diff options
| author | Paul Meyer <49727155+katexochen@users.noreply.github.com> | 2023-08-25 13:14:15 +0200 |
|---|---|---|
| committer | Paul Meyer <49727155+katexochen@users.noreply.github.com> | 2023-09-28 14:43:57 +0200 |
| commit | 123eeffafcb6635aba38166afe7af38db131702f (patch) | |
| tree | 06e1ee8ce9442f9dac9b378728f65c20a0528537 /pkgs/tools/virtualization/mkosi/default.nix | |
| parent | c7d925bbe5a318b86b81a13be6110e6221edf2d9 (diff) | |
mkosi: apply verity seed patch to systemd
This patch enables setting the a seed for systemd repart, which is usually non-deterministic. It enables reproducible builds with mkosi. Co-authored-by: Malte Poll <mp@edgeless.systems> Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
Diffstat (limited to 'pkgs/tools/virtualization/mkosi/default.nix')
| -rw-r--r-- | pkgs/tools/virtualization/mkosi/default.nix | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/pkgs/tools/virtualization/mkosi/default.nix b/pkgs/tools/virtualization/mkosi/default.nix index dcab2d5d9e095..2de32aa4bfaca 100644 --- a/pkgs/tools/virtualization/mkosi/default.nix +++ b/pkgs/tools/virtualization/mkosi/default.nix @@ -1,5 +1,6 @@ { lib , fetchFromGitHub +, fetchpatch , stdenv , python3 , bubblewrap @@ -21,7 +22,15 @@ let # For systemd features used by mkosi, see # https://github.com/systemd/mkosi/blob/19bb5e274d9a9c23891905c4bcbb8f68955a701d/action.yaml#L64-L72 - systemdForMkosi = systemd.override { + systemdForMkosi = (systemd.overrideAttrs (oldAttrs: { + patches = oldAttrs.patches ++ [ + # Enable setting a deterministic verity seed for systemd-repart. Remove when upgrading to systemd 255. + (fetchpatch { + url = "https://github.com/systemd/systemd/commit/81e04781106e3db24e9cf63c1d5fdd8215dc3f42.patch"; + hash = "sha256-KO3poIsvdeepPmXWQXNaJJCPpmBb4sVmO+ur4om9f5k="; + }) + ]; + })).override { withRepart = true; withBootloader = true; withSysusers = true; |