Construct a human readable platform identifier from GRUB's built-in
variables and use it in menu item descriptions.
Only add the menu entries for the additional tools (UEFI shell,
Memtest86+) if the files exist.
Modify baseline's `grub.cfg` to closer match releng.
* Do not manually load modules that will get loaded by invoking a command.
* Explicitly load serial modules.
* Move `insmod all_video` after the font is loaded.
bolt can be used to list and authorize Thunderbolt and USB4 devices.
Inspired by https://bbs.archlinux.org/viewtopic.php?id=288731 where a
user needed to install the package in the live environment.
The only changes we make to the default are to enable root login via a
password.
While `PasswordAuthentication yes` is the default, let's set it
explicitly to avoid potential issues in the future.
openssh 9.4p1-2 changed /etc/ssh/sshd_config to add support for
drop-in files in /etc/ssh/sshd_config.d/.
Using drop-in files avoids needing to keep up with changes to the
default /etc/ssh/sshd_config.
Since systemd 245, IPv6PrivacyExtensions can be set not just per
connection, but also globally for all connection with a configuration
file in /etc/systemd/network.conf.d/.
Since tmpfs has a `noswap` option, use it instead of ramfs. Unlike
ramfs, tmpfs has a limit to its size.
This reverts commit 09b0428128 ("configs/releng/airootfs/etc/systemd/system/etc-pacman.d-gnupg.mount: use ramfs").
1) wait for network-online.target before invoking curl
as there's no synchronization with network setup for this script
2) don't hide curl errors - it may be easier to debug the issues
3) add log and comments
configs/{baseline,releng}/grub/grub.cfg:
Use `console` as grub's `terminal_output`, as with `gfxterm` only a blank screen is shown on some hardware.
Fixes#212
To prevent the file from being accidentally missed when someone copies
the ISO's contents, let's not place it in a directory that starts with a
dot. Since all GRUB related files are in /boot/grub/, put it there too.
Instead of using a more unique UUID for the file name, use
`YYYY-mm-dd-HH-MM-SS-00.uuid` which matches the ISO's modification date
in UTC,i.e. its "UUID". If multiple ISOs would be generated in the exact
same second, the ISO 9660 modification date (i.e. its "UUID") would be
the same, so there would be not way to distinguish between the volumes
anyway. This also makes the file look less suspicious to the casual
glance.
The `grub.cfg` embedded in the GRUB binaries already sets `ARCHISO_HINT`
and `ARCHISO_UUID` in most cases. To avoid performing the same searches
multiple times, use the existing variables.
Move memtest86+ to `/boot/memtest86+/` on ISO 9660. That directory is
not copied to netboot artifact output.
Netboot boot menu https://ipxe.archlinux.org/releng/netboot/archlinux.ipxe
does not have entries for memtest and archiso-manager removes these files
(not the EFI one, though) before uploading the release files anyway.
There are claims that some UEFI allegedly natively support NTFS.
Preload the required GRUB modules to support booting from NTFS on such
systems.
Additionally preload the exFAT and UEF modules, because, why not?
Search for `/.disk/%UUID_SEARCH_FILENAME%.uuid` and pass the UUID of the
volume it's on as `archisodevice`. mkarchiso will replace
`%UUID_SEARCH_FILENAME%` with a hardcoded value generated using
`SOURCE_DATE_EPOCH` durring ISO build.
This allows to prepare an UEFI bootable installation medium by simply
copying the directory structure without having to touch `grub.cfg`.
Relying on the volume UUID instead of its LABEL also avoids collisions
of multiple ISOs created in the same month.
Fixes#202
Specify `cms_verify=y` in SYSLINUX/PXELINUX configuration to use OpenSSL
CMS based method for verifying the root file system image against the
code signing certificates in the initramfs.
`checksum` and `verify` are removed since they essentially serve the same
purpose and performing all the checks just needlessly delays boot.
Additionally, the removal of `verify` allows to build the ISO without gpg,
i.e. without using `mkarchiso`'s `-g` and `-G` options.
Fixes#200
This protects against the case where /proc/cmdline contains garbage triggering grep to think it is a binary.
See e.g. https://bugs.archlinux.org/task/76468 for an example.
configs/releng/airootfs/etc/systemd/system/pacman-init.service:
Order pacman-init.service after time-sync.target, so that time on the host is synchronized before initializing pacman.
configs/releng/airootfs/etc/systemd/system/{dbus-org.freedesktop.timesync1},sysinit.target.wants/systemd-timesyncd}.service:
Enable systemd-timesyncd which aliases to dbus-org.freedesktop.timesync1 to ensure time gets synced on the host.
configs/releng/airootfs/etc/systemd/system/sysinit.target.wants/systemd-time-wait-sync.service:
Enable systemd-time-wait-sync to ensure time is finished syncing when time-sync.target is finished.
archlinux-keyring-wkd-sync.service needs an initialized pacman keyring to work.
Add BindsTo=etc-pacman.d-gnupg.mount to stop pacman-init.service if the mount unit suddenly enters inactive state.
Johannes Frohnmeyer
nl6720