1 files changed, 75 insertions, 0 deletions
diff --git a/opt/tinyrd/MAKEPKG b/opt/tinyrd/MAKEPKG
new file mode 100644
index 0000000..a8cce18
--- /dev/null
+++ b/opt/tinyrd/MAKEPKG
@@ -0,0 +1,75 @@
+#!/bin/mkpkg
+# description: rawnix initramfs: static /init that unlocks a LUKS root
+# url: https://rawnix.org
+#
+# The image is generic (no modules, no config), so one package serves every
+# kernel and nothing regenerates it.  Staged in /boot; limine-sync mirrors it.
+#
+# libcryptsetup and libdevmapper are built here as private static libraries
+# and never installed.  The system ports stay shared-only, and the initramfs
+# wants a different configuration anyway:
+#   - libdevmapper without udev_sync  (no udev before root; the system one
+#     has it, and would drag in libudev.a)
+#   - kernel crypto backend           (no libcrypto.a; needs CRYPTO_USER_API_HASH=y)
+#   - internal argon2, no blkid, no tokens
+#
+# Versions are literal below (source= and the two cd lines): keep cryptsetup
+# equal to the cryptsetup port and LVM2 equal to device-mapper.  A security fix in either reaches the initramfs only by bumping release here.
+
+name=tinyrd
+version=0.1
+release=2
+depends=()
+makedeps=(pkgconf popt util-linux json-c)
+source=(tinyrd.c
+        https://www.kernel.org/pub/linux/utils/cryptsetup/v2.8/cryptsetup-2.8.8.tar.xz
+        https://sourceware.org/pub/lvm2/LVM2.2.03.35.tgz)
+
+sha256sums=(
+    "79dc8126afab289ff924f382face04ad18ae53d3257a7349dbef52d864c6b590"
+    "3acfa685f2dd7fcc832e0b77bc7093aa7da554a51ce8dafbb4138eaa854eee35"
+    "ebf28b3427535e2b5abd9991cd839b61622a0dbfb8c86df0f7af1f69dcaa8371"
+)
+
+build() {
+    top=$PWD
+    _p=$top/static        # private prefix, never packaged
+    export CC=clang
+    export PKG_CONFIG_PATH=$_p/lib/pkgconfig:$PKG_CONFIG_PATH
+
+    cd $top/LVM2.2.03.35
+    ./configure --prefix=$_p --enable-static_link --disable-udev_sync \
+        --disable-selinux --disable-blkid_wiping --disable-readline --disable-nls \
+        --with-thin=none --with-cache=none --with-vdo=none \
+        --with-writecache=none --with-integrity=none
+    make -C libdm ioctl/libdevmapper.a
+    install -Dm644 libdm/libdevmapper.h       $_p/include/libdevmapper.h
+    install -Dm644 libdm/ioctl/libdevmapper.a $_p/lib/libdevmapper.a
+    install -Dm644 libdm/libdevmapper.pc      $_p/lib/pkgconfig/devmapper.pc
+
+    # configure insists on popt even with every tool disabled; only the lib is built
+    cd $top/cryptsetup-2.8.8
+    CPPFLAGS="-I$_p/include $CPPFLAGS" LDFLAGS="-L$_p/lib $LDFLAGS" \
+    ./configure --prefix=$_p --disable-shared --enable-static \
+        --with-crypto_backend=kernel \
+        --enable-internal-argon2 --enable-internal-sse-argon2 --disable-libargon2 \
+        --disable-blkid --disable-udev --disable-selinux \
+        --disable-external-tokens --disable-ssh-token --disable-hw-opal \
+        --disable-cryptsetup --disable-veritysetup --disable-integritysetup \
+        --disable-pwquality --disable-asciidoc --disable-nls
+    make libcryptsetup.la
+    make install-libLTLIBRARIES install-includeHEADERS install-pkgconfigDATA
+
+    cd $top
+    $CC $CFLAGS -I$_p/include -static -o tinyrd tinyrd.c \
+        -L$_p/lib $LDFLAGS $(pkg-config --static --libs libcryptsetup)
+    ./tinyrd -o tinyrd.img
+    install -Dm644 tinyrd.img $PKG/boot/tinyrd.img
+}
+
+signify() {
+    untrusted comment: public key
+    RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
+}
+
+# vim: filetype=sh