mkosi: Build initrd as a subimage

Let's make things a little more consistent and build the initrd
explicitly as a subimage as well instead of relying on mkosi building
it as part of the main image build.

We drop the opensuse initrd postinst script as we don't use erofs by
default anymore. We can always reintroduce it again later if needed.

diff --git a/mkosi.conf b/mkosi.conf
index cafd563c35892efb043cfdda41de3677f369e451..86ee19e1fc0f0550ef392974efa4f6f910a0f37d 100644 (file)
--- a/mkosi.conf
+++ b/mkosi.conf
@@ -2,9 +2,9 @@
 
 [Config]
 MinimumVersion=23~devel
-InitrdInclude=mkosi.initrd/
 Dependencies=
         exitrd
+        initrd
         minimal-base
         minimal-0
         minimal-1
@@ -45,6 +45,8 @@ ExtraTrees=
         %O/minimal-base:/usr/share/TEST-13-NSPAWN-container-template
         %O/exitrd:/exitrd
 
+Initrds=%O/initrd
+
 Environment=
         SYSTEMD_REPART_OVERRIDE_FSTYPE_ROOT=%F
 
@@ -83,11 +85,6 @@ KernelCommandLine=systemd.crash_shell
 KernelModulesInitrdExclude=.*
 KernelModulesInitrdInclude=default
 
-InitrdPackages=
-        findutils
-        grep
-        sed
-
 Packages=
         acl
         attr

diff --git a/mkosi.conf.d/10-arch/mkosi.conf b/mkosi.conf.d/10-arch/mkosi.conf
index 7b719ff7b09bcaef30d1447ab8ffc60ed784e74b..5a4015e4d7c935a7af414f04e5ee05af76117038 100644 (file)
--- a/mkosi.conf.d/10-arch/mkosi.conf
+++ b/mkosi.conf.d/10-arch/mkosi.conf
@@ -52,12 +52,3 @@ Packages=
         tgt
         tpm2-tools
         vim
-
-InitrdPackages=
-        btrfs-progs
-        tpm2-tools
-
-InitrdVolatilePackages=
-        systemd
-        systemd-libs
-        systemd-sysvcompat

diff --git a/mkosi.conf.d/10-centos-fedora/mkosi.conf b/mkosi.conf.d/10-centos-fedora/mkosi.conf
index 8882c89b1b94c6d700d15ca1465a5315e0dfe880..6083fe4f072430f94be78340402b786a75dd6786 100644 (file)
--- a/mkosi.conf.d/10-centos-fedora/mkosi.conf
+++ b/mkosi.conf.d/10-centos-fedora/mkosi.conf
@@ -59,10 +59,3 @@ Packages=
         util-linux
         veritysetup
         vim-common
-
-InitrdPackages=
-        tpm2-tools
-
-InitrdVolatilePackages=
-        systemd
-        systemd-udev

diff --git a/mkosi.conf.d/10-debian-ubuntu/mkosi.conf b/mkosi.conf.d/10-debian-ubuntu/mkosi.conf
index d282b47fb666efde628c27d038ebee8aacd7e58f..43e078117f2c46caa853b7fd776e6197b813dddc 100644 (file)
--- a/mkosi.conf.d/10-debian-ubuntu/mkosi.conf
+++ b/mkosi.conf.d/10-debian-ubuntu/mkosi.conf
@@ -75,13 +75,3 @@ Packages=
         tpm2-tools
         tzdata
         xxd
-
-InitrdPackages=
-        btrfs-progs
-        tpm2-tools
-
-InitrdVolatilePackages=
-        systemd
-        systemd-cryptsetup
-        systemd-repart
-        udev

diff --git a/mkosi.conf.d/10-fedora/mkosi.conf b/mkosi.conf.d/10-fedora/mkosi.conf
index 92f0c7e9b0fc32197bb700070130b977cd2def2f..adb7779a1ea716d9d9e78d4087881934c513adcd 100644 (file)
--- a/mkosi.conf.d/10-fedora/mkosi.conf
+++ b/mkosi.conf.d/10-fedora/mkosi.conf
@@ -23,6 +23,3 @@ Packages=
         rpmautospec
         sbsigntools
         scsi-target-utils
-
-InitrdPackages=
-        btrfs-progs

diff --git a/mkosi.conf.d/10-opensuse/initrd/mkosi.postinst b/mkosi.conf.d/10-opensuse/initrd/mkosi.postinst
deleted file mode 100755 (executable)
index 417132f..0000000
--- a/mkosi.conf.d/10-opensuse/initrd/mkosi.postinst
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/bin/bash
-# SPDX-License-Identifier: LGPL-2.1-or-later
-set -e
-
-# OpenSUSE insists on blacklisting erofs by default because its supposedly a legacy filesystem.
-# See https://github.com/openSUSE/suse-module-tools/pull/71
-rm -f "$BUILDROOT/usr/lib/modprobe.d/60-blacklist_fs-erofs.conf"

diff --git a/mkosi.conf.d/10-opensuse/mkosi.conf b/mkosi.conf.d/10-opensuse/mkosi.conf
index 2a6bd6e7bf7289e0acdf8deb19e60d0459cef2a3..e741aa4a9c64bf52e97f1c73df98645e900f4de5 100644 (file)
--- a/mkosi.conf.d/10-opensuse/mkosi.conf
+++ b/mkosi.conf.d/10-opensuse/mkosi.conf
@@ -3,9 +3,6 @@
 [Match]
 Distribution=opensuse
 
-[Config]
-InitrdInclude=initrd/
-
 [Distribution]
 Release=tumbleweed
 Repositories=non-oss
@@ -80,13 +77,3 @@ Packages=
         vim
         xz
         zypper
-
-InitrdPackages=
-        btrfs-progs
-        kmod
-        tpm2.0-tools
-
-InitrdVolatilePackages=
-        systemd
-        udev
-        systemd-experimental

diff --git a/mkosi.images/initrd/mkosi.conf b/mkosi.images/initrd/mkosi.conf
new file mode 100644 (file)
index 0000000..ab5be9b
--- /dev/null
+++ b/mkosi.images/initrd/mkosi.conf
@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Config]
+Include=
+        mkosi-initrd
+        %D/mkosi.sanitizers
+
+[Content]
+ExtraTrees=
+    %D/mkosi.leak-sanitizer-suppressions:/usr/lib/systemd/leak-sanitizer-suppressions
+    %D/mkosi.coredump-journal-storage.conf:/usr/lib/systemd/coredump.conf.d/10-coredump-journal-storage.conf
+
+Packages=
+        findutils
+        grep
+        sed

diff --git a/mkosi.images/initrd/mkosi.conf.d/arch.conf b/mkosi.images/initrd/mkosi.conf.d/arch.conf
new file mode 100644 (file)
index 0000000..99e039d
--- /dev/null
+++ b/mkosi.images/initrd/mkosi.conf.d/arch.conf
@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=arch
+
+[Content]
+Packages=
+        btrfs-progs
+        tpm2-tools
+
+VolatilePackages=
+        systemd
+        systemd-libs
+        systemd-sysvcompat

diff --git a/mkosi.images/initrd/mkosi.conf.d/build.conf b/mkosi.images/initrd/mkosi.conf.d/build.conf
new file mode 100644 (file)
index 0000000..8c16d9b
--- /dev/null
+++ b/mkosi.images/initrd/mkosi.conf.d/build.conf
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+# Add a dependency on the build image unless NO_BUILD=1.
+
+[Match]
+Environment=!NO_BUILD=1
+
+[Config]
+Dependencies=build

diff --git a/mkosi.images/initrd/mkosi.conf.d/centos-fedora.conf b/mkosi.images/initrd/mkosi.conf.d/centos-fedora.conf
new file mode 100644 (file)
index 0000000..811d352
--- /dev/null
+++ b/mkosi.images/initrd/mkosi.conf.d/centos-fedora.conf
@@ -0,0 +1,13 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=|centos
+Distribution=|fedora
+
+[Content]
+Packages=
+        tpm2-tools
+
+VolatilePackages=
+        systemd
+        systemd-udev

diff --git a/mkosi.images/initrd/mkosi.conf.d/debian-ubuntu.conf b/mkosi.images/initrd/mkosi.conf.d/debian-ubuntu.conf
new file mode 100644 (file)
index 0000000..8d56ff2
--- /dev/null
+++ b/mkosi.images/initrd/mkosi.conf.d/debian-ubuntu.conf
@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=|debian
+Distribution=|ubuntu
+
+[Content]
+Packages=
+        btrfs-progs
+        tpm2-tools
+
+VolatilePackages=
+        systemd
+        systemd-cryptsetup
+        systemd-repart
+        udev

diff --git a/mkosi.images/initrd/mkosi.conf.d/fedora.conf b/mkosi.images/initrd/mkosi.conf.d/fedora.conf
new file mode 100644 (file)
index 0000000..634b5a0
--- /dev/null
+++ b/mkosi.images/initrd/mkosi.conf.d/fedora.conf
@@ -0,0 +1,8 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=fedora
+
+[Content]
+Packages=
+        btrfs-progs

diff --git a/mkosi.images/initrd/mkosi.conf.d/opensuse.conf b/mkosi.images/initrd/mkosi.conf.d/opensuse.conf
new file mode 100644 (file)
index 0000000..e04f8bc
--- /dev/null
+++ b/mkosi.images/initrd/mkosi.conf.d/opensuse.conf
@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=opensuse
+
+[Content]
+Packages=
+        btrfs-progs
+        kmod
+        tpm2.0-tools
+
+VolatilePackages=
+        systemd
+        udev
+        systemd-experimental

diff --git a/mkosi.images/initrd/mkosi.extra/usr/lib/encrypted-var.repart.d/00-root.conf b/mkosi.images/initrd/mkosi.extra/usr/lib/encrypted-var.repart.d/00-root.conf
new file mode 100644 (file)
index 0000000..b252491
--- /dev/null
+++ b/mkosi.images/initrd/mkosi.extra/usr/lib/encrypted-var.repart.d/00-root.conf
@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Partition]
+Type=var
+# This label is the partition's label. The filesystem inside may have its own label.
+Label=varcrypt
+# This UUID is the decrypted partition UUID, there are also filesystem and luks UUIDs.
+# The original test finds the partition by this UUID, but it doesn't appear
+# since the luks UUID, which is derived by hash of this UUID, is different
+# and the luks UUID is needed before the decrypted partition UUID.
+# The resulting luks UUID is 0d318174-56b0-4d6e-a324-ac1e7e7d235d.
+UUID=deadbeef-dead-dead-beef-000000000000
+Format=ext4
+Encrypt=key-file
+SizeMinBytes=1G

diff --git a/mkosi.images/initrd/mkosi.extra/usr/lib/systemd/system/encrypted-var.service b/mkosi.images/initrd/mkosi.extra/usr/lib/systemd/system/encrypted-var.service
new file mode 100644 (file)
index 0000000..54a9b8a
--- /dev/null
+++ b/mkosi.images/initrd/mkosi.extra/usr/lib/systemd/system/encrypted-var.service
@@ -0,0 +1,20 @@
+#  SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Unit]
+Description=Add encrypted var partition to root disk
+Documentation=man:systemd-repart.service(8)
+
+ConditionVirtualization=!container
+
+DefaultDependencies=no
+Wants=modprobe@loop.service modprobe@dm_mod.service
+After=modprobe@loop.service modprobe@dm_mod.service sysroot.mount
+Before=initrd-root-fs.target
+Conflicts=shutdown.target initrd-switch-root.target
+Before=shutdown.target initrd-switch-root.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=systemd-repart --definitions /usr/lib/encrypted-var.repart.d --key-file %d/keyfile --dry-run=no /sysroot
+ImportCredential=keyfile

diff --git a/mkosi.images/initrd/mkosi.extra/usr/lib/systemd/system/initrd-run-mount.service b/mkosi.images/initrd/mkosi.extra/usr/lib/systemd/system/initrd-run-mount.service
new file mode 100644 (file)
index 0000000..845ac57
--- /dev/null
+++ b/mkosi.images/initrd/mkosi.extra/usr/lib/systemd/system/initrd-run-mount.service
@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Unit]
+Description=Create a mount in /run that should survive the transition from initrd
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=mkdir /run/initrd-mount-source /run/initrd-mount-target
+ExecStart=mount -v --bind /run/initrd-mount-source /run/initrd-mount-target
+ExecStart=cp -v /etc/initrd-release /run/initrd-mount-target/hello-world

diff --git a/mkosi.images/initrd/mkosi.extra/usr/lib/systemd/system/initrdcred.service b/mkosi.images/initrd/mkosi.extra/usr/lib/systemd/system/initrdcred.service
new file mode 100644 (file)
index 0000000..2c709bc
--- /dev/null
+++ b/mkosi.images/initrd/mkosi.extra/usr/lib/systemd/system/initrdcred.service
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Unit]
+Description=populate initrd credential dir for TEST-54-CREDS
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=sh -c "mkdir -m 0755 -p /run/credentials && mkdir -m 0700 /run/credentials/@initrd && umask 0077 && echo guatemala > /run/credentials/@initrd/myinitrdcred"

diff --git a/mkosi.initrd/mkosi.conf b/mkosi.initrd/mkosi.conf
deleted file mode 100644 (file)
index baf0872..0000000
--- a/mkosi.initrd/mkosi.conf
+++ /dev/null
@@ -1,9 +0,0 @@
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-[Content]
-ExtraTrees=
-    ../mkosi.leak-sanitizer-suppressions:/usr/lib/systemd/leak-sanitizer-suppressions
-    ../mkosi.coredump-journal-storage.conf:/usr/lib/systemd/coredump.conf.d/10-coredump-journal-storage.conf
-
-[Config]
-Include=../mkosi.sanitizers

diff --git a/mkosi.initrd/mkosi.extra/usr/lib/encrypted-var.repart.d/00-root.conf b/mkosi.initrd/mkosi.extra/usr/lib/encrypted-var.repart.d/00-root.conf
deleted file mode 100644 (file)
index b252491..0000000
--- a/mkosi.initrd/mkosi.extra/usr/lib/encrypted-var.repart.d/00-root.conf
+++ /dev/null
@@ -1,15 +0,0 @@
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-[Partition]
-Type=var
-# This label is the partition's label. The filesystem inside may have its own label.
-Label=varcrypt
-# This UUID is the decrypted partition UUID, there are also filesystem and luks UUIDs.
-# The original test finds the partition by this UUID, but it doesn't appear
-# since the luks UUID, which is derived by hash of this UUID, is different
-# and the luks UUID is needed before the decrypted partition UUID.
-# The resulting luks UUID is 0d318174-56b0-4d6e-a324-ac1e7e7d235d.
-UUID=deadbeef-dead-dead-beef-000000000000
-Format=ext4
-Encrypt=key-file
-SizeMinBytes=1G

diff --git a/mkosi.initrd/mkosi.extra/usr/lib/systemd/system/encrypted-var.service b/mkosi.initrd/mkosi.extra/usr/lib/systemd/system/encrypted-var.service
deleted file mode 100644 (file)
index 54a9b8a..0000000
--- a/mkosi.initrd/mkosi.extra/usr/lib/systemd/system/encrypted-var.service
+++ /dev/null
@@ -1,20 +0,0 @@
-#  SPDX-License-Identifier: LGPL-2.1-or-later
-
-[Unit]
-Description=Add encrypted var partition to root disk
-Documentation=man:systemd-repart.service(8)
-
-ConditionVirtualization=!container
-
-DefaultDependencies=no
-Wants=modprobe@loop.service modprobe@dm_mod.service
-After=modprobe@loop.service modprobe@dm_mod.service sysroot.mount
-Before=initrd-root-fs.target
-Conflicts=shutdown.target initrd-switch-root.target
-Before=shutdown.target initrd-switch-root.target
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-ExecStart=systemd-repart --definitions /usr/lib/encrypted-var.repart.d --key-file %d/keyfile --dry-run=no /sysroot
-ImportCredential=keyfile

diff --git a/mkosi.initrd/mkosi.extra/usr/lib/systemd/system/initrd-run-mount.service b/mkosi.initrd/mkosi.extra/usr/lib/systemd/system/initrd-run-mount.service
deleted file mode 100644 (file)
index 845ac57..0000000
--- a/mkosi.initrd/mkosi.extra/usr/lib/systemd/system/initrd-run-mount.service
+++ /dev/null
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-[Unit]
-Description=Create a mount in /run that should survive the transition from initrd
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-ExecStart=mkdir /run/initrd-mount-source /run/initrd-mount-target
-ExecStart=mount -v --bind /run/initrd-mount-source /run/initrd-mount-target
-ExecStart=cp -v /etc/initrd-release /run/initrd-mount-target/hello-world

diff --git a/mkosi.initrd/mkosi.extra/usr/lib/systemd/system/initrdcred.service b/mkosi.initrd/mkosi.extra/usr/lib/systemd/system/initrdcred.service
deleted file mode 100644 (file)
index 2c709bc..0000000
--- a/mkosi.initrd/mkosi.extra/usr/lib/systemd/system/initrdcred.service
+++ /dev/null
@@ -1,9 +0,0 @@
-# SPDX-License-Identifier: LGPL-2.1-or-later
-
-[Unit]
-Description=populate initrd credential dir for TEST-54-CREDS
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-ExecStart=sh -c "mkdir -m 0755 -p /run/credentials && mkdir -m 0700 /run/credentials/@initrd && umask 0077 && echo guatemala > /run/credentials/@initrd/myinitrdcred"