Re: [ptxdist] building a separate initramfs

Re: [ptxdist] building a separate initramfs

[Michael Olbrich]

Hi,

On Wed, Jul 02, 2025 at 08:14:40AM -0400, Sandy Patterson wrote:
> I'm having trouble figuring out how to build an initramfs from a second
> userspace set of packages.
> 
> Basically I want to run an encrypted and verified rootfs. I have a solution
> for another board which uses an initramfs that sets up the keys/root hashes
> and does a pivot_root. But in order to get this into ptxdist I had to
> precompile all the binaries for the ramdisk and make a custom rule to build
> it. I was hoping to find how others do this or get some pointers before I
> go and replicate that again.
> 
> Or perhaps ptxdist has another solution already built for encrypting a root
> and maintaining trust?

There is no finished solution right now.

You can use the regular glibc, busybox, etc. packages and combine it with
some custom /init script or binary. Just create a new cpio image with an
explicit 'IMAGE_<NAME>_PKGS = glibc busybox ... myinit'. That's pretty
simple but the resulting initramfs will be pretty big.

Create a musl package and new packages for various components for the
initramfs. Fill the initramfs with that.

What I'm currently working on is rsinit[1]. The idea is to implement the
whole initramfs in a minimal rust binary. But that very much work in
progress. Right now, it has support for a dm-verity rootfs but no
encryption.
My plan is to have a default binary that handles all the common cases. And
for custom stuff, import the create in your own binary and use the building
blocks. But it's not ready for that yet.


In all cases: Packages that should be in the initramfs but not the regular
rootfs should use "EXTRA_PACKAGES-$(PTXCONF_...)" instead of
"PACKAGES-$(PTXCONF_...)".

Regards,
Michael

[1] https://github.com/michaelolbrich/rsinit

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

Re: [ptxdist] building a separate initramfs

[Sandy Patterson]

Thanks so much Michael, it seems my email filters needed some work!

That got me going. I was able to make a basic rootfs using "glibc
busybox usr-rootfs" which creates a 3.2M uncompressed cpio on our
architecture. I'm not sure how resource constrained you are, but we
have plenty of disk on our system.

I tried to work out how to improve the documentation. However, now
that I understand it I'm not sure how I would. I had trouble
understanding _multi_image_individual_root_filesystems and didn't
initially realize that section 1 describes two rules, an extra
package, and an image modification.

Anyway, thanks again,
Sandy

[ptxdist] building a separate initramfs

[Sandy Patterson]

Hi,

I'm having trouble figuring out how to build an initramfs from a
second userspace set of packages.

Basically I want to run an encrypted and verified rootfs. I have a
solution for another board which uses an initramfs that sets up the
keys/root hashes and does a pivot_root. But in order to get this into
ptxdist I had to precompile all the binaries for the ramdisk and make
a custom rule to build it. I was hoping to find how others do this or
get some pointers before I go and replicate that again.

Or perhaps ptxdist has another solution already built for encrypting a
root and maintaining trust?

Best,
Sandy Patterson