diff --git a/sys-boot/lamboot/Manifest b/sys-boot/lamboot/Manifest new file mode 100644 index 0000000000..e16aef7a03 --- /dev/null +++ b/sys-boot/lamboot/Manifest @@ -0,0 +1 @@ +DIST lamboot-0.16.5-x86_64.tar.gz 3190092 BLAKE2B 59be1503f8c8636b7b81222ef3f5302518e5fc93a5e1b4a2a95a8d2a660b45f77d3d8771ca362c19b4649c399a4ac2751c6ebed639f7b29f5e1c2c6348746424 SHA512 33ee1e989c418546da29550b95c3d0c982165cc782d6ceea6192f1a0c8396f3c535b415243a81978271e5e08a02cfdd93ac6cdc502f1cb3da3cb93daba911705 diff --git a/sys-boot/lamboot/lamboot-0.16.5.ebuild b/sys-boot/lamboot/lamboot-0.16.5.ebuild new file mode 100644 index 0000000000..61a4905372 --- /dev/null +++ b/sys-boot/lamboot/lamboot-0.16.5.ebuild @@ -0,0 +1,149 @@ +# Copyright 2026 Lamco Development LLC +# Distributed under the terms of the MIT or Apache-2.0 license + +EAPI=8 + +PYTHON_COMPAT=( python3_{11..14} ) +inherit python-single-r1 shell-completion + +DESCRIPTION="Memory-safe UEFI bootloader for Linux, written in Rust" +HOMEPAGE="https://lamco.ai/products/lamboot/ https://github.com/lamco-admin/lamboot" + +# Prebuilt binary ebuild: this repackages the published Secure Boot-signed +# -bin release artifact (the same tarball AUR lamboot-bin and apt.lamco.ai +# consume). It does not build from source, so no nightly Rust toolchain and +# no signing keys are needed at merge time. A build-from-source ebuild is a +# separate track, gated on whether LamBoot builds on stable rustc for the +# *-unknown-uefi targets without -Z build-std (see ../../../PACKAGING.md). +SRC_URI="https://github.com/lamco-admin/lamboot/releases/download/v${PV}/lamboot-${PV}-x86_64.tar.gz" +S="${WORKDIR}/lamboot-${PV}" + +LICENSE="MIT Apache-2.0" +SLOT="0" +KEYWORDS="~amd64" + +# The shipped .efi is a Secure Boot-signed PE binary. Stripping it (or running +# any ELF post-processing over it) rewrites the file and invalidates the +# signature, so the firmware rejects it under Secure Boot. Forbid strip. +RESTRICT="strip" + +# efibootmgr: lamboot-install registers the UEFI boot entry through it. +# python: lamboot-inspect and lamboot-monitor.py are Python 3 programs; the +# python-single-r1 eclass declares the dependency and pins the script shebangs. +REQUIRED_USE="${PYTHON_REQUIRED_USE}" +RDEPEND=" + sys-boot/efibootmgr + ${PYTHON_DEPS} +" + +# The signed PE binaries are not ELF; tell the QA scanners not to treat them +# as broken ELF objects or to expect them to be stripped. +QA_PREBUILT="usr/share/lamboot/EFI/LamBoot/*.efi + usr/share/lamboot/EFI/LamBoot/modules/*.efi + usr/share/lamboot/EFI/LamBoot/drivers/*/*.efi" + +src_install() { + # Stage the whole distribution under /usr/share/lamboot. This is + # lamboot-install's SRC_DIR: it searches /usr/share/lamboot, + # /usr/local/share/lamboot, then /opt/lamboot, and copies the .efi to the + # operator's ESP from there. We copy the tree wholesale (preserving the + # tarball's +x bits on scripts) rather than using doins, which would force + # 0644 and break lamboot-install's exec of its sibling helpers. + # + # Exclude build/packaging metadata, the man page, completions, docs, the + # top-level README/CHANGELOG/SECURITY/LICENSE files, the manifest, and + # Python bytecode: those are installed to their own paths below (or not at + # all), and lamboot-install does not read them from SRC_DIR. + local share="${ED}/usr/share/lamboot" + dodir /usr/share/lamboot + cp -a "${S}"/. "${share}"/ || die "failed to stage distribution" + rm -rf \ + "${share}"/packaging \ + "${share}"/man \ + "${share}"/completions \ + "${share}"/docs \ + "${share}"/README.md \ + "${share}"/CHANGELOG.md \ + "${share}"/SECURITY.md \ + "${share}"/LICENSE-MIT \ + "${share}"/LICENSE-APACHE \ + "${share}"/MANIFEST.sha256 \ + || die "failed to prune staged tree" + # Drop any Python bytecode the artifact carried; it is regenerated at + # runtime and would otherwise pull host paths into the package. + find "${share}" -type d -name __pycache__ -exec rm -rf {} + || die + find "${share}" -type f -name '*.pyc' -delete || die + + # Normalise staged permissions: directories 0755, files 0644, but keep the + # executable bit on the scripts/binaries that carried it (lamboot-install, + # lamboot-inspect, sign-lamboot.sh and its sign-lock/sign-unlock helpers, + # the .efi loaders, etc.). No group/other write. Mirror the deb's + # `chmod -R u=rwX,go=rX`, which preserves +x where it was already set. + chmod -R u=rwX,go=rX "${share}" || die "failed to normalise staged perms" + + # Pin the Python diagnostic scripts' shebangs to the selected interpreter + # (python-single-r1). lamboot-host-sampler and the rest are bash, left as-is. + python_fix_shebang \ + "${share}"/lamboot-inspect \ + "${share}"/lamboot-monitor.py + + # esp-deploy.sh at the canonical literal path. lamboot-install checks + # /usr/lib/lamboot/esp-deploy.sh first, then the script-relative + # ../lib/esp-deploy.sh. Use the literal /usr/lib (NOT $(get_libdir)): + # on amd64 that resolves to /usr/lib64, where lamboot-install does not + # look. It is a sourced shell library, so 0644 is correct. + insinto /usr/lib/lamboot + doins lib/esp-deploy.sh + + # Operator CLIs on PATH as relative symlinks into the staged tree, so each + # script's realpath-based sibling lookups resolve: lamboot-inspect imports + # the adjacent lamboot_inspect package, and sign-lamboot.sh execs the + # adjacent sign-unlock/sign-lock. The staged systemd units hardcode + # /usr/bin/lamboot-install, so these must land in /usr/bin, not /usr/sbin. + dodir /usr/bin + dosym ../share/lamboot/lamboot-install /usr/bin/lamboot-install + dosym ../share/lamboot/lamboot-inspect /usr/bin/lamboot-inspect + dosym ../share/lamboot/sign-lamboot.sh /usr/bin/lamboot-sign + + # Man page, shell completions (newbashcomp + dozshcomp from shell-completion). + doman man/man1/lamboot-inspect.1 + newbashcomp completions/lamboot-inspect.bash lamboot-inspect + dozshcomp completions/_lamboot-inspect + + # Documentation and dual license. + dodoc README.md CHANGELOG.md SECURITY.md + # The -bin tarball is thinned (PACKAGING.md ยง0): the full docs/ tree lives in + # the public repo + website, not the artifact, so it is absent here. Install + # it only if present, otherwise dodoc dies against the thinned tarball. + if [[ -d docs ]]; then + dodoc -r docs/. + fi + # Gentoo installs license texts under /usr/share/licenses/. + insinto /usr/share/licenses/${PN} + doins LICENSE-MIT LICENSE-APACHE + + # Note what we deliberately do NOT install: the systemd units, the + # kernel-install plugin, the kernel-event hooks, and lamboot-kernel-hook. + # lamboot-install deploys all of those at runtime from /usr/share/lamboot. + # The package never writes the ESP or /etc. (The AUR package's one + # exception, the alpm kernel hook, is an Arch-only convention and has no + # Gentoo equivalent here.) +} + +pkg_postinst() { + elog "LamBoot is staged under /usr/share/lamboot but is NOT yet installed to" + elog "the EFI System Partition. To deploy the bootloader and register a UEFI" + elog "boot entry, run:" + elog "" + elog " sudo lamboot-install --signed" + elog "" + elog "Secure Boot today means MOK or sbctl enrollment; this package never" + elog "enrolls a key for you. To trust the shipped signed bootloader under" + elog "shim, enroll the LamBoot signing certificate:" + elog "" + elog " sudo mokutil --import /usr/share/lamboot/lamboot-signing.der" + elog " (set a one-time password, reboot, complete enrollment in MokManager)" + elog "" + elog "Or, with sbctl, sign/enroll through your own Secure Boot key hierarchy." + elog "Full guide: /usr/share/doc/${PF}/" +} diff --git a/sys-boot/lamboot/metadata.xml b/sys-boot/lamboot/metadata.xml new file mode 100644 index 0000000000..cc719d6f98 --- /dev/null +++ b/sys-boot/lamboot/metadata.xml @@ -0,0 +1,31 @@ + + + + + office@lamco.io + Lamco Development LLC + + + proxy-maint@gentoo.org + Proxy Maintainers + + + LamBoot is a UEFI bootloader for Linux written in Rust. It provides a + native PE loader, a native ext4 read backend, Boot Loader Specification + multi-filesystem discovery, TPM measurements, and a structured + trust-evidence log. + + This ebuild installs the prebuilt, Secure Boot-signed bootloader, its + filesystem drivers and diagnostic modules, the public signing + certificate, and the host-side tooling (lamboot-install, + lamboot-inspect, lamboot-sign) under /usr/share/lamboot. It does not + modify the EFI System Partition: run lamboot-install to deploy LamBoot + to the ESP and register a UEFI boot entry. Under Secure Boot, enroll + the shipped signing certificate with mokutil or sbctl first. + + + lamco-admin/lamboot + https://github.com/lamco-admin/lamboot/issues + https://lamco.ai/products/lamboot/ + +