Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

create_disk: fix UEFI secure boot #1105

Merged
merged 1 commit into from
Feb 6, 2020
Merged

create_disk: fix UEFI secure boot #1105

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 24 additions & 10 deletions src/create_disk.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -307,23 +307,37 @@ install_uefi() {
# change our build process to download+extract it separately.
local source_efidir="${deploy_root}/usr/lib/ostree-boot/efi"
local target_efi="$rootfs/boot/efi"
local target_efiboot="${target_efi}/EFI/BOOT"
mkdir -p "${target_efiboot}"
/usr/lib/coreos-assembler/cp-reflink "${source_efidir}/EFI/BOOT/BOOT"* "${target_efiboot}"
local src_grubefi=$(find "${source_efidir}"/EFI/ -name 'grub*.efi')
/usr/lib/coreos-assembler/cp-reflink "${src_grubefi}" "${target_efiboot}"
local src_grubefi=$(find "${source_efidir}"/EFI/ -maxdepth 1 -type d | grep -v BOOT)
local vendor_id="${src_grubefi##*/}"
local vendordir="${target_efi}/EFI/${vendor_id}"

# Some of the files in EFI/BOOT are _symlinks_ to EFI/$VENDOR
# in the OS tree. We need to make copies here.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like it's just grubenv that's a symlink; may be easier to special case that?

Also worth commenting here probably are
coreos/rpm-ostree#969
and
ostreedev/ostree#1873

which may be related to some of this being awkward.

In fact we should probably change coreos-assembler (and/or rpm-ostree) to download the grub/efi bits separately and not commit them to the ostree as discussed. But, definitely that can come later.

mkdir -p "${target_efi}"/EFI/BOOT "${vendordir}"
for t in BOOT "${vendor_id}";
do
(
cd "${source_efidir}"/EFI/${t}
for i in *; do
/usr/lib/coreos-assembler/cp-reflink -vRL \
$(readlink -f $i) \
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Having both -L and explicit readlink seems odd?

"${target_efi}"/EFI/"${t}"/
done
)
done

local vendor_id="$(basename $(dirname ${src_grubefi}))"
local vendordir="${target_efi}/EFI/${vendor_id}"
mkdir -p "${vendordir}"
cat > ${vendordir}/grub.cfg << 'EOF'
search --label boot --set prefix
set prefix=($prefix)/grub2
normal
set prefix=($prefix)
configfile $prefix/grub2/grub.cfg
boot
EOF
mkdir -p $rootfs/boot/grub2

# copy the grub config and any other files we might need
cp $grub_script $rootfs/boot/grub2/grub.cfg
mkdir -p $rootfs/boot/grub2
cp -v $grub_script $rootfs/boot/grub2/grub.cfg
}

# Other arch-specific bootloader changes
Expand Down