[bug#68524] [PATCH 0/2] Support root encryption and secure boot.

[bug#68524] [PATCH 0/2] Support root encryption and secure boot.

[Lilah Tascheter via Guix-patches]

Primarily adds a new bootloader, uefi-uki-bootloader, and an auxilliary form,
uefi-uki-signed-bootloader. These use isolated fragments of the systemd project
(particularly the systemd-stub UEFI stub and supporting ukify tool) to install
combined kernel/arguments/initrd images to the EFI system partition. The
built-in UEFI boot manager can then deal with boot selection. While this does
require copying files from the store to the partition, it makes up for it in two
important ways:

1. Proper encrypted root support! GRUB is really fucking slow at decrypting the
store in my experience, and it's annoying to have to enter in the root password
twice. Since the kernel is loaded directly from the system partition, the first,
and only, LUKS password entry is in the initrd. Also wholly bypasses GRUB not
supporting LUKS2 (or, at least, having bad issues with it on Guix).

2. Secure boot support! It's set up assuming the user has already created the
necessary keys (typically, in /root, as they should only be root-accessible).
Passing the paths to the db cert and key to uefi-uki-signed-bootloader will then
automatically sign the entire bootloader image. In combination with root
encryption, assuming a functioning motherboard UEFI installation, this should
fully secure Guix's boot chain.

This is ported from my personal channel, so uefi-uki-bootloader has been tested
for months. The main drawback is lack of kernel generation rollback in the case
of a botched upgrade, so I've been keeping around a manually-copied backup uki
image, but I haven't had any troubles with it so far. I have just verified
uefi-uki-signed-bootloader properly functions and boots in secure boot user
mode.

All in-system testing has been done on my channel, so the porting process may
have had issues, but I did make sure the added packages compile, and there
aren't any miscopies.

No clue how this works on non-x64 systems. I don't think there's enough ARM UEFI
systems in existance for it to matter that much anyway.

Thanks!

Lilah Tascheter (2):
  gnu: bootloaders: Add uki packages.
  gnu: bootloaders: Add uefi-uki-bootloader.

 doc/guix.texi                |  35 +++++++++---
 gnu/bootloader/uki.scm       | 106 +++++++++++++++++++++++++++++++++++
 gnu/packages/bootloaders.scm |  94 +++++++++++++++++++++++++++++++
 3 files changed, 227 insertions(+), 8 deletions(-)
 create mode 100644 gnu/bootloader/uki.scm


base-commit: 21f5d20d68e0359f8111ccb936905649c70db9c1
-- 
2.41.0

[bug#68525] [PATCH 1/2] gnu: bootloaders: Add uki packages.

[Lilah Tascheter via Guix-patches]

* gnu/packages/bootloaders.scm (systemd-stub-name): New procedure.
  (systemd-version,systemd-source,systemd-stub,ukify): New variables.

Change-Id: Ie27bdcbf2c03e895956295f94f280c304393ce8d
---
 gnu/packages/bootloaders.scm | 94 ++++++++++++++++++++++++++++++++++++
 1 file changed, 94 insertions(+)

diff --git a/gnu/packages/bootloaders.scm b/gnu/packages/bootloaders.scm
index c73a0e665d..32cbb4e704 100644
--- a/gnu/packages/bootloaders.scm
+++ b/gnu/packages/bootloaders.scm
@@ -46,11 +46,13 @@ (define-module (gnu packages bootloaders)
   #:use-module (gnu packages compression)
   #:use-module (gnu packages cross-base)
   #:use-module (gnu packages disk)
+  #:use-module (gnu packages efi)
   #:use-module (gnu packages firmware)
   #:use-module (gnu packages flex)
   #:use-module (gnu packages fontutils)
   #:use-module (gnu packages gcc)
   #:use-module (gnu packages gettext)
+  #:use-module (gnu packages gperf)
   #:use-module (gnu packages linux)
   #:use-module (gnu packages man)
   #:use-module (gnu packages mtools)
@@ -71,11 +73,13 @@ (define-module (gnu packages bootloaders)
   #:use-module (gnu packages valgrind)
   #:use-module (gnu packages virtualization)
   #:use-module (gnu packages xorg)
+  #:use-module (gnu packages python-crypto)
   #:use-module (gnu packages python-web)
   #:use-module (gnu packages python-xyz)
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system meson)
   #:use-module (guix build-system pyproject)
+  #:use-module (guix build-system python)
   #:use-module (guix build-system trivial)
   #:use-module (guix download)
   #:use-module (guix gexp)
@@ -632,6 +636,96 @@ (define-public syslinux
                      ;; Also contains:
                      license:expat license:isc license:zlib)))))
 
+(define systemd-version "255")
+(define systemd-source
+  (origin
+    (method git-fetch)
+    (uri (git-reference
+           (url "https://github.com/systemd/systemd")
+           (commit (string-append "v" systemd-version))))
+    (file-name (git-file-name "systemd" systemd-version))
+    (sha256
+      (base32
+        "1qdyw9g3jgvsbc1aryr11gpc3075w5pg00mqv4pyf3hwixxkwaq6"))))
+
+(define-public (systemd-stub-name)
+  (let ((arch (cond ((target-x86-32?) "ia32")
+                ((target-x86-64?) "x64")
+                ((target-arm32?) "arm")
+                ((target-aarch64?) "aa64")
+                ((target-riscv64?) "riscv64"))))
+    (string-append "linux" arch ".efi.stub")))
+
+(define-public systemd-stub
+  (package
+    (name "systemd-stub")
+    (version systemd-version)
+    (source systemd-source)
+    (build-system meson-build-system)
+    (arguments
+      (list
+        #:configure-flags
+        `(list "-Defi=true" "-Dsbat-distro=guix"
+               "-Dsbat-distro-generation=1" ; package revision!
+               "-Dsbat-distro-summary=Guix System"
+               "-Dsbat-distro-url=https://guix.gnu.org"
+               ,(string-append "-Dsbat-distro-pkgname=" name)
+               ,(string-append "-Dsbat-distro-version=" version))
+        #:phases
+        #~(let ((stub #$(string-append "src/boot/efi/" (systemd-stub-name))))
+            (modify-phases %standard-phases
+              (replace 'build
+                (lambda* (#:key parallel-build? #:allow-other-keys)
+                  (invoke "ninja" stub
+                    "-j" (if parallel-build?
+                           (number->string (parallel-job-count)) "1"))))
+              (replace 'install
+                (lambda _
+                  (install-file stub (string-append #$output "/libexec"))))
+              (delete 'check)))))
+    (inputs (list libcap python-pyelftools `(,util-linux "lib")))
+    (native-inputs (list gperf pkg-config python-3 python-jinja2))
+    (home-page "https://systemd.io")
+    (synopsis "Unified kernel image UEFI stub")
+    (description "Simple UEFi boot stub that loads a conjoined kernel image and
+supporting data to their proper locations, before chainloading to the kernel.
+Supports measured and/or verified boot environments.")
+    (license license:lgpl2.1+)))
+
+(define-public ukify
+  (package
+    (name "ukify")
+    (version systemd-version)
+    (source systemd-source)
+    (build-system python-build-system)
+    (arguments
+      (list #:phases
+            #~(modify-phases %standard-phases
+                (replace 'build
+                  (lambda _
+                    (substitute* "src/ukify/ukify.py" ; added in python 3.11
+                      (("datetime\\.UTC") "datetime.timezone.utc"))))
+                (delete 'check)
+                (replace 'install
+                  (lambda* (#:key inputs #:allow-other-keys)
+                    (let* ((bin (string-append #$output "/bin"))
+                           (file (string-append bin "/ukify"))
+                           (binutils (assoc-ref inputs "binutils"))
+                           (sbsign (assoc-ref inputs "sbsigntools")))
+                      (mkdir-p bin)
+                      (copy-file "src/ukify/ukify.py" file)
+                      (wrap-program file
+                        `("PATH" ":" prefix
+                          (,(string-append binutils "/bin")
+                           ,(string-append sbsign "/bin"))))))))))
+    (inputs (list binutils python-cryptography python-pefile sbsigntools))
+    (home-page "https://systemd.io")
+    (synopsis "Unified kernel image UEFI tool")
+    (description "@command{ukify} joins together a UKI stub, linux kernel, initrd,
+kernel arguments, and optional secure boot signatures into a single, UEFI-bootable
+image.")
+    (license license:lgpl2.1+)))
+
 (define-public dtc
   (package
     (name "dtc")
-- 
2.41.0

[bug#68526] [PATCH 2/2] gnu: bootloaders: Add uefi-uki-bootloader.

[Lilah Tascheter via Guix-patches]

* doc/guix.texi (Bootloader Configuration)[bootloader,targets]: Document
  uefi-uki-bootloader and uefi-uki-signed-bootloader.
* gnu/bootloader/uki.scm: New file.

Change-Id: Ie30ef47ea026889727a050131a9b3c0555aa4c21
---
 doc/guix.texi          |  35 ++++++++++----
 gnu/bootloader/uki.scm | 106 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 133 insertions(+), 8 deletions(-)
 create mode 100644 gnu/bootloader/uki.scm

diff --git a/doc/guix.texi b/doc/guix.texi
index a66005ee9d..3029740f45 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -40881,8 +40881,9 @@ Bootloader Configuration
 The bootloader to use, as a @code{bootloader} object.  For now
 @code{grub-bootloader}, @code{grub-efi-bootloader},
 @code{grub-efi-removable-bootloader}, @code{grub-efi-netboot-bootloader},
-@code{grub-efi-netboot-removable-bootloader}, @code{extlinux-bootloader}
-and @code{u-boot-bootloader} are supported.
+@code{grub-efi-netboot-removable-bootloader}, @code{extlinux-bootloader},
+@code{u-boot-bootloader}, @code{uefi-uki-bootloader}, and
+@code{uefi-uki-signed-bootloader} are supported.
 
 @cindex ARM, bootloaders
 @cindex AArch64, bootloaders
@@ -40989,6 +40990,24 @@ Bootloader Configuration
 unbootable.
 @end quotation
 
+@vindex uefi-uki-bootloader
+@code{uefi-uki-bootloader} boots a linux kernel directly through UEFI, without
+an intermediary like GRUB. The main practical advantage of this is allowing
+root/store encryption without an extra GRUB password entry and slow decryption
+step.
+
+@vindex uefi-uki-signed-bootloader
+@code{uefi-uki-signed-bootloader} is like @code{uefi-uki-bootloader}, except
+that it is a procedure that returns a bootloader compatible with UEFI secure
+boot. You must provide it with two paths, to an out-of-store secure boot db
+certificate, and key, in that order.
+
+@quotation Note
+This bootloader @emph{does not} support booting from any old system generation.
+You will also need enough space in your EFI System partition to store your
+kernel and initramfs, though this likely won't be an issue.
+@end quotation
+
 @item @code{targets}
 This is a list of strings denoting the targets onto which to install the
 bootloader.
@@ -40997,12 +41016,12 @@ Bootloader Configuration
 For @code{grub-bootloader}, for example, they should be device names
 understood by the bootloader @command{installer} command, such as
 @code{/dev/sda} or @code{(hd0)} (@pxref{Invoking grub-install,,, grub,
-GNU GRUB Manual}).  For @code{grub-efi-bootloader} and
-@code{grub-efi-removable-bootloader} they should be mount
-points of the EFI file system, usually @file{/boot/efi}.  For
-@code{grub-efi-netboot-bootloader}, @code{targets} should be the mount
-points corresponding to TFTP root directories served by your TFTP
-server.
+GNU GRUB Manual}).  For @code{grub-efi-bootloader},
+@code{grub-efi-removable-bootloader}, @code{uefi-uki-bootloader}, and
+@code{uefi-uki-signed-bootloader}, they should be mount points of the EFI file
+system, usually @file{/boot/efi}.  For @code{grub-efi-netboot-bootloader},
+@code{targets} should be the mount points corresponding to TFTP root directories
+served by your TFTP server.
 
 @item @code{menu-entries} (default: @code{'()})
 A possibly empty list of @code{menu-entry} objects (see below), denoting
diff --git a/gnu/bootloader/uki.scm b/gnu/bootloader/uki.scm
new file mode 100644
index 0000000000..3131bae3d7
--- /dev/null
+++ b/gnu/bootloader/uki.scm
@@ -0,0 +1,106 @@
+;;; GNU Guix --- Functional package management for GNU
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu bootloader uki)
+  #:use-module (gnu bootloader)
+  #:use-module (gnu packages bootloaders)
+  #:use-module (gnu packages efi)
+  #:use-module (gnu packages linux)
+  #:use-module (guix gexp)
+  #:use-module (guix modules))
+
+;; config generator makes script creating uki images
+;; install runs script
+;; install device is path to uefi dir
+
+(define* (uefi-uki-configuration-file #:optional cert privkey)
+  (lambda* (config entries #:key (old-entires '()) #:allow-other-keys)
+
+    (define (menu-entry->uki e)
+      (define stub (file-append systemd-stub "/libexec/" (systemd-stub-name)))
+      (computed-file "uki.efi"
+        (with-imported-modules (source-module-closure '((guix build utils)))
+          #~(let ((args (list #$@(menu-entry-linux-arguments e))))
+              (use-modules (guix build utils))
+              (invoke #$(file-append ukify "/bin/ukify") "build"
+                "--linux" #$(menu-entry-linux e)
+                "--initrd" #$(menu-entry-initrd e)
+                "--os-release" #$(menu-entry-label e)
+                "--cmdline" (string-join args)
+                "--stub" #$stub
+                "-o" #$output)))))
+
+    (program-file "install-uki"
+      (with-imported-modules (source-module-closure '((guix build utils)))
+        #~(let* ((target (cadr (command-line)))
+                 (vendir (string-append target "/EFI/Guix"))
+                 (schema (string-append vendir "/boot.mgr"))
+                 (findmnt #$(file-append util-linux "/bin/findmnt"))
+                 (efibootmgr #$(file-append efibootmgr "/sbin/efibootmgr")))
+            (use-modules (guix build utils) (ice-9 popen) (ice-9 textual-ports))
+
+            (define disk
+              (call-with-port
+                (open-pipe* OPEN_READ findmnt "-fnro" "SOURCE" "-T" target)
+                (lambda (port) (get-line port)))) ; only 1 line: the device
+
+            (when (file-exists? schema)
+              (call-with-input-file schema
+                (lambda (port)
+                  (for-each (lambda (l)
+                              (unless (string-null? l)
+                                (system* efibootmgr "-B" "-L" l)))
+                    (string-split (get-string-all port) #\lf)))))
+            (when (directory-exists? vendir) (delete-file-recursively vendir))
+
+            (mkdir-p vendir)
+            (call-with-output-file schema
+              (lambda (port)
+                (for-each (lambda (uki label)
+                            (let* ((base (basename uki))
+                                   (out (string-append vendir "/" base)))
+                              #$(if cert ; sign here so we can access root certs
+                                  #~(invoke
+                                      #$(file-append sbsigntools "/bin/sbsign")
+                                      "--cert" #$cert "--key" #$privkey
+                                      "--output" out uki)
+                                  #~(copy-file uki out))
+                              (invoke efibootmgr "-c" "-L" label "-d" disk "-l"
+                                (string-append "\\EFI\\Guix\\" base))
+                              (put-string port label)
+                              (put-char port #\lf)))
+                  (list #$@(map-in-order menu-entry->uki entries))
+                  (list #$@(map-in-order menu-entry-label entries))))))))))
+
+(define install-uefi-uki
+  #~(lambda (bootloader target mount-point)
+      (invoke (string-append mount-point "/boot/install-uki.scm")
+              (string-append mount-point target))))
+
+(define* (make-uefi-uki-bootloader #:optional cert privkey)
+  (bootloader
+    (name 'uefi-uki)
+    (package systemd-stub)
+    (installer install-uefi-uki)
+    (disk-image-installer #f)
+    (configuration-file "/boot/install-uki.scm")
+    (configuration-file-generator (uefi-uki-configuration-file cert privkey))))
+
+(define-public uefi-uki-bootloader (make-uefi-uki-bootloader))
+;; use ukify genkey to generate cert and privkey. DO NOT include in store.
+(define-public (uefi-uki-signed-bootloader cert privkey)
+  (make-uefi-uki-bootloader cert privkey))
-- 
2.41.0

[bug#68524] [PATCH 1/2] gnu: bootloaders: Add uki packages.

[Lilah Tascheter via Guix-patches]

* gnu/packages/bootloaders.scm (systemd-stub-name): New procedure.
  (systemd-version,systemd-source,systemd-stub,ukify): New variables.

Change-Id: Ie27bdcbf2c03e895956295f94f280c304393ce8d
---
 gnu/packages/bootloaders.scm | 94 ++++++++++++++++++++++++++++++++++++
 1 file changed, 94 insertions(+)

diff --git a/gnu/packages/bootloaders.scm b/gnu/packages/bootloaders.scm
index c73a0e665d..32cbb4e704 100644
--- a/gnu/packages/bootloaders.scm
+++ b/gnu/packages/bootloaders.scm
@@ -46,11 +46,13 @@ (define-module (gnu packages bootloaders)
   #:use-module (gnu packages compression)
   #:use-module (gnu packages cross-base)
   #:use-module (gnu packages disk)
+  #:use-module (gnu packages efi)
   #:use-module (gnu packages firmware)
   #:use-module (gnu packages flex)
   #:use-module (gnu packages fontutils)
   #:use-module (gnu packages gcc)
   #:use-module (gnu packages gettext)
+  #:use-module (gnu packages gperf)
   #:use-module (gnu packages linux)
   #:use-module (gnu packages man)
   #:use-module (gnu packages mtools)
@@ -71,11 +73,13 @@ (define-module (gnu packages bootloaders)
   #:use-module (gnu packages valgrind)
   #:use-module (gnu packages virtualization)
   #:use-module (gnu packages xorg)
+  #:use-module (gnu packages python-crypto)
   #:use-module (gnu packages python-web)
   #:use-module (gnu packages python-xyz)
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system meson)
   #:use-module (guix build-system pyproject)
+  #:use-module (guix build-system python)
   #:use-module (guix build-system trivial)
   #:use-module (guix download)
   #:use-module (guix gexp)
@@ -632,6 +636,96 @@ (define-public syslinux
                      ;; Also contains:
                      license:expat license:isc license:zlib)))))
 
+(define systemd-version "255")
+(define systemd-source
+  (origin
+    (method git-fetch)
+    (uri (git-reference
+           (url "https://github.com/systemd/systemd")
+           (commit (string-append "v" systemd-version))))
+    (file-name (git-file-name "systemd" systemd-version))
+    (sha256
+      (base32
+        "1qdyw9g3jgvsbc1aryr11gpc3075w5pg00mqv4pyf3hwixxkwaq6"))))
+
+(define-public (systemd-stub-name)
+  (let ((arch (cond ((target-x86-32?) "ia32")
+                ((target-x86-64?) "x64")
+                ((target-arm32?) "arm")
+                ((target-aarch64?) "aa64")
+                ((target-riscv64?) "riscv64"))))
+    (string-append "linux" arch ".efi.stub")))
+
+(define-public systemd-stub
+  (package
+    (name "systemd-stub")
+    (version systemd-version)
+    (source systemd-source)
+    (build-system meson-build-system)
+    (arguments
+      (list
+        #:configure-flags
+        `(list "-Defi=true" "-Dsbat-distro=guix"
+               "-Dsbat-distro-generation=1" ; package revision!
+               "-Dsbat-distro-summary=Guix System"
+               "-Dsbat-distro-url=https://guix.gnu.org"
+               ,(string-append "-Dsbat-distro-pkgname=" name)
+               ,(string-append "-Dsbat-distro-version=" version))
+        #:phases
+        #~(let ((stub #$(string-append "src/boot/efi/" (systemd-stub-name))))
+            (modify-phases %standard-phases
+              (replace 'build
+                (lambda* (#:key parallel-build? #:allow-other-keys)
+                  (invoke "ninja" stub
+                    "-j" (if parallel-build?
+                           (number->string (parallel-job-count)) "1"))))
+              (replace 'install
+                (lambda _
+                  (install-file stub (string-append #$output "/libexec"))))
+              (delete 'check)))))
+    (inputs (list libcap python-pyelftools `(,util-linux "lib")))
+    (native-inputs (list gperf pkg-config python-3 python-jinja2))
+    (home-page "https://systemd.io")
+    (synopsis "Unified kernel image UEFI stub")
+    (description "Simple UEFi boot stub that loads a conjoined kernel image and
+supporting data to their proper locations, before chainloading to the kernel.
+Supports measured and/or verified boot environments.")
+    (license license:lgpl2.1+)))
+
+(define-public ukify
+  (package
+    (name "ukify")
+    (version systemd-version)
+    (source systemd-source)
+    (build-system python-build-system)
+    (arguments
+      (list #:phases
+            #~(modify-phases %standard-phases
+                (replace 'build
+                  (lambda _
+                    (substitute* "src/ukify/ukify.py" ; added in python 3.11
+                      (("datetime\\.UTC") "datetime.timezone.utc"))))
+                (delete 'check)
+                (replace 'install
+                  (lambda* (#:key inputs #:allow-other-keys)
+                    (let* ((bin (string-append #$output "/bin"))
+                           (file (string-append bin "/ukify"))
+                           (binutils (assoc-ref inputs "binutils"))
+                           (sbsign (assoc-ref inputs "sbsigntools")))
+                      (mkdir-p bin)
+                      (copy-file "src/ukify/ukify.py" file)
+                      (wrap-program file
+                        `("PATH" ":" prefix
+                          (,(string-append binutils "/bin")
+                           ,(string-append sbsign "/bin"))))))))))
+    (inputs (list binutils python-cryptography python-pefile sbsigntools))
+    (home-page "https://systemd.io")
+    (synopsis "Unified kernel image UEFI tool")
+    (description "@command{ukify} joins together a UKI stub, linux kernel, initrd,
+kernel arguments, and optional secure boot signatures into a single, UEFI-bootable
+image.")
+    (license license:lgpl2.1+)))
+
 (define-public dtc
   (package
     (name "dtc")

base-commit: 21f5d20d68e0359f8111ccb936905649c70db9c1
-- 
2.41.0

[bug#68524] [PATCH 2/2] gnu: bootloaders: Add uefi-uki-bootloader.

[Lilah Tascheter via Guix-patches]

* doc/guix.texi (Bootloader Configuration)[bootloader,targets]: Document
  uefi-uki-bootloader and uefi-uki-signed-bootloader.
* gnu/bootloader/uki.scm: New file.

Change-Id: Ie30ef47ea026889727a050131a9b3c0555aa4c21
---
 doc/guix.texi          |  35 ++++++++++----
 gnu/bootloader/uki.scm | 106 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 133 insertions(+), 8 deletions(-)
 create mode 100644 gnu/bootloader/uki.scm

diff --git a/doc/guix.texi b/doc/guix.texi
index a66005ee9d..3029740f45 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -40881,8 +40881,9 @@ Bootloader Configuration
 The bootloader to use, as a @code{bootloader} object.  For now
 @code{grub-bootloader}, @code{grub-efi-bootloader},
 @code{grub-efi-removable-bootloader}, @code{grub-efi-netboot-bootloader},
-@code{grub-efi-netboot-removable-bootloader}, @code{extlinux-bootloader}
-and @code{u-boot-bootloader} are supported.
+@code{grub-efi-netboot-removable-bootloader}, @code{extlinux-bootloader},
+@code{u-boot-bootloader}, @code{uefi-uki-bootloader}, and
+@code{uefi-uki-signed-bootloader} are supported.
 
 @cindex ARM, bootloaders
 @cindex AArch64, bootloaders
@@ -40989,6 +40990,24 @@ Bootloader Configuration
 unbootable.
 @end quotation
 
+@vindex uefi-uki-bootloader
+@code{uefi-uki-bootloader} boots a linux kernel directly through UEFI, without
+an intermediary like GRUB. The main practical advantage of this is allowing
+root/store encryption without an extra GRUB password entry and slow decryption
+step.
+
+@vindex uefi-uki-signed-bootloader
+@code{uefi-uki-signed-bootloader} is like @code{uefi-uki-bootloader}, except
+that it is a procedure that returns a bootloader compatible with UEFI secure
+boot. You must provide it with two paths, to an out-of-store secure boot db
+certificate, and key, in that order.
+
+@quotation Note
+This bootloader @emph{does not} support booting from any old system generation.
+You will also need enough space in your EFI System partition to store your
+kernel and initramfs, though this likely won't be an issue.
+@end quotation
+
 @item @code{targets}
 This is a list of strings denoting the targets onto which to install the
 bootloader.
@@ -40997,12 +41016,12 @@ Bootloader Configuration
 For @code{grub-bootloader}, for example, they should be device names
 understood by the bootloader @command{installer} command, such as
 @code{/dev/sda} or @code{(hd0)} (@pxref{Invoking grub-install,,, grub,
-GNU GRUB Manual}).  For @code{grub-efi-bootloader} and
-@code{grub-efi-removable-bootloader} they should be mount
-points of the EFI file system, usually @file{/boot/efi}.  For
-@code{grub-efi-netboot-bootloader}, @code{targets} should be the mount
-points corresponding to TFTP root directories served by your TFTP
-server.
+GNU GRUB Manual}).  For @code{grub-efi-bootloader},
+@code{grub-efi-removable-bootloader}, @code{uefi-uki-bootloader}, and
+@code{uefi-uki-signed-bootloader}, they should be mount points of the EFI file
+system, usually @file{/boot/efi}.  For @code{grub-efi-netboot-bootloader},
+@code{targets} should be the mount points corresponding to TFTP root directories
+served by your TFTP server.
 
 @item @code{menu-entries} (default: @code{'()})
 A possibly empty list of @code{menu-entry} objects (see below), denoting
diff --git a/gnu/bootloader/uki.scm b/gnu/bootloader/uki.scm
new file mode 100644
index 0000000000..3131bae3d7
--- /dev/null
+++ b/gnu/bootloader/uki.scm
@@ -0,0 +1,106 @@
+;;; GNU Guix --- Functional package management for GNU
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu bootloader uki)
+  #:use-module (gnu bootloader)
+  #:use-module (gnu packages bootloaders)
+  #:use-module (gnu packages efi)
+  #:use-module (gnu packages linux)
+  #:use-module (guix gexp)
+  #:use-module (guix modules))
+
+;; config generator makes script creating uki images
+;; install runs script
+;; install device is path to uefi dir
+
+(define* (uefi-uki-configuration-file #:optional cert privkey)
+  (lambda* (config entries #:key (old-entires '()) #:allow-other-keys)
+
+    (define (menu-entry->uki e)
+      (define stub (file-append systemd-stub "/libexec/" (systemd-stub-name)))
+      (computed-file "uki.efi"
+        (with-imported-modules (source-module-closure '((guix build utils)))
+          #~(let ((args (list #$@(menu-entry-linux-arguments e))))
+              (use-modules (guix build utils))
+              (invoke #$(file-append ukify "/bin/ukify") "build"
+                "--linux" #$(menu-entry-linux e)
+                "--initrd" #$(menu-entry-initrd e)
+                "--os-release" #$(menu-entry-label e)
+                "--cmdline" (string-join args)
+                "--stub" #$stub
+                "-o" #$output)))))
+
+    (program-file "install-uki"
+      (with-imported-modules (source-module-closure '((guix build utils)))
+        #~(let* ((target (cadr (command-line)))
+                 (vendir (string-append target "/EFI/Guix"))
+                 (schema (string-append vendir "/boot.mgr"))
+                 (findmnt #$(file-append util-linux "/bin/findmnt"))
+                 (efibootmgr #$(file-append efibootmgr "/sbin/efibootmgr")))
+            (use-modules (guix build utils) (ice-9 popen) (ice-9 textual-ports))
+
+            (define disk
+              (call-with-port
+                (open-pipe* OPEN_READ findmnt "-fnro" "SOURCE" "-T" target)
+                (lambda (port) (get-line port)))) ; only 1 line: the device
+
+            (when (file-exists? schema)
+              (call-with-input-file schema
+                (lambda (port)
+                  (for-each (lambda (l)
+                              (unless (string-null? l)
+                                (system* efibootmgr "-B" "-L" l)))
+                    (string-split (get-string-all port) #\lf)))))
+            (when (directory-exists? vendir) (delete-file-recursively vendir))
+
+            (mkdir-p vendir)
+            (call-with-output-file schema
+              (lambda (port)
+                (for-each (lambda (uki label)
+                            (let* ((base (basename uki))
+                                   (out (string-append vendir "/" base)))
+                              #$(if cert ; sign here so we can access root certs
+                                  #~(invoke
+                                      #$(file-append sbsigntools "/bin/sbsign")
+                                      "--cert" #$cert "--key" #$privkey
+                                      "--output" out uki)
+                                  #~(copy-file uki out))
+                              (invoke efibootmgr "-c" "-L" label "-d" disk "-l"
+                                (string-append "\\EFI\\Guix\\" base))
+                              (put-string port label)
+                              (put-char port #\lf)))
+                  (list #$@(map-in-order menu-entry->uki entries))
+                  (list #$@(map-in-order menu-entry-label entries))))))))))
+
+(define install-uefi-uki
+  #~(lambda (bootloader target mount-point)
+      (invoke (string-append mount-point "/boot/install-uki.scm")
+              (string-append mount-point target))))
+
+(define* (make-uefi-uki-bootloader #:optional cert privkey)
+  (bootloader
+    (name 'uefi-uki)
+    (package systemd-stub)
+    (installer install-uefi-uki)
+    (disk-image-installer #f)
+    (configuration-file "/boot/install-uki.scm")
+    (configuration-file-generator (uefi-uki-configuration-file cert privkey))))
+
+(define-public uefi-uki-bootloader (make-uefi-uki-bootloader))
+;; use ukify genkey to generate cert and privkey. DO NOT include in store.
+(define-public (uefi-uki-signed-bootloader cert privkey)
+  (make-uefi-uki-bootloader cert privkey))
-- 
2.41.0

[bug#68524] [PATCH 2/2] gnu: bootloaders: Add uefi-uki-bootloader.

[Herman Rimm via Guix-patches via]

Hello,

On Tue, Jan 16, 2024 at 10:48:11PM -0600, Lilah Tascheter wrote:
> * doc/guix.texi (Bootloader Configuration)[bootloader,targets]: Document
>   uefi-uki-bootloader and uefi-uki-signed-bootloader.
> * gnu/bootloader/uki.scm: New file.
Remember to note your copyright and register new files in gnu/local.mk.

> +(define* (uefi-uki-configuration-file #:optional cert privkey)
> +  (lambda* (config entries #:key (old-entires '()) #:allow-other-keys)
old-entries got mistyped as old-entires.
> +    (define (menu-entry->uki e)
> +      (define stub (file-append systemd-stub "/libexec/" (systemd-stub-name)))
Can you have systemd-stub be an argument of uefi-uki-configuration-file?

> +            (when (file-exists? schema)
> +              (call-with-input-file schema
> +                (lambda (port)
> +                  (for-each (lambda (l)
> +                              (unless (string-null? l)
> +                                (system* efibootmgr "-B" "-L" l)))
You can make this quiet.

> +                              (invoke efibootmgr "-c" "-L" label "-d" disk "-l"
Maybe this too?

> +(define install-uefi-uki
> +  #~(lambda (bootloader target mount-point)
Get systemd-stub from bootloader with bootloader-package.
> +      (invoke (string-append mount-point "/boot/install-uki.scm")
> +              (string-append mount-point target))))
The way GRUB does it, if mount-point/boot/efi does not exist, try
install to /boot/efi in case the ESP got mounted there. Personally, I
think it's okay to only try install to mount-point/boot/efi.

> +(define-public uefi-uki-bootloader (make-uefi-uki-bootloader))
> +;; use ukify genkey to generate cert and privkey. DO NOT include in store.
> +(define-public (uefi-uki-signed-bootloader cert privkey)
> +  (make-uefi-uki-bootloader cert privkey))
Can you use define instead and export the bootloaders in define-module?
I expect define-public procedures in package modules which would have to
use an export procedure with many arguments otherwise.

The install-uki.scm config file is a nice idea. It can be used to
regenerate the UKI and corresponding UEFI boot entry. Now that I think
about it, can that be included as an example? Like:

  uefi-uki-bootloader installs install-uki.scm to /boot, you can use it
  to (re)create the UKI manually: sudo ./install-uki.scm /boot/efi/. If
  you need to chroot to an existing system on /mnt, mount efivars first:
  mount --bind /sys/firmware/efi/efivars /mnt/sys/firmware/efi/efivars.
  This is required for efibootmgr to (re)install the UEFI entry for the
  corresponding UKI.

This bootloader has been very useful to me. I could easily chainload the
UKI from an install image GRUB, whenever I messed up the UEFI boot entry
for the EFI stub bootloader I'm working on.

Thank you,
Herman

[bug#68524] [PATCH 2/2] gnu: bootloaders: Add uefi-uki-bootloader.

[Lilah Tascheter via Guix-patches]

Thanks for the notes! I'm working on a v2 right now.

> The way GRUB does it, if mount-point/boot/efi does not exist, try
> install to /boot/efi in case the ESP got mounted there. Personally, I
> think it's okay to only try install to mount-point/boot/efi.
Yeah, I'd be concerned about overriding my own bootloader if it could decide to
just not use mount-point.

> This bootloader has been very useful to me.
I'm so glad!!! :)

> I could easily chainload the UKI from an install image GRUB
Would it be more useful to have the EFI vendor dir for UKI be like, Guix-UKI
instead of just Guix, as to not delete a preexisting grub-efi-bootloader?

-lilah

[bug#68524] [PATCH v2 0/2] Support root encryption and secure boot.

[Lilah Tascheter via Guix-patches]

Thank you so much Herman, that motherfucking typo was what made my old-entries
testing not work. I reworked the majority of the install-uki.scm code, and now
uefi-uki-bootloader and uefi-uki-signed-bootloader support generation rollback!
Slightly jank, but it works. On install, we pretty much just cram as many
generations into the ESP as possible. ESPs are typically small, so we can't
assume that we can fit more than one UKI, so if we can't fit every extent
generation we just exit early.

We also don't waste space on root by adding each UKI to the store anymore.
They're all generated at install time. Added slightly more documentation too.

Otherwise, fixed everything Herman pointed out!

Decided not to add a manual section on manually running /boot/install-uki.scm
though. It's more of a quirk of getting around guix's bootloader assumptions
than meant to be run that way; I don't know if it's a good idea to direct
attention to it. I mean it Works, but it's more of a quick hack.

Lilah Tascheter (2):
  gnu: bootloaders: Add uki packages.
  gnu: bootloaders: Add uefi-uki-bootloader.

 doc/guix.texi                |  45 ++++++++----
 gnu/bootloader/uki.scm       | 129 +++++++++++++++++++++++++++++++++++
 gnu/local.mk                 |   1 +
 gnu/packages/bootloaders.scm |  95 ++++++++++++++++++++++++++
 4 files changed, 258 insertions(+), 12 deletions(-)
 create mode 100644 gnu/bootloader/uki.scm


base-commit: 2823253484e49391c6ba3c653a2f9e9f5e5f38ae
-- 
2.41.0

[bug#68524] [PATCH v2 1/2] gnu: bootloaders: Add uki packages.

[Lilah Tascheter via Guix-patches]

* gnu/packages/bootloaders.scm (systemd-stub-name): New procedure.
  (systemd-version,systemd-source,systemd-stub,ukify): New variables.

Change-Id: I67776ec35d165afebc2eb4b11bea0459259e4bd8
---
 gnu/packages/bootloaders.scm | 95 ++++++++++++++++++++++++++++++++++++
 1 file changed, 95 insertions(+)

diff --git a/gnu/packages/bootloaders.scm b/gnu/packages/bootloaders.scm
index 986f0ac035..b0d4979f44 100644
--- a/gnu/packages/bootloaders.scm
+++ b/gnu/packages/bootloaders.scm
@@ -19,6 +19,7 @@
 ;;; Copyright © 2021 Stefan <stefan-guix@vodafonemail.de>
 ;;; Copyright © 2022, 2023 Maxim Cournoyer <maxim.cournoyer@gmail.com>
 ;;; Copyright © 2023 Herman Rimm <herman@rimm.ee>
+;;; Copyright © 2024 Lilah Tascheter <lilah@lunabee.space>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -46,11 +47,13 @@ (define-module (gnu packages bootloaders)
   #:use-module (gnu packages compression)
   #:use-module (gnu packages cross-base)
   #:use-module (gnu packages disk)
+  #:use-module (gnu packages efi)
   #:use-module (gnu packages firmware)
   #:use-module (gnu packages flex)
   #:use-module (gnu packages fontutils)
   #:use-module (gnu packages gcc)
   #:use-module (gnu packages gettext)
+  #:use-module (gnu packages gperf)
   #:use-module (gnu packages linux)
   #:use-module (gnu packages man)
   #:use-module (gnu packages mtools)
@@ -71,11 +74,13 @@ (define-module (gnu packages bootloaders)
   #:use-module (gnu packages valgrind)
   #:use-module (gnu packages virtualization)
   #:use-module (gnu packages xorg)
+  #:use-module (gnu packages python-crypto)
   #:use-module (gnu packages python-web)
   #:use-module (gnu packages python-xyz)
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system meson)
   #:use-module (guix build-system pyproject)
+  #:use-module (guix build-system python)
   #:use-module (guix build-system trivial)
   #:use-module (guix download)
   #:use-module (guix gexp)
@@ -632,6 +637,96 @@ (define-public syslinux
                      ;; Also contains:
                      license:expat license:isc license:zlib)))))
 
+(define systemd-version "255")
+(define systemd-source
+  (origin
+    (method git-fetch)
+    (uri (git-reference
+           (url "https://github.com/systemd/systemd")
+           (commit (string-append "v" systemd-version))))
+    (file-name (git-file-name "systemd" systemd-version))
+    (sha256
+      (base32
+        "1qdyw9g3jgvsbc1aryr11gpc3075w5pg00mqv4pyf3hwixxkwaq6"))))
+
+(define-public (systemd-stub-name)
+  (let ((arch (cond ((target-x86-32?) "ia32")
+                ((target-x86-64?) "x64")
+                ((target-arm32?) "arm")
+                ((target-aarch64?) "aa64")
+                ((target-riscv64?) "riscv64"))))
+    (string-append "linux" arch ".efi.stub")))
+
+(define-public systemd-stub
+  (package
+    (name "systemd-stub")
+    (version systemd-version)
+    (source systemd-source)
+    (build-system meson-build-system)
+    (arguments
+      (list
+        #:configure-flags
+        `(list "-Defi=true" "-Dsbat-distro=guix"
+               "-Dsbat-distro-generation=1" ; package revision!
+               "-Dsbat-distro-summary=Guix System"
+               "-Dsbat-distro-url=https://guix.gnu.org"
+               ,(string-append "-Dsbat-distro-pkgname=" name)
+               ,(string-append "-Dsbat-distro-version=" version))
+        #:phases
+        #~(let ((stub #$(string-append "src/boot/efi/" (systemd-stub-name))))
+            (modify-phases %standard-phases
+              (replace 'build
+                (lambda* (#:key parallel-build? #:allow-other-keys)
+                  (invoke "ninja" stub
+                    "-j" (if parallel-build?
+                           (number->string (parallel-job-count)) "1"))))
+              (replace 'install
+                (lambda _
+                  (install-file stub (string-append #$output "/libexec"))))
+              (delete 'check)))))
+    (inputs (list libcap python-pyelftools `(,util-linux "lib")))
+    (native-inputs (list gperf pkg-config python-3 python-jinja2))
+    (home-page "https://systemd.io")
+    (synopsis "Unified kernel image UEFI stub")
+    (description "Simple UEFi boot stub that loads a conjoined kernel image and
+supporting data to their proper locations, before chainloading to the kernel.
+Supports measured and/or verified boot environments.")
+    (license license:lgpl2.1+)))
+
+(define-public ukify
+  (package
+    (name "ukify")
+    (version systemd-version)
+    (source systemd-source)
+    (build-system python-build-system)
+    (arguments
+      (list #:phases
+            #~(modify-phases %standard-phases
+                (replace 'build
+                  (lambda _
+                    (substitute* "src/ukify/ukify.py" ; added in python 3.11
+                      (("datetime\\.UTC") "datetime.timezone.utc"))))
+                (delete 'check)
+                (replace 'install
+                  (lambda* (#:key inputs #:allow-other-keys)
+                    (let* ((bin (string-append #$output "/bin"))
+                           (file (string-append bin "/ukify"))
+                           (binutils (assoc-ref inputs "binutils"))
+                           (sbsign (assoc-ref inputs "sbsigntools")))
+                      (mkdir-p bin)
+                      (copy-file "src/ukify/ukify.py" file)
+                      (wrap-program file
+                        `("PATH" ":" prefix
+                          (,(string-append binutils "/bin")
+                           ,(string-append sbsign "/bin"))))))))))
+    (inputs (list binutils python-cryptography python-pefile sbsigntools))
+    (home-page "https://systemd.io")
+    (synopsis "Unified kernel image UEFI tool")
+    (description "@command{ukify} joins together a UKI stub, linux kernel, initrd,
+kernel arguments, and optional secure boot signatures into a single, UEFI-bootable
+image.")
+    (license license:lgpl2.1+)))
+
 (define-public dtc
   (package
     (name "dtc")
-- 
2.41.0

[bug#68524] [PATCH v2 1/2] gnu: bootloaders: Add uki packages.

[Hilton Chain via Guix-patches via]

Hi Lilah,

On Sun, 28 Jan 2024 17:51:40 +0800,
Lilah Tascheter via Guix-patches wrote:
>
> * gnu/packages/bootloaders.scm (systemd-stub-name): New procedure.
>   (systemd-version,systemd-source,systemd-stub,ukify): New variables.

First of all, please split this commit into two commits, each adding a single
package.
(Other comments are between quote blocks.)

> Change-Id: I67776ec35d165afebc2eb4b11bea0459259e4bd8
> ---
>  gnu/packages/bootloaders.scm | 95 ++++++++++++++++++++++++++++++++++++
>  1 file changed, 95 insertions(+)
>
> diff --git a/gnu/packages/bootloaders.scm b/gnu/packages/bootloaders.scm
> index 986f0ac035..b0d4979f44 100644
> --- a/gnu/packages/bootloaders.scm
> +++ b/gnu/packages/bootloaders.scm
> @@ -19,6 +19,7 @@
>  ;;; Copyright © 2021 Stefan <stefan-guix@vodafonemail.de>
>  ;;; Copyright © 2022, 2023 Maxim Cournoyer <maxim.cournoyer@gmail.com>
>  ;;; Copyright © 2023 Herman Rimm <herman@rimm.ee>
> +;;; Copyright © 2024 Lilah Tascheter <lilah@lunabee.space>
>  ;;;
>  ;;; This file is part of GNU Guix.
>  ;;;
> @@ -46,11 +47,13 @@ (define-module (gnu packages bootloaders)
>    #:use-module (gnu packages compression)
>    #:use-module (gnu packages cross-base)
>    #:use-module (gnu packages disk)
> +  #:use-module (gnu packages efi)
>    #:use-module (gnu packages firmware)
>    #:use-module (gnu packages flex)
>    #:use-module (gnu packages fontutils)
>    #:use-module (gnu packages gcc)
>    #:use-module (gnu packages gettext)
> +  #:use-module (gnu packages gperf)
>    #:use-module (gnu packages linux)
>    #:use-module (gnu packages man)
>    #:use-module (gnu packages mtools)
> @@ -71,11 +74,13 @@ (define-module (gnu packages bootloaders)
>    #:use-module (gnu packages valgrind)
>    #:use-module (gnu packages virtualization)
>    #:use-module (gnu packages xorg)
> +  #:use-module (gnu packages python-crypto)
>    #:use-module (gnu packages python-web)
>    #:use-module (gnu packages python-xyz)
>    #:use-module (guix build-system gnu)
>    #:use-module (guix build-system meson)
>    #:use-module (guix build-system pyproject)
> +  #:use-module (guix build-system python)
>    #:use-module (guix build-system trivial)
>    #:use-module (guix download)
>    #:use-module (guix gexp)
> @@ -632,6 +637,96 @@ (define-public syslinux
>                       ;; Also contains:
>                       license:expat license:isc license:zlib)))))
>
> +(define systemd-version "255")
> +(define systemd-source
> +  (origin
> +    (method git-fetch)
> +    (uri (git-reference
> +           (url "https://github.com/systemd/systemd")
> +           (commit (string-append "v" systemd-version))))
> +    (file-name (git-file-name "systemd" systemd-version))
> +    (sha256
> +      (base32
> +        "1qdyw9g3jgvsbc1aryr11gpc3075w5pg00mqv4pyf3hwixxkwaq6"))))
> +
> +(define-public (systemd-stub-name)
> +  (let ((arch (cond ((target-x86-32?) "ia32")
> +                ((target-x86-64?) "x64")
> +                ((target-arm32?) "arm")
> +                ((target-aarch64?) "aa64")
> +                ((target-riscv64?) "riscv64"))))
> +    (string-append "linux" arch ".efi.stub")))

How about exporting this procedure in the module definition instead?

> +
> +(define-public systemd-stub
> +  (package
> +    (name "systemd-stub")
> +    (version systemd-version)
> +    (source systemd-source)
> +    (build-system meson-build-system)
> +    (arguments
> +      (list
> +        #:configure-flags
> +        `(list "-Defi=true" "-Dsbat-distro=guix"
> +               "-Dsbat-distro-generation=1" ; package revision!
> +               "-Dsbat-distro-summary=Guix System"
> +               "-Dsbat-distro-url=https://guix.gnu.org"
> +               ,(string-append "-Dsbat-distro-pkgname=" name)
> +               ,(string-append "-Dsbat-distro-version=" version))

Please use a G-expression for #:configure-flags, replace ‘name’ and ‘version’
to ‘#$(package-name this-package)’ and ‘#$(package-version this-package)’.

"-Dmode=release" can be added, too.

> +        #:phases
> +        #~(let ((stub #$(string-append "src/boot/efi/" (systemd-stub-name))))
> +            (modify-phases %standard-phases
> +              (replace 'build
> +                (lambda* (#:key parallel-build? #:allow-other-keys)
> +                  (invoke "ninja" stub
> +                    "-j" (if parallel-build?
> +                           (number->string (parallel-job-count)) "1"))))
> +              (replace 'install
> +                (lambda _
> +                  (install-file stub (string-append #$output "/libexec"))))
> +              (delete 'check)))))
> +    (inputs (list libcap python-pyelftools `(,util-linux "lib")))
> +    (native-inputs (list gperf pkg-config python-3 python-jinja2))
> +    (home-page "https://systemd.io")

I think its homepage has an ending slash, as in "https://systemd.io/".

> +    (synopsis "Unified kernel image UEFI stub")
> +    (description "Simple UEFi boot stub that loads a conjoined kernel image and
> +supporting data to their proper locations, before chainloading to the kernel.
> +Supports measured and/or verified boot environments.")
> +    (license license:lgpl2.1+)))
> +
> +(define-public ukify
> +  (package
> +    (name "ukify")
> +    (version systemd-version)
> +    (source systemd-source)
> +    (build-system python-build-system)
> +    (arguments
> +      (list #:phases
> +            #~(modify-phases %standard-phases
> +                (replace 'build
> +                  (lambda _
> +                    (substitute* "src/ukify/ukify.py" ; added in python 3.11
> +                      (("datetime\\.UTC") "datetime.timezone.utc"))))

It's likely that only ‘systemd-source’ will be touched in the future, so I'd
suggest moving this substitution into ‘systemd-source’ as a snippet.

> +                (delete 'check)
> +                (replace 'install
> +                  (lambda* (#:key inputs #:allow-other-keys)
> +                    (let* ((bin (string-append #$output "/bin"))
> +                           (file (string-append bin "/ukify"))
> +                           (binutils (assoc-ref inputs "binutils"))
> +                           (sbsign (assoc-ref inputs "sbsigntools")))

Getting inputs' path with ‘assoc-ref’ is not recommended.  ‘search-input-file’
or ‘this-package-input’ can be used instead.

> +                      (mkdir-p bin)
> +                      (copy-file "src/ukify/ukify.py" file)
> +                      (wrap-program file
> +                        `("PATH" ":" prefix
> +                          (,(string-append binutils "/bin")
> +                           ,(string-append sbsign "/bin"))))))))))

I'd suggest patching paths instead of wrapping programs when possible, for
example, I have made one when reviewing this patch:

--8<---------------cut here---------------start------------->8---
(replace 'install
  (lambda* (#:key inputs #:allow-other-keys)
    (let ((file (string-append #$output "/bin/ukify")))
      (mkdir-p (dirname file))
      (copy-file "src/ukify/ukify.py" file)
      (substitute* file
        (("(find_tool.'|'name': ')\\<(readelf|sbsign|sbverify)\\>"
          _ pre cmd)
         (string-append
          pre (search-input-file
               inputs (string-append "bin/" cmd))))))))
--8<---------------cut here---------------end--------------->8---

Note that one dependency, ‘pesign’, is currently missing from Guix, thus not
handled here.

I don't know if it has anything to do with our usage, but for the completeness
of the package, I think we can package this dependency, or adding a comment
around the ‘inputs’ field to indicate it's missing.

> +    (inputs (list binutils python-cryptography python-pefile sbsigntools))
> +    (home-page "https://systemd.io")

Same as the homepage mentioned above.

> +    (synopsis "Unified kernel image UEFI tool")
> +    (description "@command{ukify} joins together a UKI stub, linux kernel, initrd,
> +kernel arguments, and optional secure boot signatures into a single, UEFI-bootable
> +image.")
> +    (license license:lgpl2.1+)))
> +
>  (define-public dtc
>    (package
>      (name "dtc")
> --
> 2.41.0

Thanks

[bug#68524] [PATCH v2 2/2] gnu: bootloaders: Add uefi-uki-bootloader.

[Lilah Tascheter via Guix-patches]

* doc/guix.texi (Bootloader Configuration)[bootloader,targets]: Document
  uefi-uki-bootloader and uefi-uki-signed-bootloader.
  (Keyboard Layout, Networking, and Partitioning)[Disk Partitioning]:
  Note use of uefi-uki-bootloader and uefi-uki-signed-bootloader.
* gnu/bootloader/uki.scm: New file.
* gnu/local.mk (GNU_SYSTEM_MODULES): Add bootloader/uki.scm.

Change-Id: I2097da9f3dd35137b3419f6d0545de26d53cb6da
---
 doc/guix.texi          |  45 ++++++++++----
 gnu/bootloader/uki.scm | 129 +++++++++++++++++++++++++++++++++++++++++
 gnu/local.mk           |   1 +
 3 files changed, 163 insertions(+), 12 deletions(-)
 create mode 100644 gnu/bootloader/uki.scm

diff --git a/doc/guix.texi b/doc/guix.texi
index c458befb76..30fd5d022b 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -2723,12 +2723,13 @@ Keyboard Layout and Networking and Partitioning
 for @command{cryptsetup luksFormat}.  You can check which key derivation
 function is being used by a device by running @command{cryptsetup
 luksDump @var{device}}, and looking for the PBKDF field of your
-keyslots.
+keyslots.  UEFI stub bootloaders, such as @code{uefi-uki-bootloader}, can
+however use the default, more secure key derivation function.
 @end quotation
 
-Assuming you want to store the root partition on @file{/dev/sda2}, the
-command sequence to format it as a LUKS2 partition would be along these
-lines:
+Assuming you want to store the root partition on @file{/dev/sda2} and use GRUB
+as your bootloader, the command sequence to format it as a LUKS2 partition would
+be along these lines:
 
 @example
 cryptsetup luksFormat --type luks2 --pbkdf pbkdf2 /dev/sda2
@@ -41136,8 +41137,9 @@ Bootloader Configuration
 The bootloader to use, as a @code{bootloader} object.  For now
 @code{grub-bootloader}, @code{grub-efi-bootloader},
 @code{grub-efi-removable-bootloader}, @code{grub-efi-netboot-bootloader},
-@code{grub-efi-netboot-removable-bootloader}, @code{extlinux-bootloader}
-and @code{u-boot-bootloader} are supported.
+@code{grub-efi-netboot-removable-bootloader}, @code{extlinux-bootloader},
+@code{u-boot-bootloader}, @code{uefi-uki-bootloader}, and
+@code{uefi-uki-signed-bootloader} are supported.
 
 @cindex ARM, bootloaders
 @cindex AArch64, bootloaders
@@ -41244,6 +41246,25 @@ Bootloader Configuration
 unbootable.
 @end quotation
 
+@vindex uefi-uki-bootloader
+@code{uefi-uki-bootloader} boots a linux kernel directly through UEFI, without
+an intermediary like GRUB. The main practical advantage of this is allowing
+root/store encryption without an extra GRUB password entry and slow decryption
+step.
+
+@vindex uefi-uki-signed-bootloader
+@code{uefi-uki-signed-bootloader} is like @code{uefi-uki-bootloader}, except
+that it is a procedure that returns a bootloader compatible with UEFI secure
+boot. You must provide it with two paths: an out-of-store secure boot db
+certificate (in PEM format), and out-of-store db key, in that order.
+
+@quotation Warning
+When using @code{uefi-uki-bootloader} or @code{uefi-uki-signed-bootloader},
+@emph{do not} turn off your computer if a system reconfigure failed at
+installing the bootloader.  Until bootloader installation succeeds, your system
+is in an unbootable state.
+@end quotation
+
 @item @code{targets}
 This is a list of strings denoting the targets onto which to install the
 bootloader.
@@ -41252,12 +41273,12 @@ Bootloader Configuration
 For @code{grub-bootloader}, for example, they should be device names
 understood by the bootloader @command{installer} command, such as
 @code{/dev/sda} or @code{(hd0)} (@pxref{Invoking grub-install,,, grub,
-GNU GRUB Manual}).  For @code{grub-efi-bootloader} and
-@code{grub-efi-removable-bootloader} they should be mount
-points of the EFI file system, usually @file{/boot/efi}.  For
-@code{grub-efi-netboot-bootloader}, @code{targets} should be the mount
-points corresponding to TFTP root directories served by your TFTP
-server.
+GNU GRUB Manual}).  For @code{grub-efi-bootloader},
+@code{grub-efi-removable-bootloader}, @code{uefi-uki-bootloader}, and
+@code{uefi-uki-signed-bootloader}, they should be mount points of the EFI file
+system, usually @file{/boot/efi}.  For @code{grub-efi-netboot-bootloader},
+@code{targets} should be the mount points corresponding to TFTP root directories
+served by your TFTP server.
 
 @item @code{menu-entries} (default: @code{'()})
 A possibly empty list of @code{menu-entry} objects (see below), denoting
diff --git a/gnu/bootloader/uki.scm b/gnu/bootloader/uki.scm
new file mode 100644
index 0000000000..0ef62295d6
--- /dev/null
+++ b/gnu/bootloader/uki.scm
@@ -0,0 +1,129 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2024 Lilah Tascheter <lilah@lunabee.space>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu bootloader uki)
+  #:use-module (gnu bootloader)
+  #:use-module (gnu packages bootloaders)
+  #:use-module (gnu packages efi)
+  #:use-module (gnu packages linux)
+  #:use-module (guix gexp)
+  #:use-module (guix modules)
+  #:use-module (srfi srfi-1)
+  #:export (uefi-uki-bootloader uefi-uki-signed-bootloader))
+
+;; config generator makes script creating uki images
+;; install runs script
+;; install device is path to uefi dir
+(define vendor "Guix")
+(define script-loc "/boot/install-uki.scm")
+
+(define* (uefi-uki-configuration-file #:optional cert privkey)
+  (lambda* (config entries #:key (old-entries '()) #:allow-other-keys)
+
+    (define (menu-entry->args e)
+      (let* ((boot (bootloader-configuration-bootloader config))
+             (stub (bootloader-package boot)))
+        #~(list "--os-release" #$(menu-entry-label e)
+            "--linux" #$(menu-entry-linux e) "--initrd" #$(menu-entry-initrd e)
+            "--cmdline" (string-join (list #$@(menu-entry-linux-arguments e)))
+            "--stub" #$(file-append stub "/libexec/" (systemd-stub-name))
+            #$@(if cert #~("--secureboot-certificate" #$cert) #~())
+            #$@(if privkey #~("--secureboot-private-key" #$privkey) #~()))))
+
+    (define (enum-filenames . args) ; same args as iota
+      (map (lambda (n) (string-append (number->string n) ".efi"))
+        (apply iota (map length args))))
+
+    (program-file "install-uki"
+      (with-imported-modules (source-module-closure '((guix build syscalls)
+                                                      (guix build utils)))
+        #~(let* ((target (cadr (command-line)))
+                 (vendir (string-append target "/EFI/" #$vendor))
+                 (schema (string-append vendir "/boot.mgr"))
+                 (findmnt #$(file-append util-linux "/bin/findmnt"))
+                 (efibootmgr #$(file-append efibootmgr "/sbin/efibootmgr")))
+            (use-modules (guix build syscalls) (guix build utils)
+                         (ice-9 popen) (ice-9 textual-ports))
+
+            (define (out name) (string-append vendir "/" name))
+            (define disk
+              (call-with-port
+                (open-pipe* OPEN_READ findmnt "-fnro" "SOURCE" "-T" target)
+                (lambda (port) (get-line port)))) ; only 1 line: the device
+
+            ;; delete all boot entries and files we control
+            (when (file-exists? schema)
+              (call-with-input-file schema
+                (lambda (port)
+                  (for-each (lambda (l)
+                              (unless (string-null? l)
+                                (system* efibootmgr "-B" "-L" l "-q")))
+                    (string-split (get-string-all port) #\lf)))))
+            (when (directory-exists? vendir) (delete-file-recursively vendir))
+            (mkdir-p vendir)
+
+            (define (install port boot? oos)
+              (lambda (args label name)
+                (let ((minbytes (* 2 (stat:size (stat #$script-loc)))))
+                  (put-string port label)
+                  (put-char port #\lf)
+                  (force-output port) ; make sure space is alloc'd
+                  (apply invoke #$(file-append ukify "/bin/ukify")
+                    "build" "-o" (out name) args)
+                  ;; make sure we have enough space for next install-uki.scm
+                  (when (and oos (< (free-disk-space vendir) minbytes)) (oos))
+                  (invoke efibootmgr (if boot? "-c" "-C") "-L" label "-d" disk
+                    "-l" (string-append "\\EFI\\" #$vendor "\\" name) "-q"))))
+
+            (call-with-output-file schema
+              (lambda (port) ; prioritize latest UKIs in limited ESP space
+                (for-each (install port #t #f)
+                  (list #$@(map-in-order menu-entry->args entries))
+                  (list #$@(map-in-order menu-entry-label entries))
+                  (list #$@(enum-filenames entries)))
+                (for-each ; old-entries can fail (out of space) we don't care
+                  (lambda (args label name)
+                    (define (cleanup . _) ; do exit early if out of space tho
+                      (when (file-exists? (out name)) (delete-file (out name)))
+                      (exit))
+                    (with-exception-handler cleanup
+                      (lambda _ ((install port #f cleanup) args label name))))
+                  (list #$@(map-in-order menu-entry->args old-entries))
+                  (list #$@(map-in-order menu-entry-label old-entries))
+                  (list #$@(enum-filenames old-entries entries))))))))))
+
+(define install-uefi-uki
+  #~(lambda (bootloader target mount-point)
+      (invoke (string-append mount-point #$script-loc)
+              (string-append mount-point target))))
+
+(define* (make-uefi-uki-bootloader #:optional cert privkey)
+  (bootloader
+    (name 'uefi-uki)
+    (package systemd-stub)
+    (installer install-uefi-uki)
+    (disk-image-installer #f)
+    (configuration-file script-loc)
+    (configuration-file-generator (uefi-uki-configuration-file cert privkey))))
+
+;; IMPORTANT NOTE: if bootloader install fails, do not turn off your computer! until
+;; install succeeds, your system is unbootable.
+(define uefi-uki-bootloader (make-uefi-uki-bootloader))
+;; use ukify genkey to generate cert and privkey. DO NOT include in store.
+(define (uefi-uki-signed-bootloader cert privkey)
+  (make-uefi-uki-bootloader cert privkey))
diff --git a/gnu/local.mk b/gnu/local.mk
index ab63bd5881..0a15251ddf 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -90,6 +90,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/bootloader/extlinux.scm                   \
   %D%/bootloader/u-boot.scm                     \
   %D%/bootloader/depthcharge.scm                \
+  %D%/bootloader/uki.scm                        \
   %D%/ci.scm					\
   %D%/compression.scm				\
   %D%/home.scm					\
-- 
2.41.0

[bug#68524] [PATCH v2 2/2] gnu: bootloaders: Add uefi-uki-bootloader.

[Hilton Chain via Guix-patches via]

Hi Lilah,

On Sun, 28 Jan 2024 17:51:41 +0800,
Lilah Tascheter via Guix-patches wrote:
>
> * doc/guix.texi (Bootloader Configuration)[bootloader,targets]: Document
>   uefi-uki-bootloader and uefi-uki-signed-bootloader.
>   (Keyboard Layout, Networking, and Partitioning)[Disk Partitioning]:
>   Note use of uefi-uki-bootloader and uefi-uki-signed-bootloader.
> * gnu/bootloader/uki.scm: New file.
> * gnu/local.mk (GNU_SYSTEM_MODULES): Add bootloader/uki.scm.
>
> Change-Id: I2097da9f3dd35137b3419f6d0545de26d53cb6da
> ---
>  doc/guix.texi          |  45 ++++++++++----
>  gnu/bootloader/uki.scm | 129 +++++++++++++++++++++++++++++++++++++++++
>  gnu/local.mk           |   1 +
>  3 files changed, 163 insertions(+), 12 deletions(-)
>  create mode 100644 gnu/bootloader/uki.scm
>
> diff --git a/doc/guix.texi b/doc/guix.texi
> index c458befb76..30fd5d022b 100644
> --- a/doc/guix.texi
> +++ b/doc/guix.texi
> @@ -2723,12 +2723,13 @@ Keyboard Layout and Networking and Partitioning
>  for @command{cryptsetup luksFormat}.  You can check which key derivation
>  function is being used by a device by running @command{cryptsetup
>  luksDump @var{device}}, and looking for the PBKDF field of your
> -keyslots.
> +keyslots.  UEFI stub bootloaders, such as @code{uefi-uki-bootloader}, can
> +however use the default, more secure key derivation function.
>  @end quotation
>
> -Assuming you want to store the root partition on @file{/dev/sda2}, the
> -command sequence to format it as a LUKS2 partition would be along these
> -lines:
> +Assuming you want to store the root partition on @file{/dev/sda2} and use GRUB
> +as your bootloader, the command sequence to format it as a LUKS2 partition would
> +be along these lines:
>
>  @example
>  cryptsetup luksFormat --type luks2 --pbkdf pbkdf2 /dev/sda2
> @@ -41136,8 +41137,9 @@ Bootloader Configuration
>  The bootloader to use, as a @code{bootloader} object.  For now
>  @code{grub-bootloader}, @code{grub-efi-bootloader},
>  @code{grub-efi-removable-bootloader}, @code{grub-efi-netboot-bootloader},
> -@code{grub-efi-netboot-removable-bootloader}, @code{extlinux-bootloader}
> -and @code{u-boot-bootloader} are supported.
> +@code{grub-efi-netboot-removable-bootloader}, @code{extlinux-bootloader},
> +@code{u-boot-bootloader}, @code{uefi-uki-bootloader}, and
> +@code{uefi-uki-signed-bootloader} are supported.
>
>  @cindex ARM, bootloaders
>  @cindex AArch64, bootloaders
> @@ -41244,6 +41246,25 @@ Bootloader Configuration
>  unbootable.
>  @end quotation
>
> +@vindex uefi-uki-bootloader
> +@code{uefi-uki-bootloader} boots a linux kernel directly through UEFI, without
> +an intermediary like GRUB. The main practical advantage of this is allowing
> +root/store encryption without an extra GRUB password entry and slow decryption
> +step.
> +
> +@vindex uefi-uki-signed-bootloader
> +@code{uefi-uki-signed-bootloader} is like @code{uefi-uki-bootloader}, except
> +that it is a procedure that returns a bootloader compatible with UEFI secure
> +boot. You must provide it with two paths: an out-of-store secure boot db
> +certificate (in PEM format), and out-of-store db key, in that order.

Please add two spaces between sentences, e.g. "Sentence 1.  Sentence 2".

I think "out-of-store" is not necessary here. :)

> +
> +@quotation Warning
> +When using @code{uefi-uki-bootloader} or @code{uefi-uki-signed-bootloader},
> +@emph{do not} turn off your computer if a system reconfigure failed at
> +installing the bootloader.  Until bootloader installation succeeds, your system
> +is in an unbootable state.
> +@end quotation
> +
>  @item @code{targets}
>  This is a list of strings denoting the targets onto which to install the
>  bootloader.
> @@ -41252,12 +41273,12 @@ Bootloader Configuration
>  For @code{grub-bootloader}, for example, they should be device names
>  understood by the bootloader @command{installer} command, such as
>  @code{/dev/sda} or @code{(hd0)} (@pxref{Invoking grub-install,,, grub,
> -GNU GRUB Manual}).  For @code{grub-efi-bootloader} and
> -@code{grub-efi-removable-bootloader} they should be mount
> -points of the EFI file system, usually @file{/boot/efi}.  For
> -@code{grub-efi-netboot-bootloader}, @code{targets} should be the mount
> -points corresponding to TFTP root directories served by your TFTP
> -server.
> +GNU GRUB Manual}).  For @code{grub-efi-bootloader},
> +@code{grub-efi-removable-bootloader}, @code{uefi-uki-bootloader}, and
> +@code{uefi-uki-signed-bootloader}, they should be mount points of the EFI file
> +system, usually @file{/boot/efi}.  For @code{grub-efi-netboot-bootloader},
> +@code{targets} should be the mount points corresponding to TFTP root directories
> +served by your TFTP server.
>
>  @item @code{menu-entries} (default: @code{'()})
>  A possibly empty list of @code{menu-entry} objects (see below), denoting
> diff --git a/gnu/bootloader/uki.scm b/gnu/bootloader/uki.scm
> new file mode 100644
> index 0000000000..0ef62295d6
> --- /dev/null
> +++ b/gnu/bootloader/uki.scm
> @@ -0,0 +1,129 @@
> +;;; GNU Guix --- Functional package management for GNU
> +;;; Copyright © 2024 Lilah Tascheter <lilah@lunabee.space>
> +;;;
> +;;; This file is part of GNU Guix.
> +;;;
> +;;; GNU Guix is free software; you can redistribute it and/or modify it
> +;;; under the terms of the GNU General Public License as published by
> +;;; the Free Software Foundation; either version 3 of the License, or (at
> +;;; your option) any later version.
> +;;;
> +;;; GNU Guix is distributed in the hope that it will be useful, but
> +;;; WITHOUT ANY WARRANTY; without even the implied warranty of
> +;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> +;;; GNU General Public License for more details.
> +;;;
> +;;; You should have received a copy of the GNU General Public License
> +;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
> +
> +(define-module (gnu bootloader uki)
> +  #:use-module (gnu bootloader)
> +  #:use-module (gnu packages bootloaders)
> +  #:use-module (gnu packages efi)
> +  #:use-module (gnu packages linux)
> +  #:use-module (guix gexp)
> +  #:use-module (guix modules)
> +  #:use-module (srfi srfi-1)
> +  #:export (uefi-uki-bootloader uefi-uki-signed-bootloader))
> +
> +;; config generator makes script creating uki images
> +;; install runs script
> +;; install device is path to uefi dir
> +(define vendor "Guix")
> +(define script-loc "/boot/install-uki.scm")
> +
> +(define* (uefi-uki-configuration-file #:optional cert privkey)
> +  (lambda* (config entries #:key (old-entries '()) #:allow-other-keys)
> +
> +    (define (menu-entry->args e)

I'd prefer using ‘entry’ instead of ‘e’, same for some other nonobvious
abbreviations.

> +      (let* ((boot (bootloader-configuration-bootloader config))
> +             (stub (bootloader-package boot)))
> +        #~(list "--os-release" #$(menu-entry-label e)
> +            "--linux" #$(menu-entry-linux e) "--initrd" #$(menu-entry-initrd e)
> +            "--cmdline" (string-join (list #$@(menu-entry-linux-arguments e)))
> +            "--stub" #$(file-append stub "/libexec/" (systemd-stub-name))
> +            #$@(if cert #~("--secureboot-certificate" #$cert) #~())
> +            #$@(if privkey #~("--secureboot-private-key" #$privkey) #~()))))
> +
> +    (define (enum-filenames . args) ; same args as iota
> +      (map (lambda (n) (string-append (number->string n) ".efi"))
> +        (apply iota (map length args))))

"Same args as iota" doesn't explain the procudre, it actually accepts lists
instead of numbers, and only the first two lists are intended to be used, right?

I'd suggest just having two arguments with more descriptive names.

> +
> +    (program-file "install-uki"
> +      (with-imported-modules (source-module-closure '((guix build syscalls)
> +                                                      (guix build utils)))
> +        #~(let* ((target (cadr (command-line)))
> +                 (vendir (string-append target "/EFI/" #$vendor))
> +                 (schema (string-append vendir "/boot.mgr"))
> +                 (findmnt #$(file-append util-linux "/bin/findmnt"))
> +                 (efibootmgr #$(file-append efibootmgr "/sbin/efibootmgr")))
> +            (use-modules (guix build syscalls) (guix build utils)
> +                         (ice-9 popen) (ice-9 textual-ports))
> +
> +            (define (out name) (string-append vendir "/" name))
> +            (define disk
> +              (call-with-port
> +                (open-pipe* OPEN_READ findmnt "-fnro" "SOURCE" "-T" target)
> +                (lambda (port) (get-line port)))) ; only 1 line: the device

(guix build syscalls) has procedures can be utilized for this, no need to invoke
findmnt.

> +
> +            ;; delete all boot entries and files we control
> +            (when (file-exists? schema)
> +              (call-with-input-file schema
> +                (lambda (port)
> +                  (for-each (lambda (l)
> +                              (unless (string-null? l)
> +                                (system* efibootmgr "-B" "-L" l "-q")))

Dispite the "-q" option, error messages will still be visible to user, please
use ‘invoke/quiet’ + error handling instead.

And I'd prefer long options.

> +                    (string-split (get-string-all port) #\lf)))))

‘#\newline’ is preferred over ‘#\lf’ in Guix source.

> +            (when (directory-exists? vendir) (delete-file-recursively vendir))
> +            (mkdir-p vendir)
> +
> +            (define (install port boot? oos)
> +              (lambda (args label name)
> +                (let ((minbytes (* 2 (stat:size (stat #$script-loc)))))
> +                  (put-string port label)
> +                  (put-char port #\lf)
> +                  (force-output port) ; make sure space is alloc'd
> +                  (apply invoke #$(file-append ukify "/bin/ukify")

‘invoke/quiet’ can be used.

> +                    "build" "-o" (out name) args)
> +                  ;; make sure we have enough space for next install-uki.scm
> +                  (when (and oos (< (free-disk-space vendir) minbytes)) (oos))
> +                  (invoke efibootmgr (if boot? "-c" "-C") "-L" label "-d" disk
> +                    "-l" (string-append "\\EFI\\" #$vendor "\\" name) "-q"))))

You're calling the exception handler directly here, it might be better to move
the exception handling part into the procedure to avoid this.

> +
> +            (call-with-output-file schema
> +              (lambda (port) ; prioritize latest UKIs in limited ESP space
> +                (for-each (install port #t #f)
> +                  (list #$@(map-in-order menu-entry->args entries))
> +                  (list #$@(map-in-order menu-entry-label entries))
> +                  (list #$@(enum-filenames entries)))
> +                (for-each ; old-entries can fail (out of space) we don't care
> +                  (lambda (args label name)
> +                    (define (cleanup . _) ; do exit early if out of space tho
> +                      (when (file-exists? (out name)) (delete-file (out name)))
> +                      (exit))
> +                    (with-exception-handler cleanup
> +                      (lambda _ ((install port #f cleanup) args label name))))
> +                  (list #$@(map-in-order menu-entry->args old-entries))
> +                  (list #$@(map-in-order menu-entry-label old-entries))
> +                  (list #$@(enum-filenames old-entries entries))))))))))

These two ‘for-each’ can be merged into one.

> +
> +(define install-uefi-uki
> +  #~(lambda (bootloader target mount-point)
> +      (invoke (string-append mount-point #$script-loc)
> +              (string-append mount-point target))))
> +
> +(define* (make-uefi-uki-bootloader #:optional cert privkey)
> +  (bootloader
> +    (name 'uefi-uki)
> +    (package systemd-stub)
> +    (installer install-uefi-uki)
> +    (disk-image-installer #f)
> +    (configuration-file script-loc)
> +    (configuration-file-generator (uefi-uki-configuration-file cert privkey))))
> +
> +;; IMPORTANT NOTE: if bootloader install fails, do not turn off your computer! until
> +;; install succeeds, your system is unbootable.
> +(define uefi-uki-bootloader (make-uefi-uki-bootloader))
> +;; use ukify genkey to generate cert and privkey. DO NOT include in store.
> +(define (uefi-uki-signed-bootloader cert privkey)
> +  (make-uefi-uki-bootloader cert privkey))

They'll have the same bootloader name, making these two bootloaders
indistinguishable from boot-parameters.

> diff --git a/gnu/local.mk b/gnu/local.mk
> index ab63bd5881..0a15251ddf 100644
> --- a/gnu/local.mk
> +++ b/gnu/local.mk
> @@ -90,6 +90,7 @@ GNU_SYSTEM_MODULES =				\
>    %D%/bootloader/extlinux.scm                   \
>    %D%/bootloader/u-boot.scm                     \
>    %D%/bootloader/depthcharge.scm                \
> +  %D%/bootloader/uki.scm                        \
>    %D%/ci.scm					\
>    %D%/compression.scm				\
>    %D%/home.scm					\
> --
> 2.41.0

I tried to adjust uki.scm before commenting, so here's a paste of my adjusted
version, in case some of my comments are not expressed clearly:
https://paste.sr.ht/~hako/62bb15503290273e869520e12466718ebb82e000

Thanks

[bug#68524] [PATCH v2 2/2] gnu: bootloaders: Add uefi-uki-bootloader.

[Lilah Tascheter via Guix-patches]

heyo!

thanks for the review :) I'll submit a revised patch, but had a question before
I get to work on it.

> I tried to adjust uki.scm before commenting, so here's a paste of my
> adjusted version, in case some of my comments are not expressed clearly:
> https://paste.sr.ht/~hako/62bb15503290273e869520e12466718ebb82e000

nighttime sky I didn't realize reinstall-bootloader existed. shit.

at this point, I don't think the install-uki.scm hack is a good idea. to get
this fully functioning, will probably have to do some more invasive edits to the
bootloader system, since the current one pretty much assumes an
extlinux/grubalike (which is what necessitated install-uki in the first place).
RFC on the following plan:

* add secure-boot-cert and secure-boot-key fields to bootloader-configuration.

* deprecate configuration-file and configuration-file-generator in the
  bootloader struct, and instead create an install-configuration-file field,
  similar to install-bootloader. default procedure will be to do the current
  install-boot-cfg (gnu build install) using the deprecated fields.

* rework uki.scm to, instead, run efibootmgr in install-configuration-file and
  install the uki.efi files in install-bootloader. remove the separation between
  uefi-uki-signed-bootloader and uefi-uki-bootloader, instead working off the
  new bootloader-configuration fields.

this plan should work with reinstall-bootloader, even though it uses the default
bootloader-configuration, since files are only signed during installation
proper.

opinions?

thanks,
lilah

[bug#68524] [PATCH v2 2/2] gnu: bootloaders: Add uefi-uki-bootloader.

[Lilah Tascheter via Guix-patches]

> * add secure-boot-cert and secure-boot-key fields to bootloader-
> configuration.
>
> * deprecate configuration-file and configuration-file-generator in
>   the bootloader struct, and instead create an install-configuration-file
>   field, similar to install-bootloader. default procedure will be to do the
>   current install-boot-cfg (gnu build install) using the deprecated fields.
>
> * rework uki.scm to, instead, run efibootmgr in install-
>   configuration-file and install the uki.efi files in install-bootloader.
>   remove the separation between uefi-uki-signed-bootloader and
>   uefi-uki-bootloader, instead working off the new bootloader-configuration
>   fields.

amending: also edit the bootloader-installer and bootloader-disk-image-installer
procedures to provide the bootloader-configuration in some manner.

lilah

[bug#68524] [PATCH v2 2/2] gnu: bootloaders: Add uefi-uki-bootloader.

[Hilton Chain via Guix-patches via]

Hi Lilah,

On Tue, 13 Feb 2024 15:34:55 +0800,
Lilah Tascheter wrote:
>
> > * add secure-boot-cert and secure-boot-key fields to bootloader-
> > configuration.

How about using a pair instead of two fields?  And because the usage depends on
the bootlodaer, I'd like to use a generic name.

e.g. signing-keypair
 => '("/path/to/certificate" . "/path/to/private.key")

> > * deprecate configuration-file and configuration-file-generator in
> >   the bootloader struct, and instead create an install-configuration-file
> >   field, similar to install-bootloader. default procedure will be to do the
> >   current install-boot-cfg (gnu build install) using the deprecated fields.

I'd prefer ‘configuration-installer’, since the installation target may not be a
file. :)

I don't think the deprecation is necessary though, other bootloaders don't have
to duplicate this part of code, and in my opinion the following definition does
make sense.

--8<---------------cut here---------------start------------->8---
(define uefi-uki-bootloader
  (bootloader
   (name 'uefi-uki)
   (package systemd-stub)
   (installer install-uefi-uki)
   (configuration-installer install-uefi-uki-configuration)
   (configuration-file #f)
   (configuration-file-generator #f)))
--8<---------------cut here---------------end--------------->8---

> > * rework uki.scm to, instead, run efibootmgr in install-
> >   configuration-file and install the uki.efi files in install-bootloader.
> >   remove the separation between uefi-uki-signed-bootloader and
> >   uefi-uki-bootloader, instead working off the new bootloader-configuration
> >   fields.
>
> amending: also edit the bootloader-installer and bootloader-disk-image-installer
> procedures to provide the bootloader-configuration in some manner.

I agree that <bootloader> needs modifying, since unified kernel images currently
cannot be well described.  And to support proper generation switching, some
fields of <bootloader-configuration> need exposing.

As this now involves deeper change, I think it's better to post the plan on
guix-devel@gnu.org for wider visibility and potential discussions.

Thanks

[bug#68524] [PATCH v2 0/2] Support root encryption and secure boot.

[Hilton Chain via Guix-patches via]

Hi Lilah,

On Sun, 28 Jan 2024 17:51:38 +0800,
Lilah Tascheter via Guix-patches wrote:
>
> Thank you so much Herman, that motherfucking typo was what made my old-entries
> testing not work. I reworked the majority of the install-uki.scm code, and now
> uefi-uki-bootloader and uefi-uki-signed-bootloader support generation rollback!
> Slightly jank, but it works. On install, we pretty much just cram as many
> generations into the ESP as possible. ESPs are typically small, so we can't
> assume that we can fit more than one UKI, so if we can't fit every extent
> generation we just exit early.
>
> We also don't waste space on root by adding each UKI to the store anymore.
> They're all generated at install time. Added slightly more documentation too.
>
> Otherwise, fixed everything Herman pointed out!
>
> Decided not to add a manual section on manually running /boot/install-uki.scm
> though. It's more of a quirk of getting around guix's bootloader assumptions
> than meant to be run that way; I don't know if it's a good idea to direct
> attention to it. I mean it Works, but it's more of a quick hack.
>
> Lilah Tascheter (2):
>   gnu: bootloaders: Add uki packages.
>   gnu: bootloaders: Add uefi-uki-bootloader.
>
>  doc/guix.texi                |  45 ++++++++----
>  gnu/bootloader/uki.scm       | 129 +++++++++++++++++++++++++++++++++++
>  gnu/local.mk                 |   1 +
>  gnu/packages/bootloaders.scm |  95 ++++++++++++++++++++++++++
>  4 files changed, 258 insertions(+), 12 deletions(-)
>  create mode 100644 gnu/bootloader/uki.scm
>
>
> base-commit: 2823253484e49391c6ba3c653a2f9e9f5e5f38ae
> --
> 2.41.0

Nicely done!  I have tested ‘uefi-uki-bootloader’, and it works!

But currently ‘uefi-uki-bootloader’ doesn't match generation switching well, and
‘uefi-uki-signed-bootloader’ as a procedure further breaks that, right?

I think these issues have to be addressed to get the series merged.

Reviews are coming later.

Thanks

[bug#68524] [PATCH 0/2] Support root encryption and secure boot

[Nikolaos Chatzikonstantinou]

What does it mean that "LUKS password entry is in the initrd"? Is the
password in plain sight?

Regards,
Nikolaos Chatzikonstantinou

[bug#68524] [PATCH 0/2] Support root encryption and secure boot

[Lilah Tascheter via Guix-patches]

nah, what I meant by that is instead of entering your password while
you're booted into grub, you enter it while booted into your initrd.
either way nothing touches the disk.

[bug#68524]

[Nikolaos Chatzikonstantinou]

Great, thank you for clarifying. This is awesome work. Does it mean
however that Guix becomes tied to systemd in some way when this
feature is used? Or is the feature sufficiently isolated that no
systemd process takes place?

I've also looked briefly into this from another angle, trying to
either patch GRUB or to use kexec and boot from a USB. I'm glad that
you were able to do this, thanks a lot!

Regards,
Nikolaos Chatzikonstantinou

[bug#68524] [PATCH 0/2] Support root encryption and secure boot

[Lilah Tascheter via Guix-patches]

sorry for the late responses; I don't actually get sent your replies
unless you cc me.

and yeah don't worry it's isolated. there's only two bits of systemd
used, systemd-boot-stub and ukify. ukify is pretty much just a single
python script, and systemd-boot-stub is just a bit of code tacked on to
the boot process to handle combining the kernel, args, and initrd
together. no daemons or code past the bootloader at all!

of note I'm currently in the process of rewriting the entire guix
bootloader stack to make this work a Lot nicer. sooo hopefully that
gets finished soon.

[bug#68524] [PATCH 0/2] Support root encryption and secure boot

[Nikolaos Chatzikonstantinou]

On Sat, Mar 23, 2024 at 3:40 PM Lilah Tascheter <lilah@lunabee.space> wrote:
> and yeah don't worry it's isolated. there's only two bits of systemd
> used, systemd-boot-stub and ukify. ukify is pretty much just a single
> python script, and systemd-boot-stub is just a bit of code tacked on to
> the boot process to handle combining the kernel, args, and initrd
> together. no daemons or code past the bootloader at all!
>
> of note I'm currently in the process of rewriting the entire guix
> bootloader stack to make this work a Lot nicer. sooo hopefully that
> gets finished soon.

Very exciting! I am looking forward to looking at the code.

Regards,
Nikolaos Chatzikonstantinou

[bug#68524] Fwd: [PATCH 0/2] Support root encryption and secure boot.

[Ryan S via Guix-patches via]

Hi all!

No clue if this patch series is still being worked on, however I have been keeping an eye on this (want to migrate away from GRUB because of decryption speed and integrity reasons). Good news, I've successfully added these patches on a local channel I have and everything still works, with little modifications (this has been an on and off process over the past month or so because I've been busy, so my memory of changes made may be fuzzy). However, I did notice a bug. When performing a fresh installation, the bootloader install will always fail since it assumes "/boot/efi" as the base "script-path". This assumption is false due to the installer placing the system being installed at "/mnt/boot/efi".

Outside of that, is a new rewrite of the boot system still being worked on? What kinds of things are we looking for to get UKIs merged? Should I start/continue a thread on guix-devel? I'd like to help where I can.

-- 
Best,
Ryan

[bug#68524] Rewrite Posted

[Lilah Tascheter via Guix-patches]

Hey!

> When performing a fresh installation, the bootloader install will >
always fail since it assumes "/boot/efi" as the base "script-path".
Yeah, sorry, limitation of the current system. Speaking of, though...

The rewrite has been posted! The new patch series is at
https://issues.guix.gnu.org/72457 which also subsumes this series, so
I'll close this one in favor of it.

Thanks y'all!

[bug#68524] Rewrite Posted

[Nikolaos Chatzikonstantinou]

On Thu, Aug 15, 2024 at 9:15 AM Lilah Tascheter <lilah@lunabee.space> wrote:
>
> Hey!
>
> > When performing a fresh installation, the bootloader install will >
> always fail since it assumes "/boot/efi" as the base "script-path".
> Yeah, sorry, limitation of the current system. Speaking of, though...
>
> The rewrite has been posted! The new patch series is at
> https://issues.guix.gnu.org/72457 which also subsumes this series, so
> I'll close this one in favor of it.

Congratulations. This is great!

Regards,
Nikolaos Chatzikonstantinou

[bug#68524] [PATCH v3 0/5] Support root encryption and secure boot.

[Herman Rimm via Guix-patches via]

Hi Lilah,

Recently Zheng Junjie <873216071@qq.com> told me git-fetch is better, so
I changed pesign to it.  I added libxcrypt to systemd-stub native-inputs
and did some formatting.  Please fill out [THE CONFIGURATION BELOW] in
doc/guix.texi for the next revision.  If you would like to create an
installation test for the UKI bootloader, please do so as well.

Having a UEFI boot entry per generation is pretty much perfect for me.

Thanks again,
Herman

Lilah Tascheter (5):
  gnu: packages: Add pesign.
  gnu: packages: Add ukify.
  gnu: packages: Add systemd-stub.
  gnu: system: Fix bootloader crypto device recognition.
  gnu: bootloaders: Add uki-efi-bootloader.

 doc/guix.texi                |  25 ++++++++-
 gnu/bootloader.scm           |   3 +
 gnu/bootloader/uki.scm       | 106 +++++++++++++++++++++++++++++++++++
 gnu/local.mk                 |   1 +
 gnu/packages/bootloaders.scm | 104 ++++++++++++++++++++++++++++++++++
 gnu/packages/efi.scm         |  52 +++++++++++++++++
 gnu/system.scm               |  17 +++---
 7 files changed, 299 insertions(+), 9 deletions(-)
 create mode 100644 gnu/bootloader/uki.scm


base-commit: e00ab0921afbfd4e8ee96c0c1dec77e1c5dd85b9
-- 
2.45.2

[bug#68524] [PATCH v3 1/5] gnu: packages: Add pesign.

[Herman Rimm via Guix-patches via]

From: Lilah Tascheter <lilah@lunabee.space>

* gnu/packages/efi.scm (pesign): New variable.

Change-Id: I00fcc679d9514c85d508183b9ec7e121e0a814db
---
 gnu/packages/efi.scm | 52 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)

diff --git a/gnu/packages/efi.scm b/gnu/packages/efi.scm
index 499745eba1..e5f9d2d6a3 100644
--- a/gnu/packages/efi.scm
+++ b/gnu/packages/efi.scm
@@ -24,8 +24,10 @@ (define-module (gnu packages efi)
   #:use-module (gnu packages bash)
   #:use-module (gnu packages linux)
   #:use-module (gnu packages man)
+  #:use-module (gnu packages nss)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pkg-config)
+  #:use-module (gnu packages popt)
   #:use-module (gnu packages tls)
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix build-system gnu)
@@ -153,6 +155,56 @@ (define-public sbsigntools
     (home-page "https://git.kernel.org/pub/scm/linux/kernel/git/jejb/sbsigntools.git/")
     (license license:gpl3+)))
 
+(define-public pesign
+  (package
+    (name "pesign")
+    (version "116")
+    (source
+      (origin
+        (method git-fetch)
+        (uri (git-reference
+               (url (string-append "https://github.com/rhboot/" name))
+               (commit version)))
+        (modules '((guix build utils)))
+        (snippet
+          #~(substitute* "Make.defaults"
+              (("RANLIB\t\\?= \\$\\(CROSS_COMPILE\\)") "RANLIB\t?=")
+              (("pkg-config-ccldflags") "pkg-config-ldflags")))
+        (sha256
+          (base32
+            "0fnqfiivj46bha4hsnwiqy8vq8b4i3w2dig0h9h2k4j7yq7r5qvj"))))
+    (build-system gnu-build-system)
+    (arguments
+      (list #:tests? #f ; The Makefile has no check target.
+            #:modules '((guix build gnu-build-system)
+                        (guix build utils)
+                        (ice-9 match))
+            #:phases #~(modify-phases %standard-phases (delete 'configure))
+            #:make-flags
+            (let ((system (%current-system))
+                  (target (%current-target-system)))
+              (define (arch s)
+                (if (target-x86-32? s)
+                    "ia32"
+                    (match (string-split s #\-)
+                      ((x _ ...) x))))
+              #~(list "prefix=/" "libdir=/lib/"
+                      (string-append "DESTDIR=" #$output)
+                      (string-append "HOSTARCH=" #$(arch system))
+                      (string-append "ARCH=" #$(arch (or target system)))
+                      (if #$target
+                          (string-append "CROSS_COMPILE=" #$target "-")
+                          "")))))
+    (inputs (list efivar nspr nss popt `(,util-linux "lib")))
+    (native-inputs (list mandoc pkg-config))
+    (synopsis "PE-COFF binary signing tools")
+    (description
+      "This package supports EFI keygen and subsequent signing of
+PE-COFF binaries. It contains the tools authvar, efikeygen, pesigcheck,
+pesign, pesign-client, and pesum.")
+    (home-page "https://github.com/rhboot/pesign")
+    (license license:gpl2+)))
+
 (define-public efitools
   (package
     (name "efitools")
-- 
2.45.2

[bug#68524] [PATCH v3 2/5] gnu: packages: Add ukify.

[Herman Rimm via Guix-patches via]

From: Lilah Tascheter <lilah@lunabee.space>

* gnu/packages/bootloaders.scm (%systemd-version, systemd-source,
ukify): New variables.

Change-Id: Icde59b7266529c8002331ff0375e0a35af3a2add
---
 gnu/packages/bootloaders.scm | 57 ++++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/gnu/packages/bootloaders.scm b/gnu/packages/bootloaders.scm
index 2f115f6bb3..52d92ba03a 100644
--- a/gnu/packages/bootloaders.scm
+++ b/gnu/packages/bootloaders.scm
@@ -21,6 +21,7 @@
 ;;; Copyright © 2023-2024 Herman Rimm <herman@rimm.ee>
 ;;; Copyright © 2023 Simon Tournier <zimon.toutoune@gmail.com>
 ;;; Copyright © 2024 Zheng Junjie <873216071@qq.com>
+;;; Copyright © 2024 Lilah Tascheter <lilah@lunabee.space>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -48,6 +49,7 @@ (define-module (gnu packages bootloaders)
   #:use-module (gnu packages compression)
   #:use-module (gnu packages cross-base)
   #:use-module (gnu packages disk)
+  #:use-module (gnu packages efi)
   #:use-module (gnu packages firmware)
   #:use-module (gnu packages flex)
   #:use-module (gnu packages fontutils)
@@ -76,11 +78,13 @@ (define-module (gnu packages bootloaders)
   #:use-module (gnu packages version-control)
   #:use-module (gnu packages virtualization)
   #:use-module (gnu packages xorg)
+  #:use-module (gnu packages python-crypto)
   #:use-module (gnu packages python-web)
   #:use-module (gnu packages python-xyz)
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system meson)
   #:use-module (guix build-system pyproject)
+  #:use-module (guix build-system python)
   #:use-module (guix build-system trivial)
   #:use-module (guix download)
   #:use-module (guix gexp)
@@ -576,6 +580,59 @@ (define-public syslinux
                      ;; Also contains:
                      license:expat license:isc license:zlib)))))
 
+(define %systemd-version "255")
+(define systemd-source
+  (origin
+    (method git-fetch)
+    (uri (git-reference
+           (url "https://github.com/systemd/systemd")
+           (commit (string-append "v" %systemd-version))))
+    (file-name (git-file-name "systemd" %systemd-version))
+    (snippet #~(substitute* "src/ukify/ukify.py"
+                 ;; Remove after python 3.11.
+                 (("datetime\\.UTC") "datetime.timezone.utc")))
+    (modules '((guix build utils)))
+    (sha256
+      (base32
+        "1qdyw9g3jgvsbc1aryr11gpc3075w5pg00mqv4pyf3hwixxkwaq6"))))
+
+(define-public ukify
+  (package
+    (name "ukify")
+    (version %systemd-version)
+    (source systemd-source)
+    (build-system python-build-system)
+    (arguments
+      (list
+        #:phases
+        #~(modify-phases %standard-phases
+            (replace 'build
+              (lambda* (#:key inputs #:allow-other-keys)
+                (define (get-tool tool)
+                  (search-input-file inputs (string-append "bin/" tool)))
+                ;; Hardcode the tool paths.
+                (substitute* "src/ukify/ukify.py"
+                  (("(find_tool\\(')(readelf|sbsign|pesign)'," _ ctx tool)
+                   (string-append ctx (get-tool tool) "',"))
+                  (("('name': ')(sbverify|pesign)'," _ ctx tool)
+                   (string-append ctx (get-tool tool) "',")))))
+            (delete 'check)
+            (replace 'install
+              (lambda* (#:key inputs #:allow-other-keys)
+                (let* ((bin (string-append #$output "/bin"))
+                       (file (string-append bin "/ukify")))
+                  (mkdir-p bin)
+                  (copy-file "src/ukify/ukify.py" file)))))))
+    (inputs
+      (list binutils pesign python-cryptography python-pefile sbsigntools))
+    (home-page "https://systemd.io/")
+    (synopsis "Unified kernel image UEFI tool")
+    (description
+      "@command{ukify} joins together a UKI stub, linux kernel, initrd,
+kernel arguments, and optional secure boot signatures into a single,
+UEFI-bootable image.")
+    (license license:lgpl2.1+)))
+
 (define-public dtc
   (package
     (name "dtc")
-- 
2.45.2

[bug#68524] [PATCH v3 3/5] gnu: packages: Add systemd-stub.

[Herman Rimm via Guix-patches via]

From: Lilah Tascheter <lilah@lunabee.space>

* gnu/packages/bootloaders.scm (systemd-stub): New variable.

Change-Id: I974bad9ff7a52f736286d05de53f7c5ccb60b9d6
---
 gnu/packages/bootloaders.scm | 47 ++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

diff --git a/gnu/packages/bootloaders.scm b/gnu/packages/bootloaders.scm
index 52d92ba03a..c563cbd988 100644
--- a/gnu/packages/bootloaders.scm
+++ b/gnu/packages/bootloaders.scm
@@ -39,6 +39,7 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
 
 (define-module (gnu packages bootloaders)
+  #:use-module (gnu bootloader)
   #:use-module (gnu packages)
   #:use-module (gnu packages assembly)
   #:use-module (gnu packages base)
@@ -48,6 +49,7 @@ (define-module (gnu packages bootloaders)
   #:use-module (gnu packages check)
   #:use-module (gnu packages compression)
   #:use-module (gnu packages cross-base)
+  #:use-module (gnu packages crypto)
   #:use-module (gnu packages disk)
   #:use-module (gnu packages efi)
   #:use-module (gnu packages firmware)
@@ -55,6 +57,7 @@ (define-module (gnu packages bootloaders)
   #:use-module (gnu packages fontutils)
   #:use-module (gnu packages gcc)
   #:use-module (gnu packages gettext)
+  #:use-module (gnu packages gperf)
   #:use-module (gnu packages guile)
   #:use-module (gnu packages linux)
   #:use-module (gnu packages llvm)
@@ -596,6 +599,50 @@ (define systemd-source
       (base32
         "1qdyw9g3jgvsbc1aryr11gpc3075w5pg00mqv4pyf3hwixxkwaq6"))))
 
+(define-public systemd-stub
+  (package
+    (name "systemd-stub")
+    (version %systemd-version)
+    (source systemd-source)
+    (build-system meson-build-system)
+    (arguments
+      (list #:configure-flags
+            #~(list "-Dmode=release" "-Defi=true" "-Dsbat-distro=guix"
+                    "-Dsbat-distro-generation=1" ; package revision!
+                    "-Dsbat-distro-summary=Guix System"
+                    "-Dsbat-distro-url=https://guix.gnu.org"
+                    #$(string-append "-Dsbat-distro-pkgname="
+                        (package-name this-package))
+                    #$(string-append "-Dsbat-distro-version="
+                        (package-version this-package)))
+            #:phases
+            ;; TODO: 32-bit support.
+            (let* ((stub (string-append "src/boot/efi/linux" (efi-arch)
+                                        ".efi.stub")))
+              #~(modify-phases %standard-phases
+                  (replace 'build
+                    (lambda* (#:key parallel-build? #:allow-other-keys)
+                      (invoke "ninja" #$stub "-j"
+                              (if parallel-build?
+                                  (number->string (parallel-job-count))
+                                  "1"))))
+                  (replace 'install
+                    (lambda _
+                      (install-file #$stub (string-append #$output
+                                                          "/libexec"))))
+                  (delete 'check)))))
+    (supported-systems %efi-supported-systems)
+    (inputs
+      (list libcap libxcrypt python-pyelftools `(,util-linux "lib")))
+    (native-inputs (list gperf pkg-config python-3 python-jinja2))
+    (home-page "https://systemd.io/")
+    (synopsis "Unified kernel image UEFI stub")
+    (description
+      "Simple UEFI boot stub that loads a conjoined kernel image and
+supporting data to their proper locations, before chainloading to the
+kernel.  It supports measured and/or verified boot environments.")
+    (license license:lgpl2.1+)))
+
 (define-public ukify
   (package
     (name "ukify")
-- 
2.45.2

[bug#68524] [PATCH v3 4/5] gnu: system: Fix bootloader crypto device recognition.

[Herman Rimm via Guix-patches via]

From: Lilah Tascheter <lilah@lunabee.space>

* gnu/system.scm (operating-system-bootloader-crypto-devices): Check for
luks-device-mapping-with-options in addition to luks-device-mapping.

Change-Id: Iafc9afe608640b97083c4d559c9240846330472a
---
 gnu/system.scm | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/gnu/system.scm b/gnu/system.scm
index 85e02a9965..3dde0f4959 100644
--- a/gnu/system.scm
+++ b/gnu/system.scm
@@ -402,13 +402,16 @@ (define operating-system-bootloader-crypto-devices
   (mlambdaq (os)                        ;to avoid duplicated output
     "Return the sources of the LUKS mapped devices specified by UUID."
     ;; XXX: Device ordering is important, we trust the returned one.
-    (let* ((luks-devices (filter (lambda (m)
-                                   (eq? luks-device-mapping
-                                        (mapped-device-type m)))
-                                 (operating-system-boot-mapped-devices os)))
-           (uuid-crypto-devices non-uuid-crypto-devices
-                                (partition (compose uuid? mapped-device-source)
-                                           luks-devices)))
+    ;; Check against the close-luks-device procedure to get both maptypes.
+    (let* ((close (compose mapped-device-kind-close mapped-device-type))
+           (luks (mapped-device-kind-close luks-device-mapping))
+           (luks? (lambda (m) (eq? (close m) luks)))
+           (os-devices (operating-system-boot-mapped-devices os))
+           (luks-devices (filter luks? os-devices))
+           (uuid? (compose uuid? mapped-device-source))
+           (uuid-crypto-devices
+            non-uuid-crypto-devices
+            (partition uuid? luks-devices)))
       (when (not (null? non-uuid-crypto-devices))
         (for-each (lambda (dev)
                     (warning
-- 
2.45.2

[bug#68524] [PATCH v3 5/5] gnu: bootloaders: Add uki-efi-bootloader.

[Herman Rimm via Guix-patches via]

From: Lilah Tascheter <lilah@lunabee.space>

* gnu/bootloader.scm (<bootloader-configuration>): New keypair field.
* gnu/bootloader/uki.scm: New file.
* gnu/local.mk (GNU_SYSTEM_MODULES): Add bootloader/uki.scm.
* doc/guix.texi (Bootloader Configuration): Document UKI bootloader.

Change-Id: I2097da9f3dd35137b3419f6d0545de26d53cb6da
---
 doc/guix.texi          |  25 +++++++++-
 gnu/bootloader.scm     |   3 ++
 gnu/bootloader/uki.scm | 106 +++++++++++++++++++++++++++++++++++++++++
 gnu/local.mk           |   1 +
 4 files changed, 133 insertions(+), 2 deletions(-)
 create mode 100644 gnu/bootloader/uki.scm

diff --git a/doc/guix.texi b/doc/guix.texi
index 93be87d3cc..56d5b462c2 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -42486,6 +42486,24 @@ Bootloader Configuration
 @item @code{extlinux-gpt-bootloader}
 This is the same as above, but for systems with a GPT partition table.
 
+@cindex Secure Boot, UEFI
+@vindex uki-efi-bootloader
+@item @code{uki-efi-bootloader}
+Makes and installs UKI images for UEFI systems.  Requires an @code{'esp}
+target providing a @code{path} to the mount point of the EFI System
+Partition.  Not all system generations may be available with this
+option, as UKI images contain the entire kernel and initramfs, and ESPs
+tend to be small.
+
+Full disk encryption with @code{uki-efi-bootloader} only requires a
+single password entry with fast decryption, in contrast to GRUB2
+requiring a second password entry with slow, LUKS1-only decryption.
+
+This is the only bootloader to currently support UEFI Secure Boot, when
+configured as below.
+
+[THE CONFIGURATION BELOW]
+
 @cindex ARM, bootloaders
 @cindex AArch64, bootloaders
 @vindex u-boot-a20-olinuxino-lime-bootloader
@@ -42854,8 +42872,11 @@ Bootloader Configuration
 @end lisp
 
 @item @code{chain-loader} (default: @code{#f})
-Varies slightly depending on bootloader.  For @code{grub}, this is anything that
-the @code{chainloader} directive can accept
+Varies slightly depending on bootloader.  For @code{grub}, this is
+anything that the @code{chainloader} directive can accept
+(@pxref{Chain-loading,,, grub, GNU GRUB manual}).  For @code{uki-efi},
+this is any efi binary to be installed alongside the system.  The
+following is an example of chainloading a different GNU/Linux system.
 
 @lisp
 (bootloader
diff --git a/gnu/bootloader.scm b/gnu/bootloader.scm
index 5e4578add0..ae7f20832e 100644
--- a/gnu/bootloader.scm
+++ b/gnu/bootloader.scm
@@ -100,6 +100,7 @@ (define-module (gnu bootloader)
             bootloader-configuration-default-entry
             bootloader-configuration-efi-removable?
             bootloader-configuration-32bit?
+            bootloader-configuration-keypair
             bootloader-configuration-timeout
             bootloader-configuration-keyboard-layout
             bootloader-configuration-theme
@@ -546,6 +547,8 @@ (define-record-type* <bootloader-configuration>
                          (default #f))    ;bool
   (32bit?                bootloader-configuration-32bit?
                          (default #f))    ;bool
+  (keypair               bootloader-configuration-keypair
+                         (default #f))    ;(cert . priv) pair
   (timeout               bootloader-configuration-timeout
                          (default 5))     ;seconds as integer
   (keyboard-layout       bootloader-configuration-keyboard-layout
diff --git a/gnu/bootloader/uki.scm b/gnu/bootloader/uki.scm
new file mode 100644
index 0000000000..848b7618e9
--- /dev/null
+++ b/gnu/bootloader/uki.scm
@@ -0,0 +1,106 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2024 Lilah Tascheter <lilah@lunabee.space>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu bootloader uki)
+  #:use-module (gnu bootloader)
+  #:use-module (gnu packages bootloaders)
+  #:use-module (gnu packages efi)
+  #:use-module (gnu packages linux)
+  #:use-module (gnu system boot)
+  #:use-module (guix gexp)
+  #:use-module (guix diagnostics)
+  #:use-module (guix i18n)
+  #:use-module (guix records)
+  #:use-module (ice-9 match)
+  #:export (uki-efi-bootloader))
+
+;; TODO: Support 32bit/mixed-mode UEFI.  May be relevant:
+;; https://github.com/systemd/systemd/issues/17056
+(define (menu-entry+bootcfg->builder entry bootcfg)
+  (match-menu-entry entry
+    (label linux linux-arguments initrd chain-loader)
+    (match-bootloader-configuration bootcfg (32bit? theme keypair)
+      (cond
+        ;; Support chainloader in order to allow arbitrary signed EFI
+        ;; binaries.
+        (chain-loader
+          (match keypair
+            ((cert key)
+             #~(lambda (dest)
+                 (invoke/quiet #+(sbsigntools "/bin/sbsign")
+                               "--cert" #$cert "--key" #$key
+                               "--output" dest #$chain-loader)
+                 (invoke/quiet #+(sbsigntools "/bin/sbverify")
+                               "--cert" #$(car keypair) dest)))
+            (#f #~(lambda (dest) (copy-file #$chain-loader dest)))))
+        (linux
+          (let* ((arch (efi-arch #:32? 32bit?))
+                 (stub (file-append systemd-stub "/libexec/linux" arch
+                                    ".efi.stub")))
+            #~(lambda (dest)
+                (invoke/quiet
+                  #+(file-append ukify "/bin/ukify") "build"
+                  "--output" dest "--linux" #$linux "--initrd" #$initrd
+                  "--cmdline" (string-join (list #$@linux-arguments))
+                  "--os-release" #$label "--stub" #$stub
+                  "--efi-arch" #$arch
+                  #$@(if theme #~("--splash" #$theme) '())
+                  #$@(match keypair
+                       ((cert key)
+                        #~("--secureboot-certificate" #$cert
+                           "--secureboot-private-key" #$key))
+                       (#f '()))))))
+        (else
+          (leave
+            (G_ "uki-efi-bootloader doesn't support multiboot")))))))
+
+;; We cannot use Guix's build system to make UKI images for two reasons:
+;; 1. signing is necessarily non-reproducable, especially since keys
+;; should not be in the store, or else risk being publically accessible.
+;; 2. Menu-entries may reference files which do not exist in the store.
+(define* (install-uki #:key
+                      bootloader-config
+                      current-boot-alternative
+                      old-boot-alternatives
+                      #:allow-other-keys)
+  (define* (menu-entry->plan entry num #:optional (prefix "menu-entry"))
+    #~(cons* #$(menu-entry+bootcfg->builder entry bootloader-config)
+             #$(string-append prefix "-" (number->string num) ".efi")
+             #$(menu-entry-label entry)))
+
+  (define (boot-alternative->plan alt)
+    (menu-entry->plan (boot-alternative->menu-entry alt)
+                      (boot-alternative-generation alt)
+                      "generation"))
+
+  (install-efi
+    bootloader-config
+    (let ((entries
+            (bootloader-configuration-menu-entries bootloader-config)))
+      #~(list #$(boot-alternative->plan current-boot-alternative)
+              #$@(map menu-entry->plan entries (iota (length entries)))
+              #$@(map boot-alternative->plan old-boot-alternatives)))))
+
+(define uki-efi-bootloader
+  (bootloader
+    (name 'uki-efi)
+    (default-targets (list (bootloader-target
+                             (type 'vendir)
+                             (offset 'esp)
+                             (path "EFI/Guix"))))
+    (installer install-uki)))
diff --git a/gnu/local.mk b/gnu/local.mk
index e2d32d4fbf..507ca26dfc 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -94,6 +94,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/bootloader/extlinux.scm                   \
   %D%/bootloader/u-boot.scm                     \
   %D%/bootloader/depthcharge.scm                \
+  %D%/bootloader/uki.scm                        \
   %D%/ci.scm					\
   %D%/compression.scm				\
   %D%/home.scm					\
-- 
2.45.2

[bug#68524] One problem with uki bootloader.

[amano.kenji via Guix-patches via]

You can't change kernel parameters when you boot uki bootloader.

GRUB allows you to change kernel parameters before boot.

I wish guix installed kernel and initrd and grub.cfg in /boot. Then, grub doesn't need a password, and decrypting encrypted file systems will be a lot faster with grub.

[bug#68524] Can uki be used with grub?

[amano.kenji via Guix-patches via]

I propose writing grub.cfg instead of modifying nvram.

1. Modifying nvram whenever there are changes to kernel images will increase wear and tear on nvram. If grub loads uki, then nvram lifespan will increase.

2. kernel arguments should go to both grub.cfg and uki because uki arguments are passed to kernel in the absence of secure boot. I'd like to be able to change kernel arguments in grub for debugging and troubleshooting.

Thus, the bootloader can be called grub-uefi-uki-bootloader and grub-uefi-uki-signed-bootloader.