From 376a549acaa0bb2856297ab46f2d7a6304dcbbc4 Mon Sep 17 00:00:00 2001 From: Freya Murphy Date: Tue, 9 Apr 2024 18:18:55 -0400 Subject: [PATCH] a --- .local/bin/dotfiles | 23 ++++ .root/etc/cmdline.d/look.conf | 1 + .root/etc/cmdline.d/root.conf | 1 + .root/etc/cmdline.d/virt.conf | 1 + .root/etc/initcpio/post/uki-sbsign | 15 +++ .root/etc/mkinitcpio.d/linux-lts.preset | 17 +++ .root/etc/mkinitcpio.d/linux.preset | 17 +++ .root/etc/pacman.d/hooks/uki.hook | 16 +++ .rootmakepkg.conf/makepkg.conf | 159 ++++++++++++++++++++++++ .rootmkinitcpio.conf/mkinitcpio.conf | 4 + .rootparu.conf/paru.conf | 39 ++++++ packages | 3 + 12 files changed, 296 insertions(+) create mode 100644 .root/etc/cmdline.d/look.conf create mode 100644 .root/etc/cmdline.d/root.conf create mode 100644 .root/etc/cmdline.d/virt.conf create mode 100755 .root/etc/initcpio/post/uki-sbsign create mode 100644 .root/etc/mkinitcpio.d/linux-lts.preset create mode 100644 .root/etc/mkinitcpio.d/linux.preset create mode 100644 .root/etc/pacman.d/hooks/uki.hook create mode 100644 .rootmakepkg.conf/makepkg.conf create mode 100644 .rootmkinitcpio.conf/mkinitcpio.conf create mode 100644 .rootparu.conf/paru.conf diff --git a/.local/bin/dotfiles b/.local/bin/dotfiles index c5c2ceb..5612f17 100755 --- a/.local/bin/dotfiles +++ b/.local/bin/dotfiles @@ -37,6 +37,29 @@ packages="$HOME/packages" paru -Qeqm > $aur pacman -Qeq | grep -vf "$aur" > "$packages" +root_dir() { + mkdir -p "$HOME/.root$1" + cp "$1"/* "$HOME/.root$1" + $config add "$HOME/.root$1" + rm -fr "$HOME/.root$1" +} + +root_file() { + dir=$(basename "$1") + mkdir -p "$HOME/.root$dir" + cp "$1" "$HOME/.root$dir" + $config add "$HOME/.root$dir" + rm -fr "$HOME/.root$dir" +} + +root_dir /etc/initcpio/post +root_dir /etc/pacman.d/hooks +root_dir /etc/mkinitcpio.d +root_dir /etc/cmdline.d +root_file /etc/paru.conf +root_file /etc/mkinitcpio.conf +root_file /etc/makepkg.conf + $config add "$aur" $config add "$packages" diff --git a/.root/etc/cmdline.d/look.conf b/.root/etc/cmdline.d/look.conf new file mode 100644 index 0000000..4c1901f --- /dev/null +++ b/.root/etc/cmdline.d/look.conf @@ -0,0 +1 @@ +loglevel=0 text bgrt_disable diff --git a/.root/etc/cmdline.d/root.conf b/.root/etc/cmdline.d/root.conf new file mode 100644 index 0000000..9c0248e --- /dev/null +++ b/.root/etc/cmdline.d/root.conf @@ -0,0 +1 @@ +cryptdevice=UUID=c2ac4d90-704e-4f64-a699-4cf69d40bd0b:root:discard root=/dev/mapper/root rw diff --git a/.root/etc/cmdline.d/virt.conf b/.root/etc/cmdline.d/virt.conf new file mode 100644 index 0000000..9b754f7 --- /dev/null +++ b/.root/etc/cmdline.d/virt.conf @@ -0,0 +1 @@ +amd_iommu=on diff --git a/.root/etc/initcpio/post/uki-sbsign b/.root/etc/initcpio/post/uki-sbsign new file mode 100755 index 0000000..eb34cd4 --- /dev/null +++ b/.root/etc/initcpio/post/uki-sbsign @@ -0,0 +1,15 @@ +#!/usr/bin/env bash + +uki="$3" +[[ -n "$uki" ]] || exit 0 + +keypairs=(/usr/share/secureboot/keys/db/db.key /usr/share/secureboot/keys/db/db.pem) + +for (( i=0; i<${#keypairs[@]}; i+=2 )); do + key="${keypairs[$i]}" + cert="${keypairs[(( i + 1))]}" + if ! sbverify --cert "$cert" "$uki" &>/dev/null; then + sbsign --key "$key" --cert "$cert" --output "$uki" "$uki" + fi +done + diff --git a/.root/etc/mkinitcpio.d/linux-lts.preset b/.root/etc/mkinitcpio.d/linux-lts.preset new file mode 100644 index 0000000..a55ad38 --- /dev/null +++ b/.root/etc/mkinitcpio.d/linux-lts.preset @@ -0,0 +1,17 @@ +# mkinitcpio preset file for the 'linux-lts' package + +#ALL_config="/etc/mkinitcpio.conf" +ALL_kver="/boot/vmlinuz-linux-lts" +ALL_microcode=(/boot/*-ucode.img) + +PRESETS=('default' 'fallback') + +#default_config="/etc/mkinitcpio.conf" +#default_image="/boot/initramfs-linux-lts.img" +default_uki="/boot/efi/EFI/Linux/arch-linux-lts.efi" +#default_options="--splash /usr/share/systemd/bootctl/splash-arch.bmp" + +#fallback_config="/etc/mkinitcpio.conf" +#fallback_image="/boot/initramfs-linux-lts-fallback.img" +fallback_uki="/boot/efi/EFI/Linux/arch-linux-lts-fallback.efi" +fallback_options="-S autodetect" diff --git a/.root/etc/mkinitcpio.d/linux.preset b/.root/etc/mkinitcpio.d/linux.preset new file mode 100644 index 0000000..3c28a52 --- /dev/null +++ b/.root/etc/mkinitcpio.d/linux.preset @@ -0,0 +1,17 @@ +# mkinitcpio preset file for the 'linux' package + +#ALL_config="/etc/mkinitcpio.conf" +ALL_kver="/boot/vmlinuz-linux" +ALL_microcode=(/boot/*-ucode.img) + +PRESETS=('default' 'fallback') + +#default_config="/etc/mkinitcpio.conf" +#default_image="/boot/initramfs-linux.img" +default_uki="/boot/efi/EFI/Linux/arch-linux.efi" +#default_options="--splash /usr/share/systemd/bootctl/splash-arch.bmp" + +#fallback_config="/etc/mkinitcpio.conf" +#fallback_image="/boot/initramfs-linux-fallback.img" +fallback_uki="/boot/efi/EFI/Linux/arch-linux-fallback.efi" +fallback_options="-S autodetect" diff --git a/.root/etc/pacman.d/hooks/uki.hook b/.root/etc/pacman.d/hooks/uki.hook new file mode 100644 index 0000000..3ca2bf8 --- /dev/null +++ b/.root/etc/pacman.d/hooks/uki.hook @@ -0,0 +1,16 @@ +[Trigger] +Operation=Install +Operation=Upgrade +Operation=Remove +Type=Package +Target=amd-ucode +Target=linux +Target=linux-lts + +[Action] +Description=Update Kernel and Microcode in initramfs +Depends=mkinitcpio +When=PostTransaction +NeedsTargets +Exec=/bin/sh -c 'while read -r trg; do case $trg in linux) exit 0; esac; done; /usr/bin/mkinitcpio -P' + diff --git a/.rootmakepkg.conf/makepkg.conf b/.rootmakepkg.conf/makepkg.conf new file mode 100644 index 0000000..8a1324e --- /dev/null +++ b/.rootmakepkg.conf/makepkg.conf @@ -0,0 +1,159 @@ +#!/hint/bash +# +# /etc/makepkg.conf +# + +######################################################################### +# SOURCE ACQUISITION +######################################################################### +# +#-- The download utilities that makepkg should use to acquire sources +# Format: 'protocol::agent' +DLAGENTS=('file::/usr/bin/curl -qgC - -o %o %u' + 'ftp::/usr/bin/curl -qgfC - --ftp-pasv --retry 3 --retry-delay 3 -o %o %u' + 'http::/usr/bin/curl -qgb "" -fLC - --retry 3 --retry-delay 3 -o %o %u' + 'https::/usr/bin/curl -qgb "" -fLC - --retry 3 --retry-delay 3 -o %o %u' + 'rsync::/usr/bin/rsync --no-motd -z %u %o' + 'scp::/usr/bin/scp -C %u %o') + +# Other common tools: +# /usr/bin/snarf +# /usr/bin/lftpget -c +# /usr/bin/wget + +#-- The package required by makepkg to download VCS sources +# Format: 'protocol::package' +VCSCLIENTS=('bzr::breezy' + 'fossil::fossil' + 'git::git' + 'hg::mercurial' + 'svn::subversion') + +######################################################################### +# ARCHITECTURE, COMPILE FLAGS +######################################################################### +# +CARCH="x86_64" +CHOST="x86_64-pc-linux-gnu" + +#-- Compiler and Linker Flags +#CPPFLAGS="" +CFLAGS="-march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions \ + -Wp,-D_FORTIFY_SOURCE=2 -Wformat -Werror=format-security \ + -fstack-clash-protection -fcf-protection" +CXXFLAGS="$CFLAGS -Wp,-D_GLIBCXX_ASSERTIONS" +LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now" +LTOFLAGS="-flto=auto" +#RUSTFLAGS="-C opt-level=2" +#-- Make Flags: change this for DistCC/SMP systems +MAKEFLAGS="-j16" +#-- Debugging flags +DEBUG_CFLAGS="-g" +DEBUG_CXXFLAGS="$DEBUG_CFLAGS" +#DEBUG_RUSTFLAGS="-C debuginfo=2" + +######################################################################### +# BUILD ENVIRONMENT +######################################################################### +# +# Makepkg defaults: BUILDENV=(!distcc !color !ccache check !sign) +# A negated environment option will do the opposite of the comments below. +# +#-- distcc: Use the Distributed C/C++/ObjC compiler +#-- color: Colorize output messages +#-- ccache: Use ccache to cache compilation +#-- check: Run the check() function if present in the PKGBUILD +#-- sign: Generate PGP signature file +# +BUILDENV=(!distcc color !ccache check !sign) +# +#-- If using DistCC, your MAKEFLAGS will also need modification. In addition, +#-- specify a space-delimited list of hosts running in the DistCC cluster. +#DISTCC_HOSTS="" +# +#-- Specify a directory for package building. +#BUILDDIR=/tmp/makepkg + +######################################################################### +# GLOBAL PACKAGE OPTIONS +# These are default values for the options=() settings +######################################################################### +# +# Makepkg defaults: OPTIONS=(!strip docs libtool staticlibs emptydirs !zipman !purge !debug !lto) +# A negated option will do the opposite of the comments below. +# +#-- strip: Strip symbols from binaries/libraries +#-- docs: Save doc directories specified by DOC_DIRS +#-- libtool: Leave libtool (.la) files in packages +#-- staticlibs: Leave static library (.a) files in packages +#-- emptydirs: Leave empty directories in packages +#-- zipman: Compress manual (man and info) pages in MAN_DIRS with gzip +#-- purge: Remove files specified by PURGE_TARGETS +#-- debug: Add debugging flags as specified in DEBUG_* variables +#-- lto: Add compile flags for building with link time optimization +# +OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug !lto) + +#-- File integrity checks to use. Valid: md5, sha1, sha224, sha256, sha384, sha512, b2 +INTEGRITY_CHECK=(sha256) +#-- Options to be used when stripping binaries. See `man strip' for details. +STRIP_BINARIES="--strip-all" +#-- Options to be used when stripping shared libraries. See `man strip' for details. +STRIP_SHARED="--strip-unneeded" +#-- Options to be used when stripping static libraries. See `man strip' for details. +STRIP_STATIC="--strip-debug" +#-- Manual (man and info) directories to compress (if zipman is specified) +MAN_DIRS=({usr{,/local}{,/share},opt/*}/{man,info}) +#-- Doc directories to remove (if !docs is specified) +DOC_DIRS=(usr/{,local/}{,share/}{doc,gtk-doc} opt/*/{doc,gtk-doc}) +#-- Files to be removed from all packages (if purge is specified) +PURGE_TARGETS=(usr/{,share}/info/dir .packlist *.pod) +#-- Directory to store source code in for debug packages +DBGSRCDIR="/usr/src/debug" + +######################################################################### +# PACKAGE OUTPUT +######################################################################### +# +# Default: put built package and cached source in build directory +# +#-- Destination: specify a fixed directory where all packages will be placed +#PKGDEST=/home/packages +#-- Source cache: specify a fixed directory where source files will be cached +#SRCDEST=/home/sources +#-- Source packages: specify a fixed directory where all src packages will be placed +#SRCPKGDEST=/home/srcpackages +#-- Log files: specify a fixed directory where all log files will be placed +#LOGDEST=/home/makepkglogs +#-- Packager: name/email of the person or organization building packages +#PACKAGER="John Doe " +#-- Specify a key to use for package signing +#GPGKEY="" + +######################################################################### +# COMPRESSION DEFAULTS +######################################################################### +# +COMPRESSGZ=(gzip -c -f -n) +COMPRESSBZ2=(bzip2 -c -f) +COMPRESSXZ=(xz -c -z -) +COMPRESSZST=(zstd -c -z -q -) +COMPRESSLRZ=(lrzip -q) +COMPRESSLZO=(lzop -q) +COMPRESSZ=(compress -c -f) +COMPRESSLZ4=(lz4 -q) +COMPRESSLZ=(lzip -c -f) + +######################################################################### +# EXTENSION DEFAULTS +######################################################################### +# +PKGEXT='.pkg.tar.zst' +SRCEXT='.src.tar.gz' + +######################################################################### +# OTHER +######################################################################### +# +#-- Command used to run pacman as root, instead of trying sudo and su +PACMAN_AUTH=(doas) diff --git a/.rootmkinitcpio.conf/mkinitcpio.conf b/.rootmkinitcpio.conf/mkinitcpio.conf new file mode 100644 index 0000000..ae717a2 --- /dev/null +++ b/.rootmkinitcpio.conf/mkinitcpio.conf @@ -0,0 +1,4 @@ +MODULES=(vfio_pci vfio_iommu_type1 vfio) +BINARIES=() +FILES=() +HOOKS=(base udev autodetect modconf kms keyboard keymap block tpm2 encrypt filesystems fsck) diff --git a/.rootparu.conf/paru.conf b/.rootparu.conf/paru.conf new file mode 100644 index 0000000..42be879 --- /dev/null +++ b/.rootparu.conf/paru.conf @@ -0,0 +1,39 @@ +# +# $PARU_CONF +# /etc/paru.conf +# ~/.config/paru/paru.conf +# +# See the paru.conf(5) manpage for options + +# +# GENERAL OPTIONS +# +[options] +PgpFetch +Devel +Provides +DevelSuffixes = -git -cvs -svn -bzr -darcs -always -hg -fossil +#AurOnly +#BottomUp +#RemoveMake +#SudoLoop +#UseAsk +#SaveChanges +#CombinedUpgrade +#CleanAfter +#UpgradeMenu +#NewsOnUpgrade + +#LocalRepo +#Chroot +#Sign +#SignDb +#KeepRepoCache + +# +# Binary OPTIONS +# +[bin] +#FileManager = vifm +#MFlags = --skippgpcheck +Sudo = doas diff --git a/packages b/packages index ce30b2d..999a525 100644 --- a/packages +++ b/packages @@ -96,10 +96,12 @@ nmap nodejs noto-fonts-cjk npm +nvme-cli octave openal opendoas openldap +openresolv p7zip pacman-contrib pavucontrol @@ -125,6 +127,7 @@ sbctl sbsigntools sl slurp +smartmontools sof-firmware sshfs starship