diff options
| author | Raito Bezarius <masterancpp@gmail.com> | 2023-05-15 01:12:35 +0200 |
|---|---|---|
| committer | Raito Bezarius <masterancpp@gmail.com> | 2023-10-29 13:02:03 +0100 |
| commit | 042fbb0509ba7243e6d1cd1aad71a9c19b413c38 (patch) | |
| tree | 86f2915138fef3b4401c72edeadc75f80cb92ba0 | |
| parent | lib/systems: add UEFI triples (diff) | |
| download | nixpkgs-042fbb0509ba7243e6d1cd1aad71a9c19b413c38.tar.gz | |
lanzaboote-uefi-stub: init at 0.3.0
| -rw-r--r-- | pkgs/os-specific/uefi/lanzaboote-stub/default.nix | 35 | ||||
| -rw-r--r-- | pkgs/top-level/all-packages.nix | 2 |
2 files changed, 37 insertions, 0 deletions
diff --git a/pkgs/os-specific/uefi/lanzaboote-stub/default.nix b/pkgs/os-specific/uefi/lanzaboote-stub/default.nix new file mode 100644 index 000000000000..1abb7f56f669 --- /dev/null +++ b/pkgs/os-specific/uefi/lanzaboote-stub/default.nix @@ -0,0 +1,35 @@ +{ stdenv, rustPlatform, lib, fetchFromGitHub }: + +rustPlatform.buildRustPackage rec { + pname = "lanzaboote-stub"; + version = "0.3.0"; + + src = fetchFromGitHub { + owner = "nix-community"; + repo = "lanzaboote"; + rev = "v${version}"; + hash = "sha256-Fb5TeRTdvUlo/5Yi2d+FC8a6KoRLk2h1VE0/peMhWPs="; + }; + + sourceRoot = "source/rust/stub"; + cargoHash = "sha256-FlnheCgowYsEHcFMn6k8ESxDuggbO4tNdQlOjUIj7oE="; + + # Necessary because our `cc-wrapper` doesn't understand MSVC link options. + # -flavor link which will break the whole command-line processing for the ld.lld linker. + RUSTFLAGS = "-Clinker=${stdenv.cc.bintools}/bin/${stdenv.cc.targetPrefix}lld-link -Clinker-flavor=lld-link"; + # Does not support MSVC style options yet (?). + auditable = false; + hardeningDisable = [ "relro" "bindnow" ]; + + meta = with lib; { + description = "Lanzaboote UEFI stub for SecureBoot enablement on NixOS systems"; + homepage = "https://github.com/nix-community/lanzaboote"; + license = licenses.gpl3Only; + mainProgram = "lanzaboote_stub.efi"; + platforms = [ "x86_64-uefi" "i686-uefi" "aarch64-uefi" ]; + # i686: Builtins errors + # aarch64: compile fine but... + broken = stdenv.isi686 || stdenv.isAarch64; + maintainers = with maintainers; [ raitobezarius nikstur blitz ]; + }; +} diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index ec43693eebe9..8da05b61232c 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -7707,6 +7707,8 @@ with pkgs; edk2-uefi-shell = callPackage ../tools/misc/edk2-uefi-shell { }; + lanzaboote-uefi-stub = callPackage ../os-specific/uefi/lanzaboote-stub { }; + edl = callPackage ../development/embedded/edl { }; edlib = callPackage ../development/libraries/science/biology/edlib { }; |