Add module for dm-verity-based disk rootfs

flake.nix

@@ -58,6 +58,7 @@
         debootstrap
         dosfstools
         e2fsprogs
+        erofs-utils
         mtools
         gptfdisk
         util-linux

mkosi.profiles/azure/mkosi.postoutput

@@ -5,6 +5,20 @@ EFI_FILE="${OUTPUTDIR}/${IMAGE_ID}_${IMAGE_VERSION}.efi"
 VHD_FILE="${OUTPUTDIR}/${IMAGE_ID}_${IMAGE_VERSION}.vhd"
 WORK_DIR="${OUTPUTDIR}/azure-tmp"
 
+# In verity-root mode, use existing mkosi disk image
+if [ "$(jq -r .Format "$MKOSI_CONFIG")" = "disk" ]; then
+    mkdir -p "$WORK_DIR"
+    raw="$WORK_DIR/azure_image.raw"
+    cp --sparse=always "${OUTPUTDIR}/${IMAGE_ID}_${IMAGE_VERSION}.raw" "$raw"
+    sgdisk --disk-guid "12345678-1234-5678-1234-567812345678" "$raw"
+    truncate -s %1MiB "$raw"
+    echo write | sfdisk --no-reread "$raw"
+    qemu-img convert -O vpc -o subformat=fixed,force_size "$raw" "$VHD_FILE"
+    rm -rf "$WORK_DIR"
+    echo "Successfully created VHD: $VHD_FILE"
+    exit 0
+fi
+
 if [ ! -f "$EFI_FILE" ]; then
     echo "Error: EFI file not found at $EFI_FILE"
     exit 1

mkosi.profiles/gcp/mkosi.postoutput

@@ -3,7 +3,22 @@
 set -eu -o pipefail
 
 export SOURCE_DATE_EPOCH=0 # not propagated from the main config, needed for mkfs.vfat
-export SYSTEMD_REPART_MKFS_OPTIONS_VFAT="-i 12345678 --invariant"
+export SYSTEMD_REPART_MKFS_OPTIONS_VFAT="--invariant"
+
+package_raw_as_tar() {
+    cd ${OUTPUTDIR}
+    ln -sf ${IMAGE_ID}_${IMAGE_VERSION}.raw disk.raw
+    tar --mtime="@${SOURCE_DATE_EPOCH}" --dereference --format=oldgnu -Sczf ${IMAGE_ID}_${IMAGE_VERSION}.tar.gz disk.raw
+    unlink disk.raw
+}
+
+# In verity-root mode, use existing mkosi disk image
+if [ "$(jq -r .Format "$MKOSI_CONFIG")" = "disk" ]; then
+    sgdisk --disk-guid "12345678-1234-5678-1234-567812345678" ${OUTPUTDIR}/${IMAGE_ID}_${IMAGE_VERSION}.raw
+    package_raw_as_tar
+    exit 0
+fi
+
 mkdir -p ${OUTPUTDIR}/esp/EFI/BOOT
 cp ${OUTPUTDIR}/${IMAGE_ID}_${IMAGE_VERSION}.efi ${OUTPUTDIR}/esp/EFI/BOOT/BOOTX64.EFI
 # Set fixed timestamps for reproducibility (FAT uses file mtime for directory entries)
@@ -33,8 +48,5 @@ sgdisk --disk-guid "12345678-1234-5678-1234-567812345678" ${OUTPUTDIR}/${IMAGE_I
 
 rm -rf ${OUTPUTDIR}/esp
 
-cd ${OUTPUTDIR}
-ln -sf ${IMAGE_ID}_${IMAGE_VERSION}.raw disk.raw
-tar --mtime="@${SOURCE_DATE_EPOCH}" --dereference --format=oldgnu -Sczf ${IMAGE_ID}_${IMAGE_VERSION}.tar.gz disk.raw
-unlink disk.raw
+package_raw_as_tar
 rm -f ${OUTPUTDIR}/${IMAGE_ID}_${IMAGE_VERSION}.raw

modules/verity-root/kernel/config.d/50-verity-root

@@ -0,0 +1,8 @@
+CONFIG_MD=y
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_VERITY=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_EROFS_FS=y
+CONFIG_EROFS_FS_XATTR=y
+CONFIG_EROFS_FS_POSIX_ACL=y
+CONFIG_OVERLAY_FS=y

modules/verity-root/mkosi.conf

@@ -0,0 +1,18 @@
+[Build]
+Environment=KERNEL_CONFIG_SNIPPETS_VERITY=modules/verity-root/kernel/config.d
+            SYSTEMD_REPART_MKFS_OPTIONS_VFAT=--invariant
+            # Debloated after finalize hook since mkosi looks in this directory for the kernel
+            SKIP_DEBLOAT_PATHS_VERITY=/usr/lib/modules
+
+[Output]
+Format=disk
+RepartDirectories=modules/verity-root/repart.d
+SplitArtifacts=uki
+
+[Content]
+Bootable=yes
+Bootloader=uki
+KernelModulesInitrd=no
+KernelCommandLine=systemd.volatile=overlay
+# Init contains a hack that's only needed when initramfs is the rootfs
+RemoveFiles=/init

modules/verity-root/repart.d/00-esp.conf

@@ -0,0 +1,8 @@
+[Partition]
+Type=esp
+Format=vfat
+UUID=87654321-4321-8765-4321-876543218765
+Label=ESP
+CopyFiles=/efi:/
+SizeMinBytes=260M
+SizeMaxBytes=260M

modules/verity-root/repart.d/10-root.conf

@@ -0,0 +1,12 @@
+[Partition]
+Type=root
+Format=erofs
+CopyFiles=/
+ExcludeFiles=/boot
+ExcludeFiles=/efi
+# mkosi looks for the kernel here after .finalize hooks run
+ExcludeFiles=/usr/lib/modules
+Label=root
+Verity=data
+VerityMatchKey=root
+Minimize=best

modules/verity-root/repart.d/20-root-verity.conf

@@ -0,0 +1,6 @@
+[Partition]
+Type=root-verity
+Label=root-verity
+Verity=hash
+VerityMatchKey=root
+Minimize=best

shared/mkosi.finalize.d/90-debloat.sh

@@ -52,7 +52,18 @@ if [[ ! "${PROFILES:-}" == *"devtools"* ]]; then
     )
 fi
 
+# Modules can skip debloat paths via SKIP_DEBLOAT_PATHS_* env vars (space-separated)
+skip_paths=()
+for var in "${!SKIP_DEBLOAT_PATHS@}"; do
+    skip_paths+=(${!var})
+done
+skip=" ${skip_paths[*]} "
+
 for p in "${debloat_paths[@]}"; do
+    if [[ "$skip" == *" $p "* ]]; then
+        echo "Skipping $p"
+        continue
+    fi
     echo "Debloating $p"
     rm -rf $BUILDROOT$p
 done