Commit Graph

19 Commits

Author SHA1 Message Date
Thierry Laurion
4bbd1e8af3 flake.nix: Add fakeroot requirements so root user can be discovered through (/etc/passwd /etc/group file construction)
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-10-15 09:50:14 -04:00
Thierry Laurion
9196509ba6 flake.nix: add binwalk and uefi-firmware-parser to extract OEM firmware images to blobs needed by scripts
Requirements reproducing https://docs.dasharo.com/variants/dell_optiplex/initial-deployment/#firmware-preparation

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-10-15 09:50:14 -04:00
Thierry Laurion
8ff19d17bc
Bump nix develop based docker image to tlaurion/heads-dev-env:v0.2.1: include moreutils to be able to use 'ts' in CircleCI builds ('make BOARD=xyz V=1 | ts') to give timestamps of each make step
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-07-26 11:44:33 -04:00
Jonathon Hall
265b1da920
Revert "Merge pull request from tlaurion/interim_fix_1712"
This reverts commit c43b6fc05f, reversing
changes made to fb9c558ba4.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2024-07-15 16:53:59 -04:00
Thierry Laurion
b20cde8c61
Revert "Merge pull request from JonathonHall-Purism/purism_coreboot_24.02.01"
This reverts commit 7025031702, reversing
changes made to 156d2c80dd.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-07-09 09:29:37 -04:00
Jonathon Hall
2ba56d1304
modules/coreboot: 24.02.01-Purism-1, remove CFLAGS overrides, needs nss
Update Purism coreboot to 24.02.01-Purism-1.

Remove CFLAGS overrides when building coreboot.  These overrides break
24.02.01, which added (and needs) --param=min-pagesize=1024.  This has
happened repeatedly in the past since Heads has to duplicate coreboot's
CFLAGS if it overrides them.

Specifically, the build fails with this error:
src/commonlib/include/commonlib/endian.h:27:26: error: array subscript 1 is outside array bounds of 'void[0]' [-Werror=array-bounds=]
   27 |         *(uint8_t *)dest = val;
      |         ~~~~~~~~~~~~~~~~~^~~~~
In function 'setup_default_ebda':
cc1: note: source object is likely at address zero

That's because coreboot is attempting to write to EBDA at physical
address 0x40e, just above 1024.  That is a valid address for x86, but
it's too close to 0 by default for GCC, --param-min-pagesize=1024
allows writes to physical addresses above 1024.

coreboot shouldn't need any of the usual Heads CFLAGS overrides for
reproducibility; it is already reproducible.

Fix indentation in modules/coreboot.  Make accepted it before because
the indented lines followed a variable assignment, so they couldn't
be part of a recipe.  That assignment is now gone, so they're now
interprted as part of a recipe for the `.configured` target just above,
they should not be indented.

Add nss to flake.nix, needed as of 24.02.01.

Update Librem coreboot configs for 24.02.01-Purism-1.  Notably, the
board Kconfig changed for Mini v2 in coreboot, so this is needed for
correct builds.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2024-06-19 12:38:45 -04:00
Thierry Laurion
edd4378b60
flake.nix: remove commented material, add some more comments where needed
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-30 17:05:29 -04:00
Thierry Laurion
c7d1495a0a
Use nixos-unstable channel's prebuilt qemu_full with canokey support builtin, downloaded from nix cache
- flake.lock: bumps lcoekd package list to latest packages list through 'nix flake update'
- flake.nix : comment out customizations of derivatives, removing canokey-qemu lib since qemu_full depends on qemu which depends on canokey-qemu by default now
- flake.nux: add 'less' so that 'git log' is usable
- circleci/config.yml: use docker v0.1.9
- README.md : update docker image maintainer notes to ease upstreaming of docker images and for others to play around, requiring dockerhub account

For testing iterations of this, I used:
docker_version="v0.1.9" && docker_hub_repo="tlaurion/heads-dev-env" && sed "s@\(image: \)\(.*\):\(v[0-9]*\.[0-9]*\.[0-9]*\)@\1\2:$docker_version@" -i .circleci/config.yml && nix --print-build-logs --verbose develop --ignore-environment --command true && nix build .#dockerImage && docker load < result && docker tag linuxboot/heads:dev-env "$docker_hub_repo:$docker_version" && docker push "$docker_hub_repo:$docker_version"
Then added final commit, and pushed.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-25 12:55:28 -04:00
Thierry Laurion
37f04e2855
Fix key to card failing with invalid time when moving keys to smartcard on master (Opt: Authenticated Heads)
- Revert gnupg toolstack version bump to prior of  merge (2.4.2 -> 2.4.0). Version bump not needed for reproducibility.
  - Investigation and upstream discussions will take their time resolving invalid time issue introduced by between 2.4.0 and latest gnupg, fix regression first under master)

- oem-factory-reset
  - Adding DO_WITH_DEBUG to oem-factory-reset for all its gpg calls. If failing in debug mode, /tmp/debug.txt contains calls and errors
  - Wipe keyrings only (*.gpg, *.kbx)  not conf files under gpg homedir (keep initrd/.gnupg/*.conf)

- flake.nix
  - switch build derivative from qemu and qemu_kvm to qemu_full to have qemu-img tool which was missing to run qemu boards (v0.1.8 docker)
  - add gnupg so that qemu boards can call inject_gpg to inject public key in absence of flashrom+pflash support for internal flashing

- flake.lock: Updated nix pinned package list under flake.lock with 'nix flake update' so qemu_full builds

- README.md: have consistent docker testing + release (push) notes

- .circleci/config.yml: depend on docker v0.1.8 (qemu_full built with canokey-qemu lib support, diffoscopeMinimal and gnupg for proper qemu testing)

TODO:
- some fd2 instead of fd1?!
- oem-factory-resest has whiptail_or_die which sets whiptail box to HEIGHT 0. This doesn't show a scrolling window on gpg errors which is problematic with fbwhiptail, not whiptail

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-17 09:27:29 -04:00
Thierry Laurion
c73692e4f3
flake.nix + qemu.mk : add working qemu-canokey usable from all qemu boards by default
flake.nix: add canokey-qemu lib, derivate qemu on tope of it and have qemu_kvm depend on qemu derivative
targets/qemu.mk: modified to had canokey support by default if no "USB_TOKEN=" specified on make run call

CircleCI: base docker image pull on v0.1.6 containing the newly added derivatives
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-12 13:51:28 -04:00
Thierry Laurion
1bef1083e0
README.md: update repro notes. flake.nix: qemu_kvm was not included for native kvm support: added
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-08 11:30:23 -04:00
Thierry Laurion
0b7ce534a8
WiP: revert garbage collector within nix environment. Doesn;t help and makes the docker image bigger
TODO: push v0.1.2 with those changes pointing circleci to use it
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-03 14:16:43 -04:00
Thierry Laurion
3d0991f6c1
flake.nix: revert to mmlb state and testing
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-03 10:13:09 -04:00
Thierry Laurion
46cad549ef
WiP flake.nix: make docker image usable for testing as well, target: qemu-coreboot-whiptail-tpm2 with swtpm and canokey for smartcard
- include nix tools inside of the docker to be able to call the garbage collector prior of creating docker.
- protect roots from garbage collection (WiP)
  - Requires external preparation call so that nix (the binary) is not wiped as well. See NIX_REPRO_NOTES at the end of the file for repro notes
   - Could probably be improved. Works as of now and created a 4Gb vs 3.02Gb docker image I'm uploading now.
- CircleCI bumped to use v0.0.9 version including this
- CircleCI now depending on flake.lock for all cache layers. Will rebuild clean once again

So now we have qemu with canokey support in image, nix basic tools inside of container. Possible to call docker with DISPLAY, see NIX_REPRO_NOTES as of now.
That feels nice. No need of USB security dongle to have TPM based TPMTOTP nor detach sign? Not tested but feature is there

TODO:
- make docker creating nicer in the Nix way.
- Add canokey support under targets/qemu.mk
- add canokey board version

At least we have reproducible stack and testing stack being in same docker image. Docker image moved from 991.18MB (v0.0.8) to 1.18GB (v0.0.9)
- And I tried to clean binaries of symbols here! Seems like I do not know enough of the Nix way here.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 20:51:18 -04:00
Thierry Laurion
5b2b4dc0fd
flake.nix: add exporting of AC_LOCAL which was not exported in deveenv.sh.
Was causing another ac macro misbehavior since host ac was not considered by aclocal and autoreconf

TODO: Might want to revert 6a1791112de451509d81e03bce5bdd6b1a49a79f if talos-2 board is able to build 3rdparty/sb-sign-tool

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:03:00 -04:00
Thierry Laurion
89181181df
flake.nix: add openssl requirement to build talos-2 board's kernel
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:02:45 -04:00
Thierry Laurion
f676405ae1
Revert "flake.nix: change zlib and zlib.dev for zlib-ng? https://app.circleci.com/pipelines/github/tlaurion/heads/2500/workflows/23674215-8b22-4852-adf4-2a6df9e44353/jobs/45080?invite=true#step-102-16530_106 zlib-dev not found on coreboot buildstack buildstep..."
This reverts commit d6c499676ed07037bcb4ca66db3d3876a87de23b.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:02:22 -04:00
Thierry Laurion
32e7082f09
flake.nix: change zlib and zlib.dev for zlib-ng? https://app.circleci.com/pipelines/github/tlaurion/heads/2500/workflows/23674215-8b22-4852-adf4-2a6df9e44353/jobs/45080?invite=true#step-102-16530_106 zlib-dev not found on coreboot buildstack buildstep...
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:02:12 -04:00
Manuel Mendez
2824f48f9e
Add nix files
Signed-off-by: Manuel Mendez <github@i.m.mmlb.dev>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-02 13:01:05 -04:00