lanzaboote-stub: init at 0.3.0 by RaitoBezarius · Pull Request #231951 · NixOS/nixpkgs

RaitoBezarius · 2023-05-14T23:13:02Z

Description of changes

This brings https://github.com/nix-community/lanzaboote UEFI stub in-tree.

Dependents:

nixos/boot/systemd-boot: add UEFI Secure Boot via lanzaboote #263713

Dependencies:

Either of:
- lib.systems.inspect: isEfi → hasEfi rename #263711
- lib.systems.inspect: deprecate isEfi #264297

Stub and tool are packaged in the global hierarchy as: lanzaboote-tool and lanzaboote-uefi-stub, no assumption on the system are encoded inside their package respectively.

It is expected to build the UEFI stub using a UEFI system with a UEFI compiler.

The linker is a flavored linker which will propagate adequately the lld Windows-style driver for arguments.

lanzaboote-tool is supposed to be wrapped to know about its lanzaboote-stub, unfortunately, this is impossible to achieve inside of nixpkgs, multiple attempts were proposed to the reviewers in the next section and were all rejected. Therefore, the only solution is to give up on having a wrapped lanzaboote-tool and propose a semi-wrapped lanzaboote-tool and expect the user to understand they have to export the LANZABOOTE_STUB environment variable to know about the stub itself.

This is what we do in the systemd-boot NixOS module ourselves and we expect to work in many cases, either case, author would like to move this PR forward ideally and not concern themselves further with the semi wrapping issue stemming from the impossibility to build a package as a data via cross-compilation inside of nixpkgs, alas.

What has been tried?

Trivial implementation using nixpkgs reimport inside of pkgs/ hierarchy: NACK because it reimports nixpkgs inside nixpkgs.
Introduction of a UEFI system example: NACK because there is divergence on the system data, see discussion on MinGW style vs MSVC and GNU-Config as a general.
Complicated implementation by locally rebooting nixpkgs inside the package definition of the tool to compile the stub using a hacked stdenv: NACK because it's too complicated.
Complicated implementation by locally rebooting a new package scope called uefiPkgs for cross compilation inside nixpkgs without a direct reimport: NACK because it's too complicated and does not compose well.

Some funny questions

It seems like this PR tries to move to make UEFI a proper target in nixpkgs, but there's already plenty of "data as UEFI binaries" inside of nixpkgs without any cross compilation involved per se:

EDK2/OVMF firmware
systemd-boot
GRUB EFI

Ideally, we should treat the same way as in this PR, I suppose this will be very hard given their build system.

Things done

ghost · 2023-06-19T07:20:25Z

#235230 is done; reviewing this PR is next on my list.

ghost · 2023-10-30T07:44:55Z

will wait for him to go into staging

It's only on staging because it needs d474c87. That commit is in staging-next, so at the next merge of staging to master I will be able to switch the base branch of #235230 back to master.

I will rebase on @amjoseph-nixpkgs PR for testing the triples for gnu-config,

Oh you don't need to wait for #235230 and in fact you shouldn't, since it causes a mass-rebuild.

Just please check that the CI it adds still passes with (the final version of) this PR. If it doesn't pass either it found a bug in your PR, or your PR found a bug in the new tests -- either way let me know so we're aware.

I'm thinking ahead to a scenario where this PR merges ahead of the 23.11 branch-off but #235230 doesn't.

ghost · 2023-10-30T07:50:05Z

And… it's clear that even with this patch, this is insufficient. Everything else is unfinished, it explodes at compiler-rt:

Github needs a 😭 reaction/vote

ghost · 2023-10-30T07:54:27Z

And… it's clear that even with this patch, this is insufficient. Everything else is unfinished, it explodes at compiler-rt:

What about the following? It's gross, but as long as LLVM has merged the change into LLVM17 it's effectively just a different way of backporting that change:

diff --git a/pkgs/development/compilers/llvm/16/llvm/default.nix b/pkgs/development/compilers/llvm/16/llvm/default.nix
index 9475b5c99485..c5bcfd35c5bf 100644
--- a/pkgs/development/compilers/llvm/16/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/16/llvm/default.nix
@@ -36,6 +36,10 @@
 let
   inherit (lib) optional optionals optionalString;

+  hackThemTriplesForGreatJustice = triple: {
+    "aarch64-unknown-uefi" = "aarch64-windows";
+  }.${triple} or triple;
+
   # Used when creating a version-suffixed symlink of libLLVM.dylib
   shortVersion = with lib;
     concatStringsSep "." (take 1 (splitString "." release_version));
@@ -308,8 +312,8 @@ in
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
+    "-DLLVM_HOST_TRIPLE=${hackThemTriplesForGreatJustice stdenv.hostPlatform.config}"
+    "-DLLVM_DEFAULT_TARGET_TRIPLE=${hackThemTriplesForGreatJustice stdenv.hostPlatform.config}"
     "-DLLVM_ENABLE_DUMP=ON"
   ] ++ optionals stdenv.hostPlatform.isStatic [
     # Disables building of shared libs, -fPIC is still injected by cc-wrapper

alyssais · 2023-10-30T08:12:53Z

I think backporting the Triple commit seems fair, but I don't mind waiting for LLVM17 though it's tiring.

Last I remember, LLVM 17 was basically ready I think? Can we push it over the line?

RaitoBezarius · 2023-10-30T08:57:07Z

LLVM17 has only the basic changes, things like data layout of the target description are wrong. I'd need to wait LLVM18 if I started working on this myself. Le lun. 30 oct. 2023, 09:13, Alyssa Ross ***@***.***> a écrit :

…

I think backporting the Triple commit seems fair, but I don't mind waiting for LLVM17 though it's tiring. Last I remember, LLVM 17 was basically ready I think? Can we push it over the line? — Reply to this email directly, view it on GitHub <#231951 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AACMZRGT6GSLYAZDC2ANLNLYB5ORDAVCNFSM6AAAAAAYBODJ3WVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTOOBUGY4DAMJQGA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

ghost · 2023-11-01T07:13:18Z

+  patches = [
+    ./support-uefi-triples.patch
+  ];
+


I'm flattered that you included my patch but since it hasn't been merged upstream I don't think we should do this yet.

Instead I've added *-*-uefi to the exception-list: ~~54ddd6e~~ 20a384e in #235230

If gnu-config merges the patch then we can just drop the exception. If they don't, then the fallout is limited to having an extra exception rather than having to back out the patch (which causes a total rebuild of the entire packageset).

Pushed a17e894 to this branch to drop the patch. Speeds up CI since gnu-config is part of stdenv.

ghost · 2023-11-01T07:49:56Z

Edited top comment to get github to display the merged/open/draft icon, and note that #264297 can be used instead of #263711

…/5495945c851a7bc9770eda5a3ed63c25 This commit fixes the CI failures with PR 231951: - https://gist.github.com/GrahamcOfBorg/5495945c851a7bc9770eda5a3ed63c25

ghost · 2023-11-01T07:54:46Z

Pushed to this branch:

6bc656b to fix CI.
a17e894 to drop the gnu-config patch.

When I run CI locally it passes. Let's see what ofborg says.

ghost

Got CI to pass.

My opinion remains unchanged: UEFI is a boondoggle.

But if the boon must be doggled, at least it will be done using Nix and Rust. 🤷‍♂️

ghost · 2023-11-01T08:05:54Z

+    homepage = "https://github.com/nix-community/lanzaboote";
+    license = licenses.gpl3Only;
+    mainProgram = "lanzaboote_stub.efi";
+    platforms = [ "x86_64-uefi" "i686-uefi" "aarch64-uefi" ];


Suggested change

platforms = [ "x86_64-uefi" "i686-uefi" "aarch64-uefi" ];

hydraPlatforms = [ lib.systems.inspect.platformPatterns.isUefi ];

ghost · 2023-11-01T08:07:01Z

+    platforms = [ "x86_64-uefi" "i686-uefi" "aarch64-uefi" ];
+    # i686: Builtins errors
+    # aarch64: compile fine but...
+    broken = stdenv.isi686 || stdenv.isAarch64;


Suggested change

broken = stdenv.isi686 || stdenv.isAarch64;

broken = with stdenv.hostPlatform; isi686 || isAarch64;

ghost · 2023-11-01T08:07:21Z

+    linker = "lld";
+  };
+
+


Suggested change

ghost · 2023-11-01T08:34:59Z

  redox         = filterDoubles predicates.isRedox;
  windows       = filterDoubles predicates.isWindows;
  genode        = filterDoubles predicates.isGenode;
+  uefi          = filterDoubles predicates.isEfiEnvironment;


Suggested change

uefi = filterDoubles predicates.isEfiEnvironment;

uefi = filterDoubles predicates.isUefi;

ghost · 2023-11-01T08:35:17Z

    isMusl         = with abis; map (a: { abi = a; }) [ musl musleabi musleabihf muslabin32 muslabi64 ];
    isUClibc       = with abis; map (a: { abi = a; }) [ uclibc uclibceabi uclibceabihf ];

+    isEfiEnvironment = [


Suggested change

isEfiEnvironment = [

isUefi = [

ghost · 2023-11-01T08:36:02Z

+    mainProgram = "lanzaboote_stub.efi";
+    platforms = [ "x86_64-uefi" "i686-uefi" "aarch64-uefi" ];
+    # i686: Builtins errors
+    # aarch64: compile fine but...


Suggested change

# aarch64: compile fine but...

# aarch64: compile fine but unable to test on real hardware

shouldn't it be # aarch64: compiles fine but unable to test on real hardware?

ghost · 2023-11-01T21:41:23Z

If you rebase this to a more recent staging (or switch branch to master) I think the ofborg rebuild tags will go away.

RaitoBezarius · 2023-11-02T10:02:40Z

If you rebase this to a more recent staging (or switch branch to master) I think the ofborg rebuild tags will go away.

I just need to do it when I don't feel like I will fuck up :D.

TobiPeterG · 2024-06-03T22:45:57Z

Is there any progress on this? :)

baloo · 2024-11-03T04:38:01Z

Got CI to pass.

@ghost

I'm a bit late to the party, but I'm trying to revive it in #353050, but I'm getting compilation errors on compiler-rt and I'm not sure which derivation you tried to build. None of the options I tried worked.

nixos-discourse · 2025-01-17T20:43:49Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/installation-medium-has-invalid-secure-boot-signature/58952/6

Mic92 · 2025-01-19T17:35:50Z

This pull requests is stalled.

RaitoBezarius · 2025-01-19T17:55:32Z

This pull requests is stalled.

Can I ask you the courtesy to ping the author of PR whom you close PRs? (Or put the documentation of that new nixpkgs process in your closing messages?)

Thank you.

Mic92 · 2025-01-20T09:06:38Z

Well, do you want to work on this? You said me in several occasions that you don't want to contribute to nixpkgs anymore and working on your NixOS fork. I do not think we should add too many processes to nixpkgs because it will make it too hard to understand how to make changes, so please just re-open the pull request again if you want to work on this. Otherwise just delete the branch.

RaitoBezarius · 2025-01-20T10:35:22Z

Well, do you want to work on this? You said me in several occasions that you don't want to contribute to nixpkgs anymore and working on your NixOS fork. I do not think we should add too many processes to nixpkgs because it will make it too hard to understand how to make changes, so please just re-open the pull request again if you want to work on this. Otherwise just delete the branch.

Again, all of this has nothing to do with my request. Simply ask before doing what when it comes to other people's work is what I would like you to do. Thank you.

Mic92 · 2025-01-20T11:11:48Z

Well, usually I ask them to re-open their pull request if they want to continue to work on the pull request. But I was 95% sure you would want not do that, so I kept it at that.

RaitoBezarius · 2025-01-20T11:20:05Z

Well, usually I ask them to re-open their pull request if they want to continue to work on the pull request. But I was 95% sure you would want not do that, so I kept it at that.

If you want to make up your own rules, please consider discussing it with others before applying them out of the blue, especially when it comes to the work of others. "Closing then asking to re-open" is not courtesy, it's just you doing whatever you think is acceptable to do at any time, and you are continuing to shove your view.

rrbutani mentioned this pull request May 15, 2023

bintools-wrapper: support lld's -flavor argument #231960

Draft

12 tasks

RaitoBezarius force-pushed the lanzaboote branch from 111edf3 to c9fb579 Compare June 13, 2023 01:07

github-actions Bot added 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS 8.has: module (update) This PR changes an existing module in `nixos/` labels Jun 13, 2023

RaitoBezarius changed the title ~~lanzaboote: init at 0.3.0~~ lanzaboote-tool, lanzaboote-stub: init at 0.3.0, nixos/systemd-boot: init secureboot with lanzaboote Jun 13, 2023

RaitoBezarius requested review from blitz, danielfullmer and nikstur June 13, 2023 01:07

RaitoBezarius force-pushed the lanzaboote branch from c9fb579 to e1c2349 Compare June 13, 2023 01:36

RaitoBezarius requested review from ElvishJerricco and alyssais June 13, 2023 01:36

RaitoBezarius force-pushed the lanzaboote branch from e1c2349 to c521016 Compare June 13, 2023 01:56

Kranzes reviewed Jun 13, 2023

View reviewed changes

Comment thread nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix Outdated

ElvishJerricco reviewed Jun 13, 2023

View reviewed changes

Comment thread pkgs/tools/system/lanzaboote/tool.nix Outdated

Comment thread pkgs/tools/system/lanzaboote/tool.nix Outdated

Comment thread pkgs/top-level/all-packages.nix Outdated

Comment thread nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix Outdated

This comment was marked as duplicate.

Sign in to view

RaitoBezarius mentioned this pull request Jun 16, 2023

boot: Development (& experimental) setup for SecureBoot #202497

Closed

23 tasks

oxalica suggested changes Jun 16, 2023

View reviewed changes

Comment thread pkgs/tools/system/lanzaboote/stub.nix Outdated

Comment thread nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix Outdated

Comment thread pkgs/tools/system/lanzaboote/tool.nix Outdated

Comment thread nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix Outdated

nikstur reviewed Jun 16, 2023

View reviewed changes

Comment thread pkgs/tools/system/lanzaboote/stub.nix Outdated

Comment thread pkgs/tools/system/lanzaboote/tool.nix Outdated

Comment thread pkgs/tools/system/lanzaboote/stub.nix Outdated

pasqui23 requested review from a user, ElvishJerricco and Kranzes June 17, 2023 12:36

SuperSandro2000 reviewed Jun 28, 2023

View reviewed changes

RaitoBezarius force-pushed the lanzaboote branch 3 times, most recently from 5586367 to e2723f0 Compare July 8, 2023 17:11

ghost reviewed Nov 1, 2023

View reviewed changes

lib.systems: fix CI failures at https://gist.github.com/GrahamcOfBorg…

6bc656b

…/5495945c851a7bc9770eda5a3ed63c25 This commit fixes the CI failures with PR 231951: - https://gist.github.com/GrahamcOfBorg/5495945c851a7bc9770eda5a3ed63c25

ghost requested review from edolstra and infinisil as code owners November 1, 2023 07:53

gnu-config: drop support-uefi-triples.patch patch

a17e894

ghost approved these changes Nov 1, 2023

View reviewed changes

ofborg Bot added 10.rebuild-linux-stdenv This PR causes stdenv to rebuild on Linux and must target a staging branch. 10.rebuild-darwin: 11-100 This PR causes between 11 and 100 packages to rebuild on Darwin. labels Nov 1, 2023

ghost mentioned this pull request Nov 4, 2023

mesa: fix cross compilation to x86_64 #233628

Merged

12 tasks

This was referenced Nov 2, 2024

uefi build support #353050

Closed

lanzaboote-stub: init at 0.3.0 #353052

Closed

ThinkChaos mentioned this pull request Mar 3, 2026

lanzaboote-{tool,uefi-stub}: init at 1.0.0 #496059

Open

13 tasks

	platforms = [ "x86_64-uefi" "i686-uefi" "aarch64-uefi" ];
	hydraPlatforms = [ lib.systems.inspect.platformPatterns.isUefi ];

	broken = stdenv.isi686 \|\| stdenv.isAarch64;
	broken = with stdenv.hostPlatform; isi686 \|\| isAarch64;

	uefi = filterDoubles predicates.isEfiEnvironment;
	uefi = filterDoubles predicates.isUefi;

	# aarch64: compile fine but...
	# aarch64: compile fine but unable to test on real hardware

Uh oh!

Conversation

RaitoBezarius commented May 14, 2023 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description of changes

Current design

What has been tried?

Some funny questions

Things done

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as duplicate.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ghost commented Jun 19, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ghost commented Oct 30, 2023 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ghost commented Oct 30, 2023

Uh oh!

ghost commented Oct 30, 2023

Uh oh!

alyssais commented Oct 30, 2023

Uh oh!

RaitoBezarius commented Oct 30, 2023 via email

Uh oh!

ghost Nov 1, 2023 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ghost Nov 1, 2023 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ghost commented Nov 1, 2023 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ghost commented Nov 1, 2023 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ghost left a comment • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ghost Nov 1, 2023

Choose a reason for hiding this comment

Uh oh!

ghost Nov 1, 2023

Choose a reason for hiding this comment

Uh oh!

ghost Nov 1, 2023

Choose a reason for hiding this comment

Uh oh!

ghost Nov 1, 2023

Choose a reason for hiding this comment

Uh oh!

ghost Nov 1, 2023

Choose a reason for hiding this comment

Uh oh!

ghost Nov 1, 2023

RaitoBezarius commented May 14, 2023 •

edited by ghost

Loading

ghost commented Oct 30, 2023 •

edited by ghost

Loading

ghost Nov 1, 2023 •

edited by ghost

Loading

ghost Nov 1, 2023 •

edited by ghost

Loading

ghost commented Nov 1, 2023 •

edited by ghost

Loading

ghost commented Nov 1, 2023 •

edited by ghost

Loading

ghost left a comment •

edited by ghost

Loading