├── .gitignore ├── COPYING ├── README.md ├── buildkernel ├── buildkernel.8 ├── buildkernel.conf └── buildkernel.conf.5 /.gitignore: -------------------------------------------------------------------------------- 1 | *~ 2 | preparchive.sh 3 | signdigest.sh 4 | DIGESTS 5 | -------------------------------------------------------------------------------- /COPYING: -------------------------------------------------------------------------------- 1 | GNU GENERAL PUBLIC LICENSE 2 | Version 3, 29 June 2007 3 | 4 | Copyright (C) 2007 Free Software Foundation, Inc. 5 | Everyone is permitted to copy and distribute verbatim copies 6 | of this license document, but changing it is not allowed. 7 | 8 | Preamble 9 | 10 | The GNU General Public License is a free, copyleft license for 11 | software and other kinds of works. 12 | 13 | The licenses for most software and other practical works are designed 14 | to take away your freedom to share and change the works. By contrast, 15 | the GNU General Public License is intended to guarantee your freedom to 16 | share and change all versions of a program--to make sure it remains free 17 | software for all its users. We, the Free Software Foundation, use the 18 | GNU General Public License for most of our software; it applies also to 19 | any other work released this way by its authors. You can apply it to 20 | your programs, too. 21 | 22 | When we speak of free software, we are referring to freedom, not 23 | price. Our General Public Licenses are designed to make sure that you 24 | have the freedom to distribute copies of free software (and charge for 25 | them if you wish), that you receive source code or can get it if you 26 | want it, that you can change the software or use pieces of it in new 27 | free programs, and that you know you can do these things. 28 | 29 | To protect your rights, we need to prevent others from denying you 30 | these rights or asking you to surrender the rights. Therefore, you have 31 | certain responsibilities if you distribute copies of the software, or if 32 | you modify it: responsibilities to respect the freedom of others. 33 | 34 | For example, if you distribute copies of such a program, whether 35 | gratis or for a fee, you must pass on to the recipients the same 36 | freedoms that you received. You must make sure that they, too, receive 37 | or can get the source code. And you must show them these terms so they 38 | know their rights. 39 | 40 | Developers that use the GNU GPL protect your rights with two steps: 41 | (1) assert copyright on the software, and (2) offer you this License 42 | giving you legal permission to copy, distribute and/or modify it. 43 | 44 | For the developers' and authors' protection, the GPL clearly explains 45 | that there is no warranty for this free software. For both users' and 46 | authors' sake, the GPL requires that modified versions be marked as 47 | changed, so that their problems will not be attributed erroneously to 48 | authors of previous versions. 49 | 50 | Some devices are designed to deny users access to install or run 51 | modified versions of the software inside them, although the manufacturer 52 | can do so. This is fundamentally incompatible with the aim of 53 | protecting users' freedom to change the software. The systematic 54 | pattern of such abuse occurs in the area of products for individuals to 55 | use, which is precisely where it is most unacceptable. Therefore, we 56 | have designed this version of the GPL to prohibit the practice for those 57 | products. If such problems arise substantially in other domains, we 58 | stand ready to extend this provision to those domains in future versions 59 | of the GPL, as needed to protect the freedom of users. 60 | 61 | Finally, every program is threatened constantly by software patents. 62 | States should not allow patents to restrict development and use of 63 | software on general-purpose computers, but in those that do, we wish to 64 | avoid the special danger that patents applied to a free program could 65 | make it effectively proprietary. To prevent this, the GPL assures that 66 | patents cannot be used to render the program non-free. 67 | 68 | The precise terms and conditions for copying, distribution and 69 | modification follow. 70 | 71 | TERMS AND CONDITIONS 72 | 73 | 0. Definitions. 74 | 75 | "This License" refers to version 3 of the GNU General Public License. 76 | 77 | "Copyright" also means copyright-like laws that apply to other kinds of 78 | works, such as semiconductor masks. 79 | 80 | "The Program" refers to any copyrightable work licensed under this 81 | License. Each licensee is addressed as "you". "Licensees" and 82 | "recipients" may be individuals or organizations. 83 | 84 | To "modify" a work means to copy from or adapt all or part of the work 85 | in a fashion requiring copyright permission, other than the making of an 86 | exact copy. The resulting work is called a "modified version" of the 87 | earlier work or a work "based on" the earlier work. 88 | 89 | A "covered work" means either the unmodified Program or a work based 90 | on the Program. 91 | 92 | To "propagate" a work means to do anything with it that, without 93 | permission, would make you directly or secondarily liable for 94 | infringement under applicable copyright law, except executing it on a 95 | computer or modifying a private copy. Propagation includes copying, 96 | distribution (with or without modification), making available to the 97 | public, and in some countries other activities as well. 98 | 99 | To "convey" a work means any kind of propagation that enables other 100 | parties to make or receive copies. Mere interaction with a user through 101 | a computer network, with no transfer of a copy, is not conveying. 102 | 103 | An interactive user interface displays "Appropriate Legal Notices" 104 | to the extent that it includes a convenient and prominently visible 105 | feature that (1) displays an appropriate copyright notice, and (2) 106 | tells the user that there is no warranty for the work (except to the 107 | extent that warranties are provided), that licensees may convey the 108 | work under this License, and how to view a copy of this License. If 109 | the interface presents a list of user commands or options, such as a 110 | menu, a prominent item in the list meets this criterion. 111 | 112 | 1. Source Code. 113 | 114 | The "source code" for a work means the preferred form of the work 115 | for making modifications to it. "Object code" means any non-source 116 | form of a work. 117 | 118 | A "Standard Interface" means an interface that either is an official 119 | standard defined by a recognized standards body, or, in the case of 120 | interfaces specified for a particular programming language, one that 121 | is widely used among developers working in that language. 122 | 123 | The "System Libraries" of an executable work include anything, other 124 | than the work as a whole, that (a) is included in the normal form of 125 | packaging a Major Component, but which is not part of that Major 126 | Component, and (b) serves only to enable use of the work with that 127 | Major Component, or to implement a Standard Interface for which an 128 | implementation is available to the public in source code form. A 129 | "Major Component", in this context, means a major essential component 130 | (kernel, window system, and so on) of the specific operating system 131 | (if any) on which the executable work runs, or a compiler used to 132 | produce the work, or an object code interpreter used to run it. 133 | 134 | The "Corresponding Source" for a work in object code form means all 135 | the source code needed to generate, install, and (for an executable 136 | work) run the object code and to modify the work, including scripts to 137 | control those activities. However, it does not include the work's 138 | System Libraries, or general-purpose tools or generally available free 139 | programs which are used unmodified in performing those activities but 140 | which are not part of the work. For example, Corresponding Source 141 | includes interface definition files associated with source files for 142 | the work, and the source code for shared libraries and dynamically 143 | linked subprograms that the work is specifically designed to require, 144 | such as by intimate data communication or control flow between those 145 | subprograms and other parts of the work. 146 | 147 | The Corresponding Source need not include anything that users 148 | can regenerate automatically from other parts of the Corresponding 149 | Source. 150 | 151 | The Corresponding Source for a work in source code form is that 152 | same work. 153 | 154 | 2. Basic Permissions. 155 | 156 | All rights granted under this License are granted for the term of 157 | copyright on the Program, and are irrevocable provided the stated 158 | conditions are met. This License explicitly affirms your unlimited 159 | permission to run the unmodified Program. The output from running a 160 | covered work is covered by this License only if the output, given its 161 | content, constitutes a covered work. This License acknowledges your 162 | rights of fair use or other equivalent, as provided by copyright law. 163 | 164 | You may make, run and propagate covered works that you do not 165 | convey, without conditions so long as your license otherwise remains 166 | in force. You may convey covered works to others for the sole purpose 167 | of having them make modifications exclusively for you, or provide you 168 | with facilities for running those works, provided that you comply with 169 | the terms of this License in conveying all material for which you do 170 | not control copyright. Those thus making or running the covered works 171 | for you must do so exclusively on your behalf, under your direction 172 | and control, on terms that prohibit them from making any copies of 173 | your copyrighted material outside their relationship with you. 174 | 175 | Conveying under any other circumstances is permitted solely under 176 | the conditions stated below. Sublicensing is not allowed; section 10 177 | makes it unnecessary. 178 | 179 | 3. Protecting Users' Legal Rights From Anti-Circumvention Law. 180 | 181 | No covered work shall be deemed part of an effective technological 182 | measure under any applicable law fulfilling obligations under article 183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or 184 | similar laws prohibiting or restricting circumvention of such 185 | measures. 186 | 187 | When you convey a covered work, you waive any legal power to forbid 188 | circumvention of technological measures to the extent such circumvention 189 | is effected by exercising rights under this License with respect to 190 | the covered work, and you disclaim any intention to limit operation or 191 | modification of the work as a means of enforcing, against the work's 192 | users, your or third parties' legal rights to forbid circumvention of 193 | technological measures. 194 | 195 | 4. Conveying Verbatim Copies. 196 | 197 | You may convey verbatim copies of the Program's source code as you 198 | receive it, in any medium, provided that you conspicuously and 199 | appropriately publish on each copy an appropriate copyright notice; 200 | keep intact all notices stating that this License and any 201 | non-permissive terms added in accord with section 7 apply to the code; 202 | keep intact all notices of the absence of any warranty; and give all 203 | recipients a copy of this License along with the Program. 204 | 205 | You may charge any price or no price for each copy that you convey, 206 | and you may offer support or warranty protection for a fee. 207 | 208 | 5. Conveying Modified Source Versions. 209 | 210 | You may convey a work based on the Program, or the modifications to 211 | produce it from the Program, in the form of source code under the 212 | terms of section 4, provided that you also meet all of these conditions: 213 | 214 | a) The work must carry prominent notices stating that you modified 215 | it, and giving a relevant date. 216 | 217 | b) The work must carry prominent notices stating that it is 218 | released under this License and any conditions added under section 219 | 7. This requirement modifies the requirement in section 4 to 220 | "keep intact all notices". 221 | 222 | c) You must license the entire work, as a whole, under this 223 | License to anyone who comes into possession of a copy. This 224 | License will therefore apply, along with any applicable section 7 225 | additional terms, to the whole of the work, and all its parts, 226 | regardless of how they are packaged. This License gives no 227 | permission to license the work in any other way, but it does not 228 | invalidate such permission if you have separately received it. 229 | 230 | d) If the work has interactive user interfaces, each must display 231 | Appropriate Legal Notices; however, if the Program has interactive 232 | interfaces that do not display Appropriate Legal Notices, your 233 | work need not make them do so. 234 | 235 | A compilation of a covered work with other separate and independent 236 | works, which are not by their nature extensions of the covered work, 237 | and which are not combined with it such as to form a larger program, 238 | in or on a volume of a storage or distribution medium, is called an 239 | "aggregate" if the compilation and its resulting copyright are not 240 | used to limit the access or legal rights of the compilation's users 241 | beyond what the individual works permit. Inclusion of a covered work 242 | in an aggregate does not cause this License to apply to the other 243 | parts of the aggregate. 244 | 245 | 6. Conveying Non-Source Forms. 246 | 247 | You may convey a covered work in object code form under the terms 248 | of sections 4 and 5, provided that you also convey the 249 | machine-readable Corresponding Source under the terms of this License, 250 | in one of these ways: 251 | 252 | a) Convey the object code in, or embodied in, a physical product 253 | (including a physical distribution medium), accompanied by the 254 | Corresponding Source fixed on a durable physical medium 255 | customarily used for software interchange. 256 | 257 | b) Convey the object code in, or embodied in, a physical product 258 | (including a physical distribution medium), accompanied by a 259 | written offer, valid for at least three years and valid for as 260 | long as you offer spare parts or customer support for that product 261 | model, to give anyone who possesses the object code either (1) a 262 | copy of the Corresponding Source for all the software in the 263 | product that is covered by this License, on a durable physical 264 | medium customarily used for software interchange, for a price no 265 | more than your reasonable cost of physically performing this 266 | conveying of source, or (2) access to copy the 267 | Corresponding Source from a network server at no charge. 268 | 269 | c) Convey individual copies of the object code with a copy of the 270 | written offer to provide the Corresponding Source. This 271 | alternative is allowed only occasionally and noncommercially, and 272 | only if you received the object code with such an offer, in accord 273 | with subsection 6b. 274 | 275 | d) Convey the object code by offering access from a designated 276 | place (gratis or for a charge), and offer equivalent access to the 277 | Corresponding Source in the same way through the same place at no 278 | further charge. You need not require recipients to copy the 279 | Corresponding Source along with the object code. If the place to 280 | copy the object code is a network server, the Corresponding Source 281 | may be on a different server (operated by you or a third party) 282 | that supports equivalent copying facilities, provided you maintain 283 | clear directions next to the object code saying where to find the 284 | Corresponding Source. Regardless of what server hosts the 285 | Corresponding Source, you remain obligated to ensure that it is 286 | available for as long as needed to satisfy these requirements. 287 | 288 | e) Convey the object code using peer-to-peer transmission, provided 289 | you inform other peers where the object code and Corresponding 290 | Source of the work are being offered to the general public at no 291 | charge under subsection 6d. 292 | 293 | A separable portion of the object code, whose source code is excluded 294 | from the Corresponding Source as a System Library, need not be 295 | included in conveying the object code work. 296 | 297 | A "User Product" is either (1) a "consumer product", which means any 298 | tangible personal property which is normally used for personal, family, 299 | or household purposes, or (2) anything designed or sold for incorporation 300 | into a dwelling. In determining whether a product is a consumer product, 301 | doubtful cases shall be resolved in favor of coverage. For a particular 302 | product received by a particular user, "normally used" refers to a 303 | typical or common use of that class of product, regardless of the status 304 | of the particular user or of the way in which the particular user 305 | actually uses, or expects or is expected to use, the product. A product 306 | is a consumer product regardless of whether the product has substantial 307 | commercial, industrial or non-consumer uses, unless such uses represent 308 | the only significant mode of use of the product. 309 | 310 | "Installation Information" for a User Product means any methods, 311 | procedures, authorization keys, or other information required to install 312 | and execute modified versions of a covered work in that User Product from 313 | a modified version of its Corresponding Source. The information must 314 | suffice to ensure that the continued functioning of the modified object 315 | code is in no case prevented or interfered with solely because 316 | modification has been made. 317 | 318 | If you convey an object code work under this section in, or with, or 319 | specifically for use in, a User Product, and the conveying occurs as 320 | part of a transaction in which the right of possession and use of the 321 | User Product is transferred to the recipient in perpetuity or for a 322 | fixed term (regardless of how the transaction is characterized), the 323 | Corresponding Source conveyed under this section must be accompanied 324 | by the Installation Information. But this requirement does not apply 325 | if neither you nor any third party retains the ability to install 326 | modified object code on the User Product (for example, the work has 327 | been installed in ROM). 328 | 329 | The requirement to provide Installation Information does not include a 330 | requirement to continue to provide support service, warranty, or updates 331 | for a work that has been modified or installed by the recipient, or for 332 | the User Product in which it has been modified or installed. Access to a 333 | network may be denied when the modification itself materially and 334 | adversely affects the operation of the network or violates the rules and 335 | protocols for communication across the network. 336 | 337 | Corresponding Source conveyed, and Installation Information provided, 338 | in accord with this section must be in a format that is publicly 339 | documented (and with an implementation available to the public in 340 | source code form), and must require no special password or key for 341 | unpacking, reading or copying. 342 | 343 | 7. Additional Terms. 344 | 345 | "Additional permissions" are terms that supplement the terms of this 346 | License by making exceptions from one or more of its conditions. 347 | Additional permissions that are applicable to the entire Program shall 348 | be treated as though they were included in this License, to the extent 349 | that they are valid under applicable law. If additional permissions 350 | apply only to part of the Program, that part may be used separately 351 | under those permissions, but the entire Program remains governed by 352 | this License without regard to the additional permissions. 353 | 354 | When you convey a copy of a covered work, you may at your option 355 | remove any additional permissions from that copy, or from any part of 356 | it. (Additional permissions may be written to require their own 357 | removal in certain cases when you modify the work.) You may place 358 | additional permissions on material, added by you to a covered work, 359 | for which you have or can give appropriate copyright permission. 360 | 361 | Notwithstanding any other provision of this License, for material you 362 | add to a covered work, you may (if authorized by the copyright holders of 363 | that material) supplement the terms of this License with terms: 364 | 365 | a) Disclaiming warranty or limiting liability differently from the 366 | terms of sections 15 and 16 of this License; or 367 | 368 | b) Requiring preservation of specified reasonable legal notices or 369 | author attributions in that material or in the Appropriate Legal 370 | Notices displayed by works containing it; or 371 | 372 | c) Prohibiting misrepresentation of the origin of that material, or 373 | requiring that modified versions of such material be marked in 374 | reasonable ways as different from the original version; or 375 | 376 | d) Limiting the use for publicity purposes of names of licensors or 377 | authors of the material; or 378 | 379 | e) Declining to grant rights under trademark law for use of some 380 | trade names, trademarks, or service marks; or 381 | 382 | f) Requiring indemnification of licensors and authors of that 383 | material by anyone who conveys the material (or modified versions of 384 | it) with contractual assumptions of liability to the recipient, for 385 | any liability that these contractual assumptions directly impose on 386 | those licensors and authors. 387 | 388 | All other non-permissive additional terms are considered "further 389 | restrictions" within the meaning of section 10. If the Program as you 390 | received it, or any part of it, contains a notice stating that it is 391 | governed by this License along with a term that is a further 392 | restriction, you may remove that term. If a license document contains 393 | a further restriction but permits relicensing or conveying under this 394 | License, you may add to a covered work material governed by the terms 395 | of that license document, provided that the further restriction does 396 | not survive such relicensing or conveying. 397 | 398 | If you add terms to a covered work in accord with this section, you 399 | must place, in the relevant source files, a statement of the 400 | additional terms that apply to those files, or a notice indicating 401 | where to find the applicable terms. 402 | 403 | Additional terms, permissive or non-permissive, may be stated in the 404 | form of a separately written license, or stated as exceptions; 405 | the above requirements apply either way. 406 | 407 | 8. Termination. 408 | 409 | You may not propagate or modify a covered work except as expressly 410 | provided under this License. Any attempt otherwise to propagate or 411 | modify it is void, and will automatically terminate your rights under 412 | this License (including any patent licenses granted under the third 413 | paragraph of section 11). 414 | 415 | However, if you cease all violation of this License, then your 416 | license from a particular copyright holder is reinstated (a) 417 | provisionally, unless and until the copyright holder explicitly and 418 | finally terminates your license, and (b) permanently, if the copyright 419 | holder fails to notify you of the violation by some reasonable means 420 | prior to 60 days after the cessation. 421 | 422 | Moreover, your license from a particular copyright holder is 423 | reinstated permanently if the copyright holder notifies you of the 424 | violation by some reasonable means, this is the first time you have 425 | received notice of violation of this License (for any work) from that 426 | copyright holder, and you cure the violation prior to 30 days after 427 | your receipt of the notice. 428 | 429 | Termination of your rights under this section does not terminate the 430 | licenses of parties who have received copies or rights from you under 431 | this License. If your rights have been terminated and not permanently 432 | reinstated, you do not qualify to receive new licenses for the same 433 | material under section 10. 434 | 435 | 9. Acceptance Not Required for Having Copies. 436 | 437 | You are not required to accept this License in order to receive or 438 | run a copy of the Program. Ancillary propagation of a covered work 439 | occurring solely as a consequence of using peer-to-peer transmission 440 | to receive a copy likewise does not require acceptance. However, 441 | nothing other than this License grants you permission to propagate or 442 | modify any covered work. These actions infringe copyright if you do 443 | not accept this License. Therefore, by modifying or propagating a 444 | covered work, you indicate your acceptance of this License to do so. 445 | 446 | 10. Automatic Licensing of Downstream Recipients. 447 | 448 | Each time you convey a covered work, the recipient automatically 449 | receives a license from the original licensors, to run, modify and 450 | propagate that work, subject to this License. You are not responsible 451 | for enforcing compliance by third parties with this License. 452 | 453 | An "entity transaction" is a transaction transferring control of an 454 | organization, or substantially all assets of one, or subdividing an 455 | organization, or merging organizations. If propagation of a covered 456 | work results from an entity transaction, each party to that 457 | transaction who receives a copy of the work also receives whatever 458 | licenses to the work the party's predecessor in interest had or could 459 | give under the previous paragraph, plus a right to possession of the 460 | Corresponding Source of the work from the predecessor in interest, if 461 | the predecessor has it or can get it with reasonable efforts. 462 | 463 | You may not impose any further restrictions on the exercise of the 464 | rights granted or affirmed under this License. For example, you may 465 | not impose a license fee, royalty, or other charge for exercise of 466 | rights granted under this License, and you may not initiate litigation 467 | (including a cross-claim or counterclaim in a lawsuit) alleging that 468 | any patent claim is infringed by making, using, selling, offering for 469 | sale, or importing the Program or any portion of it. 470 | 471 | 11. Patents. 472 | 473 | A "contributor" is a copyright holder who authorizes use under this 474 | License of the Program or a work on which the Program is based. The 475 | work thus licensed is called the contributor's "contributor version". 476 | 477 | A contributor's "essential patent claims" are all patent claims 478 | owned or controlled by the contributor, whether already acquired or 479 | hereafter acquired, that would be infringed by some manner, permitted 480 | by this License, of making, using, or selling its contributor version, 481 | but do not include claims that would be infringed only as a 482 | consequence of further modification of the contributor version. For 483 | purposes of this definition, "control" includes the right to grant 484 | patent sublicenses in a manner consistent with the requirements of 485 | this License. 486 | 487 | Each contributor grants you a non-exclusive, worldwide, royalty-free 488 | patent license under the contributor's essential patent claims, to 489 | make, use, sell, offer for sale, import and otherwise run, modify and 490 | propagate the contents of its contributor version. 491 | 492 | In the following three paragraphs, a "patent license" is any express 493 | agreement or commitment, however denominated, not to enforce a patent 494 | (such as an express permission to practice a patent or covenant not to 495 | sue for patent infringement). To "grant" such a patent license to a 496 | party means to make such an agreement or commitment not to enforce a 497 | patent against the party. 498 | 499 | If you convey a covered work, knowingly relying on a patent license, 500 | and the Corresponding Source of the work is not available for anyone 501 | to copy, free of charge and under the terms of this License, through a 502 | publicly available network server or other readily accessible means, 503 | then you must either (1) cause the Corresponding Source to be so 504 | available, or (2) arrange to deprive yourself of the benefit of the 505 | patent license for this particular work, or (3) arrange, in a manner 506 | consistent with the requirements of this License, to extend the patent 507 | license to downstream recipients. "Knowingly relying" means you have 508 | actual knowledge that, but for the patent license, your conveying the 509 | covered work in a country, or your recipient's use of the covered work 510 | in a country, would infringe one or more identifiable patents in that 511 | country that you have reason to believe are valid. 512 | 513 | If, pursuant to or in connection with a single transaction or 514 | arrangement, you convey, or propagate by procuring conveyance of, a 515 | covered work, and grant a patent license to some of the parties 516 | receiving the covered work authorizing them to use, propagate, modify 517 | or convey a specific copy of the covered work, then the patent license 518 | you grant is automatically extended to all recipients of the covered 519 | work and works based on it. 520 | 521 | A patent license is "discriminatory" if it does not include within 522 | the scope of its coverage, prohibits the exercise of, or is 523 | conditioned on the non-exercise of one or more of the rights that are 524 | specifically granted under this License. You may not convey a covered 525 | work if you are a party to an arrangement with a third party that is 526 | in the business of distributing software, under which you make payment 527 | to the third party based on the extent of your activity of conveying 528 | the work, and under which the third party grants, to any of the 529 | parties who would receive the covered work from you, a discriminatory 530 | patent license (a) in connection with copies of the covered work 531 | conveyed by you (or copies made from those copies), or (b) primarily 532 | for and in connection with specific products or compilations that 533 | contain the covered work, unless you entered into that arrangement, 534 | or that patent license was granted, prior to 28 March 2007. 535 | 536 | Nothing in this License shall be construed as excluding or limiting 537 | any implied license or other defenses to infringement that may 538 | otherwise be available to you under applicable patent law. 539 | 540 | 12. No Surrender of Others' Freedom. 541 | 542 | If conditions are imposed on you (whether by court order, agreement or 543 | otherwise) that contradict the conditions of this License, they do not 544 | excuse you from the conditions of this License. If you cannot convey a 545 | covered work so as to satisfy simultaneously your obligations under this 546 | License and any other pertinent obligations, then as a consequence you may 547 | not convey it at all. For example, if you agree to terms that obligate you 548 | to collect a royalty for further conveying from those to whom you convey 549 | the Program, the only way you could satisfy both those terms and this 550 | License would be to refrain entirely from conveying the Program. 551 | 552 | 13. Use with the GNU Affero General Public License. 553 | 554 | Notwithstanding any other provision of this License, you have 555 | permission to link or combine any covered work with a work licensed 556 | under version 3 of the GNU Affero General Public License into a single 557 | combined work, and to convey the resulting work. The terms of this 558 | License will continue to apply to the part which is the covered work, 559 | but the special requirements of the GNU Affero General Public License, 560 | section 13, concerning interaction through a network will apply to the 561 | combination as such. 562 | 563 | 14. Revised Versions of this License. 564 | 565 | The Free Software Foundation may publish revised and/or new versions of 566 | the GNU General Public License from time to time. Such new versions will 567 | be similar in spirit to the present version, but may differ in detail to 568 | address new problems or concerns. 569 | 570 | Each version is given a distinguishing version number. If the 571 | Program specifies that a certain numbered version of the GNU General 572 | Public License "or any later version" applies to it, you have the 573 | option of following the terms and conditions either of that numbered 574 | version or of any later version published by the Free Software 575 | Foundation. If the Program does not specify a version number of the 576 | GNU General Public License, you may choose any version ever published 577 | by the Free Software Foundation. 578 | 579 | If the Program specifies that a proxy can decide which future 580 | versions of the GNU General Public License can be used, that proxy's 581 | public statement of acceptance of a version permanently authorizes you 582 | to choose that version for the Program. 583 | 584 | Later license versions may give you additional or different 585 | permissions. However, no additional obligations are imposed on any 586 | author or copyright holder as a result of your choosing to follow a 587 | later version. 588 | 589 | 15. Disclaimer of Warranty. 590 | 591 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY 592 | APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT 593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY 594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, 595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 596 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM 597 | IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF 598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 599 | 600 | 16. Limitation of Liability. 601 | 602 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING 603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS 604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY 605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE 606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF 607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD 608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), 609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF 610 | SUCH DAMAGES. 611 | 612 | 17. Interpretation of Sections 15 and 16. 613 | 614 | If the disclaimer of warranty and limitation of liability provided 615 | above cannot be given local legal effect according to their terms, 616 | reviewing courts shall apply local law that most closely approximates 617 | an absolute waiver of all civil liability in connection with the 618 | Program, unless a warranty or assumption of liability accompanies a 619 | copy of the Program in return for a fee. 620 | 621 | END OF TERMS AND CONDITIONS 622 | 623 | How to Apply These Terms to Your New Programs 624 | 625 | If you develop a new program, and you want it to be of the greatest 626 | possible use to the public, the best way to achieve this is to make it 627 | free software which everyone can redistribute and change under these terms. 628 | 629 | To do so, attach the following notices to the program. It is safest 630 | to attach them to the start of each source file to most effectively 631 | state the exclusion of warranty; and each file should have at least 632 | the "copyright" line and a pointer to where the full notice is found. 633 | 634 | 635 | Copyright (C) 636 | 637 | This program is free software: you can redistribute it and/or modify 638 | it under the terms of the GNU General Public License as published by 639 | the Free Software Foundation, either version 3 of the License, or 640 | (at your option) any later version. 641 | 642 | This program is distributed in the hope that it will be useful, 643 | but WITHOUT ANY WARRANTY; without even the implied warranty of 644 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 645 | GNU General Public License for more details. 646 | 647 | You should have received a copy of the GNU General Public License 648 | along with this program. If not, see . 649 | 650 | Also add information on how to contact you by electronic and paper mail. 651 | 652 | If the program does terminal interaction, make it output a short 653 | notice like this when it starts in an interactive mode: 654 | 655 | Copyright (C) 656 | This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. 657 | This is free software, and you are welcome to redistribute it 658 | under certain conditions; type `show c' for details. 659 | 660 | The hypothetical commands `show w' and `show c' should show the appropriate 661 | parts of the General Public License. Of course, your program's commands 662 | might be different; for a GUI interface, you would use an "about box". 663 | 664 | You should also get your employer (if you work as a programmer) or school, 665 | if any, to sign a "copyright disclaimer" for the program, if necessary. 666 | For more information on this, and how to apply and follow the GNU GPL, see 667 | . 668 | 669 | The GNU General Public License does not permit incorporating your program 670 | into proprietary programs. If your program is a subroutine library, you 671 | may consider it more useful to permit linking proprietary applications with 672 | the library. If this is what you want to do, use the GNU Lesser General 673 | Public License instead of this License. But first, please read 674 | . 675 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # buildkernel 2 | A tool to build a secure-boot EFI stub kernel, and save it to the EFI system partition. 3 | 4 | > 31 Oct 2020: sadly, due to legal obligations arising from a recent change in my 'real world' job, I must announce I am **standing down as maintainer of this project with immediate effect**. For the meantime, I will leave the repo up (for historical interest, and it may be of use to others); however, I plan no further updates, nor will I be accepting / actioning further pull requests or bug reports from this point. Email requests for support will also have to be politely declined, so, **please treat this as an effective EOL notice**.

For further details, please see my post [here](https://forums.gentoo.org/viewtopic-p-8522963.html#8522963).

With sincere apologies, sakaki >< 5 | 6 | ## Description 7 | **buildkernel** is a script that builds a Gentoo Linux EFI stub kernel which is suitable for booting from a USB key using UEFI (no additional bootloader required). It makes use of the initramfs creation tools (and early userspace **init**(8) script) provided by **genkernel**(8). 8 | 9 | Specifically, the assumed use-case for buildkernel is where you are creating a kernel for use in a dual-factor-authenticated LVM-over-LUKS system, booting from an external USB key, with secure boot enabled (using UEFI), where you may (optionally) wish to use the **plymouth**(8) splash manager, and where the target (final) init system is **systemd**(1). 10 | 11 | > Note: as of version 1.0.11, **OpenRC**(8) init is also supported. 12 | 13 | To facilitate this, **buildkernel** will create a statically linked version of **gpg**(1) — one which furthermore does not require pinentry — and include this in the initramfs. 14 | 15 | It will also automatically set the necessary kernel configuration parameters, including the command line, sign the resulting kernel if possible, then update the EFI boot list if required. 16 | 17 | The **buildkernel** utility can be invoked in non-interactive (default) or interactive mode (see the **--ask** option, in the manpage). Non-interactive mode is suitable for use in a scripted invocation. 18 | 19 | Certain key options can be specified via the configuration file, _/etc/buildkernel.conf_: see **buildkernel.conf**(5) for details. 20 | 21 | Although **buildkernel** is targetted primarily at the use-case where the EFI system partition is on a removable USB key (for security), it can also be used with a system partition on a fixed drive. 22 | 23 | ## Installation 24 | 25 | **buildkernel** is best installed (on Gentoo) via its ebuild, available as part of the **sakaki-tools** [overlay](https://github.com/sakaki-/sakaki-tools). 26 | Full instructions are provided as part of the [**Sakaki's EFI Install Guide**](https://wiki.gentoo.org/wiki/Sakaki's_EFI_Install_Guide) tutorial, on the Gentoo wiki. 27 | 28 | In particular, see [this section](https://wiki.gentoo.org/wiki/Sakaki's_EFI_Install_Guide/Configuring_and_Building_the_Kernel#What_the_buildkernel_Script_Does_.28Background_Reading.29) for a detailed description of what **buildkernel** does, and why. 29 | -------------------------------------------------------------------------------- /buildkernel: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # 3 | # Build kernel, modules and initial ramdisk in correct sequence, ensuring kernel 4 | # config is conformed, then sign if possible and copy to EFI boot partition. 5 | # 6 | # Copyright (c) 2014-2020 sakaki 7 | # 8 | # License (GPL v3.0) 9 | # ------------------ 10 | # 11 | # This program is free software: you can redistribute it and/or modify 12 | # it under the terms of the GNU General Public License as published by 13 | # the Free Software Foundation, either version 3 of the License, or 14 | # (at your option) any later version. 15 | # 16 | # This program is distributed in the hope that it will be useful, 17 | # but WITHOUT ANY WARRANTY; without even the implied warranty of 18 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 19 | # GNU General Public License for more details. 20 | # 21 | # You should have received a copy of the GNU General Public License 22 | # along with this program. If not, see . 23 | # 24 | 25 | set -e 26 | set -u 27 | shopt -s nullglob 28 | 29 | # Scroll to the bottom of this script to follow the main program flow. 30 | 31 | # ********************** variables ********************* 32 | PROGNAME="$(basename "${0}")" 33 | CONFFILE="/etc/${PROGNAME}.conf" 34 | VERSION="1.0.37" 35 | ETCPROFILE="/etc/profile" 36 | DEFAULTEFIBOOTFILE="bootx64.efi" 37 | EFIBOOTFILE="${DEFAULTEFIBOOTFILE}" 38 | LINUXDIR="/usr/src/linux" 39 | NEWVERSION="" 40 | INITRAMFSNAME="" 41 | VMLINUZNAME="" 42 | CURRENTVERSION="linux-$(uname -r)" 43 | CURRENTCONFIG="/proc/config.gz" 44 | TARGETCONFIG="" 45 | BOOTDIR="/boot" 46 | EFIROOTDIR="${BOOTDIR}/efi" 47 | DEFAULTEFIBOOTDIR="/EFI/Boot" 48 | EFIBOOTDIR="${DEFAULTEFIBOOTDIR}" 49 | FULLEFIBOOTDIR="${EFIROOTDIR}${EFIBOOTDIR}" 50 | EFICONFIGFILE="config" 51 | OLDSUFFIX=".old" 52 | PARTUUIDDEVDIR="/dev/disk/by-partuuid" 53 | DISKIDDEVDIR="/dev/disk/by-id" 54 | IDDEVDIR="/dev/disk/by-id" 55 | DEFAULTLUKSKEYFILE="luks-key.gpg" 56 | LUKSKEYFILE="${DEFAULTLUKSKEYFILE}" 57 | MODPROBEDIR="/etc/modprobe.d" 58 | CMDLINE_ROOT="/dev/ram0" 59 | SYSTEMD_INIT="/usr/lib/systemd/systemd" 60 | SYSTEMD_NEW_INIT="/lib/systemd/systemd" 61 | OPENRC_INIT="/sbin/init" 62 | if [[ -e "${SYSTEMD_NEW_INIT}" ]]; then 63 | # new path exists, so use it 64 | CMDLINE_REAL_INIT="${SYSTEMD_NEW_INIT}" 65 | else 66 | # fallback for older systems 67 | CMDLINE_REAL_INIT="${SYSTEMD_INIT}" 68 | fi 69 | SECUREBOOTKEY="/etc/efikeys/db.key" 70 | SECUREBOOTCERT="/etc/efikeys/db.crt" 71 | SIGNEDSUFFIX=".signed" 72 | ADDITIONALKERNELCMDS="" 73 | ADDITIONALGENKERNELOPTS="--all-ramdisk-modules --firmware" 74 | CMDLINE_REAL_ROOT="/dev/mapper/vg1-root" 75 | CMDLINE_REAL_RESUME="/dev/mapper/vg1-swap" 76 | declare -i DEFAULTCREATEEFIBOOT=1 77 | declare -i CREATEEFIBOOT="${DEFAULTCREATEEFIBOOT}" 78 | declare -i DEFAULTCOMPRESSINITRAMFS=1 79 | declare -i COMPRESSINITRAMFS="${DEFAULTCOMPRESSINITRAMFS}" 80 | declare -i DISABLE_SUSPEND=0 81 | declare -i DISABLE_HIBERNATION=0 82 | declare -i DISABLE_LVM=0 83 | # you can use xconfig etc if you like - override in /etc/buildkernel.conf 84 | CONFIGTYPE="menuconfig" 85 | # following should already be in the environment; but to be safe... 86 | export NUMCPUS=$(grep -E 'processor\s+:' /proc/cpuinfo | wc -l) 87 | export NUMCPUSPLUSONE=$(( NUMCPUS + 1 )) 88 | export MAKEOPTS="${MAKEOPTS--j${NUMCPUSPLUSONE} -l${NUMCPUS}}" 89 | export EMERGE_DEFAULT_OPTS="${EMERGE_DEFAULT_OPTS---jobs=${NUMCPUSPLUSONE} --load-average=${NUMCPUS}}" 90 | # below silently updates an old config, auto-choosing defaults for new values 91 | CONFIGUPDATETYPE="olddefconfig" 92 | SILENTUPDATETYPE="olddefconfig" 93 | RED_TEXT="" GREEN_TEXT="" YELLOW_TEXT="" RESET_ATTS="" ALERT_TEXT="" 94 | if [[ -v TERM && -n "${TERM}" && "${TERM}" != "dumb" ]]; then 95 | RED_TEXT="$(tput setaf 1)$(tput bold)" 96 | GREEN_TEXT="$(tput setaf 2)$(tput bold)" 97 | YELLOW_TEXT="$(tput setaf 3)$(tput bold)" 98 | RESET_ATTS="$(tput sgr0)" 99 | ALERT_TEXT="$(tput bel)" 100 | fi 101 | # used in subshells 102 | UNCOMPRESSEDINITRAMFS="${BOOTDIR}/initramfs.cpio" 103 | INITRAMFSDIR="${BOOTDIR}/initramfs" 104 | VERBOSITY=1 105 | PREFIXSTRING="* " 106 | SHOWPREFIX="${GREEN_TEXT}${PREFIXSTRING}${RESET_ATTS}" 107 | SHOWSUFFIX="" 108 | GPG1PATHFROM="/usr/bin/staticgpg" 109 | GPG1PATHTO="${INITRAMFSDIR}/usr/bin/gpg" 110 | GPGBUILDDIR="/root/tmpgpgbuild" 111 | TMPGPGPATH="${GPGBUILDDIR}/usr/bin/gpg" 112 | declare -i USINGUSBKEYFOREFI=0 113 | declare -i BACKUPOLDKERNEL=1 114 | declare -i BUILT_EXTERNAL_MODULES=1 115 | 116 | EFIPARTNAME="EFI boot partition" 117 | DEFAULTKEYMAP="us" 118 | KEYMAP="${DEFAULTKEYMAP}" 119 | # leave blank if you don't want to use the plymouth graphical boot 120 | # manager, otherwise override to a theme of your choice, such as "text" or 121 | # "solar" 122 | DEFAULTPLYMOUTHTHEME="" 123 | PLYMOUTHTHEME="${DEFAULTPLYMOUTHTHEME}" 124 | # default init system supported by this script is systemd, but we now 125 | # also support OpenRC 126 | DEFAULTINITSYSTEM="systemd" 127 | INITSYSTEM="${DEFAULTINITSYSTEM}" 128 | # following variable is conformed on installation by ebuild 129 | # (to reflect setting of "plymouth" USE flag) 130 | USE_PLYMOUTH=true 131 | VERBOSITYFLAG="" 132 | ASKFLAG="" 133 | ALERTFLAG="" 134 | PORTAGEINFO="" 135 | MAKE="" 136 | # following array variables set by find_all_gpg_keyfile_partitions function 137 | declare -a GPGUUIDS GPGPARTNAMES GPGDEVNAMES GPGPARTNUMS 138 | # following array variables set by find_all_luks_partitions function 139 | declare -a LUKSUUIDS LUKSPARTNAMES LUKSDEVNAMES LUKSPARTNUMS 140 | declare -a LUKSONUSBS 141 | # following array variables set by find_all_efi_system_partitions function 142 | declare -a EFIUUIDS EFIPARTNAMES EFIDEVNAMES EFIPARTNUMS 143 | declare -a EFIONUSBS 144 | # following array variables set by find_all_efi_boot_entries 145 | # (held in boot index order, NOT boot order) 146 | declare -a EBOOTIDS EBOOTNAMES EBOOTPATHS EBOOTUUIDS 147 | declare -a EBOOTISACTIVES EBOOTORDER 148 | declare -i EFIBOOTENTRIESSEARCHED=0 149 | # stores whether boot entry is for Windows or not, keyed by partition UUID 150 | declare -A HASWINBOOTLOADER 151 | # map between BOOT ID (a 4 digit hex string) and index in EBOOT... arrays 152 | declare -A EBOOTIDTOINDEX 153 | # used to unwind mountpoints on failure 154 | declare -A ALLMOUNTS 155 | # has a '1' entry for all USB partitions; set by find_all_usb_partitions 156 | declare -A ISUSBPART 157 | # used by menu-driven config setting 158 | declare -i CONFIGDIRTY=0 159 | # set if CRYPTPATHMAP declared in config file 160 | declare -i CRYPTPATHMAPFORCED=0 161 | # archived prior versions of key config variables 162 | PROCVARS=("EFIPARTUUID" "CRYPTPARTUUID" "KEYFILEPARTUUID" "LUKSKEYFILE" \ 163 | "EFIBOOTDIR" "EFIBOOTFILE" "PLYMOUTHTHEME" "KEYMAP" "INITSYSTEM") 164 | NEXTVAR="" 165 | for NEXTVAR in "${PROCVARS[@]}"; do 166 | declare "OLD_${NEXTVAR}"="" 167 | done 168 | 169 | # running under EFI? 170 | declare -i USINGEFI=0 171 | # efivarfs mounted ro on entry? (OpenRC does, systemd doesn't) 172 | declare -i ONENTRYROEFIVARFS=0 173 | # and subsequently remounted rw? 174 | declare -i EFIVARFSREMOUNTEDRW=0 175 | 176 | # has support for kernel modules 177 | declare -i USINGMODULES=1 178 | 179 | declare -i MOUNTEDONENTRY=0 180 | declare -i DOUNMOUNT=1 181 | # program arguments (booleans in this case) 182 | declare -i ARG_ASK=0 ARG_CLEAN=0 ARG_COPYFROMSTAGING=0 ARG_HELP=0 183 | declare -i ARG_STAGEONLY=0 ARG_UNMOUNTATEND=0 ARG_VERBOSE=0 ARG_VERSION=0 184 | declare -i ARG_POSTCLEAR=0 ARG_MENUCONFIG=0 ARG_SNAPSHOTBACKUP=0 185 | declare -i ARG_EASYSETUP=0 ARG_IS_NEW_KERNEL_AVAILABLE=0 186 | declare -i ARG_REBUILD_EXTERNAL_MODULES=0 ARG_ALERT=0 187 | # non-boolean arguments 188 | declare -i ADJUSTMENT=19 189 | 190 | # ***************** various functions ****************** 191 | cleanup_and_exit_with_code() { 192 | # add any additional cleanup code here 193 | set +e 194 | trap - EXIT 195 | umount_all_remembered_mountpoints 196 | restore_efivarfs_mount_state 197 | exit $1 198 | } 199 | fn_exists() { 200 | declare -f -F "${1}" > /dev/null 201 | return $? 202 | } 203 | show() { 204 | local MESSAGE=${1:-""} 205 | local VERBLEVEL=${2:-${VERBOSITY}} 206 | if (( VERBLEVEL >=1 )); then 207 | echo -e "${SHOWPREFIX}${MESSAGE}${SHOWSUFFIX}" 208 | fi 209 | } 210 | alertshow() { 211 | local MESSAGE=${1:-""} 212 | local VERBLEVEL=${2:-${VERBOSITY}} 213 | if ((ARG_ALERT==0)); then 214 | show "${@}" 215 | elif (( VERBLEVEL >=1 )); then 216 | echo -e "${SHOWPREFIX}${MESSAGE}${SHOWSUFFIX}${ALERT_TEXT}" 217 | fi 218 | } 219 | warning() { 220 | echo -e "${YELLOW_TEXT}${PREFIXSTRING}${RESET_ATTS}${PROGNAME}: Warning: ${1}" >&2 221 | } 222 | die() { 223 | echo 224 | echo -e "${RED_TEXT}${PREFIXSTRING}${RESET_ATTS}${PROGNAME}: Error: ${1} - exiting" >&2 225 | cleanup_and_exit_with_code 1 226 | } 227 | trap_cleanup() { 228 | trap - SIGHUP SIGQUIT SIGINT SIGTERM SIGKILL EXIT 229 | die "Caught signal" 230 | } 231 | trap trap_cleanup SIGHUP SIGQUIT SIGINT SIGTERM SIGKILL EXIT 232 | test_yn() { 233 | echo -n -e "${SHOWPREFIX}${1} (y/n)? ${SHOWSUFFIX}${ALERT_TEXT}" 234 | read -r -n 1 235 | echo 236 | if [[ ${REPLY} =~ ^[Yy]$ ]]; then 237 | return 0 238 | else 239 | return 1 240 | fi 241 | } 242 | test_yn_need_enter() { 243 | echo -n -e "${SHOWPREFIX}${1} (y/n)? ${SHOWSUFFIX}${ALERT_TEXT}" 244 | read -r 245 | echo 246 | if [[ ${REPLY} =~ ^[Yy]$ ]]; then 247 | return 0 248 | else 249 | return 1 250 | fi 251 | } 252 | continue_yn() { 253 | if ! test_yn "${1}"; then 254 | echo -e "${RED_TEXT}${PREFIXSTRING}${RESET_ATTS}Quitting" >&2 255 | cleanup_and_exit_with_code 1 256 | fi 257 | } 258 | suppress_colours() { 259 | RED_TEXT="" 260 | GREEN_TEXT="" 261 | YELLOW_TEXT="" 262 | RESET_ATTS="" 263 | SHOWPREFIX="${PREFIXSTRING}" 264 | } 265 | suppress_alert() { 266 | ALERT_TEXT="" 267 | } 268 | suppress_colour_and_alert_if_output_not_to_a_terminal() { 269 | if [ ! -t 1 -o ! -t 2 ]; then 270 | # we are going to a non-terminal 271 | suppress_colours 272 | suppress_alert 273 | fi 274 | } 275 | check_file_exists() { 276 | if [ ! -f "${1}" ]; then 277 | die "File '${1}' does not exist" 278 | fi 279 | } 280 | read_portage_info_if_necessary() { 281 | if [ -z "${PORTAGEINFO}" ]; then 282 | show "Checking Portage configuration, please wait..." 283 | PORTAGEINFO="$(emerge --info)" 284 | fi 285 | } 286 | extract_kernel_release_name() { 287 | # extract the kernel release string, and setup the derived strings 288 | # NB we now check kernelrelease, not kernelversion; it is possible that 289 | # the kernelrelease may change during the build (e.g., by a 'clean' 290 | # tagged release directory becoming marked 'dirty', and so having a '+' 291 | # sign appended) 292 | # LINUXBUILDDIR must be defined and non-blank on entry 293 | NEWVERSION="linux-$(cd "${LINUXBUILDDIR}" && make -s kernelrelease)" 294 | INITRAMFSNAME="$(echo $NEWVERSION | sed "s/linux/initramfs-genkernel-x86_64/")" 295 | VMLINUZNAME="$(echo $NEWVERSION | sed "s/linux/vmlinuz/")" 296 | } 297 | check_gcc_config_and_reset_if_necessary() { 298 | # check if gcc-config exists with an error - if it does, then 299 | # attempt to set one based on the current gcc version number 300 | if ! gcc-config --get-current-profile >/dev/null 2>&1; then 301 | # unset or invalid, attempt to force this to the current gcc 302 | # version 303 | read_portage_info_if_necessary 304 | local CHOST="$(grep '^CHOST=.*' <<<"${PORTAGEINFO}")" 305 | CHOST="$(cut -d\" -f2 <<< ${CHOST})" 306 | local GCC_VERSION="" 307 | # can't be sure we have eix installed 308 | if eix --version >/dev/null 2>&1; then 309 | # we do, so can cleanly check latest installed gcc version 310 | GCC_VERSION="$(eix --installed --exact sys-devel/gcc --format '' --versionsort | tail -n 1)" 311 | GCC_VERSION="${GCC_VERSION##*gcc-}" 312 | else 313 | # we don't, have to hack the most recent gcc version 314 | GCC_VERSION="$(ls -1v "/usr/${CHOST}/gcc-bin" | tail -n 1)" 315 | fi 316 | local FULL_GCC_ID="${CHOST}-${GCC_VERSION}" 317 | if gcc-config "${FULL_GCC_ID}"; then 318 | warning "gcc configuration was reset" 319 | if [ -s "${ETCPROFILE}" ]; then 320 | set +e 321 | set +u 322 | shopt -u nullglob 323 | source "${ETCPROFILE}" 324 | shopt -s nullglob 325 | set -e 326 | set -u 327 | fi 328 | else 329 | die "failed to set gcc configuration" 330 | fi 331 | fi 332 | } 333 | mount_and_remember() { 334 | local DEVPATH="${1}" 335 | local MOUNTPOINT="${2}" 336 | local TYPE=${3:-""} 337 | 338 | if [[ "${ALLMOUNTS[${MOUNTPOINT}]+_}" ]]; then 339 | warning "Attempt to mount '${MOUNTPOINT}' more than once" 340 | else 341 | if [ -n "${TYPE}" ]; then 342 | mount -t "${TYPE}" "${DEVPATH}" "${MOUNTPOINT}" 343 | else 344 | mount "${DEVPATH}" "${MOUNTPOINT}" 345 | fi 346 | # and remember we mounted it 347 | ALLMOUNTS["${MOUNTPOINT}"]="${DEVPATH}" 348 | fi 349 | } 350 | umount_and_forget() { 351 | local MOUNTPOINT="${1}" 352 | if [[ "${ALLMOUNTS[${MOUNTPOINT}]+_}" ]]; then 353 | umount --lazy "${MOUNTPOINT}" 354 | # and forget 355 | unset -v "ALLMOUNTS[${MOUNTPOINT}]" 356 | else 357 | warning "Attempt to unmount '${MOUNTPOINT}', but not mounted" 358 | fi 359 | } 360 | umount_all_remembered_mountpoints() { 361 | local M ALLREMEMBEREDMOUNTS="${!ALLMOUNTS[@]}" 362 | for M in ${ALLREMEMBEREDMOUNTS}; do 363 | if (( DOUNMOUNT == 1 )) || [[ "${M}" != "${EFIROOTDIR}" ]]; then 364 | warning "Unmounting '${M}'" 365 | umount_and_forget "${M}" 366 | fi 367 | done 368 | } 369 | ensure_efivarfs_rw_if_present() { 370 | if ((USINGEFI==1 && ONENTRYROEFIVARFS==1)); then 371 | warning "Temporarily remounting efivarfs read-write" 372 | mount -o remount,rw "/sys/firmware/efi/efivars" 373 | EFIVARFSREMOUNTEDRW=1 374 | fi 375 | } 376 | restore_efivarfs_mount_state() { 377 | if ((USINGEFI==1 && ONENTRYROEFIVARFS==1 && EFIVARFSREMOUNTEDRW==1)); then 378 | warning "Remounting efivarfs read-only" 379 | if mount -o remount,ro "/sys/firmware/efi/efivars"; then 380 | EFIVARFSREMOUNTEDRW=0 381 | fi 382 | fi 383 | } 384 | check_is_luks_volume() { 385 | cryptsetup isLuks "${1}" || die "Path '${1}' is not a LUKS volume" 386 | } 387 | partuuid_is_on_usb_device() { 388 | local CANONPART="$(readlink --canonicalize "${PARTUUIDDEVDIR}/${1,,}")" 389 | if [[ "${ISUSBPART[${CANONPART}]-0}" == "1" ]]; then 390 | return 0 391 | fi 392 | return 1 393 | } 394 | check_partuuid_exists() { 395 | if [ ! -h "${PARTUUIDDEVDIR}/${1}" ]; then 396 | die "Partition with UUID '${1}' does not exist" 397 | fi 398 | } 399 | source_etc_conf_file() { 400 | # get the variables the user must set, and any overrides 401 | if [ ! -s "${CONFFILE}" ]; then 402 | warning "${CONFFILE} does not exist" 403 | if test_yn "Would you like to run --easy-setup now to fix this"; then 404 | interactively_set_buildkernel_config 405 | cleanup_and_exit_with_code 0 406 | else 407 | die "Cannot proceed; please create ${CONFFILE} manually" 408 | fi 409 | fi 410 | source "${CONFFILE}" 411 | # make sure the PARTUUIDs are lower case, if defined 412 | if [[ -v EFIPARTUUID ]]; then 413 | EFIPARTUUID="${EFIPARTUUID,,}" 414 | fi 415 | if [[ -v CRYPTPARTUUID ]]; then 416 | CRYPTPARTUUID="${CRYPTPARTUUID,,}" 417 | fi 418 | if [[ -v KEYFILEPARTUUID ]]; then 419 | KEYFILEPARTUUID="${KEYFILEPARTUUID,,}" 420 | fi 421 | # remember if CRYPTPATHMAP set 422 | if [[ -v CRYPTPATHMAP ]]; then 423 | CRYPTPATHMAPFORCED=1 424 | fi 425 | # map INITSYSTEM to lower case 426 | if [[ -v INITSYSTEM ]]; then 427 | INITSYSTEM="${INITSYSTEM,,}" 428 | fi 429 | # perform checks on KERNEL_SIGNING_CERT and KERNEL_SIGNING_KEY 430 | if [[ -v KERNEL_SIGNING_CERT ]]; then 431 | if [[ ! -v KERNEL_SIGNING_KEY ]]; then 432 | die "Cannot proceed; KERNEL_SIGNING_CERT is configured, but KERNEL_SIGNING_KEY is not." 433 | fi 434 | if [[ "${KERNEL_SIGNING_CERT}" == "auto" || "${KERNEL_SIGNING_KEY}" == "auto" ]]; then 435 | if [[ "${KERNEL_SIGNING_CERT}" != "${KERNEL_SIGNING_KEY}" ]]; then 436 | die "Cannot proceed; in automatic external module signing mode, both KERNEL_SIGNING_CERT and KERNEL_SIGNING_KEY must be set to \"auto\"" 437 | fi 438 | KERNEL_SIGNING_CERT="${LINUXDIR}/certs/signing_key.x509" 439 | KERNEL_SIGNING_KEY="${LINUXDIR}/certs/signing_key.pem" 440 | else 441 | if [[ ! -f "${KERNEL_SIGNING_CERT}" ]]; then 442 | die "Cannot proceed; KERNEL_SIGNING_CERT is not a valid path to a file." 443 | fi 444 | if [[ ! -f "${KERNEL_SIGNING_KEY}" ]]; then 445 | die "Cannot proceed; KERNEL_SIGNING_KEY is not a valid path to a file." 446 | fi 447 | fi 448 | fi 449 | if [[ -v KERNEL_SIGNING_KEY && ! -v KERNEL_SIGNING_CERT ]]; then 450 | die "Cannot proceed; KERNEL_SIGNING_KEY is configured, but KERNEL_SIGNING_CERT is not." 451 | fi 452 | } 453 | setup_final_variables() { 454 | # post-processing once buildkernel.conf loaded 455 | # critical that EFIPARTUUID and CRYPTPARTUUID are defined... 456 | # (NB - buildkernel now also supports a LUKS filesystem that does not live 457 | # in a GPT partition - you can simply override CRYPTPATHMAP directly in 458 | # buildkernel.conf. If you set this, then CRYPTPARTUUID will not be checked 459 | # and its contents (if any) will be ignored.) 460 | if [ -z ${EFIPARTUUID+xxx} ]; then 461 | warning "EFIPARTUUID not set in ${CONFFILE}" 462 | if test_yn "Would you like to run --easy-setup now to fix this"; then 463 | interactively_set_buildkernel_config 464 | cleanup_and_exit_with_code 0 465 | else 466 | die "Cannot proceed; please edit ${CONFFILE} manually" 467 | fi 468 | fi 469 | if ((CRYPTPATHMAPFORCED==1)); then 470 | if [ -z "${CRYPTPATHMAP}" ]; then 471 | die "CRYPTPATHMAP set to empty string in ${CONFFILE}; cannot proceed" 472 | fi 473 | warning "CRYPTPATHMAP defined in ${CONFFILE}" 474 | warning "CRYPTPARTUUID will be ignored" 475 | # check it 476 | if ! cryptsetup isLuks "${CRYPTPATHMAP}"; then 477 | die "CRYPTPATHMAP ('${CRYPTPATHMAP}') does not specify a LUKS filesystem" 478 | fi 479 | elif [ -z ${CRYPTPARTUUID+xxx} ]; then 480 | warning "CRYPTPARTUUID not set in ${CONFFILE}" 481 | if test_yn "Would you like to run --easy-setup now to fix this"; then 482 | interactively_set_buildkernel_config 483 | cleanup_and_exit_with_code 0 484 | else 485 | die "Cannot proceed; please edit ${CONFFILE} manually" 486 | fi 487 | fi 488 | if [ -n "${PLYMOUTHTHEME}" ] && ! "${USE_PLYMOUTH}"; then 489 | warning "You have specified a PLYMOUTHTHEME, but ${PROGNAME} was emerged" 490 | warning "without the plymouth use flag set - ignoring." 491 | PLYMOUTHTHEME="" 492 | fi 493 | EFIPATHMAP="${PARTUUIDDEVDIR}/${EFIPARTUUID}" 494 | if ((CRYPTPATHMAPFORCED==0)); then 495 | CRYPTPATHMAP="${PARTUUIDDEVDIR}/${CRYPTPARTUUID}" 496 | fi # otherwise, leave it as set 497 | # check if the user has specified an OpenRC init; if not, assume systemd 498 | if [[ "${INITSYSTEM}" == "openrc" ]]; then 499 | # need a different path for the init executable 500 | CMDLINE_REAL_INIT="${OPENRC_INIT}" 501 | elif [[ "${INITSYSTEM}" != "systemd" ]]; then 502 | warning "Unrecognized INITSYSTEM, assuming systemd" 503 | INITSYSTEM="systemd" 504 | fi 505 | # assume keyfile is also on the EFI system partition, unless KEYFILEPARTUUID 506 | # has been set explicitly in buildkernel.conf 507 | KEYFILEPARTUUID="${KEYFILEPARTUUID:-${EFIPARTUUID}}" 508 | KEYFILEPATHMAP="${PARTUUIDDEVDIR}/${KEYFILEPARTUUID}" 509 | # get the real root filesystem type if not specified 510 | # falling back to ext4 if the findmnt-based lookup fails 511 | if [[ ! -v CMDLINE_ROOTFSTYPE ]]; then 512 | CMDLINE_ROOTFSTYPE="$(/bin/findmnt -n -o FSTYPE -S ${CMDLINE_REAL_ROOT} 2>/dev/null || echo ext4)" 513 | CMDLINE_ROOTFSTYPE="$(head -n 1 <<<"${CMDLINE_ROOTFSTYPE}")" 514 | fi 515 | # we use path syntax rather than "=PARTUUID=" syntax, as more reliable 516 | KERNEL_CMD_LINE="root=${CMDLINE_ROOT} crypt_root=${CRYPTPATHMAP} " 517 | if ((DISABLE_LVM==0)); then 518 | KERNEL_CMD_LINE+="dolvm " 519 | fi 520 | KERNEL_CMD_LINE+="real_root=${CMDLINE_REAL_ROOT} rootfstype=${CMDLINE_ROOTFSTYPE} " 521 | KERNEL_CMD_LINE+="real_init=${CMDLINE_REAL_INIT} " 522 | if [ -n "${LUKSKEYFILE}" ]; then 523 | KERNEL_CMD_LINE+="root_keydev=${KEYFILEPATHMAP} root_key=${LUKSKEYFILE} " 524 | fi 525 | if ((DISABLE_HIBERNATION==0)); then 526 | KERNEL_CMD_LINE+="real_resume=${CMDLINE_REAL_RESUME} " 527 | fi 528 | KERNEL_CMD_LINE+="keymap=${KEYMAP}" 529 | if [ -n "${PLYMOUTHTHEME}" ]; then 530 | KERNEL_CMD_LINE+=" quiet splash" 531 | if [[ "${INITSYSTEM}" == "systemd" ]]; then 532 | # make sure systemd doesn't print a version number during early boot 533 | KERNEL_CMD_LINE+=" udev.log-priority=3" 534 | fi 535 | fi 536 | if [ -n "${ADDITIONALKERNELCMDS}" ]; then 537 | KERNEL_CMD_LINE+=" ${ADDITIONALKERNELCMDS}" 538 | fi 539 | 540 | if grep -q "^# CONFIG_MODULES is not set$" "${TARGETCONFIG}" > /dev/null; then 541 | warning "No module support, disabling kernel modules." 542 | USINGMODULES=0 543 | else 544 | USINGMODULES=1 545 | fi 546 | } 547 | check_if_booted_under_efi() { 548 | if [ -d "/sys/firmware/efi" ]; then 549 | USINGEFI=1 550 | # efivarfs mounted ro? 551 | if findmnt "/sys/firmware/efi/efivars" --options "ro" &>/dev/null; then 552 | ONENTRYROEFIVARFS=1 553 | else 554 | ONENTRYROEFIVARFS=0 555 | fi 556 | else 557 | USINGEFI=0 558 | fi 559 | } 560 | find_all_usb_partitions() { 561 | # overwrites ISUSBPART 562 | local U ALLU="${!ISUSBPART[@]}" 563 | for U in ${ALLU}; do 564 | unset -v "ISUSBPART[${U}]" 565 | done 566 | local NEXTID 567 | for NEXTID in "${DISKIDDEVDIR}/usb-"*"-part"*[[:digit:]]; do 568 | if [ -e "${NEXTID}" ]; then 569 | # remember this 570 | local NEXTCANONPART="$(readlink --canonicalize "${NEXTID}")" 571 | ISUSBPART["${NEXTCANONPART}"]="1" 572 | fi 573 | done 574 | } 575 | find_all_gpg_keyfile_partitions() { 576 | # overwrites the variables GPGUUIDS, GPGPARTNAMES, GPGDEVNAMES and 577 | # GPGPARTNUMS 578 | # we only look for non-LUKS partitions on attached USB devices 579 | # we don't mount to check that the file is there 580 | GPGUUIDS=(); GPGPARTNAMES=(); GPGDEVNAMES=(); GPGPARTNUMS=() 581 | local NEXTPART 582 | for NEXTPART in "${PARTUUIDDEVDIR}"/*; do 583 | if [ -e "${NEXTPART}" ]; then 584 | if ! cryptsetup isLuks "${NEXTPART}"; then 585 | NEXTPART="${NEXTPART,,}" 586 | local NEXTUUID="${NEXTPART##*/}" 587 | local NEXTPARTNAME="$(readlink --canonicalize "${NEXTPART}")" # e.g. /dev/sda3 588 | local NEXTDEVNAME="${NEXTPARTNAME%%[[:digit:]]*}" # e.g. /dev/sda 589 | local NEXTPARTNUM="${NEXTPARTNAME##*[^[:digit:]]}" # e.g. 3 590 | if partuuid_is_on_usb_device "${NEXTUUID}"; then 591 | # assign results (Bash treats arrays as unset if not assigned a value) 592 | GPGUUIDS=("${GPGUUIDS[@]:+${GPGUUIDS[@]}}" "${NEXTUUID}") 593 | GPGPARTNAMES=("${GPGPARTNAMES[@]:+${GPGPARTNAMES[@]}}" "${NEXTPARTNAME}") 594 | GPGDEVNAMES=("${GPGDEVNAMES[@]:+${GPGDEVNAMES[@]}}" "${NEXTDEVNAME}") 595 | GPGPARTNUMS=("${GPGPARTNUMS[@]:+${GPGPARTNUMS[@]}}" "${NEXTPARTNUM}") 596 | fi 597 | fi 598 | fi 599 | done 600 | } 601 | find_all_luks_partitions() { 602 | # overwrites the variables LUKSUUIDS, LUKSPARTNAMES, LUKSDEVNAMES, 603 | # LUKSPARTNUMS and LUKSONUSBS 604 | LUKSUUIDS=(); LUKSPARTNAMES=(); LUKSPARTNAMES=(); LUKSDEVNAMES=() 605 | LUKSPARTNUMS=(); LUKSONUSBS=() 606 | local NEXTPART 607 | for NEXTPART in "${PARTUUIDDEVDIR}"/*; do 608 | if [ -e "${NEXTPART}" ]; then 609 | if cryptsetup isLuks "${NEXTPART}"; then 610 | NEXTPART="${NEXTPART,,}" 611 | local NEXTUUID="${NEXTPART##*/}" 612 | local NEXTPARTNAME="$(readlink --canonicalize "${NEXTPART}")" # e.g. /dev/sda3 613 | # nvme devices have paths of form e.g. /dev/nvme0n1p1 614 | # mmc devices have paths of form e.g. /dev/mmcblk0p1 615 | # standard drives have form e.g. /dev/sda3 616 | if [[ ${NEXTPARTNAME} =~ ^/dev/.*[[:digit:]]p[[:digit:]]+$ ]]; then 617 | local NEXTDEVNAME="${NEXTPARTNAME%%p[[:digit:]]*}" # e.g. /dev/nvme0n1, /dev/mmcblk0 618 | else 619 | local NEXTDEVNAME="${NEXTPARTNAME%%[[:digit:]]*}" # e.g. /dev/sda 620 | fi 621 | local NEXTPARTNUM="${NEXTPARTNAME##*[^[:digit:]]}" # e.g. 3 622 | local NEXTONUSB="0" 623 | if partuuid_is_on_usb_device "${NEXTUUID}"; then 624 | NEXTONUSB="1" 625 | fi 626 | # assign results (Bash treats arrays as unset if not assigned a value) 627 | LUKSUUIDS=("${LUKSUUIDS[@]:+${LUKSUUIDS[@]}}" "${NEXTUUID}") 628 | LUKSPARTNAMES=("${LUKSPARTNAMES[@]:+${LUKSPARTNAMES[@]}}" "${NEXTPARTNAME}") 629 | LUKSDEVNAMES=("${LUKSDEVNAMES[@]:+${LUKSDEVNAMES[@]}}" "${NEXTDEVNAME}") 630 | LUKSPARTNUMS=("${LUKSPARTNUMS[@]:+${LUKSPARTNUMS[@]}}" "${NEXTPARTNUM}") 631 | LUKSONUSBS=("${LUKSONUSBS[@]:+${LUKSONUSBS[@]}}" "${NEXTONUSB}") 632 | fi 633 | fi 634 | done 635 | 636 | } 637 | find_all_efi_system_partitions() { 638 | # overwrites the variables EFIUUIDS, EFIPARTNAMES, EFIDEVNAMES, 639 | # EFIPARTNUMS and EFIONUSBS 640 | EFIUUIDS=(); EFIPARTNAMES=(); EFIPARTNAMES=(); EFIDEVNAMES=() 641 | EFIPARTNUMS=(); EFIONUSBS=() 642 | local NEXTPART 643 | for NEXTPART in "${PARTUUIDDEVDIR}"/*; do 644 | if [ -e "${NEXTPART}" ]; then 645 | NEXTPART="${NEXTPART,,}" 646 | local NEXTUUID="${NEXTPART##*/}" 647 | local NEXTPARTNAME="$(readlink --canonicalize "${NEXTPART}")" # e.g. /dev/sda3 648 | # nvme devices have paths of form e.g. /dev/nvme0n1p1 649 | # mmc devices have paths of form e.g. /dev/mmcblk0p1 650 | # standard drives have form e.g. /dev/sda3 651 | if [[ ${NEXTPARTNAME} =~ ^/dev/.*[[:digit:]]p[[:digit:]]+$ ]]; then 652 | local NEXTDEVNAME="${NEXTPARTNAME%%p[[:digit:]]*}" # e.g. /dev/nvme0n1, /dev/mmcblk0 653 | else 654 | local NEXTDEVNAME="${NEXTPARTNAME%%[[:digit:]]*}" # e.g. /dev/sda 655 | fi 656 | local NEXTPARTNUM="${NEXTPARTNAME##*[^[:digit:]]}" # e.g. 3 657 | local NEXTONUSB="0" 658 | if partuuid_is_on_usb_device "${NEXTUUID}"; then 659 | NEXTONUSB="1" 660 | fi 661 | if grep -qi 'EFI System' <(sgdisk --info "${NEXTPARTNUM}" "${NEXTDEVNAME}"); then 662 | # assign results (Bash treats arrays as unset if not assigned a value) 663 | EFIUUIDS=("${EFIUUIDS[@]:+${EFIUUIDS[@]}}" "${NEXTUUID}") 664 | EFIPARTNAMES=("${EFIPARTNAMES[@]:+${EFIPARTNAMES[@]}}" "${NEXTPARTNAME}") 665 | EFIDEVNAMES=("${EFIDEVNAMES[@]:+${EFIDEVNAMES[@]}}" "${NEXTDEVNAME}") 666 | EFIPARTNUMS=("${EFIPARTNUMS[@]:+${EFIPARTNUMS[@]}}" "${NEXTPARTNUM}") 667 | EFIONUSBS=("${EFIONUSBS[@]:+${EFIONUSBS[@]}}" "${NEXTONUSB}") 668 | fi 669 | fi 670 | done 671 | } 672 | find_all_efi_boot_entries() { 673 | # overwrites the variables EBOOTIDS EBOOTNAMES EBOOTPATHS EBOOTUUIDS 674 | # and EBOOTISACTIVES, EBOOTORDER 675 | # and also HASWINBOOTLOADER and EBOOTIDTOINDEX 676 | EBOOTIDS=(); EBOOTNAMES=(); EBOOTPATHS=(); EBOOTUUIDS=() 677 | EBOOTISACTIVES=(); EBOOTORDER=() 678 | local K ALLK="${!HASWINBOOTLOADER[@]}" 679 | for K in ${ALLK}; do 680 | unset -v "HASWINBOOTLOADER[${K}]" 681 | done 682 | ALLK="${!EBOOTIDTOINDEX[@]}" 683 | for K in ${ALLK}; do 684 | unset -v "EBOOTIDTOINDEX[${K}]" 685 | done 686 | if ((USINGEFI==0)); then 687 | warning "This system wasn't booted under UEFI, cannot check boot entries" 688 | return 0 689 | fi 690 | local NEXTLINE 691 | declare -i NEXTINDEX=0 692 | # only look for hard drive entries here 693 | while read -r NEXTLINE; do 694 | local NEXTID="${NEXTLINE:4:4}" 695 | local NEXTSIG="${NEXTLINE:0:8}" 696 | local NEXTISACTIVE="${NEXTLINE:8:1}" 697 | if [[ "${NEXTISACTIVE}" == "*" ]]; then 698 | NEXTISACTIVE="1" 699 | else 700 | NEXTISACTIVE="0" 701 | fi 702 | local NEXTUUID=$(egrep -o 'HD\([^(]*\)' <<<"${NEXTLINE}" | egrep -o '[[:xdigit:]]{8}(\-[[:xdigit:]]{4}){3}\-[[:xdigit:]]{12}') 703 | local NEXTPATH=$(egrep -o 'File\([^(]*\)' <<<"${NEXTLINE}") 704 | NEXTPATH="${NEXTPATH:5:-1}" 705 | local NEXTNAME="$(efibootmgr | grep "^${NEXTSIG}" | cut -c11-)" 706 | NEXTUUID="${NEXTUUID,,}" 707 | if [[ -z "${NEXTID}" || -z "${NEXTNAME}" || -z "${NEXTPATH}" || -z "${NEXTUUID}" || -z "${NEXTISACTIVE}" ]]; then 708 | # one of the required strings is empty, we cannot use this line 709 | continue 710 | fi 711 | # assign results (Bash treats arrays as unset if not assigned a value) 712 | EBOOTIDS=("${EBOOTIDS[@]:+${EBOOTIDS[@]}}" "${NEXTID}") 713 | EBOOTNAMES=("${EBOOTNAMES[@]:+${EBOOTNAMES[@]}}" "${NEXTNAME}") 714 | EBOOTPATHS=("${EBOOTPATHS[@]:+${EBOOTPATHS[@]}}" "${NEXTPATH}") 715 | EBOOTUUIDS=("${EBOOTUUIDS[@]:+${EBOOTUUIDS[@]}}" "${NEXTUUID}") 716 | EBOOTISACTIVES=("${EBOOTISACTIVES[@]:+${EBOOTISACTIVES[@]}}" "${NEXTISACTIVE}") 717 | # archive whether or not this is a windows bootloader entry 718 | # there can be >1 entry for the same UUID, so this acts like a 719 | # 'dirty' flag 720 | if grep -i -q "Windows" <<<"${NEXTNAME}" || \ 721 | grep -i -q "Microsoft" <<<"${NEXTPATH}"; then 722 | HASWINBOOTLOADER["${NEXTUUID}"]="1" 723 | fi 724 | # store a lookup from boot ID (4 digit hex string) to index in these 725 | # arrays 726 | EBOOTIDTOINDEX["${NEXTID}"]="${NEXTINDEX}" 727 | NEXTINDEX=$((NEXTINDEX+1)) 728 | done < <(efibootmgr -v | grep '^Boot0[^ ]*.*HD([^\)]*)') 729 | # now extract the boot order, and save it into EBOOTORDER in ascending order 730 | EBOOTORDER=($(efibootmgr | grep '^BootOrder' | sed 's/BootOrder: //g;s/,/ /g')) 731 | EFIBOOTENTRIESSEARCHED=1 732 | } 733 | archive_current_config_variables() { 734 | local NEXTVAR 735 | for NEXTVAR in "${PROCVARS[@]}"; do 736 | if [[ -v "${NEXTVAR}" ]] ; then 737 | eval "OLD_${NEXTVAR}"="${!NEXTVAR}" 738 | else 739 | unset -v "OLD_${NEXTVAR}" 740 | fi 741 | done 742 | } 743 | warn_if_buildkernel_config_incomplete() { 744 | declare -i WILLRUN=1 745 | if [[ ! -v EFIPARTUUID ]]; then 746 | warning "EFIPARTUUID not set in ${CONFFILE}" 747 | WILLRUN=0 748 | fi 749 | if ((CRYPTPATHMAPFORCED==1)); then 750 | if [ -z "${CRYPTPATHMAP}" ]; then 751 | warning "CRYPTPATHMAP set to empty string in ${CONFFILE}" 752 | WILLRUN=0 753 | fi 754 | warning "CRYPTPATHMAP defined in ${CONFFILE}" 755 | warning "CRYPTPARTUUID will be ignored" 756 | elif [[ ! -v CRYPTPARTUUID ]]; then 757 | warning "CRYPTPARTUUID not set in ${CONFFILE}" 758 | WILLRUN=0 759 | fi 760 | if ((WILLRUN==0)); then 761 | warning "${PROGNAME} cannot create a kernel until you fix this" 762 | fi 763 | } 764 | interactively_set_buildkernel_config() { 765 | find_all_gpg_keyfile_partitions 766 | find_all_luks_partitions 767 | find_all_efi_system_partitions 768 | find_all_efi_boot_entries 769 | archive_current_config_variables 770 | declare -i DOSAVE=0 DOEXIT=0 771 | declare -a TOPMENU=("Set EFI system partition" "Set LUKS root partition" \ 772 | "Set LUKS key options" "Set EFI boot file path"\ 773 | "Set boot splash options" "Set boot-time keymap" \ 774 | "Set init system" \ 775 | "Exit without saving" "Save and exit") 776 | local X 777 | PS3="Your choice: " 778 | until ((DOEXIT==1)); do 779 | show_current_key_config_status 780 | show "Please choose an option:" 781 | select X in "${TOPMENU[@]}"; do 782 | printf "\n" 783 | case "${X}" in 784 | "Set EFI system partition") set_efi_system_partition; break ;; 785 | "Set LUKS root partition") set_luks_root_partition; break ;; 786 | "Set LUKS key options") set_luks_key_options; break ;; 787 | "Set EFI boot file path") set_efi_boot_file_path; break ;; 788 | "Set boot splash options") set_boot_splash_options; break ;; 789 | "Set boot-time keymap") set_boot_time_keymap; break ;; 790 | "Set init system") set_init_system; break ;; 791 | "Exit without saving") DOEXIT=1; break ;; 792 | "Save and exit") DOSAVE=1; DOEXIT=1; break ;; 793 | *) warning "Please choose one of the menu options!"; break ;; 794 | esac 795 | done 796 | if ((DOEXIT==1 && DOSAVE==0 && CONFIGDIRTY==1)); then 797 | if ! test_yn_need_enter "Are you sure? Your changes will be lost. Proceed"; then 798 | DOEXIT=0 799 | fi 800 | fi 801 | done 802 | if ((DOSAVE==0)); then 803 | if ((CONFIGDIRTY==1)); then 804 | warning "As instructed, your changes were not saved!" 805 | else 806 | show "Configuration unchanged." 807 | fi 808 | else 809 | # user wants to save 810 | if ((CONFIGDIRTY==1)); then 811 | save_buildkernel_config 812 | show "Configuration saved to ${CONFFILE}." 813 | show "Be sure to run ${PROGNAME}, to rebuild the kernel with the new" 814 | show "settings, before rebooting." 815 | else 816 | show "Configuration is unchanged, nothing to save." 817 | fi 818 | warn_if_efi_boot_file_clashes_with_windows_bootloader 819 | warn_if_buildkernel_config_incomplete 820 | fi 821 | } 822 | save_buildkernel_config() { 823 | local NEXTVAR NEXTDEFAULTVAR 824 | # ensure any existing definitions are commented out 825 | for NEXTVAR in "${PROCVARS[@]}"; do 826 | sed -i "/^${NEXTVAR}=/s/^/# /" "${CONFFILE}" 827 | done 828 | # get rid of the existing 'auto' section, if there is one 829 | sed -i '/^# Automatically added by '"${PROGNAME}"' - edits here may be overwritten/,/^# End of automatically added section/d' "${CONFFILE}" 830 | # now append remaining vars to end 831 | printf "# Automatically added by ${PROGNAME} - edits here may be overwritten\n" >> "${CONFFILE}" 832 | for NEXTVAR in "${PROCVARS[@]}"; do 833 | if [[ -v "${NEXTVAR}" ]] ; then 834 | # don't write out anything if we have the default value set anyway 835 | NEXTDEFAULTVAR="DEFAULT${NEXTVAR}" 836 | if [[ -v "${NEXTDEFAULTVAR}" && "${!NEXTVAR}" == "${!NEXTDEFAULTVAR}" ]] ; then 837 | continue 838 | fi 839 | printf "${NEXTVAR}=\"${!NEXTVAR}\"\n" >> "${CONFFILE}" 840 | fi 841 | done 842 | printf "# End of automatically added section\n" >> "${CONFFILE}" 843 | # copy the keyfile, if location or path has changed 844 | if [[ -v OLD_LUKSKEYFILE && -v LUKSKEYFILE && \ 845 | ( -v OLD_EFIPARTUUID || -v OLD_KEYFILEPARTUUID ) ]]; then 846 | local OLD_ACTUAL_KEYFILEPARTUUID="${OLD_KEYFILEPARTUUID:-${OLD_EFIPARTUUID}}" 847 | local ACTUAL_KEYFILEPARTUUID="${KEYFILEPARTUUID:-${EFIPARTUUID}}" 848 | if [[ -n "${LUKSKEYFILE}" && -n "${OLD_LUKSKEYFILE}" && \ 849 | ( "${ACTUAL_KEYFILEPARTUUID}" != "${OLD_ACTUAL_KEYFILEPARTUUID}" || \ 850 | "${LUKSKEYFILE}" != "${OLD_LUKSKEYFILE}" ) ]]; then 851 | show "Your LUKS keyfile location has changed:" 852 | show "Old PARTUUID: ${OLD_ACTUAL_KEYFILEPARTUUID}, filename: '${OLD_LUKSKEYFILE}'" 853 | show "New PARTUUID: ${ACTUAL_KEYFILEPARTUUID}, filename: '${LUKSKEYFILE}'" 854 | if test_yn_need_enter "Would you like to copy the keyfile across now"; then 855 | copy_file_from_partition_to_partition \ 856 | "${OLD_ACTUAL_KEYFILEPARTUUID}" "/${OLD_LUKSKEYFILE}" \ 857 | "${ACTUAL_KEYFILEPARTUUID}" "/${LUKSKEYFILE}" \ 858 | "keyfile copied successfully (original retained)" \ 859 | "Error copying keyfile - please copy manually" 860 | else 861 | warning "File not copied" 862 | warning "Please ensure '${LUKSKEYFILE}' available on" 863 | warning "partition ${ACTUAL_KEYFILEPARTUUID}" 864 | warning "before attempting to reboot" 865 | fi 866 | fi 867 | fi 868 | # it may be dangerous to leave /boot/efi mounted, if the user has 869 | # changed its location, so unmount it now if necessary 870 | if mount | grep -q " ${EFIROOTDIR} " > /dev/null; then 871 | show "Unmounting ${EFIROOTDIR} for safety" 872 | umount_and_forget "${EFIROOTDIR}" 873 | fi 874 | } 875 | set_efi_system_partition() { 876 | declare -i DOEXIT=0 NUMEFIPARTS="${#EFIUUIDS[@]}" 877 | local NUMREG='^[0-9]+$' 878 | until ((DOEXIT==1)); do 879 | show "Please choose which EFI system partition to use (or GO BACK):" 880 | show_efi_system_partitions "GO BACK" 881 | printf "%s" "${PS3}" 882 | local N 883 | read -r N 884 | if [[ "${N}" =~ ${NUMREG} ]]; then 885 | if ((N>=1 && N<=NUMEFIPARTS)); then 886 | # valid partition, set it 887 | if [[ -v EFIPARTUUID ]]; then 888 | if [[ "${EFIPARTUUID}" != "${EFIUUIDS[$((N-1))]}" ]]; then 889 | CONFIGDIRTY=1; 890 | fi 891 | else 892 | CONFIGDIRTY=1; 893 | fi 894 | EFIPARTUUID="${EFIUUIDS[$((N-1))]}" 895 | DOEXIT=1; 896 | show "EFI system partition selected as follows:" 897 | show_efi_system_partitions 898 | warn_if_efi_boot_file_clashes_with_windows_bootloader 899 | make_key_file_location_expicit_if_necessary_and_wanted 900 | elif ((N==1+NUMEFIPARTS)); then 901 | DOEXIT=1; 902 | fi 903 | fi 904 | if ((DOEXIT==0)); then 905 | warning "Please choose one of the menu options!" 906 | fi 907 | done 908 | } 909 | set_luks_root_partition() { 910 | declare -i DOEXIT=0 NUMLUKSPARTS="${#LUKSUUIDS[@]}" 911 | local NUMREG='^[0-9]+$' 912 | until ((DOEXIT==1)); do 913 | show "Please choose which LUKS partition contains the root LVM logical volume:" 914 | show_luks_partitions "GO BACK" 915 | printf "%s" "${PS3}" 916 | local N 917 | read -r N 918 | if [[ "${N}" =~ ${NUMREG} ]]; then 919 | if ((N>=1 && N<=NUMLUKSPARTS)); then 920 | # valid partition, set it 921 | if [[ -v CRYPTPARTUUID ]]; then 922 | if [[ "${CRYPTPARTUUID}" != "${LUKSUUIDS[$((N-1))]}" ]]; then 923 | CONFIGDIRTY=1; 924 | fi 925 | else 926 | CONFIGDIRTY=1; 927 | fi 928 | CRYPTPARTUUID="${LUKSUUIDS[$((N-1))]}" 929 | DOEXIT=1; 930 | show "LUKS partition selected as follows:" 931 | show_luks_partitions 932 | elif ((N==1+NUMLUKSPARTS)); then 933 | DOEXIT=1; 934 | fi 935 | fi 936 | if ((DOEXIT==0)); then 937 | warning "Please choose one of the menu options!" 938 | fi 939 | done 940 | } 941 | show_current_key_config_status() { 942 | # main things we need are: EFIPARTUUID, CRYPTPARTUUID, KEYFILEPARTUUID 943 | # LUKSKEYFILE, EFIBOOTDIR, EFIBOOTFILE, PLYMOUTHTHEME, KEYMAP and INITSYSTEM 944 | local MODFLAG="" 945 | if ((CONFIGDIRTY==1)); then 946 | MODFLAG=" - MODIFIED" 947 | fi 948 | printf "\n" 949 | show "Current configuration (from ${CONFFILE}${MODFLAG}):" 950 | printf "\n" 951 | printf " EFI system partition UUID: %-36s\n" "${EFIPARTUUID:-NEEDS SETTING}" 952 | if ((CRYPTPATHMAPFORCED==0)); then 953 | printf " LUKS root partition UUID: %-36s\n" "${CRYPTPARTUUID:-NEEDS SETTING}" 954 | else 955 | printf " LUKS root partition UUID: %-36s\n" "IGNORED, OVERRIDDEN BY CRYPTPATHMAP" 956 | printf " (to '%s')\n" "${CRYPTPATHMAP}" 957 | fi 958 | printf " GPG keyfile partition UUID: %-36s\n" "${KEYFILEPARTUUID:-DEFAULT (=EFI system partition UUID)}" 959 | printf " GPG keyfile (for LUKS): %-36s\n" "${LUKSKEYFILE:-NONE (using fallback passphrase)}" 960 | printf " EFI boot directory: %-36s\n" "${EFIBOOTDIR:-NEEDS SETTING}" 961 | printf " EFI boot file: %-36s\n" "${EFIBOOTFILE:-NEEDS SETTING}" 962 | printf " Plymouth theme: %-36s\n" "${PLYMOUTHTHEME:-NONE (textual boot)}" 963 | printf " Boot-time keymap: %-36s\n" "${KEYMAP:-NEEDS SETTING}" 964 | if [[ "${INITSYSTEM}" == "systemd" ]]; then 965 | printf " Init system: %-36s\n" "systemd" 966 | else 967 | printf " Init system: %-36s\n" "OpenRC" 968 | fi 969 | printf "\n" 970 | } 971 | show_gpg_keyfile_partitions() { 972 | local LASTITEM=${1:-""} 973 | declare -i I=0 NUMGPGPARTS="${#GPGUUIDS[@]}" 974 | if ((NUMGPGPARTS==0)); then 975 | show "No potential keyfile partitions found on your machine" 976 | else 977 | printf "%3s %-36s %-10s %-3s %3s\n" "Num" "Partition UUID" "Path" "Use" 978 | printf "%s\n" "--- ------------------------------------ ---------- ---" 979 | for I in "${!GPGUUIDS[@]}"; do 980 | local INUSE="[ ]" 981 | if [[ ${KEYFILEPARTUUID:-""} == "${GPGUUIDS[$I]}" ]]; then 982 | INUSE="[*]" 983 | fi 984 | printf "%2d) %-36s %-10s %3s\n" $((I+1)) "${GPGUUIDS[$I]}" \ 985 | "${GPGPARTNAMES[$I]}" "${INUSE}" 986 | done 987 | fi 988 | if [ -n "${LASTITEM}" ]; then 989 | printf "%2d) %s\n" $((NUMGPGPARTS+1)) "${LASTITEM}" 990 | fi 991 | } 992 | show_luks_partitions() { 993 | local LASTITEM=${1:-""} 994 | declare -i I=0 NUMLUKSPARTS="${#LUKSUUIDS[@]}" 995 | if ((NUMLUKSPARTS==0)); then 996 | die "No LUKS partitions found on your machine" 997 | else 998 | printf "%3s %-36s %-10s %-3s %3s\n" "Num" "Partition UUID" "Path" "USB" "Use" 999 | printf "%s\n" "--- ------------------------------------ ---------- --- ---" 1000 | for I in "${!LUKSUUIDS[@]}"; do 1001 | local ISUSB=" N " 1002 | local INUSE="[ ]" 1003 | if ((${LUKSONUSBS[$I]}==1)); then 1004 | ISUSB=" Y " 1005 | fi 1006 | if [[ ${CRYPTPARTUUID:-""} == "${LUKSUUIDS[$I]}" ]]; then 1007 | INUSE="[*]" 1008 | fi 1009 | printf "%2d) %-36s %-10s %-3s %3s\n" $((I+1)) "${LUKSUUIDS[$I]}" \ 1010 | "${LUKSPARTNAMES[$I]}" "${ISUSB}" "${INUSE}" 1011 | done 1012 | fi 1013 | if [ -n "${LASTITEM}" ]; then 1014 | printf "%2d) %s\n" $((NUMLUKSPARTS+1)) "${LASTITEM}" 1015 | fi 1016 | } 1017 | show_efi_system_partitions() { 1018 | local LASTITEM=${1:-""} 1019 | declare -i I=0 NUMEFIPARTS="${#EFIUUIDS[@]}" 1020 | if ((NUMEFIPARTS==0)); then 1021 | die "No EFI system partitions found on your machine" 1022 | else 1023 | printf "%3s %-36s %-10s %-3s %-3s %3s\n" "Num" "Partition UUID" "Path" "USB" "Win" "Use" 1024 | printf "%s\n" "--- ------------------------------------ ---------- --- --- ---" 1025 | for I in "${!EFIUUIDS[@]}"; do 1026 | local ISUSB=" N " 1027 | local INUSE="[ ]" 1028 | local ISWIN=" N " 1029 | local NEXTUUID="${EFIUUIDS[$I]}" 1030 | if ((${EFIONUSBS[$I]}==1)); then 1031 | ISUSB=" Y " 1032 | fi 1033 | if [[ ${EFIPARTUUID:-""} == "${NEXTUUID}" ]]; then 1034 | INUSE="[*]" 1035 | fi 1036 | if ((USINGEFI==0)); then 1037 | ISWIN="???" 1038 | elif [[ "${HASWINBOOTLOADER[${NEXTUUID}]-0}" == "1" ]]; then 1039 | ISWIN=" Y " 1040 | fi 1041 | printf "%2d) %-36s %-10s %-3s %-3s %3s\n" $((I+1)) "${EFIUUIDS[$I]}" \ 1042 | "${EFIPARTNAMES[$I]}" "${ISUSB}" "${ISWIN}" "${INUSE}" 1043 | done 1044 | fi 1045 | if [ -n "${LASTITEM}" ]; then 1046 | printf "%2d) %s\n" $((NUMEFIPARTS+1)) "${LASTITEM}" 1047 | fi 1048 | } 1049 | show_luks_key_status() { 1050 | if [ -n "${LUKSKEYFILE}" ]; then 1051 | show "Using a GPG-encrypted keyfile for LUKS:" 1052 | if [[ ! -v KEYFILEPARTUUID ]]; then 1053 | show " KEYFILEPARTUUID unset: assuming GPG keyfile on EFI system partition" 1054 | else 1055 | show " KEYFILEPARTUUID is currently set to '${KEYFILEPARTUUID}'" 1056 | fi 1057 | else 1058 | show "Using no keyfile, but relying on fallback passphrase for LUKS" 1059 | fi 1060 | } 1061 | show_efi_boot_file_status() { 1062 | show "EFI boot file path: ${EFIBOOTDIR}/${EFIBOOTFILE}" 1063 | show " (under EFI system partition mountpoint)" 1064 | warn_if_efi_boot_file_clashes_with_windows_bootloader 1065 | } 1066 | show_boot_splash_status() { 1067 | if [ -n "${PLYMOUTHTHEME}" ]; then 1068 | show "Using Plymouth on boot, with theme '${PLYMOUTHTHEME}'" 1069 | if [ ! "${USE_PLYMOUTH}" ]; then 1070 | warning "${PROGNAME} has been emerged without the plymouth use flag" 1071 | warning "so this setting will be ignored" 1072 | fi 1073 | else 1074 | show "Using textual boot (no Plymouth)" 1075 | fi 1076 | } 1077 | show_init_system_status() { 1078 | if [[ "${INITSYSTEM}" == "systemd" ]]; then 1079 | show "Targeting systemd init" 1080 | else 1081 | show "Targeting OpenRC init" 1082 | fi 1083 | } 1084 | set_luks_key_options() { 1085 | local -i DOEXIT=0 1086 | declare -a LUKSKEYMENU=("Use GPG-encrypted keyfile on EFI system partition" \ 1087 | "Use GPG-encrypted keyfile on specific USB partition..." \ 1088 | "Use fallback passphrase (no keyfile)" "GO BACK") 1089 | local X 1090 | until ((DOEXIT==1)); do 1091 | show "Current LUKS key settings:" 1092 | show_luks_key_status 1093 | show "Please choose your desired LUKS key setting (or GO BACK):" 1094 | select X in "${LUKSKEYMENU[@]}"; do 1095 | case "${X}" in 1096 | "Use GPG-encrypted keyfile on EFI system partition") 1097 | if [[ "${LUKSKEYFILE}" != "${DEFAULTLUKSKEYFILE}" || -v KEYFILEPARTUUID ]]; then 1098 | CONFIGDIRTY=1 1099 | fi 1100 | LUKSKEYFILE="${DEFAULTLUKSKEYFILE}" 1101 | unset -v KEYFILEPARTUUID 1102 | show "New LUKS key settings:" 1103 | show_luks_key_status 1104 | DOEXIT=1 1105 | break ;; 1106 | "Use GPG-encrypted keyfile on specific USB partition...") 1107 | set_luks_keyfile_partition 1108 | DOEXIT=1 1109 | break ;; 1110 | "Use fallback passphrase (no keyfile)") 1111 | if [ -n LUKSKEYFILE ]; then 1112 | CONFIGDIRTY=1 1113 | fi 1114 | LUKSKEYFILE="" 1115 | show "New LUKS key settings:" 1116 | show_luks_key_status 1117 | DOEXIT=1 1118 | break ;; 1119 | "GO BACK") DOEXIT=1; break ;; 1120 | *) warning "Please choose one of the menu options!"; break ;; 1121 | esac 1122 | done 1123 | done 1124 | } 1125 | set_luks_keyfile_partition() { 1126 | declare -i DOEXIT=0 NUMGPGPARTS="${#GPGUUIDS[@]}" 1127 | local NUMREG='^[0-9]+$' 1128 | until ((DOEXIT==1)); do 1129 | if ((NUMGPGPARTS==0)); then 1130 | warning "No potential keyfile partitions found on your machine" 1131 | warning "(only non-LUKS partitions on USB devices are allowed)" 1132 | warning "Please insert any devices before running ${PROGNAME}" 1133 | return 0 1134 | fi 1135 | show "Please choose which partition contains the GPG keyfile for LUKS:" 1136 | show " (only non-LUKS partitions on USB devices are shown below)" 1137 | show_gpg_keyfile_partitions "GO BACK" 1138 | printf "%s" "${PS3}" 1139 | local N 1140 | read -r N 1141 | if [[ "${N}" =~ ${NUMREG} ]]; then 1142 | if ((N>=1 && N<=NUMGPGPARTS)); then 1143 | # valid partition, set it 1144 | if [[ -v KEYFILEPARTUUID ]]; then 1145 | if [[ "${KEYFILEPARTUUID}" != "${GPGUUIDS[$((N-1))]}" ]]; then 1146 | CONFIGDIRTY=1; 1147 | fi 1148 | else 1149 | CONFIGDIRTY=1; 1150 | fi 1151 | if [[ "${LUKSKEYFILE}" != "${DEFAULTLUKSKEYFILE}" ]]; then 1152 | CONFIGDIRTY=1 1153 | fi 1154 | LUKSKEYFILE="${DEFAULTLUKSKEYFILE}" 1155 | KEYFILEPARTUUID="${GPGUUIDS[$((N-1))]}" 1156 | DOEXIT=1; 1157 | show "GPG partition selected as follows:" 1158 | show_gpg_keyfile_partitions 1159 | if [[ -v EFIPARTUUID && "${EFIPARTUUID}" == "${KEYFILEPARTUUID}" ]]; then 1160 | show "The partition you have selected is also the current EFI system partition" 1161 | show "You can choose this explicitly in the LUKS key options menu, if you like" 1162 | show "(unless you intend to change the EFI system partition now)" 1163 | fi 1164 | # check if EFIPARTUUID is set and same; if so, notify user 1165 | # and clear the KEYFILEPARTUUID variable 1166 | elif ((N==1+NUMGPGPARTS)); then 1167 | DOEXIT=1; 1168 | fi 1169 | fi 1170 | if ((DOEXIT==0)); then 1171 | warning "Please choose one of the menu options!" 1172 | fi 1173 | done 1174 | } 1175 | set_boot_time_keymap() { 1176 | declare -i DOEXIT=0 1177 | declare -a KEYMAPLIST=("azerty" "be" "bg" "br-a" "br-l" "by" "cf" "croat" \ 1178 | "cz" "de" "dk" "dvorak" "es" "et" "fi" "fr" "gr" "hu" "il" "is" "it" \ 1179 | "jp" "la" "lt" "mk" "nl" "no" "pl" "pt" "ro" "ru" "se" "sg" "sk-y" \ 1180 | "sk-z" "slovene" "trf" "trq" "ua" "uk" "us" "wangbe" "sf") 1181 | declare -a KEYMAPMENU=("${KEYMAPLIST[@]}" "GO BACK") 1182 | local X 1183 | until ((DOEXIT==1)); do 1184 | show "Please choose your desired boot-time keymap (or GO BACK):" 1185 | show "Boot-time keymap is currently '${KEYMAP}'" 1186 | select X in "${KEYMAPMENU[@]}"; do 1187 | if [[ ${KEYMAPLIST[@]} =~ (^| )"${X}"($| ) ]]; then 1188 | # valid keymap, set it 1189 | if [[ "${KEYMAP}" != "${X}" ]]; then 1190 | CONFIGDIRTY=1; 1191 | fi 1192 | KEYMAP="${X}" 1193 | DOEXIT=1; 1194 | show "Keymap selected to be '${KEYMAP}'" 1195 | elif [[ "${X}" == "GO BACK" ]]; then 1196 | DOEXIT=1; 1197 | else 1198 | warning "Please choose one of the menu options!" 1199 | fi 1200 | break 1201 | done 1202 | done 1203 | } 1204 | set_efi_boot_file_path() { 1205 | # we only present a simplified choice here 1206 | local -i DOEXIT=0 1207 | declare -a EFIBOOTFILEMENU=("Use /EFI/Boot/bootx64.efi (recommended for initial USB install)" \ 1208 | "Use /EFI/Microsoft/Boot/bootmgfw.efi (fallback for certain systems)" \ 1209 | "Use /EFI/Boot/gentoo.efi (recommended for post-install use)" "GO BACK") 1210 | local X 1211 | until ((DOEXIT==1)); do 1212 | show "Current EFI boot file setting:" 1213 | show_efi_boot_file_status 1214 | show "Please choose your desired EFI boot file setting (or GO BACK):" 1215 | select X in "${EFIBOOTFILEMENU[@]}"; do 1216 | case "${X}" in 1217 | "Use /EFI/Boot/bootx64.efi (recommended for initial USB install)") 1218 | if [[ "${EFIBOOTDIR}" != "/EFI/Boot" || "${EFIBOOTFILE}" != "bootx64.efi" ]]; then 1219 | CONFIGDIRTY=1 1220 | fi 1221 | EFIBOOTDIR="/EFI/Boot" 1222 | EFIBOOTFILE="bootx64.efi" 1223 | show "New EFI boot file setting:" 1224 | show_efi_boot_file_status 1225 | DOEXIT=1 1226 | break ;; 1227 | "Use /EFI/Microsoft/Boot/bootmgfw.efi (fallback for certain systems)") 1228 | if [[ "${EFIBOOTDIR}" != "/EFI/Microsoft/Boot" || "${EFIBOOTFILE}" != "bootmgfw.efi" ]]; then 1229 | CONFIGDIRTY=1 1230 | fi 1231 | EFIBOOTDIR="/EFI/Microsoft/Boot" 1232 | EFIBOOTFILE="bootmgfw.efi" 1233 | show "New EFI boot file setting:" 1234 | show_efi_boot_file_status 1235 | DOEXIT=1 1236 | break ;; 1237 | "Use /EFI/Boot/gentoo.efi (recommended for post-install use)") 1238 | if [[ "${EFIBOOTDIR}" != "/EFI/Boot" || "${EFIBOOTFILE}" != "gentoo.efi" ]]; then 1239 | CONFIGDIRTY=1 1240 | fi 1241 | EFIBOOTDIR="/EFI/Boot" 1242 | EFIBOOTFILE="gentoo.efi" 1243 | show "New EFI boot file setting:" 1244 | show_efi_boot_file_status 1245 | DOEXIT=1 1246 | break ;; 1247 | "GO BACK") DOEXIT=1; break ;; 1248 | *) warning "Please choose one of the menu options!"; break ;; 1249 | esac 1250 | done 1251 | done 1252 | } 1253 | set_boot_splash_options() { 1254 | # we only present a simplified choice here 1255 | local -i DOEXIT=0 1256 | declare -a BOOTSPLASHMENU=("Use textual boot (no Plymouth)" \ 1257 | "Use Plymouth graphical boot splash ('fade-in')" "GO BACK") 1258 | local X 1259 | until ((DOEXIT==1)); do 1260 | show "Current boot splash settings:" 1261 | show_boot_splash_status 1262 | show "Please choose your desired boot splash setting (or GO BACK):" 1263 | select X in "${BOOTSPLASHMENU[@]}"; do 1264 | case "${X}" in 1265 | "Use textual boot (no Plymouth)") 1266 | if [ -n "${PLYMOUTHTHEME}" ]; then 1267 | CONFIGDIRTY=1 1268 | fi 1269 | PLYMOUTHTHEME="" 1270 | show "New boot splash settings:" 1271 | show_boot_splash_status 1272 | DOEXIT=1 1273 | break ;; 1274 | "Use Plymouth graphical boot splash ('fade-in')") 1275 | if [[ "${PLYMOUTHTHEME}" != "fade-in" ]]; then 1276 | CONFIGDIRTY=1 1277 | fi 1278 | PLYMOUTHTHEME="fade-in" 1279 | show "New boot splash settings:" 1280 | show_boot_splash_status 1281 | DOEXIT=1 1282 | break ;; 1283 | "GO BACK") DOEXIT=1; break ;; 1284 | *) warning "Please choose one of the menu options!"; break ;; 1285 | esac 1286 | done 1287 | done 1288 | } 1289 | set_init_system() { 1290 | # currently only two option are supported 1291 | local -i DOEXIT=0 1292 | declare -a INITSYSTEMSPLASHMENU=("systemd (select if unsure)" \ 1293 | "OpenRC" "GO BACK") 1294 | local X 1295 | until ((DOEXIT==1)); do 1296 | show "Current init system settings:" 1297 | show_init_system_status 1298 | show "Please choose your desired init system setting (or GO BACK):" 1299 | select X in "${INITSYSTEMSPLASHMENU[@]}"; do 1300 | case "${X}" in 1301 | "systemd (select if unsure)") 1302 | if [[ "${INITSYSTEM}" != "systemd" ]]; then 1303 | CONFIGDIRTY=1 1304 | fi 1305 | INITSYSTEM="systemd" 1306 | show "New init system settings:" 1307 | show_init_system_status 1308 | DOEXIT=1 1309 | break ;; 1310 | "OpenRC") 1311 | if [[ "${INITSYSTEM}" != "openrc" ]]; then 1312 | CONFIGDIRTY=1 1313 | fi 1314 | INITSYSTEM="openrc" 1315 | show "New init system settings:" 1316 | show_init_system_status 1317 | DOEXIT=1 1318 | break ;; 1319 | "GO BACK") DOEXIT=1; break ;; 1320 | *) warning "Please choose one of the menu options!"; break ;; 1321 | esac 1322 | done 1323 | done 1324 | } 1325 | warn_if_efi_boot_file_clashes_with_windows_bootloader() { 1326 | # we check if our (slash-modified) path + PARTUUID matches any in the 1327 | # existing EFI boot list, which are flagged as being 'windows' boots 1328 | local SMBOOTPATH="${EFIBOOTDIR}/${EFIBOOTFILE}" 1329 | SMBOOTPATH="${SMBOOTPATH//\//\\}" # map to backslash separators 1330 | declare -i FOUNDCLASH=0 I 1331 | for I in "${!EBOOTUUIDS[@]}"; do 1332 | if [[ "${EBOOTUUIDS[$I]}" == "${EFIPARTUUID}" && \ 1333 | "${EBOOTPATHS[$I]}" == "${SMBOOTPATH}" && \ 1334 | "${EBOOTNAMES[$I],,}" == "windows"* ]]; then 1335 | FOUNDCLASH=1 1336 | break 1337 | fi 1338 | done 1339 | if ((FOUNDCLASH==1)); then 1340 | warning "Your EFI boot file pathname clashes with at least one" 1341 | warning "Windows bootloader in the EFI boot list; consider" 1342 | warning "changing it to /EFI/Boot/gentoo.efi for safety" 1343 | warning "(as otherwise, the Windows bootloader may be overwritten)" 1344 | fi 1345 | } 1346 | make_key_file_location_expicit_if_necessary_and_wanted() { 1347 | # whenever the EFIPARTUUID is changed, it is possible that an (implicitly 1348 | # defined) KEYFILEPARTUUID should then become explicit - so do this if 1349 | # need be (and warn if so) 1350 | if [[ ! -v KEYFILEPARTUUID && ! -v OLD_KEYFILEPARTUUID && -v EFIPARTUUID && \ 1351 | -n "${LUKSKEYFILE}" && -n "${OLD_LUKSKEYFILE}" ]]; then 1352 | # key file location implicit, and was implicit on entry, but EFI location defined 1353 | if [[ -v OLD_EFIPARTUUID && "${EFIPARTUUID}" != "${OLD_EFIPARTUUID}" ]]; then 1354 | show "Previously, KEYFILEPARTUUID was unset, and so implicitly followed" 1355 | show "the value of EFIPARTUUID (the EFI system partition)." 1356 | show "Now you have changed EFIPARTUUID, you must choose what to do" 1357 | show "about the keyfile." 1358 | 1359 | local -i DOEXIT=0 1360 | declare -a KEYFILEMENU=("Keep keyfile in previous EFI system partition" \ 1361 | "Move keyfile to new EFI system partition (retain implicit tracking)") 1362 | local X 1363 | until ((DOEXIT==1)); do 1364 | show "Please choose your desired option:" 1365 | select X in "${KEYFILEMENU[@]}"; do 1366 | case "${X}" in 1367 | "Keep keyfile in previous EFI system partition") 1368 | show "OK, explicitly defining KEYFILEPARTUUID now" 1369 | KEYFILEPARTUUID="${OLD_EFIPARTUUID}" 1370 | DOEXIT=1 1371 | break ;; 1372 | "Move keyfile to new EFI system partition (retain implicit tracking)") 1373 | show "OK, the init scripts will look for the keyfile in the newly" 1374 | show "specified EFI system partition now (once you rebuild the kernel)" 1375 | show "You will asked whether to physically copy over the keyfile" 1376 | show "when you select 'Save and exit' from the main menu" 1377 | DOEXIT=1 1378 | break ;; 1379 | *) warning "Please choose one of the menu options!"; break ;; 1380 | esac 1381 | done 1382 | done 1383 | fi 1384 | fi 1385 | } 1386 | copy_file_from_partition_to_partition() { 1387 | # used to copy files from one partition to another 1388 | # prints a warning only if not successful (you can specify text of this) 1389 | # if mounted on entry, a partition will remain so on exit 1390 | # if unmounted on entry, the partition will be unmounted again on exit 1391 | local FROMPARTUUID="${1,,}" 1392 | local FROMPATH="${2}" # path relative to mountpoint, starting with / 1393 | local TOPARTUUID="${3,,}" 1394 | local TOPATH="${4}" # path relative to mountpoint, starting with / 1395 | local ONSUCCESSTEXT="${5}" 1396 | local ONERRORTEXT="${6}" 1397 | local COPYFLAGS=${7:-"--force"} 1398 | declare -i FROMPARTMOUNTEDONENTRY=0 TOPARTMOUNTEDONENTRY=0 1399 | declare -i DIDMOUNTFROM=0 DIDMOUNTTO=0 1400 | # both of these UUIDs need to be in the /dev/disk/by-partuuid list 1401 | # or it's no go 1402 | local FROMEFIPARTPATH="${PARTUUIDDEVDIR}/${FROMPARTUUID}" 1403 | local TOEFIPARTPATH="${PARTUUIDDEVDIR}/${TOPARTUUID}" 1404 | if [[ ! -e "${FROMEFIPARTPATH}" || ! -e "${TOEFIPARTPATH}" ]]; then 1405 | warning "${ONERRORTEXT}" 1406 | return 0 1407 | fi 1408 | local FROMPARTNAME="$(readlink --canonicalize "${FROMEFIPARTPATH}")" # e.g. /dev/sda3 1409 | local TOPARTNAME="$(readlink --canonicalize "${TOEFIPARTPATH}")" # e.g. /dev/sdb3 1410 | local ALLMOUNTEDPARTS="$(df -P)" 1411 | local FROMMOUNT="$(grep "^${FROMPARTNAME}" <<<"${ALLMOUNTEDPARTS}" | perl -pe 's/^(\S+\s+){5}//')" 1412 | local TOMOUNT="$(grep "^${TOPARTNAME}" <<<"${ALLMOUNTEDPARTS}" | perl -pe 's/^(\S+\s+){5}//')" 1413 | if [ -n "${FROMMOUNT}" ]; then 1414 | FROMPARTMOUNTEDONENTRY=1 1415 | fi 1416 | if [ -n "${TOMOUNT}" ]; then 1417 | TOPARTMOUNTEDONENTRY=1 1418 | fi 1419 | if ((FROMPARTMOUNTEDONENTRY==0)); then 1420 | FROMMOUNT=$(mktemp -d) 1421 | if mount_and_remember "${FROMPARTNAME}" "${FROMMOUNT}"; then 1422 | DIDMOUNTFROM=1 1423 | else 1424 | warning "Failed to mount ${FROMPARTNAME}" 1425 | fi 1426 | fi 1427 | if ((TOPARTMOUNTEDONENTRY==0)); then 1428 | if [[ "${FROMPARTUUID}" != "${TOPARTUUID}" ]]; then 1429 | TOMOUNT=$(mktemp -d) 1430 | if mount_and_remember "${TOPARTNAME}" "${TOMOUNT}"; then 1431 | DIDMOUNTTO=1 1432 | else 1433 | warning "Failed to mount ${TOPARTNAME}" 1434 | fi 1435 | else 1436 | TOMOUNT="${FROMMOUNT}" 1437 | fi 1438 | fi 1439 | local TODIR="$(dirname "${TOPATH}")" 1440 | if [[ "${TODIR}" != "/" ]]; then 1441 | # ensure parent directories exist 1442 | mkdir --parents --verbose "${TOMOUNT}${TODIR}" 1443 | fi 1444 | 1445 | cp ${COPYFLAGS} "${FROMMOUNT}${FROMPATH}" "${TOMOUNT}${TOPATH}" && \ 1446 | show "${ONSUCCESSTEXT}" || warning "${ONERRORTEXT}" 1447 | sync 1448 | # now unmount, if we mounted 1449 | if ((DIDMOUNTTO==1)); then 1450 | umount_and_forget "${TOMOUNT}" 1451 | rmdir "${TOMOUNT}" 1452 | fi 1453 | if ((DIDMOUNTFROM==1)); then 1454 | umount_and_forget "${FROMMOUNT}" 1455 | rmdir "${FROMMOUNT}" 1456 | fi 1457 | } 1458 | ask_whether_to_proceed() { 1459 | show "Secure-bootable EFI kernel build script" 1460 | check_is_luks_volume "${CRYPTPATHMAP}" 1461 | if ((ARG_COPYFROMSTAGING==1)); then 1462 | show "Will copy built kernel from ${BOOTDIR} to ${FULLEFIBOOTDIR}" 1463 | else 1464 | show "Will build ${NEWVERSION}; running kernel is ${CURRENTVERSION}" 1465 | if ((ARG_STAGEONLY)); then 1466 | show "(will build in ${BOOTDIR} (staging) only)" 1467 | fi 1468 | fi 1469 | # if in non-interactive mode, proceed automatically 1470 | if ((ARG_ASK==1)); then 1471 | continue_yn "Do you want to proceed" 1472 | fi 1473 | } 1474 | conform_efi_boot_order_if_possible() { 1475 | # checks if we have been booted under UEFI, and, if so, whether or not 1476 | # the EFIBOOTNAME is present, accurate, active, and at the top of the boot 1477 | # order; if all these conditions are met, does nothing, otherwise, deletes 1478 | # any old (clashing) entry for the EFIBOOTNAME, and inserts a new one 1479 | # (which automatically starts off active and at the top of the list) 1480 | if ((USINGEFI==0)); then 1481 | warning "Your system is not currently booted under EFI" 1482 | warning "As such, unable to set EFI stub kernel in boot list" 1483 | if [[ ( "${EFIBOOTFILE}" == "bootx64.efi" && "${EFIBOOTDIR}" == "/EFI/Boot" ) || \ 1484 | ( "${EFIBOOTFILE}" == "bootmgfw.efi" && "${EFIBOOTDIR}" == "/EFI/Microsoft/Boot" ) ]]; then 1485 | warning "Manually select device using BIOS, to boot this kernel" 1486 | if [[ "${EFIBOOTFILE}" == "bootx64.efi" ]]; then 1487 | warning "If unsuccessful, try using /EFI/Microsoft/Boot/bootmgfw.efi instead" 1488 | else 1489 | warning "If unsuccessful, try using /EFI/Boot/bootx64.efi instead" 1490 | fi 1491 | else 1492 | warning "Non-standard boot path specified!" 1493 | warning "Manually select boot file using BIOS or EFI shell" 1494 | fi 1495 | # nothing more we can do 1496 | return 0 1497 | fi 1498 | if ((CREATEEFIBOOT==0)); then 1499 | warning "Not setting up, or checking, EFI boot entry" 1500 | warning "(as CREATEEFIBOOT=0 set in ${CONFFILE})" 1501 | # nothing more we can do 1502 | return 0 1503 | fi 1504 | if ((EFIBOOTENTRIESSEARCHED==0)); then 1505 | find_all_efi_boot_entries 1506 | fi 1507 | # are we already at the top? 1508 | declare -i NEWBOOTENTRYNEEDED=1 1509 | local SMBOOTPATH="${EFIBOOTDIR}/${EFIBOOTFILE}" 1510 | # locate the EFIPARTUUID, if possible 1511 | local EFIPARTPATH="${PARTUUIDDEVDIR}/${EFIPARTUUID}" 1512 | if [ ! -e "${EFIPARTPATH}" ]; then 1513 | warning "EFIPARTUUID (${EFIPARTUUID}) not found on system" 1514 | warning "Cannot conform EFI boot list" 1515 | warning "Ensure EFIPARTUUID is correct, USB device (if appropriate) is" 1516 | warning "inserted, and try again" 1517 | # nothing more we can do 1518 | return 0 1519 | fi 1520 | # ok we do know about this partition, so find out its device path and 1521 | # partition number, as we'll need this to invoke efibootmgr 1522 | local PARTNAME="$(readlink --canonicalize "${EFIPARTPATH}")" # e.g. /dev/sda3 1523 | local DEVNAME 1524 | # nvme devices have paths of form e.g. /dev/nvme0n1p1 1525 | # mmc devices have paths of form e.g. /dev/mmcblk0p1 1526 | # standard drives have form e.g. /dev/sda3 1527 | if [[ ${PARTNAME} =~ ^/dev/.*[[:digit:]]p[[:digit:]]+$ ]]; then 1528 | DEVNAME="${PARTNAME%%p[[:digit:]]*}" # e.g. /dev/nvme0n1, /dev/mmcblk0 1529 | else 1530 | DEVNAME="${PARTNAME%%[[:digit:]]*}" # e.g. /dev/sda 1531 | fi 1532 | local PARTNUM="${PARTNAME##*[^[:digit:]]}" # e.g. 3 1533 | local BOOTLABEL 1534 | # label will reflect if desired EFI partition is on USB or not 1535 | if partuuid_is_on_usb_device "${EFIPARTUUID}"; then 1536 | BOOTLABEL="Gentoo Linux (USB Key)" 1537 | else 1538 | BOOTLABEL="Gentoo Linux (Internal Drive)" 1539 | fi 1540 | SMBOOTPATH="${SMBOOTPATH//\//\\}" # map boot file path to backslash separators 1541 | declare -i NUMBOOTORDERS="${#EBOOTORDER[@]}" 1542 | if ((NUMBOOTORDERS>0)); then 1543 | local FIRSTBOOTID="${EBOOTORDER[0]}" 1544 | # look this up - it may not match if the top item is e.g. a net boot 1545 | if [[ "${EBOOTIDTOINDEX[${FIRSTBOOTID}]+_}" ]]; then 1546 | declare -i IX="${EBOOTIDTOINDEX[${FIRSTBOOTID}]}" 1547 | # now check if this boot matches what we want; if so, leave it alone 1548 | if [[ "${EBOOTNAMES[${IX}]}" == "${BOOTLABEL}" && \ 1549 | "${EBOOTPATHS[${IX}]}" == "${SMBOOTPATH}" && \ 1550 | "${EBOOTUUIDS[${IX}]}" == "${EFIPARTUUID}" && \ 1551 | "${EBOOTISACTIVES[${IX}]}" == "1" ]]; then 1552 | # all criteria met! 1553 | NEWBOOTENTRYNEEDED=0 1554 | fi 1555 | fi 1556 | fi 1557 | if ((NEWBOOTENTRYNEEDED==1)); then 1558 | ensure_efivarfs_rw_if_present 1559 | # remove any existing bootnums with the same name first 1560 | declare -i I=0 1561 | for I in "${!EBOOTNAMES[@]}"; do 1562 | if [[ "${EBOOTNAMES[${I}]}" == "${BOOTLABEL}" ]]; then 1563 | show "Deleting conflicting boot entry ${EBOOTIDS[${I}]} ('${EBOOTNAMES[${I}]}')" 1564 | efibootmgr --quiet --delete-bootnum --bootnum "${EBOOTIDS[${I}]}" 1565 | fi 1566 | done 1567 | show "Adding ('${BOOTLABEL}') to top of the EFI boot list" 1568 | efibootmgr --create --disk "${DEVNAME}" --part "${PARTNUM}" --loader "${SMBOOTPATH}" --label "${BOOTLABEL}" 1569 | restore_efivarfs_mount_state 1570 | else 1571 | show "Appropriate entry already exists at the top of EFI boot list" 1572 | fi 1573 | } 1574 | check_key_file_if_on_efi_system_partition () { 1575 | # We check for the presence of a key file ONLY if it is on the EFI system 1576 | # partition, as this must be mounted on entry to this function 1577 | if [ -n "${LUKSKEYFILE}" ]; then 1578 | if [[ "${KEYFILEPARTUUID}" == "${EFIPARTUUID}" ]]; then 1579 | # keyfile should be on our already-mounted partition 1580 | if [ ! -s "${EFIROOTDIR}/${LUKSKEYFILE}" ]; then 1581 | die "The ${EFIPARTNAME} does not contain a LUKS key file" 1582 | fi 1583 | else 1584 | warning "Your keyfile partition is != the EFI system partition" 1585 | warning "Please ensure that ${LUKSKEYFILE} is present, on partition" 1586 | warning "${KEYFILEPARTUUID}," 1587 | warning "before attemping to reboot" 1588 | fi 1589 | fi 1590 | } 1591 | ensure_efi_partition_mounted() { 1592 | MOUNTEDONENTRY=0 1593 | if mount | grep -q " ${EFIROOTDIR} " > /dev/null; then 1594 | # check it is the correct partition, otherwise unmount it (to stop bad 1595 | # things happening in the case where the user leaves an old partition 1596 | # mounted, changes the EFIPARTUUID in /etc/buildkernel.conf, then runs 1597 | # buildkernel) 1598 | local MOUNTEDPARTUUID="$(lsblk --noheadings --list --output="MOUNTPOINT,PARTUUID" | grep "^${EFIROOTDIR}[[:space:]]" | awk '{print $2;}')" 1599 | MOUNTEDPARTUUID="${MOUNTEDPARTUUID,,}" 1600 | if [[ "${MOUNTEDPARTUUID}" == "${EFIPARTUUID}" ]]; then 1601 | # remember original mount status, so we can maintain it later if needed 1602 | MOUNTEDONENTRY=1 1603 | else 1604 | warning "Wrong PARTUUID mounted on ${EFIROOTDIR}:" 1605 | warning " Have: ${MOUNTEDPARTUUID}" 1606 | warning " Want: ${EFIPARTUUID}" 1607 | warning " Unmounting" 1608 | sync 1609 | umount_and_forget "${EFIROOTDIR}" 1610 | fi 1611 | fi 1612 | if ((MOUNTEDONENTRY==0)); then 1613 | show "The ${EFIPARTNAME} is not mounted." 1614 | show "(If using a USB key to boot from, please ensure it is inserted)" 1615 | if ((ARG_ASK==1)); then 1616 | continue_yn "Would you like to mount it now" 1617 | else 1618 | show "Attemping to mount it..." 1619 | fi 1620 | if ! mount_and_remember "${EFIPATHMAP}" "${EFIROOTDIR}" "vfat"; then 1621 | die "Failed to mount ${EFIPATHMAP}" 1622 | fi 1623 | fi 1624 | check_partuuid_exists "${EFIPARTUUID}" 1625 | if partuuid_is_on_usb_device "${EFIPARTUUID}"; then 1626 | USINGUSBKEYFOREFI=1 1627 | EFIPARTNAME="EFI boot USB key" 1628 | else 1629 | USINGUSBKEYFOREFI=0 1630 | fi 1631 | check_key_file_if_on_efi_system_partition 1632 | } 1633 | setup_build_directory() { 1634 | if [ -z "${LINUXBUILDDIR+x}" ]; then 1635 | LINUXBUILDDIR="${LINUXDIR}" 1636 | else 1637 | LINUXBUILDDIR="${LINUXBUILDDIR%/}/${PROGNAME}" 1638 | if [ -d "${LINUXBUILDDIR}" ]; then 1639 | if ((ARG_CLEAN==1)); then 1640 | show "Cleaning ${LINUXBUILDDIR}..." 1641 | rm -r "${LINUXBUILDDIR}" 1642 | show "Copying from ${LINUXDIR} to ${LINUXBUILDDIR}..." 1643 | cp -ax "${LINUXDIR}"/ "${LINUXBUILDDIR}" 1644 | else 1645 | warning "${LINUXBUILDDIR} exists, using it as-is" 1646 | warning "Specify the --clean/-c option to override this" 1647 | fi 1648 | else 1649 | # ensure parent directory exists... 1650 | mkdir -p "${LINUXBUILDDIR%/*}" 1651 | show "Copying from ${LINUXDIR} to ${LINUXBUILDDIR}..." 1652 | cp -ax "${LINUXDIR}"/ "${LINUXBUILDDIR}" 1653 | fi 1654 | fi 1655 | } 1656 | enter_build_directory() { 1657 | show "Proceeding - entering ${LINUXBUILDDIR}..." 1658 | cd "${LINUXBUILDDIR}" 1659 | } 1660 | copy_config_from_proc_if_necessary () { 1661 | # LINUXBUILDDIR must be defined and non blank on entry 1662 | TARGETCONFIG="${LINUXBUILDDIR}/.config" 1663 | if [ ! -s "${TARGETCONFIG}" ]; then 1664 | if ((ARG_ASK==1)); then 1665 | continue_yn "There is no .config file; use current (${CURRENTVERSION}) config" 1666 | else 1667 | show "No .config file found; using current (${CURRENTVERSION}) config" 1668 | fi 1669 | # requires that the kernel has support for config in /proc 1670 | check_file_exists "${CURRENTCONFIG}" 1671 | zcat "${CURRENTCONFIG}" > "${TARGETCONFIG}" 1672 | fi 1673 | } 1674 | update_config_if_necessary() { 1675 | # LINUXBUILDDIR must be defined and non blank on entry 1676 | if ((ARG_ASK==1)); then 1677 | show "Updating old config using make ${CONFIGUPDATETYPE}" 1678 | if [ "${CONFIGUPDATETYPE}" != "${SILENTUPDATETYPE}" ]; then 1679 | show "Please answer all questions as and if prompted..." 1680 | fi 1681 | (cd "${LINUXBUILDDIR}" && make "${CONFIGUPDATETYPE}") 1682 | else 1683 | # non-interactive mode, so we have to go silent 1684 | show "Updating old config using make ${SILENTUPDATETYPE}" 1685 | (cd "${LINUXBUILDDIR}" && make "${SILENTUPDATETYPE}") 1686 | fi 1687 | } 1688 | conform_config_file() { 1689 | if [[ "${INITSYSTEM}" == "openrc" ]]; then 1690 | show "Although we are targeting OpenRC init, systemd kernel flags will" 1691 | show "still be set, to provide future flexibility" 1692 | fi 1693 | show "Setting Gentoo flags for systemd..." 1694 | # our initial init is a script on the initramfs, which then hands off to 1695 | # systemd or openrc... 1696 | set_kernel_config_list_to_y "GENTOO_LINUX GENTOO_LINUX_UDEV GENTOO_LINUX_INIT_SCRIPT GENTOO_LINUX_INIT_SYSTEMD" 1697 | # set up a few additional flags recommended in the wiki, but not forced on 1698 | # by the above 1699 | show "Setting additional recommended settings for systemd..." 1700 | # we omit IPV6 here - turn on manually if you want it 1701 | set_kernel_config_list_to_y "SECCOMP DMIID TMPFS_POSIX_ACL" 1702 | set_kernel_config "UEVENT_HELPER_PATH" "" 1703 | set_kernel_config_list_to_y "AUDIT AUDITSYSCALL" 1704 | show "Setting kernel command line = '${KERNEL_CMD_LINE}'..." 1705 | set_kernel_config "CMDLINE_BOOL" "y" 1706 | set_kernel_config "CMDLINE" "\"${KERNEL_CMD_LINE}\"" 1707 | show "Setting up initramfs location and type..." 1708 | set_kernel_config "INITRAMFS_SOURCE" "\"${UNCOMPRESSEDINITRAMFS}\"" 1709 | # unless the user specifically directs, we will compress the initramfs with 1710 | # XZ - although the enclosing kernel will be compressed anyway, this can 1711 | # help on low-memory systems; also the need to leave compression off seems 1712 | # to no longer apply with modern kernels 1713 | if ((COMPRESSINITRAMFS==1)); then 1714 | show "Using XZ compression for built-in initramfs" 1715 | unset_kernel_config "INITRAMFS_COMPRESSION_NONE" 1716 | for COMP_TYPE in "GZIP" "BZIP2" "LZMA" "LZO" "LZ4"; do 1717 | unset_kernel_config "INITRAMFS_COMPRESSION_${COMP_TYPE}" 1718 | done 1719 | set_kernel_config "INITRAMFS_COMPRESSION_XZ" "y" 1720 | set_kernel_config "INITRAMFS_COMPRESSION" ".xz" 1721 | else 1722 | warning "As requested, not compressing the built-in initramfs" 1723 | warning "This can lead to boot failure on memory-constrained systems" 1724 | for COMP_TYPE in "GZIP" "BZIP2" "LZMA" "XZ" "LZO" "LZ4"; do 1725 | unset_kernel_config "INITRAMFS_COMPRESSION_${COMP_TYPE}" 1726 | done 1727 | set_kernel_config "INITRAMFS_COMPRESSION_NONE" "y" 1728 | set_kernel_config "INITRAMFS_COMPRESSION" "" 1729 | fi 1730 | 1731 | # ensure we can get at the LUKS volume! note that these could also be 1732 | # modules really, since we copy all modules into the initramfs 1733 | show "Ensuring Serpent, Whirlpool and SHA-512 are included..." 1734 | set_kernel_config_list_to_y "CRYPTO_SERPENT CRYPTO_WP512 CRYPTO_SHA512" 1735 | # the EFI system system partition is formatted FAT... 1736 | show "Ensuring VFAT file system support included..." 1737 | set_kernel_config_list_to_y "VFAT_FS" 1738 | show "Ensuring device mapper and crypt target support are included..." 1739 | set_kernel_config_list_to_y "BLK_DEV_DM DM_CRYPT" 1740 | show "Ensuring kernel makes config available under /proc..." 1741 | set_kernel_config_list_to_y "IKCONFIG IKCONFIG_PROC" 1742 | show "Setting options needed for EFI / stub loading..." 1743 | set_kernel_config_list_to_y "PARTITION_ADVANCED EFI_PARTITION EFI EFIVAR_FS EFI_VARS EFI_STUB" 1744 | show "Enabling real-time-clock support..." 1745 | set_kernel_config_list_to_y "RTC_CLASS RTC_HCTOSYS RTC_SYSTOHC" 1746 | set_kernel_config "RTC_HCTOSYS_DEVICE" "rtc0" 1747 | set_kernel_config_list_to_y "RTC_INTF_SYSFS RTC_INTF_PROC RTC_INTF_DEV RTC_DRV_CMOS" 1748 | if ((DISABLE_SUSPEND==0)); then 1749 | show "Enabling suspend support..." 1750 | set_kernel_config_list_to_y "SUSPEND" 1751 | else 1752 | show "Disabling suspend support..." 1753 | unset_kernel_config "SUSPEND" 1754 | fi 1755 | if ((DISABLE_HIBERNATION==0)); then 1756 | show "Enabling hibernation support..." 1757 | set_kernel_config_list_to_y "HIBERNATION" 1758 | else 1759 | show "Disabling hibernation support..." 1760 | unset_kernel_config "HIBERNATION" 1761 | fi 1762 | show "Ensuring deprecated sysfs support turned off..." 1763 | unset_kernel_config "SYSFS_DEPRECATED" 1764 | # turn off penguin logo at boot if using Plymouth 1765 | if [ -n "${PLYMOUTHTHEME}" ]; then 1766 | show "Plymouth in use: ensuring penguin boot logo is disabled..." 1767 | unset_kernel_config "LOGO" 1768 | fi 1769 | # you can define user_conform_config_file in your buildkernel.conf file... 1770 | if fn_exists user_conform_config_file; then 1771 | show "Calling user_conform_config_file function..." 1772 | (user_conform_config_file) 1773 | fi 1774 | } 1775 | allow_user_to_modify_config_graphically() { 1776 | # make menuconfig (and friends) will sort out any dependencies resulting 1777 | # from calling conform_config_file(), before the UI is presented 1778 | if ((ARG_MENUCONFIG==1)); then 1779 | # force the menuconfig, no matter whether interactive or not 1780 | alertshow "Executing make ${CONFIGTYPE}; select the kernel options you require..." 1781 | make ${CONFIGTYPE} 1782 | elif ((ARG_ASK==1)); then 1783 | # interactive mode 1784 | if test_yn "Would you like to modify the configuration using the editor"; then 1785 | show "Executing make ${CONFIGTYPE}; select the kernel options you require..." 1786 | make ${CONFIGTYPE} 1787 | else 1788 | show "OK, autoconforming configuration using make ${CONFIGUPDATETYPE} instead..." 1789 | make ${CONFIGUPDATETYPE} 1790 | fi 1791 | else 1792 | # non-interactive mode 1793 | show "Autoconforming configuration using make ${SILENTUPDATETYPE}..." 1794 | make ${SILENTUPDATETYPE} 1795 | fi 1796 | } 1797 | set_kernel_config() { 1798 | # flag as $1, value to set as $2, config must exist at "./.config" 1799 | local TGT="CONFIG_${1}" 1800 | local REP="${2//\//\\/}" 1801 | if grep -q "^${TGT}[^_]" .config; then 1802 | sed -i "s/^\(${TGT}=.*\|# ${TGT} is not set\)/${TGT}=${REP}/" .config 1803 | else 1804 | echo "${TGT}=${2}" >> .config 1805 | fi 1806 | } 1807 | set_kernel_config_list_to_y() { 1808 | # force all in list to 'y' 1809 | local x 1810 | for x in ${1}; do 1811 | set_kernel_config "${x}" "y" 1812 | done 1813 | } 1814 | unset_kernel_config() { 1815 | # unsets flag with the value of $1, config must exist at "./.config" 1816 | local TGT="CONFIG_${1}" 1817 | sed -i "s/^${TGT}=.*/# ${TGT} is not set/" .config 1818 | } 1819 | clean_kernel_tree_if_desired() { 1820 | declare -i DOCLEAN="${ARG_CLEAN}" 1821 | if ((DOCLEAN==0 && ARG_ASK==1)); then 1822 | if test_yn "Do a 'make clean' prior to build"; then 1823 | DOCLEAN=1 1824 | fi 1825 | fi 1826 | if ((DOCLEAN==1)); then 1827 | show "Cleaning up..." 1828 | ${MAKE} clean # not mrproper - so our .config file will be left alone 1829 | fi 1830 | } 1831 | kernel_build_pass_1() { 1832 | # touch ramdisk decompressed image file first, so that the 1833 | # kernel has something to include for the first run 1834 | rm ${VERBOSITYFLAG} -f "${UNCOMPRESSEDINITRAMFS}" 1835 | touch "${UNCOMPRESSEDINITRAMFS}" 1836 | show "Building ${NEWVERSION} (pass 1 - dummy initramfs)..." 1837 | 1838 | if ((USINGMODULES==1)); then 1839 | ${MAKE} modules_prepare 1840 | fi 1841 | 1842 | ${MAKE} -j ${NUMCPUSPLUSONE} 1843 | ${MAKE} install 1844 | 1845 | if ((USINGMODULES==1)); then 1846 | show "Installing modules..." 1847 | ${MAKE} modules_install 1848 | fi 1849 | 1850 | show "Installing firmware..." 1851 | show "(where supported; in-kernel firmware was dropped in 4.14)" 1852 | ${MAKE} firmware_install || true 1853 | } 1854 | rebuild_external_modules_if_necessary() { 1855 | if ((ARG_REBUILD_EXTERNAL_MODULES==1)); then 1856 | show "Creating any necessary external modules (e.g., VirtualBox)..." 1857 | if ! emerge ${VERBOSITYFLAG} @module-rebuild; then 1858 | if MAKEOPTS="${MAKEOPTS-} -j1" emerge --resume; then 1859 | warning "emerge @module-rebuild completed successfully, but only by restricting" 1860 | warning "build parallelism" 1861 | else 1862 | warning "Failed to complete emerge @module-rebuild due to error" 1863 | warning "Continuing..." 1864 | BUILT_EXTERNAL_MODULES=0 1865 | fi 1866 | fi 1867 | if [[ ${BUILT_EXTERNAL_MODULES}==1 && -v KERNEL_SIGNING_CERT ]] ; then 1868 | for EXTERNAL_MODULE in `find /lib/modules/${NEWVERSION#"linux-"}/* -type f -name '*.ko' -not -path '*/kernel/*'`; do 1869 | "${LINUXDIR}/scripts/sign-file" sha512 "${KERNEL_SIGNING_KEY}" "${KERNEL_SIGNING_CERT}" "${EXTERNAL_MODULE}" 1870 | done 1871 | fi 1872 | fi 1873 | } 1874 | create_initramfs_using_genkernel() { 1875 | show "Creating initramfs (uncompressed)..." 1876 | # this is a partial use of genkernel, we don't use it to build the kernel 1877 | # itself; also note, we build an uncompressed ramdisk, as the kernel 1878 | # build process will compress it on integration into the 1879 | # unified kernel image 1880 | # we suppress gpg here as we don't want to add gpg v2 which is installed, 1881 | # but rather our static gpg v1, which will be inserted into the initramfs 1882 | local PLYMOUTH_OPTS="" 1883 | if [ -n "${PLYMOUTHTHEME}" ]; then 1884 | PLYMOUTH_OPTS="--plymouth --plymouth-theme=${PLYMOUTHTHEME}" 1885 | fi 1886 | local POSTCLEAR_FLAG="" 1887 | if ((ARG_POSTCLEAR==1)); then 1888 | POSTCLEAR_FLAG="--postclear" # clear all caches after genkenrel run 1889 | fi 1890 | GENKERNEL_OPTS="--install --no-mountboot --luks " 1891 | if ((DISABLE_LVM==0)); then 1892 | GENKERNEL_OPTS+="--lvm " 1893 | fi 1894 | GENKERNEL_OPTS+="--no-gpg --udev ${POSTCLEAR_FLAG} " 1895 | GENKERNEL_OPTS+="--kernel-config=\"${TARGETCONFIG}\" --busybox " 1896 | GENKERNEL_OPTS+="--no-compress-initramfs " 1897 | GENKERNEL_OPTS+="${ADDITIONALGENKERNELOPTS} ${PLYMOUTH_OPTS} initramfs" 1898 | genkernel ${GENKERNEL_OPTS} 1899 | # re-extract release details, in case these have changed 1900 | # (e.g. due to 'SCM dirty suffix' having been added (a '+' sign)) 1901 | extract_kernel_release_name 1902 | cp ${VERBOSITYFLAG} "${BOOTDIR}/${INITRAMFSNAME}" "${UNCOMPRESSEDINITRAMFS}" 1903 | } 1904 | unpack_initramfs() { 1905 | show "Unpacking initramfs cpio archive to ${INITRAMFSDIR}..." 1906 | if [ ! -d "${INITRAMFSDIR}" ]; then 1907 | mkdir "${INITRAMFSDIR}" 1908 | else 1909 | rm ${VERBOSITYFLAG} -rf "${INITRAMFSDIR}"/* # wipe any old data 1910 | fi 1911 | (cd "${INITRAMFSDIR}"; cpio --extract --file="${UNCOMPRESSEDINITRAMFS}") 1912 | } 1913 | build_static_gpg() { 1914 | # gnupg not slotted unfortunately, so we do this instead 1915 | show "Building static gpg 1.x for use in initramfs..." 1916 | emerge ${VERBOSITYFLAG} "app-crypt/staticgpg" 1917 | } 1918 | modify_initramfs() { 1919 | if [ -n "${LUKSKEYFILE}" ]; then 1920 | if [ ! -x "${GPG1PATHFROM}" ]; then 1921 | if ((ARG_ASK==1)); then 1922 | continue_yn "No static gpg found, would you like to build it?" 1923 | else 1924 | show "No static gpg found, so creating one..." 1925 | fi 1926 | build_static_gpg 1927 | fi 1928 | show "Copying static gpg program into initramfs..." 1929 | cp ${VERBOSITYFLAG} "${GPG1PATHFROM}" "${GPG1PATHTO}" 1930 | fi 1931 | 1932 | if ((USINGMODULES==1)); then 1933 | show "Copying contents of ${MODPROBEDIR} directory into initramfs..." 1934 | if [ "$(ls -A ${MODPROBEDIR})" ]; then 1935 | cp ${VERBOSITYFLAG} "${MODPROBEDIR}"/* "${INITRAMFSDIR}${MODPROBEDIR}/" 1936 | fi 1937 | fi 1938 | 1939 | # you can define user_modify_initramfs in your buildkernel.conf file... 1940 | if fn_exists user_modify_initramfs; then 1941 | show "Calling user_modify_initramfs function..." 1942 | (user_modify_initramfs) 1943 | fi 1944 | } 1945 | repack_initramfs() { 1946 | show "Deleting old initramfs cpio archive, and repacking..." 1947 | rm ${VERBOSITYFLAG} -f "${UNCOMPRESSEDINITRAMFS}" "${BOOTDIR}/${INITRAMFSNAME}" 1948 | (cd "${INITRAMFSDIR}"; find . | cpio -H newc --create > "${UNCOMPRESSEDINITRAMFS}") 1949 | cp ${VERBOSITYFLAG} "${UNCOMPRESSEDINITRAMFS}" "${BOOTDIR}/${INITRAMFSNAME}" 1950 | } 1951 | kernel_build_pass_2() { 1952 | show "Building ${NEWVERSION} (pass 2, to include real initramfs)..." 1953 | ${MAKE} -j ${NUMCPUSPLUSONE} 1954 | show "Installing boot files to ${BOOTDIR}; for reference only..." 1955 | ${MAKE} install 1956 | # no need to re-install modules or firmware - only the initramfs has changed 1957 | } 1958 | sign_kernel_if_possible() { 1959 | if [ -s "${BOOTDIR}/${VMLINUZNAME}${SIGNEDSUFFIX}" ]; then 1960 | show "Removing old signed kernel ${BOOTDIR}/${VMLINUZNAME}${SIGNEDSUFFIX}" 1961 | rm ${VERBOSITYFLAG} "${BOOTDIR}/${VMLINUZNAME}${SIGNEDSUFFIX}" 1962 | fi 1963 | if [ -s "${SECUREBOOTKEY}" -a -s "${SECUREBOOTCERT}" ]; then 1964 | show "Signing kernel" 1965 | sbsign --key "${SECUREBOOTKEY}" --cert "${SECUREBOOTCERT}" \ 1966 | --output "${BOOTDIR}/${VMLINUZNAME}${SIGNEDSUFFIX}" \ 1967 | "${BOOTDIR}/${VMLINUZNAME}" 1968 | else 1969 | warning "No key / certificate present in ${SECUREBOOTKEY}" 1970 | warning "This kernel will only boot in unsecured EFI mode!" 1971 | fi 1972 | } 1973 | purge_old_backup_kernel_and_config_if_present() { 1974 | local FILEPREFIX=${1:-""} 1975 | rm -rf "${FULLEFIBOOTDIR}/${FILEPREFIX}${EFIBOOTFILE}${OLDSUFFIX}" 1976 | rm -rf "${FULLEFIBOOTDIR}/${FILEPREFIX}${EFICONFIGFILE}${OLDSUFFIX}" 1977 | } 1978 | check_if_enough_disk_space_for_backups() { 1979 | # do the best we can - if using an existing (Windows) EFI system partition 1980 | # (and an unshrunk kernel) things may be tight 1981 | declare -i OLDKERNSIZEKB=0 OLDCONFIGSIZEKB=0 1982 | declare -i NEWKERNSIZEKB=0 NEWCONFIGSIZEKB=0 1983 | declare -i FREESPACEKB="$(df -k "${EFIROOTDIR}" | tail -n 1 | awk '{print $4}' | sed 's/[Kk]//g')" 1984 | # introduce a safety factor for file overhead etc 1985 | FREESPACEKB=$((FREESPACEKB*90/100)) 1986 | if [ -s "${FULLEFIBOOTDIR}/${EFIBOOTFILE}" ]; then 1987 | OLDKERNSIZEKB="$(stat --format="%s" "${FULLEFIBOOTDIR}/${EFIBOOTFILE}")" 1988 | OLDKERNSIZEKB=$((OLDKERNSIZEKB/1024)) 1989 | fi 1990 | if [ -s "${FULLEFIBOOTDIR}/${EFICONFIGFILE}" ]; then 1991 | OLDCONFIGSIZEKB="$(stat --format="%s" "${FULLEFIBOOTDIR}/${EFICONFIGFILE}")" 1992 | OLDCONFIGSIZEKB=$((OLDCONFIGSIZEKB/1024)) 1993 | fi 1994 | if [ -s "${BOOTDIR}/${VMLINUZNAME}${SIGNEDSUFFIX}" ]; then 1995 | NEWKERNSIZEKB="$(stat --format="%s" "${BOOTDIR}/${VMLINUZNAME}${SIGNEDSUFFIX}")" 1996 | else 1997 | NEWKERNSIZEKB="$(stat --format="%s" "${BOOTDIR}/${VMLINUZNAME}")" 1998 | fi 1999 | NEWKERNSIZEKB=$((NEWKERNSIZEKB/1024)) 2000 | NEWCONFIGSIZEKB="$(stat --format="%s" "${TARGETCONFIG}")" 2001 | NEWCONFIGSIZEKB=$((NEWCONFIGSIZEKB/1024)) 2002 | declare -i TOTALNEWKB=$((NEWKERNSIZEKB+NEWCONFIGSIZEKB)) 2003 | declare -i TOTALOLDKB=0 2004 | if ((BACKUPOLDKERNEL==1)); then 2005 | TOTALOLDKB+=$((OLDKERNSIZEKB+OLDCONFIGSIZEKB)) 2006 | fi 2007 | declare -i TOTALREQKB=$((TOTALOLDKB+TOTALNEWKB)) 2008 | if ((TOTALNEWKB>FREESPACEKB)); then 2009 | # would we have enough if we deleted the old files? 2010 | declare -i RECOVERABLEKB=0 2011 | if [ -s "${FULLEFIBOOTDIR}/${EFIBOOTFILE}" ]; then 2012 | RECOVERABLEKB+="$(stat --format="%s" "${FULLEFIBOOTDIR}/${EFIBOOTFILE}")" 2013 | fi 2014 | if [ -s "${FULLEFIBOOTDIR}/${EFICONFIGFILE}" ]; then 2015 | RECOVERABLEKB+="$(stat --format="%s" "${FULLEFIBOOTDIR}/${EFICONFIGFILE}")" 2016 | fi 2017 | if ((TOTALNEWKB<=(FREESPACEKB+RECOVERABLEKB))); then 2018 | # purge them now 2019 | warning "Deleting previous kernel and configuration from EFI" 2020 | warning "system partition, to save space" 2021 | rm -vf "${FULLEFIBOOTDIR}/${EFIBOOTFILE}" 2022 | rm -vf "${FULLEFIBOOTDIR}/${EFICONFIGFILE}" 2023 | FREESPACEKB+="${RECOVERABLEKB}" 2024 | # obviously, nothing to back up now! 2025 | warning "Suppressing backup on this run" 2026 | BACKUPOLDKERNEL=0 2027 | else 2028 | die "Insufficient space to copy kernel onto EFI system partition!" 2029 | fi 2030 | fi 2031 | if ((TOTALREQKB>FREESPACEKB)); then 2032 | warning "Insufficient space to backup prior kernel" 2033 | warning "Suppressing backup on this run" 2034 | BACKUPOLDKERNEL=0 2035 | fi 2036 | } 2037 | backup_prior_efi_kernel_if_present() { 2038 | local FILEPREFIX=${1:-""} 2039 | # first, make sure the directory exists! 2040 | mkdir -pv "${FULLEFIBOOTDIR}" 2041 | if ((BACKUPOLDKERNEL==1)); then 2042 | # now backup any prior kernel 2043 | if [ -s "${FULLEFIBOOTDIR}/${EFIBOOTFILE}" ]; then 2044 | show "Backing up bootfile in case of failure..." 2045 | cp ${VERBOSITYFLAG} -f "${FULLEFIBOOTDIR}/${EFIBOOTFILE}" "${FULLEFIBOOTDIR}/${FILEPREFIX}${EFIBOOTFILE}${OLDSUFFIX}" 2046 | fi 2047 | fi 2048 | } 2049 | backup_prior_config_if_present() { 2050 | local FILEPREFIX=${1:-""} 2051 | if ((BACKUPOLDKERNEL==1)); then 2052 | if [ -s "${FULLEFIBOOTDIR}/${EFICONFIGFILE}" ]; then 2053 | show "Backing up config in case of failure..." 2054 | cp ${VERBOSITYFLAG} -f "${FULLEFIBOOTDIR}/${EFICONFIGFILE}" "${FULLEFIBOOTDIR}/${FILEPREFIX}${EFICONFIGFILE}${OLDSUFFIX}" 2055 | fi 2056 | fi 2057 | } 2058 | copy_new_efi_kernel_to_efi_partition() { 2059 | show "Copying EFI-bootable kernel $NEWVERSION to EFI directory..." 2060 | if [ -s "${BOOTDIR}/${VMLINUZNAME}${SIGNEDSUFFIX}" ]; then 2061 | cp ${VERBOSITYFLAG} "${BOOTDIR}/${VMLINUZNAME}${SIGNEDSUFFIX}" "${FULLEFIBOOTDIR}/${EFIBOOTFILE}" 2062 | else 2063 | cp ${VERBOSITYFLAG} "${BOOTDIR}/${VMLINUZNAME}" "${FULLEFIBOOTDIR}/${EFIBOOTFILE}" 2064 | fi 2065 | } 2066 | copy_new_config_to_efi_partition() { 2067 | show "Copying .config file to EFI directory (for reference only)..." 2068 | cp ${VERBOSITYFLAG} "${TARGETCONFIG}" "${FULLEFIBOOTDIR}/${EFICONFIGFILE}" 2069 | } 2070 | finalize_efi_partition_and_unmount_if_desired() { 2071 | show "Syncing filesystem..." 2072 | sync 2073 | echo 2074 | DOUNMOUNT=0 2075 | 2076 | if ((ARG_UNMOUNTATEND==1)); then 2077 | # this trumps everything else 2078 | DOUNMOUNT=1 2079 | else 2080 | if ((ARG_ASK==1)); then 2081 | # check with user what to do 2082 | if test_yn "Completed: would you like to unmount the ${EFIPARTNAME} now"; then 2083 | DOUNMOUNT=1 2084 | fi 2085 | else 2086 | # leave things how we found them 2087 | if ((MOUNTEDONENTRY==0)); then 2088 | DOUNMOUNT=1; 2089 | fi 2090 | fi 2091 | fi 2092 | if ((DOUNMOUNT==1)); then 2093 | umount_and_forget "${EFIROOTDIR}" 2094 | if ((USINGUSBKEYFOREFI==1)); then 2095 | show "Unmounted, it is now safe to remove the ${EFIPARTNAME}" 2096 | fi 2097 | else 2098 | if ((ARG_ASK==0)); then 2099 | show "The ${EFIPARTNAME} has been left mounted" 2100 | else 2101 | show "OK, the ${EFIPARTNAME} has been left mounted" 2102 | fi 2103 | fi 2104 | } 2105 | display_final_status() { 2106 | show "All done!" 2107 | if ((ARG_STAGEONLY==1)); then 2108 | show " (Remember to run again with the --copy-from-staging option, to install" 2109 | show " to the EFI system partition)" 2110 | fi 2111 | } 2112 | if_option_has_value() { 2113 | # execute third argument as function, if the variable *named by* the second 2114 | # argument has the value passed in the first argument 2115 | # remaining arguments (if any) will be passed to the invoked function 2116 | declare -i ARG TESTVAL 2117 | TESTVAL="${1}" 2118 | shift 2119 | eval ARG="\$${1}" # bash indirect reference 2120 | shift 2121 | if ((ARG==TESTVAL)); then 2122 | local TORUN="${1}" 2123 | shift 2124 | # execute the command with the remaining arguments 2125 | "${TORUN}" "${@}" 2126 | fi 2127 | } 2128 | if_option_set() { 2129 | # execute second argument as function if variable named by the first 2130 | # argument has value 1 2131 | if_option_has_value 1 "${@}" 2132 | } 2133 | if_option_unset() { 2134 | # execute second argument as function if variable named by the first 2135 | # argument has value 0 2136 | if_option_has_value 0 "${@}" 2137 | } 2138 | print_usage() { 2139 | cat << EOF 2140 | Usage: ${PROGNAME} [options] 2141 | 2142 | Options: 2143 | -a, --ask turns on interactive mode: you must confirm key actions 2144 | -A, --alert sound terminal bell when interaction required 2145 | (selecting this also automatically selects --ask) 2146 | -b, --snapshot-backup make a datestamped kernel / configuration backup on EFI 2147 | system partition (to keep a last-known-good version) 2148 | -c, --clean do a make clean at the beginning of kernel build 2149 | -e, --easy-setup invoke a simple, menu-driven setup for buildkernel.conf 2150 | -f, --copy-from-staging 2151 | use this option after compiling a kernel with 2152 | --stage-only, to copy it to the EFI system partition 2153 | -h, --help show this help message and exit 2154 | -i, --is-new-kernel-available 2155 | return with code 0 if the currently-running kernel has 2156 | a different version from that built in the staging area 2157 | (at /boot), or 1 otherwise 2158 | -m, --menuconfig show kernel configuration GUI, even if non-interactive 2159 | -p, --postclear clear genkernel temporary files and caches after run 2160 | -r, --adjustment=N add integer N to the make niceness -20<=N<=19 2161 | (the default is 19; this runs make at the lowest 2162 | priority to avoid slowing the system too much) 2163 | -s, --stage-only prepare kernel in /boot as usual, but do not copy 2164 | to system partition 2165 | -u, --unmount-at-end umount the EFI system partition on successful exit 2166 | -v, --verbose display more information, where possible 2167 | -x, --rebuild-external-modules 2168 | rebuild external modules if present 2169 | -V, --version display the version number of ${PROGNAME} and exit 2170 | EOF 2171 | } 2172 | print_help() { 2173 | cat << EOF 2174 | ${PROGNAME} - build a secure boot kernel and save to EFI system partition 2175 | EOF 2176 | print_usage 2177 | } 2178 | print_version() { 2179 | printf "%s\n" "${VERSION}" 2180 | } 2181 | display_usage_message_and_bail_out() { 2182 | if [ ! -z "${1+x}" ]; then 2183 | printf "%s: %s\n" "${PROGNAME}" "${1}" >&2 2184 | fi 2185 | print_usage >&2 2186 | cleanup_and_exit_with_code 1 2187 | } 2188 | internal_consistency_option_checks() { 2189 | # following not exhaustive, just some more obvious snafus 2190 | if ((ARG_STAGEONLY==1 && ARG_COPYFROMSTAGING==1)); then 2191 | display_usage_message_and_bail_out "cannot set both --copy-from-staging and --stage-only" 2192 | fi 2193 | if ((ARG_CLEAN==1 && ARG_COPYFROMSTAGING==1)); then 2194 | display_usage_message_and_bail_out "--clean is meaningless with --copy-from-staging" 2195 | fi 2196 | if ((ARG_STAGEONLY==1 && ARG_UNMOUNTATEND==1)); then 2197 | display_usage_message_and_bail_out "--unmount-at-end is meaningless with --stage-only" 2198 | fi 2199 | if ((ARG_MENUCONFIG==1 && ARG_COPYFROMSTAGING==1)); then 2200 | display_usage_message_and_bail_out "--menuconfig if meaningless with --copy-from-staging" 2201 | fi 2202 | if ((ADJUSTMENT<-20 || ADJUSTMENT>19)); then 2203 | display_usage_message_and_bail_out "must have -20 <= make niceness adjustment <= 19" 2204 | fi 2205 | } 2206 | snapshot_kernel_on_efi_partition() { 2207 | local TIMESTAMP_PREFIX=$(date +"%Y-%m-%d-%H-%M-%S-") 2208 | ensure_efi_partition_mounted 2209 | backup_prior_efi_kernel_if_present "${TIMESTAMP_PREFIX}" 2210 | backup_prior_config_if_present "${TIMESTAMP_PREFIX}" 2211 | finalize_efi_partition_and_unmount_if_desired 2212 | } 2213 | exit_zero_if_new_kernel_available() { 2214 | # simple test - is the currently running kernel the same as the one 2215 | # present in the staging area? 2216 | # exit with code 0 if it is not (i.e., a new kernel IS available), or 1 2217 | # if it is 2218 | if [[ "${CURRENTVERSION}" != "${NEWVERSION}" && \ 2219 | (-s "${BOOTDIR}/${VMLINUZNAME}" || -s "${BOOTDIR}/${VMLINUZNAME}${SIGNEDSUFFIX}")]]; then 2220 | cleanup_and_exit_with_code 0 2221 | else 2222 | # up to date, or no new kernel available, so th 2223 | cleanup_and_exit_with_code 1 2224 | fi 2225 | } 2226 | 2227 | # NB should not invoke any stateful handlers; just set the ARG_... variables 2228 | # deal with 'perform-then-exit' actions, and return 2229 | process_command_line_options() { 2230 | local TEMP 2231 | declare -i RC 2232 | set +e 2233 | # error trapping off, as we want to handle errors 2234 | TEMP="$(getopt -o aAbcefhimpr:suvxV --long ask,alert,snapshot-backup,clean,easy-setup,copy-from-staging,help,is-new-kernel-available,menuconfig,postclear,adjustment:,stage-only,verbose,unmount-at-end,rebuild-external-modules,version -n "${PROGNAME}" -- "${@}")" 2235 | RC="${?}" 2236 | set -e 2237 | if ((RC!=0)); then 2238 | display_usage_message_and_bail_out 2239 | fi 2240 | eval set -- "${TEMP}" 2241 | 2242 | # extract options and their arguments into variables. 2243 | while true ; do 2244 | case "${1}" in 2245 | -a|--ask) ARG_ASK=1 ; shift ;; 2246 | -A|--alert) ARG_ALERT=1 ; ARG_ASK=1 ; shift ;; 2247 | -b|--snapshot-backup) ARG_SNAPSHOTBACKUP=1 ; shift ;; 2248 | -c|--clean) ARG_CLEAN=1 ; shift ;; 2249 | -e|--easy-setup) ARG_EASYSETUP=1 ; shift ;; 2250 | -f|--copy-from-staging) ARG_COPYFROMSTAGING=1 ; shift ;; 2251 | -h|--help) ARG_HELP=1 ; shift ;; 2252 | -i|--is-new-kernel-available) ARG_IS_NEW_KERNEL_AVAILABLE=1 ; shift ;; 2253 | -m|--menuconfig) ARG_MENUCONFIG=1 ; shift ;; 2254 | -p|--postclear) ARG_POSTCLEAR=1 ; shift ;; 2255 | -r|--adjustment) 2256 | case "${2}" in 2257 | "") shift 2 ;; 2258 | *) ADJUSTMENT="${2}" ; shift 2 ;; 2259 | esac ;; 2260 | -s|--stage-only) ARG_STAGEONLY=1 ; shift ;; 2261 | -u|--unmount-at-end) ARG_UNMOUNTATEND=1 ; shift ;; 2262 | -v|--verbose) ARG_VERBOSE=1 ; shift ;; 2263 | -x|--rebuild-external-modules) ARG_REBUILD_EXTERNAL_MODULES=1 ; shift ;; 2264 | -V|--version) ARG_VERSION=1 ; shift ;; 2265 | --) shift ; break ;; 2266 | *) die "Internal error!" ;; 2267 | esac 2268 | done 2269 | # setup make with specified niceness 2270 | MAKE="nice -n ${ADJUSTMENT} make" 2271 | # set verbosity 2272 | if ((ARG_VERBOSE==1)); then 2273 | VERBOSITY+=1 2274 | fi 2275 | if ((VERBOSITY>1)); then 2276 | VERBOSITYFLAG="--verbose" 2277 | fi 2278 | # set interactive mode 2279 | if ((ARG_ASK==1)); then 2280 | ASKFLAG="--ask" 2281 | fi 2282 | if ((ARG_ALERT==1)); then 2283 | ALERTFLAG="--alert" 2284 | else 2285 | suppress_alert 2286 | fi 2287 | internal_consistency_option_checks 2288 | # process 'perform-then-exit' options 2289 | if ((ARG_HELP==1)); then 2290 | print_help 2291 | cleanup_and_exit_with_code 0 2292 | elif ((ARG_VERSION==1)); then 2293 | print_version 2294 | cleanup_and_exit_with_code 0 2295 | elif ((ARG_EASYSETUP==1)); then 2296 | interactively_set_buildkernel_config 2297 | cleanup_and_exit_with_code 0 2298 | fi 2299 | } 2300 | 2301 | # tail end handler called once buildkernel.conf sourced, EFIPATHMAP set etc. 2302 | handle_final_options() { 2303 | if ((ARG_SNAPSHOTBACKUP==1)); then 2304 | snapshot_kernel_on_efi_partition 2305 | cleanup_and_exit_with_code 0 2306 | elif ((ARG_IS_NEW_KERNEL_AVAILABLE==1)); then 2307 | exit_zero_if_new_kernel_available 2308 | fi 2309 | } 2310 | 2311 | # *************** start of script proper *************** 2312 | suppress_colour_and_alert_if_output_not_to_a_terminal 2313 | check_if_booted_under_efi 2314 | find_all_usb_partitions 2315 | source_etc_conf_file 2316 | process_command_line_options "${@}" 2317 | setup_build_directory 2318 | copy_config_from_proc_if_necessary 2319 | update_config_if_necessary 2320 | extract_kernel_release_name 2321 | setup_final_variables 2322 | handle_final_options 2323 | ask_whether_to_proceed 2324 | 2325 | check_gcc_config_and_reset_if_necessary 2326 | if_option_unset "ARG_STAGEONLY" ensure_efi_partition_mounted 2327 | if ((ARG_COPYFROMSTAGING==0)); then 2328 | enter_build_directory 2329 | update_config_if_necessary 2330 | conform_config_file 2331 | allow_user_to_modify_config_graphically 2332 | if_option_set "ARG_ASK" continue_yn "Now build a kernel with this new configuration" 2333 | clean_kernel_tree_if_desired 2334 | kernel_build_pass_1 # with empty initramfs 2335 | rebuild_external_modules_if_necessary 2336 | create_initramfs_using_genkernel 2337 | unpack_initramfs 2338 | modify_initramfs # make sure our static gpg is in there! 2339 | repack_initramfs 2340 | kernel_build_pass_2 # with real initramfs 2341 | sign_kernel_if_possible # if key/certificate available, for secure boot 2342 | fi 2343 | if ((ARG_STAGEONLY==0)); then 2344 | purge_old_backup_kernel_and_config_if_present 2345 | check_if_enough_disk_space_for_backups 2346 | backup_prior_efi_kernel_if_present 2347 | backup_prior_config_if_present 2348 | copy_new_efi_kernel_to_efi_partition 2349 | copy_new_config_to_efi_partition 2350 | conform_efi_boot_order_if_possible 2351 | finalize_efi_partition_and_unmount_if_desired 2352 | fi 2353 | display_final_status 2354 | cleanup_and_exit_with_code 0 2355 | # **************** end of script proper **************** 2356 | -------------------------------------------------------------------------------- /buildkernel.8: -------------------------------------------------------------------------------- 1 | .TH BUILDKERNEL 8 "Version 1.0.37: July 2020" 2 | .SH NAME 3 | buildkernel \- build secure boot kernel, save to EFI system partition 4 | .SH SYNOPSIS 5 | .B buildkernel 6 | [\fIoptions\fR] 7 | .SH DESCRIPTION 8 | \fBbuildkernel\fR is a script that builds a Gentoo Linux EFI stub kernel 9 | which is suitable for booting from a USB key using UEFI (no additional 10 | bootloader required). It makes use of the initramfs creation tools 11 | (and early userspace \fBinit\fR(8) script) provided by \fBgenkernel\fR(8). 12 | 13 | Specifically, the assumed use-case for \fBbuildkernel\fR is where you are creating a kernel 14 | for use in a dual-factor-authenticated LVM-over-LUKS system, booting from an 15 | external USB key, with secure boot enabled (using UEFI), where you 16 | may (optionally) wish to use the \fBplymouth\fR(8) splash manager, and where 17 | the target (final) init system is \fBsystemd\fR(1). 18 | (As of version 1.0.11, \fBOpenRC\fR(8) is also supported as a target 19 | init system.) 20 | 21 | To facilitate this, \fBbuildkernel\fR will create a statically linked version 22 | of \fBgpg\fR(1) \(em one which furthermore does not require \fBpinentry\fR \(em 23 | and include this in the initramfs (unless \fBLUKSKEYFILE\fR is 24 | left blank in \fI/etc/buildkernel.conf\fR: see \fBbuildkernel.conf\fR(5) 25 | for details). 26 | 27 | It will also automatically set the necessary kernel configuration parameters, 28 | including the command line, sign the resulting kernel if possible, 29 | then update the EFI boot list if required. 30 | 31 | The \fBbuildkernel\fR utility can be invoked in non-interactive (default) or 32 | interactive mode (see the \fB--ask\fR option, below). 33 | Non-interactive mode is suitable for use in a scripted invocation. 34 | 35 | Certain key options can be specified via the configuration file, 36 | \fI/etc/buildkernel.conf\fR: again, see \fBbuildkernel.conf\fR(5) for details. 37 | 38 | Although \fBbuildkernel\fR is targetted primarily at the use-case where the 39 | EFI system partition is on a removable USB key (for security), it can 40 | also be used with a system partition on a fixed drive. 41 | 42 | .SH ALGORITHM DETAIL 43 | When invoked, \fBbuildkernel\fR perorms the following steps, in order: 44 | .br 45 | .RS 46 | .IP \(bu 2 47 | reads your \fI/etc/buildkernel.conf\fR configuration file; 48 | .IP \(bu 2 49 | mounts the EFI partition, if not already mounted (to \fI/boot/efi\fR); 50 | .IP \(bu 2 51 | enters the \fI/usr/src/linux\fR directory; 52 | .IP \(bu 2 53 | copies a .config file from the currently running kernel (via \fI/proc/config.gz\fR) if no config already exists in \fI/usr/src/linux\fR, and sanitizes/updates it with \fBmake olddefconfig\fR; 54 | .IP \(bu 2 55 | conforms the .config, by setting/unsetting various key parameters that are required for the kernel to boot successfully in EFI mode, including the somewhat complex kernel command line (which contains directives targeted both at the kernel, and at the \fBinit\fR(8) script provided by \fBgenkernel\fR(8)); required settings for 56 | \fBsystemd\fR(1) are also conformed; 57 | .IP \(bu 2 58 | calls your user hook function \fBuser_conform_config_file\fR if you have defined it in \fI/etc/genkernel.conf\fR (you'll only generally want to do this to override unwanted changes made by \fBbuildkernel\fR in the above step; other changes should be made via the standard \fBmake menuconfig\fR route, per the step below; they will be persisted); 59 | .IP \(bu 2 60 | allows you to modify the resulting configuration using the standard \fBmake menuconfig\fR tool (you can force this to happen, even in non-interactive mode, with \fB--menuconfig\fR, and you will be asked whether you wish to do so in interactive mode (set by \fB--ask\fR)); if you choose not to run \fBmake menuconfig\fR, \fBmake olddefconfig\fR will be run instead (which silently sanitizes/upgrades the conformed \fB.config\fR); 61 | .IP \(bu 2 62 | cleans the kernel tree (if you specify \fB--clean\fR; you will be asked whether you wish to do so in interactive mode (set by \fB--ask\fR)); 63 | .IP \(bu 2 64 | builds the kernel, and its modules, with the specified configuration; in this first pass, an empty initramfs is used (since it must be incorporated in the kernel, to be protected by UEFI secure boot, but we don't have everything necessary to include in it, yet!); 65 | .IP \(bu 2 66 | builds any external modules (such as those required for VirtualBox), using \fBemerge @module-rebuild\fR, if you so specify (using the option \fB--rebuild-external-modules\fR), and optionally signs them (if you have set up the variables \fBKERNEL_SIGNING_CERT\fR and \fBKERNEL_SIGNING_KEY\fR in \fI/etc/buildkernel.conf\fR); 67 | .IP \(bu 2 68 | creates a first cut of the initramfs using \fBgenkernel\fR(8) (see below for more details); this will contain \fBgenkernel\fR(8)'s \fBinit\fR(8) script, compiled modules, any necessary firmware (if you haven't deblobbed), and a minimal set of binaries; it does \fInot\fR at this point contain a static copy of \fBgpg\fR; 69 | .IP \(bu 2 70 | unpacks the initramfs, to the \fI/boot/initramfs\fR directory; 71 | .IP \(bu 2 72 | modifies the initramfs by copying the \fI/etc/modprobe.d\fR directory contents across to it, and the static v1.x \fBgpg\fR(1) binary mentioned earlier (if this does not already exist, \fBbuildkernel\fR will create it); 73 | .IP \(bu 2 74 | calls your user hook function \fBuser_modify_initramfs\fR if you have defined it in \fI/etc/genkernel.conf\fR (you don't need it to make the boot work); 75 | .IP \(bu 2 76 | repacks the initramfs into \fI/boot/initramfs.cpio\fR (the unpacked copy is left at \fI/boot/initramfs\fR too, for reference, since it's useful to be able to see what is in this archive at a glance); 77 | .IP \(bu 2 78 | builds the kernel a second time (to incorporate this 'real' initramfs); this is a quick process as most of the components are unchanged; 79 | .IP \(bu 2 80 | if you have a secure boot private key and public key certificate available in 81 | \fI/etc/efikeys/db.key\fR and \fI/etc/efikeys/db.crt\fR respectively, 82 | signs the kernel so it will secure boot; 83 | .IP \(bu 2 84 | backs up the old kernel and config on the EFI system partition, if any are present; 85 | .IP \(bu 2 86 | copies the newly built kernel (which is configured so as to be an EFI executable), into \fI/boot/efi/EFI/Boot/bootx64.efi\fR (the magic location expected by most UEFI BIOSes; you can override this \(em see \fBgenkenrnel.conf\fR(5)); and also copies the config to the same directory; 87 | .IP \(bu 2 88 | ensures that an EFI boot entry for the new kernel exists, and that it 89 | is placed at the top of the EFI boot order (N.B., it is only possible 90 | to do this if the system is currently booted under EFI); note that 91 | \fBbuildkernel\fR will temporarily make the special 92 | \fI/sys/firmware/efi/efivars\fR filesystem read-write, if required for 93 | these modifications to be made; 94 | .IP \(bu 2 95 | performs a filesystem sync and then unmounts the EFI system partition (if you so specify, see the \fB--unmount-at-end\fR option text). 96 | .RE 97 | .SH MONOLITHIC KERNEL SUPPORT 98 | If \fBCONFIG_MODULES\fR is unset, \fBbuildkernel\fR will automatically detect 99 | this, and in such a case will not attempt to build or install modules during 100 | the flow just described. 101 | .SH OPTIONS 102 | .TP 103 | .BR \-a ", " \-\-ask 104 | Sets interactive mode, in which you will be asked what to do at a number of 105 | key steps in the process (see \fBALGORITHM DETAIL\fR, above). 106 | .TP 107 | .BR \-A ", " \-\-alert 108 | If possible, sounds the terminal bell when interaction is needed. 109 | Selecting this option automatically selects \fB--ask\fR. 110 | .TP 111 | .BR \-b ", " \-\-snapshot\-backup 112 | Makes a backup of the current kernel and config on the EFI system partition, 113 | using a a datestamp prefix for both files (based on the system date at the time 114 | the command was issued). This is useful to preserve a 'last known good' (LNG) 115 | configuration, since the standard backups written by \fBbuildkernel\fR are 116 | overwritten each time the program is run. 117 | .TP 118 | .BR \-c ", " \-\-clean 119 | Specifies that a \fBmake clean\fR should be carried out in the kernel source 120 | directory prior to building (this will leave the \fI.config\fR file intact). 121 | Most of the time, it is fine not to \fBmake clean\fR. 122 | 123 | If this option is left \fIunspecified\fR, then \fBbuildkernel\fR will either: 124 | a) in non-interactive mode, not perform a \fBmake clean\fR; or 125 | b) in interactive move, ask you whether or not you wish to \fBmake clean\fR. 126 | .TP 127 | .BR \-e ", " \-\-easy\-setup 128 | This option invokes a simple, menu-driven setup program for the 129 | \fBbuildkernel.conf(5)\fR configuration file. Using this can help you to 130 | avoid more obvious mistakes when setting up \fBbuildkernel\fR. 131 | .TP 132 | .BR \-f ", " \-\-copy\-from\-staging 133 | This option is used where you have previously built a kernel using the 134 | \fB--stage-only\fR option, and would now like \fBbuildkernel\fR to copy it onto 135 | your EFI system partition. No further compilation will be done when this option 136 | is specified, only copying. 137 | .TP 138 | .BR \-h ", " \-\-help 139 | Displays a short help screen, and exits. 140 | .TP 141 | .BR \-i ", " \-\-is\-new\-kernel\-available 142 | Returns an exit code of 0 if there is a kernel built in the staging area with 143 | the same version as the kernel tree pointed to by \fI/usr/src/linux\fR, 144 | \fBand\fR this is different to the version of the currently running kernel. 145 | (Note, this does not check whether the kernel has been copied to the EFI 146 | system partition.) 147 | Returns an exit code of 1 otherwise. 148 | .TP 149 | .BR \-m ", " \-\-menuconfig 150 | Specifies that the GUI-based kernel configuration step (\fBmake menuconfig\fR) 151 | should be performed at the appropriate stage in the process 152 | (see \fBALGORITHM DETAIL\fR, above). If this option is 153 | left \fIunspecified\fR, then \fBbuildkernel\fR will either: 154 | a) in non-interactive mode, not perform a \fBmake menuconfig\fR; or 155 | b) in interactive move, ask you whether or not you wish to \fBmake menuconfig\fR. 156 | .TP 157 | .BR \-p ", " \-\-postclear 158 | Clears all \fBgenkernel\fR(8) temporary files and caches after run. 159 | .TP 160 | .BR \-r ", " \-\-adjustment\=N 161 | Specifies the \fBnice\fR(1) adjustment value N (-20<=N<=19) under which 162 | to run \fBmake\fR(1) operations. 163 | 164 | If this option is unspecified, the default niceness adjustment value is 19, 165 | which causes invoked makes to run at the lowest possible 166 | priority; this is useful to prevent \fBbuildkernel\fR clogging up your 167 | system. Be careful about using negative values! 168 | .TP 169 | .BR \-s ", " \-\-stage\-only 170 | When this option is specified, \fBbuildkernel\fR will create the kernel in 171 | the \fI/boot\fR staging directory as usual, but will not copy the result across 172 | to the EFI system partition. 173 | 174 | This is useful in situations where e.g., the USB key holding the system partition 175 | is unavailble, but you would still like to create an updated kernel (in an 176 | automated update context, for example). 177 | 178 | If you use this option, you can use \fBbuildkernel\fR with the 179 | \fB--copy-from-staging\fR option, to update your system partition based on the 180 | contents of the \fI/boot\fR directory later. 181 | .TP 182 | .BR \-u ", " \-\-unmount\-at\-end 183 | Instructs \fBbuildkernel\fR to unmount the EFI system partition upon successful 184 | exit. 185 | 186 | If this option is left \fIunspecified\fR, then \fBbuildkernel\fR will either: 187 | a) in non-interactive mode, leave the EFI system partition in the mount state 188 | in which it found it (mounted or unmounted); or 189 | b) in interactive mode, ask you whether or not you wish to unmount. 190 | .TP 191 | .BR \-v ", " \-\-verbose 192 | Provides more verbose output from invoked tools, where possible. 193 | .TP 194 | .BR \-x ", " \-\-rebuild\-external\-modules 195 | Specifies that external modules (such as those required by VirtualBox) should 196 | be rebuilt (using \fBemerge @module-rebuild\fR) 197 | at the appropriate stage in the process (see \fBALGORITHM DETAIL\fR, above). 198 | However, note that if you are upgrading a kernel, 199 | it is best to defer this step until rebooted into 200 | the new kernel (for example, by running \fBgenup\fR(8), post-reboot). 201 | .TP 202 | .BR \-V ", " \-\-version 203 | Displays the version number of \fBbuildkernel\fR, and exits. 204 | .SH IMPORTANT CONFIGURATION VARIABLES 205 | Before invoking \fBbuildkernel\fR, you \fImust\fR set the following variables in 206 | \fI/etc/buildkernel.conf\fR: 207 | .br 208 | .TP 209 | .BR EFIPARTUUID 210 | This must be set to the partition UUID of your EFI system partition. 211 | It will generally be on a removable USB key, but a partition on a fixed drive 212 | can also be specified. 213 | .br 214 | .TP 215 | .BR CRYPTPARTUUID 216 | This must be set to the partition UUID of the \fBLUKS\fR partition on your fixed 217 | drive, which contains a set of \fBlvm\fR logical volumes (for root, home and swap 218 | directories). 219 | 220 | By default, \fBbuildkernel\fR assumes that the \fBLUKS\fR 221 | partition is secured with by a 222 | \fBgpg\fR(1) encrypted keyfile. At boot, you are prompted to enter the 223 | passphrase for this file. Because both the keyfile, and a passphrase to unlock 224 | it, are required, dual-factor security is obtained. 225 | 226 | Also, please note that it is assumed that your \fBLUKS\fR filesystem exists on the 227 | partition of a GPT-formatted drive; if this is \fInot\fR the case (for example, if 228 | you have your \fBLUKS\fR filesystem on an MBR partition, or if you have luksFormat-ed 229 | a top-level drive, rather than a partition within it), 230 | then you should instead set the \fBLUKS\fR path directly, via the 231 | \fBCRYPTPATHMAP\fR variable (see the \fBbuildkernel.conf\fR(5) manpage). 232 | (Most users will \fInot\fR need to do this, however.) 233 | .br 234 | .PP 235 | Please see the \fBbuildkernel.conf\fR(5) manpage for additional optional, 236 | but important, variables which may be set (including \fBKEYMAP\fR to specify 237 | the early-boot keymap, and \fBINITSYSTEM\fR, if targeting \fBOpenRC\fR(8) rather 238 | than the default \fBsystemd\fR(1)). 239 | .SH EXIT STATUS 240 | The exit status is 0 if the kernel build completed successfully, and 1 otherwise. 241 | .SH BUGS 242 | \fBbuildkernel\fR currently executes the kernel build process as the root user. 243 | It would be a little more hygienic to build as a non-priveleged user, and then 244 | install as root. 245 | 246 | Note also that if have installed a package that uses external modules (such as 247 | VirtualBox), you will need to re-run \fBemerge @module-rebuild\fR once rebooted 248 | under your new kernel (as this set takes its version from the 249 | currently running kernel). 250 | A post-reboot run of \fBgenup\fR(8) will achieve this. 251 | 252 | .SH COPYRIGHT 253 | .nf 254 | Copyright \(co 2014-2020 sakaki 255 | License GPLv3+ (GNU GPL version 3 or later) 256 | 257 | 258 | This is free software, you are free to change and redistribute it. 259 | There is NO WARRANTY, to the extent permitted by law. 260 | .fi 261 | .SH AUTHORS 262 | sakaki \(em send bug reports or comments to 263 | .SH "SEE ALSO" 264 | .BR emerge (1), 265 | .BR gpg (1), 266 | .BR make (1), 267 | .BR nice (1), 268 | .BR systemd (1), 269 | .BR cryptsetup (8), 270 | .BR genkernel (8), 271 | .BR genup (8), 272 | .BR init (8), 273 | .BR lvm (8), 274 | .BR plymouth (8), 275 | .BR umount (8), 276 | .BR openrc (8), 277 | .BR portage (5). 278 | -------------------------------------------------------------------------------- /buildkernel.conf: -------------------------------------------------------------------------------- 1 | # Configuration file for /usr/sbin/buildkernel 2 | # Make sure the below are set correctly for your system! 3 | 4 | # following is the partuuid of your EFI system partition 5 | # (e.g., the first partition on your USB boot key) 6 | # replace with an appropriate value (find with lsblk and blkid) for your system 7 | #EFIPARTUUID="2498f874-ad8f-484e-8aba-81ac1c9665b6" 8 | 9 | # following is the partuuid of your LUKS partition (if on a GPT drive) 10 | # (usually, this will be a partition of a fixed drive in your machine) 11 | # replace with an appropriate value (find with lsblk and blkid) for your system 12 | #CRYPTPARTUUID="8111286a-d24e-4ba2-b6af-d0650fab4130" 13 | 14 | # if your LUKS filesystem is NOT on a GPT partition (for example, if it is 15 | # on an MBR partition, or if you have luksFormat-ed a top-level drive, rather 16 | # than a partition within it), then you must uncomment and set the following 17 | # variable (use "ls -l /dev/disk/by-uuid" to locate the correct path) 18 | # NB - most users will NOT need to do this (it is a special case), and 19 | # should accordingly leave the variable commented out; 20 | # note also that if you set CRYPTPATHMAP directly in this manner, the 21 | # contents of CRYPTPARTUUID will be ignored 22 | #CRYPTPATHMAP="/dev/disk/by-uuid/01234567-89ab-cdef-0123-456789abcdef" 23 | 24 | # if your LUKS keyfile is not on your EFI system partition (for example, 25 | # because you use a USB key to hold the keyfile, but have created an EFI 26 | # system partition on the machine's main drive), then uncomment the below 27 | # and replace the UUID with the appropriate value (find with lsblk and blkid) 28 | # for your system; if you do not, then KEYFILEPARTUUID=EFIPARTUUID is assumed 29 | #KEYFILEPARTUUID="8eca6e85-3f96-4117-b1f0-864576258c4f" 30 | 31 | # if you wish to rely only on the fallback passphrase (assuming you have set 32 | # one up) and no keyfile, uncomment the line below; otherwise 33 | # the value "luks-key.gpg" will be assumed (if you do set LUKSKEYFILE to the 34 | # empty string, KEYFILEPARTUUID is ignored) 35 | #LUKSKEYFILE="" 36 | 37 | # by default, buildkernel will build the kernel in /usr/src/linux. If 38 | # LINUXBUILDDIR is specified, buildkernel will delete the contents of 39 | # LINUXBUILDDIR/buildkernel, copy the contents of /usr/src/linux there, 40 | # then build the kernel in that directory. This can be useful for sparing write 41 | # cycles if /usr/src/linux is located on a SSD and the specified directory lies 42 | # e.g. on tmpfs. 43 | #LINUXBUILDDIR="/var/tmp" 44 | 45 | # add any additional kernel command line parameters here (most critical ones 46 | # will be set automatically by buildkernel; you can leave this commented out) 47 | #ADDITIONALKERNELCMDS="root_trim=yes" 48 | 49 | # by default, genkernel will be instructed to include all firmware and modules 50 | # into the initramfs; uncomment and change the below (for example, to specify 51 | # an empty string) if you do not want this, or if you want to manage these 52 | # options explicitly through /etc/genkernel.conf 53 | # (caution - may cause boot issues on some systems) 54 | #ADDITIONALGENKERNELOPTS="--all-ramdisk-modules --firmware" 55 | 56 | # by default, buildkernel will ensure that an EFI boot entry for any kernel 57 | # it creates exists at the top of the EFI boot order (in EFI NVRAM); 58 | # uncomment and change the below (to specify value 0) if you do not want to 59 | # do this (for example, because you wish to use your own EFI bootloader) 60 | #CREATEEFIBOOT=1 61 | 62 | # set your keymap - this is IMPORTANT to ensure your password for the GPG 63 | # protected keyfile gets read correctly 64 | # if you leave this commented out, the "us" keymap will be used 65 | #KEYMAP="jp" 66 | 67 | # if you want a graphical boot theme, set it here; will automatically turn 68 | # on the 'quiet splash' kernel options 69 | # leave commented out for a textual boot screen 70 | #PLYMOUTHTHEME="fade-in" 71 | 72 | # if you want to use OpenRC init, rather than the default systemd, uncommment 73 | # the below (capitalization is unimportant) 74 | #INITSYSTEM="openrc" 75 | 76 | # if you want to revert to the old (<=1.0.29) behaviour of _not_ compressing 77 | # the built-in initramfs, uncomment the line below; XZ compression is now 78 | # used by default; some systems will not boot large kernels that contain an 79 | # uncompressed ramfs, even though the enclosing kernel is itself compressed 80 | #COMPRESSINITRAMFS=0 81 | 82 | # you can manually set the filesystem type for your root partition here. 83 | # however, doing so should not be necessary. 84 | #CMDLINE_ROOTFSTYPE="ext4" 85 | 86 | # if you sign your kernel modules, configure the signing certificate and key 87 | # paths to sign external modules as well once built. Setting the variables to 88 | # "auto" will use the kernel's automatically generated certificate and key if 89 | # you have configured it to generate them. By default the variable is unset and 90 | # modules will not be signed. 91 | #KERNEL_SIGNING_CERT="auto" 92 | #KERNEL_SIGNING_KEY="auto" 93 | 94 | # if you don't wish to enable suspend, uncomment below. Default is 0 95 | # (Suspend enabled). 96 | #DISABLE_SUSPEND=1 97 | 98 | # if you don't wish to enable hibernation, uncomment below. Default is 0 99 | # (Hibernation enabled). 100 | #DISABLE_HIBERNATION=1 101 | 102 | # if your configuration doesn't use LVM, uncomment below. Default is 0 (LVM 103 | # enabled). 104 | #DISABLE_LVM=1 105 | 106 | # if you need to conform the config file for some reason, uncomment this 107 | # hook function and fill it out to suit your requirements 108 | # NB you should only really need to do this to override a setting forced 109 | # by buildkernel itself; other changes you make during the make menuconfig step 110 | # are persisted, and this is the preferred way to modify the config 111 | # user_conform_config_file() { 112 | # # call set_kernel_config / unset_kernel_config functions here as needed 113 | # } 114 | 115 | # if you need to modify the initramfs during the buildkernel process, 116 | # uncomment this hook function and fill it out to suit your requirements 117 | # user_modify_initramfs() { 118 | # # do stuff with ${INITRAMFSDIR} directory contents; 119 | # # the cpio archive is already unpacked here upon function entry 120 | # # and will be repacked again automatically for you afterwards 121 | # } 122 | 123 | # leave the below two lines commented out, unless running on a *very* 124 | # badly-behaved UEFI BIOS, that looks only at the Microsoft boot loader path 125 | #EFIBOOTFILE="bootmgfw.efi" 126 | #EFIBOOTDIR="/EFI/Microsoft/Boot" 127 | -------------------------------------------------------------------------------- /buildkernel.conf.5: -------------------------------------------------------------------------------- 1 | .TH BUILDKERNEL 5 "Version 1.0.37: July 2020" 2 | .SH NAME 3 | buildkernel.conf \- a configuration file for \fBbuildkernel\fR(8) 4 | .SH SYNOPSIS 5 | .B /etc/buildkernel.conf 6 | .SH DESCRIPTION 7 | This file is used to define various variables and functions 8 | that are used by the \fBbuildkernel\fR(8) 9 | script. You \fImust\fR specify at least the \fBEFIPARTUUID\fR and 10 | \fBCRYPTPARTUUID\fR variables for \fBbuildkernel\fR(8) to be able to work properly; 11 | others are optional (see below for defaults). 12 | 13 | This file will be sourced into a \fBbash\fR(1) context, so normal \fBbash\fR(1) rules for 14 | variable definition, comments etc. apply. 15 | 16 | If \fBbuildkernel\fR(8) is installed using the standard \fBinstall.sh\fR script, 17 | then the installer will attempt to infer sensible values for \fBEFIPARTUUID\fR 18 | and \fBCRYPTPARTUUID\fR, and their definitions will already be present, uncommented, in 19 | \fB/etc/buildkernel.conf\fR on first use. However, even in this case, you should 20 | take care to verify that they are correct. 21 | 22 | You can also run \fBbuildkernel --easy-setup\fR to make changes to this file 23 | in a structured manner; doing so is recommended when starting out, 24 | to avoid obvious errors. 25 | .SH VARIABLES 26 | The following variables are mandatory and \fImust\fR be set in 27 | \fB/etc/buildkernel.conf\fR, or \fBbuildkernel\fR(8) 28 | will not function properly: 29 | .RS 30 | .TP 31 | .BR EFIPARTUUID 32 | This \fImust\fR be set to the partition UUID of your EFI system partition. 33 | It will generally be on a removable USB key, but a partition on a fixed drive 34 | can also be specified. 35 | .br 36 | .TP 37 | .BR CRYPTPARTUUID 38 | This \fImust\fR be set to the partition UUID of the \fBLUKS\fR partition on your fixed 39 | drive, which contains a set of \fBlvm\fR logical volumes (for root, home and swap 40 | directories). 41 | 42 | \fBbuildkernel\fR assumes that the \fBLUKS\fR partition is secured with by a 43 | \fBgpg\fR(1) encrypted keyfile. At boot, you are prompted to enter the 44 | passphrase for this file. Because both the keyfile, and a passphrase to unlock 45 | it, are required, dual-factor security is obtained. 46 | 47 | Also, please note that it is assumed that your \fBLUKS\fR filesystem exists on the 48 | partition of a GPT-formatted drive; if this is \fInot\fR the case (for example, if 49 | you have your \fBLUKS\fR filesystem on an MBR partition, or if you have luksFormat-ed 50 | a top-level drive, rather than a partition within it), then you should instead 51 | set the \fBLUKS\fR path directly, via the 52 | \fBCRYPTPATHMAP\fR variable (see below). 53 | (Most users will \fInot\fR need to do this, however.) 54 | .RE 55 | 56 | The following variables are optional, and \fImay\fR be set 57 | in \fB/etc/buildkernel.conf\fR if their defaults 58 | are not suitable for your system: 59 | .RS 60 | .TP 61 | .BR CRYPTPATHMAP 62 | If, for some reason, your LUKS filesystem does \fInot\fR exist on a GPT 63 | partition, then you can uncomment this variable, and set it to 64 | the correct path directly (where possible, use \fI/dev/disk/by-uuid/<...>\fR 65 | as the value). This feature is provided as a convenience only; most users should 66 | not need to use it (and so should leave the \fBCRYPTPATHMAP\fR variable 67 | commented out). 68 | .br 69 | .TP 70 | .BR KEYFILEPARTUUID 71 | This should be set to the partition UUID of the partition containing your 72 | \fBgpg\fR(1)-encrypted keyfile, used to unlock the \fBLUKS\fR partition (see 73 | above). The file should be called \fIluks-key.gpg\fR, and be stored in the top-level 74 | directory of this partition. If unspecified, \fBKEYFILEPARTUUID=EFIPARTUUID\fR will 75 | be assumed (i.e., that you have a single USB key holding both the EFI stub kernel and 76 | the encrypted keyfile). 77 | .br 78 | .TP 79 | .BR LUKSKEYFILE 80 | If you wish to rely only on the fallback passphrase (assuming you have set 81 | one up) and no keyfile, set this to the empty string (in which case, 82 | \fBKEYFILEPARTUUID\fR will be ignored) (and no static \fBgpg\fR(1) 83 | will be built into the initramfs). Defaults to \fBluks-key.gpg\fR if 84 | unset. 85 | .br 86 | .TP 87 | .BR LINUXBUILDDIR 88 | By default, \fBbuildkernel\fR(8) will build the kernel in \fI/usr/src/linux\fR. 89 | If \fBLINUXBUILDDIR\fR is specified however, \fBbuildkernel\fR(8) will instead 90 | delete the contents of \fBLINUXBUILDDIR\fI/buildkernel\fR, then copy the 91 | contents of \fI/usr/src/linux\fR there. This can be useful for sparing 92 | write cycles if \fI/usr/src/linux\fR is located on a SSD and the specified 93 | directory lies e.g. on tmpfs. 94 | 95 | For example, you may consider setting \fBLINUXBUILDDIR\fR="\fI/var/tmp\fR" 96 | (the kernel will then be built in \fI/var/tmp/buildkernel\fR). 97 | 98 | Please note that if the kernel's \fI.config\fR file is modified 99 | during the build, and you have specified a \fBLINUXBUILDDIR\fR, then it is 100 | only the \fI.config\fR in the \fBLINUXBUILDDIR\fI/buildkernel\fR directory 101 | that is affected; the \fI.config\fR in \fI/usr/src/linux\fR (if any) will 102 | be unchanged. 103 | .br 104 | .TP 105 | .BR ADDITIONALKERNELCMDS 106 | If you wish to pass any additional command line parameters in the kernel boot 107 | line (either for attention of the kernel itself, or for \fBgenkernel\fR(8)'s 108 | \fBinit\fR(8) script), you can specify them here. All of the important values 109 | for booting will be set by \fBbuildkernel\fR, so this defaults to an empty 110 | string if not set. 111 | 112 | One parameter you may wish to consider here is "root_trim=yes"; this will 113 | enable TRIM support on the encrypted LUKS partition (turned off by default). 114 | .br 115 | .TP 116 | .BR ADDITIONALGENKERNELOPTS 117 | By default, \fBgenkernel\fR(8) will be instructed by \fBbuildkernel\fR(8) to 118 | include all firmware and kernel modules into the initramfs; if you do not want 119 | this (for example, to minimize the size of your final kernel), or if you would 120 | rather manage the settings explicitly via \fI/etc/genkernel.conf\fR, specify 121 | the the desired options (which may be simply an empty string) here. 122 | 123 | \fBCaution\fR - choosing not to include the firmware or kernel modules may cause 124 | boot issues on some systems. 125 | .br 126 | .TP 127 | .BR KEYMAP 128 | This variable specifies the keymap to be used in early userspace (that is, when 129 | the initramfs-based system is prompting you for a passphrase to unlock the 130 | \fBgpg\fR(1)-encrypted keyfile). It is \fInot\fR a standard locale keymap string, 131 | but rather one recognized by the \fI/usr/share/genkernel/defaults/initrd.d/00-keymaps.sh\fR 132 | script. If not specified here, \fBKEYMAP="us"\fR will be assumed. 133 | .br 134 | .TP 135 | .BR PLYMOUTHTHEME 136 | If you want to use the graphical boot splash manager \fBplymouth\fR(8), specify 137 | a theme here (for example, \fB"fade-in"\fR), and it will automatically be used 138 | at boot (this will also imply the additional kernel command line options of 139 | \fB"quiet splash"\fR, and turn off the early 'penguins' display). The default 140 | is for this variable to be set to the empty string, implying a textual boot console. 141 | .br 142 | .TP 143 | .BR EFIBOOTFILE 144 | This is the file to which the EFI-stub kernel will be saved, and it defaults to 145 | \fIbootx64.efi\fR, which is the 'magic' name most UEFI BIOSes will look for. 146 | If you are on a system that expects \fIonly\fR a Microsoft boot loader, you 147 | may have to change this to \fIbootmgfw.efi\fR. 148 | 149 | Most users will not need to override the default. 150 | .br 151 | .TP 152 | .BR EFIBOOTDIR 153 | This is the directory (under the EFI system partition root) in which the EFI-stub 154 | kernel will be saved. It defaults to \fI/EFI/Boot\fR, 155 | which is the 'magic' path that most UEFI BIOSes will search. 156 | If you are on a system that 157 | expects \fIonly\fR a Microsoft boot loader, you may have to change this path to 158 | \fI/EFI/Microsoft/Boot\fR. 159 | 160 | Most users will not need to override the default. 161 | .br 162 | .TP 163 | .BR INITSYSTEM 164 | If you are targeting \fBOpenRC\fR(8) (rather than \fBsystemd\fR(1)) boot, 165 | uncomment this variable, 166 | and set it to \fB"openrc"\fR (the capitalization is unimportant). 167 | If left commented out, a value of \fB"systemd"\fR will be assumed. 168 | 169 | Most users will not need to override the default. 170 | .br 171 | .TP 172 | .BR CREATEEFIBOOT 173 | When set to \fB0\fR the \fBbuildkernel\fR script will \fInot\fR 174 | create or modify EFI boot 175 | settings in NVRAM (if left unset, a value of \fB1\fR will be assumed). 176 | Set to \fB0\fR only if you have your own EFI bootloader, 177 | or want to insert appropriate EFI boot settings manually. 178 | 179 | Most users will not need to override the default. 180 | .br 181 | .TP 182 | .BR COMPRESSINITRAMFS 183 | When set to \fB0\fR the \fBbuildkernel\fR script will \fInot\fR 184 | intruct the kernel to XZ compress its integral initrams (the default 185 | behaviour prior to version 1.0.30); doing so may cause boot 186 | issues on certain systems with modest RAM. 187 | 188 | Most users will not need to override the default. 189 | .br 190 | .TP 191 | .BR CMDLINE_ROOTFSTYPE 192 | If you wish to explicitly specify your root filesystem's type, do so 193 | via this variable. Otherwise, \fBbuildkernel\fR will attempt to 194 | automatically detect the filesystem type of \fBCMDLINE_REAL_ROOT\fR 195 | (falling back to \fBext4\fR, in case of error). 196 | 197 | Most users will not need to override the default. 198 | .br 199 | .TP 200 | .BR KERNEL_SIGNING_CERT 201 | If you sign your kernel modules, set this to the path for the signing 202 | certificate so that your external modules are signed after being built. 203 | Setting to \fBauto\fR uses the kernel's automatically generated signing 204 | certificate if you have configured it to generate it. 205 | 206 | By default this is not set and causes external modules to not be signed. 207 | Requires that the \fBKERNEL_SIGNING_KEY\fR variable is set. 208 | .br 209 | .TP 210 | .BR KERNEL_SIGNING_KEY 211 | If you sign your kernel modules, set this to the path for the signing key so 212 | that your external modules are signed after being built. Setting to \fBauto\fR 213 | uses the kernel's automatically generated signing key if you have configured it 214 | to generate it. 215 | 216 | By default this is not set and causes external modules to not be signed. 217 | Requires that the \fBKERNEL_SIGNING_CERT\fR variable is set. 218 | .br 219 | .TP 220 | .BR DISABLE_SUSPEND 221 | If you wish to disable suspend, set this to \fB1\fR. This is set to 222 | \fB0\fR (Suspend enabled) by default. 223 | .br 224 | .TP 225 | .BR DISABLE_HIBERNATION 226 | If you wish to disable hibernation, set this to \fB1\fR. This is set to 227 | \fB0\fR (Hibernation enabled) by default. 228 | .br 229 | .TP 230 | .BR DISABLE_LVM 231 | If your configuration doesn't use LVM, set this to \fB1\fR. This is set to 232 | \fB0\fR (LVM enabled) by default. 233 | 234 | .RE 235 | .SH FUNCTIONS 236 | The following hook functions \fImay\fR be specified in \fB/etc/buildkernel.conf\fR if 237 | you need to modify \fBbuildkernel\fR(8)'s behaviour: by default they are unset. 238 | Most users will not need to define these functions. 239 | .RS 240 | .TP 241 | .BR user_conform_config_file 242 | Define this hook function if you need to conform (modify the contents of) the 243 | kernel \fI/usr/src/linux/.config\fR file. Note that you should only really need 244 | to do this to override a setting forced by \fBbuildkernel\fR(8) itself; otherwise 245 | changes made using \fBmake menuconfig\fR are persisted (and this is the 246 | preferred way to change the configuration). 247 | .br 248 | .TP 249 | .BR user_modify_initramfs 250 | Define this hook function if you need to modify the initramfs during the 251 | \fBbuildkernel\fR(8) process. Upon entry, the \fBcpio\fR(1L) archive will 252 | already have been unpacked into \fI/boot/initramfs/\fR, and it is to this 253 | unpacked image that you should apply any changes. The contents of 254 | \fI/boot/initramfs/\fR will be repacked again automatically for you upon 255 | function exit. 256 | .RE 257 | .SH COPYRIGHT 258 | .nf 259 | Copyright \(co 2014-2020 sakaki 260 | License GPLv3+ (GNU GPL version 3 or later) 261 | 262 | 263 | This is free software, you are free to change and redistribute it. 264 | There is NO WARRANTY, to the extent permitted by law. 265 | .fi 266 | .SH AUTHORS 267 | sakaki \(em send bug reports or comments to 268 | .SH "SEE ALSO" 269 | .BR bash (1), 270 | .BR cpio (1L), 271 | .BR gpg (1), 272 | .BR systemd (1), 273 | .BR cryptsetup (8), 274 | .BR genkernel (8), 275 | .BR init (8), 276 | .BR lvm (8), 277 | .BR plymouth (8), 278 | .BR openrc (8), 279 | .BR portage (5). 280 | --------------------------------------------------------------------------------