##// END OF EJS Templates
Raspi2-3_GenImage
RSS

Cloner depuis https://github.com/drtyhlpr/rpi23-gen-image.git

All other RPI devices added
Unknown -
r254:e2c8cfd64f4b
parent child
Show More
Show file before | Show file after | Hide comments
@@ -1,458 +1,465
1 1 # rpi23-gen-image
2 2 ## Introduction
3 3 `rpi23-gen-image.sh` is an advanced Debian Linux bootstrapping shell script for generating Debian OS images for Raspberry Pi 2 (RPi2) and Raspberry Pi 3 (RPi3) computers. The script at this time supports the bootstrapping of the Debian (armhf) releases `jessie`, `stretch` and `buster`. Raspberry Pi 3 images are generated for 32-bit mode only. Raspberry Pi 3 64-bit images can be generated using custom configuration parameters (```templates/rpi3-stretch-arm64-4.11.y```).
4 4
5 5 ## Build dependencies
6 6 The following list of Debian packages must be installed on the build system because they are essentially required for the bootstrapping process. The script will check if all required packages are installed and missing packages will be installed automatically if confirmed by the user.
7 7
8 8 ```debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo```
9 9
10 10 It is recommended to configure the `rpi23-gen-image.sh` script to build and install the latest Raspberry Pi Linux kernel. For the RPi3 this is mandatory. Kernel compilation and linking will be performed on the build system using an ARM (armhf) cross-compiler toolchain.
11 11
12 12 The script has been tested using the default `crossbuild-essential-armhf` toolchain meta package on Debian Linux `jessie` and `stretch` build systems. Please check the [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains) for further information.
13 13
14 14 If a Debian Linux `jessie` build system is used it will be required to add the [Debian Cross-toolchains repository](http://emdebian.org/tools/debian/) first:
15 15
16 16 ```
17 17 echo "deb http://emdebian.org/tools/debian/ jessie main" > /etc/apt/sources.list.d/crosstools.list
18 18 sudo -u nobody wget -O - http://emdebian.org/tools/debian/emdebian-toolchain-archive.key | apt-key add -
19 19 dpkg --add-architecture armhf
20 20 apt-get update
21 21 ```
22 22
23 23 ## Command-line parameters
24 24 The script accepts certain command-line parameters to enable or disable specific OS features, services and configuration settings. These parameters are passed to the `rpi23-gen-image.sh` script via (simple) shell-variables. Unlike environment shell-variables (simple) shell-variables are defined at the beginning of the command-line call of the `rpi23-gen-image.sh` script.
25 25
26 26 ##### Command-line examples:
27 27 ```shell
28 28 ENABLE_UBOOT=true ./rpi23-gen-image.sh
29 29 ENABLE_CONSOLE=false ENABLE_IPV6=false ./rpi23-gen-image.sh
30 30 ENABLE_WM=xfce4 ENABLE_FBTURBO=true ENABLE_MINBASE=true ./rpi23-gen-image.sh
31 31 ENABLE_HARDNET=true ENABLE_IPTABLES=true /rpi23-gen-image.sh
32 32 APT_SERVER=ftp.de.debian.org APT_PROXY="http://127.0.0.1:3142/" ./rpi23-gen-image.sh
33 33 ENABLE_MINBASE=true ./rpi23-gen-image.sh
34 34 BUILD_KERNEL=true ENABLE_MINBASE=true ENABLE_IPV6=false ./rpi23-gen-image.sh
35 35 BUILD_KERNEL=true KERNELSRC_DIR=/tmp/linux ./rpi23-gen-image.sh
36 36 ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
37 37 ENABLE_CRYPTFS=true CRYPTFS_PASSWORD=changeme EXPANDROOT=false ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
38 38 RELEASE=stretch BUILD_KERNEL=true ./rpi23-gen-image.sh
39 39 RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
40 40 RELEASE=stretch RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
41 41 ```
42 42
43 43 ## Configuration template files
44 44 To avoid long lists of command-line parameters and to help to store the favourite parameter configurations the `rpi23-gen-image.sh` script supports so called configuration template files (`CONFIG_TEMPLATE`=template). These are simple text files located in the `./templates` directory that contain the list of configuration parameters that will be used. New configuration template files can be added to the `./templates` directory.
45 45
46 46 ##### Command-line examples:
47 47 ```shell
48 48 CONFIG_TEMPLATE=rpi3stretch ./rpi23-gen-image.sh
49 49 CONFIG_TEMPLATE=rpi2stretch ./rpi23-gen-image.sh
50 50 ```
51 51
52 52 ## Supported parameters and settings
53 53 #### APT settings:
54 54 ##### `APT_SERVER`="ftp.debian.org"
55 55 Set Debian packages server address. Choose a server from the list of Debian worldwide [mirror sites](https://www.debian.org/mirror/list). Using a nearby server will probably speed-up all required downloads within the bootstrapping process.
56 56
57 57 ##### `APT_PROXY`=""
58 58 Set Proxy server address. Using a local Proxy-Cache like `apt-cacher-ng` will speed-up the bootstrapping process because all required Debian packages will only be downloaded from the Debian mirror site once.
59 59
60 60 ##### `APT_INCLUDES`=""
61 61 A comma separated list of additional packages to be installed by debootstrap during bootstrapping.
62 62
63 63 ##### `APT_INCLUDES_LATE`=""
64 64 A comma separated list of additional packages to be installed by apt after bootstrapping and after APT sources are set up. This is useful for packages with pre-depends, which debootstrap do not handle well.
65 65
66 66 ---
67 67
68 68 #### General system settings:
69 69 ##### `RPI_MODEL`=2
70 Specifiy the target Raspberry Pi hardware model. The script at this time supports the Raspberry Pi models `2`,`3` and `3B`. `BUILD_KERNEL`=true will automatically be set if the Raspberry Pi model `3` or `3B` is used.
70 Specifiy the target Raspberry Pi hardware model. The script at this time supports the following Raspberry Pi models:
71 `0` = Used for Raspberry Pi 0 and Raspberry Pi 0 W
72 `1` = Used for Pi 1 model A and B
73 `1P` = Used for Pi 1 model B+ and A+
74 `2` = Used for Pi 2 model B
75 `3` = Used for Pi 3 model B
76 `3P` = Used for Pi 3 model B+
77 `BUILD_KERNEL`=true will automatically be set if the Raspberry Pi model `3` or `3P` is used.
71 78
72 79 ##### `RELEASE`="jessie"
73 80 Set the desired Debian release name. The script at this time supports the bootstrapping of the Debian releases "jessie", "stretch" and "buster". `BUILD_KERNEL`=true will automatically be set if the Debian releases `stretch` or `buster` are used.
74 81
75 82 ##### `RELEASE_ARCH`="armhf"
76 83 Set the desired Debian release architecture.
77 84
78 85 ##### `HOSTNAME`="rpi$RPI_MODEL-$RELEASE"
79 86 Set system host name. It's recommended that the host name is unique in the corresponding subnet.
80 87
81 88 ##### `PASSWORD`="raspberry"
82 89 Set system `root` password. It's **STRONGLY** recommended that you choose a custom password.
83 90
84 91 ##### `USER_PASSWORD`="raspberry"
85 92 Set password for the created non-root user `USER_NAME`=pi. Ignored if `ENABLE_USER`=false. It's **STRONGLY** recommended that you choose a custom password.
86 93
87 94 ##### `DEFLOCAL`="en_US.UTF-8"
88 95 Set default system locale. This setting can also be changed inside the running OS using the `dpkg-reconfigure locales` command. Please note that on using this parameter the script will automatically install the required packages `locales`, `keyboard-configuration` and `console-setup`.
89 96
90 97 ##### `TIMEZONE`="Europe/Berlin"
91 98 Set default system timezone. All available timezones can be found in the `/usr/share/zoneinfo/` directory. This setting can also be changed inside the running OS using the `dpkg-reconfigure tzdata` command.
92 99
93 100 ##### `EXPANDROOT`=true
94 101 Expand the root partition and filesystem automatically on first boot.
95 102
96 103 ---
97 104
98 105 #### Keyboard settings:
99 106 These options are used to configure keyboard layout in `/etc/default/keyboard` for console and Xorg. These settings can also be changed inside the running OS using the `dpkg-reconfigure keyboard-configuration` command.
100 107
101 108 ##### `XKB_MODEL`=""
102 109 Set the name of the model of your keyboard type.
103 110
104 111 ##### `XKB_LAYOUT`=""
105 112 Set the supported keyboard layout(s).
106 113
107 114 ##### `XKB_VARIANT`=""
108 115 Set the supported variant(s) of the keyboard layout(s).
109 116
110 117 ##### `XKB_OPTIONS`=""
111 118 Set extra xkb configuration options.
112 119
113 120 ---
114 121
115 122 #### Networking settings (DHCP):
116 123 This parameter is used to set up networking auto configuration in `/etc/systemd/network/eth.network`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.`
117 124
118 125 ##### `ENABLE_DHCP`=true
119 126 Set the system to use DHCP. This requires an DHCP server.
120 127
121 128 ---
122 129
123 130 #### Networking settings (static):
124 131 These parameters are used to set up a static networking configuration in `/etc/systemd/network/eth.network`. The following static networking parameters are only supported if `ENABLE_DHCP` was set to `false`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.
125 132
126 133 ##### `NET_ADDRESS`=""
127 134 Set a static IPv4 or IPv6 address and its prefix, separated by "/", eg. "192.169.0.3/24".
128 135
129 136 ##### `NET_GATEWAY`=""
130 137 Set the IP address for the default gateway.
131 138
132 139 ##### `NET_DNS_1`=""
133 140 Set the IP address for the first DNS server.
134 141
135 142 ##### `NET_DNS_2`=""
136 143 Set the IP address for the second DNS server.
137 144
138 145 ##### `NET_DNS_DOMAINS`=""
139 146 Set the default DNS search domains to use for non fully qualified host names.
140 147
141 148 ##### `NET_NTP_1`=""
142 149 Set the IP address for the first NTP server.
143 150
144 151 ##### `NET_NTP_2`=""
145 152 Set the IP address for the second NTP server.
146 153
147 154 ---
148 155
149 156 #### Basic system features:
150 157 ##### `ENABLE_CONSOLE`=true
151 158 Enable serial console interface. Recommended if no monitor or keyboard is connected to the RPi2/3. In case of problems fe. if the network (auto) configuration failed - the serial console can be used to access the system.
152 159
153 160 ##### `ENABLE_I2C`=false
154 161 Enable I2C interface on the RPi2/3. Please check the [RPi2/3 pinout diagrams](http://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
155 162
156 163 ##### `ENABLE_SPI`=false
157 164 Enable SPI interface on the RPi2/3. Please check the [RPi2/3 pinout diagrams](http://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
158 165
159 166 ##### `ENABLE_IPV6`=true
160 167 Enable IPv6 support. The network interface configuration is managed via systemd-networkd.
161 168
162 169 ##### `ENABLE_SSHD`=true
163 170 Install and enable OpenSSH service. The default configuration of the service doesn't allow `root` to login. Please use the user `pi` instead and `su -` or `sudo` to execute commands as root.
164 171
165 172 ##### `ENABLE_NONFREE`=false
166 173 Allow the installation of non-free Debian packages that do not comply with the DFSG. This is required to install closed-source firmware binary blobs.
167 174
168 175 ##### `ENABLE_WIRELESS`=false
169 176 Download and install the [closed-source firmware binary blob](https://github.com/RPi-Distro/firmware-nonfree/tree/master/brcm80211/brcm) that is required to run the internal wireless interface of the Raspberry Pi model `3`. This parameter is ignored if the specified `RPI_MODEL` is not `3`.
170 177
171 178 ##### `ENABLE_RSYSLOG`=true
172 179 If set to false, disable and uninstall rsyslog (so logs will be available only
173 180 in journal files)
174 181
175 182 ##### `ENABLE_SOUND`=true
176 183 Enable sound hardware and install Advanced Linux Sound Architecture.
177 184
178 185 ##### `ENABLE_HWRANDOM`=true
179 186 Enable Hardware Random Number Generator. Strong random numbers are important for most network based communications that use encryption. It's recommended to be enabled.
180 187
181 188 ##### `ENABLE_MINGPU`=false
182 189 Minimize the amount of shared memory reserved for the GPU. It doesn't seem to be possible to fully disable the GPU.
183 190
184 191 ##### `ENABLE_DBUS`=true
185 192 Install and enable D-Bus message bus. Please note that systemd should work without D-bus but it's recommended to be enabled.
186 193
187 194 ##### `ENABLE_XORG`=false
188 195 Install Xorg open-source X Window System.
189 196
190 197 ##### `ENABLE_WM`=""
191 198 Install a user defined window manager for the X Window System. To make sure all X related package dependencies are getting installed `ENABLE_XORG` will automatically get enabled if `ENABLE_WM` is used. The `rpi23-gen-image.sh` script has been tested with the following list of window managers: `blackbox`, `openbox`, `fluxbox`, `jwm`, `dwm`, `xfce4`, `awesome`.
192 199
193 200 ---
194 201
195 202 #### Advanced system features:
196 203 ##### `ENABLE_MINBASE`=false
197 204 Use debootstrap script variant `minbase` which only includes essential packages and apt. This will reduce the disk usage by about 65 MB.
198 205
199 206 ##### `ENABLE_REDUCE`=false
200 207 Reduce the disk space usage by deleting packages and files. See `REDUCE_*` parameters for detailed information.
201 208
202 209 ##### `ENABLE_UBOOT`=false
203 210 Replace the default RPi2/3 second stage bootloader (bootcode.bin) with [U-Boot bootloader](http://git.denx.de/?p=u-boot.git;a=summary). U-Boot can boot images via the network using the BOOTP/TFTP protocol.
204 211
205 212 ##### `UBOOTSRC_DIR`=""
206 213 Path to a directory (`u-boot`) of [U-Boot bootloader sources](http://git.denx.de/?p=u-boot.git;a=summary) that will be copied, configured, build and installed inside the chroot.
207 214
208 215 ##### `ENABLE_FBTURBO`=false
209 216 Install and enable the [hardware accelerated Xorg video driver](https://github.com/ssvb/xf86-video-fbturbo) `fbturbo`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling.
210 217
211 218 ##### `FBTURBOSRC_DIR`=""
212 219 Path to a directory (`xf86-video-fbturbo`) of [hardware accelerated Xorg video driver sources](https://github.com/ssvb/xf86-video-fbturbo) that will be copied, configured, build and installed inside the chroot.
213 220
214 221 ##### `ENABLE_IPTABLES`=false
215 222 Enable iptables IPv4/IPv6 firewall. Simplified ruleset: Allow all outgoing connections. Block all incoming connections except to OpenSSH service.
216 223
217 224 ##### `ENABLE_USER`=true
218 225 Create non-root user with password `USER_PASSWORD`=raspberry. Unless overridden with `USER_NAME`=user, username will be `pi`.
219 226
220 227 ##### `USER_NAME`=pi
221 228 Non-root user to create. Ignored if `ENABLE_USER`=false
222 229
223 230 ##### `ENABLE_ROOT`=false
224 231 Set root user password so root login will be enabled
225 232
226 233 ##### `ENABLE_HARDNET`=false
227 234 Enable IPv4/IPv6 network stack hardening settings.
228 235
229 236 ##### `ENABLE_SPLITFS`=false
230 237 Enable having root partition on an USB drive by creating two image files: one for the `/boot/firmware` mount point, and another for `/`.
231 238
232 239 ##### `CHROOT_SCRIPTS`=""
233 240 Path to a directory with scripts that should be run in the chroot before the image is finally built. Every executable file in this directory is run in lexicographical order.
234 241
235 242 ##### `ENABLE_INITRAMFS`=false
236 243 Create an initramfs that that will be loaded during the Linux startup process. `ENABLE_INITRAMFS` will automatically get enabled if `ENABLE_CRYPTFS`=true. This parameter will be ignored if `BUILD_KERNEL`=false.
237 244
238 245 ##### `ENABLE_IFNAMES`=true
239 246 Enable automatic assignment of predictable, stable network interface names for all local Ethernet, WLAN interfaces. This might create complex and long interface names. This parameter is only supported if the Debian releases `stretch` or `buster` are used.
240 247
241 248 ##### `DISABLE_UNDERVOLT_WARNINGS`=
242 249 Disable RPi2/3 under-voltage warnings and overlays. Setting the parameter to `1` will disable the warning overlay. Setting it to `2` will additionally allow RPi2/3 turbo mode when low-voltage is present.
243 250
244 251 ---
245 252
246 253 #### SSH settings:
247 254 ##### `SSH_ENABLE_ROOT`=false
248 255 Enable password root login via SSH. This may be a security risk with default password, use only in trusted environments. `ENABLE_ROOT` must be set to `true`.
249 256
250 257 ##### `SSH_DISABLE_PASSWORD_AUTH`=false
251 258 Disable password based SSH authentication. Only public key based SSH (v2) authentication will be supported.
252 259
253 260 ##### `SSH_LIMIT_USERS`=false
254 261 Limit the users that are allowed to login via SSH. Only allow user `USER_NAME`=pi and root if `SSH_ENABLE_ROOT`=true to login. This parameter will be ignored if `dropbear` SSH is used (`REDUCE_SSHD`=true).
255 262
256 263 ##### `SSH_ROOT_PUB_KEY`=""
257 264 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `root`. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported. `ENABLE_ROOT` **and** `SSH_ENABLE_ROOT` must be set to `true`.
258 265
259 266 ##### `SSH_USER_PUB_KEY`=""
260 267 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `USER_NAME`=pi. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported.
261 268
262 269 ---
263 270
264 271 #### Kernel compilation:
265 272 ##### `BUILD_KERNEL`=false
266 273 Build and install the latest RPi2/3 Linux kernel. Currently only the default RPi2/3 kernel configuration is used. `BUILD_KERNEL`=true will automatically be set if the Raspberry Pi model `3` is used.
267 274
268 275 ##### `CROSS_COMPILE`="arm-linux-gnueabihf-"
269 276 This sets the cross compile enviornment for the compiler.
270 277
271 278 ##### `KERNEL_ARCH`="arm"
272 279 This sets the kernel architecture for the compiler.
273 280
274 281 ##### `KERNEL_IMAGE`="kernel7.img"
275 282 Name of the image file in the boot partition. If not set, `KERNEL_IMAGE` will be set to "kernel8.img" automatically if building for arm64.
276 283
277 284 ##### `KERNEL_BRANCH`=""
278 285 Name of the requested branch from the GIT location for the RPi Kernel. Default is using the current default branch from the GIT site.
279 286
280 287 ##### `QEMU_BINARY`="/usr/bin/qemu-arm-static"
281 288 Sets the QEMU enviornment for the Debian archive. If not set, `QEMU_BINARY` will be set to "/usr/bin/qemu-aarch64-static" automatically if building for arm64.
282 289
283 290 ##### `KERNEL_DEFCONFIG`="bcm2709_defconfig"
284 291 Sets the default config for kernel compiling. If not set, `KERNEL_DEFCONFIG` will be set to "bcmrpi3\_defconfig" automatically if building for arm64.
285 292
286 293 ##### `KERNEL_REDUCE`=false
287 294 Reduce the size of the generated kernel by removing unwanted device, network and filesystem drivers (experimental).
288 295
289 296 ##### `KERNEL_THREADS`=1
290 297 Number of parallel kernel building threads. If the parameter is left untouched the script will automatically determine the number of CPU cores to set the number of parallel threads to speed the kernel compilation.
291 298
292 299 ##### `KERNEL_HEADERS`=true
293 300 Install kernel headers with built kernel.
294 301
295 302 ##### `KERNEL_MENUCONFIG`=false
296 303 Start `make menuconfig` interactive menu-driven kernel configuration. The script will continue after `make menuconfig` was terminated.
297 304
298 305 ##### `KERNEL_OLDDEFCONFIG`=false
299 306 Run `make olddefconfig` to automatically set all new kernel configuration options to their recommended default values.
300 307
301 308 ##### `KERNEL_CCACHE`=false
302 309 Compile the kernel using ccache. This speeds up kernel recompilation by caching previous compilations and detecting when the same compilation is being done again.
303 310
304 311 ##### `KERNEL_REMOVESRC`=true
305 312 Remove all kernel sources from the generated OS image after it was built and installed.
306 313
307 314 ##### `KERNELSRC_DIR`=""
308 315 Path to a directory (`linux`) of [RaspberryPi Linux kernel sources](https://github.com/raspberrypi/linux) that will be copied, configured, build and installed inside the chroot.
309 316
310 317 ##### `KERNELSRC_CLEAN`=false
311 318 Clean the existing kernel sources directory `KERNELSRC_DIR` (using `make mrproper`) after it was copied to the chroot and before the compilation of the kernel has started. This parameter will be ignored if no `KERNELSRC_DIR` was specified or if `KERNELSRC_PREBUILT`=true.
312 319
313 320 ##### `KERNELSRC_CONFIG`=true
314 321 Run `make bcm2709_defconfig` (and optional `make menuconfig`) to configure the kernel sources before building. This parameter is automatically set to `true` if no existing kernel sources directory was specified using `KERNELSRC_DIR`. This parameter is ignored if `KERNELSRC_PREBUILT`=true.
315 322
316 323 ##### `KERNELSRC_USRCONFIG`=""
317 324 Copy own config file to kernel `.config`. If `KERNEL_MENUCONFIG`=true then running after copy.
318 325
319 326 ##### `KERNELSRC_PREBUILT`=false
320 327 With this parameter set to true the script expects the existing kernel sources directory to be already successfully cross-compiled. The parameters `KERNELSRC_CLEAN`, `KERNELSRC_CONFIG`, `KERNELSRC_USRCONFIG` and `KERNEL_MENUCONFIG` are ignored and no kernel compilation tasks are performed.
321 328
322 329 ##### `RPI_FIRMWARE_DIR`=""
323 330 The directory (`firmware`) containing a local copy of the firmware from the [RaspberryPi firmware project](https://github.com/raspberrypi/firmware). Default is to download the latest firmware directly from the project.
324 331
325 332 ---
326 333
327 334 #### Reduce disk usage:
328 335 The following list of parameters is ignored if `ENABLE_REDUCE`=false.
329 336
330 337 ##### `REDUCE_APT`=true
331 338 Configure APT to use compressed package repository lists and no package caching files.
332 339
333 340 ##### `REDUCE_DOC`=true
334 341 Remove all doc files (harsh). Configure APT to not include doc files on future `apt-get` package installations.
335 342
336 343 ##### `REDUCE_MAN`=true
337 344 Remove all man pages and info files (harsh). Configure APT to not include man pages on future `apt-get` package installations.
338 345
339 346 ##### `REDUCE_VIM`=false
340 347 Replace `vim-tiny` package by `levee` a tiny vim clone.
341 348
342 349 ##### `REDUCE_BASH`=false
343 350 Remove `bash` package and switch to `dash` shell (experimental).
344 351
345 352 ##### `REDUCE_HWDB`=true
346 353 Remove PCI related hwdb files (experimental).
347 354
348 355 ##### `REDUCE_SSHD`=true
349 356 Replace `openssh-server` with `dropbear`.
350 357
351 358 ##### `REDUCE_LOCALE`=true
352 359 Remove all `locale` translation files.
353 360
354 361 ---
355 362
356 363 #### Encrypted root partition:
357 364 ##### `ENABLE_CRYPTFS`=false
358 365 Enable full system encryption with dm-crypt. Setup a fully LUKS encrypted root partition (aes-xts-plain64:sha512) and generate required initramfs. The /boot directory will not be encrypted. This parameter will be ignored if `BUILD_KERNEL`=false. `ENABLE_CRYPTFS` is experimental. SSH-to-initramfs is currently not supported but will be soon - feel free to help.
359 366
360 367 ##### `CRYPTFS_PASSWORD`=""
361 368 Set password of the encrypted root partition. This parameter is mandatory if `ENABLE_CRYPTFS`=true.
362 369
363 370 ##### `CRYPTFS_MAPPING`="secure"
364 371 Set name of dm-crypt managed device-mapper mapping.
365 372
366 373 ##### `CRYPTFS_CIPHER`="aes-xts-plain64:sha512"
367 374 Set cipher specification string. `aes-xts*` ciphers are strongly recommended.
368 375
369 376 ##### `CRYPTFS_XTSKEYSIZE`=512
370 377 Sets key size in bits. The argument has to be a multiple of 8.
371 378
372 379 ---
373 380
374 381 #### Build settings:
375 382 ##### `BASEDIR`=$(pwd)/images/${RELEASE}
376 383 Set a path to a working directory used by the script to generate an image.
377 384
378 385 ##### `IMAGE_NAME`=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}
379 386 Set a filename for the output file(s). Note: the script will create $IMAGE_NAME.img if `ENABLE_SPLITFS`=false or $IMAGE_NAME-frmw.img and $IMAGE_NAME-root.img if `ENABLE_SPLITFS`=true. Note 2: If the KERNEL_BRANCH is not set, the word "CURRENT" is used.
380 387
381 388 ## Understanding the script
382 389 The functions of this script that are required for the different stages of the bootstrapping are split up into single files located inside the `bootstrap.d` directory. During the bootstrapping every script in this directory gets executed in lexicographical order:
383 390
384 391 | Script | Description |
385 392 | --- | --- |
386 393 | `10-bootstrap.sh` | Debootstrap basic system |
387 394 | `11-apt.sh` | Setup APT repositories |
388 395 | `12-locale.sh` | Setup Locales and keyboard settings |
389 396 | `13-kernel.sh` | Build and install RPi2/3 Kernel |
390 397 | `14-fstab.sh` | Setup fstab and initramfs |
391 398 | `15-rpi-config.sh` | Setup RPi2/3 config and cmdline |
392 399 | `20-networking.sh` | Setup Networking |
393 400 | `21-firewall.sh` | Setup Firewall |
394 401 | `30-security.sh` | Setup Users and Security settings |
395 402 | `31-logging.sh` | Setup Logging |
396 403 | `32-sshd.sh` | Setup SSH and public keys |
397 404 | `41-uboot.sh` | Build and Setup U-Boot |
398 405 | `42-fbturbo.sh` | Build and Setup fbturbo Xorg driver |
399 406 | `50-firstboot.sh` | First boot actions |
400 407 | `99-reduce.sh` | Reduce the disk space usage |
401 408
402 409 All the required configuration files that will be copied to the generated OS image are located inside the `files` directory. It is not recommended to modify these configuration files manually.
403 410
404 411 | Directory | Description |
405 412 | --- | --- |
406 413 | `apt` | APT management configuration files |
407 414 | `boot` | Boot and RPi2/3 configuration files |
408 415 | `dpkg` | Package Manager configuration |
409 416 | `etc` | Configuration files and rc scripts |
410 417 | `firstboot` | Scripts that get executed on first boot |
411 418 | `initramfs` | Initramfs scripts |
412 419 | `iptables` | Firewall configuration files |
413 420 | `locales` | Locales configuration |
414 421 | `modules` | Kernel Modules configuration |
415 422 | `mount` | Fstab configuration |
416 423 | `network` | Networking configuration files |
417 424 | `sysctl.d` | Swapping and Network Hardening configuration |
418 425 | `xorg` | fbturbo Xorg driver configuration |
419 426
420 427 ## Custom packages and scripts
421 428 Debian custom packages, i.e. those not in the debian repositories, can be installed by placing them in the `packages` directory. They are installed immediately after packages from the repositories are installed. Any dependencies listed in the custom packages will be downloaded automatically from the repositories. Do not list these custom packages in `APT_INCLUDES`.
422 429
423 430 Scripts in the custom.d directory will be executed after all other installation is complete but before the image is created.
424 431
425 432 ## Logging of the bootstrapping process
426 433 All information related to the bootstrapping process and the commands executed by the `rpi23-gen-image.sh` script can easily be saved into a logfile. The common shell command `script` can be used for this purpose:
427 434
428 435 ```shell
429 436 script -c 'APT_SERVER=ftp.de.debian.org ./rpi23-gen-image.sh' ./build.log
430 437 ```
431 438
432 439 ## Flashing the image file
433 440 After the image file was successfully created by the `rpi23-gen-image.sh` script it can be copied to the microSD card that will be used by the RPi2/3 computer. This can be performed by using the tools `bmaptool` or `dd`. Using `bmaptool` will probably speed-up the copy process because `bmaptool` copies more wisely than `dd`.
434 441
435 442 ##### Flashing examples:
436 443 ```shell
437 444 bmaptool copy ./images/jessie/2017-01-23-rpi3-jessie.img /dev/mmcblk0
438 445 dd bs=4M if=./images/jessie/2017-01-23-rpi3-jessie.img of=/dev/mmcblk0
439 446 ```
440 447 If you have set `ENABLE_SPLITFS`, copy the `-frmw` image on the microSD card, then the `-root` one on the USB drive:
441 448 ```shell
442 449 bmaptool copy ./images/jessie/2017-01-23-rpi3-jessie-frmw.img /dev/mmcblk0
443 450 bmaptool copy ./images/jessie/2017-01-23-rpi3-jessie-root.img /dev/sdc
444 451 ```
445 452 ## Weekly image builds
446 453 The image files are provided by JRWR'S I/O PORT and are built once a Sunday at midnight UTC!
447 454 * [Debian Stretch Raspberry Pi2/3 Weekly Image Builds](https://jrwr.io/doku.php?id=projects:debianpi)
448 455
449 456 ## External links and references
450 457 * [Debian worldwide mirror sites](https://www.debian.org/mirror/list)
451 458 * [Debian Raspberry Pi 2 Wiki](https://wiki.debian.org/RaspberryPi2)
452 459 * [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains)
453 460 * [Official Raspberry Pi Firmware on github](https://github.com/raspberrypi/firmware)
454 461 * [Official Raspberry Pi Kernel on github](https://github.com/raspberrypi/linux)
455 462 * [U-BOOT git repository](http://git.denx.de/?p=u-boot.git;a=summary)
456 463 * [Xorg DDX driver fbturbo](https://github.com/ssvb/xf86-video-fbturbo)
457 464 * [RPi3 Wireless interface firmware](https://github.com/RPi-Distro/firmware-nonfree/tree/master/brcm80211/brcm)
458 465 * [Collabora RPi2 Kernel precompiled](https://repositories.collabora.co.uk/debian/)
Show file before | Show file after | Hide comments
@@ -1,663 +1,691
1 1 #!/bin/sh
2 2
3 3 ########################################################################
4 4 # rpi23-gen-image.sh 2015-2017
5 5 #
6 6 # Advanced Debian "jessie", "stretch" and "buster" bootstrap script for RPi2/3
7 7 #
8 8 # This program is free software; you can redistribute it and/or
9 9 # modify it under the terms of the GNU General Public License
10 10 # as published by the Free Software Foundation; either version 2
11 11 # of the License, or (at your option) any later version.
12 12 #
13 13 # Copyright (C) 2015 Jan Wagner <mail@jwagner.eu>
14 14 #
15 15 # Big thanks for patches and enhancements by 20+ github contributors!
16 16 ########################################################################
17 17
18 18 # Are we running as root?
19 19 if [ "$(id -u)" -ne "0" ] ; then
20 20 echo "error: this script must be executed with root privileges!"
21 21 exit 1
22 22 fi
23 23
24 24 # Check if ./functions.sh script exists
25 25 if [ ! -r "./functions.sh" ] ; then
26 26 echo "error: './functions.sh' required script not found!"
27 27 exit 1
28 28 fi
29 29
30 30 # Load utility functions
31 31 . ./functions.sh
32 32
33 33 # Load parameters from configuration template file
34 34 if [ ! -z "$CONFIG_TEMPLATE" ] ; then
35 35 use_template
36 36 fi
37 37
38 38 # Introduce settings
39 39 set -e
40 40 echo -n -e "\n#\n# RPi2/3 Bootstrap Settings\n#\n"
41 41 set -x
42 42
43 43 # Raspberry Pi model configuration
44 44 RPI_MODEL=${RPI_MODEL:=2}
45 #bcm2708-rpi-0-w.dtb (Used for Pi 0 and PI 0W)
46 RPI0_DTB_FILE=${RPI0_DTB_FILE:=bcm2708-rpi-0-w.dtb}
47 RPI0_UBOOT_CONFIG=${RPI0_UBOOT_CONFIG:=rpi_defconfig}
48 #bcm2708-rpi-b.dtb (Used for Pi 1 model A and B)
49 RPI1_DTB_FILE=${RPI1_DTB_FILE:=bcm2708-rpi-b.dtb}
50 RPI1_UBOOT_CONFIG=${RPI1_UBOOT_CONFIG:=rpi_defconfig}
51 #bcm2708-rpi-b-plus.dtb (Used for Pi 1 model B+ and A+)
52 RPI1P_DTB_FILE=${RPI1P_DTB_FILE:=bcm2708-rpi-b-plus.dtb}
53 RPI1P_UBOOT_CONFIG=${RPI1P_UBOOT_CONFIG:=rpi_defconfig}
54 #bcm2709-rpi-2-b.dtb (Used for Pi 2 model B)
45 55 RPI2_DTB_FILE=${RPI2_DTB_FILE:=bcm2709-rpi-2-b.dtb}
46 56 RPI2_UBOOT_CONFIG=${RPI2_UBOOT_CONFIG:=rpi_2_defconfig}
57 #bcm2710-rpi-3-b.dtb (Used for Pi 3 model B)
47 58 RPI3_DTB_FILE=${RPI3_DTB_FILE:=bcm2710-rpi-3-b.dtb}
48 59 RPI3_UBOOT_CONFIG=${RPI3_UBOOT_CONFIG:=rpi_3_32b_defconfig}
49 RPI3B_DTB_FILE=${RPI3B_DTB_FILE:=bcm2710-rpi-3-b-plus.dtb}
50 RPI3B_UBOOT_CONFIG=${RPI3_UBOOT_CONFIG:=rpi_3_32b_defconfig}
60 #bcm2710-rpi-3-b-plus.dtb (Used for Pi 3 model B+)
61 RPI3P_DTB_FILE=${RPI3P_DTB_FILE:=bcm2710-rpi-3-b-plus.dtb}
62 RPI3P_UBOOT_CONFIG=${RPI3P_UBOOT_CONFIG:=rpi_3_32b_defconfig}
51 63
52 64 # Debian release
53 65 RELEASE=${RELEASE:=jessie}
54 66 KERNEL_ARCH=${KERNEL_ARCH:=arm}
55 67 RELEASE_ARCH=${RELEASE_ARCH:=armhf}
56 68 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabihf-}
57 69 COLLABORA_KERNEL=${COLLABORA_KERNEL:=3.18.0-trunk-rpi2}
58 70 if [ "$KERNEL_ARCH" = "arm64" ] ; then
59 71 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi3_defconfig}
60 72 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel8.img}
73 elif [RPI_MODEL] = 0 || [RPI_MODEL = 1] || [RPI_MODEL = 1P]
74 #RASPBERRY PI 1, PI ZERO, PI ZERO W, AND COMPUTE MODULE DEFAULT Kernel BUILD CONFIGURATION
75 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi_defconfig}
76 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel7.img}
61 77 else
78 #RASPBERRY PI 2, PI 3, PI 3+, AND COMPUTE MODULE 3 DEFAULT Kernel BUILD CONFIGURATION
79 #https://www.raspberrypi.org/documentation/linux/kernel/building.md
62 80 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2709_defconfig}
63 81 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel7.img}
64 82 fi
83
65 84 if [ "$RELEASE_ARCH" = "arm64" ] ; then
66 85 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-aarch64-static}
67 86 else
68 87 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-arm-static}
69 88 fi
70 89 KERNEL_BRANCH=${KERNEL_BRANCH:=""}
71 90
72 91 # URLs
73 92 KERNEL_URL=${KERNEL_URL:=https://github.com/raspberrypi/linux}
74 93 FIRMWARE_URL=${FIRMWARE_URL:=https://github.com/raspberrypi/firmware/raw/master/boot}
75 94 WLAN_FIRMWARE_URL=${WLAN_FIRMWARE_URL:=https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm}
76 95 COLLABORA_URL=${COLLABORA_URL:=https://repositories.collabora.co.uk/debian}
77 96 FBTURBO_URL=${FBTURBO_URL:=https://github.com/ssvb/xf86-video-fbturbo.git}
78 97 UBOOT_URL=${UBOOT_URL:=git://git.denx.de/u-boot.git}
79 98
80 99 # Build directories
81 100 BASEDIR=${BASEDIR:=$(pwd)/images/${RELEASE}}
82 101 BUILDDIR="${BASEDIR}/build"
83 102
84 103 # Prepare date string for default image file name
85 104 DATE="$(date +%Y-%m-%d)"
86 105 if [ -z "$KERNEL_BRANCH" ] ; then
87 106 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
88 107 else
89 108 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
90 109 fi
91 110
92 111 # Chroot directories
93 112 R="${BUILDDIR}/chroot"
94 113 ETC_DIR="${R}/etc"
95 114 LIB_DIR="${R}/lib"
96 115 BOOT_DIR="${R}/boot/firmware"
97 116 KERNEL_DIR="${R}/usr/src/linux"
98 117 WLAN_FIRMWARE_DIR="${R}/lib/firmware/brcm"
99 118
100 119 # Firmware directory: Blank if download from github
101 120 RPI_FIRMWARE_DIR=${RPI_FIRMWARE_DIR:=""}
102 121
103 122 # General settings
104 123 HOSTNAME=${HOSTNAME:=rpi${RPI_MODEL}-${RELEASE}}
105 124 PASSWORD=${PASSWORD:=raspberry}
106 125 USER_PASSWORD=${USER_PASSWORD:=raspberry}
107 126 DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}
108 127 TIMEZONE=${TIMEZONE:="Europe/Berlin"}
109 128 EXPANDROOT=${EXPANDROOT:=true}
110 129
111 130 # Keyboard settings
112 131 XKB_MODEL=${XKB_MODEL:=""}
113 132 XKB_LAYOUT=${XKB_LAYOUT:=""}
114 133 XKB_VARIANT=${XKB_VARIANT:=""}
115 134 XKB_OPTIONS=${XKB_OPTIONS:=""}
116 135
117 136 # Network settings (DHCP)
118 137 ENABLE_DHCP=${ENABLE_DHCP:=true}
119 138
120 139 # Network settings (static)
121 140 NET_ADDRESS=${NET_ADDRESS:=""}
122 141 NET_GATEWAY=${NET_GATEWAY:=""}
123 142 NET_DNS_1=${NET_DNS_1:=""}
124 143 NET_DNS_2=${NET_DNS_2:=""}
125 144 NET_DNS_DOMAINS=${NET_DNS_DOMAINS:=""}
126 145 NET_NTP_1=${NET_NTP_1:=""}
127 146 NET_NTP_2=${NET_NTP_2:=""}
128 147
129 148 # APT settings
130 149 APT_PROXY=${APT_PROXY:=""}
131 150 APT_SERVER=${APT_SERVER:="ftp.debian.org"}
132 151
133 152 # Feature settings
134 153 ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}
135 154 ENABLE_I2C=${ENABLE_I2C:=false}
136 155 ENABLE_SPI=${ENABLE_SPI:=false}
137 156 ENABLE_IPV6=${ENABLE_IPV6:=true}
138 157 ENABLE_SSHD=${ENABLE_SSHD:=true}
139 158 ENABLE_NONFREE=${ENABLE_NONFREE:=false}
140 159 ENABLE_WIRELESS=${ENABLE_WIRELESS:=false}
141 160 ENABLE_SOUND=${ENABLE_SOUND:=true}
142 161 ENABLE_DBUS=${ENABLE_DBUS:=true}
143 162 ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}
144 163 ENABLE_MINGPU=${ENABLE_MINGPU:=false}
145 164 ENABLE_XORG=${ENABLE_XORG:=false}
146 165 ENABLE_WM=${ENABLE_WM:=""}
147 166 ENABLE_RSYSLOG=${ENABLE_RSYSLOG:=true}
148 167 ENABLE_USER=${ENABLE_USER:=true}
149 168 USER_NAME=${USER_NAME:="pi"}
150 169 ENABLE_ROOT=${ENABLE_ROOT:=false}
151 170
152 171 # SSH settings
153 172 SSH_ENABLE_ROOT=${SSH_ENABLE_ROOT:=false}
154 173 SSH_DISABLE_PASSWORD_AUTH=${SSH_DISABLE_PASSWORD_AUTH:=false}
155 174 SSH_LIMIT_USERS=${SSH_LIMIT_USERS:=false}
156 175 SSH_ROOT_PUB_KEY=${SSH_ROOT_PUB_KEY:=""}
157 176 SSH_USER_PUB_KEY=${SSH_USER_PUB_KEY:=""}
158 177
159 178 # Advanced settings
160 179 ENABLE_MINBASE=${ENABLE_MINBASE:=false}
161 180 ENABLE_REDUCE=${ENABLE_REDUCE:=false}
162 181 ENABLE_UBOOT=${ENABLE_UBOOT:=false}
163 182 UBOOTSRC_DIR=${UBOOTSRC_DIR:=""}
164 183 ENABLE_FBTURBO=${ENABLE_FBTURBO:=false}
165 184 FBTURBOSRC_DIR=${FBTURBOSRC_DIR:=""}
166 185 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
167 186 ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
168 187 ENABLE_SPLITFS=${ENABLE_SPLITFS:=false}
169 188 ENABLE_INITRAMFS=${ENABLE_INITRAMFS:=false}
170 189 ENABLE_IFNAMES=${ENABLE_IFNAMES:=true}
171 190 DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS:=}
172 191
173 192 # Kernel compilation settings
174 193 BUILD_KERNEL=${BUILD_KERNEL:=false}
175 194 KERNEL_REDUCE=${KERNEL_REDUCE:=false}
176 195 KERNEL_THREADS=${KERNEL_THREADS:=1}
177 196 KERNEL_HEADERS=${KERNEL_HEADERS:=true}
178 197 KERNEL_MENUCONFIG=${KERNEL_MENUCONFIG:=false}
179 198 KERNEL_REMOVESRC=${KERNEL_REMOVESRC:=true}
180 199 KERNEL_OLDDEFCONFIG=${KERNEL_OLDDEFCONFIG:=false}
181 200 KERNEL_CCACHE=${KERNEL_CCACHE:=false}
182 201
183 202 if [ "$KERNEL_ARCH" = "arm64" ] ; then
184 203 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="Image"}
185 204 else
186 205 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="zImage"}
187 206 fi
188 207
189 208 # Kernel compilation from source directory settings
190 209 KERNELSRC_DIR=${KERNELSRC_DIR:=""}
191 210 KERNELSRC_CLEAN=${KERNELSRC_CLEAN:=false}
192 211 KERNELSRC_CONFIG=${KERNELSRC_CONFIG:=true}
193 212 KERNELSRC_PREBUILT=${KERNELSRC_PREBUILT:=false}
194 213
195 214 # Reduce disk usage settings
196 215 REDUCE_APT=${REDUCE_APT:=true}
197 216 REDUCE_DOC=${REDUCE_DOC:=true}
198 217 REDUCE_MAN=${REDUCE_MAN:=true}
199 218 REDUCE_VIM=${REDUCE_VIM:=false}
200 219 REDUCE_BASH=${REDUCE_BASH:=false}
201 220 REDUCE_HWDB=${REDUCE_HWDB:=true}
202 221 REDUCE_SSHD=${REDUCE_SSHD:=true}
203 222 REDUCE_LOCALE=${REDUCE_LOCALE:=true}
204 223
205 224 # Encrypted filesystem settings
206 225 ENABLE_CRYPTFS=${ENABLE_CRYPTFS:=false}
207 226 CRYPTFS_PASSWORD=${CRYPTFS_PASSWORD:=""}
208 227 CRYPTFS_MAPPING=${CRYPTFS_MAPPING:="secure"}
209 228 CRYPTFS_CIPHER=${CRYPTFS_CIPHER:="aes-xts-plain64:sha512"}
210 229 CRYPTFS_XTSKEYSIZE=${CRYPTFS_XTSKEYSIZE:=512}
211 230
212 231 # Chroot scripts directory
213 232 CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""}
214 233
215 234 # Packages required in the chroot build environment
216 235 APT_INCLUDES=${APT_INCLUDES:=""}
217 236 APT_INCLUDES="${APT_INCLUDES},apt-transport-https,apt-utils,ca-certificates,debian-archive-keyring,dialog,sudo,systemd,sysvinit-utils"
218 237
219 238 # Packages required for bootstrapping
220 239 REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo"
221 240 MISSING_PACKAGES=""
222 241
223 242 # Packages installed for c/c++ build environment in chroot (keep empty)
224 243 COMPILER_PACKAGES=""
225 244
226 245 set +x
227 246
228 247 # Set Raspberry Pi model specific configuration
229 if [ "$RPI_MODEL" = 2 ] ; then
248 elif [ "$RPI_MODEL" = 0 ] ; then
249 DTB_FILE=${RPI2_DTB_FILE}
250 UBOOT_CONFIG=${RPI2_UBOOT_CONFIG}
251 elif [ "$RPI_MODEL" = 1 ] ; then
252 DTB_FILE=${RPI2_DTB_FILE}
253 UBOOT_CONFIG=${RPI2_UBOOT_CONFIG}
254 elif [ "$RPI_MODEL" = 1P ] ; then
255 DTB_FILE=${RPI2_DTB_FILE}
256 UBOOT_CONFIG=${RPI2_UBOOT_CONFIG}
257 elif [ "$RPI_MODEL" = 2 ] ; then
230 258 DTB_FILE=${RPI2_DTB_FILE}
231 259 UBOOT_CONFIG=${RPI2_UBOOT_CONFIG}
232 260 elif [ "$RPI_MODEL" = 3 ] ; then
233 261 DTB_FILE=${RPI3_DTB_FILE}
234 262 UBOOT_CONFIG=${RPI3_UBOOT_CONFIG}
235 263 BUILD_KERNEL=true
236 elif [ "$RPI_MODEL" = 3B ] ; then
237 DTB_FILE=${RPI3B_DTB_FILE}
238 UBOOT_CONFIG=${RPI3B_UBOOT_CONFIG}
264 elif [ "$RPI_MODEL" = 3P ] ; then
265 DTB_FILE=${RPI3P_DTB_FILE}
266 UBOOT_CONFIG=${RPI3P_UBOOT_CONFIG}
239 267 BUILD_KERNEL=true
240 268 else
241 269 echo "error: Raspberry Pi model ${RPI_MODEL} is not supported!"
242 270 exit 1
243 271 fi
244 272
245 273 # Check if the internal wireless interface is supported by the RPi model
246 274 if [ "$ENABLE_WIRELESS" = true ] && [ "$RPI_MODEL" = 2 ]; then
247 275 echo "error: The selected Raspberry Pi model has no internal wireless interface"
248 276 exit 1
249 277 fi
250 278
251 279 # Check if DISABLE_UNDERVOLT_WARNINGS parameter value is supported
252 280 if [ ! -z "$DISABLE_UNDERVOLT_WARNINGS" ] ; then
253 281 if [ "$DISABLE_UNDERVOLT_WARNINGS" != 1 ] && [ "$DISABLE_UNDERVOLT_WARNINGS" != 2 ] ; then
254 282 echo "error: DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS} is not supported"
255 283 exit 1
256 284 fi
257 285 fi
258 286
259 287 # Build RPi2/3 Linux kernel if required by Debian release
260 288 if [ "$RELEASE" = "stretch" ] || [ "$RELEASE" = "buster" ] ; then
261 289 BUILD_KERNEL=true
262 290 fi
263 291
264 292 # Add packages required for kernel cross compilation
265 293 if [ "$BUILD_KERNEL" = true ] ; then
266 294 if [ "$KERNEL_ARCH" = "arm" ] ; then
267 295 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armhf"
268 296 else
269 297 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-arm64"
270 298 fi
271 299 fi
272 300
273 301 # Add libncurses5 to enable kernel menuconfig
274 302 if [ "$KERNEL_MENUCONFIG" = true ] ; then
275 303 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libncurses5-dev"
276 304 fi
277 305
278 306 # Add ccache compiler cache for (faster) kernel cross (re)compilation
279 307 if [ "$KERNEL_CCACHE" = true ] ; then
280 308 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} ccache"
281 309 fi
282 310
283 311 # Add cryptsetup package to enable filesystem encryption
284 312 if [ "$ENABLE_CRYPTFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
285 313 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cryptsetup"
286 314 APT_INCLUDES="${APT_INCLUDES},cryptsetup,console-setup"
287 315
288 316 if [ -z "$CRYPTFS_PASSWORD" ] ; then
289 317 echo "error: no password defined (CRYPTFS_PASSWORD)!"
290 318 exit 1
291 319 fi
292 320 ENABLE_INITRAMFS=true
293 321 fi
294 322
295 323 # Add initramfs generation tools
296 324 if [ "$ENABLE_INITRAMFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
297 325 APT_INCLUDES="${APT_INCLUDES},initramfs-tools"
298 326 fi
299 327
300 328 # Add device-tree-compiler required for building the U-Boot bootloader
301 329 if [ "$ENABLE_UBOOT" = true ] ; then
302 330 APT_INCLUDES="${APT_INCLUDES},device-tree-compiler"
303 331 fi
304 332
305 333 # Check if root SSH (v2) public key file exists
306 334 if [ ! -z "$SSH_ROOT_PUB_KEY" ] ; then
307 335 if [ ! -f "$SSH_ROOT_PUB_KEY" ] ; then
308 336 echo "error: '$SSH_ROOT_PUB_KEY' specified SSH public key file not found (SSH_ROOT_PUB_KEY)!"
309 337 exit 1
310 338 fi
311 339 fi
312 340
313 341 # Check if $USER_NAME SSH (v2) public key file exists
314 342 if [ ! -z "$SSH_USER_PUB_KEY" ] ; then
315 343 if [ ! -f "$SSH_USER_PUB_KEY" ] ; then
316 344 echo "error: '$SSH_USER_PUB_KEY' specified SSH public key file not found (SSH_USER_PUB_KEY)!"
317 345 exit 1
318 346 fi
319 347 fi
320 348
321 349 # Check if all required packages are installed on the build system
322 350 for package in $REQUIRED_PACKAGES ; do
323 351 if [ "`dpkg-query -W -f='${Status}' $package`" != "install ok installed" ] ; then
324 352 MISSING_PACKAGES="${MISSING_PACKAGES} $package"
325 353 fi
326 354 done
327 355
328 356 # If there are missing packages ask confirmation for install, or exit
329 357 if [ -n "$MISSING_PACKAGES" ] ; then
330 358 echo "the following packages needed by this script are not installed:"
331 359 echo "$MISSING_PACKAGES"
332 360
333 361 echo -n "\ndo you want to install the missing packages right now? [y/n] "
334 362 read confirm
335 363 [ "$confirm" != "y" ] && exit 1
336 364
337 365 # Make sure all missing required packages are installed
338 366 apt-get -qq -y install ${MISSING_PACKAGES}
339 367 fi
340 368
341 369 # Check if ./bootstrap.d directory exists
342 370 if [ ! -d "./bootstrap.d/" ] ; then
343 371 echo "error: './bootstrap.d' required directory not found!"
344 372 exit 1
345 373 fi
346 374
347 375 # Check if ./files directory exists
348 376 if [ ! -d "./files/" ] ; then
349 377 echo "error: './files' required directory not found!"
350 378 exit 1
351 379 fi
352 380
353 381 # Check if specified KERNELSRC_DIR directory exists
354 382 if [ -n "$KERNELSRC_DIR" ] && [ ! -d "$KERNELSRC_DIR" ] ; then
355 383 echo "error: '${KERNELSRC_DIR}' specified directory not found (KERNELSRC_DIR)!"
356 384 exit 1
357 385 fi
358 386
359 387 # Check if specified UBOOTSRC_DIR directory exists
360 388 if [ -n "$UBOOTSRC_DIR" ] && [ ! -d "$UBOOTSRC_DIR" ] ; then
361 389 echo "error: '${UBOOTSRC_DIR}' specified directory not found (UBOOTSRC_DIR)!"
362 390 exit 1
363 391 fi
364 392
365 393 # Check if specified FBTURBOSRC_DIR directory exists
366 394 if [ -n "$FBTURBOSRC_DIR" ] && [ ! -d "$FBTURBOSRC_DIR" ] ; then
367 395 echo "error: '${FBTURBOSRC_DIR}' specified directory not found (FBTURBOSRC_DIR)!"
368 396 exit 1
369 397 fi
370 398
371 399 # Check if specified CHROOT_SCRIPTS directory exists
372 400 if [ -n "$CHROOT_SCRIPTS" ] && [ ! -d "$CHROOT_SCRIPTS" ] ; then
373 401 echo "error: ${CHROOT_SCRIPTS} specified directory not found (CHROOT_SCRIPTS)!"
374 402 exit 1
375 403 fi
376 404
377 405 # Check if specified device mapping already exists (will be used by cryptsetup)
378 406 if [ -r "/dev/mapping/${CRYPTFS_MAPPING}" ] ; then
379 407 echo "error: mapping /dev/mapping/${CRYPTFS_MAPPING} already exists, not proceeding"
380 408 exit 1
381 409 fi
382 410
383 411 # Don't clobber an old build
384 412 if [ -e "$BUILDDIR" ] ; then
385 413 echo "error: directory ${BUILDDIR} already exists, not proceeding"
386 414 exit 1
387 415 fi
388 416
389 417 # Setup chroot directory
390 418 mkdir -p "${R}"
391 419
392 420 # Check if build directory has enough of free disk space >512MB
393 421 if [ "$(df --output=avail ${BUILDDIR} | sed "1d")" -le "524288" ] ; then
394 422 echo "error: ${BUILDDIR} not enough space left to generate the output image!"
395 423 exit 1
396 424 fi
397 425
398 426 set -x
399 427
400 428 # Call "cleanup" function on various signals and errors
401 429 trap cleanup 0 1 2 3 6
402 430
403 431 # Add required packages for the minbase installation
404 432 if [ "$ENABLE_MINBASE" = true ] ; then
405 433 APT_INCLUDES="${APT_INCLUDES},vim-tiny,netbase,net-tools,ifupdown"
406 434 fi
407 435
408 436 # Add required locales packages
409 437 if [ "$DEFLOCAL" != "en_US.UTF-8" ] ; then
410 438 APT_INCLUDES="${APT_INCLUDES},locales,keyboard-configuration,console-setup"
411 439 fi
412 440
413 441 # Add parted package, required to get partprobe utility
414 442 if [ "$EXPANDROOT" = true ] ; then
415 443 APT_INCLUDES="${APT_INCLUDES},parted"
416 444 fi
417 445
418 446 # Add dbus package, recommended if using systemd
419 447 if [ "$ENABLE_DBUS" = true ] ; then
420 448 APT_INCLUDES="${APT_INCLUDES},dbus"
421 449 fi
422 450
423 451 # Add iptables IPv4/IPv6 package
424 452 if [ "$ENABLE_IPTABLES" = true ] ; then
425 453 APT_INCLUDES="${APT_INCLUDES},iptables"
426 454 fi
427 455
428 456 # Add openssh server package
429 457 if [ "$ENABLE_SSHD" = true ] ; then
430 458 APT_INCLUDES="${APT_INCLUDES},openssh-server"
431 459 fi
432 460
433 461 # Add alsa-utils package
434 462 if [ "$ENABLE_SOUND" = true ] ; then
435 463 APT_INCLUDES="${APT_INCLUDES},alsa-utils"
436 464 fi
437 465
438 466 # Add rng-tools package
439 467 if [ "$ENABLE_HWRANDOM" = true ] ; then
440 468 APT_INCLUDES="${APT_INCLUDES},rng-tools"
441 469 fi
442 470
443 471 # Add fbturbo video driver
444 472 if [ "$ENABLE_FBTURBO" = true ] ; then
445 473 # Enable xorg package dependencies
446 474 ENABLE_XORG=true
447 475 fi
448 476
449 477 # Add user defined window manager package
450 478 if [ -n "$ENABLE_WM" ] ; then
451 479 APT_INCLUDES="${APT_INCLUDES},${ENABLE_WM}"
452 480
453 481 # Enable xorg package dependencies
454 482 ENABLE_XORG=true
455 483 fi
456 484
457 485 # Add xorg package
458 486 if [ "$ENABLE_XORG" = true ] ; then
459 487 APT_INCLUDES="${APT_INCLUDES},xorg,dbus-x11"
460 488 fi
461 489
462 490 # Replace selected packages with smaller clones
463 491 if [ "$ENABLE_REDUCE" = true ] ; then
464 492 # Add levee package instead of vim-tiny
465 493 if [ "$REDUCE_VIM" = true ] ; then
466 494 APT_INCLUDES="$(echo ${APT_INCLUDES} | sed "s/vim-tiny/levee/")"
467 495 fi
468 496
469 497 # Add dropbear package instead of openssh-server
470 498 if [ "$REDUCE_SSHD" = true ] ; then
471 499 APT_INCLUDES="$(echo ${APT_INCLUDES} | sed "s/openssh-server/dropbear/")"
472 500 fi
473 501 fi
474 502
475 503 if [ "$RELEASE" != "jessie" ] ; then
476 504 APT_INCLUDES="${APT_INCLUDES},libnss-systemd"
477 505 fi
478 506
479 507 # Configure kernel sources if no KERNELSRC_DIR
480 508 if [ "$BUILD_KERNEL" = true ] && [ -z "$KERNELSRC_DIR" ] ; then
481 509 KERNELSRC_CONFIG=true
482 510 fi
483 511
484 512 # Configure reduced kernel
485 513 if [ "$KERNEL_REDUCE" = true ] ; then
486 514 KERNELSRC_CONFIG=false
487 515 fi
488 516
489 517 # Execute bootstrap scripts
490 518 for SCRIPT in bootstrap.d/*.sh; do
491 519 head -n 3 "$SCRIPT"
492 520 . "$SCRIPT"
493 521 done
494 522
495 523 ## Execute custom bootstrap scripts
496 524 if [ -d "custom.d" ] ; then
497 525 for SCRIPT in custom.d/*.sh; do
498 526 . "$SCRIPT"
499 527 done
500 528 fi
501 529
502 530 # Execute custom scripts inside the chroot
503 531 if [ -n "$CHROOT_SCRIPTS" ] && [ -d "$CHROOT_SCRIPTS" ] ; then
504 532 cp -r "${CHROOT_SCRIPTS}" "${R}/chroot_scripts"
505 533 chroot_exec /bin/bash -x <<'EOF'
506 534 for SCRIPT in /chroot_scripts/* ; do
507 535 if [ -f $SCRIPT -a -x $SCRIPT ] ; then
508 536 $SCRIPT
509 537 fi
510 538 done
511 539 EOF
512 540 rm -rf "${R}/chroot_scripts"
513 541 fi
514 542
515 543 # Remove c/c++ build environment from the chroot
516 544 chroot_remove_cc
517 545
518 546 # Remove apt-utils
519 547 if [ "$RELEASE" = "jessie" ] ; then
520 548 chroot_exec apt-get purge -qq -y --force-yes apt-utils
521 549 fi
522 550
523 551 # Generate required machine-id
524 552 MACHINE_ID=$(dbus-uuidgen)
525 553 echo -n "${MACHINE_ID}" > "${R}/var/lib/dbus/machine-id"
526 554 echo -n "${MACHINE_ID}" > "${ETC_DIR}/machine-id"
527 555
528 556 # APT Cleanup
529 557 chroot_exec apt-get -y clean
530 558 chroot_exec apt-get -y autoclean
531 559 chroot_exec apt-get -y autoremove
532 560
533 561 # Unmount mounted filesystems
534 562 umount -l "${R}/proc"
535 563 umount -l "${R}/sys"
536 564
537 565 # Clean up directories
538 566 rm -rf "${R}/run/*"
539 567 rm -rf "${R}/tmp/*"
540 568
541 569 # Clean up files
542 570 rm -f "${ETC_DIR}/ssh/ssh_host_*"
543 571 rm -f "${ETC_DIR}/dropbear/dropbear_*"
544 572 rm -f "${ETC_DIR}/apt/sources.list.save"
545 573 rm -f "${ETC_DIR}/resolvconf/resolv.conf.d/original"
546 574 rm -f "${ETC_DIR}/*-"
547 575 rm -f "${ETC_DIR}/apt/apt.conf.d/10proxy"
548 576 rm -f "${ETC_DIR}/resolv.conf"
549 577 rm -f "${R}/root/.bash_history"
550 578 rm -f "${R}/var/lib/urandom/random-seed"
551 579 rm -f "${R}/initrd.img"
552 580 rm -f "${R}/vmlinuz"
553 581 rm -f "${R}${QEMU_BINARY}"
554 582
555 583 # Calculate size of the chroot directory in KB
556 584 CHROOT_SIZE=$(expr `du -s "${R}" | awk '{ print $1 }'`)
557 585
558 586 # Calculate the amount of needed 512 Byte sectors
559 587 TABLE_SECTORS=$(expr 1 \* 1024 \* 1024 \/ 512)
560 588 FRMW_SECTORS=$(expr 64 \* 1024 \* 1024 \/ 512)
561 589 ROOT_OFFSET=$(expr ${TABLE_SECTORS} + ${FRMW_SECTORS})
562 590
563 591 # The root partition is EXT4
564 592 # This means more space than the actual used space of the chroot is used.
565 593 # As overhead for journaling and reserved blocks 35% are added.
566 594 ROOT_SECTORS=$(expr $(expr ${CHROOT_SIZE} + ${CHROOT_SIZE} \/ 100 \* 35) \* 1024 \/ 512)
567 595
568 596 # Calculate required image size in 512 Byte sectors
569 597 IMAGE_SECTORS=$(expr ${TABLE_SECTORS} + ${FRMW_SECTORS} + ${ROOT_SECTORS})
570 598
571 599 # Prepare image file
572 600 if [ "$ENABLE_SPLITFS" = true ] ; then
573 601 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count=${TABLE_SECTORS}
574 602 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count=0 seek=${FRMW_SECTORS}
575 603 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count=${TABLE_SECTORS}
576 604 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count=0 seek=${ROOT_SECTORS}
577 605
578 606 # Write firmware/boot partition tables
579 607 sfdisk -q -L -uS -f "$IMAGE_NAME-frmw.img" 2> /dev/null <<EOM
580 608 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
581 609 EOM
582 610
583 611 # Write root partition table
584 612 sfdisk -q -L -uS -f "$IMAGE_NAME-root.img" 2> /dev/null <<EOM
585 613 ${TABLE_SECTORS},${ROOT_SECTORS},83
586 614 EOM
587 615
588 616 # Setup temporary loop devices
589 617 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $IMAGE_NAME-frmw.img)"
590 618 ROOT_LOOP="$(losetup -o 1M -f --show $IMAGE_NAME-root.img)"
591 619 else # ENABLE_SPLITFS=false
592 620 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count=${TABLE_SECTORS}
593 621 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count=0 seek=${IMAGE_SECTORS}
594 622
595 623 # Write partition table
596 624 sfdisk -q -L -uS -f "$IMAGE_NAME.img" 2> /dev/null <<EOM
597 625 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
598 626 ${ROOT_OFFSET},${ROOT_SECTORS},83
599 627 EOM
600 628
601 629 # Setup temporary loop devices
602 630 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $IMAGE_NAME.img)"
603 631 ROOT_LOOP="$(losetup -o 65M -f --show $IMAGE_NAME.img)"
604 632 fi
605 633
606 634 if [ "$ENABLE_CRYPTFS" = true ] ; then
607 635 # Create dummy ext4 fs
608 636 mkfs.ext4 "$ROOT_LOOP"
609 637
610 638 # Setup password keyfile
611 639 touch .password
612 640 chmod 600 .password
613 641 echo -n ${CRYPTFS_PASSWORD} > .password
614 642
615 643 # Initialize encrypted partition
616 644 echo "YES" | cryptsetup luksFormat "${ROOT_LOOP}" -c "${CRYPTFS_CIPHER}" -s "${CRYPTFS_XTSKEYSIZE}" .password
617 645
618 646 # Open encrypted partition and setup mapping
619 647 cryptsetup luksOpen "${ROOT_LOOP}" -d .password "${CRYPTFS_MAPPING}"
620 648
621 649 # Secure delete password keyfile
622 650 shred -zu .password
623 651
624 652 # Update temporary loop device
625 653 ROOT_LOOP="/dev/mapper/${CRYPTFS_MAPPING}"
626 654
627 655 # Wipe encrypted partition (encryption cipher is used for randomness)
628 656 dd if=/dev/zero of="${ROOT_LOOP}" bs=512 count=$(blockdev --getsz "${ROOT_LOOP}")
629 657 fi
630 658
631 659 # Build filesystems
632 660 mkfs.vfat "$FRMW_LOOP"
633 661 mkfs.ext4 "$ROOT_LOOP"
634 662
635 663 # Mount the temporary loop devices
636 664 mkdir -p "$BUILDDIR/mount"
637 665 mount "$ROOT_LOOP" "$BUILDDIR/mount"
638 666
639 667 mkdir -p "$BUILDDIR/mount/boot/firmware"
640 668 mount "$FRMW_LOOP" "$BUILDDIR/mount/boot/firmware"
641 669
642 670 # Copy all files from the chroot to the loop device mount point directory
643 671 rsync -a "${R}/" "$BUILDDIR/mount/"
644 672
645 673 # Unmount all temporary loop devices and mount points
646 674 cleanup
647 675
648 676 # Create block map file(s) of image(s)
649 677 if [ "$ENABLE_SPLITFS" = true ] ; then
650 678 # Create block map files for "bmaptool"
651 679 bmaptool create -o "$IMAGE_NAME-frmw.bmap" "$IMAGE_NAME-frmw.img"
652 680 bmaptool create -o "$IMAGE_NAME-root.bmap" "$IMAGE_NAME-root.img"
653 681
654 682 # Image was successfully created
655 683 echo "$IMAGE_NAME-frmw.img ($(expr \( ${TABLE_SECTORS} + ${FRMW_SECTORS} \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
656 684 echo "$IMAGE_NAME-root.img ($(expr \( ${TABLE_SECTORS} + ${ROOT_SECTORS} \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
657 685 else
658 686 # Create block map file for "bmaptool"
659 687 bmaptool create -o "$IMAGE_NAME.bmap" "$IMAGE_NAME.img"
660 688
661 689 # Image was successfully created
662 690 echo "$IMAGE_NAME.img ($(expr \( ${TABLE_SECTORS} + ${FRMW_SECTORS} + ${ROOT_SECTORS} \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
663 691 fi
General Comments 0
Vous devez vous connecter pour laisser un commentaire. Se connecter maintenant