Hi, On Wed, Jul 02, 2025 at 08:14:40AM -0400, Sandy Patterson wrote: > I'm having trouble figuring out how to build an initramfs from a second > userspace set of packages. > > Basically I want to run an encrypted and verified rootfs. I have a solution > for another board which uses an initramfs that sets up the keys/root hashes > and does a pivot_root. But in order to get this into ptxdist I had to > precompile all the binaries for the ramdisk and make a custom rule to build > it. I was hoping to find how others do this or get some pointers before I > go and replicate that again. > > Or perhaps ptxdist has another solution already built for encrypting a root > and maintaining trust?
There is no finished solution right now. You can use the regular glibc, busybox, etc. packages and combine it with some custom /init script or binary. Just create a new cpio image with an explicit 'IMAGE_<NAME>_PKGS = glibc busybox ... myinit'. That's pretty simple but the resulting initramfs will be pretty big. Create a musl package and new packages for various components for the initramfs. Fill the initramfs with that. What I'm currently working on is rsinit[1]. The idea is to implement the whole initramfs in a minimal rust binary. But that very much work in progress. Right now, it has support for a dm-verity rootfs but no encryption. My plan is to have a default binary that handles all the common cases. And for custom stuff, import the create in your own binary and use the building blocks. But it's not ready for that yet. In all cases: Packages that should be in the initramfs but not the regular rootfs should use "EXTRA_PACKAGES-$(PTXCONF_...)" instead of "PACKAGES-$(PTXCONF_...)". Regards, Michael [1] https://github.com/michaelolbrich/rsinit -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
