New upstream version 2

1 files changed, 63 insertions, 12 deletions

diff --git a/README.md b/README.md
index 41c146b..c959f49 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # mkosi - Create legacy-free OS images
 
-A fancy wrapper around `dnf --installroot`, `debootstrap` and
-`pacstrap`, that may generate disk images with a number of
+A fancy wrapper around `dnf --installroot`, `debootstrap`,
+`pacstrap` and `zypper` that may generate disk images with a number of
 bells and whistles.
 
 # Supported output formats
@@ -12,6 +12,8 @@ The following output formats are supported:
 
 * Raw *GPT* disk image, with btrfs as root (*raw_btrfs*)
 
+* Raw *GPT* disk image, with squashfs as read-only root (*raw_squashfs*)
+
 * Plain directory, containing the *OS* tree (*directory*)
 
 * btrfs subvolume, with separate subvolumes for `/var`, `/home`,
@@ -28,6 +30,12 @@ options are available:
 
 * Separate partitions for `/srv` and `/home` may be added in
 
+* The root, /srv and /home partitions may optionally be encrypted with
+  LUKS.
+
+* A dm-verity partition may be added in that adds runtime integrity
+  data for the root partition
+
 # Compatibility
 
 Generated images are *legacy-free*. This means only *GPT* disk
@@ -35,9 +43,6 @@ labels (and no *MBR* disk labels) are supported, and only
 systemd based images may be generated. Moreover, for bootable
 images only *EFI* systems are supported (not plain *MBR/BIOS*).
 
-Currently, the *EFI* boot loader does not support *SecureBoot*,
-and hence cannot generate signed *SecureBoot* images.
-
 All generated *GPT* disk images may be booted in a local
 container directly with:
 
@@ -67,7 +72,7 @@ systemd-nspawn -bD image
 
 # Other features
 
-* Optionally, create an *SHA256SUM* checksum file for the result,
+* Optionally, create an *SHA256SUMS* checksum file for the result,
   possibly even signed via gpg.
 
 * Optionally, place a specific `.nspawn` settings file along
@@ -105,15 +110,18 @@ following *OS*es.
 
 * *Arch Linux* (incomplete)
 
+* *openSUSE*
+
 In theory, any distribution may be used on the host for
 building images containing any other distribution, as long as
 the necessary tools are available. Specifically, any distro
 that packages `debootstrap` may be used to build *Debian* or
 *Ubuntu* images. Any distro that packages `dnf` may be used to
 build *Fedora* images. Any distro that packages `pacstrap` may
-be used to build *Arch Linux* images.
+be used to build *Arch Linux* images. Any distro that packages
+`zypper` may be used to build *openSUSE* images.
 
-Currently, *Fedora* packages all three tools.
+Currently, *Fedora* packages the first three tools.
 
 # Files
 
@@ -132,6 +140,9 @@ they exist in the local directory:
   hence little more than a way to make sure simply typing
   `mkosi` without further parameters in your *source* tree is
   enough to get the right image of your choice set up.
+  Additionally if a `mkosi.default.d` directory exists, each file in it
+  is loaded in the same manner adding/overriding the values specified in
+  `mkosi.default`.
 
 * `mkosi.extra` may be a directory. If this exists all files
   contained in it are copied over the directory tree of the
@@ -158,12 +169,39 @@ they exist in the local directory:
   build script copied in. However, this time the contents of
   `$DESTDIR` is added into the image.
 
+* `mkosi.postinst` may be an executable script. If it exists it is
+  invoked as last step of preparing an image, from within the image
+  context. It is once called for the *development* image (if this is
+  enabled, see above) with the "build" command line parameter, right
+  before invoking the build script. It is called a second time for the
+  *final* image with the "final" command line parameter, right before
+  the image is considered complete. This script may be used to alter
+  the images without any restrictions, after all software packages and
+  built sources have been installed. Note that this script is executed
+  directly in the image context with the final root directory in
+  place, without any `$SRCDIR`/`$DESTDIR` setup.
+
 * `mkosi.nspawn` may be an nspawn settings file. If this exists
   it will be copied into the same place as the output image
   file. This is useful since nspawn looks for settings files
   next to image files it boots, for additional container
   runtime settings.
 
+* `mkosi.cache` may be a directory. If so, it is automatically used as
+  package download cache, in order to speed repeated runs of the tool.
+
+* `mkosi.passphrase` may be a passphrase file to use when LUKS
+  encryption is selected. It should contain the passphrase literally,
+  and not end in a newline character (i.e. in the same format as
+  cryptsetup and /etc/crypttab expect the passphrase files). The file
+  must have an access mode of 0600 or less. If this file does not
+  exist and encryption is requested the user is queried instead.
+
+* `mkosi.secure-boot.crt` and `mkosi.secure-boot.key` may contain an
+  X509 certificate and PEM private key to use when UEFI SecureBoot
+  support is enabled. All EFI binaries included in the image's ESP are
+  signed with this key, as a late step in the build process.
+
 All these files are optional.
 
 Note that the location of all these files may also be
@@ -192,7 +230,7 @@ Create and run a *Fedora* image into a plain directory:
 
 ```bash
 # mkosi -d fedora -t directory -o quux
-# systemd-nspawn -b quux
+# systemd-nspawn -b -D quux
 ```
 
 Create a compressed tar ball `image.raw.xz` and add a checksum
@@ -223,7 +261,7 @@ BuildPackages=make gcc libcurl-devel
 EOF
 # cat > mkosi.build <<EOF
 #!/bin/sh
-cd $SRCDIR <<EOF
+cd $SRCDIR
 ./autogen.sh
 ./configure --prefix=/usr
 make -j `nproc`
@@ -239,8 +277,21 @@ EOF
 mkosi is packaged for various distributions: Debian, Ubuntu, Arch (in AUR), Fedora.
 It is usually easiest to use the distribution package.
 
-When not using distribution packages, for example, on *Fedora* you need:
+When not using distribution packages make sure to install the
+necessary dependencies. For example, on *Fedora* you need:
 
 ```bash
-dnf install python3 debootstrap arch-install-scripts xz btrfs-progs dosfstools edk2-ovmf
+dnf install arch-install-scripts btrfs-progs debootstrap dosfstools edk2-ovmf squashfs-tools gnupg python3 tar veritysetup xz
+```
+
+Note that the minimum required Python version is 3.5.
+
+If SecureBoot signing is to be used, then the "sbsign" tool needs to
+be installed as well, which is currently not available on Fedora, but
+in a COPR repository:
+
+```bash
+
+dnf copr enable msekleta/sbsigntool
+dnf install sbsigntool
 ```