SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #34687 from DaanDeMeyer/mkosi

Browse Source 
Various fixes
This commit is contained in:
Yu Watanabe
2024-10-10 05:26:14 +09:00
committed by GitHub
parent 2a796b9f52 963157ca78
commit a029550507
31 changed files with 86 additions and 139 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/mkosi.yml
+1 -1
View File
@@ -105,7 +105,7 @@ jobs:
steps:
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
- uses: systemd/mkosi@3454f7bd4ef0336ec80a117d593baaef0fe53398
- uses: systemd/mkosi@2a35f9958bc6b82d95d1eac02dc245e9bb068765
# Freeing up disk space with rm -rf can take multiple minutes. Since we don't need the extra free space
# immediately, we remove the files in the background. However, we first move them to a different location
mkosi.conf
+8 -4
View File
@@ -26,12 +26,18 @@ PassEnvironment=
[Output]
RepartDirectories=mkosi.repart
OutputDirectory=build/mkosi.output
[Build]
BuildDirectory=build/mkosi.builddir
CacheDirectory=build/mkosi.cache
BuildSourcesEphemeral=yes
Incremental=yes
# TODO: Remove when TEST-70-TPM doesn't fail in an image with signed PCRs anymore.
[Validation]
SignExpectedPcr=no
[Content]
BuildSourcesEphemeral=yes
ExtraTrees=
mkosi.crt:/usr/lib/verity.d/mkosi.crt # sysext verification key
mkosi.leak-sanitizer-suppressions:/usr/lib/systemd/leak-sanitizer-suppressions
@@ -137,11 +143,9 @@ Credentials=
tty.serial.hvc0.login.noauth=yes
tty.console.agetty.autologin=root
tty.console.login.noauth=yes
Incremental=yes
RuntimeBuildSources=yes
RuntimeScratch=no
QemuSmp=2
QemuSwtpm=yes
QemuVsock=yes
QemuKvm=yes
ToolsTreePackages=virtiofsd
mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-selinux.conf
-3
View File
@@ -3,9 +3,6 @@
# libselinux does not work in the slightest with /usr-only images so don't install the packages if we're
# building a /usr-only image.
[Match]
Profile=!particle
[Content]
Packages=
selinux-policy
mkosi.conf.d/10-centos/mkosi.conf
+2 -1
View File
@@ -6,7 +6,7 @@ Distribution=centos
[Distribution]
Release=10
[Content]
[Build]
Environment=
# CentOS doesn't support btrfs so we have to use something else. We'd prefer to use XFS here but it
# fails to mount on duplicate filesystem UUIDs which happens when running tests in parallel so we use
@@ -16,5 +16,6 @@ Environment=
# mkfs.ext4 enabled it by default, so we disable it explicitly.
SYSTEMD_REPART_MKFS_OPTIONS_EXT4="-O ^orphan_file"
[Content]
Packages=
kernel-modules # For squashfs
mkosi.conf.d/20-particle/mkosi.conf
-15
View File
@@ -1,15 +0,0 @@
# SPDX-License-Identifier: LGPL-2.1-or-later
[Match]
Profile=particle
[Output]
RepartDirectories=
RepartDirectories=mkosi.repart
[Validation]
SecureBoot=yes
SignExpectedPcr=yes
[Host]
RuntimeSize=8G
mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/15-swap.conf
-6
View File
@@ -1,6 +0,0 @@
# SPDX-License-Identifier: LGPL-2.1-or-later
[Partition]
Type=swap
SizeMinBytes=100M
SizeMaxBytes=100M
mkosi.conf.d/20-particle/mkosi.extra/usr/lib/repart.d/20-root.conf
-6
View File
@@ -1,6 +0,0 @@
# SPDX-License-Identifier: LGPL-2.1-or-later
[Partition]
Type=root
Format=btrfs
SizeMinBytes=1G
mkosi.conf.d/20-particle/mkosi.extra/usr/lib/tmpfiles.d/99-mkosi.conf
-3
View File
@@ -1,3 +0,0 @@
# SPDX-License-Identifier: LGPL-2.1-or-later
C+! /etc - - - - /usr/share/factory/mkosi
mkosi.conf.d/20-particle/mkosi.finalize
-6
View File
@@ -1,6 +0,0 @@
#!/bin/bash
# SPDX-License-Identifier: LGPL-2.1-or-later
set -e
mkdir -p "$BUILDROOT"/usr/share/factory/mkosi
cp --archive --recursive --no-target-directory --reflink=auto "$BUILDROOT"/etc "$BUILDROOT"/usr/share/factory/mkosi
mkosi.conf.d/20-particle/mkosi.postinst.chroot
-12
View File
@@ -1,12 +0,0 @@
#!/bin/bash
# SPDX-License-Identifier: LGPL-2.1-or-later
set -e
# sbsign is not available on CentOS Stream
if command -v sbsign &>/dev/null; then
# Ensure that side-loaded PE addons are loaded if signed, and ignored if not
addons_dir=/efi/loader/addons
mkdir -p "$addons_dir"
ukify build --secureboot-private-key mkosi.key --secureboot-certificate mkosi.crt --cmdline this_should_be_here -o "$addons_dir/good.addon.efi"
ukify build --cmdline this_should_not_be_here -o "$addons_dir/bad.addon.efi"
fi
mkosi.conf.d/20-particle/mkosi.repart/00-esp.conf
-9
View File
@@ -1,9 +0,0 @@
# SPDX-License-Identifier: LGPL-2.1-or-later
[Partition]
Type=esp
Format=vfat
CopyFiles=/boot:/
CopyFiles=/efi:/
SizeMinBytes=1G
SizeMaxBytes=1G
mkosi.conf.d/20-particle/mkosi.repart/10-usr.conf
-9
View File
@@ -1,9 +0,0 @@
# SPDX-License-Identifier: LGPL-2.1-or-later
[Partition]
Type=usr
Format=erofs
CopyFiles=/usr:/
Verity=data
VerityMatchKey=usr
Minimize=yes
mkosi.conf.d/20-particle/mkosi.repart/11-usr-verity.conf
-7
View File
@@ -1,7 +0,0 @@
# SPDX-License-Identifier: LGPL-2.1-or-later
[Partition]
Type=usr-verity
Verity=hash
VerityMatchKey=usr
Minimize=yes
mkosi.conf.d/20-particle/mkosi.repart/12-usr-verity-sig.conf
-6
View File
@@ -1,6 +0,0 @@
# SPDX-License-Identifier: LGPL-2.1-or-later
[Partition]
Type=usr-verity-sig
Verity=signature
VerityMatchKey=usr
mkosi.conf.d/20-sanitizers.conf
+4 -2
View File
@@ -4,13 +4,15 @@
Environment=SANITIZERS
Environment=!SANITIZERS=
[Content]
[Build]
# Set verify_asan_link_order=0 to prevent ASAN warnings when building the image and make sure the real ASAN
# options are set when booting the image.
# Set intercept_tls_get_addr=0 to work around leak sanitizer segmentation fault in test-dlopen-so on CentOS
# Stream 9.
# TODO: Drop intercept_tls_get_addr=0 when we remove CentOS Stream 9 builds.
Environment=ASAN_OPTIONS=verify_asan_link_order=0:intercept_tls_get_addr=0
[Content]
KernelCommandLine=
ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1:disable_coredump=0:use_madv_dontdump=1
systemd.setenv=ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1:disable_coredump=0:use_madv_dontdump=1
@@ -19,5 +21,5 @@ KernelCommandLine=
LSAN_OPTIONS=suppressions=/usr/lib/systemd/leak-sanitizer-suppressions
systemd.setenv=LSAN_OPTIONS=suppressions=/usr/lib/systemd/leak-sanitizer-suppressions
[Config]
[Include]
Include=%D/mkosi.sanitizers
mkosi.images/build/mkosi.conf.d/arch/mkosi.conf
+2 -1
View File
@@ -3,13 +3,14 @@
[Match]
Distribution=arch
[Content]
[Build]
Environment=
GIT_URL=https://gitlab.archlinux.org/archlinux/packaging/packages/systemd.git
GIT_BRANCH=main
GIT_COMMIT=d5a2dc54dad2bcfefa1032cc95823f1acedfcb4c
PKG_SUBDIR=arch
[Content]
Packages=
base
base-devel
mkosi.images/build/mkosi.conf.d/centos-fedora/mkosi.conf
+2 -1
View File
@@ -4,13 +4,14 @@
Distribution=|centos
Distribution=|fedora
[Content]
[Build]
Environment=
GIT_URL=https://src.fedoraproject.org/rpms/systemd.git
GIT_BRANCH=rawhide
GIT_COMMIT=a67221c3f0d0b81b9b5b3230a71d09044342f1a4
PKG_SUBDIR=fedora
[Content]
Packages=
compiler-rt
git-core
mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.conf
+2 -1
View File
@@ -4,7 +4,7 @@
Distribution=|debian
Distribution=|ubuntu
[Content]
[Build]
Environment=
GIT_URL=https://salsa.debian.org/systemd-team/systemd.git
GIT_SUBDIR=debian
@@ -12,6 +12,7 @@ Environment=
GIT_COMMIT=51389fefcabae6d1e28153fed84a5e69a9147b19
PKG_SUBDIR=debian
[Content]
Packages=
apt
erofs-utils
mkosi.images/build/mkosi.conf.d/opensuse/mkosi.conf
+2 -1
View File
@@ -3,13 +3,14 @@
[Match]
Distribution=opensuse
[Content]
[Build]
Environment=
GIT_URL=https://src.opensuse.org/pool/systemd
GIT_BRANCH=factory
GIT_COMMIT=612bc16021b28ab99002fa1069f1ec97124397a25c7a207d013213b5cfb86055
PKG_SUBDIR=opensuse
[Content]
Packages=
diffutils
erofs-utils
mkosi.images/exitrd/mkosi.conf
+1 -1
View File
@@ -13,5 +13,5 @@ MakeInitrd=yes
Packages=
bash
[Config]
[Include]
Include=%D/mkosi.sanitizers
mkosi.images/initrd/mkosi.conf
+1 -1
View File
@@ -1,6 +1,6 @@
# SPDX-License-Identifier: LGPL-2.1-or-later
[Config]
[Include]
Include=
mkosi-initrd
%D/mkosi.sanitizers
mkosi.images/minimal-0/mkosi.conf
+3 -1
View File
@@ -7,7 +7,9 @@ Dependencies=minimal-base
Format=portable
SplitArtifacts=yes
[Build]
Environment=SYSTEMD_REPART_OVERRIDE_FSTYPE=squashfs
[Content]
BaseTrees=%O/minimal-base
Environment=SYSTEMD_REPART_OVERRIDE_FSTYPE=squashfs
Bootable=no
mkosi.images/minimal-1/mkosi.conf
+3 -1
View File
@@ -7,7 +7,9 @@ Dependencies=minimal-base
Format=portable
SplitArtifacts=yes
[Build]
Environment=SYSTEMD_REPART_OVERRIDE_FSTYPE=squashfs
[Content]
BaseTrees=%O/minimal-base
Environment=SYSTEMD_REPART_OVERRIDE_FSTYPE=squashfs
Bootable=no
mkosi.images/minimal-base/mkosi.conf
+1 -1
View File
@@ -15,5 +15,5 @@ Packages=
grep
util-linux
[Config]
[Include]
Include=%D/mkosi.sanitizers
mkosi.profiles/particle.conf
-2
View File
@@ -1,2 +0,0 @@
# SPDX-License-Identifier: LGPL-2.1-or-later
# This file exists to create the particle profile which is matched on by other configuration files.
src/boot/efi/boot.c
+6 -6
View File
@@ -1925,11 +1925,11 @@ static bool is_sd_boot(EFI_FILE *root_dir, const char16_t *loader_path) {
/* profile= */ UINT_MAX,
/* validate_base= */ 0,
&vector);
if (vector.size != sizeof(SD_MAGIC))
if (vector.memory_size != sizeof(SD_MAGIC))
return false;
err = file_handle_read(handle, vector.file_offset, vector.size, &content, &read);
if (err != EFI_SUCCESS || vector.size != read)
err = file_handle_read(handle, vector.file_offset, vector.file_size, &content, &read);
if (err != EFI_SUCCESS || vector.file_size != read)
return false;
return memcmp(content, SD_MAGIC, sizeof(SD_MAGIC)) == 0;
@@ -2210,7 +2210,7 @@ static void boot_entry_add_type2(
err = file_handle_read(
handle,
sections[SECTION_OSREL].file_offset,
sections[SECTION_OSREL].size,
sections[SECTION_OSREL].file_size,
&content,
/* ret_size= */ NULL);
if (err != EFI_SUCCESS)
@@ -2281,7 +2281,7 @@ static void boot_entry_add_type2(
err = file_handle_read(
handle,
sections[SECTION_PROFILE].file_offset,
sections[SECTION_PROFILE].size,
sections[SECTION_PROFILE].file_size,
&content,
/* ret_size= */ NULL);
if (err != EFI_SUCCESS)
@@ -2348,7 +2348,7 @@ static void boot_entry_add_type2(
err = file_handle_read(
handle,
sections[SECTION_CMDLINE].file_offset,
sections[SECTION_CMDLINE].size,
sections[SECTION_CMDLINE].file_size,
&content,
&cmdline_len);
if (err == EFI_SUCCESS) {
src/boot/efi/pe.c
+12 -6
View File
@@ -186,13 +186,13 @@ static void pe_locate_sections(
/* Overflow check: ignore sections that are impossibly large, relative to the file
* address for the section. */
size_t size_max = SIZE_MAX - j->PointerToRawData;
if ((size_t) j->VirtualSize > size_max)
if ((size_t) j->SizeOfRawData > size_max)
continue;
/* Overflow check: ignore sections that are impossibly large, given the virtual
* address for the section */
size_max = SIZE_MAX - j->VirtualAddress;
if (j->VirtualSize > size_max)
if ((size_t) j->VirtualSize > size_max)
continue;
/* 2nd overflow check: ignore sections that are impossibly large also taking the
@@ -208,9 +208,15 @@ static void pe_locate_sections(
/* At this time, the sizes and offsets have been validated. Store them away */
sections[i] = (PeSectionVector) {
.size = j->VirtualSize,
.file_offset = j->PointerToRawData,
.memory_size = j->VirtualSize,
.memory_offset = j->VirtualAddress,
/* VirtualSize can be bigger than SizeOfRawData when the section requires
* uninitialized data. It can also be smaller than SizeOfRawData when there's
* no need for uninitialized data as SizeOfRawData is aligned to
* FileAlignment and VirtualSize isn't. The actual data that's read from disk
* is the minimum of these two fields. */
.file_size = MIN(j->SizeOfRawData, j->VirtualSize),
.file_offset = j->PointerToRawData,
};
/* First matching section wins, ignore the rest */
@@ -235,7 +241,7 @@ static uint32_t get_compatibility_entry_address(const DosFileHeader *dos, const
PTR_TO_SIZE(dos),
&vector);
if (vector.size == 0) /* not found */
if (vector.memory_size == 0) /* not found */
return 0;
typedef struct {
@@ -245,7 +251,7 @@ static uint32_t get_compatibility_entry_address(const DosFileHeader *dos, const
uint32_t entry_point;
} _packed_ LinuxPeCompat1;
size_t addr = vector.memory_offset, size = vector.size;
size_t addr = vector.memory_offset, size = vector.memory_size;
while (size >= sizeof(LinuxPeCompat1) && addr % alignof(LinuxPeCompat1) == 0) {
const LinuxPeCompat1 *compat = (const LinuxPeCompat1 *) ((const uint8_t *) dos + addr);
src/boot/efi/pe.h
+3 -2
View File
@@ -20,13 +20,14 @@ typedef struct PeSectionHeader {
/* This is a subset of the full PE section header structure, with validated values, and without
* the noise. */
typedef struct PeSectionVector {
size_t size;
size_t memory_size; /* Size of the section in memory (corresponds to VirtualSize field) */
size_t memory_offset; /* Offset in memory, relative to base address */
uint64_t file_size; /* Amount of bytes of the section read from disk (possibly aligned to FileAlignment in case VirtualSize > SizeOfRawData). */
uint64_t file_offset; /* Offset on disk, relative to beginning of file */
} PeSectionVector;
static inline bool PE_SECTION_VECTOR_IS_SET(const PeSectionVector *v) {
return v && v->size != 0;
return v && v->memory_size != 0;
}
EFI_STATUS pe_section_table_from_base(
src/boot/efi/stub.c
+16 -16
View File
@@ -58,7 +58,7 @@ static char16_t* pe_section_to_str16(
if (!PE_SECTION_VECTOR_IS_SET(section))
return NULL;
return xstrn8_to_16((const char *) loaded_image->ImageBase + section->memory_offset, section->size);
return xstrn8_to_16((const char *) loaded_image->ImageBase + section->memory_offset, section->memory_size);
}
static char *pe_section_to_str8(
@@ -71,7 +71,7 @@ static char *pe_section_to_str8(
if (!PE_SECTION_VECTOR_IS_SET(section))
return NULL;
return xstrndup8((const char *)loaded_image->ImageBase + section->memory_offset, section->size);
return xstrndup8((const char *)loaded_image->ImageBase + section->memory_offset, section->memory_size);
}
static void combine_measured_flag(int *value, int measured) {
@@ -634,7 +634,7 @@ static EFI_STATUS load_addons(
if (uname && PE_SECTION_VECTOR_IS_SET(sections + UNIFIED_SECTION_UNAME) &&
!strneq8(uname,
(const char *)loaded_addon->ImageBase + sections[UNIFIED_SECTION_UNAME].memory_offset,
sections[UNIFIED_SECTION_UNAME].size)) {
sections[UNIFIED_SECTION_UNAME].memory_size)) {
log_error(".uname mismatch between %ls and UKI, ignoring", items[i]);
continue;
}
@@ -653,8 +653,8 @@ static EFI_STATUS load_addons(
(*devicetree_addons)[(*n_devicetree_addons)++] = (NamedAddon) {
.blob = {
.iov_base = xmemdup((const uint8_t*) loaded_addon->ImageBase + sections[UNIFIED_SECTION_DTB].memory_offset, sections[UNIFIED_SECTION_DTB].size),
.iov_len = sections[UNIFIED_SECTION_DTB].size,
.iov_base = xmemdup((const uint8_t*) loaded_addon->ImageBase + sections[UNIFIED_SECTION_DTB].memory_offset, sections[UNIFIED_SECTION_DTB].memory_size),
.iov_len = sections[UNIFIED_SECTION_DTB].memory_size,
},
.filename = xstrdup16(items[i]),
};
@@ -666,8 +666,8 @@ static EFI_STATUS load_addons(
(*n_initrd_addons + 1) * sizeof(NamedAddon));
(*initrd_addons)[(*n_initrd_addons)++] = (NamedAddon) {
.blob = {
.iov_base = xmemdup((const uint8_t*) loaded_addon->ImageBase + sections[UNIFIED_SECTION_INITRD].memory_offset, sections[UNIFIED_SECTION_INITRD].size),
.iov_len = sections[UNIFIED_SECTION_INITRD].size,
.iov_base = xmemdup((const uint8_t*) loaded_addon->ImageBase + sections[UNIFIED_SECTION_INITRD].memory_offset, sections[UNIFIED_SECTION_INITRD].memory_size),
.iov_len = sections[UNIFIED_SECTION_INITRD].memory_size,
},
.filename = xstrdup16(items[i]),
};
@@ -679,8 +679,8 @@ static EFI_STATUS load_addons(
(*n_ucode_addons + 1) * sizeof(NamedAddon));
(*ucode_addons)[(*n_ucode_addons)++] = (NamedAddon) {
.blob = {
.iov_base = xmemdup((const uint8_t*) loaded_addon->ImageBase + sections[UNIFIED_SECTION_UCODE].memory_offset, sections[UNIFIED_SECTION_UCODE].size),
.iov_len = sections[UNIFIED_SECTION_UCODE].size,
.iov_base = xmemdup((const uint8_t*) loaded_addon->ImageBase + sections[UNIFIED_SECTION_UCODE].memory_offset, sections[UNIFIED_SECTION_UCODE].memory_size),
.iov_len = sections[UNIFIED_SECTION_UCODE].memory_size,
},
.filename = xstrdup16(items[i]),
};
@@ -748,7 +748,7 @@ static void measure_sections(
(void) tpm_log_ipl_event_ascii(
TPM2_PCR_KERNEL_BOOT,
POINTER_TO_PHYSICAL_ADDRESS(loaded_image->ImageBase) + sections[section].memory_offset,
sections[section].size,
sections[section].memory_size,
unified_sections[section],
&m);
combine_measured_flag(sections_measured, m);
@@ -905,7 +905,7 @@ static void generate_embedded_initrds(
(void) pack_cpio_literal(
(const uint8_t*) loaded_image->ImageBase + sections[t->section].memory_offset,
sections[t->section].size,
sections[t->section].memory_size,
".extra",
t->filename,
/* dir_mode= */ 0555,
@@ -929,12 +929,12 @@ static void lookup_embedded_initrds(
if (PE_SECTION_VECTOR_IS_SET(sections + UNIFIED_SECTION_INITRD))
initrds[INITRD_BASE] = IOVEC_MAKE(
(const uint8_t*) loaded_image->ImageBase + sections[UNIFIED_SECTION_INITRD].memory_offset,
sections[UNIFIED_SECTION_INITRD].size);
sections[UNIFIED_SECTION_INITRD].memory_size);
if (PE_SECTION_VECTOR_IS_SET(sections + UNIFIED_SECTION_UCODE))
initrds[INITRD_UCODE] = IOVEC_MAKE(
(const uint8_t*) loaded_image->ImageBase + sections[UNIFIED_SECTION_UCODE].memory_offset,
sections[UNIFIED_SECTION_UCODE].size);
sections[UNIFIED_SECTION_UCODE].memory_size);
}
static void export_pcr_variables(
@@ -973,7 +973,7 @@ static void install_embedded_devicetree(
err = devicetree_install_from_memory(
dt_state,
(const uint8_t*) loaded_image->ImageBase + sections[UNIFIED_SECTION_DTB].memory_offset,
sections[UNIFIED_SECTION_DTB].size);
sections[UNIFIED_SECTION_DTB].memory_size);
if (err != EFI_SUCCESS)
log_error_status(err, "Error loading embedded devicetree, ignoring: %m");
}
@@ -1047,7 +1047,7 @@ static void display_splash(
if (!PE_SECTION_VECTOR_IS_SET(sections + UNIFIED_SECTION_SPLASH))
return;
graphics_splash((const uint8_t*) loaded_image->ImageBase + sections[UNIFIED_SECTION_SPLASH].memory_offset, sections[UNIFIED_SECTION_SPLASH].size);
graphics_splash((const uint8_t*) loaded_image->ImageBase + sections[UNIFIED_SECTION_SPLASH].memory_offset, sections[UNIFIED_SECTION_SPLASH].memory_size);
}
static EFI_STATUS find_sections(
@@ -1250,7 +1250,7 @@ static EFI_STATUS run(EFI_HANDLE image) {
struct iovec kernel = IOVEC_MAKE(
(const uint8_t*) loaded_image->ImageBase + sections[UNIFIED_SECTION_LINUX].memory_offset,
sections[UNIFIED_SECTION_LINUX].size);
sections[UNIFIED_SECTION_LINUX].memory_size);
err = linux_exec(image, cmdline, &kernel, &final_initrd);
graphics_mode(false);
src/shared/efi-loader.c
+1 -1
View File
@@ -364,5 +364,5 @@ bool efi_loader_entry_name_valid(const char *s) {
if (!filename_is_valid(s)) /* Make sure entry names fit in filenames */
return false;
return in_charset(s, ALPHANUMERICAL "+-_.");
return in_charset(s, ALPHANUMERICAL "+-_.@");
}
src/ukify/ukify.py
+16 -7
View File
@@ -1052,7 +1052,7 @@ def make_uki(opts: argparse.Namespace) -> None:
Section.create(n, section.get_data(length=section.Misc_VirtualSize), measure=True)
)
call_systemd_measure(uki, opts=opts, profile_start=prev_len + 1)
call_systemd_measure(uki, opts=opts, profile_start=prev_len)
# UKI creation
@@ -1801,6 +1801,13 @@ def create_parser() -> argparse.ArgumentParser:
return p
def resolve_at_path(value: Optional[str]) -> str:
if value and value.startswith('@'):
return Path(value[1:])
return value
def finalize_options(opts: argparse.Namespace) -> None:
# Figure out which syntax is being used, one of:
# ukify verb --arg --arg --arg
@@ -1835,17 +1842,17 @@ def finalize_options(opts: argparse.Namespace) -> None:
if n_phase_path_groups is not None and n_phase_path_groups != n_pcr_priv:
raise ValueError('--phases= specifications must match --pcr-private-key=')
if opts.cmdline and opts.cmdline.startswith('@'):
opts.cmdline = Path(opts.cmdline[1:])
elif opts.cmdline:
opts.cmdline = resolve_at_path(opts.cmdline)
if isinstance(opts.cmdline, str):
# Drop whitespace from the command line. If we're reading from a file,
# we copy the contents verbatim. But configuration specified on the command line
# or in the config file may contain additional whitespace that has no meaning.
opts.cmdline = ' '.join(opts.cmdline.split())
if opts.os_release and opts.os_release.startswith('@'):
opts.os_release = Path(opts.os_release[1:])
elif not opts.os_release and opts.linux:
opts.os_release = resolve_at_path(opts.os_release)
if not opts.os_release and opts.linux:
p = Path('/etc/os-release')
if not p.exists():
p = Path('/usr/lib/os-release')
@@ -1891,6 +1898,8 @@ def finalize_options(opts: argparse.Namespace) -> None:
'--sign-kernel requires either --secureboot-private-key= and --secureboot-certificate= (for sbsign) or --secureboot-certificate-name= (for pesign) to be specified' # noqa: E501
)
opts.profile = resolve_at_path(opts.profile)
if opts.join_profiles and not opts.profile:
# If any additional profiles are added, we need a base profile as well so add one if
# one wasn't explicitly provided