[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: creating Hurd chroots on Linux using DPKG_ROOT chrootless mode



Hi,

Quoting Johannes Schauer Marin Rodrigues (2024-07-15 11:38:37)
> Quoting Johannes Schauer Marin Rodrigues (2024-05-21 11:50:25)
> > In any case, things go much further now. The next problem is some missing
> > DPKG_ROOT support in the hurd maintainer script. I opened a merge request
> > here:
> > 
> > https://salsa.debian.org/hurd-team/hurd/-/merge_requests/1
> 
> thank you for uploading a new version of the hurd package including these
> DPKG_ROOT changes! I just confirmed that these indeed do work as intended and
> it is now possible to create minimal hurd tarballs containing kernel and
> sysvinit using chrootless mode on linux like this:

Theodore Ts'o just put this into e2fsprogs main:

https://github.com/tytso/e2fsprogs/commit/6ba18ef7bf4bec1f2fd738d52a42181baa6bafbf

And it already landed in unstable:

https://tracker.debian.org/news/1589306/accepted-e2fsprogs-1472rc1-1-all-amd64-source-into-unstable/

So now I can create bootable ext2 hurd-i386 disk images on my arm64 Linux box.
I get a terminal in qemu:

    INIT: Entering runlevel: 2
    Using makefile-style concurrent boot in runlevel 2.
    Debian GNU/Hurd trixie/sid reform console
    login: root
    The programs included with the Debian GNU/Hurd system are free software;
    the exact distribution terms for each program are described in the
    individual files in /usr/share/doc/*/copyright.
    Debian GNU/Hurd comes with ABSOLUTELY NO WARRANTY, to the extent
    permitted by applicable law.
    root@reform:~# 

To reproduce the above, you need to run two commands. The first creates the
disk image using mmdebstrap and the second runs the VM using qemu (broken into
multiple lines for readability):

    mmdebstrap --variant=apt \
        --include=passwd,debian-ports-archive-keyring,mmdebstrap,sysvinit-core,sysv-rc,e2fsprogs,libarchive13 \
        --customize-hook='chroot "$1"
            mmdebstrap --mode=chrootless --arch=hurd-i386
            --include=sysvinit-core,sysv-rc,debian-ports-archive-keyring,gnumach-image-1-486
            --customize-hook="passwd --root=\"\$1\" --delete root"
            --customize-hook="copy-out /boot/gnumach-1.8-486-up.gz /hurd/exec.static /hurd/ext2fs.static /tmp"
            --variant=apt unstable -
            "deb http://ftp.ports.debian.org/debian-ports/ unstable main"
            "deb http://ftp.ports.debian.org/debian-ports/ unreleased main"
            | chroot "$1" /sbin/mkfs.ext2 -q -F -o hurd -I 128 -b 4096 -d - /tmp/hurd.ext2 204800' \
        --customize-hook='copy-out /tmp/hurd.ext2 /tmp/gnumach-1.8-486-up.gz /tmp/exec.static /tmp/ext2fs.static .'
        unstable /dev/null

    qemu-system-i386 -nographic -net user,hostfwd=tcp:127.0.0.1:2222-:22 -net nic,model=e1000 -m 1G
        -kernel gnumach-1.8-486-up -append 'root=device:hd0 console=com0'
        --initrd './ext2fs.static --multiboot-command-line=${kernel-command-line}
            --host-priv-port=${host-port} --device-master-port=${device-port}
            --exec-server-task=${exec-task} -T typed ${root} $(task-create) $(task-resume),./exec.static $(exec-task=task-create)' \
        -drive file=hurd.ext2,format=raw

I think this is pretty cool. A bootable GNU/Hurd disk image created on Linux
from first principles, straight from the ports.d.o apt mirrors without going
through d-i or downloading disk images and thus everything that we built is
verified using GPG (via debian-ports-archive-keyring). No superuser privileges
required. Works when running from Debian stable.

The only wrinkle is, that the result is not yet bit-by-bit reproducible when
having SOURCE_DATE_EPOCH and a uuid and hash_seed set... I'll investigate that.

Do you think this milestone deserves some wider attention? Otherwise I'll just
write something up in my silly blog.

I also plan to add this to the dpkg-root-demo salsa CI pipeline to make sure
that this setup keeps working going forward.

What do you think?

Thank you so much for all your help!

cheers, josch

Attachment: signature.asc
Description: signature


Reply to: