nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-07-23 09:00:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

nixos/repart-verity-store: small cleanup (#365935)

Browse Source
This commit is contained in:
nikstur
2024-12-19 11:11:07 +01:00
committed by GitHub
parent 572141a3f4 685d9fe348
commit eb56336ced
2 changed files with 9 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
nixos/modules/image/repart-verity-store.nix
View File

@@ -81,12 +81,18 @@ in
};
config = lib.mkIf cfg.enable {
boot.initrd.systemd.dmVerity.enable = true;
boot.initrd = {
systemd.dmVerity.enable = true;
supportedFilesystems = {
${config.image.repart.partitions.${cfg.partitionIds.store}.repartConfig.Format} =
lib.mkDefault true;
};
};
image.repart.partitions = {
# dm-verity hash partition
${cfg.partitionIds.store-verity}.repartConfig = {
Type = partitionTypes.usr-verity;
Type = lib.mkDefault partitionTypes.usr-verity;
Verity = "hash";
VerityMatchKey = lib.mkDefault verityMatchKey;
Label = lib.mkDefault "store-verity";
@@ -95,7 +101,7 @@ in
${cfg.partitionIds.store} = {
storePaths = [ config.system.build.toplevel ];
repartConfig = {
Type = partitionTypes.usr;
Type = lib.mkDefault partitionTypes.usr;
Verity = "data";
Format = lib.mkDefault "erofs";
VerityMatchKey = lib.mkDefault verityMatchKey;

7
nixos/tests/appliance-repart-image-verity-store.nix
View File

@@ -29,13 +29,6 @@
options = [ "mode=0755" ];
};
"/usr" = {
device = "/dev/mapper/usr";
# explicitly mount it read-only otherwise systemd-remount-fs will fail
options = [ "ro" ];
fsType = config.image.repart.partitions.${partitionIds.store}.repartConfig.Format;
};
# bind-mount the store
"/nix/store" = {
device = "/usr/nix/store";