webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
4c19f2158e3eef81e4ea9d4597bb6aded1fe4823
bpfire/lfs/cdrom
Peter Müller 9a7e4d8506 Switch checksums from MD5 to BLAKE2 
Historically, the MD5 checksums in our LFS files serve as a protection
against broken downloads, or accidentally corrupted source files.

While the sources are nowadays downloaded via HTTPS, it make sense to
beef up integrity protection for them, since transparently intercepting
TLS is believed to be feasible for more powerful actors, and the state
of the public PKI ecosystem is clearly not helping.

Therefore, this patch switches from MD5 to BLAKE2, updating all LFS
files as well as make.sh to deal with this checksum algorithm. BLAKE2 is
notably faster (and more secure) than SHA2, so the performance penalty
introduced by this patch is negligible, if noticeable at all.

In preparation of this patch, the toolchain files currently used have
been supplied with BLAKE2 checksums as well on
https://source.ipfire.org/.

Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremeripfire.org>
2022-04-02 14:19:25 +00:00

255 lines
7.7 KiB
Plaintext
Raw Blame History

###############################################################################
# #
# IPFire.org - A linux based firewall #
# Copyright (C) 2007-2021 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
# the Free Software Foundation, either version 3 of the License, or #
# (at your option) any later version. #
# #
# This program is distributed in the hope that it will be useful, #
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
# GNU General Public License for more details. #
# #
# You should have received a copy of the GNU General Public License #
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
# #
###############################################################################
###############################################################################
# Definitions
###############################################################################
include Config
VER = ipfire
THISAPP = cdrom
TARGET = $(DIR_INFO)/$(THISAPP)
# Fail when there is an error in the tar pipe
SHELL=/bin/bash -o pipefail
HAS_MEMTEST = 0
HAS_IPXE = 0
HAS_ISOLINUX = 0
HAS_KERNEL = 1
ifeq "$(BUILD_PLATFORM)" "x86"
HAS_MEMTEST = 1
HAS_IPXE = 1
HAS_ISOLINUX = 1
endif
ifeq "$(BUILD_ARCH)" "armv6l"
HAS_KERNEL = 0
endif
ISO_ARGS = -J -r -v \
-A "$(NAME) $(VERSION) $(BUILD_ARCH)" \
-V "$(NAME) $(VERSION) $(BUILD_ARCH)"
ISOHYBRID_ARGS =
ifeq "$(HAS_ISOLINUX)" "1"
ISO_ARGS += \
-no-emul-boot \
-boot-load-size 4 \
-boot-info-table \
-b boot/isolinux/isolinux.bin \
-c boot/isolinux/boot.catalog
endif
ifeq "$(EFI)" "1"
ISO_ARGS += \
-eltorito-alt-boot \
-e boot/isolinux/efiboot.img \
-no-emul-boot
ISOHYBRID_ARGS += --uefi
endif
GRUB_EFI_MODULES = \
all_video \
at_keyboard \
boot \
bitmap_scale \
cat \
chain \
configfile \
disk \
echo \
efi_gop \
efi_uga \
ext2 \
extcmd \
fat \
file \
font \
fxterm_menu \
gfxterm \
gfxmenu \
gfxterm_background \
gzio \
halt \
help \
iso9660 \
jpeg \
loadbios \
loadenv \
loopback \
linux \
ls \
memdisk \
minicmd \
nativedisk \
normal \
ntfs \
part_gpt \
part_msdos \
png \
probe \
reboot \
regexp \
search \
search_fs_file \
search_fs_uuid \
search_label \
tar \
test \
tga \
true \
usb_keyboard
###############################################################################
# Top-level Rules
###############################################################################
install : $(TARGET)
check :
download :
b2 :
###############################################################################
# Installation Details
###############################################################################
$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
# Update /etc/system-release, because the string might have changed
# since stage2 has been executed..
echo "$(SYSTEM_RELEASE)" > /etc/system-release
# Create a directory to authorise the CDROM in
rm -rf $(DIR_TMP)/cdrom && mkdir -p $(DIR_TMP)/cdrom
# Clear mtab (prevents .journal problems)
rm -vf /etc/mtab
echo > /etc/mtab
# Create filelist for packaging.
BUILDTARGET="$(BUILDTARGET)" BUILD_ARCH="$(BUILD_ARCH)" KVER="$(KVER)" \
$(DIR_SRC)/src/scripts/archive.files \
$(DIR_SRC)/config/rootfiles/common \
> $(DIR_TMP)/ROOTFILES
# Compress root filesystem
# Reason for this tar+untar+tar is removing of entries listed two or more in src/ROOTFILES
rm -rf $(DIR_TMP)/root && mkdir -p $(DIR_TMP)/root
tar $(TAR_OPTIONS) -c --exclude='#*' --exclude='proc/*' --exclude='dev/pts/*' --exclude='tmp/*' \
--exclude='__pycache__' \
-C / --files-from=$(DIR_TMP)/ROOTFILES | tar $(TAR_OPTIONS) -x -C $(DIR_TMP)/root
rm -f $(DIR_TMP)/ROOTFILES
mkdir $(DIR_TMP)/root/sys
cd $(DIR_TMP)/root && tar $(TAR_OPTIONS) -cf - * | zstd $(ZSTD_OPTIONS) > $(DIR_TMP)/cdrom/distro.img
rm -rf $(DIR_TMP)/root
# Other files
touch $(DIR_TMP)/cdrom/$(SNAME)-$(VERSION)-core$(CORE).media
sed 's/VERSION/$(VERSION)/' $(DIR_SRC)/config/cdrom/README.txt > $(DIR_TMP)/cdrom/README.txt
cp $(DIR_SRC)/doc/COPYING $(DIR_TMP)/cdrom/
# Install documentation
-mkdir -pv $(DIR_TMP)/cdrom/doc
cp $(DIR_SRC)/doc/{ChangeLog,packages-list.txt} $(DIR_TMP)/cdrom/doc
mkdir -p $(DIR_TMP)/cdrom/boot/isolinux
ifeq "$(HAS_KERNEL)" "1"
cp /boot/vmlinuz-$(KVER)-ipfire $(DIR_TMP)/cdrom/boot/isolinux/vmlinuz
dracut --force -a "installer" --strip $(DIR_TMP)/cdrom/boot/isolinux/instroot $(KVER)-ipfire
endif
ifeq "$(HAS_ISOLINUX)" "1"
dd if=/dev/zero bs=1k count=2 > $(DIR_TMP)/cdrom/boot/isolinux/boot.catalog
cp $(DIR_SRC)/config/syslinux/boot.png $(DIR_TMP)/cdrom/boot/isolinux/boot.png
cp /usr/share/syslinux/isolinux.bin $(DIR_TMP)/cdrom/boot/isolinux/isolinux.bin
cp /usr/share/hwdata/pci.ids $(DIR_TMP)/cdrom/boot/isolinux/pci.ids
cp -vf /usr/share/syslinux/*.c32 $(DIR_TMP)/cdrom/boot/isolinux/
sed -e "s/VERSION/$(VERSION) - Core $(CORE)/g" \
$(DIR_SRC)/config/syslinux/syslinux.cfg \
> $(DIR_TMP)/cdrom/boot/isolinux/isolinux.cfg
endif
ifeq "$(HAS_MEMTEST)" "1"
# Install memtest
cp /usr/lib/memtest86+/memtest.bin $(DIR_TMP)/cdrom/boot/isolinux/memtest
endif
ifeq "$(HAS_IPXE)" "1"
cp /usr/share/ipfire-netboot/ipxe.lkrn $(DIR_TMP)/cdrom/boot/isolinux/netboot
endif
ifeq "$(EFI)" "1"
# Generate embedded GRUB configuration
sed -e "s/NAME/$(NAME)/g" -e "s/VERSION/$(VERSION)/g" -e "s/ARCH/$(BUILD_ARCH)/g" \
$(DIR_SRC)/config/cdrom/grub-efi.cfg > /tmp/grub-efi.cfg
# Build a GRUB EFI image
mkdir -pv $(DIR_TMP)/cdrom/EFI/BOOT
grub-mkimage \
--format=$(GRUB_ARCH)-efi \
--output=$(DIR_TMP)/cdrom/EFI/BOOT/boot$(EFI_ARCH).efi \
--config=$(DIR_TMP)/grub-efi.cfg \
--compression=xz \
--prefix=/EFI/BOOT \
$$(for mod in $(GRUB_EFI_MODULES); do [ -f "/usr/lib/grub/$(GRUB_ARCH)-efi/$${mod}.mod" ] && echo "$${mod}"; done)
# Install GRUB configuration
mkdir -pv $(DIR_TMP)/cdrom/EFI/BOOT
sed -e "s/NAME/$(NAME)/g" -e "s/VERSION/$(VERSION)/g" -e "s/ARCH/$(BUILD_ARCH)/g" \
< $(DIR_SRC)/config/cdrom/grub.cfg > $(DIR_TMP)/cdrom/EFI/BOOT/grub.cfg
# Create the EFI Eltorito image
dd if=/dev/zero of=$(DIR_TMP)/cdrom/boot/isolinux/efiboot.img bs=1k count=1440
mkdosfs -F 12 -n "IPFIRE_EFI" $(DIR_TMP)/cdrom/boot/isolinux/efiboot.img
# Mount the EFI image
mkdir -pv $(DIR_TMP)/efiboot.img
mount -o loop $(DIR_TMP)/cdrom/boot/isolinux/efiboot.img $(DIR_TMP)/efiboot.img
# Copy the bootloader into the image
mkdir -p $(DIR_TMP)/efiboot.img/EFI/BOOT
cp -a $(DIR_TMP)/cdrom/EFI/BOOT/boot$(EFI_ARCH).efi \
$(DIR_TMP)/efiboot.img/EFI/BOOT/boot$(EFI_ARCH).efi
# Cleanup
umount $(DIR_TMP)/efiboot.img
rm -rf $(DIR_TMP)/efiboot.img $(DIR_TMP)/grub-efi.cfg
endif
cd $(DIR_TMP)/cdrom && find -type f ! -name md5sum.txt | grep -v "./boot" | \
xargs md5sum > md5sum.txt
mkdir -p /install/images
cd $(DIR_TMP)/cdrom && mkisofs $(ISO_ARGS) \
-o /install/images/$(SNAME)-$(VERSION).$(BUILD_ARCH)-full-core$(CORE).iso .
ifeq "$(HAS_ISOLINUX)" "1"
isohybrid $(ISOHYBRID_ARGS) /install/images/$(SNAME)-$(VERSION).$(BUILD_ARCH)-full-core$(CORE).iso
endif
Reference in New Issue View Git Blame Copy Permalink