webnet/tailscale
1
0
Fork 0
Code Issues 1 Pull Requests Packages Projects Releases Wiki Activity

gokrazy, Makefile: improve appliance build tooling

Browse Source 
Several improvements to the gokrazy appliance build and flash workflow:

gokrazy/build.go:
  - Round Pi image size up to a power of 2 (QEMU raspi3b requires it)
  - Use monogok's mkfs.Perm for the /perm ext4 partition (pure Go,
    cross-platform, no e2fsprogs dependency)

gokrazy/mkfs:
  - Accept optional PermFile entries to include in the freshly-created
    ext4 filesystem (used for breakglass authorized_keys)
  - Use progresstracking.Ticker for flush progress reporting

gokrazy/tsapp*/config.json:
  - Point breakglass at /perm/breakglass.authorized_keys (not ec2)
  - Fix Pi SerialConsole to serial0,115200 (not ttyS0)

cmd/tailscale/cli/configure-flash-appliance.go:
  - Add --add-ssh-authorized-keys flag to write an authorized_keys
    file into /perm during flash (for breakglass SSH access)
  - Use progresstracking.CountingWriter + Ticker for write progress

Makefile:
  - tsapp-build-and-flash-pi: auto-include ~/.ssh/id_ed25519.pub
  - tsapp-qemu-pi: use virt machine + UEFI + ramfb + e1000 (working
    network + framebuffer), with DTB watchdog patch and
    gokrazy.log_to_serial for debugging
  - Auto-detect UEFI firmware path across Debian/Homebrew/Fedora

Updates #1866

Change-Id: Ifa97ad34c509a81e1637d9bce12a788037dfe5ec
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
This commit is contained in:
Brad Fitzpatrick
2026-07-02 09:24:01 -07:00
committed by Brad Fitzpatrick
parent 4c22d22df5
commit 76eece2d15
6 changed files with 108 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gokrazy/mkfs/mkfs.go
+22 -3
View File
@@ -38,11 +38,20 @@ const gptSecondaryReservedSectors = 34
const sectorSize = 512
// PermFile is a file to include in the /perm partition.
type PermFile struct {
Path string // path within the filesystem, e.g. "breakglass.authorized_keys"
Content []byte
}
// Perm creates an ext4 filesystem with volume label "PERM" inside the
// gokrazy /perm partition of f. devsizeBytes is the total disk size
// that the gokrazy GPT in f was written for; the partition layout is
// derived from it via [disklayout].
//
// If files is non-empty, the listed files are written into the
// filesystem before flushing to disk.
//
// To avoid issuing ext4.Create's hundreds of small scattered writes
// against slow storage one syscall at a time, the filesystem is first
// built in an in-memory sparse buffer and then only the genuinely
@@ -56,14 +65,14 @@ const sectorSize = 512
//
// f must be open read/write, and on macOS should be the buffered
// /dev/diskN device rather than the raw /dev/rdiskN alias.
func Perm(f *os.File, devsizeBytes int64) error {
func Perm(f *os.File, devsizeBytes int64, files ...PermFile) error {
permStart := int64(disklayout.PermStartLBA(disklayout.DefaultBootPartitionStartLBA)) * sectorSize
permSize := int64(disklayout.PermSize(disklayout.DefaultBootPartitionStartLBA, uint64(devsizeBytes))-gptSecondaryReservedSectors) * sectorSize
fmt.Fprintf(os.Stderr, "Formatting /perm as ext4 (PERM): %s filesystem\n", humanBytes(permSize))
mem := newMemBackend(permSize)
if _, err := ext4.Create(mem, permSize, 0, sectorSize, &ext4.Params{
fsys, err := ext4.Create(mem, permSize, 0, sectorSize, &ext4.Params{
VolumeName: "PERM",
// Force 4 KiB blocks. go-diskfs v1.9.3 otherwise defaults to 1
// KiB blocks regardless of filesystem size, which makes a 128
@@ -79,9 +88,19 @@ func Perm(f *os.File, devsizeBytes int64) error {
Features: []ext4.FeatureOpt{
ext4.WithFeatureReservedGDTBlocksForExpansion(false),
},
}); err != nil {
})
if err != nil {
return fmt.Errorf("ext4.Create: %w", err)
}
for _, pf := range files {
w, err := fsys.OpenFile("/"+pf.Path, os.O_CREATE|os.O_RDWR)
if err != nil {
return fmt.Errorf("create %s in /perm: %w", pf.Path, err)
}
if _, err := w.Write(pf.Content); err != nil {
return fmt.Errorf("write %s in /perm: %w", pf.Path, err)
}
}
return mem.flushTo(f, permStart)
}