From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Fri, 04 Jul 2025 17:09:00 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1uXi28-00E1lS-1a for lore@lore.pengutronix.de; Fri, 04 Jul 2025 17:09:00 +0200 Received: from localhost ([127.0.0.1] helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1uXi28-0004r1-9d; Fri, 04 Jul 2025 17:09:00 +0200 Received: from drehscheibe.grey.stw.pengutronix.de ([2a0a:edc0:0:c01:1d::a2]) by metis.whiteo.stw.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1uXi1l-0004qb-ET; Fri, 04 Jul 2025 17:08:37 +0200 Received: from dude05.red.stw.pengutronix.de ([2a0a:edc0:0:1101:1d::54]) by drehscheibe.grey.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1uXi1l-006mbe-0M; Fri, 04 Jul 2025 17:08:37 +0200 Received: from mol by dude05.red.stw.pengutronix.de with local (Exim 4.96) (envelope-from ) id 1uXi1l-00BgHU-0C; Fri, 04 Jul 2025 17:08:37 +0200 Date: Fri, 4 Jul 2025 17:08:37 +0200 From: Michael Olbrich To: Sandy Patterson Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Sent-From: Pengutronix Hildesheim X-URL: http://www.pengutronix.de/ X-IRC: #ptxdist @freenode X-Accept-Language: de,en X-Accept-Content-Type: text/plain Subject: Re: [ptxdist] building a separate initramfs X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: ptxdist@pengutronix.de Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Hi, On Wed, Jul 02, 2025 at 08:14:40AM -0400, Sandy Patterson wrote: > I'm having trouble figuring out how to build an initramfs from a second > userspace set of packages. > > Basically I want to run an encrypted and verified rootfs. I have a solution > for another board which uses an initramfs that sets up the keys/root hashes > and does a pivot_root. But in order to get this into ptxdist I had to > precompile all the binaries for the ramdisk and make a custom rule to build > it. I was hoping to find how others do this or get some pointers before I > go and replicate that again. > > Or perhaps ptxdist has another solution already built for encrypting a root > and maintaining trust? There is no finished solution right now. You can use the regular glibc, busybox, etc. packages and combine it with some custom /init script or binary. Just create a new cpio image with an explicit 'IMAGE__PKGS = glibc busybox ... myinit'. That's pretty simple but the resulting initramfs will be pretty big. Create a musl package and new packages for various components for the initramfs. Fill the initramfs with that. What I'm currently working on is rsinit[1]. The idea is to implement the whole initramfs in a minimal rust binary. But that very much work in progress. Right now, it has support for a dm-verity rootfs but no encryption. My plan is to have a default binary that handles all the common cases. And for custom stuff, import the create in your own binary and use the building blocks. But it's not ready for that yet. In all cases: Packages that should be in the initramfs but not the regular rootfs should use "EXTRA_PACKAGES-$(PTXCONF_...)" instead of "PACKAGES-$(PTXCONF_...)". Regards, Michael [1] https://github.com/michaelolbrich/rsinit -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |