Commit Graph

2796 Commits

Author SHA1 Message Date
Thierry Laurion
443955e086
nv41/ns50 board config: Add note referring that those boards FB are GOP enabled just like the librem_11 for reference
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:50:31 -04:00
Thierry Laurion
eb2d8da983
nv41/ns50 coreboot config: apply 4cf15f2586c55d7c2f2c5136f08e7670eebc5012 also to ns50. Note: SMMSTORE and top-down resource allocation diff between ns50/nv41
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:50:27 -04:00
Thierry Laurion
7e31b204e1
nv41/ns50 coreboot config: make sure everything is saved with make BOARD=nitropad-n*** coreboot.modify_and_save_oldconfig_in_place
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:50:22 -04:00
Michał Żygowski
23976461d8
modules/coreboot: Avoid double quotes in LOCALVERSION
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:40:26 -04:00
Michał Żygowski
83f96aae5c
modules/coreboot: Remove the lines with config values before overriding them
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:40:21 -04:00
Michał Kopeć
1eef518daa
modules/coreboot: don't touch DMI vendor name if unspecified
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:40:16 -04:00
Michał Kopeć
3cfa4e91ae
Allow overriding DMI manufacturer name
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:40:11 -04:00
Michał Kopeć
3102666c91
coreboot-nitropad-nv41.config: disable RESOURCE_ALLOCATION_TOP_DOWN
Also disable bootsplash resizing to center the logo in the middle of
the screen.

Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:40:07 -04:00
Michał Żygowski
acc8044766
modules/coreboot: Allow overriding LOCALVERSION and SMBIOS_PRODUCT_NAME
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:40:02 -04:00
Michał Żygowski
c7dc6a8064
patches: Remove obsolete patches for nitropad builds
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:39:57 -04:00
Michał Żygowski
8e7e18920d
modules/nitrokey-blobs,boards/nitropad: Remove obsolete blobs module
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:39:53 -04:00
Michał Żygowski
6a64144e97
modules/coreboot,config/coreboot-nitropad: Update to the newest revision
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:39:48 -04:00
Thierry Laurion
77f1e346d0
Merge pull request #1640 from tlaurion/nitrokey_board_unification_clean-enable_htop_validated_autoboot
Nitrokey board cleaning+ unification cleanup (enable htop validated autoboot + tethering)
2024-05-10 14:20:16 -04:00
Thierry Laurion
181ce621bb
README.md Makefile: address comments in PR review for daily/non-daily Nix users, remove NIX_REPRO_NOTES, Makefile dev helpers self-explain themselves
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 12:04:32 -04:00
Jonathon Hall
c7f652bf89
Makefile: Use relative paths in configs generated from templates
Use relative paths in configs generated from templates, so the final
build doesn't depend on the absolute location of the repository.  The
coreboot config is part of the final ROM.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-09 19:44:10 -04:00
Jonathon Hall
6ce3d21e4c
modules/flashrom: Remove LIBS_BASE to stop linking in RPATH.
Specifying LIBS_BASE causes flashrom's Makefile to link in an RPATH,
using the Heads workspace path, which is not what we want.  It does
other things too, but we already pass the parts we need to the make
invocation for flashrom.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-09 12:20:17 -04:00
Thierry Laurion
e4976e7882
Re-add kgpe-d16 as UNMAINTAINED_* boards, still built by CircleCI (since cosntant interest in the builds)
Modify .circleci/config.yml to also not reuse past caches if CircleCI config changes as part of calculated hashes for the 3 layers
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-08 15:36:27 -04:00
Thierry Laurion
b4936ea42c
CircleCI: use v.0.1.4 produced with latest flake.nix which includes qemu_kvm for kvm testing in docker image
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-08 11:35:23 -04:00
Thierry Laurion
1bef1083e0
README.md: update repro notes. flake.nix: qemu_kvm was not included for native kvm support: added
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-08 11:30:23 -04:00
Thierry Laurion
03e861ea48
README.md: Add docs refs to setup docker and nix persistence over QubesOS Template/AppVM for usage. Expand on nix repro instructions fro NIX_REPRO_NOTES for review
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-07 12:09:39 -04:00
Thierry Laurion
f4db4b791c
README.md qemu.md + CircleCI: point to images for building and using nix developed created docker image
- push v0.1.3 and have latest point to the same image, add repro notes inside of README.md
- modify qemu.md to also refer to using docker images

TODO: remove NIX_REPRO_NOTES prior of merging

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-06 15:22:11 -04:00
Thierry Laurion
2b2356e87e
CircleCI: use tlaurion/heads-dev-env:v0.1.1 which reverts nix attempt of garbage collection inside of nix prior of making the docker
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-03 15:07:29 -04:00
Thierry Laurion
0b7ce534a8
WiP: revert garbage collector within nix environment. Doesn;t help and makes the docker image bigger
TODO: push v0.1.2 with those changes pointing circleci to use it
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-03 14:16:43 -04:00
Thierry Laurion
b65e8bf66d
nv41/ns50 shared linux config: reenable I2C, not even sure if needed
git difftool -d HEAD^ to check config against previous version (librem shared config), noticed I2C options being maybe relevant, added them back in

Then saved with make BOARD=nitropad-ns50 linux.modify_and_save_oldconfig_in_place

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-03 13:53:28 -04:00
Thierry Laurion
862f58f0da
config/linux-nitropad-x.config: bring par with librem_11 shared linux config (GOP compliant)
TODO: next, readd what might have been pertinent

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-03 13:43:31 -04:00
Thierry Laurion
8cace17940
nv41/ns50: coreboot configs saved in oldconfig
Result of:
make BOARD=nitropad-nv41 coreboot.save_in_oldconfig_format_in_place
make BOARD=nitropad-ns50 coreboot.save_in_oldconfig_format_in_place

No change, was applied like this anyway at compilation.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-03 13:35:46 -04:00
Thierry Laurion
0f412ed3ce
config/linux-nitropad-x.config: Add Tethering requirements
TODO: fix discrepencies in kernel config to limit technological debt in later commit in this PR
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-03 13:30:37 -04:00
Thierry Laurion
60e0d6017f
boards: uniformize nitropad boards with qemu-coreboot boards and against each other
- Add tethering in board configs
- Add autoboot after 5 seconds if HOTP remote attestation is  successful

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-03 13:29:17 -04:00
Thierry Laurion
865a0c6a2b
WiP: Boards configuration unification between x230-hotp-maximized and nitrokey boards: enable Automatic boot when HOTP valid after 5 seconds
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-03 12:30:20 -04:00
Thierry Laurion
3d0991f6c1
flake.nix: revert to mmlb state and testing
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-03 10:13:09 -04:00
Thierry Laurion
973e905ef6
flake.lock: revert to old package pinning
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-03 10:06:16 -04:00
Thierry Laurion
46cad549ef
WiP flake.nix: make docker image usable for testing as well, target: qemu-coreboot-whiptail-tpm2 with swtpm and canokey for smartcard
- include nix tools inside of the docker to be able to call the garbage collector prior of creating docker.
- protect roots from garbage collection (WiP)
  - Requires external preparation call so that nix (the binary) is not wiped as well. See NIX_REPRO_NOTES at the end of the file for repro notes
   - Could probably be improved. Works as of now and created a 4Gb vs 3.02Gb docker image I'm uploading now.
- CircleCI bumped to use v0.0.9 version including this
- CircleCI now depending on flake.lock for all cache layers. Will rebuild clean once again

So now we have qemu with canokey support in image, nix basic tools inside of container. Possible to call docker with DISPLAY, see NIX_REPRO_NOTES as of now.
That feels nice. No need of USB security dongle to have TPM based TPMTOTP nor detach sign? Not tested but feature is there

TODO:
- make docker creating nicer in the Nix way.
- Add canokey support under targets/qemu.mk
- add canokey board version

At least we have reproducible stack and testing stack being in same docker image. Docker image moved from 991.18MB (v0.0.8) to 1.18GB (v0.0.9)
- And I tried to clean binaries of symbols here! Seems like I do not know enough of the Nix way here.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 20:51:18 -04:00
Thierry Laurion
6070d8f6f0
CircleCI: use tlaurion/heads-dev-env:v0.0.8 which includes AC_LOCAL export of develop env into the docker image. Works locally for talos-2 board build.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:03:09 -04:00
Thierry Laurion
19bccf0cbd
Revert "modules/tpm2-tss: just remove LT_LIB_DLLOAD from aclocal generated file since there is no easy way of fixing this"
This reverts commit 6a1791112de451509d81e03bce5bdd6b1a49a79f.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:03:04 -04:00
Thierry Laurion
5b2b4dc0fd
flake.nix: add exporting of AC_LOCAL which was not exported in deveenv.sh.
Was causing another ac macro misbehavior since host ac was not considered by aclocal and autoreconf

TODO: Might want to revert 6a1791112de451509d81e03bce5bdd6b1a49a79f if talos-2 board is able to build 3rdparty/sb-sign-tool

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:03:00 -04:00
Thierry Laurion
50ab1c5b88
modules/patches slang: bump to version 2.3.3 so we can disable termcap without hacking around
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:02:55 -04:00
Thierry Laurion
9a72d9545a
CircleCI: use tlaurion/heads-dev-env:v0.0.7 which includes openssl in flake.nix for talos-2 board's linux config
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:02:50 -04:00
Thierry Laurion
89181181df
flake.nix: add openssl requirement to build talos-2 board's kernel
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:02:45 -04:00
Thierry Laurion
35530f9115
modules/msrtools : add missing MAKE_JOBS for parallel builds
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:02:41 -04:00
Thierry Laurion
fa60bf7dfb
modules/tpm2-tss: just remove LT_LIB_DLLOAD from aclocal generated file since there is no easy way of fixing this
nix doesn't provide an equivalent of libltdl-dev, so just wipe the remnant of old ages if present
https://github.com/tpm2-software/tpm2-tss/issues/2161

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:02:36 -04:00
Thierry Laurion
76c20847da
CircleCI: add CircleCI step to source manually /devenv.sh in build_board additional step
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:02:31 -04:00
Thierry Laurion
70a9f93ddf
Revert "CirlceCI: use docker v0.0.6 which flake.nix jumped from zlib/zlib.dev to zlib-ng"
This reverts commit 9052d2b562162183fa201ebf89c75be904d87281.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:02:26 -04:00
Thierry Laurion
f676405ae1
Revert "flake.nix: change zlib and zlib.dev for zlib-ng? https://app.circleci.com/pipelines/github/tlaurion/heads/2500/workflows/23674215-8b22-4852-adf4-2a6df9e44353/jobs/45080?invite=true#step-102-16530_106 zlib-dev not found on coreboot buildstack buildstep..."
This reverts commit d6c499676ed07037bcb4ca66db3d3876a87de23b.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:02:22 -04:00
Thierry Laurion
53ca8d3554
CirlceCI: use docker v0.0.6 which flake.nix jumped from zlib/zlib.dev to zlib-ng
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:02:17 -04:00
Thierry Laurion
32e7082f09
flake.nix: change zlib and zlib.dev for zlib-ng? https://app.circleci.com/pipelines/github/tlaurion/heads/2500/workflows/23674215-8b22-4852-adf4-2a6df9e44353/jobs/45080?invite=true#step-102-16530_106 zlib-dev not found on coreboot buildstack buildstep...
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:02:12 -04:00
Thierry Laurion
b45fc960cf
CircleCI: Test tlaurion/heads-dev-env:v.0.0.5 (created from flake develop) which fails at tpm2-tss
- switch cache to nix-docker-heads to not interfere with nixos develop layer on same PR
- remove nix develop calls; replace by direct script calls and make calls
- make sure save/restore/root is ~/heads

Signed-off-by: Thierry Laurion <insurgo@riseup.net>

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:02:07 -04:00
Thierry Laurion
093fc4a73e
Makefile: reduce dependencies on external tools for dynamic MAKE_JOBS creation. Cleaner NIX_REPRO_NOTES
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:02:03 -04:00
Thierry Laurion
c197d6193a
NIX_REPRO_NOTES: Add notes to help repro and go farther faster without loosing traces of reproduction notes
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:01:58 -04:00
Thierry Laurion
975a2424cd
Makefile: add yet another helper real.remove_canary_files-extract_patch_rebuild_what_changed: reextract packages, repatch sources (might fail, easy to fix) and rebuild only what changed (not a lot)
if patch fails to apply, its because patch file creates a file and doesn't expect it to exist.
just call rm on the file reported to exist, and relaunch build.

Deletes ./install/*/* and permits to rebuild all dependencies in order, just based on freshly extracted and patched code.
Bonus, this saves your SDD from unneeded wear and rebuilds faster then all other Mafile helpers.

That's my favorite.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:01:53 -04:00
Thierry Laurion
a29f92a26d
modules/* : WiP for tpm2-* while having added MAKE_JOBS to modules that were missing it to propogate build optimizations per module, while still impossible to call make -j 12 on main make call
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:01:48 -04:00