[PATCH v4 2/2] Move UKI creation to a separate derivation

19 Nov 2025

It will be used by the update code later.

No functional change intended, other than a trivial shell script
refactoring.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
I kept release/live/default.nix using the UKI's systemd because the old
code did it that way.  Changing this would be better in a separate
commit.
---
 host/efi.nix             | 40 ++++++++++++++++++++++++++++++++++++++++
 host/rootfs/Makefile     |  8 ++++----
 release/live/Makefile    | 16 ++--------------
 release/live/default.nix | 27 +++++++++++----------------
 release/live/shell.nix   | 10 ++++++++--
 5 files changed, 65 insertions(+), 36 deletions(-)

diff --git a/host/efi.nix b/host/efi.nix
new file mode 100644
index 0000000000000000000000000000000000000000..d0ce260bd908c186059b75a1b4f42258b0e62bff
--- /dev/null
+++ b/host/efi.nix
@@ -0,0 +1,40 @@
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: 2021-2024 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+
+import ../lib/call-package.nix (
+{ callSpectrumPackage, config, cryptsetup, rootfs
+, runCommand, stdenv, systemdUkify
+}:
+let
+  initramfs = callSpectrumPackage ./initramfs {};
+  kernel = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}";
+  systemd = systemdUkify.overrideAttrs ({ mesonFlags ? [], ... }: {
+    # The default limit is too low to build a generic aarch64 distro image:
+    # https://github.com/systemd/systemd/pull/37417
+    mesonFlags = mesonFlags ++ [ "-Defi-stub-extra-sections=3000" ];
+  });
+in
+
+runCommand "spectrum-efi" {
+  nativeBuildInputs = [ cryptsetup systemd ];
+  __structuredAttrs = true;
+  unsafeDiscardReferences = { out = true; };
+  dontFixup = true;
+  passthru = { inherit initramfs rootfs systemd; };
+} ''
+  read -r roothash < ${rootfs}/rootfs.verity.roothash
+  { \
+      printf "[UKI]\nDeviceTreeAuto="
+      if [ -d ${rootfs.kernel}/dtbs ]; then
+          find ${rootfs.kernel}/dtbs -name '*.dtb' -print0 | tr '\0' ' '
+      fi
+  } | ukify build \
+      --output "$out" \
+      --config /dev/stdin \
+      --linux ${kernel} \
+      --initrd ${initramfs} \
+      --os-release $'NAME="Spectrum"\n' \
+      --cmdline "ro intel_iommu=on roothash=$roothash"
+  ''
+) (_: {})
diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile
index 055185064d84d9450c2076fdeb410b21d00f1d40..4c14d3acfa8f7ffd276fdfb684d08bf58fd80a15 100644
--- a/host/rootfs/Makefile
+++ b/host/rootfs/Makefile
@@ -46,6 +46,10 @@ FIFOS = etc/s6-linux-init/run-image/service/s6-svscan-log/fifo
 
 BUILD_FILES = build/etc/s6-rc
 
+# This rule produces three files but Make only (portably)
+# supports one output per rule.  Instead of resorting to temporary
+# files, a timestamp file is created as the last step.  The actual
+# outputs are produced as side-effects.
 build/verity-timestamp: $(ROOT_FS)
 	$(VERITYSETUP) format \
 		--root-hash-file $(ROOT_FS_VERITY_ROOTHASH) \
@@ -54,10 +58,6 @@ build/verity-timestamp: $(ROOT_FS)
 	echo >> $(ROOT_FS_VERITY_ROOTHASH)
 	touch -- $(ROOT_FS_DIR)/verity-timestamp
 
-# This rule produces three files but Make only (portably)
-# supports one output per rule.  Instead of resorting to temporary
-# files, a timestamp file is created as the last step.  The actual
-# outputs are produced as side-effects.
 $(ROOT_FS): ../../scripts/make-erofs.sh $(PACKAGES_FILE) $(FILES) $(BUILD_FILES) build/empty build/fifo file-list.mk
 	mkdir -p $(ROOT_FS_DIR) && \
 	{ \
diff --git a/release/live/Makefile b/release/live/Makefile
index 7372b41d94bfb10f7761955d9d1a246e9785b7f8..d61248e94599adc5229d0ad38d54b9f649d66ca1 100644
--- a/release/live/Makefile
+++ b/release/live/Makefile
@@ -19,23 +19,11 @@ $(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sf
 build/empty:
 	mkdir -p $@
 
-build/spectrum.efi: $(DTBS) $(KERNEL) $(INITRAMFS) $(ROOT_FS_VERITY_ROOTHASH)
-	{ \
-	    printf "[UKI]\nDeviceTreeAuto=" && \
-	    find $(DTBS) -name '*.dtb' -print0 | tr '\0' ' ' ;\
-	} | $(UKIFY) build \
-	    --output $@ \
-	    --config /dev/stdin \
-	    --linux $(KERNEL) \
-	    --initrd $(INITRAMFS) \
-	    --os-release $$'NAME="Spectrum"\n' \
-	    --cmdline "ro intel_iommu=on roothash=$$(cat $(ROOT_FS_VERITY_ROOTHASH))"
-
-build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi
+build/boot.fat: $(SYSTEMD_BOOT_EFI) $(EFI_IMAGE) build/empty
 	$(TRUNCATE) -s 440401920 $@
 	$(MKFS_FAT) $@
 	$(MMD) -i $@ ::/EFI ::/EFI/BOOT ::/EFI/Linux
-	$(MCOPY) -i $@ build/spectrum.efi ::/EFI/Linux
+	$(MCOPY) -i $@ $(EFI_IMAGE) ::/EFI/Linux/spectrum.efi
 	$(MCOPY) -i $@ $(SYSTEMD_BOOT_EFI) ::/EFI/BOOT/$(EFINAME)
 
 clean:
diff --git a/release/live/default.nix b/release/live/default.nix
index 7adaefef330daf11372cff0d2d04cca400efba1f..ac2d7a55fd4fe0c02108309ecea20e368000af0d 100644
--- a/release/live/default.nix
+++ b/release/live/default.nix
@@ -3,10 +3,9 @@
 # SPDX-FileCopyrightText: 2022 Unikie
 
 import ../../lib/call-package.nix (
-{ callSpectrumPackage, spectrum-build-tools, rootfs, src
+{ callSpectrumPackage, spectrum-build-tools, src
 , lib, pkgsStatic, stdenvNoCC
 , cryptsetup, dosfstools, jq, mtools, util-linux
-, systemdUkify
 }:
 
 let
@@ -14,14 +13,12 @@ let
 
   stdenv = stdenvNoCC;
 
-  systemd = systemdUkify.overrideAttrs ({ mesonFlags ? [], ... }: {
-    # The default limit is too low to build a generic aarch64 distro image:
-    # https://github.com/systemd/systemd/pull/37417
-    mesonFlags = mesonFlags ++ [ "-Defi-stub-extra-sections=3000" ];
-  });
-
-  initramfs = callSpectrumPackage ../../host/initramfs {};
   efiArch = stdenv.hostPlatform.efiArch;
+
+  efi = callSpectrumPackage ../../host/efi.nix {};
+
+  # The initramfs and rootfs must match those used to build the UKI.
+  inherit (efi) initramfs rootfs systemd;
 in
 
 stdenv.mkDerivation {
@@ -40,17 +37,15 @@ stdenv.mkDerivation {
   sourceRoot = "source/release/live";
 
   nativeBuildInputs = [
-    cryptsetup dosfstools jq spectrum-build-tools mtools systemd util-linux
+    cryptsetup dosfstools jq spectrum-build-tools mtools util-linux
   ];
 
   env = {
-    INITRAMFS = initramfs;
-    KERNEL = "${rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}";
-    ROOT_FS_DIR = rootfs;
+    KERNEL = "${efi.rootfs.kernel}/${stdenv.hostPlatform.linux-kernel.target}";
+    ROOT_FS_DIR = "${efi.rootfs}";
     SYSTEMD_BOOT_EFI = "${systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
+    EFI_IMAGE = efi;
     EFINAME = "BOOT${toUpper efiArch}.EFI";
-  } // lib.optionalAttrs stdenv.hostPlatform.linux-kernel.DTB or false {
-    DTBS = "${rootfs.kernel}/dtbs";
   };
 
   buildFlags = [ "dest=$(out)" ];
@@ -63,6 +58,6 @@ stdenv.mkDerivation {
   unsafeDiscardReferences = { out = true; };
   dontFixup = true;
 
-  passthru = { inherit initramfs rootfs; };
+  passthru = { inherit efi initramfs rootfs; };
 }
 ) (_: {})
diff --git a/release/live/shell.nix b/release/live/shell.nix
index c5db7b732ef048b4c0cb87a4c5ea614e993db516..ffaa9a571c662810348822a5952d479d251a25e5 100644
--- a/release/live/shell.nix
+++ b/release/live/shell.nix
@@ -1,7 +1,12 @@
 # SPDX-License-Identifier: MIT
 # SPDX-FileCopyrightText: 2021-2024 Alyssa Ross <hi@alyssa.is>
 
-import ../../lib/call-package.nix ({ callSpectrumPackage, stdenv, qemu_kvm, rootfs }:
+import ../../lib/call-package.nix (
+{ callSpectrumPackage, stdenv, qemu_kvm }:
+
+let
+  efi = callSpectrumPackage ../../host/efi.nix {};
+in
 
 (callSpectrumPackage ./. {}).overrideAttrs (
   { nativeBuildInputs ? [], env ? {}, ... }:
@@ -10,7 +15,8 @@ import ../../lib/call-package.nix ({ callSpectrumPackage, stdenv, qemu_kvm, root
 
     env = env // {
       OVMF_CODE = "${qemu_kvm}/share/qemu/edk2-${stdenv.hostPlatform.qemuArch}-code.fd";
-      ROOT_FS_DIR = rootfs;
+      ROOT_FS_DIR = efi.rootfs;
+      EFI_IMAGE = efi;
     };
   }
 )) (_: {})

-- 
2.52.0

    