What is additionally needed under produced nix develop docker image compared as today?

[tlaurion]

I would love to hear you on this.

As of today, the nix flake develop environment (flake.nix) under master includes

• qemu built against canokey-qemu (upstreamed under nix and prebuilt and as per Use nixos-unstable channel's prebuilt qemu_full with canokey support builtin from nix cache #1687)
  • meaning all features but TPMTOTP sealed to USB Security dongle through reverse HOTP can be tested under qemu
  • qemu supports swtpm which is also deployed with the docker image
  • flashing support of qemu q35 coreboot rom will be possible in the future (tracked under Have qemu boards support writeable pflash and internal flashing #1203)

So basically, today

• q35 coreboot bochs gpu provides virtualized sysfb->efifb compatibility testing for coreboot releases version bump for regression
• swtpm provides emulated tpm1/2 support for testing tpm related firmware integrity attestation, TPM Disk Unlock Key (DUK) and kexec into next OS with DUK unsealed from TPM and passed to final OS
• Canokey provides OpenGPG virtual smartcard support for testing
  • Trying to get their attention to develop reverse HOTP to become compatble with Heads for remote attestation (Reverse HOTP support  canokeys/canokey-qemu#7)
• flashrom support for internal flashing will be soon a thing
• diffoscopeMinimal is included to investigate differences in reproducible build, if any diff comes up between CircleCI and local builds for a Heads commit where docker image for that commit can be reproduced reproducibly and match docker image hash under docker hub, where Circleci config shows which docker image version was used to produce rom image reproducibly as well.
• qemu board configs enable DEBUG + TRACING verbose output for anyone being interested into the internal workings of Heads, with output being redirected to /tmp/debug.log, pausing for introspection prior of rebooting or booting final OS in both kvm/qemu tcg mode.

---

What else is desired to be present into flake.nix/produced docker image so that we stabilize it into version 1.0.0? (0.1.9 as of #1687 to be merged in the next days after PR approval)

[tlaurion]

Next planned steps

• Have musl cross used from nix instead of bootstrapping it (should be easy)
  • Would require global Makefile to check for presence of exposed muslc present in docker image
  • Would require phasing out usage of module/musl-cross (actually being musl-cross-make, misleadingly)
• Maybe use coreboot buildstacks so that we don't bootstrap them
  • not sure how to do this effectively

But the goal of reaching out in this discussion is to seek for what is needed in dev/testing cycles today, outside of previous OP. What were you relying on that was made available from your host installation that would benefit using Nix derivatives instead and be packed in reproducible docker image, considering that the docker image should stabilize and not need to be rebuilt/re-downloaded often after that point in time (v1.0.0 of the docker image content is the goal of this discussion).

[tlaurion]

Asked matrix channel for users/devels/testers to comment here at https://matrix.to/#/!pAlHOfxQNPXOgFGTmo:matrix.org/$P44kQl4HLAKgwglg1stoxKLj11Q1BX604iy1dCSlmNc?via=matrix.org&via=nitro.chat&via=fairydust.space

[tlaurion]

On the long term we could imagine/dream/make reality:

• replacing building things ourselves and use arch (x86/ppc64 le) nix derivatives which are already stripped to only create initramfs with tools needed and collaborate uptream to nix for heads needs, but that would require changing the build system to use nix derivatives for everything build related
  • interesting projects in that realm, and probable grant application co-writing possible if synergies exist:
    • @amjoseph-nixpkgs's ownerboot : https://sr.ht/~amjoseph/ownerboot/ (Collaborate with ownerboot #1366)
    • @jmbaur's tinyboot: https://github.com/jmbaur/tinyboot (some testing done but not far yet (README.md out of date or missing something obvious! jmbaur/tinyboot#20)
    • @? 's tvix project (linuxboot+u-root+nix derivatives to pack initramfs) https://cs.tvl.fyi/depot/-/blob/tvix/boot/README.md (a lot of synergies possible there)

In more direct goals, pragmatic things:

• Ease Consider moving away of busybox #1484
• play more with Experiment with u-root (u-root-builder booted from network, and tinygoized u-root)  #1559, investigate squashfs layers, borrow ideas from TinyCore but with help of nix reproducibly built squashfs layers that could be fetched and cached under /boot and detached signed and reused, thanks to Add CDC based tethering over USB (CDC NCM/ECM compatible phones only) #1384, lowering dev/maintenance/test cycles costs and lowering what needs to be packed under firmware.

This is a place to throw ideas for co-written grant application writings, people :)

---

But it can also be really pragmatic as in: I need this https://search.nixos.org/packages already existing package in the docker image today. If so, please just say so/open an issue

Thanks!

[tlaurion]

Some python dependencies seem recommended for diffoscope but not shipped automatically, review and add.