[PATCH v3 2/2] Move UKI creation to a separate derivation

12 Nov 2025

It will be used by the update code later.

No functional change intended, other than a trivial shell script
refactoring.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
 host/efi.nix             | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 pkgs/default.nix         |  1 +
 release/live/Makefile    | 15 ++-------------
 release/live/default.nix | 19 +++++--------------
 4 files changed, 54 insertions(+), 27 deletions(-)

diff --git a/host/efi.nix b/host/efi.nix
new file mode 100644
index 0000000000000000000000000000000000000000..a2b47fd050fbf00050473a0d5a1373eb96c341b5
--- /dev/null
+++ b/host/efi.nix
@@ -0,0 +1,46 @@
+# SPDX-License-Identifier: EUPL-1.2+
+# SPDX-FileCopyrightText: 2021-2024 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+
+import ../lib/call-package.nix (
+{ bash, callSpectrumPackage, cryptsetup, runCommand
+, stdenv, systemdUkify, rootfs
+}:
+let
+  initramfs = callSpectrumPackage ./initramfs {};
+  kernel = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}";
+  systemd = systemdUkify.overrideAttrs ({ mesonFlags ? [], ... }: {
+    # The default limit is too low to build a generic aarch64 distro image:
+    # https://github.com/systemd/systemd/pull/37417
+    mesonFlags = mesonFlags ++ [ "-Defi-stub-extra-sections=3000" ];
+  });
+in
+
+runCommand "spectrum-efi" {
+  nativeBuildInputs = [ cryptsetup systemd bash ];
+  __structuredAttrs = true;
+  unsafeDiscardReferences = { out = true; };
+  dontFixup = true;
+  passthru = { inherit systemd; };
+  env = {
+    DTBS = "${rootfs.kernel}/dtbs";
+    KERNEL = kernel;
+    INITRAMFS = initramfs;
+    ROOTFS = rootfs;
+  };
+} ''
+  read -r roothash < "$ROOTFS/rootfs.verity.roothash"
+  { \
+      printf "[UKI]\nDeviceTreeAuto="
+      if [ -d "$DTBS" ]; then
+          find "$DTBS" -name '*.dtb' -print0 | tr '\0' ' '
+      fi
+  } | ukify build \
+      --output "$out" \
+      --config /dev/stdin \
+      --linux "$KERNEL" \
+      --initrd "$INITRAMFS" \
+      --os-release $'NAME="Spectrum"\n' \
+      --cmdline "ro intel_iommu=on roothash=$roothash"
+  ''
+) (_: {})
diff --git a/pkgs/default.nix b/pkgs/default.nix
index cc60228a10cddcb70e5ab9faa1bab7d74f3ebb35..c9f6dcfad9369567468b30d1c5697e3551a7b236 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -36,6 +36,7 @@ let
       path: (import path { inherit (self) callPackage; }).override;
 
     rootfs = self.callSpectrumPackage ../host/rootfs {};
+    efi = self.callSpectrumPackage ../host/efi.nix {};
     spectrum-build-tools = self.callSpectrumPackage ../tools {
       appSupport = false;
       buildSupport = true;
diff --git a/release/live/Makefile b/release/live/Makefile
index 191b44944af0adf965e1d5f2785719b236bfd99c..4de8743f42dec65aa863c3020cd70124316a6118 100644
--- a/release/live/Makefile
+++ b/release/live/Makefile
@@ -19,19 +19,8 @@ $(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sf
 build/empty:
 	mkdir -p $@
 
-build/spectrum.efi: $(DTBS) $(KERNEL) $(INITRAMFS) $(ROOT_FS_VERITY_ROOTHASH)
-	{ \
-	    printf "[UKI]\nDeviceTreeAuto=" && \
-	    find $(DTBS) -name '*.dtb' -print0 | tr '\0' ' ' ;\
-	} | $(UKIFY) build \
-	    --output $@ \
-	    --config /dev/stdin \
-	    --linux $(KERNEL) \
-	    --initrd $(INITRAMFS) \
-	    --os-release $$'NAME="Spectrum"\n' \
-	    --cmdline "ro intel_iommu=on roothash=$$(cat "$$ROOT_FS_VERITY_ROOTHASH")"
-
-build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi
+build/boot.fat: $(SYSTEMD_BOOT_EFI) $(EFI_IMAGE) build/empty
+	ln -sf -- "$$EFI_IMAGE" build/spectrum.efi
 	$(TRUNCATE) -s 440401920 $@
 	$(MKFS_FAT) $@
 	$(MMD) -i $@ ::/EFI ::/EFI/BOOT ::/EFI/Linux
diff --git a/release/live/default.nix b/release/live/default.nix
index 9a62d4da9cfea11d94d2a1d5764d41587efd5ad5..c234d87e62cc9ae65ba60f94bab6e58b43beddbc 100644
--- a/release/live/default.nix
+++ b/release/live/default.nix
@@ -6,7 +6,7 @@ import ../../lib/call-package.nix (
 { callSpectrumPackage, spectrum-build-tools, rootfs, src
 , lib, pkgsStatic, stdenvNoCC
 , cryptsetup, dosfstools, jq, mtools, util-linux
-, systemdUkify
+, systemdUkify, efi
 }:
 
 let
@@ -14,13 +14,6 @@ let
 
   stdenv = stdenvNoCC;
 
-  systemd = systemdUkify.overrideAttrs ({ mesonFlags ? [], ... }: {
-    # The default limit is too low to build a generic aarch64 distro image:
-    # https://github.com/systemd/systemd/pull/37417
-    mesonFlags = mesonFlags ++ [ "-Defi-stub-extra-sections=3000" ];
-  });
-
-  initramfs = callSpectrumPackage ../../host/initramfs {};
   efiArch = stdenv.hostPlatform.efiArch;
 in
 
@@ -40,19 +33,17 @@ stdenv.mkDerivation {
   sourceRoot = "source/release/live";
 
   nativeBuildInputs = [
-    cryptsetup dosfstools jq spectrum-build-tools mtools systemd util-linux
+    cryptsetup dosfstools jq spectrum-build-tools mtools util-linux
   ];
 
   env = {
-    INITRAMFS = initramfs;
     KERNEL = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}";
     ROOT_FS = "${rootfs}/rootfs";
     ROOT_FS_VERITY = "${rootfs}/rootfs.verity.superblock";
     ROOT_FS_VERITY_ROOTHASH = "${rootfs}/rootfs.verity.roothash";
-    SYSTEMD_BOOT_EFI = "${systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
+    SYSTEMD_BOOT_EFI = "${efi.systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
+    EFI_IMAGE = efi;
     EFINAME = "BOOT${toUpper efiArch}.EFI";
-  } // lib.optionalAttrs stdenv.hostPlatform.linux-kernel.DTB or false {
-    DTBS = "${rootfs.kernel}/dtbs";
   };
 
   buildFlags = [ "dest=$(out)" ];
@@ -65,6 +56,6 @@ stdenv.mkDerivation {
   unsafeDiscardReferences = { out = true; };
   dontFixup = true;
 
-  passthru = { inherit initramfs rootfs; };
+  passthru = { inherit rootfs; };
 }
 ) (_: {})

-- 
2.51.2

    