldplug}/type | 0 .../type.license | 0 .../image/etc/s6-rc/systemd-udevd-coldplug/up | 3 + .../s6-rc/{mdevd => systemd-udevd}/notification-fd | 0 .../s6-rc/systemd-udevd/notification-fd.license | 2 + host/rootfs/image/etc/s6-rc/systemd-udevd/run | 14 +++ .../image/etc/s6-rc/{mdevd => systemd-udevd}/type | 0 .../s6-rc/{mdevd => systemd-udevd}/type.license | 0 .../contents.d/systemd-udevd-coldplug} | 0 .../contents.d/systemd-udevd-coldplug} | 0 .../weston/dependencies.d/systemd-udevd-coldplug | 0 host/rootfs/image/etc/s6-rc/weston/run | 6 +- .../image/etc/udev/rules.d/99-spectrum.rules | 9 ++ host/rootfs/image/usr/bin/run-vmm | 1 + host/rootfs/image/usr/bin/systemd-udevd | 1 + .../{etc/mdev/net/add => usr/libexec/net-add} | 0 tools/default.nix | 1 + tools/meson.build | 1 + tools/sd-notify-adapter/meson.build | 4 + tools/sd-notify-adapter/sd-notify-adapter.c | 107 +++++++++++++++++++ 39 files changed, 203 insertions(+), 159 deletions(-) --- base-commit: 1d666582892fbdf812662b4490caf7821078eaf9 change-id: 20250911-udev-24cf4bf68fbe -- Sincerely, Demi Marie Obenour (she/her/hers)

1 2

[PATCH 1/2] host/rootfs: assign-devices: silence errors
by Alyssa Ross 02 Nov '25

02 Nov '25

The expected warnings frequently confuse people. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/image/usr/bin/assign-devices | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/host/rootfs/image/usr/bin/assign-devices b/host/rootfs/image/usr/bin/assign-devices index 1332a40..58dd3cc 100755 --- a/host/rootfs/image/usr/bin/assign-devices +++ b/host/rootfs/image/usr/bin/assign-devices @@ -5,4 +5,9 @@ elglob -0 devices /sys/bus/pci/drivers/vfio-pci/????:??:??.? forx -pE device { $devices } +# This script is designed to be re-entrant and called multiple times. +# This means we expect to sometimes get an error due to the device +# already having been added. If there's a different error, +# cloud-hypervisor will probably log it itself anyway. +redirfd -w 2 /dev/null ch-remote --api-socket /run/vm/by-name/sys.netvm/vmm add-device path=${device} base-commit: e0f5aad7901d150b1abe381ffd99d554e65e758b -- 2.51.0

3 5