save progress

Containerfile

@@ -39,7 +39,7 @@ FROM stagex/opensc:sx2024.09.0@sha256:5117a9d39d3b77655b29bf661d9e04eea2001a5b03
 FROM stagex/openssl:sx2024.09.0@sha256:2c1a9d8fcc6f52cb11a206f380b17d74c1079f04cbb08071a4176648b4df52c1 AS openssl
 FROM stagex/pcsc-lite:sx2024.09.0@sha256:4fe37671197ac768637e95f7395ae1a18412b3f42359d0c0aa9f4e7f684aef4e AS pcsc-lite
 FROM stagex/pcsc-tools:sx2024.09.0@sha256:05046ca5d41a09163eda26785563fd98f0cb1179030c3f4ee3243997a907bb96 AS pcsc-tools
-FROM stagex/qemu:sx2024.09.0@sha256:c9b099bc7d810a581e0e0f68061dd525d7efdb5334d119b4253249a459bd907e AS qemu
+# FROM stagex/qemu:sx2024.09.0@sha256:c9b099bc7d810a581e0e0f68061dd525d7efdb5334d119b4253249a459bd907e AS qemu
 FROM stagex/seabios:sx2024.09.0@sha256:f4e535fb1bfc2c7ae1756cdaa2404b1572f6ad195ceabba90d87ed0599fd97d7 AS seabios
 FROM stagex/sops:sx2024.09.0@sha256:c742fb1f0c5a4f9d9bc9afc37ba686b247d2b17d55d179409d33736b43c9aaa5 AS sops
 FROM stagex/swtpm:sx2024.09.0@sha256:c47fb2c4d8690936b4adef832a3f354231bb5a04206bf2fb565218034ce27792 AS swtpm
@@ -52,6 +52,81 @@ FROM stagex/xz:sx2024.09.0@sha256:b57c5e6144117bc0124855e9538e60c302cc7bf53fafb5
 FROM stagex/yq:sx2024.09.0@sha256:bd6882f0f3ea664e9de6cf732cef2fa2781fc2852f5e6502a6aea1e63eb9708b AS yq
 FROM stagex/zlib:sx2024.09.0@sha256:96b4100550760026065dac57148d99e20a03d17e5ee20d6b32cbacd61125dbb6 AS zlib
 
+FROM stagex/git as git
+FROM stagex/ca-certificates as ca-certificates
+FROM stagex/cmake as cmake
+FROM stagex/make as make
+FROM stagex/glibc as glibc
+FROM stagex/gcc as gcc
+FROM stagex/binutils as binutils
+FROM stagex/gawk as gawk
+FROM stagex/autoconf as autoconf
+FROM stagex/automake as automake
+
+## qemu
+FROM stagex/busybox AS busybox
+FROM stagex/bash AS bash
+FROM stagex/gzip AS gzip
+FROM stagex/gcc AS gcc
+FROM stagex/binutils AS binutils 
+FROM stagex/python AS python 
+FROM stagex/py-packaging AS py-packaging
+FROM stagex/py-urllib3 AS py-urllib3
+FROM stagex/make AS make
+FROM stagex/bison AS bison
+FROM stagex/meson AS meson
+FROM stagex/samurai AS samurai
+FROM stagex/libtool AS libtool
+FROM stagex/openssl AS opensll
+FROM stagex/git AS git
+FROM stagex/zlib AS zlib
+FROM stagex/libffi AS libffi
+FROM stagex/libzstd AS libzstd
+FROM stagex/ncurses AS ncurses
+FROM stagex/curl AS curl
+FROM stagex/flex AS flex
+FROM stagex/perl AS perl
+FROM stagex/pcre2 AS pcre2
+FROM stagex/autoconf AS autoconf
+FROM stagex/automake AS automake
+FROM stagex/pkgconf AS pkgconf
+FROM stagex/gettext AS gettext
+FROM stagex/m4 AS m4
+FROM stagex/argp-standalone AS argp-standalone
+FROM stagex/musl AS musl
+FROM stagex/musl-fts AS musl-fts
+FROM stagex/musl-obstack AS musl-obstack
+FROM stagex/linux-headers AS linux-headers
+FROM stagex/py-docutils AS py-docutils
+FROM stagex/py-pygments AS py-pygments
+FROM stagex/py-babel AS py-babel
+FROM stagex/py-sphinx AS py-sphinx
+FROM stagex/py-sphinx_rtd_theme AS py-sphinx_rtd_theme
+FROM stagex/py-sphinxcontrib-applehelp AS py-sphinxcontrib-applehelp
+FROM stagex/py-sphinxcontrib-devhelp AS py-sphinxcontrib-devhelp
+FROM stagex/py-sphinxcontrib-htmlhelp AS py-sphinxcontrib-htmlhelp
+FROM stagex/py-sphinxcontrib-qthelp AS py-sphinxcontrib-qthelp
+FROM stagex/py-sphinxcontrib-serializinghtml AS py-sphinxcontrib-serializinghtml
+FROM stagex/py-sphinxcontrib-jquery AS py-sphinxcontrib-jquery
+FROM stagex/py-jinja2 AS py-jinja2
+FROM stagex/py-markupsafe AS py-markupsafe
+FROM stagex/py-snowballstemmer AS py-snowballstemmer
+FROM stagex/py-imagesize AS py-imagesize
+FROM stagex/py-requests AS py-requests
+FROM stagex/py-idna AS py-idna
+FROM stagex/py-certifi AS py-certifi
+FROM stagex/py-alabaster AS py-alabaster
+FROM stagex/libaio AS libaio
+FROM stagex/libseccomp AS libseccomp
+FROM stagex/libcap-ng AS libcap-ng
+FROM stagex/libslirp AS libslirp
+FROM stagex/alsa-lib AS alsa-lib
+FROM stagex/openssh AS openssh
+FROM stagex/glib AS glib
+FROM stagex/lzo AS lzo
+FROM stagex/dtc AS dtc
+FROM stagex/numactl AS numactl
+
 FROM scratch AS base
 ARG VERSION development
 ARG GIT_TIMESTAMP null
@@ -81,7 +156,7 @@ COPY --from=libzstd . /
 COPY --from=libslirp . /
 COPY --from=seabios . /
 COPY --from=ipxe . /
-COPY --from=qemu . /
+# COPY --from=qemu . /
 COPY --from=swtpm . /
 COPY --from=openssl . /
 COPY --from=curl . /
@@ -89,6 +164,186 @@ COPY --from=libtpms . /
 COPY --from=tpm2-tss . /
 COPY --from=tpm2-tools . /
 
+## Deps for qemu-canokey
+COPY --from=git . /
+COPY --from=zlib . /
+COPY --from=curl . /
+COPY --from=ca-certificates . /
+COPY --from=openssl . /
+COPY --from=cmake . /
+COPY --from=glibc . /
+COPY --from=gcc . /
+COPY --from=binutils . /
+COPY --from=busybox . /
+COPY --from=make . / 
+COPY --from=gawk . /
+COPY --from=autoconf . /
+COPY --from=automake . /
+COPY --from=busybox . /
+COPY --from=bash . /
+
+## Build canokey-qemu
+RUN git clone https://github.com/canokeys/canokey-qemu
+RUN mkdir canokey-qemu/build
+WORKDIR canokey-qemu/build
+RUN git submodule update --init --recursive
+RUN cmake .. && make && make install
+
+## Deps for qemu
+COPY --from=busybox . /
+COPY --from=bash . /
+COPY --from=gzip . /
+COPY --from=gcc . /
+COPY --from=binutils . /
+COPY --from=python . /
+COPY --from=py-packaging . /
+COPY --from=py-urllib3 . /
+COPY --from=make . /
+COPY --from=bison . /
+COPY --from=meson . /
+COPY --from=samurai . /
+COPY --from=libtool . /
+COPY --from=openssl . /
+COPY --from=git . /
+COPY --from=zlib . /
+COPY --from=libffi . /
+COPY --from=libzstd . /
+COPY --from=ncurses . /
+COPY --from=curl . /
+COPY --from=flex . /
+COPY --from=perl . /
+COPY --from=pcre2 . /
+COPY --from=autoconf . /
+COPY --from=automake . /
+COPY --from=pkgconf . /
+COPY --from=gettext . /
+COPY --from=m4 . /
+COPY --from=argp-standalone . /
+COPY --from=musl . /
+COPY --from=musl-fts . /
+COPY --from=musl-obstack . /
+COPY --from=linux-headers . /
+COPY --from=py-docutils . /
+COPY --from=py-pygments . /
+COPY --from=py-babel . /
+COPY --from=py-sphinx . /
+COPY --from=py-sphinx_rtd_theme . /
+COPY --from=py-sphinxcontrib-applehelp . /
+COPY --from=py-sphinxcontrib-devhelp . /
+COPY --from=py-sphinxcontrib-htmlhelp . /
+COPY --from=py-sphinxcontrib-qthelp . /
+COPY --from=py-sphinxcontrib-serializinghtml . /
+COPY --from=py-sphinxcontrib-jquery . /
+COPY --from=py-jinja2 . /
+COPY --from=py-markupsafe . /
+COPY --from=py-snowballstemmer . /
+COPY --from=py-imagesize . /
+COPY --from=py-requests . /
+COPY --from=py-idna . /
+COPY --from=py-certifi . /
+COPY --from=py-alabaster . /
+COPY --from=libaio . /
+COPY --from=libseccomp . /
+COPY --from=libcap-ng . /
+COPY --from=libslirp . /
+COPY --from=alsa-lib . /
+COPY --from=openssh . /
+COPY --from=glib . /
+COPY --from=lzo . /
+COPY --from=dtc . /
+COPY --from=numactl . /
+ADD https://download.qemu.org/qemu-9.1.0.tar.xz .
+RUN tar -xvf qemu-9.1.0.tar.xz
+WORKDIR qemu-9.1.0
+RUN ls -la .
+ENV SOURCE_DATE_EPOCH=1
+ENV LDFLAGS=" \
+		-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro \
+		-Wl,-z,now -Wl,-z,pack-relative-relocs"
+ENV CFLAGS=" \
+		-march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions \
+		-Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security \
+		-fstack-clash-protection -fcf-protection \
+		-fno-omit-frame-pointer -mno-omit-leaf-frame-pointer"
+ENV CXXFLAGS="$CFLAGS -Wp,-D_GLIBCXX_ASSERTIONS"
+ENV LTOFLAGS="-flto=auto"
+ENV TARGET_LIST="x86_64-softmmu,x86_64-linux-user,i386-softmmu,i386-linux-user"
+COPY <<-EOF pc-bios/optionrom/config.mak
+		TOPSRC_DIR=/qemu-9.1.0
+		CC=gcc
+		CCAS=gcc
+		AR=ar
+		AS=as
+		LD=ld
+		NM=nm
+		OBJCOPY=objcopy
+		RANLIB=ranlib
+		STRIP=strip
+EOF
+RUN export PKG_CONFIG_PATH=/pkgconf:$PKG_CONFIG_PATH 
+RUN <<-EOF
+    set -eux
+	# rm -rf pc-bios/*.bz2
+	rm -rf \
+		pc-bios/*.bin \
+		pc-bios/*.rom \
+		pc-bios/*.img \
+		pc-bios/*.e500 \
+		pc-bios/*.dtb \
+		pc-bios/*.lid \
+		pc-bios/*.ndrv \
+		pc-bios/palcode-clipper \
+		pc-bios/openbios-*
+	make -j "$(nproc)" -C pc-bios/optionrom all
+	./configure \
+		--target-list="$TARGET_LIST" \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--localstatedir=/var \
+		--libexecdir=/usr/lib/qemu \
+		--docdir=/usr/share/doc/qemu \
+		--python=/usr/bin/python \
+		--cc=gcc \
+		--audio-drv-list=oss,alsa \
+		--enable-curses \
+        --enable-canokey \
+		--enable-modules \
+		--enable-tpm \
+		--enable-vhost-net \
+		--enable-attr \
+		--enable-linux-user \
+		--enable-slirp \
+		--enable-tcg \
+		--disable-install-blobs \
+		--disable-docs \
+		--disable-sdl \
+		--disable-gtk \
+		--disable-bpf \
+		--disable-capstone \
+		--disable-glusterfs \
+		--disable-debug-info \
+		--disable-opengl \
+		--disable-bsd-user \
+		--disable-werror \
+		--disable-libnfs \
+		--disable-libssh \
+		--disable-snappy \
+		--disable-spice \
+		--disable-usb-redir \
+		--disable-vde \
+		--disable-virglrenderer \
+		--disable-virtfs \
+		--disable-vnc \
+		--disable-vnc-jpeg \
+		--disable-xen
+	make ARFLAGS="rc" -j "$(nproc)"
+	make install
+	rm -rf /rootfs/var/run
+	strip /rootfs/usr/bin/qemu-*
+	install -vDm 644 pc-bios/optionrom/*.bin -t /rootfs/usr/share/qemu
+	install -vDm 644 pc-bios/optionrom/*.img -t /rootfs/usr/share/qemu
+EOF
+
 FROM base AS build
 
 ## Kernel

Makefile

@@ -61,6 +61,7 @@ vm: out/dev-shell.digest out/airgap.iso out/sdcard.img
 			-tpmdev emulator,id=tpm0,chardev=chrtpm \
 			-device tpm-tis,tpmdev=tpm0 \
 			-usb \
+			-device canokey,file=~/.canokey-file \
 			-device sdhci-pci \
 			-device sd-card,drive=external \
 			-drive id=external,if=none,format=raw,file=out/sdcard.img \