mirror of
https://github.com/NixOS/nixpkgs.git
synced 2024-11-23 15:33:13 +00:00
942588c686
This module provides some abstraction for a multi-stage build to create a dm-verity protected NixOS repart image. The opinionated approach realized by this module is to first create an immutable, verity-protected nix store partition, then embed the root hash of the corresponding verity hash partition in a UKI, that is then injected into the ESP of the resulting image. The UKI can then precisely identify the corresponding data from which the entire system is bootstrapped. The module comes with a script that checks the UKI used in the final image corresponds to the intermediate image created in the first step. This is necessary to notice incompatible substitutions of non-reproducible store paths, for example when working with distributed builds, or when offline-signing the UKI. |
||
|---|---|---|
| .. | ||
| amend-repart-definitions.py | ||
| assert_uki_repart_match.py | ||
| repart-image.nix | ||
| repart-verity-store.nix | ||
| repart.nix | ||