Allow .standalone version to be built on-demand, even if -Dstandalone=false
is configured. In other words, this changes the meson option from a hard
disablement to a soft "build is on/off by default".
The meson config was originally written in this way but we lost this feature
after the transition to templates. It is nice to build additional targets on
demand during development, so add this back.
The indirection through variables doesn't seem that useful here:
OTOH, the lists are short, and OTOH, there is a bunch of different
programs with similar names. Overall, it's all easier to follow if
the lists are inline.
In aad0d11e7c we stopped supporting XBOOTLDR
with a different fs driver. This was the primary example that comes to mind
when we talk about loading filesystem drivers in the firmware. Since we don't
want people to do load such drivers, use a different example.
We said in the header that "all EFI variables use the vendor UUID
4a67b082-0a4c-41cf-b6c7-440b29bb8c4f", but people not familiar with
UEFI might not know that this is concatenated with the variable name.
Let's use the full form once — when introducing the variable — to
make it easier to grep and search for.
While at it, use sembreaks in the document. This makes subsequent
changes much easier to review. (It also shows that some sentences
are rather long and thus hard to understand.)
Change unknown key mappings to reserved.
A KEY_RESERVED button is marked as reserved and passed to the kernel. This will stop the kernel from passing this keystroke event to user space.
If unknown, the key is set to KEY_UNKNOWN and the event is passed to user space, which we want to avoid.
It is not entirely clear what happens when EnvironmentFile fails in the
prior wording. With the new wording it should now be clear that if it
fails to process the file the service will fail, and if it is prefixed
with "-" all errors are silently ignored.
Signed-off-by: Andrew Halaney <ahalaney@netflix.com>
This can happen expectedly if an addon purely provides .dtbauto
sections, and there's no match for this machine. Reduce the log message
of this case to "debug" level.
Follow-up for a08f2ea02d
This fixes extensions refreshing + verity-protected DDIs.
TEST-50-DISSECT previously passed because confext refreshing
is tested after live mount, the latter of which used to
load libcryptsetup in pid1.
Follow-up for d796c6b7c6
rename() may yield ENOTEMPTY rather than EEXIST for existing dir,
so catch that too. Also, both the source and target must be
writable when exchanging.
Test coverage for this logic (i.e. user units with ExecStartPre=)
will be added later.
While blocking dlopen() in child generally makes sense, it does
also lead to misery - in the very case of extension/cred refreshing
it then enforces loading of libcryptsetup/libacl in pid1, which
are otherwise never used. Let's add a flag to opt out hence, but
still prohibit it in namespace_fork/enter().
* 9e31235211 pacman: Make sure hookdir exists
* 20009b7f48 make_image: log systemd-repart *.conf files at the --debug level
* b94b415db9 run: Increase string limit for strace when debugging sandbox
* 9f6d9405d6 Ring the terminal bell after the last image has been built
* b509b4246d Add glob in default initrd to exclude some exotic drivers
* 189394b8b9 Allow KernelModules= globs to also match relative to modules root dir
* 92bd086e4e zypper: add --force-resolution flag
* 3637749702 kmod: Only add fully resolved fw path if it exists
* d41ac276c9 Add details to KernelModulesInitrd= doc
* 1b6960ddb1 Fix SplitArtifacts=repart-definitions for addons
* 07464f38d6 Add log_step call in build_kernel_modules_initrd
* 18f5885362 Use proper constants for ansi colors
* 454c1602b6 mkosi-obs: add SplitArtifacts=repart-definitions and use it
* 9e57461af6 Copy repart definitions to staging directory
* 1acab18874 Add SplitArtifacts=repart-definitions
* c5c5c225e8 mkosi-obs: always include verity certificate
* ac5babb8e0 Revert "Use Path.relative_to instead of Path.parts"
* cbb1daeb76 action: Use environment variables instead of inputs
* 97c81eef72 portable: support split roothash
PCR 16 is intended for debugging purposes, and is the only PCR that can
be reset by software. Let's prefer that for testing.
PCR 11 has a purpose (i.e. kernel is measured there on UKI systems, as
are the boot phases), hence let's not use that for testing.
That should remove any interference of boot time ordering and testing
our tpm code, as we will write to PCR 16 only, and reset it before we
rely on it.
This likely, kind of fixes#39582, but the issue mixes two things, PCR
11 issues on real-life hardware, and PCR 11 isues in our artificial
tests. Only the latter is addressed by this PR, the other issue needs
more debugging, but without logs we cannot do much.
Since these helper processes aren't spawned in the unit cgroup,
let's explicitly attach unit log context so that all logging gets
attributed to the unit, including the ones done in library calls.
Given the integration tests take a while to run, it is useful to see
at which point it is while it is running. Sometimes only a test
script or such subset is changed, which means there's no need to
wait for the entire suite to run, especially with the sanitizers
job which is super slow.
Partially reverts 9848f56cc6
This is also temporary, but demonstrates that the version of qemu
currently in noble-proposed fixes https://launchpad.net/bugs/2127974,
which will ultimately allow for the fix to be released to noble-updates.
Zbigniew Jędrzejewski-Szmek
Luca Boccassi
Luca Boccassi
QuickSwift315490
Haiyue Wang
Andrew Halaney
Yu Watanabe
Vivian Wang
Priit Jõerüüt
Mike Yuan
Lennart Poettering
Henri Aunin
Nick Rosbrook
