7284b4ec0b
BOOT=efi only changed the GRUB inside the rootfs squashfs — grub-mkrescue
builds the ISO bootloader from the build host's GRUB, so an ISO assembled
on a host without the x86_64-efi modules + mtools shipped with NO UEFI
boot entry. Booting that ISO on a UEFI machine showed:
"make sure there is a bootable uefi x64 image"
- check-host-deps.sh now verifies the GRUB module dirs it needs for a
hybrid ISO (/usr/lib/grub/x86_64-efi from grub-efi-amd64-bin,
/usr/lib/grub/i386-pc from grub-pc-bin) and mtools, not just
grub-mkrescue.
- build-iso.sh verifies the finished ISO has both EFI and BIOS boot
entries (xorriso El Torito report) and prints the result; BOOT=efi
builds FAIL if the EFI entry is missing.
- GitLab CI build image gains grub-pc-bin, grub-efi-amd64-bin, mtools.
- docs/building.md: hybrid-ISO burning instructions (dd) and the
"bootable uefi x64 image" troubleshooting path.
119 lines
6.2 KiB
Bash
Executable File
119 lines
6.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Arcline OS — live ISO builder
|
|
#
|
|
# scripts/build-iso.sh <edition>
|
|
#
|
|
# Wraps a rootfs into a hybrid (BIOS+UEFI) live ISO:
|
|
# 1. ensure the rootfs exists (build it with live-boot support if needed)
|
|
# 2. stage kernel + initramfs + squashfs in isofiles/live
|
|
# 3. write the grub boot config (live-boot: boot=live)
|
|
# 4. grub-mkrescue → build/artifacts/arcline-<edition>-<version>-<arch>.iso
|
|
#
|
|
# Requires root for the rootfs stage; the ISO assembly itself runs unprivileged.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
set -euo pipefail
|
|
source "$(dirname "${BASH_SOURCE[0]}")/common.sh"
|
|
|
|
EDITION="${1:?usage: build-iso.sh <edition>}"
|
|
validate_edition "$EDITION"
|
|
|
|
ROOTFS="$ROOTFS_DIR/$EDITION"
|
|
ISOFILES="$IMAGE_DIR/$EDITION/isofiles"
|
|
ARTIFACT="$ARTIFACT_DIR/arcline-$EDITION-$VERSION-$ARCH.iso"
|
|
|
|
# ── 1. rootfs ───────────────────────────────────────────────────────────────
|
|
if [[ ! -d "$ROOTFS" ]]; then
|
|
log "rootfs missing — building with live-boot support"
|
|
ARCLINE_LIVE=1 "$ROOT/scripts/build-rootfs.sh" "$EDITION"
|
|
fi
|
|
|
|
# live-boot must be present in the rootfs for the ISO to boot
|
|
if [[ ! -d "$ROOTFS/lib/live" && ! -d "$ROOTFS/usr/lib/live" ]]; then
|
|
warn "rootfs has no live-boot support; rebuilding with ARCLINE_LIVE=1"
|
|
ARCLINE_LIVE=1 "$ROOT/scripts/build-rootfs.sh" "$EDITION"
|
|
fi
|
|
|
|
# ── 2. stage files ──────────────────────────────────────────────────────────
|
|
log "staging ISO files for edition '$EDITION'"
|
|
rm -rf "$ISOFILES"
|
|
mkdir -p "$ISOFILES/live" "$ISOFILES/boot/grub"
|
|
|
|
KERNEL="$(find "$ROOTFS/boot" -maxdepth 1 -name 'vmlinuz-*' | sort -V | tail -1)"
|
|
INITRD="$(find "$ROOTFS/boot" -maxdepth 1 -name 'initrd.img-*' | sort -V | tail -1)"
|
|
[[ -n "$KERNEL" && -n "$INITRD" ]] || die "kernel or initramfs not found in rootfs"
|
|
cp -L "$KERNEL" "$ISOFILES/live/vmlinuz"
|
|
cp -L "$INITRD" "$ISOFILES/live/initrd.img"
|
|
|
|
# ── 2b. secure boot (optional: ARCLINE_SIGN=1 + a MOK keypair) ──────────────
|
|
if [[ "${ARCLINE_SIGN:-0}" == "1" ]]; then
|
|
log "secure boot: signing boot chain and shipping MOK in the live image"
|
|
[[ -f "$BUILD_DIR/keys/MOK.der" ]] || die "ARCLINE_SIGN=1 but no MOK keypair — run: scripts/secureboot/gen-keys.sh"
|
|
mkdir -p "$ROOTFS/etc/arcline"
|
|
cp "$BUILD_DIR/keys/MOK.der" "$ROOTFS/etc/arcline/MOK.der"
|
|
"$ROOT/scripts/secureboot/sign-image.sh" "$ROOTFS" --keydir "$BUILD_DIR/keys"
|
|
"$ROOT/scripts/secureboot/sign-image.sh" "$ISOFILES" --keydir "$BUILD_DIR/keys"
|
|
fi
|
|
|
|
log "compressing rootfs → squashfs (this takes a while)"
|
|
# The squashfs is the live root. Keep it complete — offline man pages and
|
|
# docs are a product promise (see the landing page), so nothing is excluded.
|
|
mksquashfs "$ROOTFS" "$ISOFILES/live/arcline.squashfs" -noappend -comp zstd -Xcompression-level 15 2>/dev/null || \
|
|
mksquashfs "$ROOTFS" "$ISOFILES/live/arcline.squashfs" -noappend -comp xz
|
|
|
|
# ── 3. grub boot config ─────────────────────────────────────────────────────
|
|
log "writing grub config"
|
|
KCMD="$(tr '\n' ' ' < "$(edition_dir "$EDITION")/kernel.cmdline" | sed 's/ */ /g')"
|
|
cat > "$ISOFILES/boot/grub/grub.cfg" <<EOF
|
|
set timeout=5
|
|
set default=0
|
|
|
|
menuentry "Arcline $EDITION ($VERSION)" {
|
|
linux /live/vmlinuz boot=live config quiet $KCMD
|
|
initrd /live/initrd.img
|
|
}
|
|
|
|
menuentry "Arcline $EDITION ($VERSION) — safe mode (no mitigations)" {
|
|
linux /live/vmlinuz boot=live config quiet nomodeset
|
|
initrd /live/initrd.img
|
|
}
|
|
EOF
|
|
|
|
# ── 4. assemble ─────────────────────────────────────────────────────────────
|
|
log "assembling ISO with grub-mkrescue"
|
|
command -v grub-mkrescue >/dev/null || die "grub-mkrescue not found (run scripts/check-host-deps.sh --install)"
|
|
mkdir -p "$ARTIFACT_DIR"
|
|
grub-mkrescue -o "$ARTIFACT" "$ISOFILES" -- \
|
|
-volume-label "ARCLINE_${EDITION^^}" 2>/dev/null || \
|
|
grub-mkrescue -o "$ARTIFACT" "$ISOFILES"
|
|
|
|
# ── 5. verify hybrid boot entries ───────────────────────────────────────────
|
|
# grub-mkrescue builds the ISO bootloader from the HOST's GRUB modules. If the
|
|
# host lacks the x86_64-efi modules or mtools, the ISO has no UEFI boot entry
|
|
# and UEFI firmware shows "make sure there is a bootable uefi x64 image".
|
|
# Check the finished ISO instead of trusting the host.
|
|
if command -v xorriso >/dev/null 2>&1; then
|
|
log "verifying ISO boot entries"
|
|
ET="$(xorriso -indev "$ARTIFACT" -report_el_torito cmd 2>/dev/null || true)"
|
|
|
|
HAS_EFI=0
|
|
echo "$ET" | grep -qiE 'boot_image efi|efi\.img|BOOTX64\.EFI' && HAS_EFI=1
|
|
if [[ $HAS_EFI -eq 0 ]]; then
|
|
# fallback: some xorriso versions name it differently — look in the fs
|
|
xorriso -indev "$ARTIFACT" -find / -name 'efi.img' 2>/dev/null | grep -qi 'efi\.img' && HAS_EFI=1
|
|
fi
|
|
|
|
HAS_BIOS=0
|
|
echo "$ET" | grep -qiE 'boot_image isolinux|boot_image grub' && HAS_BIOS=1
|
|
|
|
[[ $HAS_EFI -eq 1 ]] && log " ✓ EFI boot entry present" || warn " ISO has NO EFI boot entry (UEFI will refuse it)"
|
|
[[ $HAS_BIOS -eq 1 ]] && log " ✓ BIOS boot entry present" || warn " ISO has NO BIOS boot entry (legacy BIOS will refuse it)"
|
|
|
|
if [[ "$BOOT" == "efi" && $HAS_EFI -eq 0 ]]; then
|
|
die "BOOT=efi but the ISO has no EFI boot entry — install grub-efi-amd64-bin + mtools on the build host (scripts/check-host-deps.sh --install), then rebuild"
|
|
fi
|
|
fi
|
|
|
|
log "ISO artifact: $ARTIFACT"
|
|
sha256sum "$ARTIFACT" | tee "$ARTIFACT.sha256"
|