Skip to content

Commit b76c50f

Browse files
chrishammchrishamm
committed
Merge remote-tracking branch 'RPi-Distro/master' into bullseye
2 parents b6131ed + 1d13a29 commit b76c50f

30 files changed

Lines changed: 187 additions & 93 deletions

File tree

‎README.md‎

Lines changed: 29 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,10 @@ Getting started is as simple as cloning this repository on your build machine. Y
3535
can do so with:
3636

3737
```bash
38-
git clone --depth 1 https://github.com/RPI-Distro/pi-gen.git
38+
git clone https://github.com/RPI-Distro/pi-gen.git
3939
```
4040

41-
Using `--depth 1` with `git clone` will create a shallow clone, only containing
41+
`--depth 1` can be added afer `git clone` to create a shallow clone, only containing
4242
the latest revision of the repository. Do not do this on your development machine.
4343

4444
Also, be careful to clone the repository to a base path **NOT** containing spaces.
@@ -88,8 +88,11 @@ The following environment variables are supported:
8888

8989
* `RELEASE` (Default: bullseye)
9090

91-
The release version to build images against. Valid values are jessie, stretch,
92-
buster, bullseye, and testing.
91+
The release version to build images against. Valid values are any supported
92+
Debian release. However, since different releases will have different sets of
93+
packages available, you'll need to either modify your stages accordingly, or
94+
checkout the appropriate branch. For example, if you'd like to build a
95+
`buster` image, you should do so from the `buster` branch.
9396

9497
* `APT_PROXY` (Default: unset)
9598

@@ -183,17 +186,26 @@ The following environment variables are supported:
183186
To get the current value from a running system, look in
184187
`/etc/timezone`.
185188

186-
* `FIRST_USER_NAME` (Default: "pi" )
189+
* `FIRST_USER_NAME` (Default: `pi`)
187190

188-
Username for the first user
191+
Username for the first user. This user only exists during the image creation process. Unless
192+
`DISABLE_FIRST_BOOT_USER_RENAME` is set to `1`, this user will be renamed on the first boot with
193+
a name chosen by the final user. This security feature is designed to prevent shipping images
194+
with a default username and help prevent malicious actors from taking over your devices.
189195

190-
* `FIRST_USER_PASS` (Default: "raspberry")
196+
* `FIRST_USER_PASS` (Default: unset)
191197

192-
Password for the first user
198+
Password for the first user. If unset, the account is locked.
199+
200+
* `DISABLE_FIRST_BOOT_USER_RENAME` (Default: `0`)
201+
202+
Disable the renaming of the first user during the first boot. This make it so `FIRST_USER_NAME`
203+
stays activated. `FIRST_USER_PASS` must be set for this to work. Please be aware of the implied
204+
security risk of defining a default username and password for your devices.
193205

194206
* `WPA_ESSID`, `WPA_PASSWORD` and `WPA_COUNTRY` (Default: unset)
195207

196-
If these are set, they are use to configure `wpa_supplicant.conf`, so that the Raspberry Pi can automatically connect to a wireless network on first boot. If `WPA_ESSID` is set and `WPA_PASSWORD` is unset an unprotected wireless network will be configured. If set, `WPA_PASSWORD` must be between 8 and 63 characters.
208+
If these are set, they are use to configure `wpa_supplicant.conf`, so that the Raspberry Pi can automatically connect to a wireless network on first boot. If `WPA_ESSID` is set and `WPA_PASSWORD` is unset an unprotected wireless network will be configured. If set, `WPA_PASSWORD` must be between 8 and 63 characters. `WPA_COUNTRY` is a 2-letter ISO/IEC 3166 country Code, i.e. `GB`
197209

198210
* `ENABLE_SSH` (Default: `0`)
199211

@@ -211,6 +223,13 @@ The following environment variables are supported:
211223
public key authentication. Note that if SSH is not enabled this will take
212224
effect when SSH becomes enabled.
213225

226+
* `SETFCAP` (Default: unset)
227+
228+
* Setting to `1` will prevent pi-gen from dropping the "capabilities"
229+
feature. Generating the root filesystem with capabilities enabled and running
230+
it from a filesystem that does not support capabilities (like NFS) can cause
231+
issues. Only enable this if you understand what it is.
232+
214233
* `STAGE_LIST` (Default: `stage*`)
215234

216235
If set, then instead of working through the numeric stages in order, this list will be followed. For example setting to `"stage0 stage1 mystage stage2"` will run the contents of `mystage` before stage2. Note that quotes are needed around the list. An absolute or relative path can be given for stages outside the pi-gen directory.
@@ -488,7 +507,7 @@ A 64 bit image can be generated from the `arm64` branch in this repository. Just
488507
replace the command from [this section](#getting-started-with-building-your-images)
489508
by the one below, and follow the rest of the documentation:
490509
```bash
491-
git clone --depth 1 --branch arm64 https://github.com/RPI-Distro/pi-gen.git
510+
git clone --branch arm64 https://github.com/RPI-Distro/pi-gen.git
492511
```
493512

494513
If you want to generate a 64 bits image from a Raspberry Pi running a 32 bits

‎build.sh‎

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ EOF
2121
PACKAGES="$(sed -f "${SCRIPT_DIR}/remove-comments.sed" < "${i}-packages-nr")"
2222
if [ -n "$PACKAGES" ]; then
2323
on_chroot << EOF
24-
apt-get -o APT::Acquire::Retries=3 install --no-install-recommends -y $PACKAGES
24+
apt-get -o Acquire::Retries=3 install --no-install-recommends -y $PACKAGES
2525
EOF
2626
if [ "${USE_QCOW2}" = "1" ]; then
2727
on_chroot << EOF
@@ -36,7 +36,7 @@ EOF
3636
PACKAGES="$(sed -f "${SCRIPT_DIR}/remove-comments.sed" < "${i}-packages")"
3737
if [ -n "$PACKAGES" ]; then
3838
on_chroot << EOF
39-
apt-get -o APT::Acquire::Retries=3 install -y $PACKAGES
39+
apt-get -o Acquire::Retries=3 install -y $PACKAGES
4040
EOF
4141
if [ "${USE_QCOW2}" = "1" ]; then
4242
on_chroot << EOF
@@ -224,8 +224,9 @@ export LOG_FILE="${WORK_DIR}/build.log"
224224
export TARGET_HOSTNAME=${TARGET_HOSTNAME:-raspberrypi}
225225

226226
export FIRST_USER_NAME=${FIRST_USER_NAME:-pi}
227-
export FIRST_USER_PASS=${FIRST_USER_PASS:-raspberry}
228-
export RELEASE=${RELEASE:-bullseye}
227+
export FIRST_USER_PASS
228+
export DISABLE_FIRST_BOOT_USER_RENAME=${DISABLE_FIRST_BOOT_USER_RENAME:-0}
229+
export RELEASE=${RELEASE:-bullseye} # Don't forget to update stage0/prerun.sh
229230
export WPA_ESSID
230231
export WPA_PASSWORD
231232
export WPA_COUNTRY
@@ -282,6 +283,10 @@ fi
282283

283284
export NO_PRERUN_QCOW2="${NO_PRERUN_QCOW2:-1}"
284285

286+
if [ "$SETFCAP" != "1" ]; then
287+
export CAPSH_ARG="--drop=cap_setfcap"
288+
fi
289+
285290
dependencies_check "${BASE_DIR}/depends"
286291

287292
#check username is valid
@@ -290,6 +295,17 @@ if [[ ! "$FIRST_USER_NAME" =~ ^[a-z][-a-z0-9_]*$ ]]; then
290295
exit 1
291296
fi
292297

298+
if [[ "$DISABLE_FIRST_BOOT_USER_RENAME" == "1" ]] && [ -z "${FIRST_USER_PASS}" ]; then
299+
echo "To disable user rename on first boot, FIRST_USER_PASS needs to be set"
300+
echo "Not setting FIRST_USER_PASS makes your system vulnerable and open to cyberattacks"
301+
exit 1
302+
fi
303+
304+
if [[ "$DISABLE_FIRST_BOOT_USER_RENAME" == "1" ]]; then
305+
echo "User rename on the first boot is disabled"
306+
echo "Be advised of the security risks linked to shipping a device with default username/password set."
307+
fi
308+
293309
if [[ -n "${APT_PROXY}" ]] && ! curl --silent "${APT_PROXY}" >/dev/null ; then
294310
echo "Could not reach APT_PROXY server: ${APT_PROXY}"
295311
exit 1

‎export-image/01-user-rename/00-packages‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
userconf-pi

‎export-image/01-user-rename/01-run.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/bash -e
2+
3+
if [[ "${DISABLE_FIRST_BOOT_USER_RENAME}" == "0" ]]; then
4+
on_chroot <<- EOF
5+
SUDO_USER="${FIRST_USER_NAME}" rename-user -f -s
6+
EOF
7+
else
8+
rm -f "${ROOTFS_DIR}/etc/xdg/autostart/piwiz.desktop"
9+
fi

export-image/01-set-sources/01-run.sh renamed to export-image/02-set-sources/01-run.sh

File renamed without changes.

export-image/02-network/01-run.sh renamed to export-image/03-network/01-run.sh

File renamed without changes.

export-image/02-network/files/resolv.conf renamed to export-image/03-network/files/resolv.conf

File renamed without changes.

export-image/03-set-partuuid/00-run.sh renamed to export-image/04-set-partuuid/00-run.sh

File renamed without changes.

export-image/04-finalise/01-run.sh renamed to export-image/05-finalise/01-run.sh

File renamed without changes.

‎export-image/prerun.sh‎

Lines changed: 8 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -33,49 +33,29 @@ if [ "${NO_PRERUN_QCOW2}" = "0" ]; then
3333
parted --script "${IMG_FILE}" unit B mkpart primary fat32 "${BOOT_PART_START}" "$((BOOT_PART_START + BOOT_PART_SIZE - 1))"
3434
parted --script "${IMG_FILE}" unit B mkpart primary ext4 "${ROOT_PART_START}" "$((ROOT_PART_START + ROOT_PART_SIZE - 1))"
3535

36-
PARTED_OUT=$(parted -sm "${IMG_FILE}" unit b print)
37-
BOOT_OFFSET=$(echo "$PARTED_OUT" | grep -e '^1:' | cut -d':' -f 2 | tr -d B)
38-
BOOT_LENGTH=$(echo "$PARTED_OUT" | grep -e '^1:' | cut -d':' -f 4 | tr -d B)
39-
40-
ROOT_OFFSET=$(echo "$PARTED_OUT" | grep -e '^2:' | cut -d':' -f 2 | tr -d B)
41-
ROOT_LENGTH=$(echo "$PARTED_OUT" | grep -e '^2:' | cut -d':' -f 4 | tr -d B)
42-
43-
echo "Mounting BOOT_DEV..."
44-
cnt=0
45-
until BOOT_DEV=$(losetup --show -f -o "${BOOT_OFFSET}" --sizelimit "${BOOT_LENGTH}" "${IMG_FILE}"); do
46-
if [ $cnt -lt 5 ]; then
47-
cnt=$((cnt + 1))
48-
echo "Error in losetup for BOOT_DEV. Retrying..."
49-
sleep 5
50-
else
51-
echo "ERROR: losetup for BOOT_DEV failed; exiting"
52-
exit 1
53-
fi
54-
done
55-
56-
echo "Mounting ROOT_DEV..."
36+
echo "Creating loop device..."
5737
cnt=0
58-
until ROOT_DEV=$(losetup --show -f -o "${ROOT_OFFSET}" --sizelimit "${ROOT_LENGTH}" "${IMG_FILE}"); do
38+
until LOOP_DEV="$(losetup --show --find --partscan "$IMG_FILE")"; do
5939
if [ $cnt -lt 5 ]; then
6040
cnt=$((cnt + 1))
61-
echo "Error in losetup for ROOT_DEV. Retrying..."
41+
echo "Error in losetup. Retrying..."
6242
sleep 5
6343
else
64-
echo "ERROR: losetup for ROOT_DEV failed; exiting"
44+
echo "ERROR: losetup failed; exiting"
6545
exit 1
6646
fi
6747
done
6848

69-
echo "/boot: offset $BOOT_OFFSET, length $BOOT_LENGTH"
70-
echo "/: offset $ROOT_OFFSET, length $ROOT_LENGTH"
49+
BOOT_DEV="${LOOP_DEV}p1"
50+
ROOT_DEV="${LOOP_DEV}p2"
7151

7252
ROOT_FEATURES="^huge_file"
73-
for FEATURE in metadata_csum 64bit; do
53+
for FEATURE in 64bit; do
7454
if grep -q "$FEATURE" /etc/mke2fs.conf; then
7555
ROOT_FEATURES="^$FEATURE,$ROOT_FEATURES"
7656
fi
7757
done
78-
mkdosfs -n boot -F 32 -v "$BOOT_DEV" > /dev/null
58+
mkdosfs -n boot -F 32 -s 4 -v "$BOOT_DEV" > /dev/null
7959
mkfs.ext4 -L rootfs -O "$ROOT_FEATURES" "$ROOT_DEV" > /dev/null
8060

8161
mount -v "$ROOT_DEV" "${ROOTFS_DIR}" -t ext4

0 commit comments

Comments
 (0)