From 86c1b908b30bd6a8d68164ea6698b4a27e630f48 Mon Sep 17 00:00:00 2001 From: Florian Albrechtskirchinger Date: Mon, 13 Jul 2026 08:20:46 +0200 Subject: [PATCH] Revert "sys-boot/lamboot: new package" Policy violation. Reverts: 49700491753c7e6fb6393a69364545738970ca3e Reverts: d03b63516a5200fef5a8e577c4424b232d5f150c Reverts: 7299af2062dbc324dc70a5cf3112e41634d1ce0a Bug: https://bugs.gentoo.org/979152 Signed-off-by: Florian Albrechtskirchinger --- sys-boot/lamboot/Manifest | 1 - sys-boot/lamboot/lamboot-0.16.5.ebuild | 143 ------------------------- sys-boot/lamboot/metadata.xml | 27 ----- 3 files changed, 171 deletions(-) delete mode 100644 sys-boot/lamboot/Manifest delete mode 100644 sys-boot/lamboot/lamboot-0.16.5.ebuild delete mode 100644 sys-boot/lamboot/metadata.xml diff --git a/sys-boot/lamboot/Manifest b/sys-boot/lamboot/Manifest deleted file mode 100644 index e16aef7a03..0000000000 --- a/sys-boot/lamboot/Manifest +++ /dev/null @@ -1 +0,0 @@ -DIST lamboot-0.16.5-x86_64.tar.gz 3190092 BLAKE2B 59be1503f8c8636b7b81222ef3f5302518e5fc93a5e1b4a2a95a8d2a660b45f77d3d8771ca362c19b4649c399a4ac2751c6ebed639f7b29f5e1c2c6348746424 SHA512 33ee1e989c418546da29550b95c3d0c982165cc782d6ceea6192f1a0c8396f3c535b415243a81978271e5e08a02cfdd93ac6cdc502f1cb3da3cb93daba911705 diff --git a/sys-boot/lamboot/lamboot-0.16.5.ebuild b/sys-boot/lamboot/lamboot-0.16.5.ebuild deleted file mode 100644 index f3f896bf7d..0000000000 --- a/sys-boot/lamboot/lamboot-0.16.5.ebuild +++ /dev/null @@ -1,143 +0,0 @@ -# Copyright 2026 Gentoo Authors -# Copyright 2026 Lamco Development LLC -# Distributed under the terms of the GNU General Public License v2 - -EAPI=8 - -PYTHON_COMPAT=( python3_{12..15} ) -inherit python-single-r1 shell-completion - -DESCRIPTION="Memory-safe UEFI bootloader for Linux, written in Rust" -HOMEPAGE="https://lamco.ai/products/lamboot/ https://github.com/lamco-admin/lamboot" - -# Prebuilt binary ebuild: this repackages the published Secure Boot-signed -# -bin release artifact (the same tarball AUR lamboot-bin and apt.lamco.ai -# consume). It does not build from source, so no nightly Rust toolchain and -# no signing keys are needed at merge time. A build-from-source ebuild is a -# separate track, gated on whether LamBoot builds on stable rustc for the -# *-unknown-uefi targets without -Z build-std (see ../../../PACKAGING.md). -SRC_URI="https://github.com/lamco-admin/lamboot/releases/download/v${PV}/lamboot-${PV}-x86_64.tar.gz" - -LICENSE="MIT Apache-2.0" -SLOT="0" -KEYWORDS="~amd64" - -# The shipped .efi is a Secure Boot-signed PE binary. Stripping it (or running -# any ELF post-processing over it) rewrites the file and invalidates the -# signature, so the firmware rejects it under Secure Boot. Forbid strip. -RESTRICT="strip" - -# efibootmgr: lamboot-install registers the UEFI boot entry through it. -# python: lamboot-inspect and lamboot-monitor.py are Python 3 programs; the -# python-single-r1 eclass declares the dependency and pins the script shebangs. -REQUIRED_USE="${PYTHON_REQUIRED_USE}" -RDEPEND=" - sys-boot/efibootmgr - ${PYTHON_DEPS} -" - -# The signed PE binaries are not ELF; tell the QA scanners not to treat them -# as broken ELF objects or to expect them to be stripped. -QA_PREBUILT="usr/share/lamboot/EFI/LamBoot/*.efi - usr/share/lamboot/EFI/LamBoot/modules/*.efi - usr/share/lamboot/EFI/LamBoot/drivers/*/*.efi" - -src_prepare() { - default - - # Drop any Python bytecode the artifact carried; it is regenerated at - # runtime and would otherwise pull host paths into the package. - find . -type d -name __pycache__ -exec rm -rf {} + || die - find . -type f -name '*.pyc' -delete || die - - # Normalise permissions: directories 0755, files 0644, keeping the - # executable bit where the tarball already set it (lamboot-install, - # lamboot-inspect, sign-lamboot.sh + its sign-lock/sign-unlock helpers, - # the .efi loaders). Mirrors the deb's `chmod -R u=rwX,go=rX`. The - # wholesale cp in src_install then preserves these modes. - chmod -R u=rwX,go=rX . || die "failed to normalise source perms" - - # Pin the Python diagnostic scripts' shebangs to the selected interpreter - # (python-single-r1). lamboot-host-sampler and the rest are bash, left as-is. - python_fix_shebang lamboot-inspect lamboot-monitor.py -} - -src_install() { - # Stage the whole distribution under /usr/share/lamboot — lamboot-install's - # SRC_DIR (it searches /usr/share/lamboot, /usr/local/share/lamboot, then - # /opt/lamboot, and copies the .efi to the operator's ESP from there). Copy - # the tree wholesale to preserve the +x bits on scripts, rather than doins - # (which forces 0644 and would break lamboot-install's exec of its siblings). - local share="${ED}/usr/share/lamboot" - dodir /usr/share/lamboot - cp -a "${S}"/. "${share}"/ || die "failed to stage distribution" - - # Prune the copies installed to their own paths below (man, completions, - # the README/CHANGELOG/SECURITY docs) or not installed at all (packaging, - # docs, the license texts, the manifest); lamboot-install reads none of - # them from SRC_DIR. - rm -rf \ - "${share}"/packaging \ - "${share}"/man \ - "${share}"/completions \ - "${share}"/docs \ - "${share}"/README.md \ - "${share}"/CHANGELOG.md \ - "${share}"/SECURITY.md \ - "${share}"/LICENSE-MIT \ - "${share}"/LICENSE-APACHE \ - "${share}"/MANIFEST.sha256 \ - || die "failed to prune staged tree" - - # esp-deploy.sh at the canonical literal path. lamboot-install checks - # /usr/lib/lamboot/esp-deploy.sh first, then the script-relative - # ../lib/esp-deploy.sh. Use the literal /usr/lib (NOT $(get_libdir)): - # on amd64 that resolves to /usr/lib64, where lamboot-install does not - # look. It is a sourced shell library, so 0644 is correct. - insinto /usr/lib/lamboot - doins lib/esp-deploy.sh - - # Operator CLIs on PATH as relative symlinks into the staged tree, so each - # script's realpath-based sibling lookups resolve: lamboot-inspect imports - # the adjacent lamboot_inspect package, and sign-lamboot.sh execs the - # adjacent sign-unlock/sign-lock. The staged systemd units hardcode - # /usr/bin/lamboot-install, so these must land in /usr/bin, not /usr/sbin. - dodir /usr/bin - dosym ../share/lamboot/lamboot-install /usr/bin/lamboot-install - dosym ../share/lamboot/lamboot-inspect /usr/bin/lamboot-inspect - dosym ../share/lamboot/sign-lamboot.sh /usr/bin/lamboot-sign - - # Man page, shell completions (newbashcomp + dozshcomp from shell-completion). - doman man/man1/lamboot-inspect.1 - newbashcomp completions/lamboot-inspect.bash lamboot-inspect - dozshcomp completions/_lamboot-inspect - - # Documentation. The MIT and Apache-2.0 license texts are not installed: - # both are in Gentoo's license tree and tracked via LICENSE above. - dodoc README.md CHANGELOG.md SECURITY.md - - # Note what we deliberately do NOT install: the systemd units, the - # kernel-install plugin, the kernel-event hooks, and lamboot-kernel-hook. - # lamboot-install deploys all of those at runtime from /usr/share/lamboot. - # The package never writes the ESP or /etc. (The AUR package's one - # exception, the alpm kernel hook, is an Arch-only convention and has no - # Gentoo equivalent here.) -} - -pkg_postinst() { - elog "LamBoot is staged under /usr/share/lamboot but is NOT yet installed to" - elog "the EFI System Partition. To deploy the bootloader and register a UEFI" - elog "boot entry, run:" - elog "" - elog " sudo lamboot-install --signed" - elog "" - elog "Secure Boot today means MOK or sbctl enrollment; this package never" - elog "enrolls a key for you. To trust the shipped signed bootloader under" - elog "shim, enroll the LamBoot signing certificate:" - elog "" - elog " sudo mokutil --import /usr/share/lamboot/lamboot-signing.der" - elog " (set a one-time password, reboot, complete enrollment in MokManager)" - elog "" - elog "Or, with sbctl, sign/enroll through your own Secure Boot key hierarchy." - elog "Full guide: /usr/share/doc/${PF}/" -} diff --git a/sys-boot/lamboot/metadata.xml b/sys-boot/lamboot/metadata.xml deleted file mode 100644 index 4c782ddb36..0000000000 --- a/sys-boot/lamboot/metadata.xml +++ /dev/null @@ -1,27 +0,0 @@ - - - - - greg@lamco.io - Greg Lamberson - - - LamBoot is a UEFI bootloader for Linux written in Rust. It provides a - native PE loader, a native ext4 read backend, Boot Loader Specification - multi-filesystem discovery, TPM measurements, and a structured - trust-evidence log. - - This ebuild installs the prebuilt, Secure Boot-signed bootloader, its - filesystem drivers and diagnostic modules, the public signing - certificate, and the host-side tooling (lamboot-install, - lamboot-inspect, lamboot-sign) under /usr/share/lamboot. It does not - modify the EFI System Partition: run lamboot-install to deploy LamBoot - to the ESP and register a UEFI boot entry. Under Secure Boot, enroll - the shipped signing certificate with mokutil or sbctl first. - - - lamco-admin/lamboot - https://github.com/lamco-admin/lamboot/issues - https://lamco.ai/products/lamboot/ - -