`boot.initrd.preDeviceCommands` only runs in the script-based stage 1
and is gated on `!config.boot.initrd.systemd.enable`. Tests that
enable systemd initrd therefore never get `/tmp/secret.key` staged,
and disko's encrypted-filesystem mount hooks fail to find the
configured `passwordFile`.
The nixpkgs test driver was refactored: `driver.machines` is now a
computed property that returns a fresh sorted list combining
`driver.machines_qemu` and `driver.machines_nspawn`. Appending to the
property therefore mutates only the temporary returned list, so the
machines created via `create_test_machine` are no longer registered
with the driver.
This introduces what has been described in
https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-fido2-pkcs11-security-hardware-on-systemd-248.html.
That is: support for FIDO2 and recovery passphrases and their boot
mechanism.
Testing is hard right now because of canokey-qemu being broken and U2F
is not a valid replacement for FIDO2…
I tried to keep as much as possible the previous behavior and make it
possible to mix FIDO2 and normal passphrases or key files without any
problem.
PIV support is out of scope for this change but can easily be added.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
QEMU on aarch64 requires an explicit machine type (e.g., '-machine virt'),
unlike x86_64 which has a default. Previously, the test script hardcoded
'qemu-kvm' without machine type arguments, causing aarch64 tests to fail
with "No machine specified, and there is no default".
By importing and using nixpkgs' qemu-common.nix library, we reuse the
existing platform-specific QEMU configuration logic.
A config like
```nix
{
vdev = [
{
mode = "mirror";
members = [ "data1" "data2" ];
}
{
members = [ "data3" ];
}
];
}
```
would result in the following command:
```shell
zpool create -f <name> mirror /dev/data1 /dev/data2 /dev/data3
```
which would result in a single vdev with a 3-way mirror, rather than a
vdev with a 2-way mirror and a second vdev with a single disk. By
reordering the vdevs to handle those with an empty mode first we
transform this into:
```shell
zpool create -f <name> /dev/data3 mirror /dev/data1 /dev/data2
```
which does have the desired outcome.
The new confirmation dialogue is only shown for the new outputs
introduced in the previous commits. The existing outputs do not change
behavior to keep backwards compatibility.
Fixes#725
This adds new outpus like `format` and `formatNoDeps` which
are compatible with `nix run` so you can do something like
nix run .#nixosConfigurations.myhostname.config.system.build.formatNoDeps
as originally intended in #78, or add disko to your configuration like
environment.systemPackages = [
config.system.build.format
config.system.build.mount
config.system.build.destroyFormatMount
];
as mentioned in #454.
Fixes part of #454
Supersedes #78
It also deprecates mode `disko` in favor of the clearer
`destroy,format,mount` and adds `format,mount` to allow easier in-place
updates.
