Merge pull request #34 from gardenlinux/feat/ukify

feat: use ukify instead of objcopy

Dockerfile

@@ -1,24 +1,24 @@
-FROM debian:bookworm AS mv_data
+FROM debian:testing AS mv_data
 RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends build-essential ca-certificates git
 RUN git clone --depth=1 https://github.com/nkraetzschmar/mv_data
 RUN make -C mv_data install
 
-FROM debian:bookworm AS aws-kms-pkcs11
+FROM debian:testing AS aws-kms-pkcs11
 RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends build-essential awscli ca-certificates cmake git libcurl4-openssl-dev libengine-pkcs11-openssl libjson-c-dev libssl-dev libp11-kit-dev libp11-dev zlib1g-dev
 RUN git clone --depth=1 --recurse-submodules -b 1.11.25 https://github.com/aws/aws-sdk-cpp
 RUN mkdir aws-sdk-cpp/.build && cd aws-sdk-cpp/.build && cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=OFF -DBUILD_ONLY="kms;acm-pca" .. && make -j "$(nproc)" install
 RUN git clone --depth=1 -b v0.0.10 https://github.com/JackOfMostTrades/aws-kms-pkcs11
 RUN cd aws-kms-pkcs11 && make -j "$(nproc)" AWS_SDK_STATIC=y install
 RUN cp "/usr/lib/$(uname -m)-linux-gnu/pkcs11/aws_kms_pkcs11.so" /aws_kms_pkcs11.so
 
-FROM debian:bookworm
+FROM debian:testing
 COPY pkg.list /pkg.list
-RUN apt update && DEBIAN_FRONTEND=noninteractive apt install -y --no-install-recommends $(cat /pkg.list) && rm /pkg.list
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends $(cat /pkg.list) && rm /pkg.list
 COPY --from=mv_data /usr/bin/mv_data /usr/bin/mv_data
 COPY --from=aws-kms-pkcs11 /aws_kms_pkcs11.so /aws_kms_pkcs11.so
 RUN mv /aws_kms_pkcs11.so "/usr/lib/$(uname -m)-linux-gnu/pkcs11/aws_kms_pkcs11.so"
 COPY builder /builder
 RUN mkdir /builder/cert
 COPY setup_namespace /usr/sbin/setup_namespace
-RUN echo 'root:0:65536' | tee /etc/subuid /etc/subgid > /dev/null
+RUN echo 'root:1:65535' | tee /etc/subuid /etc/subgid > /dev/null
 ENTRYPOINT [ "/usr/sbin/setup_namespace" ]

builder/image.d/makesecureboot

@@ -93,24 +93,20 @@ case "$BUILDER_ARCH" in
 	amd64)
 		uefi_arch=X64
 		gnu_arch=x86_64
-		initrd_vma=0x3000000
 		;;
 	arm64)
 		uefi_arch=AA64
 		gnu_arch=aarch64
-		initrd_vma=0x4000000
 		;;
 esac
 
 # create unified image
-cmdline_file=$(mktemp)
-echo "$cmdline" > "$cmdline_file"
-"${gnu_arch}-linux-gnu-objcopy" \
-	--add-section .cmdline="$cmdline_file" --change-section-vma .cmdline=0x1000000 \
-	--add-section .linux="$kernel_file" --change-section-vma .linux=0x2000000 \
-	--add-section .initrd="$initrd" --change-section-vma .initrd="$initrd_vma" \
-	"$rootfs/usr/lib/systemd/boot/efi/linux$(tr '[:upper:]' '[:lower:]' <<< "$uefi_arch").efi.stub" "$unified_image"
-rm "$cmdline_file"
+/usr/lib/systemd/ukify build \
+	--stub "$rootfs/usr/lib/systemd/boot/efi/linux$(tr '[:upper:]' '[:lower:]' <<< "$uefi_arch").efi.stub" \
+	--linux "$kernel_file" \
+	--initrd "$initrd" \
+	--cmdline "$cmdline" \
+	--output "$unified_image"
 
 efi_dir="$(mktemp -d)"
 mkdir -p "$efi_dir/EFI/BOOT/"

pkg.list

@@ -1,3 +1,4 @@
+binutils
 binutils-aarch64-linux-gnu
 binutils-x86-64-linux-gnu
 bsdextrautils
@@ -21,6 +22,7 @@ ostree-boot
 python3
 python3-mako
 python3-networkx
+python3-pefile
 python3-yaml
 qemu-utils
 sbsigntool