;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2020 Mathieu Othacehe <m.othacehe@gmail.com>
;;;
;;; This file is part of GNU Guix.
;;;
;;; GNU Guix is free software; you can redistribute it and/or modify it
;;; under the terms of the GNU General Public License as published by
;;; the Free Software Foundation; either version 3 of the License, or (at
;;; your option) any later version.
;;;
;;; GNU Guix is distributed in the hope that it will be useful, but
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

(define-module (gnu system images pinebook-pro)
  #:use-module (gnu bootloader)
  #:use-module (gnu bootloader u-boot)
  #:use-module (gnu image)
  #:use-module (gnu packages linux)
  #:use-module (gnu services)
  #:use-module (gnu services base)
  #:use-module (gnu system)
  #:use-module (gnu system file-systems)
  #:use-module (gnu system image)
  #:use-module (srfi srfi-26)
  #:export (pinebook-pro-barebones-os
            pinebook-pro-image-type
            pinebook-pro-barebones-raw-image))

(define pinebook-pro-barebones-os
  (operating-system
    (host-name "viso")
    (timezone "Europe/Paris")
    (locale "en_US.utf8")
    (bootloader (bootloader-configuration
                 (bootloader u-boot-pinebook-pro-rk3399-bootloader)
                 (target "/dev/vda")))
    (initrd-modules '())
    (kernel linux-libre-arm64-generic)
    (file-systems (cons (file-system
                          (device (file-system-label "my-root"))
                          (mount-point "/")
                          (type "ext4"))
                        %base-file-systems))
    (services (cons (service agetty-service-type
                             (agetty-configuration
                              (extra-options '("-L")) ; no carrier detect
                              (baud-rate "115200")
                              (term "vt100")
                              (tty "ttyS2")))
                    %base-services))))

(define pinebook-pro-image-type
  (image-type
   (name 'pinebook-pro-raw)
   (constructor (cut image-with-os
                     (arm64-disk-image (* 9 (expt 2 20))) ;9MiB
                     <>))))

(define pinebook-pro-barebones-raw-image
  (image
   (inherit
    (os->image pinebook-pro-barebones-os #:type pinebook-pro-image-type))
   (name 'pinebook-pro-barebones-raw-image)))
51a4ae022&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2021-04-03 22:08:34 +0200'>2021-04-03</span></td><td><a href='/guix/commit/gnu/build/activation.scm?id=2161820ebbbab62a5ce76c9101ebaec54dc61586'>activation: Do not dereference symlinks during home directory creation.</a><span class='msg-avail'>...<span class='msg-tooltip'>Fixes &lt;https://bugs.gnu.org/47584&gt;.

* gnu/build/activation.scm (copy-account-skeletons): Do not chown the
home directory; leave this to 'activate-user-home'.
(activate-user-home): Only chown the home directory after the account
skeletons have been copied.

Co-authored-by: Ludovic Courtès &lt;ludo@gnu.org&gt;.
</span></span></td><td>Maxime Devos</td></tr>
<tr><td><span title='2021-03-10 18:01:47 +0100'>2021-03-10</span></td><td><a href='/guix/commit/gnu/build/activation.scm?id=520bac7ed00a949a0391ad680de65a1498105c2b'>services: Prevent following symlinks during activation.</a><span class='msg-avail'>...<span class='msg-tooltip'>This addresses a potential security issue, where a compromised
service could trick the activation code in changing the permissions,
owner and group of arbitrary files.  However, this patch is
currently only a partial fix, due to a TOCTTOU (time-of-check to
time-of-use) race, which can be fixed once guile has bindings
to openat and friends.

Fixes: &lt;https://lists.gnu.org/archive/html/guix-devel/2021-01/msg00388.html&gt;

* gnu/build/activation.scm: new procedure 'mkdir-p/perms'.
* gnu/services/authentication.scm
  (%nslcd-activation, nslcd-service-type): use new procedure.
* gnu/services/cups.scm (%cups-activation): likewise.
* gnu/services/dbus.scm (dbus-activation): likewise.
* gnu/services/dns.scm (knot-activation): likewise.

Signed-off-by: Ludovic Courtès &lt;ludo@gnu.org&gt;
</span></span></td><td>Maxime Devos</td></tr>
<tr><td><span title='2021-02-09 10:06:02 +0100'>2021-02-09</span></td><td><a href='/guix/commit/gnu/build/activation.scm?id=aa8de806252e3835d57fab351b02d13db762deac'>activation: Do not make setuid programs setgid-root [security].</a><span class='msg-avail'>...<span class='msg-tooltip'>Fixes &lt;https://bugs.gnu.org/46395&gt;.
Reported by Duncan Overbruck &lt;mail@duncano.de&gt;.

* gnu/build/activation.scm (activate-setuid-programs): Change TARGET
mode to not be setgid.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-06-09 10:43:54 +0200'>2020-06-09</span></td><td><a href='/guix/commit/gnu/build/activation.scm?id=ea80cdbcea3763ded87d2fc3b5e97a427a6bb1d4'>activation: Fix function call for system activation</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/build/activation.scm (boot-time-system):
Evaluate the linux-command-line thunk for linux systems to boot

Signed-off-by: Ludovic Courtès &lt;ludo@gnu.org&gt;
</span></span></td><td>Royce Strange</td></tr>
<tr><td><span title='2020-06-08 14:12:20 +0200'>2020-06-08</span></td><td><a href='/guix/commit/gnu/build/activation.scm?id=c3fd2df705695a0dc9f393545606360be1ea6104'>system: Support activation service for the Hurd.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/build/activation.scm (boot-time-system): Use "command-line" for the
Hurd.
* gnu/system.scm (hurd-default-essential-services): Add %boot-service and
%activation-service.
</span></span></td><td>Jan (janneke) Nieuwenhuizen</td></tr>
<tr><td><span title='2020-01-06 16:31:54 +0100'>2020-01-06</span></td><td><a href='/guix/commit/gnu/build/activation.scm?id=83460433b94487198750ad0bcc6f3869f68a8c8f'>activation: Check whether /proc/sys/kernel/modprobe exists.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/build/activation.scm (activate-modprobe): Check whether
/proc/sys/kernel/modprobe exists before writing to it.

Co-authored-by: Ludovic Courtès &lt;ludo@gnu.org&gt;
</span></span></td><td>kanichos@yandex.ru</td></tr>
<tr><td><span title='2020-01-02 19:42:59 +0100'>2020-01-02</span></td><td><a href='/guix/commit/gnu/build/activation.scm?id=7c4e4bac876190eae90635ba7d7f59892c31bcc6'>activation: Keep going when failing to create one of the setuid programs.</a><span class='msg-avail'>...<span class='msg-tooltip'>Fixes &lt;https://bugs.gnu.org/38800&gt;.
Reported by Jakub Kądziołka &lt;kuba@kadziolka.net&gt;.

* gnu/build/activation.scm (activate-setuid-programs): Catch
'system-error' around 'make-setuid-program' calls.
</span></span></td><td>Ludovic Courtès</td></tr>