Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package rdi-installer for openSUSE:Factory checked in at 2026-10-28 17:49:37 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rdi-installer (Old) and /work/SRC/openSUSE:Factory/.rdi-installer.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rdi-installer" Wed Oct 28 17:49:37 2026 rev:5 rq:1393391 version:1.3.0 Changes: -------- --- /work/SRC/openSUSE:Factory/rdi-installer/rdi-installer.changes 2026-10-20 12:42:36.707260850 +0200 +++ /work/SRC/openSUSE:Factory/.rdi-installer.new.2252680/rdi-installer.changes 2026-10-28 17:49:47.490213630 +0100 @@ -1,0 +2,26 @@ +Wed Oct 28 11:13:53 UTC 2026 - Thorsten Kukuk <[email protected]> + +- Update to version 1.3.0: + * Release version 1.3.0 + * Provide rdii-pubkey-setup.service to import pubkeys into import-pubring.gpg + * CI: update actions/checkout + * First version of the Quick Guide with text + * README.md: fix typos + * Add "rdii.minsize=" option for minimal required disk size + +------------------------------------------------------------------- +Fri Oct 23 12:22:39 UTC 2026 - Thorsten Kukuk <[email protected]> + +- Update to version 1.2.1+git4.20261023: + * Rename images to include rdi-installer version + * image: fix excluding of kernel modules + * image: don't bail out of images directory already exists +- Switch git suffix to have it always increasing + +------------------------------------------------------------------- +Wed Oct 21 09:52:15 UTC 2026 - Thorsten Kukuk <[email protected]> + +- Update to version 1.2.1+git20261021.b30d538: + * Don't run rdii-set-default-loader-entry on MicroOS + +------------------------------------------------------------------- Old: ---- rdi-installer-1.2.1+git20261019.1a525f6.tar.xz New: ---- rdi-installer-1.3.0.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ rdi-installer.spec ++++++ --- /var/tmp/diff_new_pack.Anf21p/_old 2026-10-28 17:49:48.651262397 +0100 +++ /var/tmp/diff_new_pack.Anf21p/_new 2026-10-28 17:49:48.656262607 +0100 @@ -16,7 +16,7 @@ # Name: rdi-installer -Version: 1.2.1+git20261019.1a525f6 +Version: 1.3.0 Release: 0 Summary: Utility to write disk images to hard disk License: MIT @@ -100,16 +100,19 @@ %{_bindir}/rdii-networkd %{_bindir}/rdii-fetch-config %{_bindir}/rdii-proxy-setup +%{_bindir}/rdii-pubkey-setup %{_bindir}/rdii-ssh-setup %{_prefix}/lib/systemd/system/rdii-fetch-config-early.service %{_prefix}/lib/systemd/system/rdii-fetch-config.service %{_prefix}/lib/systemd/system/rdii-mount-img-part.service %{_prefix}/lib/systemd/system/rdii-networkd.service %{_prefix}/lib/systemd/system/rdii-proxy-setup.service +%{_prefix}/lib/systemd/system/rdii-pubkey-setup.service %{_prefix}/lib/systemd/system/rdii-ssh-setup.service %dir %{_libexecdir}/rdi-installer %{_libexecdir}/rdi-installer/mount-part-by-label %{_mandir}/man8/rdii-networkd.8%{?ext_man} +%{_mandir}/man8/rdii-pubkey-setup.service.8%{?ext_man} %{_mandir}/man8/rdii-ssh-setup.service.8%{?ext_man} %files -n rdii-helper ++++++ _service ++++++ --- /var/tmp/diff_new_pack.Anf21p/_old 2026-10-28 17:49:48.719265254 +0100 +++ /var/tmp/diff_new_pack.Anf21p/_new 2026-10-28 17:49:48.729265673 +0100 @@ -5,8 +5,8 @@ <param name="changesgenerate">enable</param> <param name="filename">rdi-installer</param> <param name="revision">main</param> - <param name="versionformat">@PARENT_TAG@+git%cd.%h</param> - <param name="versionrewrite-pattern">v(.*?)(\+git0)?$</param> + <param name="versionformat">@PARENT_TAG@+git%cd.@TAG_OFFSET@</param> + <param name="versionrewrite-pattern">v(.*?)(\+git[0-9]{8}\.0)?$</param> <param name="exclude">images</param> </service> <service mode="manual" name="recompress"> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.Anf21p/_old 2026-10-28 17:49:48.779267774 +0100 +++ /var/tmp/diff_new_pack.Anf21p/_new 2026-10-28 17:49:48.792268320 +0100 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/thkukuk/rdi-installer.git</param> -<param name="changesrevision">1a525f685c1dd285f69d5039122db9d08d33c356</param></service></servicedata> +<param name="changesrevision">0a629c290169e717413703cbfe986e52124147c0</param></service></servicedata> (No newline at EOF) ++++++ rdi-installer-1.2.1+git20261019.1a525f6.tar.xz -> rdi-installer-1.3.0.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rdi-installer-1.2.1+git20261019.1a525f6/.github/workflows/ci-opensuse.yml new/rdi-installer-1.3.0/.github/workflows/ci-opensuse.yml --- old/rdi-installer-1.2.1+git20261019.1a525f6/.github/workflows/ci-opensuse.yml 2026-10-19 15:53:46.000000000 +0200 +++ new/rdi-installer-1.3.0/.github/workflows/ci-opensuse.yml 2026-10-28 12:12:50.000000000 +0100 @@ -8,7 +8,7 @@ container: registry.opensuse.org/opensuse/tumbleweed:latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Install devel packages run: | @@ -31,7 +31,7 @@ container: registry.opensuse.org/opensuse/tumbleweed:latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Install devel packages run: | @@ -52,7 +52,7 @@ container: registry.opensuse.org/opensuse/tumbleweed:latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Install devel packages run: | diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rdi-installer-1.2.1+git20261019.1a525f6/Quick-Guide/README.md new/rdi-installer-1.3.0/Quick-Guide/README.md --- old/rdi-installer-1.2.1+git20261019.1a525f6/Quick-Guide/README.md 2026-10-19 15:53:46.000000000 +0200 +++ new/rdi-installer-1.3.0/Quick-Guide/README.md 2026-10-28 12:12:50.000000000 +0100 @@ -1,10 +1,50 @@ +# Raw Disk Image Installer Quick Guide +  + +The RDI-Installer offers a text UI for the correct settings. +In most cases, selecting an image and a target device before starting the installation is enough. But sometimes it is necessary to adjust at first some options. +  + +In the settings dialog you can adjust: +* if the host ssh key should be backed up from an already installed system and copied back into the installed system. +* The URL from where images should be downloaded. In the "Select Image" dialog, this URL will be used to present existing images for installation. Under the URL a file SHA256SUMS is read to get the image names. +* The keyboard layout. This is only used for the installer itself to make it easier to type URLs and image names. +  + +Now enter the `Select Image` dialog. +  + +Three options to select an image are offered: +1. `Select image from download server` offers all images from the download URL in the settings dialog. To build a list of available images, `SHA256SUMS` and `SHA256SUMS.asc` are downloaded and verified with the openSUSE signing key. +2. With `Provide URL` a URL for an image can be entered. +3. `Use file selection` allows to browse for the image. Partitions with the label `images` will be auto-mounted below `/images`. +  + +The dialog to select an image from a download server shows a list of all matching images. The dialog filters according to the extension of the image and the architecture of the system. There are three options: +* The default is `matching` and only images with the same architecture as the host are shown. +* `all` will show all images with a supported format. +* At last you can select per architecture, which allows to install e.g. an aarch64 image for a Raspberry Pi on an SD card on a x86-64 host. + +  + +After selecting an image for installation, a device needs to be selected, on which the image should be installed. The list contains the device name, the disk model if known, the interface, disk size and if the disk is the boot device, the default disk according to the firmware or if it is already mounted. Only disks with size of 10GB or greater are shown by default. +  + +If an image and the target device got selected, RDI-Installer will automatically pre-select the "Start Installation" option. +  + +Until now, no changes were made to the disk. If `YES` get selected, the destructive part starts and all data on the selected device gets overwritten. +  + +You can follow the output of `dd` as it writes the image to disk. +  diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rdi-installer-1.2.1+git20261019.1a525f6/README.md new/rdi-installer-1.3.0/README.md --- old/rdi-installer-1.2.1+git20261019.1a525f6/README.md 2026-10-19 15:53:46.000000000 +0200 +++ new/rdi-installer-1.3.0/README.md 2026-10-28 12:12:50.000000000 +0100 @@ -1,33 +1,33 @@ # Raw Disk Image Installer (rdi-installer) -This project consists of various utilities and a UKI image for a raw disk image installer, which main purpose is to have a comfortable and robust tool to boot on bare metal and install a raw disk image on that hardware. +This project consists of various utilities and a UKI image for a raw disk image installer, whose main purpose is to have a comfortable and robust tool to boot on bare metal and install a raw disk image on that hardware. ## Images -This project will build the folowing images: +This project will build the following images: * `rdi-installer-<version>.<arch>.efi` (UKI EFI binary) * `rdi-installer-<version>.<arch>.img` (USB stick) -Images will be build in the [home:kukuk:mkosi-images](https://build.opensuse.org/project/monitor/home:kukuk:mkosi-images) OBS project. +Images will be built in the [devel:microos:images](https://build.opensuse.org/project/monitor/devel:microos:images) OBS project. ### rdi-installer-<version>.<arch>.efi This is a UKI EFI binary file that can be stored on an ESP partition (e.g. <ESP>/EFI/Linux/ will automatically be sourced by `systemd-boot`), on a tftpboot server or on a http server. It can be booted directly from the UEFI firmware from the hard disk, via PXE, or HTTP. The kernel command line cannot be modified with UKI binary files. Since the image is *not* signed with an official Microsoft key, Secure Boot will only work if the key used is registered in the UEFI firmware. -This binary runs completley from a RAM disk in memory. +This binary runs completely from a RAM disk in memory. -### rdi-installer-<version>.<arch>.img +### rdi-installer-<version>.<arch>.img -This is a disk image which can be written to an USB stick and uses +This is a disk image which can be written to a USB stick and uses `shim` and `systemd-boot` as bootloader with the classical linux kernel and initrd setup. This image allows to modify the kernel cmdline during boot. -This system also runs completley from a RAM disk in memory. +This system also runs completely from a RAM disk in memory. -There is a script [add_extra_partition.sh](images/scripts/add_extra_partition.sh) with extends the image with an additional partition. This can be used to create a parition `images`, on which raw disk images can be copied and the installer will automatically mount the partition and provides the images on it as installation source. Or a `combustion` partition with a combustion config to personalize the image later. The script can create as many partitions with a filesystem, label and size as needed. +There is a script [add_extra_partition.sh](images/scripts/add_extra_partition.sh) which extends the image with an additional partition. This can be used to create a partition `images`, on which raw disk images can be copied and the installer will automatically mount the partition and provide the images on it as installation source. Or a `combustion` partition with a combustion config to personalize the image later. The script can create as many partitions with a filesystem, label and size as needed. Usage: ``` @@ -49,6 +49,8 @@ Signature verification is done by `gpgv` with a keyring at `/etc/systemd/import-pubring.gpg`. The signing key must be imported into that keyring for verification to succeed. If the signature file cannot be downloaded or verification fails, the installer will warn the user but still allow the installation to proceed. +The keyring already contains the key used for the official repositories. To verify images signed with a different key, import that key at boot time via the `rdii.pubkey` option, processed by `rdii-pubkey-setup.service`. + ## Options The options can be provided either via the kernel cmdline during boot or with a configuration file. @@ -56,7 +58,7 @@ | Parameter | Format | Description | | --------- | ------ | ----------- | | rdii.config | http url/local file | Specifies the URL or the filename for a configuration file, used by `rdii-fetch-config` | -| rdii.url | http url/local file | Specifies a the URL or the filename under which the to be installed image can be downloaded | +| rdii.url | http url/local file | Specifies the URL or the filename under which the to be installed image can be downloaded | | rdii.device | /dev/... | Device on which the image should be installed | | rdii.mdraid | /dev/... | Second device together with rdii.device for MD Raid 1 | | rdii.keymap | name | Configures the key mapping table for the keyboard. Only applied when running on a Linux virtual console; ignored on serial consoles and pseudo terminals | @@ -69,7 +71,7 @@ | rdii.autoinstall.confirm_errors | true/false/yes/no/1/0 | Only takes effect if `rdii.autoinstall` is `true`. Default `true`: error popups are always shown. If `false` and `rdii.autoinstall.popup_timeout` is greater than `0`, the popup is automatically dismissed after that many seconds instead of waiting for a keypress | | rdii.autoinstall.popup_timeout | integer (seconds) | Only takes effect if `rdii.autoinstall` is `true`. Default `0` (disabled). Number of seconds after which a popup is automatically dismissed, but only for popups whose corresponding `confirm_infos`/`confirm_warnings`/`confirm_errors` setting is `false`. Popups that still require confirmation always wait indefinitely for a keypress | -With `rdii.url1` and `rdii.url2` additional images can be specified. At the start of `rdi-installer`, the user has to selected the one he wants to install. +With `rdii.url1` and `rdii.url2` additional images can be specified. At the start of `rdi-installer`, the user has to select the one they want to install. ### SSH Host Key Preservation @@ -96,13 +98,13 @@ ### MD Raid (Raid 1) -During installation a MD Raid can be created and used as device for the image. If `rdii.mdraid` is set, `rdii.device` is the first device of the MD Raid and `rdii.mdraid` is the second device. `rdi-intaller` does not make any modifications to the image, it needs to contain already everything to assembly the MD device during boot. +During installation a MD Raid can be created and used as device for the image. If `rdii.mdraid` is set, `rdii.device` is the first device of the MD Raid and `rdii.mdraid` is the second device. `rdi-installer` does not make any modifications to the image, it needs to contain already everything to assemble the MD device during boot. ### Configuration file The rdii-config configuration file is used by rdi-installer, rdii-networkd, rdii-proxy-setup.service and rdii-ssh-setup.service to provision installation -sources and targets, network interfaces, proxys and remote SSH access. +sources and targets, network interfaces, proxies and remote SSH access. It follows a simple syntax: * One key=value parameter is defined per line. * Empty lines are ignored. @@ -231,7 +233,7 @@ This script provides a systemd service and shell script that parses the Linux kernel command line (`/proc/cmdline`) and config file at -boot time and setups the /etc/sysconfig/proxy file. +boot time and sets up the /etc/sysconfig/proxy file. The supported proxy URL format is protocol://[user[:password]@]host[:port]. The format for the kernel command line and config file is: @@ -256,3 +258,19 @@ | ssh=1 | N/A | Enables and starts the sshd service immediately. | | ssh.key | Base64 Encoded | Decodes the string and appends it to `/root/.ssh/authorized_keys`.| | ssh.password | Plaintext | (Insecure) Sets the root password to the provided string. Sets PermitRootLogin yes.| + +### rdii-pubkey-setup + +This script provides a systemd service and a bash script that parses +the Linux kernel command line (`/proc/cmdline`) and config file at +boot time and imports additional gpg public keys into the keyring +(`/etc/systemd/import-pubring.gpg`) used by `rdi-installer` to verify +downloaded raw disk images. This is needed if an image is signed with +a key other than the one used for the official repositories, which is +already contained in the keyring. + +| Parameter | Format | Description | +| --------- | ------ | ----------- | +| rdii.pubkey | http(s)/ftp url or Base64 Encoded | Downloads the ASCII armored gpg public key from the given URL, or decodes it directly if the value is not a URL. Can be specified more than once. | + +Example: `rdii.pubkey=https://download.opensuse.org/repositories/devel:/microos:/images/Tumbleweed/repodata/repomd.xml.key` diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rdi-installer-1.2.1+git20261019.1a525f6/include/parse-size.h new/rdi-installer-1.3.0/include/parse-size.h --- old/rdi-installer-1.2.1+git20261019.1a525f6/include/parse-size.h 1970-01-01 01:00:00.000000000 +0100 +++ new/rdi-installer-1.3.0/include/parse-size.h 2026-10-28 12:12:50.000000000 +0100 @@ -0,0 +1,10 @@ +// SPDX-License-Identifier: GPL-2.0-or-later + +#pragma once + +#include <stdint.h> + +/* Parses a size given as plain number of bytes, or a number followed by + an optional "B" and a K/M/G/T suffix (binary units, e.g. "500G", + "500GB", "1T", "1TB"). Returns 0 on success, or a negative errno. */ +extern int parse_size(const char *str, uint64_t *res); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rdi-installer-1.2.1+git20261019.1a525f6/lib/parse-size.c new/rdi-installer-1.3.0/lib/parse-size.c --- old/rdi-installer-1.2.1+git20261019.1a525f6/lib/parse-size.c 1970-01-01 01:00:00.000000000 +0100 +++ new/rdi-installer-1.3.0/lib/parse-size.c 2026-10-28 12:12:50.000000000 +0100 @@ -0,0 +1,70 @@ +// SPDX-License-Identifier: GPL-2.0-or-later + +#include "config.h" + +#include <errno.h> +#include <stdlib.h> +#include <ctype.h> + +#include "basics.h" +#include "parse-size.h" + +int +parse_size(const char *str, uint64_t *res) +{ + const char *p = str; + uint64_t size, multiplier = 1; + char *ep; + + if (isempty(str)) + return -EINVAL; + + while (isspace((unsigned char)*p)) + p++; + if (*p == '-') /* strtoull() would silently wrap this around */ + return -ERANGE; + + errno = 0; + size = strtoull(p, &ep, 10); + if (errno == ERANGE) + return -ERANGE; + if (ep == p) /* no digits at all */ + return -EINVAL; + + switch (toupper((unsigned char)*ep)) + { + case '\0': + break; + case 'K': + multiplier = 1024ULL; + ep++; + break; + case 'M': + multiplier = 1024ULL * 1024; + ep++; + break; + case 'G': + multiplier = 1024ULL * 1024 * 1024; + ep++; + break; + case 'T': + multiplier = 1024ULL * 1024 * 1024 * 1024; + ep++; + break; + default: + return -EINVAL; + } + + /* Accept an optional trailing "B" (e.g. "GB" as well as "G"). */ + if (multiplier != 1 && toupper((unsigned char)*ep) == 'B') + ep++; + + if (!isempty(ep)) /* trailing garbage */ + return -EINVAL; + + if (size > UINT64_MAX / multiplier) + return -ERANGE; + + *res = size * multiplier; + return 0; +} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rdi-installer-1.2.1+git20261019.1a525f6/man/meson.build new/rdi-installer-1.3.0/man/meson.build --- old/rdi-installer-1.2.1+git20261019.1a525f6/man/meson.build 2026-10-19 15:53:46.000000000 +0200 +++ new/rdi-installer-1.3.0/man/meson.build 2026-10-28 12:12:50.000000000 +0100 @@ -43,4 +43,11 @@ command : xslt_cmd + [custom_man_xsl, '@INPUT@'], install : want_man, install_dir : mandir8) + +custom_target('rdii-pubkey-setup.service.8', + input : 'rdii-pubkey-setup.service.8.xml', + output : 'rdii-pubkey-setup.service.8', + command : xslt_cmd + [custom_man_xsl, '@INPUT@'], + install : want_man, + install_dir : mandir8) endif diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rdi-installer-1.2.1+git20261019.1a525f6/man/rdii-config.7.xml new/rdi-installer-1.3.0/man/rdii-config.7.xml --- old/rdi-installer-1.2.1+git20261019.1a525f6/man/rdii-config.7.xml 2026-10-19 15:53:46.000000000 +0200 +++ new/rdi-installer-1.3.0/man/rdii-config.7.xml 2026-10-28 12:12:50.000000000 +0100 @@ -9,17 +9,18 @@ <refnamediv> <refname>rdii-config</refname> - <refpurpose>Configuration file for rdi-installer, rdii-networkd, and rdii-ssh-setup.service</refpurpose> + <refpurpose>Configuration file for rdi-installer, rdii-networkd, rdii-ssh-setup.service, and rdii-pubkey-setup.service</refpurpose> </refnamediv> <refsect1> <title>Description</title> <para> The <filename>rdii-config</filename> configuration file is used by - <command>rdi-installer</command>, <command>rdii-networkd</command> - and <command>rdii-ssh-setup.service</command> to provision - installation sources and targets, network interfaces and - remote SSH access. + <command>rdi-installer</command>, <command>rdii-networkd</command>, + <command>rdii-ssh-setup.service</command> and + <command>rdii-pubkey-setup.service</command> to provision + installation sources and targets, network interfaces, remote SSH + access and additional gpg public keys. </para> </refsect1> @@ -136,6 +137,22 @@ </listitem> </varlistentry> <varlistentry> + <term><literal>rdii.minsize</literal></term> + <listitem> + <para> + <emphasis>Format:</emphasis> A plain number of bytes, or a + number followed by <literal>KB</literal>, + <literal>MB</literal>, <literal>GB</literal>, or + <literal>TB</literal>. + </para> + <para> + Default: <literal>10GB</literal>. Minimum size a disk must + have to be offered as an installation target in the + interactive target selection menu. + </para> + </listitem> + </varlistentry> + <varlistentry> <term><literal>rdii.autoinstall</literal></term> <listitem> <para> @@ -351,11 +368,41 @@ </refsect1> <refsect1> + <title>GPG Public Key Options</title> + <para> + Additional gpg public keys used to verify downloaded raw disk + images are imported at boot by + <command>rdii-pubkey-setup.service</command>. + </para> + <variablelist> + <varlistentry> + <term><literal>rdii.pubkey</literal></term> + <listitem> + <para> + <emphasis>Format:</emphasis> HTTP(S)/FTP URL or Base64 Encoded + </para> + <para> + If the value starts with <literal>http://</literal>, + <literal>https://</literal> or <literal>ftp://</literal>, the + ASCII armored gpg public key is downloaded from that URL. Otherwise + the value is treated as a Base64 encoded ASCII armored gpg public + key and decoded directly. In both cases the key is imported into + the keyring <filename>/etc/systemd/import-pubring.gpg</filename> + used by <command>rdi-installer</command> to verify downloaded + images. May be specified more than once to import several keys. + </para> + </listitem> + </varlistentry> + </variablelist> + </refsect1> + + <refsect1> <title>See Also</title> <para> <citerefentry><refentrytitle>rdii-fetch-config</refentrytitle><manvolnum>8</manvolnum></citerefentry>, <citerefentry><refentrytitle>rdii-networkd</refentrytitle><manvolnum>8</manvolnum></citerefentry>, - <citerefentry><refentrytitle>rdii-ssh-setup.service</refentrytitle><manvolnum>8</manvolnum></citerefentry> + <citerefentry><refentrytitle>rdii-ssh-setup.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>, + <citerefentry><refentrytitle>rdii-pubkey-setup.service</refentrytitle><manvolnum>8</manvolnum></citerefentry> </para> </refsect1> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rdi-installer-1.2.1+git20261019.1a525f6/man/rdii-pubkey-setup.service.8.xml new/rdi-installer-1.3.0/man/rdii-pubkey-setup.service.8.xml --- old/rdi-installer-1.2.1+git20261019.1a525f6/man/rdii-pubkey-setup.service.8.xml 1970-01-01 01:00:00.000000000 +0100 +++ new/rdi-installer-1.3.0/man/rdii-pubkey-setup.service.8.xml 2026-10-28 12:12:50.000000000 +0100 @@ -0,0 +1,101 @@ +<?xml version="1.0" encoding="UTF-8"?> +<refentry xmlns="http://docbook.org/ns/docbook"; version="5.0" xml:id="rdii-pubkey-setup.service" xml:lang="en"> + <refmeta> + <refentrytitle>rdii-pubkey-setup.service</refentrytitle> + <manvolnum>8</manvolnum> + <refmiscinfo class="source">rdi-installer %version%</refmiscinfo> + <refmiscinfo class="manual">rdii-pubkey-setup.service</refmiscinfo> + </refmeta> + + <refnamediv> + <refname>rdii-pubkey-setup.service</refname> + <refpurpose>Import additional gpg public keys from kernel parameters or config file</refpurpose> + </refnamediv> + + <refsect1> + <title>Description</title> + <para> + <command>rdii-pubkey-setup.service</command> is a systemd service calling + a script to parse a transient configuration file + (<filename>/run/rdi-installer/rdii-config</filename>) and the Linux + kernel command line (<filename>/proc/cmdline</filename>) at boot time. + </para> + <para> + <command>rdi-installer</command> verifies downloaded raw disk images + with <command>gpgv</command> against the keyring + <filename>/etc/systemd/import-pubring.gpg</filename>, which already + contains the key used for the official repositories. If an image is + signed with a different key, that key must be imported into the keyring + first. This service allows doing so dynamically at boot via the + <literal>rdii.pubkey</literal> parameter, without having to rebuild the + installer image. + </para> + </refsect1> + + <refsect1> + <title>Boot Parameters</title> + <para>The service looks for the following parameter to import gpg public keys:</para> + + <variablelist> + <varlistentry> + <term><literal>rdii.pubkey</literal></term> + <listitem> + <para> + <emphasis>Format:</emphasis> HTTP(S)/FTP URL or Base64 Encoded + </para> + <para> + If the value starts with <literal>http://</literal>, + <literal>https://</literal> or <literal>ftp://</literal>, it is + treated as the URL of an ASCII armored gpg public key, e.g. + <literal>https://download.opensuse.org/repositories/devel:/microos:/images/Tumbleweed/repodata/repomd.xml.key</literal>. + The key is downloaded and imported. + </para> + <para> + Otherwise the value is treated as a Base64 encoded ASCII + armored gpg public key and decoded and imported directly, + without any network access. + </para> + <para> + In both cases the key is added to the keyring + <filename>/etc/systemd/import-pubring.gpg</filename> used by + <command>rdi-installer</command> to verify downloaded images. + <literal>rdii.pubkey</literal> may be specified more than once + to import several keys. + </para> + </listitem> + </varlistentry> + </variablelist> + </refsect1> + + <refsect1> + <title>Files</title> + <variablelist> + <varlistentry> + <term><filename>/run/rdi-installer/rdii-config</filename></term> + <listitem> + <para>The transient configuration file parsed by the script at boot.</para> + </listitem> + </varlistentry> + <varlistentry> + <term><filename>/proc/cmdline</filename></term> + <listitem> + <para>The Linux kernel command line parsed for the parameter described above.</para> + </listitem> + </varlistentry> + <varlistentry> + <term><filename>/etc/systemd/import-pubring.gpg</filename></term> + <listitem> + <para>The gpg keyring the public key(s) are imported into.</para> + </listitem> + </varlistentry> + </variablelist> + </refsect1> + + <refsect1> + <title>See Also</title> + <para> + <citerefentry><refentrytitle>rdii-config</refentrytitle><manvolnum>7</manvolnum></citerefentry>, + <citerefentry><refentrytitle>rdii-fetch-config</refentrytitle><manvolnum>8</manvolnum></citerefentry> + </para> + </refsect1> +</refentry> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rdi-installer-1.2.1+git20261019.1a525f6/meson.build new/rdi-installer-1.3.0/meson.build --- old/rdi-installer-1.2.1+git20261019.1a525f6/meson.build 2026-10-19 15:53:46.000000000 +0200 +++ new/rdi-installer-1.3.0/meson.build 2026-10-28 12:12:50.000000000 +0100 @@ -14,7 +14,7 @@ 'werror=true', 'warning_level=2'], license : ['MIT', 'GPL-2.0-or-later'], - version : '1.2.1', + version : '1.3.0', ) conf = configuration_data() @@ -84,7 +84,8 @@ librdii_c = files('lib/exec_cmd.c', 'lib/mkdir_p.c', 'lib/tmpfile-util.c', 'lib/logger.c', 'lib/zap_partition_table.c', 'lib/rm_rf.c', 'lib/download.c', 'lib/nc-dialogs.c', - 'lib/keymap.c', 'lib/select_keymap.c', 'lib/is_linux_vt.c') + 'lib/keymap.c', 'lib/select_keymap.c', 'lib/is_linux_vt.c', + 'lib/parse-size.c') librdii = static_library( 'rdii', librdii_c, @@ -137,6 +138,7 @@ # additional tools install_data('scripts/rdii-proxy-setup.sh', rename : 'rdii-proxy-setup', install_mode : 'rwxr-xr-x', install_dir : bindir) install_data('scripts/rdii-ssh-setup.sh', rename : 'rdii-ssh-setup', install_mode : 'rwxr-xr-x', install_dir : bindir) +install_data('scripts/rdii-pubkey-setup.sh', rename : 'rdii-pubkey-setup', install_mode : 'rwxr-xr-x', install_dir : bindir) install_data('scripts/mount-part-by-label.sh', rename : 'mount-part-by-label', install_mode : 'rwxr-xr-x', install_dir : rdiidir) configure_file(output: 'config.h', configuration: conf) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rdi-installer-1.2.1+git20261019.1a525f6/scripts/rdii-pubkey-setup.sh new/rdi-installer-1.3.0/scripts/rdii-pubkey-setup.sh --- old/rdi-installer-1.2.1+git20261019.1a525f6/scripts/rdii-pubkey-setup.sh 1970-01-01 01:00:00.000000000 +0100 +++ new/rdi-installer-1.3.0/scripts/rdii-pubkey-setup.sh 2026-10-28 12:12:50.000000000 +0100 @@ -0,0 +1,89 @@ +#!/bin/bash + +# Imports additional gpg public keys into the keyring used by rdi-installer +# to verify the signature of downloaded raw disk images. +# +# Kernel cmdline / config file argument: +# +# rdii.pubkey=<url> URL (http://, https://, ftp://) to an ASCII armored +# gpg public key, e.g. +# https://download.opensuse.org/repositories/devel:/microos:/images/Tumbleweed/repodata/repomd.xml.key +# rdii.pubkey=<base64> Base64 encoded ASCII armored gpg public key, imported +# directly without downloading anything. +# +# May be specified more than once to import several keys. + +RDII_CONFIG_FILE="/run/rdi-installer/rdii-config" +KEYRING="/etc/systemd/import-pubring.gpg" + +cmdline=$(cat /proc/cmdline) + +declare -a PUBKEYS=() + +if [ -f "${RDII_CONFIG_FILE}" ]; then + while IFS= read -r line || [ -n "$line" ]; do + case "$line" in + rdii.pubkey=*) + PUBKEYS+=("${line#rdii.pubkey=}") + ;; + esac + done < "${RDII_CONFIG_FILE}" +fi + +for ARG in $cmdline; do + case "$ARG" in + rdii.pubkey=*) + PUBKEYS+=("${ARG#rdii.pubkey=}") + ;; + esac +done + +if [ ${#PUBKEYS[@]} -eq 0 ]; then + exit 0 +fi + +mkdir -p "$(dirname "$KEYRING")" + +for key in "${PUBKEYS[@]}"; do + # Strip surrounding quotes, in case the value was quoted on the + # kernel cmdline. + key="${key%\"}" + key="${key#\"}" + + if [ -z "$key" ]; then + continue + fi + + WORKDIR=$(mktemp -d) + mkdir -m 700 "$WORKDIR/gnupg" + + case "$key" in + http://*|https://*|ftp://*) + echo "rdii-pubkey-setup: Downloading public key from $key..." + if ! wget -q -O "$WORKDIR/key.asc" "$key"; then + echo "rdii-pubkey-setup: Failed to download public key from $key" >&2 + rm -rf "$WORKDIR" + continue + fi + ;; + *) + echo "rdii-pubkey-setup: Decoding Base64 encoded public key..." + if ! base64 -d <<<"$key" > "$WORKDIR/key.asc" 2>/dev/null; then + echo "rdii-pubkey-setup: Failed to decode Base64 public key" >&2 + rm -rf "$WORKDIR" + continue + fi + ;; + esac + + if gpg --homedir "$WORKDIR/gnupg" --no-options --batch --import \ + --no-default-keyring --keyring "$KEYRING" "$WORKDIR/key.asc"; then + echo "rdii-pubkey-setup: Imported public key into $KEYRING" + else + echo "rdii-pubkey-setup: Failed to import public key into $KEYRING" >&2 + fi + + rm -rf "$WORKDIR" +done + +exit 0 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rdi-installer-1.2.1+git20261019.1a525f6/src/rdi-installer.c new/rdi-installer-1.3.0/src/rdi-installer.c --- old/rdi-installer-1.2.1+git20261019.1a525f6/src/rdi-installer.c 2026-10-19 15:53:46.000000000 +0200 +++ new/rdi-installer-1.3.0/src/rdi-installer.c 2026-10-28 12:12:50.000000000 +0100 @@ -15,6 +15,7 @@ #include "nc-dialogs.h" #include "rdii-menu.h" #include "rdii-autoinstall.h" +#include "parse-size.h" #include "logger.h" #include "select_keymap.h" #include "is_linux_vt.h" @@ -31,7 +32,7 @@ char **ret_url, char **ret_url1, char **ret_url2, char **ret_keymap, char **ret_download_server, bool *ret_preserve_ssh_hostkey, bool *ret_autoinstall, - char **ret_autoinstall_finish) + char **ret_autoinstall_finish, uint64_t *ret_minsize) { _cleanup_(econf_freeFilep) econf_file *key_file = NULL; _cleanup_free_ char *device = NULL; @@ -42,6 +43,7 @@ _cleanup_free_ char *keymap = NULL; _cleanup_free_ char *download_server = NULL; _cleanup_free_ char *autoinstall_finish = NULL; + _cleanup_free_ char *minsize_str = NULL; bool preserve_ssh_hostkey = false; bool autoinstall = false; econf_err error; @@ -82,6 +84,20 @@ if (error != ECONF_SUCCESS && error != ECONF_NOKEY) return error; + error = econf_getStringValue(key_file, NULL, "rdii.minsize", &minsize_str); + if (error != ECONF_SUCCESS && error != ECONF_NOKEY) + return error; + if (minsize_str) + { + uint64_t minsize; + int r = parse_size(minsize_str, &minsize); + + if (r < 0) + MSG_WARN("Invalid value for rdii.minsize '%s': %s", minsize_str, strerror(-r)); + else if (ret_minsize) + *ret_minsize = minsize; + } + error = econf_getBoolValue(key_file, NULL, "rdii.preserve-ssh-hostkey", &preserve_ssh_hostkey); if (error != ECONF_SUCCESS && error != ECONF_NOKEY) return error; @@ -271,6 +287,7 @@ _cleanup_free_ char *autoinstall_finish = NULL; bool preserve_ssh_hostkey = false; bool autoinstall = false; + uint64_t minsize = 10 * 1000ULL * 1000 * 1000; // 10G min disk size int r; econf_err conf_err; @@ -336,7 +353,7 @@ conf_err = read_config(rdii_config, &device, &mdraid, &image, &image1, &image2, &keymap, &download_server, &preserve_ssh_hostkey, &autoinstall, - &autoinstall_finish); + &autoinstall_finish, &minsize); if (conf_err != ECONF_SUCCESS) { show_error_popup("Failed to read config file:", @@ -382,7 +399,7 @@ if (!autoinstall || !rdii_autoinstall(image, device, mdraid, preserve_ssh_hostkey, autoinstall_finish, &r)) r = rdii_menu(TITLE, image, image1, image2, device, mdraid, keymap, - preserve_ssh_hostkey); + preserve_ssh_hostkey, minsize); MSG_INFO("rdi-installer stopped (retval=%i)", r); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rdi-installer-1.2.1+git20261019.1a525f6/src/rdii-helper-disk.c new/rdi-installer-1.3.0/src/rdii-helper-disk.c --- old/rdi-installer-1.2.1+git20261019.1a525f6/src/rdii-helper-disk.c 2026-10-19 15:53:46.000000000 +0200 +++ new/rdi-installer-1.3.0/src/rdii-helper-disk.c 2026-10-28 12:12:50.000000000 +0100 @@ -7,72 +7,15 @@ #include <getopt.h> #include <stdint.h> #include <limits.h> -#include <ctype.h> #include <libudev.h> #include "basics.h" #include "efivars.h" #include "devices.h" #include "rdii-helper.h" +#include "parse-size.h" #include "logger.h" -/* Parse a size with an optional K/M/G/T suffix (binary units). */ -static int -parse_size(const char *str, uint64_t *res) -{ - const char *p = str; - uint64_t size, multiplier = 1; - char *ep; - - if (isempty(str)) - return -EINVAL; - - while (isspace((unsigned char)*p)) - p++; - if (*p == '-') /* strtoull() would silently wrap this around */ - return -ERANGE; - - errno = 0; - size = strtoull(p, &ep, 10); - if (errno == ERANGE) - return -ERANGE; - if (ep == p) /* no digits at all */ - return -EINVAL; - - switch (toupper((unsigned char)*ep)) - { - case '\0': - break; - case 'K': - multiplier = 1024ULL; - ep++; - break; - case 'M': - multiplier = 1024ULL * 1024; - ep++; - break; - case 'G': - multiplier = 1024ULL * 1024 * 1024; - ep++; - break; - case 'T': - multiplier = 1024ULL * 1024 * 1024 * 1024; - ep++; - break; - default: - return -EINVAL; - } - - if (!isempty(ep)) /* trailing garbage */ - return -EINVAL; - - if (size > UINT64_MAX / multiplier) - return -ERANGE; - - *res = size * multiplier; - return 0; -} - int main_disk(int argc, char **argv) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rdi-installer-1.2.1+git20261019.1a525f6/src/rdii-menu.c new/rdi-installer-1.3.0/src/rdii-menu.c --- old/rdi-installer-1.2.1+git20261019.1a525f6/src/rdii-menu.c 2026-10-19 15:53:46.000000000 +0200 +++ new/rdi-installer-1.3.0/src/rdii-menu.c 2026-10-28 12:12:50.000000000 +0100 @@ -9,6 +9,7 @@ #include <stdlib.h> #include <locale.h> #include <wchar.h> +#include <inttypes.h> #include "basics.h" #include "exec_cmd.h" @@ -231,6 +232,14 @@ "* rdii.download_server\n" " - Format: HTTP URL\n" " - Description: Base URL from which a list of raw disk images can be retrieved for selection.\n\n" + "* rdii.minsize\n" + " - Format: Number of bytes, or a number followed by KB, MB, GB, or TB\n" + " - Description: Minimum disk size for a device to be offered as installation target. Default: 10GB.\n\n" + "* rdii.pubkey\n" + " - Format: http(s)/ftp URL or Base64 Encoded\n" + " - Description: Imports an additional gpg public key into /etc/systemd/import-pubring.gpg, used to verify downloaded images signed " + "with a key other than the official one. If the value is a URL, the key is downloaded from it; otherwise it is treated as a " + "Base64 encoded key and decoded directly. Can be specified more than once.\n\n" "Note: Additional images can be specified using rdii.url1 and rdii.url2. When rdi-installer starts, the user will be prompted" " to select which image to install.\n\n" "SSH Host Key Preservation\n" @@ -277,9 +286,8 @@ static int show_main_menu(const char *def_image, const char *def_device, const char *def_mdraid, - const char *def_keymap, bool preserve_ssh_hostkey) + const char *def_keymap, bool preserve_ssh_hostkey, uint64_t minsize) { - uint64_t minsize = 10 * 1000ULL * 1000 * 1000; // 10G min disk size _cleanup_free_ char *image_entry = NULL; _cleanup_free_ char *target_entry = NULL; _cleanup_free_ char *mdraid_entry = NULL; @@ -508,15 +516,15 @@ int rdii_menu(const char *title, const char *image0, const char *image1, const char *image2, const char *device, const char *mdraid, - const char *keymap, bool preserve_ssh_hostkey) + const char *keymap, bool preserve_ssh_hostkey, uint64_t minsize) { const char *image = NULL; int r; - MSG_FUNC("image0='%s', image1='%s', image2='%s', device='%s', mdraid='%s', keymap='%s', preserve_ssh_hostkey=%i", + MSG_FUNC("image0='%s', image1='%s', image2='%s', device='%s', mdraid='%s', keymap='%s', preserve_ssh_hostkey=%i, minsize=%" PRIu64, strempty(image0), strempty(image1), strempty(image2), strempty(device), strempty(mdraid), strempty(keymap), - preserve_ssh_hostkey); + preserve_ssh_hostkey, minsize); show_splash_screen(title); @@ -547,7 +555,7 @@ else image = image0; - r = show_main_menu(image, device, mdraid, keymap, preserve_ssh_hostkey); + r = show_main_menu(image, device, mdraid, keymap, preserve_ssh_hostkey, minsize); endwin(); return r; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rdi-installer-1.2.1+git20261019.1a525f6/src/rdii-menu.h new/rdi-installer-1.3.0/src/rdii-menu.h --- old/rdi-installer-1.2.1+git20261019.1a525f6/src/rdii-menu.h 2026-10-19 15:53:46.000000000 +0200 +++ new/rdi-installer-1.3.0/src/rdii-menu.h 2026-10-28 12:12:50.000000000 +0100 @@ -23,7 +23,7 @@ extern int rdii_menu(const char *title, const char *image, const char *image1, const char *image2, const char *device, const char *mdraid, const char *keymap, - bool preserve_ssh_hostkey); + bool preserve_ssh_hostkey, uint64_t minsize); static inline void cleanup_string_array(char ***p) { if (!p || !*p) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rdi-installer-1.2.1+git20261019.1a525f6/tests/meson.build new/rdi-installer-1.3.0/tests/meson.build --- old/rdi-installer-1.2.1+git20261019.1a525f6/tests/meson.build 2026-10-19 15:53:46.000000000 +0200 +++ new/rdi-installer-1.3.0/tests/meson.build 2026-10-28 12:12:50.000000000 +0100 @@ -9,6 +9,10 @@ shellcheck_exe, args: [files('../scripts/rdii-ssh-setup.sh')] ) +test('shellcheck-rdii-pubkey-setup', + shellcheck_exe, + args: [files('../scripts/rdii-pubkey-setup.sh')] +) test('shellcheck-mount-part-by-label', shellcheck_exe, args: [files('../scripts/mount-part-by-label.sh')] diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rdi-installer-1.2.1+git20261019.1a525f6/units/meson.build new/rdi-installer-1.3.0/units/meson.build --- old/rdi-installer-1.2.1+git20261019.1a525f6/units/meson.build 2026-10-19 15:53:46.000000000 +0200 +++ new/rdi-installer-1.3.0/units/meson.build 2026-10-28 12:12:50.000000000 +0100 @@ -2,6 +2,7 @@ install_data('rdii-set-default-loader-entry.service', install_dir : systemunitdir) install_data('rdii-proxy-setup.service', install_dir : systemunitdir) install_data('rdii-ssh-setup.service', install_dir : systemunitdir) +install_data('rdii-pubkey-setup.service', install_dir : systemunitdir) install_data('rdii-fetch-config.service', install_dir : systemunitdir) install_data('rdii-fetch-config-early.service', install_dir : systemunitdir) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rdi-installer-1.2.1+git20261019.1a525f6/units/rdii-pubkey-setup.service new/rdi-installer-1.3.0/units/rdii-pubkey-setup.service --- old/rdi-installer-1.2.1+git20261019.1a525f6/units/rdii-pubkey-setup.service 1970-01-01 01:00:00.000000000 +0100 +++ new/rdi-installer-1.3.0/units/rdii-pubkey-setup.service 2026-10-28 12:12:50.000000000 +0100 @@ -0,0 +1,15 @@ +[Unit] +Description=Import gpg public key(s) from Kernel Command Line or config file +After=local-fs.target +After=network-online.target +Wants=network-online.target +After=rdii-fetch-config.service +Before=getty.target + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/usr/bin/rdii-pubkey-setup + +[Install] +WantedBy=multi-user.target diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rdi-installer-1.2.1+git20261019.1a525f6/units/rdii-set-default-loader-entry.service new/rdi-installer-1.3.0/units/rdii-set-default-loader-entry.service --- old/rdi-installer-1.2.1+git20261019.1a525f6/units/rdii-set-default-loader-entry.service 2026-10-19 15:53:46.000000000 +0200 +++ new/rdi-installer-1.3.0/units/rdii-set-default-loader-entry.service 2026-10-28 12:12:50.000000000 +0100 @@ -2,6 +2,9 @@ Description=Set LoaderEntryDefault to booted entry Documentation=man:rdii-helper(8) +# On systems with read-only root filesystem, every +# update will set the default boot loader entry. +ConditionPathIsReadWrite=/ ConditionFirstBoot=yes After=local-fs.target @@ -11,4 +14,4 @@ ExecStart=rdii-helper set-default-loader-entry [Install] -WantedBy=multi-user.target \ No newline at end of file +WantedBy=multi-user.target
