blob: a8cce1811891e2719714ad1b28391662b2aee084 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
|
#!/bin/mkpkg
# description: rawnix initramfs: static /init that unlocks a LUKS root
# url: https://rawnix.org
#
# The image is generic (no modules, no config), so one package serves every
# kernel and nothing regenerates it. Staged in /boot; limine-sync mirrors it.
#
# libcryptsetup and libdevmapper are built here as private static libraries
# and never installed. The system ports stay shared-only, and the initramfs
# wants a different configuration anyway:
# - libdevmapper without udev_sync (no udev before root; the system one
# has it, and would drag in libudev.a)
# - kernel crypto backend (no libcrypto.a; needs CRYPTO_USER_API_HASH=y)
# - internal argon2, no blkid, no tokens
#
# Versions are literal below (source= and the two cd lines): keep cryptsetup
# equal to the cryptsetup port and LVM2 equal to device-mapper. A security fix in either reaches the initramfs only by bumping release here.
name=tinyrd
version=0.1
release=2
depends=()
makedeps=(pkgconf popt util-linux json-c)
source=(tinyrd.c
https://www.kernel.org/pub/linux/utils/cryptsetup/v2.8/cryptsetup-2.8.8.tar.xz
https://sourceware.org/pub/lvm2/LVM2.2.03.35.tgz)
sha256sums=(
"79dc8126afab289ff924f382face04ad18ae53d3257a7349dbef52d864c6b590"
"3acfa685f2dd7fcc832e0b77bc7093aa7da554a51ce8dafbb4138eaa854eee35"
"ebf28b3427535e2b5abd9991cd839b61622a0dbfb8c86df0f7af1f69dcaa8371"
)
build() {
top=$PWD
_p=$top/static # private prefix, never packaged
export CC=clang
export PKG_CONFIG_PATH=$_p/lib/pkgconfig:$PKG_CONFIG_PATH
cd $top/LVM2.2.03.35
./configure --prefix=$_p --enable-static_link --disable-udev_sync \
--disable-selinux --disable-blkid_wiping --disable-readline --disable-nls \
--with-thin=none --with-cache=none --with-vdo=none \
--with-writecache=none --with-integrity=none
make -C libdm ioctl/libdevmapper.a
install -Dm644 libdm/libdevmapper.h $_p/include/libdevmapper.h
install -Dm644 libdm/ioctl/libdevmapper.a $_p/lib/libdevmapper.a
install -Dm644 libdm/libdevmapper.pc $_p/lib/pkgconfig/devmapper.pc
# configure insists on popt even with every tool disabled; only the lib is built
cd $top/cryptsetup-2.8.8
CPPFLAGS="-I$_p/include $CPPFLAGS" LDFLAGS="-L$_p/lib $LDFLAGS" \
./configure --prefix=$_p --disable-shared --enable-static \
--with-crypto_backend=kernel \
--enable-internal-argon2 --enable-internal-sse-argon2 --disable-libargon2 \
--disable-blkid --disable-udev --disable-selinux \
--disable-external-tokens --disable-ssh-token --disable-hw-opal \
--disable-cryptsetup --disable-veritysetup --disable-integritysetup \
--disable-pwquality --disable-asciidoc --disable-nls
make libcryptsetup.la
make install-libLTLIBRARIES install-includeHEADERS install-pkgconfigDATA
cd $top
$CC $CFLAGS -I$_p/include -static -o tinyrd tinyrd.c \
-L$_p/lib $LDFLAGS $(pkg-config --static --libs libcryptsetup)
./tinyrd -o tinyrd.img
install -Dm644 tinyrd.img $PKG/boot/tinyrd.img
}
signify() {
untrusted comment: public key
RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
}
# vim: filetype=sh
|
