[PATCH v5 2/2] Move UKI creation to a separate derivation

26 Nov 2025

It will be used by the update code later.

No functional change intended, other than a trivial shell script
refactoring.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
I kept release/live/default.nix using the UKI's systemd because the old
code did it that way.  Changing this would be better in a separate
commit.

Changes since v5:

- Create a temporary symlink named build/spectrum.efi and then run
  $(MCOPY) -i $@ build/spectrum.efi ::/EFI/Linux, rather than copying
  the file with its original name.  The latter results in an unbootable
  image.  I do not know the reason.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
 host/efi.nix             | 40 ++++++++++++++++++++++++++++++++++++++++
 release/live/Makefile    | 17 ++++-------------
 release/live/default.nix | 27 +++++++++++----------------
 release/live/shell.nix   | 10 ++++++++--
 4 files changed, 63 insertions(+), 31 deletions(-)

diff --git a/host/efi.nix b/host/efi.nix
new file mode 100644
index 0000000000000000000000000000000000000000..ecedb6bea6bf29c7a7303dc9062fe12b5c7a9fbd
--- /dev/null
+++ b/host/efi.nix
@@ -0,0 +1,40 @@
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: 2021-2024 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+
+import ../lib/call-package.nix (
+{ callSpectrumPackage, cryptsetup, rootfs
+, runCommand, stdenv, systemdUkify
+}:
+let
+  initramfs = callSpectrumPackage ./initramfs {};
+  kernel = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}";
+  systemd = systemdUkify.overrideAttrs ({ mesonFlags ? [], ... }: {
+    # The default limit is too low to build a generic aarch64 distro image:
+    # https://github.com/systemd/systemd/pull/37417
+    mesonFlags = mesonFlags ++ [ "-Defi-stub-extra-sections=3000" ];
+  });
+in
+
+runCommand "spectrum-efi" {
+  nativeBuildInputs = [ cryptsetup systemd ];
+  __structuredAttrs = true;
+  unsafeDiscardReferences = { out = true; };
+  dontFixup = true;
+  passthru = { inherit initramfs rootfs systemd; };
+} ''
+  read -r roothash < ${rootfs}/rootfs.verity.roothash
+  { \
+      printf "[UKI]\nDeviceTreeAuto="
+      if [ -d ${rootfs.kernel}/dtbs ]; then
+          find ${rootfs.kernel}/dtbs -name '*.dtb' -print0 | tr '\0' ' '
+      fi
+  } | ukify build \
+      --output "$out" \
+      --config /dev/stdin \
+      --linux ${kernel} \
+      --initrd ${initramfs} \
+      --os-release $'NAME="Spectrum"\n' \
+      --cmdline "ro intel_iommu=on roothash=$roothash"
+  ''
+) (_: {})
diff --git a/release/live/Makefile b/release/live/Makefile
index ba81c7e679429e045b24c1591a9f0b72f016cfab..b37ccce42feb3ac7e8ce4faf96a67902b55be808 100644
--- a/release/live/Makefile
+++ b/release/live/Makefile
@@ -19,22 +19,13 @@ $(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sf
 build/empty:
 	mkdir -p $@
 
-build/spectrum.efi: $(DTBS) $(KERNEL) $(INITRAMFS) $(ROOT_FS_VERITY_ROOTHASH)
-	{ \
-	    printf "[UKI]\nDeviceTreeAuto=" && \
-	    find $(DTBS) -name '*.dtb' -print0 | tr '\0' ' ' ;\
-	} | $(UKIFY) build \
-	    --output $@ \
-	    --config /dev/stdin \
-	    --linux $(KERNEL) \
-	    --initrd $(INITRAMFS) \
-	    --os-release $$'NAME="Spectrum"\n' \
-	    --cmdline "ro intel_iommu=on roothash=$$(cat $(ROOT_FS_VERITY_ROOTHASH))"
-
-build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi
+build/boot.fat: $(SYSTEMD_BOOT_EFI) $(EFI_IMAGE) build/empty
 	$(TRUNCATE) -s 440401920 $@
 	$(MKFS_FAT) $@
 	$(MMD) -i $@ ::/EFI ::/EFI/BOOT ::/EFI/Linux
+# This symlink is necessary.  Copying $(EFI_IMAGE) directly
+# results in an unbootable image.  TODO: figure out why.
+	ln -s $(EFI_IMAGE) build/spectrum.efi
 	$(MCOPY) -i $@ build/spectrum.efi ::/EFI/Linux
 	$(MCOPY) -i $@ $(SYSTEMD_BOOT_EFI) ::/EFI/BOOT/$(EFINAME)
 
diff --git a/release/live/default.nix b/release/live/default.nix
index 2a1dc3e1dd939f21edac582bf39737eb4d46eb0c..ba9bb17e697a6ecfe81e52a4ffbc375ef443b6f3 100644
--- a/release/live/default.nix
+++ b/release/live/default.nix
@@ -3,10 +3,9 @@
 # SPDX-FileCopyrightText: 2022 Unikie
 
 import ../../lib/call-package.nix (
-{ callSpectrumPackage, spectrum-build-tools, rootfs, src
+{ callSpectrumPackage, spectrum-build-tools, src
 , lib, pkgsStatic, stdenvNoCC
 , cryptsetup, dosfstools, jq, mtools, util-linux
-, systemdUkify
 }:
 
 let
@@ -14,14 +13,12 @@ let
 
   stdenv = stdenvNoCC;
 
-  systemd = systemdUkify.overrideAttrs ({ mesonFlags ? [], ... }: {
-    # The default limit is too low to build a generic aarch64 distro image:
-    # https://github.com/systemd/systemd/pull/37417
-    mesonFlags = mesonFlags ++ [ "-Defi-stub-extra-sections=3000" ];
-  });
-
-  initramfs = callSpectrumPackage ../../host/initramfs {};
   efiArch = stdenv.hostPlatform.efiArch;
+
+  efi = callSpectrumPackage ../../host/efi.nix {};
+
+  # The initramfs and rootfs must match those used to build the UKI.
+  inherit (efi) initramfs rootfs systemd;
 in
 
 stdenv.mkDerivation {
@@ -40,17 +37,15 @@ stdenv.mkDerivation {
   sourceRoot = "source/release/live";
 
   nativeBuildInputs = [
-    cryptsetup dosfstools jq spectrum-build-tools mtools systemd util-linux
+    cryptsetup dosfstools jq spectrum-build-tools mtools util-linux
   ];
 
   env = {
-    INITRAMFS = initramfs;
-    KERNEL = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}";
-    ROOT_FS = rootfs;
+    KERNEL = "${efi.rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}";
+    ROOT_FS = "${efi.rootfs}";
     SYSTEMD_BOOT_EFI = "${systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
+    EFI_IMAGE = efi;
     EFINAME = "BOOT${toUpper efiArch}.EFI";
-  } // lib.optionalAttrs stdenv.hostPlatform.linux-kernel.DTB or false {
-    DTBS = "${rootfs.kernel}/dtbs";
   };
 
   buildFlags = [ "dest=$(out)" ];
@@ -63,6 +58,6 @@ stdenv.mkDerivation {
   unsafeDiscardReferences = { out = true; };
   dontFixup = true;
 
-  passthru = { inherit initramfs rootfs; };
+  passthru = { inherit efi initramfs rootfs; };
 }
 ) (_: {})
diff --git a/release/live/shell.nix b/release/live/shell.nix
index 799d575b4f6e6f3dad8ac1a0a8bc2e3fc46aab44..b0bf957c085d1581a24d8916925611da0a60ec8b 100644
--- a/release/live/shell.nix
+++ b/release/live/shell.nix
@@ -1,7 +1,12 @@
 # SPDX-License-Identifier: MIT
 # SPDX-FileCopyrightText: 2021-2024 Alyssa Ross <hi@alyssa.is>
 
-import ../../lib/call-package.nix ({ callSpectrumPackage, stdenv, qemu_kvm, rootfs }:
+import ../../lib/call-package.nix (
+{ callSpectrumPackage, stdenv, qemu_kvm }:
+
+let
+  efi = callSpectrumPackage ../../host/efi.nix {};
+in
 
 (callSpectrumPackage ./. {}).overrideAttrs (
   { nativeBuildInputs ? [], env ? {}, ... }:
@@ -10,7 +15,8 @@ import ../../lib/call-package.nix ({ callSpectrumPackage, stdenv, qemu_kvm, root
 
     env = env // {
       OVMF_CODE = "${qemu_kvm}/share/qemu/edk2-${stdenv.hostPlatform.qemuArch}-code.fd";
-      ROOT_FS = rootfs;
+      ROOT_FS = efi.rootfs;
+      EFI_IMAGE = efi;
     };
   }
 )) (_: {})

-- 
2.52.0

    