##// END OF EJS Templates
Raspi2-3_GenImage
RSS

Cloner depuis https://github.com/drtyhlpr/rpi23-gen-image.git

Preconfigure Wifi...
Unknown -
r698:1d5e72bc7aa0
parent child
Show More
Show file before | Show file after | Hide comments
@@ -1,572 +1,611
1 1 # rpi23-gen-image
2 2 ## Introduction
3 3 `rpi23-gen-image.sh` is an advanced Debian Linux bootstrapping shell script for generating Debian OS images for all Raspberry Pi computers. The script at this time supports the bootstrapping of the Debian (armhf/armel) releases `stretch` and `buster`. Raspberry Pi 0/1/2/3/4 images are generated for 32-bit mode only. Raspberry Pi 3 supports 64-bit images that can be generated using custom configuration parameters (```templates/rpi3-stretch-arm64-4.14.y```).
4 4
5 5 ## Build dependencies
6 6 The following list of Debian packages must be installed on the build system because they are essentially required for the bootstrapping process. The script will check if all required packages are installed and missing packages will be installed automatically if confirmed by the user.
7 7
8 8 ```debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo```
9 9
10 10 It is recommended to configure the `rpi23-gen-image.sh` script to build and install the latest Raspberry Pi Linux kernel. For the Raspberry 3 this is mandatory. Kernel compilation and linking will be performed on the build system using an ARM (armhf/armel/aarch64) cross-compiler toolchain.
11 11
12 12 The script has been tested using the default `crossbuild-essential-armhf` and `crossbuild-essential-armel` toolchain meta packages on Debian Linux `stretch` build systems. Please check the [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains) for further information.
13 13
14 14 ## Command-line parameters
15 15 The script accepts certain command-line parameters to enable or disable specific OS features, services and configuration settings. These parameters are passed to the `rpi23-gen-image.sh` script via (simple) shell-variables. Unlike environment shell-variables (simple) shell-variables are defined at the beginning of the command-line call of the `rpi23-gen-image.sh` script.
16 16
17 17 ##### Command-line examples:
18 18 ```shell
19 19 ENABLE_UBOOT=true ./rpi23-gen-image.sh
20 20 ENABLE_CONSOLE=false ENABLE_IPV6=false ./rpi23-gen-image.sh
21 21 ENABLE_WM=xfce4 ENABLE_FBTURBO=true ENABLE_MINBASE=true ./rpi23-gen-image.sh
22 22 ENABLE_HARDNET=true ENABLE_IPTABLES=true /rpi23-gen-image.sh
23 23 APT_SERVER=ftp.de.debian.org APT_PROXY="http://127.0.0.1:3142/" ./rpi23-gen-image.sh
24 24 ENABLE_MINBASE=true ./rpi23-gen-image.sh
25 25 BUILD_KERNEL=true ENABLE_MINBASE=true ENABLE_IPV6=false ./rpi23-gen-image.sh
26 26 BUILD_KERNEL=true KERNELSRC_DIR=/tmp/linux ./rpi23-gen-image.sh
27 27 ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
28 28 ENABLE_CRYPTFS=true CRYPTFS_PASSWORD=changeme EXPANDROOT=false ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
29 29 RELEASE=stretch BUILD_KERNEL=true ./rpi23-gen-image.sh
30 30 RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
31 31 RELEASE=stretch RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
32 32 ```
33 33
34 34 ## Configuration template files
35 35 To avoid long lists of command-line parameters and to help to store the favourite parameter configurations the `rpi23-gen-image.sh` script supports so called configuration template files (`CONFIG_TEMPLATE`=template). These are simple text files located in the `./templates` directory that contain the list of configuration parameters that will be used. New configuration template files can be added to the `./templates` directory.
36 36
37 37 ##### Command-line examples:
38 38 ```shell
39 39 CONFIG_TEMPLATE=rpi3stretch ./rpi23-gen-image.sh
40 40 CONFIG_TEMPLATE=rpi2stretch ./rpi23-gen-image.sh
41 41 ```
42 42
43 43 ## Supported parameters and settings
44 44 #### APT settings:
45 45 ##### `APT_SERVER`="ftp.debian.org"
46 46 Set Debian packages server address. Choose a server from the list of Debian worldwide [mirror sites](https://www.debian.org/mirror/list). Using a nearby server will probably speed-up all required downloads within the bootstrapping process.
47 47
48 48 ##### `APT_PROXY`=""
49 49 Set Proxy server address. Using a local Proxy-Cache like `apt-cacher-ng` will speed-up the bootstrapping process because all required Debian packages will only be downloaded from the Debian mirror site once. If `apt-cacher-ng` is running on default `http://127.0.0.1:3142` it is autodetected and you don't need to set this.
50 50
51 51 ##### `KEEP_APT_PROXY`=false
52 52 Keep the APT_PROXY settings used in the bootsrapping process in the generated image.
53 53
54 54 ##### `APT_INCLUDES`=""
55 55 A comma-separated list of additional packages to be installed by debootstrap during bootstrapping.
56 56
57 57 ##### `APT_INCLUDES_LATE`=""
58 58 A comma-separated list of additional packages to be installed by apt after bootstrapping and after APT sources are set up. This is useful for packages with pre-depends, which debootstrap do not handle well.
59 59
60 60 ---
61 61
62 62 #### General system settings:
63 63 ##### `SET_ARCH`=32
64 64 Set Architecture to default 32bit. If you want to compile 64-bit (RPI3/RPI3+/RPI4) set it to `64`. This option will set every needed cross-compiler or board specific option for a successful build.
65 65
66 66 ##### `RPI_MODEL`=2
67 67 Specify the target Raspberry Pi hardware model. The script at this time supports the following Raspberry Pi models:
68 68 - `0` = Raspberry Pi 0 and Raspberry Pi 0 W
69 69 - `1` = Raspberry Pi 1 model A and B
70 70 - `1P` = Raspberry Pi 1 model B+ and A+
71 71 - `2` = Raspberry Pi 2 model B
72 72 - `3` = Raspberry Pi 3 model B
73 73 - `3P` = Raspberry Pi 3 model B+
74 74 - `4` = Raspberry Pi 4 model B
75 75
76 76 ##### `RELEASE`="buster"
77 77 Set the desired Debian release name. The script at this time supports the bootstrapping of the Debian releases `stretch` and `buster`.
78 78
79 79 ##### `RELEASE_ARCH`="armhf"
80 80 Set the desired Debian release architecture.
81 81
82 82 ##### `HOSTNAME`="rpi$RPI_MODEL-$RELEASE"
83 83 Set system hostname. It's recommended that the hostname is unique in the corresponding subnet.
84 84
85 85 ##### `PASSWORD`="raspberry"
86 86 Set system `root` password. It's **STRONGLY** recommended that you choose a custom password.
87 87
88 88 ##### `USER_PASSWORD`="raspberry"
89 89 Set password for the created non-root user `USER_NAME`=pi. Ignored if `ENABLE_USER`=false. It's **STRONGLY** recommended that you choose a custom password.
90 90
91 91 ##### `DEFLOCAL`="en_US.UTF-8"
92 92 Set default system locale. This setting can also be changed inside the running OS using the `dpkg-reconfigure locales` command. Please note that on using this parameter the script will automatically install the required packages `locales`, `keyboard-configuration` and `console-setup`.
93 93
94 94 ##### `TIMEZONE`="Europe/Berlin"
95 95 Set default system timezone. All available timezones can be found in the `/usr/share/zoneinfo/` directory. This setting can also be changed inside the running OS using the `dpkg-reconfigure tzdata` command.
96 96
97 97 ##### `EXPANDROOT`=true
98 98 Expand the root partition and filesystem automatically on first boot.
99 99
100 100 ##### `ENABLE_DPHYSSWAP`=true
101 101 Enable swap. The size of the swapfile is chosen relative to the size of the root partition. It'll use the `dphys-swapfile` package for that.
102 102
103 103 ##### `ENABLE_QEMU`=false
104 104 Generate kernel (`vexpress_defconfig`), file system image (`qcow2`) and DTB files that can be used for QEMU full system emulation (`vexpress-A15`). The output files are stored in the `$(pwd)/images/qemu` directory. You can find more information about running the generated image in the QEMU section of this readme file.
105 105
106 106 ---
107 107
108 108 #### Keyboard settings:
109 109 These options are used to configure keyboard layout in `/etc/default/keyboard` for console and Xorg. These settings can also be changed inside the running OS using the `dpkg-reconfigure keyboard-configuration` command.
110 110
111 111 ##### `XKB_MODEL`=""
112 112 Set the name of the model of your keyboard type.
113 113
114 114 ##### `XKB_LAYOUT`=""
115 115 Set the supported keyboard layout(s).
116 116
117 117 ##### `XKB_VARIANT`=""
118 118 Set the supported variant(s) of the keyboard layout(s).
119 119
120 120 ##### `XKB_OPTIONS`=""
121 121 Set extra xkb configuration options.
122 122
123 123 ---
124 124
125 125 #### Networking settings (DHCP):
126 This parameter is used to set up networking auto-configuration in `/etc/systemd/network/eth.network`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.`
126 This parameter `ENABLE_ETH_DHCP` is used to set up networking auto-configuration in `/etc/systemd/network/eth0.network`. This parameter `ENABLE_WIFI_DHCP` is used to set up networking auto-configuration in `/etc/systemd/network/wlan0.network`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.`
127 127
128 ##### `ENABLE_DHCP`=true
128 ##### `ENABLE_ETH_DHCP`=true
129 129 Set the system to use DHCP. This requires an DHCP server.
130 130
131 ##### `ENABLE_WIFI_DHCP`=true
132 Set the system to use DHCP. This requires an DHCP server.
133
134 ---
135
136 #### Networking settings (ethernet static):
137 These parameters are used to set up a static networking configuration in `/etc/systemd/network/eth0.network`. The following static networking parameters are only supported if `ENABLE_ETH_DHCP` was set to `false`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.
138
139 ##### `NET_ETH_ADDRESS`=""
140 Set a static IPv4 or IPv6 address and its prefix, separated by "/", eg. "192.169.0.3/24".
141
142 ##### `NET_ETH_GATEWAY`=""
143 Set the IP address for the default gateway.
144
145 ##### `NET_ETH_DNS_1`=""
146 Set the IP address for the first DNS server.
147
148 ##### `NET_ETH_DNS_2`=""
149 Set the IP address for the second DNS server.
150
151 ##### `NET_ETH_DNS_DOMAINS`=""
152 Set the default DNS search domains to use for non fully qualified hostnames.
153
154 ##### `NET_ETH_NTP_1`=""
155 Set the IP address for the first NTP server.
156
157 ##### `NET_ETH_NTP_2`=""
158 Set the IP address for the second NTP server.
159
160 ---
161
162 #### Networking settings (WIFI):
163
164 ##### `NET_WIFI_SSID`=""
165 Set to your WIFI SSID
166
167 ##### `NET_WIFI_WPAPSK`=""
168 Set your WPA/WPA2 PSK
169
131 170 ---
132 171
133 #### Networking settings (static):
134 These parameters are used to set up a static networking configuration in `/etc/systemd/network/eth.network`. The following static networking parameters are only supported if `ENABLE_DHCP` was set to `false`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.
172 #### Networking settings (WIFI static):
173 These parameters are used to set up a static networking configuration in `/etc/systemd/network/wlan0.network`. The following static networking parameters are only supported if `ENABLE_WIFI_DHCP` was set to `false`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.
135 174
136 ##### `NET_ADDRESS`=""
175 ##### `NET_WIFI_ADDRESS`=""
137 176 Set a static IPv4 or IPv6 address and its prefix, separated by "/", eg. "192.169.0.3/24".
138 177
139 ##### `NET_GATEWAY`=""
178 ##### `NET_WIFI_GATEWAY`=""
140 179 Set the IP address for the default gateway.
141 180
142 ##### `NET_DNS_1`=""
181 ##### `NET_WIFI_DNS_1`=""
143 182 Set the IP address for the first DNS server.
144 183
145 ##### `NET_DNS_2`=""
184 ##### `NET_WIFI_DNS_2`=""
146 185 Set the IP address for the second DNS server.
147 186
148 ##### `NET_DNS_DOMAINS`=""
187 ##### `NET_WIFI_DNS_DOMAINS`=""
149 188 Set the default DNS search domains to use for non fully qualified hostnames.
150 189
151 ##### `NET_NTP_1`=""
190 ##### `NET_WIFI_NTP_1`=""
152 191 Set the IP address for the first NTP server.
153 192
154 ##### `NET_NTP_2`=""
193 ##### `NET_WIFI_NTP_2`=""
155 194 Set the IP address for the second NTP server.
156 195
157 196 ---
158 197
159 198 #### Basic system features:
160 199 ##### `ENABLE_CONSOLE`=true
161 200 Enable serial console interface. Recommended if no monitor or keyboard is connected to the RPi2/3. In case of problems fe. if the network (auto) configuration failed - the serial console can be used to access the system. On RPI `0` `3` `3P` the CPU speed is locked at lowest speed.
162 201
163 202 ##### `ENABLE_PRINTK`=false
164 203 Enables printing kernel messages to konsole. printk is `3 4 1 3` as in raspbian.
165 204
166 205 ##### `ENABLE_BLUETOOTH`=false
167 206 Enable onboard Bluetooth interface on the RPi0/3/3P. See: [Configuring the GPIO serial port on Raspbian jessie and stretch](https://spellfoundry.com/2016/05/29/configuring-gpio-serial-port-raspbian-jessie-including-pi-3/).
168 207
169 208 ##### `ENABLE_MINIUART_OVERLAY`=false
170 209 Enable Bluetooth to use this. Adds overlay to swap UART0 with UART1. Enabling (slower) Bluetooth and full speed serial console. - RPI `0` `3` `3P` have a fast `hardware UART0` (ttyAMA0) and a `mini UART1` (ttyS0)! RPI `1` `1P` `2` only have a `hardware UART0`. `UART0` is considered better, because is faster and more stable than `mini UART1`. By default the Bluetooth modem is mapped to the `hardware UART0` and `mini UART` is used for console. The `mini UART` is a problem for the serial console, because its baudrate depends on the CPU frequency, which is changing on runtime. Resulting in a volatile baudrate and thus in an unusable serial console.
171 210
172 211 ##### `ENABLE_TURBO`=false
173 212 Enable Turbo mode. This setting locks cpu at the highest frequency. As setting ENABLE_CONSOLE=true locks RPI to lowest CPU speed, this is can be used additionally to lock cpu hat max speed. Need a good power supply and probably cooling for the Raspberry PI.
174 213
175 214 ##### `ENABLE_I2C`=false
176 215 Enable I2C interface on the RPi 0/1/2/3. Please check the [RPi 0/1/2/3 pinout diagrams](https://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
177 216
178 217 ##### `ENABLE_SPI`=false
179 218 Enable SPI interface on the RPi 0/1/2/3. Please check the [RPi 0/1/2/3 pinout diagrams](https://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
180 219
181 220 ##### `ENABLE_IPV6`=true
182 221 Enable IPv6 support. The network interface configuration is managed via systemd-networkd.
183 222
184 223 ##### `ENABLE_SSHD`=true
185 224 Install and enable OpenSSH service. The default configuration of the service doesn't allow `root` to login. Please use the user `pi` instead and `su -` or `sudo` to execute commands as root.
186 225
187 226 ##### `ENABLE_NONFREE`=false
188 227 Allow the installation of non-free Debian packages that do not comply with the DFSG. This is required to install closed-source firmware binary blobs.
189 228
190 229 ##### `ENABLE_WIRELESS`=false
191 Download and install the [closed-source firmware binary blob](https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm) that is required to run the internal wireless interface of the Raspberry Pi model `3`. This parameter is ignored if the specified `RPI_MODEL` is not `3`.
230 Download and install the [closed-source firmware binary blob](https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm) that is required to run the internal wireless interface of the Raspberry Pi model `3`. This parameter is ignored if the specified `RPI_MODEL` is not `0`,`3`,`3P`,`4`.
192 231
193 232 ##### `ENABLE_RSYSLOG`=true
194 233 If set to false, disable and uninstall rsyslog (so logs will be available only in journal files)
195 234
196 235 ##### `ENABLE_SOUND`=true
197 236 Enable sound hardware and install Advanced Linux Sound Architecture.
198 237
199 238 ##### `ENABLE_HWRANDOM`=true
200 239 Enable Hardware Random Number Generator. Strong random numbers are important for most network-based communications that use encryption. It's recommended to be enabled.
201 240
202 241 ##### `ENABLE_MINGPU`=false
203 242 Minimize the amount of shared memory reserved for the GPU. It doesn't seem to be possible to fully disable the GPU.
204 243
205 244 ##### `ENABLE_DBUS`=true
206 245 Install and enable D-Bus message bus. Please note that systemd should work without D-bus but it's recommended to be enabled.
207 246
208 247 ##### `ENABLE_XORG`=false
209 248 Install Xorg open-source X Window System.
210 249
211 250 ##### `ENABLE_WM`=""
212 251 Install a user-defined window manager for the X Window System. To make sure all X related package dependencies are getting installed `ENABLE_XORG` will automatically get enabled if `ENABLE_WM` is used. The `rpi23-gen-image.sh` script has been tested with the following list of window managers: `blackbox`, `openbox`, `fluxbox`, `jwm`, `dwm`, `xfce4`, `awesome`.
213 252
214 253 ##### `ENABLE_SYSVINIT`=false
215 254 Support for halt,init,poweroff,reboot,runlevel,shutdown,telinit commands
216 255
217 256 ---
218 257
219 258 #### Advanced system features:
220 259 ##### `ENABLE_KEYGEN`=false
221 260 Recover your lost codec license
222 261
223 262 ##### `ENABLE_SYSTEMDSWAP`=false
224 263 Enables [Systemd-swap service](https://github.com/Nefelim4ag/systemd-swap). Usefull if `KERNEL_ZSWAP` is enabled.
225 264
226 265 ##### `ENABLE_MINBASE`=false
227 266 Use debootstrap script variant `minbase` which only includes essential packages and apt. This will reduce the disk usage by about 65 MB.
228 267
229 268 ##### `ENABLE_REDUCE`=false
230 269 Reduce the disk space usage by deleting packages and files. See `REDUCE_*` parameters for detailed information.
231 270
232 271 ##### `ENABLE_UBOOT`=false
233 272 Replace the default RPi 0/1/2/3 second stage bootloader (bootcode.bin) with [U-Boot bootloader](https://git.denx.de/?p=u-boot.git;a=summary). U-Boot can boot images via the network using the BOOTP/TFTP protocol.
234 273 RPI4 needs tbd
235 274
236 275 ##### `UBOOTSRC_DIR`=""
237 276 Path to a directory (`u-boot`) of [U-Boot bootloader sources](https://git.denx.de/?p=u-boot.git;a=summary) that will be copied, configured, build and installed inside the chroot.
238 277
239 278 ##### `ENABLE_FBTURBO`=false
240 279 Install and enable the [hardware accelerated Xorg video driver](https://github.com/ssvb/xf86-video-fbturbo) `fbturbo`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling.
241 280
242 281 ##### `FBTURBOSRC_DIR`=""
243 282 Path to a directory (`xf86-video-fbturbo`) of [hardware accelerated Xorg video driver sources](https://github.com/ssvb/xf86-video-fbturbo) that will be copied, configured, build and installed inside the chroot.
244 283
245 284 ##### `ENABLE_VIDEOCORE`=false
246 285 Install and enable the [ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) `vcgencmd`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling.
247 286
248 287 ##### `VIDEOCORESRC_DIR`=""
249 288 Path to a directory (`userland`) of [ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) that will be copied, configured, build and installed inside the chroot.
250 289
251 290 ##### `ENABLE_NEXMON`=false
252 291 Install and enable the [Source code for a C-based firmware patching framework for Broadcom/Cypress WiFi chips that enables you to write your own firmware patches, for example, to enable monitor mode with radiotap headers and frame injection](https://github.com/seemoo-lab/nexmon.git).
253 292
254 293 ##### `NEXMONSRC_DIR`=""
255 294 Path to a directory (`nexmon`) of [Source code for ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) that will be copied, configured, build and installed inside the chroot.
256 295
257 296 ##### `ENABLE_IPTABLES`=false
258 297 Enable iptables IPv4/IPv6 firewall. Simplified ruleset: Allow all outgoing connections. Block all incoming connections except to OpenSSH service.
259 298
260 299 ##### `ENABLE_USER`=true
261 300 Create non-root user with password `USER_PASSWORD`=raspberry. Unless overridden with `USER_NAME`=user, the username will be `pi`.
262 301
263 302 ##### `USER_NAME`=pi
264 303 Non-root user to create. Ignored if `ENABLE_USER`=false
265 304
266 305 ##### `ENABLE_ROOT`=false
267 306 Set root user password so root login will be enabled
268 307
269 308 ##### `ENABLE_HARDNET`=false
270 309 Enable IPv4/IPv6 network stack hardening settings.
271 310
272 311 ##### `ENABLE_SPLITFS`=false
273 312 Enable having root partition on an USB drive by creating two image files: one for the `/boot/firmware` mount point, and another for `/`.
274 313
275 314 ##### `CHROOT_SCRIPTS`=""
276 315 Path to a directory with scripts that should be run in the chroot before the image is finally built. Every executable file in this directory is run in lexicographical order.
277 316
278 317 ##### `ENABLE_INITRAMFS`=false
279 318 Create an initramfs that that will be loaded during the Linux startup process. `ENABLE_INITRAMFS` will automatically get enabled if `ENABLE_CRYPTFS`=true. This parameter will be ignored if `BUILD_KERNEL`=false.
280 319
281 320 ##### `ENABLE_IFNAMES`=true
282 321 Enable automatic assignment of predictable, stable network interface names for all local Ethernet, WLAN interfaces. This might create complex and long interface names.
283 322
284 323 ##### `ENABLE_SPLASH`=true
285 324 Enable default Raspberry Pi boot up rainbow splash screen.
286 325
287 326 ##### `ENABLE_LOGO`=true
288 327 Enable default Raspberry Pi console logo (image of four raspberries in the top left corner).
289 328
290 329 ##### `ENABLE_SILENT_BOOT`=false
291 330 Set the verbosity of console messages shown during boot up to a strict minimum.
292 331
293 332 ##### `DISABLE_UNDERVOLT_WARNINGS`=
294 333 Disable RPi2/3 under-voltage warnings and overlays. Setting the parameter to `1` will disable the warning overlay. Setting it to `2` will additionally allow RPi2/3 turbo mode when low-voltage is present.
295 334
296 335 ---
297 336
298 337 #### SSH settings:
299 338 ##### `SSH_ENABLE_ROOT`=false
300 339 Enable password-based root login via SSH. This may be a security risk with the default password set, use only in trusted environments. `ENABLE_ROOT` must be set to `true`.
301 340
302 341 ##### `SSH_DISABLE_PASSWORD_AUTH`=false
303 342 Disable password-based SSH authentication. Only public key based SSH (v2) authentication will be supported.
304 343
305 344 ##### `SSH_LIMIT_USERS`=false
306 345 Limit the users that are allowed to login via SSH. Only allow user `USER_NAME`=pi and root if `SSH_ENABLE_ROOT`=true to login. This parameter will be ignored if `dropbear` SSH is used (`REDUCE_SSHD`=true).
307 346
308 347 ##### `SSH_ROOT_PUB_KEY`=""
309 348 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `root`. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported. `ENABLE_ROOT` **and** `SSH_ENABLE_ROOT` must be set to `true`.
310 349
311 350 ##### `SSH_USER_PUB_KEY`=""
312 351 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `USER_NAME`=pi. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported.
313 352
314 353 ---
315 354
316 355 #### Kernel compilation:
317 356 ##### `BUILD_KERNEL`=true
318 357 Build and install the latest RPi 0/1/2/3/4 Linux kernel. The default RPi 0/1/2/3/ kernel configuration is used most of the time.
319 358 ENABLE_NEXMON - Changes Kernel Source to [https://github.com/Re4son/](Kali Linux Kernel)
320 359 Precompiled 32bit kernel for RPI0/1/2/3 by [https://github.com/hypriot/](hypriot)
321 360 Precompiled 64bit kernel for RPI3/4 by [https://github.com/sakaki-/](sakaki)
322 361
323 362
324 363 ##### `CROSS_COMPILE`="arm-linux-gnueabihf-"
325 364 This sets the cross-compile environment for the compiler.
326 365
327 366 ##### `KERNEL_ARCH`="arm"
328 367 This sets the kernel architecture for the compiler.
329 368
330 369 ##### `KERNEL_IMAGE`="kernel7.img"
331 370 Name of the image file in the boot partition. If not set, `KERNEL_IMAGE` will be set to "kernel8.img" automatically if building for arm64.
332 371
333 372 ##### `KERNEL_BRANCH`=""
334 373 Name of the requested branch from the GIT location for the RPi Kernel. Default is using the current default branch from the GIT site.
335 374
336 375 ##### `QEMU_BINARY`="/usr/bin/qemu-arm-static"
337 376 Sets the QEMU enviornment for the Debian archive. If not set, `QEMU_BINARY` will be set to "/usr/bin/qemu-aarch64-static" automatically if building for arm64.
338 377
339 378 ##### `KERNEL_DEFCONFIG`="bcm2709_defconfig"
340 379 Sets the default config for kernel compiling. If not set, `KERNEL_DEFCONFIG` will be set to "bcmrpi3\_defconfig" automatically if building for arm64.
341 380
342 381 ##### `KERNEL_REDUCE`=false
343 382 Reduce the size of the generated kernel by removing unwanted devices, network and filesystem drivers (experimental).
344 383
345 384 ##### `KERNEL_THREADS`=1
346 385 Number of parallel kernel building threads. If the parameter is left untouched the script will automatically determine the number of CPU cores to set the number of parallel threads to speed the kernel compilation.
347 386
348 387 ##### `KERNEL_HEADERS`=true
349 388 Install kernel headers with the built kernel.
350 389
351 390 ##### `KERNEL_MENUCONFIG`=false
352 391 Start `make menuconfig` interactive menu-driven kernel configuration. The script will continue after `make menuconfig` was terminated.
353 392
354 393 ##### `KERNEL_OLDDEFCONFIG`=false
355 394 Run `make olddefconfig` to automatically set all new kernel configuration options to their recommended default values.
356 395
357 396 ##### `KERNEL_CCACHE`=false
358 397 Compile the kernel using ccache. This speeds up kernel recompilation by caching previous compilations and detecting when the same compilation is being done again.
359 398
360 399 ##### `KERNEL_REMOVESRC`=true
361 400 Remove all kernel sources from the generated OS image after it was built and installed.
362 401
363 402 ##### `KERNELSRC_DIR`=""
364 403 Path to a directory (`linux`) of [RaspberryPi Linux kernel sources](https://github.com/raspberrypi/linux) that will be copied, configured, build and installed inside the chroot.
365 404
366 405 ##### `KERNELSRC_CLEAN`=false
367 406 Clean the existing kernel sources directory `KERNELSRC_DIR` (using `make mrproper`) after it was copied to the chroot and before the compilation of the kernel has started. This parameter will be ignored if no `KERNELSRC_DIR` was specified or if `KERNELSRC_PREBUILT`=true.
368 407
369 408 ##### `KERNELSRC_CONFIG`=true
370 409 Run `make bcm2709_defconfig` (and optional `make menuconfig`) to configure the kernel sources before building. This parameter is automatically set to `true` if no existing kernel sources directory was specified using `KERNELSRC_DIR`. This parameter is ignored if `KERNELSRC_PREBUILT`=true.
371 410
372 411 ##### `KERNELSRC_USRCONFIG`=""
373 412 Copy own config file to kernel `.config`. If `KERNEL_MENUCONFIG`=true then running after copy.
374 413
375 414 ##### `KERNELSRC_PREBUILT`=false
376 415 With this parameter set to true the script expects the existing kernel sources directory to be already successfully cross-compiled. The parameters `KERNELSRC_CLEAN`, `KERNELSRC_CONFIG`, `KERNELSRC_USRCONFIG` and `KERNEL_MENUCONFIG` are ignored and no kernel compilation tasks are performed.
377 416
378 417 ##### `RPI_FIRMWARE_DIR`=""
379 418 The directory (`firmware`) containing a local copy of the firmware from the [RaspberryPi firmware project](https://github.com/raspberrypi/firmware). Default is to download the latest firmware directly from the project.
380 419
381 420 ##### `KERNEL_DEFAULT_GOV`="ONDEMAND"
382 421 Set the default cpu governor at kernel compilation. Supported values are: PERFORMANCE POWERSAVE USERSPACE ONDEMAND CONSERVATIVE SCHEDUTIL
383 422
384 423 ##### `KERNEL_NF`=false
385 424 Enable Netfilter modules as kernel modules
386 425
387 426 ##### `KERNEL_VIRT`=false
388 427 Enable Kernel KVM support (/dev/kvm)
389 428
390 429 ##### `KERNEL_ZSWAP`=false
391 430 Enable Kernel Zswap support. Best use on high RAM load and mediocre CPU load usecases
392 431
393 432 ##### `KERNEL_BPF`=true
394 433 Allow attaching eBPF programs to a cgroup using the bpf syscall (CONFIG_BPF_SYSCALL CONFIG_CGROUP_BPF) [systemd compilations about it - File /lib/systemd/system/systemd-journald.server:36 configures an IP firewall (IPAddressDeny=all), but the local system does not support BPF/cgroup based firewalls]
395 434
396 435 ##### `KERNEL_SECURITY`=false
397 436 Enables Apparmor, integrity subsystem, auditing.
398 437
399 438 ##### `KERNEL_BTRFS`="false"
400 439 enable btrfs kernel support
401 440
402 441 ##### `KERNEL_POEHAT`="false"
403 442 enable Enable RPI POE HAT fan kernel support
404 443
405 444 ##### `KERNEL_NSPAWN`="false"
406 445 Enable per-interface network priority control - for systemd-nspawn
407 446
408 447 ##### `KERNEL_DHKEY`="true"
409 448 Diffie-Hellman operations on retained keys - required for >keyutils-1.6
410 449
411 450 ---
412 451
413 452 #### Reduce disk usage:
414 453 The following list of parameters is ignored if `ENABLE_REDUCE`=false.
415 454
416 455 ##### `REDUCE_APT`=true
417 456 Configure APT to use compressed package repository lists and no package caching files.
418 457
419 458 ##### `REDUCE_DOC`=true
420 459 Remove all doc files (harsh). Configure APT to not include doc files on future `apt-get` package installations.
421 460
422 461 ##### `REDUCE_MAN`=true
423 462 Remove all man pages and info files (harsh). Configure APT to not include man pages on future `apt-get` package installations.
424 463
425 464 ##### `REDUCE_VIM`=false
426 465 Replace `vim-tiny` package by `levee` a tiny vim clone.
427 466
428 467 ##### `REDUCE_BASH`=false
429 468 Remove `bash` package and switch to `dash` shell (experimental).
430 469
431 470 ##### `REDUCE_HWDB`=true
432 471 Remove PCI related hwdb files (experimental).
433 472
434 473 ##### `REDUCE_SSHD`=true
435 474 Replace `openssh-server` with `dropbear`.
436 475
437 476 ##### `REDUCE_LOCALE`=true
438 477 Remove all `locale` translation files.
439 478
440 479 ---
441 480
442 481 #### Encrypted root partition:
443 482 ##### `ENABLE_CRYPTFS`=false
444 483 Enable full system encryption with dm-crypt. Setup a fully LUKS encrypted root partition (aes-xts-plain64:sha512) and generate required initramfs. The /boot directory will not be encrypted. This parameter will be ignored if `BUILD_KERNEL`=false. `ENABLE_CRYPTFS` is experimental. SSH-to-initramfs is currently not supported but will be soon - feel free to help.
445 484
446 485 ##### `CRYPTFS_PASSWORD`=""
447 486 Set password of the encrypted root partition. This parameter is mandatory if `ENABLE_CRYPTFS`=true.
448 487
449 488 ##### `CRYPTFS_MAPPING`="secure"
450 489 Set name of dm-crypt managed device-mapper mapping.
451 490
452 491 ##### `CRYPTFS_CIPHER`="aes-xts-plain64"
453 492 Set cipher specification string. `aes-xts*` ciphers are strongly recommended.
454 493
455 494 ##### `CRYPTFS_HASH`=sha512
456 495 Hash function and size to be used
457 496
458 497 ##### `CRYPTFS_XTSKEYSIZE`=512
459 498 Sets key size in bits. The argument has to be a multiple of 8.
460 499
461 500 ##### `CRYPTFS_DROPBEAR`=false
462 501 Enable Dropbear Initramfs support
463 502
464 503 ##### `CRYPTFS_DROPBEAR_PUBKEY`=""
465 504 Provide path to dropbear Public RSA-OpenSSH Key
466 505
467 506 ---
468 507
469 508 #### Build settings:
470 509 ##### `BASEDIR`=$(pwd)/images/${RELEASE}
471 510 Set a path to a working directory used by the script to generate an image.
472 511
473 512 ##### `IMAGE_NAME`=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}
474 513 Set a filename for the output file(s). Note: the script will create $IMAGE_NAME.img if `ENABLE_SPLITFS`=false or $IMAGE_NAME-frmw.img and $IMAGE_NAME-root.img if `ENABLE_SPLITFS`=true. Note 2: If the KERNEL_BRANCH is not set, the word "CURRENT" is used.
475 514
476 515 ## Understanding the script
477 516 The functions of this script that are required for the different stages of the bootstrapping are split up into single files located inside the `bootstrap.d` directory. During the bootstrapping every script in this directory gets executed in lexicographical order:
478 517
479 518 | Script | Description |
480 519 | --- | --- |
481 520 | `10-bootstrap.sh` | Debootstrap basic system |
482 521 | `11-apt.sh` | Setup APT repositories |
483 522 | `12-locale.sh` | Setup Locales and keyboard settings |
484 523 | `13-kernel.sh` | Build and install RPi 0/1/2/3 Kernel |
485 524 | `14-fstab.sh` | Setup fstab and initramfs |
486 525 | `15-rpi-config.sh` | Setup RPi 0/1/2/3 config and cmdline |
487 526 | `20-networking.sh` | Setup Networking |
488 527 | `21-firewall.sh` | Setup Firewall |
489 528 | `30-security.sh` | Setup Users and Security settings |
490 529 | `31-logging.sh` | Setup Logging |
491 530 | `32-sshd.sh` | Setup SSH and public keys |
492 531 | `41-uboot.sh` | Build and Setup U-Boot |
493 532 | `42-fbturbo.sh` | Build and Setup fbturbo Xorg driver |
494 533 | `43-videocore.sh` | Build and Setup videocore libraries |
495 534 | `50-firstboot.sh` | First boot actions |
496 535 | `99-reduce.sh` | Reduce the disk space usage |
497 536
498 537 All the required configuration files that will be copied to the generated OS image are located inside the `files` directory. It is not recommended to modify these configuration files manually.
499 538
500 539 | Directory | Description |
501 540 | --- | --- |
502 541 | `apt` | APT management configuration files |
503 542 | `boot` | Boot and RPi 0/1/2/3 configuration files |
504 543 | `dpkg` | Package Manager configuration |
505 544 | `etc` | Configuration files and rc scripts |
506 545 | `firstboot` | Scripts that get executed on first boot |
507 546 | `initramfs` | Initramfs scripts |
508 547 | `iptables` | Firewall configuration files |
509 548 | `locales` | Locales configuration |
510 549 | `modules` | Kernel Modules configuration |
511 550 | `mount` | Fstab configuration |
512 551 | `network` | Networking configuration files |
513 552 | `sysctl.d` | Swapping and Network Hardening configuration |
514 553 | `xorg` | fbturbo Xorg driver configuration |
515 554
516 555 ## Custom packages and scripts
517 556 Debian custom packages, i.e. those not in the debian repositories, can be installed by placing them in the `packages` directory. They are installed immediately after packages from the repositories are installed. Any dependencies listed in the custom packages will be downloaded automatically from the repositories. Do not list these custom packages in `APT_INCLUDES`.
518 557
519 558 Scripts in the custom.d directory will be executed after all other installation is complete but before the image is created.
520 559
521 560 ## Logging of the bootstrapping process
522 561 All information related to the bootstrapping process and the commands executed by the `rpi23-gen-image.sh` script can easily be saved into a logfile. The common shell command `script` can be used for this purpose:
523 562
524 563 ```shell
525 564 script -c 'APT_SERVER=ftp.de.debian.org ./rpi23-gen-image.sh' ./build.log
526 565 ```
527 566
528 567 ## Flashing the image file
529 568 After the image file was successfully created by the `rpi23-gen-image.sh` script it can be copied to the microSD card that will be used by the RPi 0/1/2/3 computer. This can be performed by using the tools `bmaptool` or `dd`. Using `bmaptool` will probably speed-up the copy process because `bmaptool` copies more wisely than `dd`.
530 569
531 570 ##### Flashing examples:
532 571 ```shell
533 572 bmaptool copy ./images/buster/2017-01-23-rpi3-buster.img /dev/mmcblk0
534 573 dd bs=4M if=./images/buster/2017-01-23-rpi3-buster.img of=/dev/mmcblk0
535 574 ```
536 575 If you have set `ENABLE_SPLITFS`, copy the `-frmw` image on the microSD card, then the `-root` one on the USB drive:
537 576 ```shell
538 577 bmaptool copy ./images/buster/2017-01-23-rpi3-buster-frmw.img /dev/mmcblk0
539 578 bmaptool copy ./images/buster/2017-01-23-rpi3-buster-root.img /dev/sdc
540 579 ```
541 580
542 581 ## QEMU emulation
543 582 Start QEMU full system emulation:
544 583 ```shell
545 584 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=tty1"
546 585 ```
547 586
548 587 Start QEMU full system emulation and output to console:
549 588 ```shell
550 589 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
551 590 ```
552 591
553 592 Start QEMU full system emulation with SMP and output to console:
554 593 ```shell
555 594 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -smp cpus=2,maxcpus=2 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
556 595 ```
557 596
558 597 Start QEMU full system emulation with cryptfs, initramfs and output to console:
559 598 ```shell
560 599 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -initrd "initramfs-${KERNEL_VERSION}" -append "root=/dev/mapper/secure cryptdevice=/dev/mmcblk0p2:secure rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
561 600 ```
562 601
563 602 ## External links and references
564 603 * [Debian worldwide mirror sites](https://www.debian.org/mirror/list)
565 604 * [Debian Raspberry Pi 2 Wiki](https://wiki.debian.org/RaspberryPi2)
566 605 * [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains)
567 606 * [Official Raspberry Pi Firmware on github](https://github.com/raspberrypi/firmware)
568 607 * [Official Raspberry Pi Kernel on github](https://github.com/raspberrypi/linux)
569 608 * [U-BOOT git repository](https://git.denx.de/?p=u-boot.git;a=summary)
570 609 * [Xorg DDX driver fbturbo](https://github.com/ssvb/xf86-video-fbturbo)
571 610 * [RPi3 Wireless interface firmware](https://github.com/RPi-Distro/firmware-nonfree/tree/master/brcm)
572 611 * [Collabora RPi2 Kernel precompiled](https://repositories.collabora.co.uk/debian/)
Show file before | Show file after | Hide comments
@@ -1,120 +1,120
1 1 #
2 2 # Setup fstab and initramfs
3 3 #
4 4
5 5 # Load utility functions
6 6 . ./functions.sh
7 7
8 8 # Install and setup fstab
9 9 install_readonly files/mount/fstab "${ETC_DIR}/fstab"
10 10
11 11 # Generate initramfs file
12 12 if [ "$ENABLE_INITRAMFS" = true ] ; then
13 13 if [ "$ENABLE_CRYPTFS" = true ] ; then
14 14
15 15 # Include initramfs scripts to auto expand encrypted root partition
16 16 if [ "$EXPANDROOT" = true ] ; then
17 17 install_exec files/initramfs/expand_encrypted_rootfs "${ETC_DIR}/initramfs-tools/scripts/init-premount/expand_encrypted_rootfs"
18 18 install_exec files/initramfs/expand-premount "${ETC_DIR}/initramfs-tools/scripts/local-premount/expand-premount"
19 19 install_exec files/initramfs/expand-tools "${ETC_DIR}/initramfs-tools/hooks/expand-tools"
20 20 fi
21 21
22 22 # Replace fstab root partition with encrypted partition mapping
23 23 sed -i "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING}/" "${ETC_DIR}/fstab"
24 24
25 25 # Add encrypted partition to crypttab and fstab
26 26 install_readonly files/mount/crypttab "${ETC_DIR}/crypttab"
27 27 echo "${CRYPTFS_MAPPING} /dev/mmcblk0p2 none luks,initramfs" >> "${ETC_DIR}/crypttab"
28 28
29 29 if [ "$ENABLE_USBBOOT" = true ] && [ "$ENABLE_SPLITFS" = false ]; then
30 30 sed -i "s/mmcblk0p1/sda1/" "${ETC_DIR}/fstab"
31 31 # Add usb/sda2 disk to crypttab
32 32 sed -i "s/mmcblk0p2/sda2/" "${ETC_DIR}/crypttab"
33 33 fi
34 34
35 35 # Add encrypted root partition to fstab and crypttab
36 36 if [ "$ENABLE_SPLITFS" = true ] && [ "$ENABLE_USBBOOT" = false ]; then
37 37 # Add usb/sda1 disk to crypttab
38 38 sed -i "s/mmcblk0p2/sda1/" "${ETC_DIR}/crypttab"
39 39 fi
40 40
41 41 if [ "$CRYPTFS_DROPBEAR" = true ] ; then
42 if [ "$ENABLE_DHCP" = false ] ; then
42 if [ "$ENABLE_ETH_DHCP" = false ] ; then
43 43 # Get cdir from NET_ADDRESS e.g. 24
44 cdir=$(printf "%s" "${NET_ADDRESS}" | cut -d '/' -f2)
44 cdir=$(printf "%s" "${NET_ETH_ADDRESS}" | cut -d '/' -f2)
45 45
46 46 # Convert cdir ro netmask e.g. 24 to 255.255.255.0
47 47 NET_MASK=$(cdr2mask "$cdir")
48 48
49 49 # Write static ip settings to "${ETC_DIR}"/initramfs-tools/initramfs.conf
50 50 # ip=<client-ip>:<server-ip>:<gw-ip>:<netmask>:<hostname>:<device>:<autoconf>
51 sed -i "\$a\nIP=${NET_ADDRESS}::${NET_GATEWAY}:${NET_MASK}:${HOSTNAME}:" "${ETC_DIR}"/initramfs-tools/initramfs.conf
51 sed -i "\$a\nIP=${NET_ETH_ADDRESS}::${NET_ETH_GATEWAY}:${NET_MASK}:${HOSTNAME}:" "${ETC_DIR}"/initramfs-tools/initramfs.conf
52 52 else
53 53 sed -i "\$a\nIP=::::${HOSTNAME}::dhcp" "${ETC_DIR}"/initramfs-tools/initramfs.conf
54 54 fi
55 55
56 56 if [ -n "$CRYPTFS_DROPBEAR_PUBKEY" ] && [ -f "$CRYPTFS_DROPBEAR_PUBKEY" ] ; then
57 57 install_readonly "${CRYPTFS_DROPBEAR_PUBKEY}" "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
58 58 cat "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub >> "${ETC_DIR}"/dropbear-initramfs/authorized_keys
59 59 else
60 60 # Create key
61 61 chroot_exec /usr/bin/dropbearkey -t rsa -f /etc/dropbear-initramfs/id_rsa.dropbear
62 62
63 63 # Convert dropbear key to openssh key
64 64 chroot_exec /usr/lib/dropbear/dropbearconvert dropbear openssh /etc/dropbear-initramfs/id_rsa.dropbear /etc/dropbear-initramfs/id_rsa
65 65
66 66 # Get Public Key Part
67 67 chroot_exec /usr/bin/dropbearkey -y -f /etc/dropbear-initramfs/id_rsa.dropbear | chroot_exec tee /etc/dropbear-initramfs/id_rsa.pub
68 68
69 69 # Delete unwanted lines
70 70 sed -i '/Public/d' "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
71 71 sed -i '/Fingerprint/d' "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
72 72
73 73 # Trust the new key
74 74 cat "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub > "${ETC_DIR}"/dropbear-initramfs/authorized_keys
75 75
76 76 # Save Keys - convert with putty from rsa/openssh to puttkey
77 77 cp -f "${ETC_DIR}"/dropbear-initramfs/id_rsa "${BASEDIR}"/dropbear_initramfs_key.rsa
78 78
79 79 # Get unlock script
80 80 install_exec files/initramfs/crypt_unlock.sh "${ETC_DIR}"/initramfs-tools/hooks/crypt_unlock.sh
81 81
82 82 # Enable Dropbear inside initramfs
83 83 printf "#\n# DROPBEAR: [ y | n ]\n#\n\nDROPBEAR=y\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"
84 84
85 85 # Enable Dropbear inside initramfs
86 86 sed -i "54 i sleep 5" "${R}"/usr/share/initramfs-tools/scripts/init-premount/dropbear
87 87 fi
88 88 # CRYPTFSDROPBEAR=false
89 89 else
90 90 # Disable SSHD inside initramfs
91 91 printf "#\n# DROPBEAR: [ y | n ]\n#\n\nDROPBEAR=n\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"
92 92 fi
93 93
94 94 # Add cryptsetup modules to initramfs
95 95 #printf "#\n# CRYPTSETUP: [ y | n ]\n#\n\nCRYPTSETUP=y\n" >> "${ETC_DIR}/initramfs-tools/conf-hook"
96 96
97 97 # Dummy mapping required by mkinitramfs
98 98 echo "0 1 crypt "${CRYPTFS_CIPHER}" ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 0 7:0 4096" | chroot_exec dmsetup create "${CRYPTFS_MAPPING}"
99 99
100 100 # Generate initramfs with encrypted root partition support
101 101 chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
102 102
103 103 # Remove dummy mapping
104 104 chroot_exec cryptsetup close "${CRYPTFS_MAPPING}"
105 105 # CRYPTFS=false
106 106 else
107 107 #USB BOOT /boot on sda1 / on sda2
108 108 if [ "$ENABLE_USBBOOT" = true ] ; then
109 109 sed -i "s/mmcblk0p1/sda1/" "${ETC_DIR}/fstab"
110 110 sed -i "s/mmcblk0p2/sda2/" "${ETC_DIR}/fstab"
111 111 fi
112 112
113 113 # Add usb/sda disk root partition to fstab
114 114 if [ "$ENABLE_SPLITFS" = true ] ; then
115 115 sed -i "s/mmcblk0p2/sda1/" "${ETC_DIR}/fstab"
116 116 fi
117 117 # Generate initramfs without encrypted root partition support
118 118 chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
119 119 fi
120 120 fi
Show file before | Show file after | Hide comments
@@ -1,136 +1,177
1 1 #
2 2 # Setup Networking
3 3 #
4 4
5 5 # Load utility functions
6 6 . ./functions.sh
7 7
8 8 # Install and setup hostname
9 9 install_readonly files/network/hostname "${ETC_DIR}/hostname"
10 10 sed -i "s/^RaspberryPI/${HOSTNAME}/" "${ETC_DIR}/hostname"
11 11
12 12 # Install and setup hosts
13 13 install_readonly files/network/hosts "${ETC_DIR}/hosts"
14 14 sed -i "s/RaspberryPI/${HOSTNAME}/" "${ETC_DIR}/hosts"
15 15
16 16 # Setup hostname entry with static IP
17 if [ "$NET_ADDRESS" != "" ] ; then
18 NET_IP=$(echo "${NET_ADDRESS}" | cut -f 1 -d'/')
17 if [ "$NET_ETH_ADDRESS" != "" ] ; then
18 NET_IP=$(echo "${NET_ETH_ADDRESS}" | cut -f 1 -d'/')
19 19 sed -i "s/^127.0.1.1/${NET_IP}/" "${ETC_DIR}/hosts"
20 20 fi
21 21
22 22 # Remove IPv6 hosts
23 23 if [ "$ENABLE_IPV6" = false ] ; then
24 24 sed -i -e "/::[1-9]/d" -e "/^$/d" "${ETC_DIR}/hosts"
25 25 fi
26 26
27 27 # Install hint about network configuration
28 28 install_readonly files/network/interfaces "${ETC_DIR}/network/interfaces"
29 29
30 30 # Install configuration for interface eth0
31 install_readonly files/network/eth.network "${ETC_DIR}/systemd/network/eth.network"
31 install_readonly files/network/eth0.network "${ETC_DIR}/systemd/network/eth0.network"
32 32
33 33 if [ "$RPI_MODEL" = 3P ] ; then
34 printf "\n[Link]\nGenericReceiveOffload=off\nTCPSegmentationOffload=off\nGenericSegmentationOffload=off" >> "${ETC_DIR}/systemd/network/eth.network"
34 printf "\n[Link]\nGenericReceiveOffload=off\nTCPSegmentationOffload=off\nGenericSegmentationOffload=off" >> "${ETC_DIR}/systemd/network/eth0.network"
35 35 fi
36 36
37 37 # Install configuration for interface wl*
38 install_readonly files/network/wlan.network "${ETC_DIR}/systemd/network/wlan.network"
38 install_readonly files/network/wlan0.network "${ETC_DIR}/systemd/network/wlan0.network"
39 39
40 40 #always with dhcp since wpa_supplicant integration is missing
41 sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/wlan.network"
41 sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/wlan0.network"
42 42
43 if [ "$ENABLE_DHCP" = true ] ; then
43 if [ "$ENABLE_ETH_DHCP" = true ] ; then
44 44 # Enable DHCP configuration for interface eth0
45 sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/eth.network"
45 sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/eth0.network"
46 46
47 47 # Set DHCP configuration to IPv4 only
48 48 if [ "$ENABLE_IPV6" = false ] ; then
49 sed -i "s/DHCP=.*/DHCP=v4/" "${ETC_DIR}/systemd/network/eth.network"
49 sed -i "s/DHCP=.*/DHCP=v4/" "${ETC_DIR}/systemd/network/eth0.network"
50 sed '/IPv6PrivacyExtensions=true/d' "${ETC_DIR}/systemd/network/eth0.network"
50 51 fi
51 52
52 else # ENABLE_DHCP=false
53 else # ENABLE_ETH_DHCP=false
53 54 # Set static network configuration for interface eth0
54 55 sed -i\
55 56 -e "s|DHCP=.*|DHCP=no|"\
56 -e "s|Address=\$|Address=${NET_ADDRESS}|"\
57 -e "s|Gateway=\$|Gateway=${NET_GATEWAY}|"\
58 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_DNS_1}|"\
59 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_DNS_2}|"\
60 -e "s|Domains=\$|Domains=${NET_DNS_DOMAINS}|"\
61 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_NTP_1}|"\
62 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_NTP_2}|"\
63 "${ETC_DIR}/systemd/network/eth.network"
57 -e "s|Address=\$|Address=${NET_ETH_ADDRESS}|"\
58 -e "s|Gateway=\$|Gateway=${NET_ETH_GATEWAY}|"\
59 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_ETH_DNS_1}|"\
60 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_ETH_DNS_2}|"\
61 -e "s|Domains=\$|Domains=${NET_ETH_DNS_DOMAINS}|"\
62 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_ETH_NTP_1}|"\
63 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_ETH_NTP_2}|"\
64 "${ETC_DIR}/systemd/network/eth0.network"
64 65 fi
65 66
67 if [ "$ENABLE_WIFI_DHCP" = true ] ; then
68 # Enable DHCP configuration for interface eth0
69 sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/wlan0.network"
70
71 # Set DHCP configuration to IPv4 only
72 if [ "$ENABLE_IPV6" = false ] ; then
73 sed -i "s/DHCP=.*/DHCP=v4/" "${ETC_DIR}/systemd/network/wlan0.network"
74 sed '/IPv6PrivacyExtensions=true/d' "${ETC_DIR}/systemd/network/wlan0.network"
75 fi
76
77 else # ENABLE_ETH_DHCP=false
78 # Set static network configuration for interface eth0
79 sed -i\
80 -e "s|DHCP=.*|DHCP=no|"\
81 -e "s|Address=\$|Address=${NET_WIFI_ADDRESS}|"\
82 -e "s|Gateway=\$|Gateway=${NET_WIFI_GATEWAY}|"\
83 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_WIFI_DNS_1}|"\
84 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_WIFI_DNS_2}|"\
85 -e "s|Domains=\$|Domains=${NET_WIFI_DNS_DOMAINS}|"\
86 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_WIFI_NTP_1}|"\
87 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_WIFI_NTP_2}|"\
88 "${ETC_DIR}/systemd/network/wlan0.network"
89 fi
90
91 printf "
92 ctrl_interface=/run/wpa_supplicant
93 ctrl_interface_group=wheel
94 update_config=1
95 eapol_version=1
96 ap_scan=1
97 fast_reauth=1
98
99 " > /etc/wpa_supplicant/wpa_supplicant-wlan0.conf
100
101 #Configure WPA_supplicant
102 chroot_exec wpa_passphrase "$NET_SSID" "$NET_WPAPSK" >> /etc/wpa_supplicant/wpa_supplicant-wlan0.conf
103
104 chroot_exec systemctl enable wpa_supplicant.service
105 chroot_exec systemctl enable wpa_supplicant@wlan0.service
106
66 107 # Remove empty settings from network configuration
67 sed -i "/.*=\$/d" "${ETC_DIR}/systemd/network/eth.network"
108 sed -i "/.*=\$/d" "${ETC_DIR}/systemd/network/eth0.network"
68 109 # Remove empty settings from wlan configuration
69 sed -i "/.*=\$/d" "${ETC_DIR}/systemd/network/wlan.network"
110 sed -i "/.*=\$/d" "${ETC_DIR}/systemd/network/wlan0.network"
70 111
71 112 # Move systemd network configuration if required by Debian release
72 mv -v "${ETC_DIR}/systemd/network/eth.network" "${LIB_DIR}/systemd/network/10-eth.network"
113 mv -v "${ETC_DIR}/systemd/network/eth0.network" "${LIB_DIR}/systemd/network/10-eth0.network"
73 114 # If WLAN is enabled copy wlan configuration too
74 115 if [ "$ENABLE_WIRELESS" = true ] ; then
75 mv -v "${ETC_DIR}/systemd/network/wlan.network" "${LIB_DIR}/systemd/network/11-wlan.network"
116 mv -v "${ETC_DIR}/systemd/network/wlan0.network" "${LIB_DIR}/systemd/network/11-wlan0.network"
76 117 fi
77 118 rm -fr "${ETC_DIR}/systemd/network"
78 119
79 120 # Enable systemd-networkd service
80 121 chroot_exec systemctl enable systemd-networkd
81 122
82 123 # Install host.conf resolver configuration
83 124 install_readonly files/network/host.conf "${ETC_DIR}/host.conf"
84 125
85 126 # Enable network stack hardening
86 127 if [ "$ENABLE_HARDNET" = true ] ; then
87 128 # Install sysctl.d configuration files
88 129 install_readonly files/sysctl.d/82-rpi-net-hardening.conf "${ETC_DIR}/sysctl.d/82-rpi-net-hardening.conf"
89 130
90 131 # Setup resolver warnings about spoofed addresses
91 132 sed -i "s/^# spoof warn/spoof warn/" "${ETC_DIR}/host.conf"
92 133 fi
93 134
94 135 # Enable time sync
95 136 if [ "$NET_NTP_1" != "" ] ; then
96 137 chroot_exec systemctl enable systemd-timesyncd.service
97 138 fi
98 139
99 140 # Download the firmware binary blob required to use the RPi3 wireless interface
100 141 if [ "$ENABLE_WIRELESS" = true ] ; then
101 142 if [ ! -d "${WLAN_FIRMWARE_DIR}" ] ; then
102 143 mkdir -p "${WLAN_FIRMWARE_DIR}"
103 144 fi
104 145
105 146 # Create temporary directory for firmware binary blob
106 147 temp_dir=$(as_nobody mktemp -d)
107 148
108 149 # Fetch firmware binary blob for RPI3B+
109 150 if [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
110 151 # Fetch firmware binary blob for RPi3P
111 152 as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.bin" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.bin"
112 153 as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.txt" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.txt"
113 154 as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.clm_blob" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.clm_blob"
114 155
115 156 # Move downloaded firmware binary blob
116 157 mv "${temp_dir}/brcmfmac43455-sdio."* "${WLAN_FIRMWARE_DIR}/"
117 158
118 159 # Set permissions of the firmware binary blob
119 160 chown root:root "${WLAN_FIRMWARE_DIR}/brcmfmac43455-sdio."*
120 161 chmod 600 "${WLAN_FIRMWARE_DIR}/brcmfmac43455-sdio."*
121 162 elif [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 0 ] ; then
122 163 # Fetch firmware binary blob for RPi3
123 164 as_nobody wget -q -O "${temp_dir}/brcmfmac43430-sdio.bin" "${WLAN_FIRMWARE_URL}/brcmfmac43430-sdio.bin"
124 165 as_nobody wget -q -O "${temp_dir}/brcmfmac43430-sdio.txt" "${WLAN_FIRMWARE_URL}/brcmfmac43430-sdio.txt"
125 166
126 167 # Move downloaded firmware binary blob
127 168 mv "${temp_dir}/brcmfmac43430-sdio."* "${WLAN_FIRMWARE_DIR}/"
128 169
129 170 # Set permissions of the firmware binary blob
130 171 chown root:root "${WLAN_FIRMWARE_DIR}/brcmfmac43430-sdio."*
131 172 chmod 600 "${WLAN_FIRMWARE_DIR}/brcmfmac43430-sdio."*
132 173 fi
133 174
134 175 # Remove temporary directory for firmware binary blob
135 176 rm -fr "${temp_dir}"
136 177 fi
Show file before | Show file after | Hide comments
@@ -1,13 +1,28
1 1 logger -t "rc.firstboot" "Configuring network interface name"
2 2
3 INTERFACE_NAME=$(dmesg | grep "renamed from eth0" | awk -F ":| " '{ print $9 }')
3 INTERFACE_NAME_ETH=$(dmesg | grep "renamed from eth0" | awk -F ":| " '{ print $9 }')
4 INTERFACE_NAME_WIFI=$(dmesg | grep "renamed from wlan0" | awk -F ":| " '{ print $9 }')
4 5
5 if [ ! -z INTERFACE_NAME ] ; then
6 if [ -r "/etc/systemd/network/eth.network" ] ; then
7 sed -i "s/eth0/${INTERFACE_NAME}/" /etc/systemd/network/eth.network
6 if [ ! -z INTERFACE_NAME_ETH ] ; then
7 if [ -r "/etc/systemd/network/eth0.network" ] ; then
8 sed -i "s/eth0/${INTERFACE_NAME_ETH}/" /etc/systemd/network/eth0.network
8 9 fi
9 10
10 if [ -r "/lib/systemd/network/10-eth.network" ] ; then
11 sed -i "s/eth0/${INTERFACE_NAME}/" /lib/systemd/network/10-eth.network
11 if [ -r "/lib/systemd/network/10-eth0.network" ] ; then
12 sed -i "s/eth0/${INTERFACE_NAME_ETH}/" /lib/systemd/network/10-eth0.network
12 13 fi
14 # Move config to new interface name
15 mv /etc/systemd/network/eth0.network /etc/systemd/network/"${INTERFACE_NAME_ETH}".network
16 fi
17
18 if [ ! -z INTERFACE_NAME_WIFI ] ; then
19 if [ -r "/etc/systemd/network/wlan0.network" ] ; then
20 sed -i "s/wlan0/${INTERFACE_NAME_WIFI}/" /etc/systemd/network/wlan0.network
21 fi
22
23 if [ -r "/lib/systemd/network/11-wlan0.network" ] ; then
24 sed -i "s/wlan0/${INTERFACE_NAME_WIFI}/" /lib/systemd/network/11-wlan0.network
25 fi
26 # Move config to new interface name
27 mv /etc/systemd/network/wlan0.network /etc/systemd/network/"${INTERFACE_NAME_WIFI}".network
13 28 fi
Show file before | Show file after | Hide comments
@@ -1,12 +1,14
1 1 [Match]
2 2 Name=eth0
3 3
4 4 [Network]
5 RouteMetric=10
6 IPv6PrivacyExtensions=true
5 7 DHCP=no
6 8 Address=
7 9 Gateway=
8 10 DNS=
9 11 DNS=
10 12 Domains=
11 13 NTP=
12 14 NTP=
Show file before | Show file after | Hide comments
@@ -1,12 +1,14
1 1 [Match]
2 2 Name=wlan0
3 3
4 4 [Network]
5 RouteMetric=20
6 IPv6PrivacyExtensions=true
5 7 DHCP=no
6 8 Address=
7 9 Gateway=
8 10 DNS=
9 11 DNS=
10 12 Domains=
11 13 NTP=
12 14 NTP=
Show file before | Show file after | Hide comments
@@ -1,897 +1,910
1 1 #!/bin/sh
2 2 ########################################################################
3 3 # rpi23-gen-image.sh 2015-2017
4 4 #
5 5 # Advanced Debian "stretch" and "buster" bootstrap script for Raspberry Pi
6 6 #
7 7 # This program is free software; you can redistribute it and/or
8 8 # modify it under the terms of the GNU General Public License
9 9 # as published by the Free Software Foundation; either version 2
10 10 # of the License, or (at your option) any later version.
11 11 #
12 12 # Copyright (C) 2015 Jan Wagner <mail@jwagner.eu>
13 13 #
14 14 # Big thanks for patches and enhancements by 20+ github contributors!
15 15 ########################################################################
16 16
17 17 # Are we running as root?
18 18 if [ "$(id -u)" -ne "0" ] ; then
19 19 echo "error: this script must be executed with root privileges!"
20 20 exit 1
21 21 fi
22 22
23 23 # Check if ./functions.sh script exists
24 24 if [ ! -r "./functions.sh" ] ; then
25 25 echo "error: './functions.sh' required script not found!"
26 26 exit 1
27 27 fi
28 28
29 29 # Load utility functions
30 30 . ./functions.sh
31 31
32 32 # Load parameters from configuration template file
33 33 if [ -n "$CONFIG_TEMPLATE" ] ; then
34 34 use_template
35 35 fi
36 36
37 37 # Introduce settings
38 38 set -e
39 39 echo -n -e "\n#\n# RPi 0/1/2/3 Bootstrap Settings\n#\n"
40 40 set -x
41 41
42 42 # Raspberry Pi model configuration
43 43 RPI_MODEL=${RPI_MODEL:=2}
44 44
45 45 # Debian release
46 46 RELEASE=${RELEASE:=buster}
47 47 if [ $RELEASE = "bullseye" ] ; then
48 48 RELEASE=testing
49 49 fi
50 50
51 51 # Kernel Branch
52 52 KERNEL_BRANCH=${KERNEL_BRANCH:=""}
53 53
54 54 # URLs
55 55 KERNEL_URL=${KERNEL_URL:=https://github.com/raspberrypi/linux}
56 56 FIRMWARE_URL=${FIRMWARE_URL:=https://github.com/raspberrypi/firmware/raw/master/boot}
57 57 WLAN_FIRMWARE_URL=${WLAN_FIRMWARE_URL:=https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm}
58 58 FBTURBO_URL=${FBTURBO_URL:=https://github.com/ssvb/xf86-video-fbturbo.git}
59 59 UBOOT_URL=${UBOOT_URL:=https://git.denx.de/u-boot.git}
60 60 VIDEOCORE_URL=${VIDEOCORE_URL:=https://github.com/raspberrypi/userland}
61 61 BLUETOOTH_URL=${BLUETOOTH_URL:=https://github.com/RPi-Distro/pi-bluetooth.git}
62 62 NEXMON_URL=${NEXMON_URL:=https://github.com/seemoo-lab/nexmon.git}
63 63 SYSTEMDSWAP_URL=${SYSTEMDSWAP_URL:=https://github.com/Nefelim4ag/systemd-swap.git}
64 64
65 65 # Kernel deb packages for 32bit kernel
66 66 RPI_32_KERNEL_URL=${RPI_32_KERNEL_URL:=https://github.com/hypriot/rpi-kernel/releases/download/v4.14.34/raspberrypi-kernel_20180422-141901_armhf.deb}
67 67 RPI_32_KERNELHEADER_URL=${RPI_32_KERNELHEADER_URL:=https://github.com/hypriot/rpi-kernel/releases/download/v4.14.34/raspberrypi-kernel-headers_20180422-141901_armhf.deb}
68 68 # Kernel has KVM and zswap enabled - use if KERNEL_* parameters and precompiled kernel are used
69 69 RPI3_64_BIS_KERNEL_URL=${RPI3_64_BIS_KERNEL_URL:=https://github.com/sakaki-/bcmrpi3-kernel-bis/releases/download/4.19.80.20191022/bcmrpi3-kernel-bis-4.19.80.20191022.tar.xz}
70 70 # Default precompiled 64bit kernel
71 71 RPI3_64_DEF_KERNEL_URL=${RPI3_64_DEF_KERNEL_URL:=https://github.com/sakaki-/bcmrpi3-kernel/releases/download/4.19.80.20191022/bcmrpi3-kernel-4.19.80.20191022.tar.xz}
72 72 # Sakaki BIS Kernel RPI4 - https://github.com/sakaki-/bcm2711-kernel-bis
73 73 RPI4_64_BIS_KERNEL_URL=${RPI4_64_BIS_KERNEL_URL:=https://github.com/sakaki-/bcm2711-kernel-bis/releases/download/4.19.59.20190724/bcm2711-kernel-bis-4.19.59.20190724.tar.xz}
74 74 # Default precompiled 64bit kernel - https://github.com/sakaki-/bcm2711-kernel
75 75 RPI4_64_DEF_KERNEL_URL=${RPI4_64_DEF_KERNEL_URL:=https://github.com/sakaki-/bcm2711-kernel-bis/releases/download/4.19.59.20190724/bcm2711-kernel-bis-4.19.59.20190724.tar.xz}
76 76 # Generic
77 77 RPI3_64_KERNEL_URL=${RPI3_64_KERNEL_URL:=$RPI3_64_DEF_KERNEL_URL}
78 78 RPI4_64_KERNEL_URL=${RPI4_64_KERNEL_URL:=$RPI4_64_DEF_KERNEL_URL}
79 79 # Kali kernel src - used if ENABLE_NEXMON=true (they patch the wlan kernel modul)
80 80 KALI_KERNEL_URL=${KALI_KERNEL_URL:=https://github.com/Re4son/re4son-raspberrypi-linux.git}
81 81
82 82 # Build directories
83 83 WORKDIR=$(pwd)
84 84 BASEDIR=${BASEDIR:=${WORKDIR}/images/${RELEASE}}
85 85 BUILDDIR="${BASEDIR}/build"
86 86
87 87 # Chroot directories
88 88 R="${BUILDDIR}/chroot"
89 89 ETC_DIR="${R}/etc"
90 90 LIB_DIR="${R}/lib"
91 91 BOOT_DIR="${R}/boot/firmware"
92 92 KERNEL_DIR="${R}/usr/src/linux"
93 93 WLAN_FIRMWARE_DIR="${LIB_DIR}/firmware/brcm"
94 94 BLUETOOTH_FIRMWARE_DIR="${ETC_DIR}/firmware/bt"
95 95
96 96 # Firmware directory: Blank if download from github
97 97 RPI_FIRMWARE_DIR=${RPI_FIRMWARE_DIR:=""}
98 98
99 99 # General settings
100 100 SET_ARCH=${SET_ARCH:=32}
101 101 HOSTNAME=${HOSTNAME:=rpi${RPI_MODEL}-${RELEASE}}
102 102 PASSWORD=${PASSWORD:=raspberry}
103 103 USER_PASSWORD=${USER_PASSWORD:=raspberry}
104 104 DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}
105 105 TIMEZONE=${TIMEZONE:="Europe/Berlin"}
106 106 EXPANDROOT=${EXPANDROOT:=true}
107 107 ENABLE_DPHYSSWAP=${ENABLE_DPHYSSWAP:=true}
108 108
109 109 # Keyboard settings
110 110 XKB_MODEL=${XKB_MODEL:=""}
111 111 XKB_LAYOUT=${XKB_LAYOUT:=""}
112 112 XKB_VARIANT=${XKB_VARIANT:=""}
113 113 XKB_OPTIONS=${XKB_OPTIONS:=""}
114 114
115 115 # Network settings (DHCP)
116 ENABLE_DHCP=${ENABLE_DHCP:=true}
116 ENABLE_ETH_DHCP=${ENABLE_ETH_DHCP:=true}
117 ENABLE_WIFI_DHCP=${ENABLE_ETH_DHCP:=true}
117 118
118 119 # Network settings (static)
119 NET_ADDRESS=${NET_ADDRESS:=""}
120 NET_GATEWAY=${NET_GATEWAY:=""}
121 NET_DNS_1=${NET_DNS_1:=""}
122 NET_DNS_2=${NET_DNS_2:=""}
123 NET_DNS_DOMAINS=${NET_DNS_DOMAINS:=""}
124 NET_NTP_1=${NET_NTP_1:=""}
125 NET_NTP_2=${NET_NTP_2:=""}
120 NET_ETH_ADDRESS=${NET_ETH_ADDRESS:=""}
121 NET_ETH_GATEWAY=${NET_ETH_GATEWAY:=""}
122 NET_ETH_DNS_1=${NET_ETH_DNS_1:=""}
123 NET_ETH_DNS_2=${NET_ETH_DNS_2:=""}
124 NET_ETH_DNS_DOMAINS=${NET_ETH_DNS_DOMAINS:=""}
125 NET_ETH_NTP_1=${NET_ETH_NTP_1:=""}
126 NET_ETH_NTP_2=${NET_ETH_NTP_2:=""}
127
128 NET_WIFI_SSID=${NET_SSID:=""}
129 NET_WIFI_WPAPSK=${NET_WPAPSK:=""}
130
131 # Network settings (static)
132 NET_WIFI_ADDRESS=${NET_WIFI_ADDRESS:=""}
133 NET_WIFI_GATEWAY=${NET_WIFI_GATEWAY:=""}
134 NET_WIFI_DNS_1=${NET_WIFI_DNS_1:=""}
135 NET_WIFI_DNS_2=${NET_WIFI_DNS_2:=""}
136 NET_WIFI_DNS_DOMAINS=${NET_WIFI_DNS_DOMAINS:=""}
137 NET_WIFI_NTP_1=${NET_WIFI_NTP_1:=""}
138 NET_WIFI_NTP_2=${NET_WIFI_NTP_2:=""}
126 139
127 140 # APT settings
128 141 APT_PROXY=${APT_PROXY:=""}
129 142 APT_SERVER=${APT_SERVER:="ftp.debian.org"}
130 143 KEEP_APT_PROXY=${KEEP_APT_PROXY:=false}
131 144
132 145 # Feature settings
133 146 ENABLE_PRINTK=${ENABLE_PRINTK:=false}
134 147 ENABLE_BLUETOOTH=${ENABLE_BLUETOOTH:=false}
135 148 ENABLE_MINIUART_OVERLAY=${ENABLE_MINIUART_OVERLAY:=false}
136 149 ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}
137 150 ENABLE_I2C=${ENABLE_I2C:=false}
138 151 ENABLE_SPI=${ENABLE_SPI:=false}
139 152 ENABLE_IPV6=${ENABLE_IPV6:=true}
140 153 ENABLE_SSHD=${ENABLE_SSHD:=true}
141 154 ENABLE_NONFREE=${ENABLE_NONFREE:=false}
142 155 ENABLE_WIRELESS=${ENABLE_WIRELESS:=false}
143 156 ENABLE_SOUND=${ENABLE_SOUND:=true}
144 157 ENABLE_DBUS=${ENABLE_DBUS:=true}
145 158 ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}
146 159 ENABLE_MINGPU=${ENABLE_MINGPU:=false}
147 160 ENABLE_XORG=${ENABLE_XORG:=false}
148 161 ENABLE_WM=${ENABLE_WM:=""}
149 162 ENABLE_RSYSLOG=${ENABLE_RSYSLOG:=true}
150 163 ENABLE_USER=${ENABLE_USER:=true}
151 164 USER_NAME=${USER_NAME:="pi"}
152 165 ENABLE_ROOT=${ENABLE_ROOT:=false}
153 166 ENABLE_QEMU=${ENABLE_QEMU:=false}
154 167 ENABLE_SYSVINIT=${ENABLE_SYSVINIT:=false}
155 168
156 169 # SSH settings
157 170 SSH_ENABLE_ROOT=${SSH_ENABLE_ROOT:=false}
158 171 SSH_DISABLE_PASSWORD_AUTH=${SSH_DISABLE_PASSWORD_AUTH:=false}
159 172 SSH_LIMIT_USERS=${SSH_LIMIT_USERS:=false}
160 173 SSH_ROOT_PUB_KEY=${SSH_ROOT_PUB_KEY:=""}
161 174 SSH_USER_PUB_KEY=${SSH_USER_PUB_KEY:=""}
162 175
163 176 # Advanced settings
164 177 ENABLE_SYSTEMDSWAP=${ENABLE_SYSTEMDSWAP:=false}
165 178 ENABLE_MINBASE=${ENABLE_MINBASE:=false}
166 179 ENABLE_REDUCE=${ENABLE_REDUCE:=false}
167 180 ENABLE_UBOOT=${ENABLE_UBOOT:=false}
168 181 UBOOTSRC_DIR=${UBOOTSRC_DIR:=""}
169 182 ENABLE_USBBOOT=${ENABLE_USBBOOT=false}
170 183 ENABLE_FBTURBO=${ENABLE_FBTURBO:=false}
171 184 ENABLE_VIDEOCORE=${ENABLE_VIDEOCORE:=false}
172 185 ENABLE_NEXMON=${ENABLE_NEXMON:=false}
173 186 VIDEOCORESRC_DIR=${VIDEOCORESRC_DIR:=""}
174 187 FBTURBOSRC_DIR=${FBTURBOSRC_DIR:=""}
175 188 NEXMONSRC_DIR=${NEXMONSRC_DIR:=""}
176 189 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
177 190 ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
178 191 ENABLE_SPLITFS=${ENABLE_SPLITFS:=false}
179 192 ENABLE_INITRAMFS=${ENABLE_INITRAMFS:=false}
180 193 ENABLE_IFNAMES=${ENABLE_IFNAMES:=true}
181 194 ENABLE_SPLASH=${ENABLE_SPLASH:=true}
182 195 ENABLE_LOGO=${ENABLE_LOGO:=true}
183 196 ENABLE_SILENT_BOOT=${ENABLE_SILENT_BOOT=false}
184 197 DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS:=}
185 198
186 199 # Kernel compilation settings
187 200 BUILD_KERNEL=${BUILD_KERNEL:=true}
188 201 KERNEL_REDUCE=${KERNEL_REDUCE:=false}
189 202 KERNEL_THREADS=${KERNEL_THREADS:=1}
190 203 KERNEL_HEADERS=${KERNEL_HEADERS:=true}
191 204 KERNEL_MENUCONFIG=${KERNEL_MENUCONFIG:=false}
192 205 KERNEL_REMOVESRC=${KERNEL_REMOVESRC:=true}
193 206 KERNEL_OLDDEFCONFIG=${KERNEL_OLDDEFCONFIG:=false}
194 207 KERNEL_CCACHE=${KERNEL_CCACHE:=false}
195 208 KERNEL_ZSWAP=${KERNEL_ZSWAP:=false}
196 209 KERNEL_VIRT=${KERNEL_VIRT:=false}
197 210 KERNEL_BPF=${KERNEL_BPF:=false}
198 211 KERNEL_DEFAULT_GOV=${KERNEL_DEFAULT_GOV:=ondemand}
199 212 KERNEL_SECURITY=${KERNEL_SECURITY:=false}
200 213 KERNEL_NF=${KERNEL_NF:=false}
201 214 KERNEL_DHKEY=${KERNEL_DHKEY:=true}
202 215 KERNEL_BTRFS=${KERNEL_BTRFS:=false}
203 216 KERNEL_NSPAN=${KERNEL_NSPAN:=false}
204 217 KERNEL_POEHAT=${KERNEL_POEHAT:=false}
205 218
206 219 # Kernel compilation from source directory settings
207 220 KERNELSRC_DIR=${KERNELSRC_DIR:=""}
208 221 KERNELSRC_CLEAN=${KERNELSRC_CLEAN:=false}
209 222 KERNELSRC_CONFIG=${KERNELSRC_CONFIG:=true}
210 223 KERNELSRC_PREBUILT=${KERNELSRC_PREBUILT:=false}
211 224
212 225 # Reduce disk usage settings
213 226 REDUCE_APT=${REDUCE_APT:=true}
214 227 REDUCE_DOC=${REDUCE_DOC:=true}
215 228 REDUCE_MAN=${REDUCE_MAN:=true}
216 229 REDUCE_VIM=${REDUCE_VIM:=false}
217 230 REDUCE_BASH=${REDUCE_BASH:=false}
218 231 REDUCE_HWDB=${REDUCE_HWDB:=true}
219 232 REDUCE_SSHD=${REDUCE_SSHD:=true}
220 233 REDUCE_LOCALE=${REDUCE_LOCALE:=true}
221 234
222 235 # Encrypted filesystem settings
223 236 ENABLE_CRYPTFS=${ENABLE_CRYPTFS:=false}
224 237 CRYPTFS_PASSWORD=${CRYPTFS_PASSWORD:=""}
225 238 CRYPTFS_MAPPING=${CRYPTFS_MAPPING:="secure"}
226 239 CRYPTFS_CIPHER=${CRYPTFS_CIPHER:="aes-xts-plain64"}
227 240 CRYPTFS_HASH=${CRYPTFS_HASH:="sha512"}
228 241 CRYPTFS_XTSKEYSIZE=${CRYPTFS_XTSKEYSIZE:=512}
229 242 #Dropbear-initramfs supports unlocking encrypted filesystem via SSH on bootup
230 243 CRYPTFS_DROPBEAR=${CRYPTFS_DROPBEAR:=false}
231 244 #Provide your own Dropbear Public RSA-OpenSSH Key otherwise it will be generated
232 245 CRYPTFS_DROPBEAR_PUBKEY=${CRYPTFS_DROPBEAR_PUBKEY:=""}
233 246
234 247 # Chroot scripts directory
235 248 CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""}
236 249
237 250 # Packages required in the chroot build environment
238 251 APT_INCLUDES=${APT_INCLUDES:=""}
239 252 APT_INCLUDES="${APT_INCLUDES},flex,bison,apt-transport-https,apt-utils,ca-certificates,debian-archive-keyring,dialog,sudo,systemd,sysvinit-utils,locales,keyboard-configuration,console-setup,libnss-systemd"
240 253
241 254 # Packages to exclude from chroot build environment
242 255 APT_EXCLUDES=${APT_EXCLUDES:=""}
243 256
244 257 # Packages required for bootstrapping
245 258 REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo"
246 259 MISSING_PACKAGES=""
247 260
248 261 # Packages installed for c/c++ build environment in chroot (keep empty)
249 262 COMPILER_PACKAGES=""
250 263
251 264 # Check if apt-cacher-ng has port 3142 open and set APT_PROXY
252 265 APT_CACHER_RUNNING=$(lsof -i :3142 | cut -d ' ' -f3 | uniq | sed '/^\s*$/d')
253 266 if [ "${APT_CACHER_RUNNING}" = "apt-cacher-ng" ] ; then
254 267 APT_PROXY=http://127.0.0.1:3142/
255 268 fi
256 269
257 270 # Setup architecture specific settings
258 271 if [ -n "$SET_ARCH" ] ; then
259 272 # 64-bit configuration
260 273 if [ "$SET_ARCH" = 64 ] ; then
261 274 # General 64-bit depended settings
262 275 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-aarch64-static}
263 276 KERNEL_ARCH=${KERNEL_ARCH:=arm64}
264 277 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="Image"}
265 278
266 279 # Raspberry Pi model specific settings
267 280 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
268 281 if [ "$RPI_MODEL" != 4 ] ; then
269 282 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi3_defconfig}
270 283 else
271 284 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2711_defconfig}
272 285 fi
273 286
274 287 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-arm64"
275 288 RELEASE_ARCH=${RELEASE_ARCH:=arm64}
276 289 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel8.img}
277 290 CROSS_COMPILE=${CROSS_COMPILE:=aarch64-linux-gnu-}
278 291 else
279 292 echo "error: Only Raspberry PI 3, 3B+ and 4 support 64-bit"
280 293 exit 1
281 294 fi
282 295 fi
283 296
284 297 # 32-bit configuration
285 298 if [ "$SET_ARCH" = 32 ] ; then
286 299 # General 32-bit dependend settings
287 300 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-arm-static}
288 301 KERNEL_ARCH=${KERNEL_ARCH:=arm}
289 302 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="zImage"}
290 303
291 304 # Raspberry Pi model specific settings
292 305 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 1 ] || [ "$RPI_MODEL" = 1P ] ; then
293 306 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armel"
294 307 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi_defconfig}
295 308 RELEASE_ARCH=${RELEASE_ARCH:=armel}
296 309 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel.img}
297 310 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabi-}
298 311 fi
299 312
300 313 # Raspberry Pi model specific settings
301 314 if [ "$RPI_MODEL" = 2 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
302 315 if [ "$RPI_MODEL" != 4 ] ; then
303 316 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2709_defconfig}
304 317 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel7.img}
305 318 else
306 319 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2711_defconfig}
307 320 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel7l.img}
308 321 fi
309 322
310 323 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armhf"
311 324 RELEASE_ARCH=${RELEASE_ARCH:=armhf}
312 325
313 326 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabihf-}
314 327 fi
315 328 fi
316 329 # SET_ARCH not set
317 330 else
318 331 echo "error: Please set '32' or '64' as value for SET_ARCH"
319 332 exit 1
320 333 fi
321 334 # Device specific configuration and U-Boot configuration
322 335 case "$RPI_MODEL" in
323 336 0)
324 337 DTB_FILE=${DTB_FILE:=bcm2708-rpi-0-w.dtb}
325 338 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
326 339 ;;
327 340 1)
328 341 DTB_FILE=${DTB_FILE:=bcm2708-rpi-b.dtb}
329 342 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
330 343 ;;
331 344 1P)
332 345 DTB_FILE=${DTB_FILE:=bcm2708-rpi-b-plus.dtb}
333 346 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
334 347 ;;
335 348 2)
336 349 DTB_FILE=${DTB_FILE:=bcm2709-rpi-2-b.dtb}
337 350 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_2_defconfig}
338 351 ;;
339 352 3)
340 353 DTB_FILE=${DTB_FILE:=bcm2710-rpi-3-b.dtb}
341 354 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_3_defconfig}
342 355 ;;
343 356 3P)
344 357 DTB_FILE=${DTB_FILE:=bcm2710-rpi-3-b.dtb}
345 358 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_3_defconfig}
346 359 ;;
347 360 4)
348 361 DTB_FILE=${DTB_FILE:=bcm2711-rpi-4-b.dtb}
349 362 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_4_defconfig}
350 363 ;;
351 364 *)
352 365 echo "error: Raspberry Pi model $RPI_MODEL is not supported!"
353 366 exit 1
354 367 ;;
355 368 esac
356 369
357 370 # Raspberry PI 0,3,3P with Bluetooth and Wifi onboard
358 371 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
359 372 # Include bluetooth packages on supported boards
360 373 if [ "$ENABLE_BLUETOOTH" = true ] ; then
361 374 APT_INCLUDES="${APT_INCLUDES},bluetooth,bluez"
362 375 fi
363 376 if [ "$ENABLE_WIRELESS" = true ] ; then
364 APT_INCLUDES="${APT_INCLUDES},wireless-tools,crda,wireless-regdb"
377 APT_INCLUDES="${APT_INCLUDES},wireless-tools,crda,wireless-regdb,wpasupplicant"
365 378 fi
366 379 else # Raspberry PI 1,1P,2 without Wifi and bluetooth onboard
367 380 # Check if the internal wireless interface is not supported by the RPi model
368 381 if [ "$ENABLE_WIRELESS" = true ] || [ "$ENABLE_BLUETOOTH" = true ]; then
369 382 echo "error: The selected Raspberry Pi model has no integrated interface for wireless or bluetooth"
370 383 exit 1
371 384 fi
372 385 fi
373 386
374 387 if [ "$BUILD_KERNEL" = false ] && [ "$ENABLE_NEXMON" = true ]; then
375 388 echo "error: You have to compile kernel sources, if you want to enable nexmon"
376 389 exit 1
377 390 fi
378 391
379 392 # Prepare date string for default image file name
380 393 DATE="$(date +%Y-%m-%d)"
381 394 if [ -z "$KERNEL_BRANCH" ] ; then
382 395 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
383 396 else
384 397 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
385 398 fi
386 399
387 400 # Check if DISABLE_UNDERVOLT_WARNINGS parameter value is supported
388 401 if [ -n "$DISABLE_UNDERVOLT_WARNINGS" ] ; then
389 402 if [ "$DISABLE_UNDERVOLT_WARNINGS" != 1 ] && [ "$DISABLE_UNDERVOLT_WARNINGS" != 2 ] ; then
390 403 echo "error: DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS} is not supported"
391 404 exit 1
392 405 fi
393 406 fi
394 407
395 408 # Add cmake to compile videocore sources
396 409 if [ "$ENABLE_VIDEOCORE" = true ] ; then
397 410 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cmake"
398 411 fi
399 412
400 413 # Add deps for nexmon
401 414 if [ "$ENABLE_NEXMON" = true ] ; then
402 415 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libgmp3-dev gawk qpdf make autoconf automake build-essential libtool"
403 416 fi
404 417
405 418 # Add libncurses5 to enable kernel menuconfig
406 419 if [ "$KERNEL_MENUCONFIG" = true ] ; then
407 420 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libncurses-dev"
408 421 fi
409 422
410 423 # Add ccache compiler cache for (faster) kernel cross (re)compilation
411 424 if [ "$KERNEL_CCACHE" = true ] ; then
412 425 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} ccache"
413 426 fi
414 427
415 428 # Add cryptsetup package to enable filesystem encryption
416 429 if [ "$ENABLE_CRYPTFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
417 430 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cryptsetup"
418 431 APT_INCLUDES="${APT_INCLUDES},cryptsetup,busybox,console-setup,cryptsetup-initramfs"
419 432
420 433 # If cryptfs,dropbear and initramfs are enabled include dropbear-initramfs package
421 434 if [ "$CRYPTFS_DROPBEAR" = true ] && [ "$ENABLE_INITRAMFS" = true ]; then
422 435 APT_INCLUDES="${APT_INCLUDES},dropbear-initramfs"
423 436 fi
424 437
425 438 if [ -z "$CRYPTFS_PASSWORD" ] ; then
426 439 echo "error: no password defined (CRYPTFS_PASSWORD)!"
427 440 exit 1
428 441 fi
429 442 ENABLE_INITRAMFS=true
430 443 fi
431 444
432 445 # Add initramfs generation tools
433 446 if [ "$ENABLE_INITRAMFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
434 447 APT_INCLUDES="${APT_INCLUDES},initramfs-tools"
435 448 fi
436 449
437 450 # Add device-tree-compiler required for building the U-Boot bootloader
438 451 if [ "$ENABLE_UBOOT" = true ] ; then
439 452 APT_INCLUDES="${APT_INCLUDES},device-tree-compiler,bc"
440 453 fi
441 454
442 455 if [ "$ENABLE_USBBOOT" = true ] ; then
443 456 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 1P ] || [ "$RPI_MODEL" = 1 ] || [ "$RPI_MODEL" = 2 ]; then
444 457 echo "error: Booting from USB alone is only supported by Raspberry Pi 3 and 3P"
445 458 exit 1
446 459 fi
447 460 fi
448 461
449 462 # Check if root SSH (v2) public key file exists
450 463 if [ -n "$SSH_ROOT_PUB_KEY" ] ; then
451 464 if [ ! -f "$SSH_ROOT_PUB_KEY" ] ; then
452 465 echo "error: '$SSH_ROOT_PUB_KEY' specified SSH public key file not found (SSH_ROOT_PUB_KEY)!"
453 466 exit 1
454 467 fi
455 468 fi
456 469
457 470 # Check if $USER_NAME SSH (v2) public key file exists
458 471 if [ -n "$SSH_USER_PUB_KEY" ] ; then
459 472 if [ ! -f "$SSH_USER_PUB_KEY" ] ; then
460 473 echo "error: '$SSH_USER_PUB_KEY' specified SSH public key file not found (SSH_USER_PUB_KEY)!"
461 474 exit 1
462 475 fi
463 476 fi
464 477
465 478 if [ "$ENABLE_NEXMON" = true ] && [ -n "$KERNEL_BRANCH" ] ; then
466 479 echo "error: Please unset KERNEL_BRANCH if using ENABLE_NEXMON"
467 480 exit 1
468 481 fi
469 482
470 483 # Check if all required packages are installed on the build system
471 484 for package in $REQUIRED_PACKAGES ; do
472 485 if [ "$(dpkg-query -W -f='${Status}' "$package")" != "install ok installed" ] ; then
473 486 MISSING_PACKAGES="${MISSING_PACKAGES} $package"
474 487 fi
475 488 done
476 489
477 490 # If there are missing packages ask confirmation for install, or exit
478 491 if [ -n "$MISSING_PACKAGES" ] ; then
479 492 echo "the following packages needed by this script are not installed:"
480 493 echo "$MISSING_PACKAGES"
481 494
482 495 printf "\ndo you want to install the missing packages right now? [y/n] "
483 496 read -r confirm
484 497 [ "$confirm" != "y" ] && exit 1
485 498
486 499 # Make sure all missing required packages are installed
487 500 apt-get update && apt-get -qq -y install `echo "${MISSING_PACKAGES}" | sed "s/ //"`
488 501 fi
489 502
490 503 # Check if ./bootstrap.d directory exists
491 504 if [ ! -d "./bootstrap.d/" ] ; then
492 505 echo "error: './bootstrap.d' required directory not found!"
493 506 exit 1
494 507 fi
495 508
496 509 # Check if ./files directory exists
497 510 if [ ! -d "./files/" ] ; then
498 511 echo "error: './files' required directory not found!"
499 512 exit 1
500 513 fi
501 514
502 515 # Check if specified KERNELSRC_DIR directory exists
503 516 if [ -n "$KERNELSRC_DIR" ] && [ ! -d "$KERNELSRC_DIR" ] ; then
504 517 echo "error: '${KERNELSRC_DIR}' specified directory not found (KERNELSRC_DIR)!"
505 518 exit 1
506 519 fi
507 520
508 521 # Check if specified UBOOTSRC_DIR directory exists
509 522 if [ -n "$UBOOTSRC_DIR" ] && [ ! -d "$UBOOTSRC_DIR" ] ; then
510 523 echo "error: '${UBOOTSRC_DIR}' specified directory not found (UBOOTSRC_DIR)!"
511 524 exit 1
512 525 fi
513 526
514 527 # Check if specified VIDEOCORESRC_DIR directory exists
515 528 if [ -n "$VIDEOCORESRC_DIR" ] && [ ! -d "$VIDEOCORESRC_DIR" ] ; then
516 529 echo "error: '${VIDEOCORESRC_DIR}' specified directory not found (VIDEOCORESRC_DIR)!"
517 530 exit 1
518 531 fi
519 532
520 533 # Check if specified FBTURBOSRC_DIR directory exists
521 534 if [ -n "$FBTURBOSRC_DIR" ] && [ ! -d "$FBTURBOSRC_DIR" ] ; then
522 535 echo "error: '${FBTURBOSRC_DIR}' specified directory not found (FBTURBOSRC_DIR)!"
523 536 exit 1
524 537 fi
525 538
526 539 # Check if specified NEXMONSRC_DIR directory exists
527 540 if [ -n "$NEXMONSRC_DIR" ] && [ ! -d "$NEXMONSRC_DIR" ] ; then
528 541 echo "error: '${NEXMONSRC_DIR}' specified directory not found (NEXMONSRC_DIR)!"
529 542 exit 1
530 543 fi
531 544
532 545 # Check if specified CHROOT_SCRIPTS directory exists
533 546 if [ -n "$CHROOT_SCRIPTS" ] && [ ! -d "$CHROOT_SCRIPTS" ] ; then
534 547 echo "error: ${CHROOT_SCRIPTS} specified directory not found (CHROOT_SCRIPTS)!"
535 548 exit 1
536 549 fi
537 550
538 551 # Check if specified device mapping already exists (will be used by cryptsetup)
539 552 if [ -r "/dev/mapping/${CRYPTFS_MAPPING}" ] ; then
540 553 echo "error: mapping /dev/mapping/${CRYPTFS_MAPPING} already exists, not proceeding"
541 554 exit 1
542 555 fi
543 556
544 557 # Don't clobber an old build
545 558 if [ -e "$BUILDDIR" ] ; then
546 559 echo "error: directory ${BUILDDIR} already exists, not proceeding"
547 560 exit 1
548 561 fi
549 562
550 563 # Setup chroot directory
551 564 mkdir -p "${R}"
552 565
553 566 # Check if build directory has enough of free disk space >512MB
554 567 if [ "$(df --output=avail "${BUILDDIR}" | sed "1d")" -le "524288" ] ; then
555 568 echo "error: ${BUILDDIR} not enough space left to generate the output image!"
556 569 exit 1
557 570 fi
558 571
559 572 set -x
560 573
561 574 # Call "cleanup" function on various signals and errors
562 575 trap cleanup 0 1 2 3 6
563 576
564 577 # Add required packages for the minbase installation
565 578 if [ "$ENABLE_MINBASE" = true ] ; then
566 579 APT_INCLUDES="${APT_INCLUDES},vim-tiny,netbase,net-tools,ifupdown"
567 580 fi
568 581
569 582 # Add parted package, required to get partprobe utility
570 583 if [ "$EXPANDROOT" = true ] ; then
571 584 APT_INCLUDES="${APT_INCLUDES},parted"
572 585 fi
573 586
574 587 # Add dphys-swapfile package, required to enable swap
575 588 if [ "$ENABLE_DPHYSSWAP" = true ] ; then
576 589 APT_INCLUDES="${APT_INCLUDES},dphys-swapfile"
577 590 fi
578 591
579 592 # Add dbus package, recommended if using systemd
580 593 if [ "$ENABLE_DBUS" = true ] ; then
581 594 APT_INCLUDES="${APT_INCLUDES},dbus"
582 595 fi
583 596
584 597 # Add iptables IPv4/IPv6 package
585 598 if [ "$ENABLE_IPTABLES" = true ] ; then
586 599 APT_INCLUDES="${APT_INCLUDES},iptables,iptables-persistent"
587 600 fi
588 601 # Add apparmor for KERNEL_SECURITY
589 602 if [ "$KERNEL_SECURITY" = true ] ; then
590 603 APT_INCLUDES="${APT_INCLUDES},apparmor,apparmor-utils,apparmor-profiles,apparmor-profiles-extra,libapparmor-perl"
591 604 fi
592 605
593 606 # Add openssh server package
594 607 if [ "$ENABLE_SSHD" = true ] ; then
595 608 APT_INCLUDES="${APT_INCLUDES},openssh-server"
596 609 fi
597 610
598 611 # Add alsa-utils package
599 612 if [ "$ENABLE_SOUND" = true ] ; then
600 613 APT_INCLUDES="${APT_INCLUDES},alsa-utils"
601 614 fi
602 615
603 616 # Add rng-tools package
604 617 if [ "$ENABLE_HWRANDOM" = true ] ; then
605 618 APT_INCLUDES="${APT_INCLUDES},rng-tools"
606 619 fi
607 620
608 621 # Add fbturbo video driver
609 622 if [ "$ENABLE_FBTURBO" = true ] ; then
610 623 # Enable xorg package dependencies
611 624 ENABLE_XORG=true
612 625 fi
613 626
614 627 # Add user defined window manager package
615 628 if [ -n "$ENABLE_WM" ] ; then
616 629 APT_INCLUDES="${APT_INCLUDES},${ENABLE_WM}"
617 630
618 631 # Enable xorg package dependencies
619 632 ENABLE_XORG=true
620 633 fi
621 634
622 635 # Add xorg package
623 636 if [ "$ENABLE_XORG" = true ] ; then
624 637 APT_INCLUDES="${APT_INCLUDES},xorg,dbus-x11"
625 638 fi
626 639
627 640 # Replace selected packages with smaller clones
628 641 if [ "$ENABLE_REDUCE" = true ] ; then
629 642 # Add levee package instead of vim-tiny
630 643 if [ "$REDUCE_VIM" = true ] ; then
631 644 APT_INCLUDES="$(echo ${APT_INCLUDES} | sed "s/vim-tiny/levee/")"
632 645 fi
633 646
634 647 # Add dropbear package instead of openssh-server
635 648 if [ "$REDUCE_SSHD" = true ] ; then
636 649 APT_INCLUDES="$(echo "${APT_INCLUDES}" | sed "s/openssh-server/dropbear/")"
637 650 fi
638 651 fi
639 652
640 653 # Configure systemd-sysv exclude to make halt/reboot/shutdown scripts available
641 654 if [ "$ENABLE_SYSVINIT" = false ] ; then
642 655 APT_EXCLUDES="--exclude=${APT_EXCLUDES},init,systemd-sysv"
643 656 fi
644 657
645 658 # Configure kernel sources if no KERNELSRC_DIR
646 659 if [ "$BUILD_KERNEL" = true ] && [ -z "$KERNELSRC_DIR" ] ; then
647 660 KERNELSRC_CONFIG=true
648 661 fi
649 662
650 663 # Configure reduced kernel
651 664 if [ "$KERNEL_REDUCE" = true ] ; then
652 665 KERNELSRC_CONFIG=false
653 666 fi
654 667
655 668 # Configure qemu compatible kernel
656 669 if [ "$ENABLE_QEMU" = true ] ; then
657 670 DTB_FILE=vexpress-v2p-ca15_a7.dtb
658 671 UBOOT_CONFIG=vexpress_ca15_tc2_defconfig
659 672 KERNEL_DEFCONFIG="vexpress_defconfig"
660 673 if [ "$KERNEL_MENUCONFIG" = false ] ; then
661 674 KERNEL_OLDDEFCONFIG=true
662 675 fi
663 676 fi
664 677
665 678 # Execute bootstrap scripts
666 679 for SCRIPT in bootstrap.d/*.sh; do
667 680 head -n 3 "$SCRIPT"
668 681 . "$SCRIPT"
669 682 done
670 683
671 684 ## Execute custom bootstrap scripts
672 685 if [ -d "custom.d" ] ; then
673 686 for SCRIPT in custom.d/*.sh; do
674 687 . "$SCRIPT"
675 688 done
676 689 fi
677 690
678 691 # Execute custom scripts inside the chroot
679 692 if [ -n "$CHROOT_SCRIPTS" ] && [ -d "$CHROOT_SCRIPTS" ] ; then
680 693 cp -r "${CHROOT_SCRIPTS}" "${R}/chroot_scripts"
681 694 chroot_exec /bin/bash -x <<'EOF'
682 695 for SCRIPT in /chroot_scripts/* ; do
683 696 if [ -f $SCRIPT -a -x $SCRIPT ] ; then
684 697 $SCRIPT
685 698 fi
686 699 done
687 700 EOF
688 701 rm -rf "${R}/chroot_scripts"
689 702 fi
690 703
691 704 # Remove c/c++ build environment from the chroot
692 705 chroot_remove_cc
693 706
694 707 # Generate required machine-id
695 708 MACHINE_ID=$(dbus-uuidgen)
696 709 echo -n "${MACHINE_ID}" > "${R}/var/lib/dbus/machine-id"
697 710 echo -n "${MACHINE_ID}" > "${ETC_DIR}/machine-id"
698 711
699 712 # APT Cleanup
700 713 chroot_exec apt-get -y clean
701 714 chroot_exec apt-get -y autoclean
702 715 chroot_exec apt-get -y autoremove
703 716
704 717 # Unmount mounted filesystems
705 718 umount -l "${R}/proc"
706 719 umount -l "${R}/sys"
707 720
708 721 # Clean up directories
709 722 rm -rf "${R}/run/*"
710 723 rm -rf "${R}/tmp/*"
711 724
712 725 # Clean up APT proxy settings
713 726 if [ "$KEEP_APT_PROXY" = false ] ; then
714 727 rm -f "${ETC_DIR}/apt/apt.conf.d/10proxy"
715 728 fi
716 729
717 730 # Clean up files
718 731 rm -f "${ETC_DIR}/ssh/ssh_host_*"
719 732 rm -f "${ETC_DIR}/dropbear/dropbear_*"
720 733 rm -f "${ETC_DIR}/apt/sources.list.save"
721 734 rm -f "${ETC_DIR}/resolvconf/resolv.conf.d/original"
722 735 rm -f "${ETC_DIR}/*-"
723 736 rm -f "${ETC_DIR}/resolv.conf"
724 737 rm -f "${R}/root/.bash_history"
725 738 rm -f "${R}/var/lib/urandom/random-seed"
726 739 rm -f "${R}/initrd.img"
727 740 rm -f "${R}/vmlinuz"
728 741 rm -f "${R}${QEMU_BINARY}"
729 742
730 743 if [ "$ENABLE_QEMU" = true ] ; then
731 744 # Setup QEMU directory
732 745 mkdir "${BASEDIR}/qemu"
733 746
734 747 # Copy kernel image to QEMU directory
735 748 install_readonly "${BOOT_DIR}/${KERNEL_IMAGE}" "${BASEDIR}/qemu/${KERNEL_IMAGE}"
736 749
737 750 # Copy kernel config to QEMU directory
738 751 install_readonly "${R}/boot/config-${KERNEL_VERSION}" "${BASEDIR}/qemu/config-${KERNEL_VERSION}"
739 752
740 753 # Copy kernel dtbs to QEMU directory
741 754 for dtb in "${BOOT_DIR}/"*.dtb ; do
742 755 if [ -f "${dtb}" ] ; then
743 756 install_readonly "${dtb}" "${BASEDIR}/qemu/"
744 757 fi
745 758 done
746 759
747 760 # Copy kernel overlays to QEMU directory
748 761 if [ -d "${BOOT_DIR}/overlays" ] ; then
749 762 # Setup overlays dtbs directory
750 763 mkdir "${BASEDIR}/qemu/overlays"
751 764
752 765 for dtb in "${BOOT_DIR}/overlays/"*.dtbo ; do
753 766 if [ -f "${dtb}" ] ; then
754 767 install_readonly "${dtb}" "${BASEDIR}/qemu/overlays/"
755 768 fi
756 769 done
757 770 fi
758 771
759 772 # Copy u-boot files to QEMU directory
760 773 if [ "$ENABLE_UBOOT" = true ] ; then
761 774 if [ -f "${BOOT_DIR}/u-boot.bin" ] ; then
762 775 install_readonly "${BOOT_DIR}/u-boot.bin" "${BASEDIR}/qemu/u-boot.bin"
763 776 fi
764 777 if [ -f "${BOOT_DIR}/uboot.mkimage" ] ; then
765 778 install_readonly "${BOOT_DIR}/uboot.mkimage" "${BASEDIR}/qemu/uboot.mkimage"
766 779 fi
767 780 if [ -f "${BOOT_DIR}/boot.scr" ] ; then
768 781 install_readonly "${BOOT_DIR}/boot.scr" "${BASEDIR}/qemu/boot.scr"
769 782 fi
770 783 fi
771 784
772 785 # Copy initramfs to QEMU directory
773 786 if [ -f "${BOOT_DIR}/initramfs-${KERNEL_VERSION}" ] ; then
774 787 install_readonly "${BOOT_DIR}/initramfs-${KERNEL_VERSION}" "${BASEDIR}/qemu/initramfs-${KERNEL_VERSION}"
775 788 fi
776 789 fi
777 790
778 791 # Calculate size of the chroot directory in KB
779 792 CHROOT_SIZE=$(expr "$(du -s "${R}" | awk '{ print $1 }')")
780 793
781 794 # Calculate the amount of needed 512 Byte sectors
782 795 TABLE_SECTORS=$(expr 1 \* 1024 \* 1024 \/ 512)
783 796 FRMW_SECTORS=$(expr 64 \* 1024 \* 1024 \/ 512)
784 797 ROOT_OFFSET=$(expr "${TABLE_SECTORS}" + "${FRMW_SECTORS}")
785 798
786 799 # The root partition is EXT4
787 800 # This means more space than the actual used space of the chroot is used.
788 801 # As overhead for journaling and reserved blocks 35% are added.
789 802 ROOT_SECTORS=$(expr "$(expr "${CHROOT_SIZE}" + "${CHROOT_SIZE}" \/ 100 \* 35)" \* 1024 \/ 512)
790 803
791 804 # Calculate required image size in 512 Byte sectors
792 805 IMAGE_SECTORS=$(expr "${TABLE_SECTORS}" + "${FRMW_SECTORS}" + "${ROOT_SECTORS}")
793 806
794 807 # Prepare image file
795 808 if [ "$ENABLE_SPLITFS" = true ] ; then
796 809 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count="${TABLE_SECTORS}"
797 810 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count=0 seek="${FRMW_SECTORS}"
798 811 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count="${TABLE_SECTORS}"
799 812 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count=0 seek="${ROOT_SECTORS}"
800 813
801 814 # Write firmware/boot partition tables
802 815 sfdisk -q -L -uS -f "$IMAGE_NAME-frmw.img" 2> /dev/null <<EOM
803 816 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
804 817 EOM
805 818
806 819 # Write root partition table
807 820 sfdisk -q -L -uS -f "$IMAGE_NAME-root.img" 2> /dev/null <<EOM
808 821 ${TABLE_SECTORS},${ROOT_SECTORS},83
809 822 EOM
810 823
811 824 # Setup temporary loop devices
812 825 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show "$IMAGE_NAME"-frmw.img)"
813 826 ROOT_LOOP="$(losetup -o 1M -f --show "$IMAGE_NAME"-root.img)"
814 827 else # ENABLE_SPLITFS=false
815 828 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count="${TABLE_SECTORS}"
816 829 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count=0 seek="${IMAGE_SECTORS}"
817 830
818 831 # Write partition table
819 832 sfdisk -q -L -uS -f "$IMAGE_NAME.img" 2> /dev/null <<EOM
820 833 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
821 834 ${ROOT_OFFSET},${ROOT_SECTORS},83
822 835 EOM
823 836
824 837 # Setup temporary loop devices
825 838 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show "$IMAGE_NAME".img)"
826 839 ROOT_LOOP="$(losetup -o 65M -f --show "$IMAGE_NAME".img)"
827 840 fi
828 841
829 842 if [ "$ENABLE_CRYPTFS" = true ] ; then
830 843 # Create dummy ext4 fs
831 844 mkfs.ext4 "$ROOT_LOOP"
832 845
833 846 # Setup password keyfile
834 847 touch .password
835 848 chmod 600 .password
836 849 echo -n ${CRYPTFS_PASSWORD} > .password
837 850
838 851 # Initialize encrypted partition
839 852 cryptsetup --verbose --debug -q luksFormat "${ROOT_LOOP}" -c "${CRYPTFS_CIPHER}" -h "${CRYPTFS_HASH}" -s "${CRYPTFS_XTSKEYSIZE}" .password
840 853
841 854 # Open encrypted partition and setup mapping
842 855 cryptsetup luksOpen "${ROOT_LOOP}" -d .password "${CRYPTFS_MAPPING}"
843 856
844 857 # Secure delete password keyfile
845 858 shred -zu .password
846 859
847 860 # Update temporary loop device
848 861 ROOT_LOOP="/dev/mapper/${CRYPTFS_MAPPING}"
849 862
850 863 # Wipe encrypted partition (encryption cipher is used for randomness)
851 864 dd if=/dev/zero of="${ROOT_LOOP}" bs=512 count="$(blockdev --getsz "${ROOT_LOOP}")"
852 865 fi
853 866
854 867 # Build filesystems
855 868 mkfs.vfat "$FRMW_LOOP"
856 869 mkfs.ext4 "$ROOT_LOOP"
857 870
858 871 # Mount the temporary loop devices
859 872 mkdir -p "$BUILDDIR/mount"
860 873 mount "$ROOT_LOOP" "$BUILDDIR/mount"
861 874
862 875 mkdir -p "$BUILDDIR/mount/boot/firmware"
863 876 mount "$FRMW_LOOP" "$BUILDDIR/mount/boot/firmware"
864 877
865 878 # Copy all files from the chroot to the loop device mount point directory
866 879 rsync -a "${R}/" "$BUILDDIR/mount/"
867 880
868 881 # Unmount all temporary loop devices and mount points
869 882 cleanup
870 883
871 884 # Create block map file(s) of image(s)
872 885 if [ "$ENABLE_SPLITFS" = true ] ; then
873 886 # Create block map files for "bmaptool"
874 887 bmaptool create -o "$IMAGE_NAME-frmw.bmap" "$IMAGE_NAME-frmw.img"
875 888 bmaptool create -o "$IMAGE_NAME-root.bmap" "$IMAGE_NAME-root.img"
876 889
877 890 # Image was successfully created
878 891 echo "$IMAGE_NAME-frmw.img ($(expr \( "${TABLE_SECTORS}" + "${FRMW_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
879 892 echo "$IMAGE_NAME-root.img ($(expr \( "${TABLE_SECTORS}" + "${ROOT_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
880 893 else
881 894 # Create block map file for "bmaptool"
882 895 bmaptool create -o "$IMAGE_NAME.bmap" "$IMAGE_NAME.img"
883 896
884 897 # Image was successfully created
885 898 echo "$IMAGE_NAME.img ($(expr \( "${TABLE_SECTORS}" + "${FRMW_SECTORS}" + "${ROOT_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
886 899
887 900 # Create qemu qcow2 image
888 901 if [ "$ENABLE_QEMU" = true ] ; then
889 902 QEMU_IMAGE=${QEMU_IMAGE:=${BASEDIR}/qemu/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
890 903 QEMU_SIZE=16G
891 904
892 905 qemu-img convert -f raw -O qcow2 "$IMAGE_NAME".img "$QEMU_IMAGE".qcow2
893 906 qemu-img resize "$QEMU_IMAGE".qcow2 $QEMU_SIZE
894 907
895 908 echo "$QEMU_IMAGE.qcow2 ($QEMU_SIZE)" ": successfully created"
896 909 fi
897 910 fi
General Comments 0
Vous devez vous connecter pour laisser un commentaire. Se connecter maintenant