initial commit

9 files changed, 258 insertions, 0 deletions

diff --git a/.SRCINFO b/.SRCINFO
new file mode 100644
index 000000000000..1a1d586917dd
--- /dev/null
+++ b/.SRCINFO
@@ -0,0 +1,50 @@
+pkgbase = mkinitcpio-sign-patch
+	pkgdesc = Modular initramfs image creation utility (automatically signs kernels and images)
+	pkgver = 27
+	pkgrel = 2
+	url = https://projects.archlinux.org/mkinitcpio.git/
+	install = mkinitcpio.install
+	arch = any
+	license = GPL
+	depends = awk
+	depends = mkinitcpio-busybox>=1.19.4-2
+	depends = kmod
+	depends = util-linux>=2.23
+	depends = libarchive
+	depends = coreutils
+	depends = bash
+	depends = diffutils
+	depends = findutils
+	depends = grep
+	depends = filesystem>=2011.10-1
+	depends = gzip
+	depends = systemd
+	depends = gnupg
+	optdepends = xz: Use lzma or xz compression for the initramfs image
+	optdepends = bzip2: Use bzip2 compression for the initramfs image
+	optdepends = lzop: Use lzo compression for the initramfs image
+	optdepends = lz4: Use lz4 compression for the initramfs image
+	optdepends = mkinitcpio-nfs-utils: Support for root filesystem on NFS
+	provides = initramfs
+	conflicts = mkinitcpio
+	backup = etc/mkinitcpio.conf
+	source = https://sources.archlinux.org/other/mkinitcpio/mkinitcpio-27.tar.gz
+	source = https://sources.archlinux.org/other/mkinitcpio/mkinitcpio-27.tar.gz.sig
+	source = 0001-mkinitcpio-remove-preset-pacsave.patch
+	source = gpg.conf
+	source = 89-mkinitcpio-sign-install.hook
+	source = mkinitcpio-sign-install
+	source = 0002-mkinitcpio-sign-when-done.patch
+	validpgpkeys = 487EACC08557AD082088DABA1EB2638FF56C0C53
+	validpgpkeys = 86CFFCA918CF3AF47147588051E8B148A9999C34
+	validpgpkeys = ECCAC84C1BA08A6CC8E63FBBF22FB1D78A77AEAB
+	sha256sums = e6bff1cb78b677538eb9aace900b715fd59de8fc210b74fb9d899dfaa32bc354
+	sha256sums = SKIP
+	sha256sums = 845569fa760f70c868ecb3dc8ae9667287970526dddaf403fdafcb716e8b3d51
+	sha256sums = f6eebbd610dcb91288d39b93e4f7f7f47e1c13abaab2d379607d78d417bfd0c7
+	sha256sums = cb094c11de6d4ad903484dea41ef456a4a92c788e570ff8f21214021de7e4f14
+	sha256sums = dc555d3c8d774556732362ae707704b09b86c21c55f53f5c68215ca1d3b24b0a
+	sha256sums = 5dc8d9ae28979ea09a6b2ba0192a211421b0a40518a8763bdc86c4f841926590
+
+pkgname = mkinitcpio-sign-patch
+
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 000000000000..d7727ffc22a3
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,10 @@
+*
+!.gitignore
+!.SRCINFO
+!PKGBUILD
+!0001-mkinitcpio-remove-preset-pacsave.patch
+!0002-mkinitcpio-sign-when-done.patch
+!gpg.conf
+!mkinitcpio-sign-install
+!mkinitcpio.install
+!89-mkinitcpio-sign-install.hook
diff --git a/0001-mkinitcpio-remove-preset-pacsave.patch b/0001-mkinitcpio-remove-preset-pacsave.patch
new file mode 100644
index 000000000000..e2f7efc30aad
--- /dev/null
+++ b/0001-mkinitcpio-remove-preset-pacsave.patch
@@ -0,0 +1,59 @@
+diff --git a/libalpm/scripts/mkinitcpio-remove b/libalpm/scripts/mkinitcpio-remove
+index 86838e4..17b4b31 100644
+--- a/libalpm/scripts/mkinitcpio-remove
++++ b/libalpm/scripts/mkinitcpio-remove
+@@ -2,6 +2,20 @@
+ 
+ package=0
+ 
++process_preset() {
++    if [[ -n "${pkgbase}" && -e $preset ]]; then
++        if ! cmp $preset > /dev/null 2>&1 <(sed "s|%PKGBASE%|${pkgbase}|g" /usr/share/mkinitcpio/hook.preset); then
++            if [[ ! -e $preset.pacsave ]]; then
++                # save the preset as pacsave
++                mv $preset $preset.pacsave && return 0
++            fi
++        else
++            # remove the preset
++            rm $preset && return 0
++        fi
++    fi
++}
++
+ while read -r line; do
+     if [[ $line != */vmlinuz ]]; then
+         # triggers when it's a change to usr/lib/initcpio/*
+@@ -23,17 +37,25 @@ while read -r line; do
+         # remove the installed kernel
+         rm $kernel
+     fi
+-    if [[ -e $preset ]]; then
+-        # remove the preset
+-        rm $preset
++
++    process_preset "${pkgbase}" $preset
++
++    if [[ -e $initramfs ]]; then
++        # remove the main image
++        rm $initramfs
+     fi
+-    if [[ -e $initramfs && -e $fallback_initramfs ]]; then
+-        # remove the images
+-        rm $initramfs $fallback_initramfs
++    if [[ -e $fallback_initramfs ]]; then
++        # remove the fallback image
++        rm $fallback_initramfs
+     fi
+ done
+ 
+ if (( package )) && compgen -G /etc/mkinitcpio.d/"*.preset" > /dev/null; then
+-    # remove all presets
+-    rm /etc/mkinitcpio.d/*.preset
++    shopt -s nullglob
++    for preset in /etc/mkinitcpio.d/*.preset; do
++        pkgbase=${preset##*/}
++        pkgbase=${pkgbase%.preset}
++        process_preset "${pkgbase}" $preset
++    done
++    shopt -u nullglob
+ fi
diff --git a/0002-mkinitcpio-sign-when-done.patch b/0002-mkinitcpio-sign-when-done.patch
new file mode 100644
index 000000000000..8dd8822ec33c
--- /dev/null
+++ b/0002-mkinitcpio-sign-when-done.patch
@@ -0,0 +1,30 @@
+diff --unified --recursive --text a/mkinitcpio b/mkinitcpio
+--- a/mkinitcpio	2019-12-07 01:05:10.293236383 +0100
++++ b/mkinitcpio	2019-12-07 02:47:29.735948757 +0100
+@@ -245,6 +245,26 @@
+         error "Image generation FAILED: %s" "$errmsg"
+     elif (( _builderrors == 0 )); then
+         msg "Image generation successful"
++        sleep .1
++        if [ ! -d "${out%/*}" ]; then
++            error "Directory \"${out%/*}\" not found!"
++        else
++            gpg=(/usr/bin/gpg --homedir /usr/lib/initcpio/sign)
++            if [ ! -f $out.sig ] || ! `${gpg[@]} --verify "$out.sig" "$out" 1>/dev/null 2>&1`; then
++                msg "Signing updated $out ..."
++                ${gpg[@]} --detach-sign "$out"
++                [ $? -gt 0 ] && error "$out is not signed!"
++            fi
++            kernelimg=/boot/vmlinuz-${out#*-}
++            kernelimg=${kernelimg%.img}
++            kernelimg=${kernelimg%-fallback}
++            if [ ! -f ${kernelimg}.sig ] || ! `${gpg[@]} --verify ${kernelimg}.sig "$kernelimg" 1>/dev/null 2>&1`; then
++                msg "Signing updated kernel $kernelimg ..."
++                ${gpg[@]} --detach-sign "$kernelimg"
++                [ $? -gt 0 ] && error "$kernelimg is not signed!"
++            fi
++            /usr/bin/gpgconf --kill gpg-agent 1>/dev/null 2>&1
++        fi
+     fi
+ }
+ 
diff --git a/89-mkinitcpio-sign-install.hook b/89-mkinitcpio-sign-install.hook
new file mode 100644
index 000000000000..4921bb58c565
--- /dev/null
+++ b/89-mkinitcpio-sign-install.hook
@@ -0,0 +1,12 @@
+[Trigger]
+Type = File
+Operation = Install
+Operation = Upgrade
+Target = usr/lib/modules/*/vmlinuz
+Target = usr/lib/initcpio/*
+
+[Action]
+Description = Checking for a keypair to sign images with
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/mkinitcpio-sign-install
+NeedsTargets
diff --git a/PKGBUILD b/PKGBUILD
new file mode 100644
index 000000000000..c5c5acf67026
--- /dev/null
+++ b/PKGBUILD
@@ -0,0 +1,53 @@
+# Maintainer: Bart De Roy <de dot roy dot bart at gmail dot com>
+
+pkgname=mkinitcpio-sign-patch
+pkgver=27
+pkgrel=2
+pkgdesc="Modular initramfs image creation utility (automatically signs kernels and images)"
+arch=('any')
+url="https://projects.archlinux.org/mkinitcpio.git/"
+license=('GPL')
+depends=('awk' 'mkinitcpio-busybox>=1.19.4-2' 'kmod' 'util-linux>=2.23' 'libarchive' 'coreutils'
+         'bash' 'diffutils' 'findutils' 'grep' 'filesystem>=2011.10-1' 'gzip' 'systemd' 'gnupg')
+optdepends=('xz: Use lzma or xz compression for the initramfs image'
+            'bzip2: Use bzip2 compression for the initramfs image'
+            'lzop: Use lzo compression for the initramfs image'
+            'lz4: Use lz4 compression for the initramfs image'
+            'mkinitcpio-nfs-utils: Support for root filesystem on NFS')
+provides=('initramfs')
+conflicts=('mkinitcpio')
+backup=('etc/mkinitcpio.conf')
+source=("https://sources.archlinux.org/other/${pkgname%-sign-patch}/${pkgname%-sign-patch}-$pkgver.tar.gz"{,.sig}
+        "0001-mkinitcpio-remove-preset-pacsave.patch"
+        "gpg.conf" "89-mkinitcpio-sign-install.hook" "mkinitcpio-sign-install"
+        "0002-mkinitcpio-sign-when-done.patch")
+install=mkinitcpio.install
+sha256sums=('e6bff1cb78b677538eb9aace900b715fd59de8fc210b74fb9d899dfaa32bc354'
+            'SKIP'
+            '845569fa760f70c868ecb3dc8ae9667287970526dddaf403fdafcb716e8b3d51'
+            'f6eebbd610dcb91288d39b93e4f7f7f47e1c13abaab2d379607d78d417bfd0c7'
+            'cb094c11de6d4ad903484dea41ef456a4a92c788e570ff8f21214021de7e4f14'
+            'dc555d3c8d774556732362ae707704b09b86c21c55f53f5c68215ca1d3b24b0a'
+            '5dc8d9ae28979ea09a6b2ba0192a211421b0a40518a8763bdc86c4f841926590')
+validpgpkeys=('487EACC08557AD082088DABA1EB2638FF56C0C53'   # Dave Reisner
+              '86CFFCA918CF3AF47147588051E8B148A9999C34'   # Evangelos Foutras
+              'ECCAC84C1BA08A6CC8E63FBBF22FB1D78A77AEAB')  # Giancarlo Razzolini
+
+prepare() {
+  cd ${pkgname%-sign-patch}-$pkgver
+  # Apply 0001-mkinitcpio-remove-preset-pacsave.patch
+  patch -Np1 < $srcdir/0001-mkinitcpio-remove-preset-pacsave.patch
+  patch -Np1 < $srcdir/0002-mkinitcpio-sign-when-done.patch
+}
+
+check() {
+  make -C "${pkgname%-sign-patch}-$pkgver" check
+}
+
+package() {
+  make -C "${pkgname%-sign-patch}-$pkgver" DESTDIR="$pkgdir" install
+  install -m644  $srcdir/89-mkinitcpio-sign-install.hook $pkgdir/usr/share/libalpm/hooks/89-mkinitcpio-sign-install.hook
+  install -m755  $srcdir/mkinitcpio-sign-install         $pkgdir/usr/share/libalpm/scripts/mkinitcpio-sign-install
+  install -dm700 $pkgdir/usr/lib/initcpio/sign
+  install -m600  $srcdir/gpg.conf $pkgdir/usr/lib/initcpio/sign/gpg.conf
+}
diff --git a/gpg.conf b/gpg.conf
new file mode 100644
index 000000000000..bf86bf9ed18c
--- /dev/null
+++ b/gpg.conf
@@ -0,0 +1,6 @@
+yes
+no-greeting
+disable-dirmngr
+pinentry-mode loopback
+batch
+passphrase-file /usr/lib/initcpio/sign/passphrase
diff --git a/mkinitcpio-sign-install b/mkinitcpio-sign-install
new file mode 100644
index 000000000000..4bacd2fe0071
--- /dev/null
+++ b/mkinitcpio-sign-install
@@ -0,0 +1,23 @@
+#!/bin/bash -e
+
+pushd /usr/lib/initcpio/sign
+gpg-agent --daemon --max-cache-ttl 1
+keys=(`gpg --homedir . --list-keys --with-colons | awk -F: '/^pub:/ { print $5 }' | tr '\n' ' '`)
+
+if [[ $keys != "" ]]; then
+  echo "found $keys"
+else
+  gpg --homedir . --gen-key
+  [ $? -ne 0 ] && 1>&2 echo "you need to generate a GPG keypair to use for signing in /usr/lib/initcpio/sign" && exit 1
+  gpg --homedir . --export > ~/boot.key
+fi
+
+if [ ! -f ./passphrase ] && `read pass`; then
+  echo "$pass" > passphrase
+fi
+
+chmod 600 passphrase 2>&1 1>/dev/null
+
+if (( ${#args[@]} )); then
+    mkinitcpio "${args[@]}"
+fi
diff --git a/mkinitcpio.install b/mkinitcpio.install
new file mode 100644
index 000000000000..8571ee7d3f2d
--- /dev/null
+++ b/mkinitcpio.install
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+post_upgrade() {
+  if [ "$(vercmp 0.9.0 "$2")" -eq 1 ]; then
+    printf '==> If your /usr is on a separate partition, you must add the "usr" hook\n'
+    printf '    to /etc/mkinitcpio.conf and regenerate your images before rebooting\n'
+  fi
+
+  if [ "$(vercmp 0.12.0 "$2")" -eq 1 ]; then
+    printf '==> The "block" hook has replaced several hooks:\n'
+    printf '       fw, sata, pata, scsi, virtio, mmc, usb\n'
+    printf '    Replace any and all of these in /etc/mkinitcpio.conf with a single\n'
+    printf '    instance of the "block" hook\n'
+  fi
+}