mirror of
https://github.com/gentoo-mirror/guru.git
synced 2026-07-19 20:13:01 -04:00
Revert "sys-boot/lamboot: new package"
Policy violation. Reverts:4970049175Reverts:d03b63516aReverts:7299af2062Bug: https://bugs.gentoo.org/979152 Signed-off-by: Florian Albrechtskirchinger <falbrechtskirchinger@gmail.com>
This commit is contained in:
Florian Albrechtskirchinger
@@ -1 +0,0 @@
|
||||
DIST lamboot-0.16.5-x86_64.tar.gz 3190092 BLAKE2B 59be1503f8c8636b7b81222ef3f5302518e5fc93a5e1b4a2a95a8d2a660b45f77d3d8771ca362c19b4649c399a4ac2751c6ebed639f7b29f5e1c2c6348746424 SHA512 33ee1e989c418546da29550b95c3d0c982165cc782d6ceea6192f1a0c8396f3c535b415243a81978271e5e08a02cfdd93ac6cdc502f1cb3da3cb93daba911705
|
||||
@@ -1,143 +0,0 @@
|
||||
# Copyright 2026 Gentoo Authors
|
||||
# Copyright 2026 Lamco Development LLC
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
|
||||
PYTHON_COMPAT=( python3_{12..15} )
|
||||
inherit python-single-r1 shell-completion
|
||||
|
||||
DESCRIPTION="Memory-safe UEFI bootloader for Linux, written in Rust"
|
||||
HOMEPAGE="https://lamco.ai/products/lamboot/ https://github.com/lamco-admin/lamboot"
|
||||
|
||||
# Prebuilt binary ebuild: this repackages the published Secure Boot-signed
|
||||
# -bin release artifact (the same tarball AUR lamboot-bin and apt.lamco.ai
|
||||
# consume). It does not build from source, so no nightly Rust toolchain and
|
||||
# no signing keys are needed at merge time. A build-from-source ebuild is a
|
||||
# separate track, gated on whether LamBoot builds on stable rustc for the
|
||||
# *-unknown-uefi targets without -Z build-std (see ../../../PACKAGING.md).
|
||||
SRC_URI="https://github.com/lamco-admin/lamboot/releases/download/v${PV}/lamboot-${PV}-x86_64.tar.gz"
|
||||
|
||||
LICENSE="MIT Apache-2.0"
|
||||
SLOT="0"
|
||||
KEYWORDS="~amd64"
|
||||
|
||||
# The shipped .efi is a Secure Boot-signed PE binary. Stripping it (or running
|
||||
# any ELF post-processing over it) rewrites the file and invalidates the
|
||||
# signature, so the firmware rejects it under Secure Boot. Forbid strip.
|
||||
RESTRICT="strip"
|
||||
|
||||
# efibootmgr: lamboot-install registers the UEFI boot entry through it.
|
||||
# python: lamboot-inspect and lamboot-monitor.py are Python 3 programs; the
|
||||
# python-single-r1 eclass declares the dependency and pins the script shebangs.
|
||||
REQUIRED_USE="${PYTHON_REQUIRED_USE}"
|
||||
RDEPEND="
|
||||
sys-boot/efibootmgr
|
||||
${PYTHON_DEPS}
|
||||
"
|
||||
|
||||
# The signed PE binaries are not ELF; tell the QA scanners not to treat them
|
||||
# as broken ELF objects or to expect them to be stripped.
|
||||
QA_PREBUILT="usr/share/lamboot/EFI/LamBoot/*.efi
|
||||
usr/share/lamboot/EFI/LamBoot/modules/*.efi
|
||||
usr/share/lamboot/EFI/LamBoot/drivers/*/*.efi"
|
||||
|
||||
src_prepare() {
|
||||
default
|
||||
|
||||
# Drop any Python bytecode the artifact carried; it is regenerated at
|
||||
# runtime and would otherwise pull host paths into the package.
|
||||
find . -type d -name __pycache__ -exec rm -rf {} + || die
|
||||
find . -type f -name '*.pyc' -delete || die
|
||||
|
||||
# Normalise permissions: directories 0755, files 0644, keeping the
|
||||
# executable bit where the tarball already set it (lamboot-install,
|
||||
# lamboot-inspect, sign-lamboot.sh + its sign-lock/sign-unlock helpers,
|
||||
# the .efi loaders). Mirrors the deb's `chmod -R u=rwX,go=rX`. The
|
||||
# wholesale cp in src_install then preserves these modes.
|
||||
chmod -R u=rwX,go=rX . || die "failed to normalise source perms"
|
||||
|
||||
# Pin the Python diagnostic scripts' shebangs to the selected interpreter
|
||||
# (python-single-r1). lamboot-host-sampler and the rest are bash, left as-is.
|
||||
python_fix_shebang lamboot-inspect lamboot-monitor.py
|
||||
}
|
||||
|
||||
src_install() {
|
||||
# Stage the whole distribution under /usr/share/lamboot — lamboot-install's
|
||||
# SRC_DIR (it searches /usr/share/lamboot, /usr/local/share/lamboot, then
|
||||
# /opt/lamboot, and copies the .efi to the operator's ESP from there). Copy
|
||||
# the tree wholesale to preserve the +x bits on scripts, rather than doins
|
||||
# (which forces 0644 and would break lamboot-install's exec of its siblings).
|
||||
local share="${ED}/usr/share/lamboot"
|
||||
dodir /usr/share/lamboot
|
||||
cp -a "${S}"/. "${share}"/ || die "failed to stage distribution"
|
||||
|
||||
# Prune the copies installed to their own paths below (man, completions,
|
||||
# the README/CHANGELOG/SECURITY docs) or not installed at all (packaging,
|
||||
# docs, the license texts, the manifest); lamboot-install reads none of
|
||||
# them from SRC_DIR.
|
||||
rm -rf \
|
||||
"${share}"/packaging \
|
||||
"${share}"/man \
|
||||
"${share}"/completions \
|
||||
"${share}"/docs \
|
||||
"${share}"/README.md \
|
||||
"${share}"/CHANGELOG.md \
|
||||
"${share}"/SECURITY.md \
|
||||
"${share}"/LICENSE-MIT \
|
||||
"${share}"/LICENSE-APACHE \
|
||||
"${share}"/MANIFEST.sha256 \
|
||||
|| die "failed to prune staged tree"
|
||||
|
||||
# esp-deploy.sh at the canonical literal path. lamboot-install checks
|
||||
# /usr/lib/lamboot/esp-deploy.sh first, then the script-relative
|
||||
# ../lib/esp-deploy.sh. Use the literal /usr/lib (NOT $(get_libdir)):
|
||||
# on amd64 that resolves to /usr/lib64, where lamboot-install does not
|
||||
# look. It is a sourced shell library, so 0644 is correct.
|
||||
insinto /usr/lib/lamboot
|
||||
doins lib/esp-deploy.sh
|
||||
|
||||
# Operator CLIs on PATH as relative symlinks into the staged tree, so each
|
||||
# script's realpath-based sibling lookups resolve: lamboot-inspect imports
|
||||
# the adjacent lamboot_inspect package, and sign-lamboot.sh execs the
|
||||
# adjacent sign-unlock/sign-lock. The staged systemd units hardcode
|
||||
# /usr/bin/lamboot-install, so these must land in /usr/bin, not /usr/sbin.
|
||||
dodir /usr/bin
|
||||
dosym ../share/lamboot/lamboot-install /usr/bin/lamboot-install
|
||||
dosym ../share/lamboot/lamboot-inspect /usr/bin/lamboot-inspect
|
||||
dosym ../share/lamboot/sign-lamboot.sh /usr/bin/lamboot-sign
|
||||
|
||||
# Man page, shell completions (newbashcomp + dozshcomp from shell-completion).
|
||||
doman man/man1/lamboot-inspect.1
|
||||
newbashcomp completions/lamboot-inspect.bash lamboot-inspect
|
||||
dozshcomp completions/_lamboot-inspect
|
||||
|
||||
# Documentation. The MIT and Apache-2.0 license texts are not installed:
|
||||
# both are in Gentoo's license tree and tracked via LICENSE above.
|
||||
dodoc README.md CHANGELOG.md SECURITY.md
|
||||
|
||||
# Note what we deliberately do NOT install: the systemd units, the
|
||||
# kernel-install plugin, the kernel-event hooks, and lamboot-kernel-hook.
|
||||
# lamboot-install deploys all of those at runtime from /usr/share/lamboot.
|
||||
# The package never writes the ESP or /etc. (The AUR package's one
|
||||
# exception, the alpm kernel hook, is an Arch-only convention and has no
|
||||
# Gentoo equivalent here.)
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
elog "LamBoot is staged under /usr/share/lamboot but is NOT yet installed to"
|
||||
elog "the EFI System Partition. To deploy the bootloader and register a UEFI"
|
||||
elog "boot entry, run:"
|
||||
elog ""
|
||||
elog " sudo lamboot-install --signed"
|
||||
elog ""
|
||||
elog "Secure Boot today means MOK or sbctl enrollment; this package never"
|
||||
elog "enrolls a key for you. To trust the shipped signed bootloader under"
|
||||
elog "shim, enroll the LamBoot signing certificate:"
|
||||
elog ""
|
||||
elog " sudo mokutil --import /usr/share/lamboot/lamboot-signing.der"
|
||||
elog " (set a one-time password, reboot, complete enrollment in MokManager)"
|
||||
elog ""
|
||||
elog "Or, with sbctl, sign/enroll through your own Secure Boot key hierarchy."
|
||||
elog "Full guide: /usr/share/doc/${PF}/"
|
||||
}
|
||||
@@ -1,27 +0,0 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
|
||||
<pkgmetadata>
|
||||
<maintainer type="person">
|
||||
<email>greg@lamco.io</email>
|
||||
<name>Greg Lamberson</name>
|
||||
</maintainer>
|
||||
<longdescription lang="en">
|
||||
LamBoot is a UEFI bootloader for Linux written in Rust. It provides a
|
||||
native PE loader, a native ext4 read backend, Boot Loader Specification
|
||||
multi-filesystem discovery, TPM measurements, and a structured
|
||||
trust-evidence log.
|
||||
|
||||
This ebuild installs the prebuilt, Secure Boot-signed bootloader, its
|
||||
filesystem drivers and diagnostic modules, the public signing
|
||||
certificate, and the host-side tooling (lamboot-install,
|
||||
lamboot-inspect, lamboot-sign) under /usr/share/lamboot. It does not
|
||||
modify the EFI System Partition: run lamboot-install to deploy LamBoot
|
||||
to the ESP and register a UEFI boot entry. Under Secure Boot, enroll
|
||||
the shipped signing certificate with mokutil or sbctl first.
|
||||
</longdescription>
|
||||
<upstream>
|
||||
<remote-id type="github">lamco-admin/lamboot</remote-id>
|
||||
<bugs-to>https://github.com/lamco-admin/lamboot/issues</bugs-to>
|
||||
<doc>https://lamco.ai/products/lamboot/</doc>
|
||||
</upstream>
|
||||
</pkgmetadata>
|
||||
Reference in New Issue
Block a user