When a download attempt fails with an HTTP error, the body of the failed
request will be written to the output file with a 0 exit status, causing the
execution of an error message as a script.
This issue is resolved by adding the --fail option to curl.
Co-authored-by: David Runge <dvzrv@archlinux.org>
mkfs.fat selects FAT32 for file systems of at least 512 MiB size, but a
FAT32 file system can already be created at 36 MiB size (assuming 512
byte logical sector size).
Use higher compression for the initramfs.
Now that mkinitcpio moves the compressed kernel modules and firmware
files to the early uncompressed initramfs, we can compress the main
initramfs image slightly more without it increasing the built time too
much. This will increase the memory required for decompression from
9 MiB to 65 MiB (assuming the kernel's decompressor works the same as
the xz tool), but that should not be an issue for any system targeting
Arch.
This reduces the initramfs size by ~250 KiB, which will save ~500 KiB
for the whole ISO.
Less than 1 MiB (but rounded up to one) is needed to account for file and
directory entries, especially when using FAT32. Otherwise the ISO build could stop with:
Disk full
The rest of the increase is to allow more space for adding custom files
after the fact, i.e. when repacking the ISO. E.g. for the purposes of
adding a signed boot loader for Secure Boot or similar. See
https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot#ISO_repacking
The existence of a ``early_cpio`` file is not enough since mkinitcpio can
and will place other files in the early uncompressed CPIO even when the
microcode hook is not used.
Fixes https://gitlab.archlinux.org/archlinux/archiso/-/issues/231
While using GRUB as the UEFI boot loader has reduced the size of the ISO,
it has brought nothing but pain otherwise:
* We cannot use `gfxterm` since it is not visible on some hardware.
* GRUB has a a strange and nonsensical limitation where the EFI binary
can be built with either support for shim or custom Secure Boot key
support, but not both. This means you cannot repack the ISO to use
shim + MOK since we currently use `--disable-shim-lock` to provide
support for setups with custom keys.
* GRUB's EFI binary needs to be built with `grub-mkstandalone` instead
of there being a ready made EFI binary in the package. This requires
having grub installed on the host system which affects reproducibility.
This increases the size of the ISO since systemd-boot cannot boot files
from other volumes, i.e. the kernel and initramfs is duplicated in the
EFI system partition (the second partition made from `efiboot.img`).
Implements https://gitlab.archlinux.org/archlinux/archiso/-/issues/227
The zstd tool has now been around for a while, so the availability of
it should not be a concern anymore.
Unlike gzip which was used until now, zstd offers higher compression
while still being faster (and multi-threaded).
The `--auto-threads=logical` option is used just so that there is some
difference between the releng and baseline profiles.
Everyone using the official Arch Linux bootstrap tarball (previously
`archlinux-bootstrap-YYYY.MM.DD-x86_64.tar.gz` or
`archlinux-bootstrap-x86_64.tar.gz`) will need to update their scripts
and etc. to use `archlinux-bootstrap-YYYY.MM.DD-x86_64.tar.zst` or
`archlinux-bootstrap-x86_64.tar.zst` instead.
Implements https://gitlab.archlinux.org/archlinux/archiso/-/issues/130
`uefi-ia32.systemd-boot.eltorito` has the same requirements as
`uefi-ia32.systemd-boot.esp`, not the same as `uefi-x64.systemd-boot.esp`.
Fixes: 5e72546e89 ("mkarchiso: add uefi-ia32.systemd-boot.esp and uefi-ia32.systemd-boot.eltorito boot modes")
The early uncompressed CPIO archive containing microcode update files
can be part of the initramfs file. To avoid wasting space, first check
if the initramfs file contains `early_cpio` and only copy external
microcode initramfs images if it does not.
The licenses package does not ship
`/usr/share/licenses/common/GPL2/license.txt` anymore, which results in:
/usr/share/licenses/common/GPL2/license.txt': No such file or directory
Use its replacement, `/usr/share/licenses/spdx/GPL-2.0-only.txt` instead.
Fixes https://gitlab.archlinux.org/archlinux/archiso/-/issues/225
Keep the prepared `.conf` files in `work_dir` to avoid having to run
them through `sed` twice.
This makes sure the FAT image size calculation is more correct and also
simplifies copying the files m to both ISO 9660 and the FAT image since
the the whole `loader` directory can copied instead of copying
individual files.
By default systemd-networkd-wait-online.service considers a network
connection to be "online" when it has reached the "degraded" state
(see networkctl(1) for the definitions).
Since "degraded" does not ensure there's a routable address, let's
change the connection's requirement to "routable" instead.
This gives a better chance that the network really is online when
network-online.target is reached.
By Anton Hvornum
* origin/merge-requests/353:
Ensured the correct CA key and CA certificate is used during signing process. It's been working based on default assumptions from the openssl configuration, but it's worth being explicit when doing these operations. Also removed a redundant -sha256
See merge request https://gitlab.archlinux.org/archlinux/archiso/-/merge_requests/353
GnuPG changed their default from RSA to ECC, so Key-Length not
a thing it supports. Instead it asks for the Key-Curve.
Avoid using the default and hardcode ed25519 (which is the current
GnuPG default).
Even if GRUB is not used as a boot loader for the ISO, create a
`/boot/grub/grubenv` file in the ISO 9660 file system. If a
`loopback.cfg` file exists in the profile's `grub` directory, copy it
to `/boot/grub/loopback.cfg` on the ISO.
This ensures the funtionality will not be lost if the used boot loaders
are changed.
Construct a human readable platform identifier from GRUB's built-in
variables and use it in menu item descriptions.
Only add the menu entries for the additional tools (UEFI shell,
Memtest86+) if the files exist.
Modify baseline's `grub.cfg` to closer match releng.
