fwupd stopped honouring the FWUPD_EFIAPPDIR environment variable in
https://github.com/fwupd/fwupd/pull/9846; the location is a compile-time
constant (`EFI_APP_LOCATION`) since then, so setting the variable on
fwupd.service had no effect.
Drop `RuntimeDirectory` from the signing unit too: the directory is now
created and populated by the fwupd module, and RuntimeDirectoryPreserve
defaults to `no`, so systemd removed it (together with the unsigned app)
whenever the unit stopped -- which `partOf = fwupd.service` makes happen
on every fwupd restart.
Cover the whole path in the limine secure boot test, which so far never
enabled fwupd: it now asserts that both the unsigned app and the signed
variant end up in /run/fwupd-efi.
Assisted-by: claude-code with claude-opus-5[1m]-high
The installer being placed directly at (e.g.)
/nix/store/272h8d4df6by64ycl3s01bixrcaq5a9a-limine-install.py causes
Python to search the script's directory for imports if -P is not added,
so add -P to avoid Python automatically adding /nix/store to the script's
sys.path.
From the python manpage:
> -P: Don't automatically prepend a potentially unsafe path to sys.path
> such as the current directory, the script's directory or an empty string.
> See also the PYTHONSAFEPATH environment variable.
audit 4.2 rejects overlong values (max 15 bytes) for the kernel comm.
systemd attempts to send the full 19 bytes of "systemd-update-utmp",
and the systemd-update-utmp service fails to start. this was changed to
truncate instead of reject in audit 4.2.1, but until we can take the
mass rebuild on staging, we fetch the systemd patch which shortens
"systemd-update-utmp" to "update-utmp". this is in the nixos module as
`apply` instead of part of the systemd package as that would be a larger
rebuild and would delay other fixes making their way to master.
When setting `hardware.deviceTree.name` and `.enable`, a DeviceTree
section is added to UKI. This is nice default behavior for arm64
systems. When `hardware.deviceTree.package` plumbs into UEFI firmware
(e.g. u-boot), the UKI replaces the UEFI-supplied DTB. Besides bloating
the UKI, this has the side-effect of preventing UEFI firmware from
making modifications to the devicetree.
Filter out null boot.uki.settings values so that a NixOS configuration
can set `boot.uki.settings.UKI.DeviceTree = null;` to remove the default
behavior of packing the dtb into the UKI.
There is valid scenarios to NOT have certain keys in /etc/resolved.conf, e.g. WSL mDNS.
This was reported in https://github.com/NixOS/nixpkgs/pull/535649#issuecomment-5103574775.
Empty configs can still be achieved passing an empty list (`[]`) or empty string (`""`),
while passing `null` will now remove the key from the config file.
Wasi P2 is different enough to Wasi P1 to warrant being treated entirely
separately, rather than as two minor variants of the same thing. P3 will
likewise want to be a different target.
I've left aliases in place; maybe eventually, those can be deprecated
and removed. I've tested this, but it's possible there might be breakage
somewhere (e.g., the canonical doubles for P1 have changed, though I
can't imagine why anyone would rely on that).
Fixes https://github.com/NixOS/nixpkgs/issues/435954
In a previous change the transformSettings function was modified to look
at the Resolve section, but since it got a second consumer in the mean
time this regressed. We now target the resolved.conf explicitly instead.
This reverts commit 66353ca989.
In the meantime a new option was added that consumes the
`transformSettings` function, which broke by looking at just at the
Resolve section.
libfido2 links against pcsclite's libpcsclite.so.1, which since
pcsclite 2.3.1 is a shim that dlopens libpcsclite_real.so.1. nixpkgs
patches that dlopen to an absolute store path. make-initrd-ng only
follows DT_NEEDED, so the real library never ends up in the initrd.
systemd-cryptsetup then logs at boot:
loading ".../pcsclite-2.4.1-lib/lib/libpcsclite_real.so.1" failed:
cannot open shared object file: No such file or directory
and FIDO2 tokens behind PC/SC (NFC readers) cannot be used to unlock
LUKS in stage 1. Add the real library to the initrd store paths.
systemd v261 added systemd-pcrlogin@.service, which logind starts on
first login of a user to measure the user record into the 'login'
NvPCR. NixOS does not install the unit, so every first login logs:
systemd-logind: Failed to start user measurement service
'systemd-pcrlogin@1000.service', ignoring: Unit not found.
Install the unit on systems with systemd.tpm2.enable. The unit has ConditionSecurity=measured-os and does nothing elsewhere.
The documentation describes this as a set of files copied to /boot, with
the attribute name denoting the destination file name in /boot.
This uses essentially the same description as refind, systemd-boot and
grub. However limine put it into limine_install_dir (/boot/limine by
default) by accident, which broke downstream users.
For example, nixos-apple-silicon uses boot.loader.limine.additionalFiles
(and similar directives for other bootloaders) to update its m1n1
bootloader (which chainloads into u-boot, which chainloads into the
bootloader selected in NixOS), and due to this bug, put new versions of
it in the wrong location, effectively never updating m1n1.
Fix this, by updating the location. The next commit adds a regression VM
test for it.
systemd v261 lists the new systemd-boot-fallback binary in `bootctl
status`, so our regex picked up the older fallback version and ran
`bootctl update` on an already current ESP, which then exits non-zero.
Switch from parsing the `bootctl --status` output to having bootctl
compare versions itself by calling io.systemd.BootControl.Install over
Varlink. bootctl is spawned as a stdio Varlink server so that we always
use the bootctl from the target closure. An already current binary comes
back as an io.systemd.System error carrying ESTALE, which we treat as
success.
Because all options are below the [Resolve] section, and we nest them as
such below `settings.Resolve` we need to apply the transformations one
level down for it to match the relevant keys.
This is for instance useful on Asahi where an additional initrd archive
containing firmware blobs and per-device calibration files is placed
on the ESP and updated by the Asahi Linux Installer.
These need to be loaded alongside the NixOS initrd.
Implemented for systemd-boot and Limine. Grub is left out since its
install script does not use bootspec yet.
Co-authored-by: Florian Klink <flokli@flokli.de>
Allows running additional shell commands after the limine install script
generates menu entries, mirroring the systemd-boot option of the same
name.
Co-authored-by: Florian Klink <flokli@flokli.de>
We aren't linking systemd to gnutls anymore so these options
were all silently ignored. Which is pretty bad!
Assisted-by: Claude <noreply@anthropic.com>
This adds io.systemd.PCRExtend if the system has TPM2
enabled.
Additionally, this requires the system to fullfill
ConditionSecurity=measured-uki.
Change-Id: I3f1046cdc7463f3b6d3205030f7f12ac95e5cd9e
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
