Having many separate mkinitfs-hook packages makes it harder to add new
hooks and makes maintaining the hooks very fragmented and challenging.
Merging them all into one package and splitting them out by subpackage
makes them much more maintainable and makes adding new hooks as easy as
adding files and a subpackage.
Signed-off-by: Aster Boese <asterboese@mailbox.org>
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/8413>
In some cases when the disk is very large (e.g. 2TB) repart will add
extra space to the slot-A usr partition to make it larger. The slot-B
partitions are already pinned with a min/max size so they would stay
the correct size. This pins the slot-A usr partition so it's no longer
grown. This should have been done all along.
Signed-off-by: Clayton Craft <craftyguy@postmarketos.org>
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/8419>
This uses a new naming convention for partitions. It fixes an issue
where some firmware (i.e. on the OnePlus 6 / 6T) will hang when starting
fastboot mode if it finds a (sub!)partition with a GPT partition label
that's "too long" (25char, in the case of enchilada, well under the 34
char limit in the GPT spec).
By keeping the old partition name match pattern, which *should* help
migrate existing installs after 2 updates (to capture partitions
associated with both "slots"). Given duranium's "wip" status, I don't
think it's strictly necessary to migrate existing installs, but I feel
like this is a good opportunity to see if it's possible to do so. It
might be handy to do in the future and working out how to do that now
seems useful.
This also drops the verity signature partition. According to the UAPI
Discov. Partition Spec (DPS) this partition is not really needed if the
verity hash for the usr partition is in the kernel cmdline and the UKI
is signed (not yet, but one day 🤞). There is one mode where having the
separate partition is useful: verified boot in containers, but this is
outside the scope of duranium.
This partition is tiny (16K) so the space saving is negligible... but
it would be nice to have one less partition to "manage". On existing
installs, this partition will become "foreign" to systemd repart, and
sysupdate will not touch it since it will no longer match any patterns.
fixes#4484
Signed-off-by: Clayton Craft <craftyguy@postmarketos.org>
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/8408>
The kernel cmdline option is to prevent gnome-initial-setup from
launching, because it doesn't work properly and conflicts with our first
boot setup. On phosh this is technically not necessary since g-i-s won't
try to start there, but adding this to the base gnome UI pkg means I
wouldn't have to add sep. subpackages to gnome and gnome-mobile UI pkgs.
The duranium subpkg also pulls in a plugin for gnome-software so that
g-s can provide a frontend for pulling duranium image updates via
sysupdate.
Signed-off-by: Clayton Craft <craftyguy@postmarketos.org>
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/8411>
Currently dropins are processed before the default of enabling pwfeedback,
so a dropin that does `Defaults !pwfeedback` to restore the pre-sudo-rs behavior
has no effect. With this change, the dropin will take effect.
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/8388>
depending on arch
Angelfish is not available on armv7 nor riscv64 due to qt6-qtwebengine
getting disabled. However, it is still preferable to install a web
browser by default. Firefox however can still be used on those devices.
Add a new -web subpackage, which installs Firefox on armv7/riscv64, and
installs angelfish on others, so everyone gets to have a pre-installed
and working web browser.
Signed-off-by: Ferass El Hafidi <funderscore@postmarketos.org>
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/8373>
A web browser engine not being available should not cause the whole UI
to become unavailable, especially when not required for the UI itself to
work. Move packages depending on qt6-qtwebengine to a separate
subpackage, that gets pulled only on arches where qtwebengine is
available.
Signed-off-by: Ferass El Hafidi <funderscore@postmarketos.org>
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/8373>
qt6-qtwebengine has been disabled on ARMv7, and therefore angelfish is
no longer available for this architecture (pending disablement in
Alpine, but cannot be installed due to the missing qtwebengine libraries).
[ci:skip-vercheck]: only changing architectures
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/8372>
This adds a script that can be used to set the "channel" for images to
"staging" or "main." "Staging" will come from a separate pipeline in the
duranium mkosi config repo, it may build images with patches or whatever
for testing, and won't be available to users running the "main" channel.
Signed-off-by: Clayton Craft <craftyguy@postmarketos.org>
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/8330>
Duranium is an immutable variant of postmarketOS that uses systemd's
image-based OS model: dm-verity verified /usr, A/B slots managed by
systemd-sysupdate, LUKS2-encrypted root, and systemd-boot with UKIs.
This package ships systemd-repart, systemd-sysusers, tmpfiles, and
first-boot service configuration needed at runtime in both the initramfs
and the booted system, as well as sysupdate transfer definitions for
finding and upgrading images. Build-time repart and sysupdate config
lives in the mkosi config repo[1].
The pmOS initramfs is not used. Rather than re-implement partition
setup, verity, factory reset, and switch_root in shell script and
risk regressions for mutable pmOS installs, an initramfs is built by
mkosi containing systemd. This lets the standard systemd initrd
machinery handle everything, with no modifications to the pmOS
initramfs required.
On Android devices, subpartition logic from the pmOS initramfs is
essentially copied into a new systemd unit that runs in the initramfs
and sets up subpartitions so that they are available to tooling that
runs later in the boot process. In the future, this functionality should
be moved upstream into systemd.
Boot flows:
"Normal boot": the verified /usr partition is mounted and the LUKS
root partition is unlocked (empty passphrase by default, with fallback
to a graphical unlock prompt for user-set passphrases). switch_root
hands off to the real rootfs.
"First boot": systemd-repart creates the root partition, always as a
LUKS volume with an empty passphrase. After switch_root, a first-boot
app runs before the display manager to collect a username and password,
create the user account, and optionally set a LUKS passphrase. The
passphrase can also be changed later via systemd-cryptenroll or
cryptsetup.
"Factory reset": detected in the initramfs by systemd, which uses
systemd-repart to wipe and recreate the root partition. Boot then
continues with the first boot flow above. Factory reset can be triggered
while booting in the rootfs by starting a systemd unit that configures
an EFI variable to signal to the initramfs on next boot.
Signed-off-by: Clayton Craft <craftyguy@postmarketos.org>
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/7059>
abuild's default behaviour copies files from usr/lib/systemd into a the
$pkgname-split subpackage.
Several APKBUILD definitions do this manually, since they predate this
feature.
Remove the superfluous systemd() function in these cases.
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/8023>
Back in the days, hexagonrpcd was not suitable for generic device
packages and we had to hack around it with this service / script. Now
that hexagonrpcd can guess the HexagonFS directory location at runtime,
we can and should get rid of this service to align with our (future)
firmware packaging guidelines.
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/8163>
This changes the override to:
1) use /sys/kernel/config for the configfs location
2) depend on the sys-kernel-config.mount unit, which will automatically
mount configfs
3) depend on modprobing libcomposite
4) create the g1/configs/c.1 path automatically in case it's not created
yet
The configfs.ini file is also updated with the path
Signed-off-by: Clayton Craft <craftyguy@postmarketos.org>
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/8175>
The version of OpenBSD's doas packaged by Alpine had its last commit
21-02-2022. This in itself is not bad, but the issue is that in that time,
there have been many MRs and issues filed to the repo that see no action.
One major MR, that being a hardening patch against rowhammer attacks,
has layed stale since 03-03-2024. After Natanael Copa asked if the repo
was still maintained, the response was that it is low-priority.
As such switching to sudo-rs, despite its larger size and attack surface, makes
sense due to more users and thus more eyes on it performing analysis and fixing
security issues quicker. OpenBSD doas does not have this itself, and a low-usage
fork of it definitely does not. While there are snazzier, more modern
alternatives like run0, capsudo, or s6-sudo, none of these are in a state where
they can fully replace all the features that sudo provides.
sudo-rs was chosen over the original sudo due to a few factors. The first is
memory safety, as Rust generally solves that issue in the codebase, so a whole
class of possible vulns are eliminated. Second is that sudo-rs is already in
use by larger distributions like Canonical's Ubuntu, meaning that the user base
is already quite large, leading to similar amounts of eyes on the source code.
Third, sudo-rs has had support from the original authors of sudo, allowing the
project to avoid the pitfalls of the legacy C codebase. Finally, sudo-rs has
already had two fairly recent independent security audits, meaning that their
security posture is diligent enough to be trusted.
See https://github.com/trifectatechfoundation/sudo-rs/tree/main/docs/audit
In the future, any further switch in the privilege-escalation tool should keep
the sudo command, be it through a symlink, shim, or a binary itself. This is
maintained currently due to having installed doas-sudo-shim by default, but
more care should be taken in the future to not break user workflows.
Partially reverts 0f327af853
See https://gitlab.postmarketos.org/postmarketOS/pmaports/-/issues/4144
Signed-off-by: Aster Boese <asterboese@mailbox.org>
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/7967>
Aster Boese