While using GRUB as the UEFI boot loader has reduced the size of the ISO,
it has brought nothing but pain otherwise:
* We cannot use `gfxterm` since it is not visible on some hardware.
* GRUB has a a strange and nonsensical limitation where the EFI binary
can be built with either support for shim or custom Secure Boot key
support, but not both. This means you cannot repack the ISO to use
shim + MOK since we currently use `--disable-shim-lock` to provide
support for setups with custom keys.
* GRUB's EFI binary needs to be built with `grub-mkstandalone` instead
of there being a ready made EFI binary in the package. This requires
having grub installed on the host system which affects reproducibility.
This increases the size of the ISO since systemd-boot cannot boot files
from other volumes, i.e. the kernel and initramfs is duplicated in the
EFI system partition (the second partition made from `efiboot.img`).
Implements https://gitlab.archlinux.org/archlinux/archiso/-/issues/227
The zstd tool has now been around for a while, so the availability of
it should not be a concern anymore.
Unlike gzip which was used until now, zstd offers higher compression
while still being faster (and multi-threaded).
The `--auto-threads=logical` option is used just so that there is some
difference between the releng and baseline profiles.
Everyone using the official Arch Linux bootstrap tarball (previously
`archlinux-bootstrap-YYYY.MM.DD-x86_64.tar.gz` or
`archlinux-bootstrap-x86_64.tar.gz`) will need to update their scripts
and etc. to use `archlinux-bootstrap-YYYY.MM.DD-x86_64.tar.zst` or
`archlinux-bootstrap-x86_64.tar.zst` instead.
Implements https://gitlab.archlinux.org/archlinux/archiso/-/issues/130
`uefi-ia32.systemd-boot.eltorito` has the same requirements as
`uefi-ia32.systemd-boot.esp`, not the same as `uefi-x64.systemd-boot.esp`.
Fixes: 5e72546e89 ("mkarchiso: add uefi-ia32.systemd-boot.esp and uefi-ia32.systemd-boot.eltorito boot modes")
The early uncompressed CPIO archive containing microcode update files
can be part of the initramfs file. To avoid wasting space, first check
if the initramfs file contains `early_cpio` and only copy external
microcode initramfs images if it does not.
The licenses package does not ship
`/usr/share/licenses/common/GPL2/license.txt` anymore, which results in:
/usr/share/licenses/common/GPL2/license.txt': No such file or directory
Use its replacement, `/usr/share/licenses/spdx/GPL-2.0-only.txt` instead.
Fixes https://gitlab.archlinux.org/archlinux/archiso/-/issues/225
By default systemd-networkd-wait-online.service considers a network
connection to be "online" when it has reached the "degraded" state
(see networkctl(1) for the definitions).
Since "degraded" does not ensure there's a routable address, let's
change the connection's requirement to "routable" instead.
This gives a better chance that the network really is online when
network-online.target is reached.
The systemd 254.2-1 package ships with IA32 systemd-boot, so it is
possible to use for booting on IA32 UEFI.
Perhaps they will be useful in the future.
At least for now, the baseline and releng profiles are not changed to
use them. When the issues and headaches caused with GRUB reach a
critical point, then we will switch.
bolt can be used to list and authorize Thunderbolt and USB4 devices.
Inspired by https://bbs.archlinux.org/viewtopic.php?id=288731 where a
user needed to install the package in the live environment.
openssh 9.4p1-2 changed /etc/ssh/sshd_config to add support for
drop-in files in /etc/ssh/sshd_config.d/.
Using drop-in files avoids needing to keep up with changes to the
default /etc/ssh/sshd_config.
Since systemd 245, IPv6PrivacyExtensions can be set not just per
connection, but also globally for all connection with a configuration
file in /etc/systemd/network.conf.d/.
Since tmpfs has a `noswap` option, use it instead of ramfs. Unlike
ramfs, tmpfs has a limit to its size.
This reverts commit 09b0428128 ("configs/releng/airootfs/etc/systemd/system/etc-pacman.d-gnupg.mount: use ramfs").
Options set in xorriso startup files (~/.xorrisorc) could interfere with the xorriso command run by mkarchiso.
For example, if ~root/.xorrisorc contains -dummy on, then the ISO file will be empty.
Pass -no_rc as the first option to xorriso to prevent interference and unintended behavior.
Fixes#153.
Since `_build_buildmode_netboot` runs `_build_iso_base` which runs
`_prepare_airootfs_image`, the call to `_cms_sign_artifact` in
`_build_buildmode_netboot` can be removed.
Fixes#197
`-r` will instruct to delete the working directory at the end of a
`mkarchiso` run.
If the specified directory already exists, then it will not be deleted
and instead produce a warning.
Implements #211
When restarting an interrupted build, SOURCE_DATE_EPOCH needs to be
available before `profiledef.sh` is read, since it may reference it.
Fixes 7c6f266ec9
