public
/
airgap
5
0
Fork 1
Code Issues 13 Pull Requests 1 Packages Projects Releases Wiki Activity

save progress

This commit is contained in:
Anton Livaja 2025-02-06 10:45:54 -05:00
parent 13bedb1e73
commit 47536ce88c
Signed by: anton
GPG Key ID: 44A86CFF1FDF0E85
2 changed files with 258 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

259
Containerfile
View File

@ -39,7 +39,7 @@ FROM stagex/opensc:sx2024.09.0@sha256:5117a9d39d3b77655b29bf661d9e04eea2001a5b03
FROM stagex/openssl:sx2024.09.0@sha256:2c1a9d8fcc6f52cb11a206f380b17d74c1079f04cbb08071a4176648b4df52c1 AS openssl
FROM stagex/pcsc-lite:sx2024.09.0@sha256:4fe37671197ac768637e95f7395ae1a18412b3f42359d0c0aa9f4e7f684aef4e AS pcsc-lite
FROM stagex/pcsc-tools:sx2024.09.0@sha256:05046ca5d41a09163eda26785563fd98f0cb1179030c3f4ee3243997a907bb96 AS pcsc-tools
FROM stagex/qemu:sx2024.09.0@sha256:c9b099bc7d810a581e0e0f68061dd525d7efdb5334d119b4253249a459bd907e AS qemu
# FROM stagex/qemu:sx2024.09.0@sha256:c9b099bc7d810a581e0e0f68061dd525d7efdb5334d119b4253249a459bd907e AS qemu
FROM stagex/seabios:sx2024.09.0@sha256:f4e535fb1bfc2c7ae1756cdaa2404b1572f6ad195ceabba90d87ed0599fd97d7 AS seabios
FROM stagex/sops:sx2024.09.0@sha256:c742fb1f0c5a4f9d9bc9afc37ba686b247d2b17d55d179409d33736b43c9aaa5 AS sops
FROM stagex/swtpm:sx2024.09.0@sha256:c47fb2c4d8690936b4adef832a3f354231bb5a04206bf2fb565218034ce27792 AS swtpm
@ -52,6 +52,81 @@ FROM stagex/xz:sx2024.09.0@sha256:b57c5e6144117bc0124855e9538e60c302cc7bf53fafb5
FROM stagex/yq:sx2024.09.0@sha256:bd6882f0f3ea664e9de6cf732cef2fa2781fc2852f5e6502a6aea1e63eb9708b AS yq
FROM stagex/zlib:sx2024.09.0@sha256:96b4100550760026065dac57148d99e20a03d17e5ee20d6b32cbacd61125dbb6 AS zlib
FROM stagex/git as git
FROM stagex/ca-certificates as ca-certificates
FROM stagex/cmake as cmake
FROM stagex/make as make
FROM stagex/glibc as glibc
FROM stagex/gcc as gcc
FROM stagex/binutils as binutils
FROM stagex/gawk as gawk
FROM stagex/autoconf as autoconf
FROM stagex/automake as automake
## qemu
FROM stagex/busybox AS busybox
FROM stagex/bash AS bash
FROM stagex/gzip AS gzip
FROM stagex/gcc AS gcc
FROM stagex/binutils AS binutils
FROM stagex/python AS python
FROM stagex/py-packaging AS py-packaging
FROM stagex/py-urllib3 AS py-urllib3
FROM stagex/make AS make
FROM stagex/bison AS bison
FROM stagex/meson AS meson
FROM stagex/samurai AS samurai
FROM stagex/libtool AS libtool
FROM stagex/openssl AS opensll
FROM stagex/git AS git
FROM stagex/zlib AS zlib
FROM stagex/libffi AS libffi
FROM stagex/libzstd AS libzstd
FROM stagex/ncurses AS ncurses
FROM stagex/curl AS curl
FROM stagex/flex AS flex
FROM stagex/perl AS perl
FROM stagex/pcre2 AS pcre2
FROM stagex/autoconf AS autoconf
FROM stagex/automake AS automake
FROM stagex/pkgconf AS pkgconf
FROM stagex/gettext AS gettext
FROM stagex/m4 AS m4
FROM stagex/argp-standalone AS argp-standalone
FROM stagex/musl AS musl
FROM stagex/musl-fts AS musl-fts
FROM stagex/musl-obstack AS musl-obstack
FROM stagex/linux-headers AS linux-headers
FROM stagex/py-docutils AS py-docutils
FROM stagex/py-pygments AS py-pygments
FROM stagex/py-babel AS py-babel
FROM stagex/py-sphinx AS py-sphinx
FROM stagex/py-sphinx_rtd_theme AS py-sphinx_rtd_theme
FROM stagex/py-sphinxcontrib-applehelp AS py-sphinxcontrib-applehelp
FROM stagex/py-sphinxcontrib-devhelp AS py-sphinxcontrib-devhelp
FROM stagex/py-sphinxcontrib-htmlhelp AS py-sphinxcontrib-htmlhelp
FROM stagex/py-sphinxcontrib-qthelp AS py-sphinxcontrib-qthelp
FROM stagex/py-sphinxcontrib-serializinghtml AS py-sphinxcontrib-serializinghtml
FROM stagex/py-sphinxcontrib-jquery AS py-sphinxcontrib-jquery
FROM stagex/py-jinja2 AS py-jinja2
FROM stagex/py-markupsafe AS py-markupsafe
FROM stagex/py-snowballstemmer AS py-snowballstemmer
FROM stagex/py-imagesize AS py-imagesize
FROM stagex/py-requests AS py-requests
FROM stagex/py-idna AS py-idna
FROM stagex/py-certifi AS py-certifi
FROM stagex/py-alabaster AS py-alabaster
FROM stagex/libaio AS libaio
FROM stagex/libseccomp AS libseccomp
FROM stagex/libcap-ng AS libcap-ng
FROM stagex/libslirp AS libslirp
FROM stagex/alsa-lib AS alsa-lib
FROM stagex/openssh AS openssh
FROM stagex/glib AS glib
FROM stagex/lzo AS lzo
FROM stagex/dtc AS dtc
FROM stagex/numactl AS numactl
FROM scratch AS base
ARG VERSION development
ARG GIT_TIMESTAMP null
@ -81,7 +156,7 @@ COPY --from=libzstd . /
COPY --from=libslirp . /
COPY --from=seabios . /
COPY --from=ipxe . /
COPY --from=qemu . /
# COPY --from=qemu . /
COPY --from=swtpm . /
COPY --from=openssl . /
COPY --from=curl . /
@ -89,6 +164,186 @@ COPY --from=libtpms . /
COPY --from=tpm2-tss . /
COPY --from=tpm2-tools . /
## Deps for qemu-canokey
COPY --from=git . /
COPY --from=zlib . /
COPY --from=curl . /
COPY --from=ca-certificates . /
COPY --from=openssl . /
COPY --from=cmake . /
COPY --from=glibc . /
COPY --from=gcc . /
COPY --from=binutils . /
COPY --from=busybox . /
COPY --from=make . /
COPY --from=gawk . /
COPY --from=autoconf . /
COPY --from=automake . /
COPY --from=busybox . /
COPY --from=bash . /
## Build canokey-qemu
RUN git clone https://github.com/canokeys/canokey-qemu
RUN mkdir canokey-qemu/build
WORKDIR canokey-qemu/build
RUN git submodule update --init --recursive
RUN cmake .. && make && make install
## Deps for qemu
COPY --from=busybox . /
COPY --from=bash . /
COPY --from=gzip . /
COPY --from=gcc . /
COPY --from=binutils . /
COPY --from=python . /
COPY --from=py-packaging . /
COPY --from=py-urllib3 . /
COPY --from=make . /
COPY --from=bison . /
COPY --from=meson . /
COPY --from=samurai . /
COPY --from=libtool . /
COPY --from=openssl . /
COPY --from=git . /
COPY --from=zlib . /
COPY --from=libffi . /
COPY --from=libzstd . /
COPY --from=ncurses . /
COPY --from=curl . /
COPY --from=flex . /
COPY --from=perl . /
COPY --from=pcre2 . /
COPY --from=autoconf . /
COPY --from=automake . /
COPY --from=pkgconf . /
COPY --from=gettext . /
COPY --from=m4 . /
COPY --from=argp-standalone . /
COPY --from=musl . /
COPY --from=musl-fts . /
COPY --from=musl-obstack . /
COPY --from=linux-headers . /
COPY --from=py-docutils . /
COPY --from=py-pygments . /
COPY --from=py-babel . /
COPY --from=py-sphinx . /
COPY --from=py-sphinx_rtd_theme . /
COPY --from=py-sphinxcontrib-applehelp . /
COPY --from=py-sphinxcontrib-devhelp . /
COPY --from=py-sphinxcontrib-htmlhelp . /
COPY --from=py-sphinxcontrib-qthelp . /
COPY --from=py-sphinxcontrib-serializinghtml . /
COPY --from=py-sphinxcontrib-jquery . /
COPY --from=py-jinja2 . /
COPY --from=py-markupsafe . /
COPY --from=py-snowballstemmer . /
COPY --from=py-imagesize . /
COPY --from=py-requests . /
COPY --from=py-idna . /
COPY --from=py-certifi . /
COPY --from=py-alabaster . /
COPY --from=libaio . /
COPY --from=libseccomp . /
COPY --from=libcap-ng . /
COPY --from=libslirp . /
COPY --from=alsa-lib . /
COPY --from=openssh . /
COPY --from=glib . /
COPY --from=lzo . /
COPY --from=dtc . /
COPY --from=numactl . /
ADD https://download.qemu.org/qemu-9.1.0.tar.xz .
RUN tar -xvf qemu-9.1.0.tar.xz
WORKDIR qemu-9.1.0
RUN ls -la .
ENV SOURCE_DATE_EPOCH=1
ENV LDFLAGS=" \
-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro \
-Wl,-z,now -Wl,-z,pack-relative-relocs"
ENV CFLAGS=" \
-march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions \
-Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security \
-fstack-clash-protection -fcf-protection \
-fno-omit-frame-pointer -mno-omit-leaf-frame-pointer"
ENV CXXFLAGS="$CFLAGS -Wp,-D_GLIBCXX_ASSERTIONS"
ENV LTOFLAGS="-flto=auto"
ENV TARGET_LIST="x86_64-softmmu,x86_64-linux-user,i386-softmmu,i386-linux-user"
COPY <<-EOF pc-bios/optionrom/config.mak
TOPSRC_DIR=/qemu-9.1.0
CC=gcc
CCAS=gcc
AR=ar
AS=as
LD=ld
NM=nm
OBJCOPY=objcopy
RANLIB=ranlib
STRIP=strip
EOF
RUN export PKG_CONFIG_PATH=/pkgconf:$PKG_CONFIG_PATH
RUN <<-EOF
set -eux
# rm -rf pc-bios/*.bz2
rm -rf \
pc-bios/*.bin \
pc-bios/*.rom \
pc-bios/*.img \
pc-bios/*.e500 \
pc-bios/*.dtb \
pc-bios/*.lid \
pc-bios/*.ndrv \
pc-bios/palcode-clipper \
pc-bios/openbios-*
make -j "$(nproc)" -C pc-bios/optionrom all
./configure \
--target-list="$TARGET_LIST" \
--prefix=/usr \
--sysconfdir=/etc \
--localstatedir=/var \
--libexecdir=/usr/lib/qemu \
--docdir=/usr/share/doc/qemu \
--python=/usr/bin/python \
--cc=gcc \
--audio-drv-list=oss,alsa \
--enable-curses \
--enable-canokey \
--enable-modules \
--enable-tpm \
--enable-vhost-net \
--enable-attr \
--enable-linux-user \
--enable-slirp \
--enable-tcg \
--disable-install-blobs \
--disable-docs \
--disable-sdl \
--disable-gtk \
--disable-bpf \
--disable-capstone \
--disable-glusterfs \
--disable-debug-info \
--disable-opengl \
--disable-bsd-user \
--disable-werror \
--disable-libnfs \
--disable-libssh \
--disable-snappy \
--disable-spice \
--disable-usb-redir \
--disable-vde \
--disable-virglrenderer \
--disable-virtfs \
--disable-vnc \
--disable-vnc-jpeg \
--disable-xen
make ARFLAGS="rc" -j "$(nproc)"
make install
rm -rf /rootfs/var/run
strip /rootfs/usr/bin/qemu-*
install -vDm 644 pc-bios/optionrom/*.bin -t /rootfs/usr/share/qemu
install -vDm 644 pc-bios/optionrom/*.img -t /rootfs/usr/share/qemu
EOF
FROM base AS build
## Kernel

1
Makefile
View File

@ -61,6 +61,7 @@ vm: out/dev-shell.digest out/airgap.iso out/sdcard.img
-tpmdev emulator,id=tpm0,chardev=chrtpm \
-device tpm-tis,tpmdev=tpm0 \
-usb \
-device canokey,file=~/.canokey-file \
-device sdhci-pci \
-device sd-card,drive=external \
-drive id=external,if=none,format=raw,file=out/sdcard.img \