feat(linux-firmware): sysext packaging of linux firmware

flake.nix

@@ -46,6 +46,8 @@
 
           firewall-tools = pkgs.callPackage ./pkgs/sysext/firewall-tools.nix { };
           firewall-tools-aarch64 = pkgsCross.callPackage ./pkgs/sysext/firewall-tools.nix { };
+
+          linux-firmware = pkgs.callPackage ./pkgs/linux-firmware { };
         };
 
         checks = {

pkgs/linux-firmware/default.nix

@@ -0,0 +1,41 @@
+{
+  stdenv,
+  pkgs,
+}:
+
+stdenv.mkDerivation {
+  pname = pkgs.linux-firmware.name;
+  version = pkgs.linux-firmware.version;
+  src = pkgs.linux-firmware.src;
+
+  nativeBuildInputs = with pkgs; [
+    erofs-utils
+    cryptsetup
+    python3
+    rdfind
+    which
+    zstd
+  ];
+
+  noBrokenSymlinks = true;
+
+  installTargets = [
+    "install-zst"
+    "dedup"
+  ];
+
+  # inspo: https://gitlab.archlinux.org/archlinux/packaging/packages/linux-firmware/-/blob/main/PKGBUILD?ref_type=heads#L93
+  makeFlags = [
+    "DESTDIR=$(out)"
+    "ZSTD_CLEVEL=19"
+    "FIRMWAREDIR=/usr/lib/firmware"
+  ];
+
+  preFixup = ''
+    # Remove broken symlinks if any, or just skip the check
+    find $out -xtype l -delete
+  '';
+
+  postInstall = ./post-install.sh;
+}
+

pkgs/linux-firmware/post-install.sh

@@ -0,0 +1,84 @@
+set -ex -uo pipefail
+
+_pick() {
+  local p="$1" f d; shift
+  for f; do
+    d="$out/$p/${f#$out/}"
+    mkdir -p "$(dirname "$d")"
+    mv "$f" "$(dirname "$d")"
+    rmdir -p --ignore-fail-on-non-empty "$(dirname "$f")"
+  done
+}
+
+_package() {
+  local p="$1"
+  mkdir -p $out/$p/usr/lib/extension-release.d
+  cat << EOF > $out/$p/usr/lib/extension-release.d/extension-release.$p
+ID=patos
+IMAGE_ID=$p
+IMAGE_VERSION=$version
+VERSION_ID=patos
+EOF
+
+  mkfs.erofs --all-root -Efragments,dedupe,ztailpacking $out/$p.raw $out/$p
+  veritysetup format --root-hash-file $out/$p.roothash $out/$p.raw $out/$p.verity
+  rm -rf $out/$p
+}
+
+fwdir=$out/usr/lib/firmware
+
+# split into packages
+_pick linux-firmware-amd-ucode "${fwdir}"/amd-ucode
+_package linux-firmware-amd-ucode
+
+_pick linux-firmware-amdgpu "${fwdir}"/amdgpu
+_package linux-firmware-amdgpu
+
+_pick linux-firmware-atheros "${fwdir}"/{ar[0-9]*,ath*,carl9170*,htc_*,qca,wil6210*}
+_package linux-firmware-atheros
+
+_pick linux-firmware-broadcom "${fwdir}"/{bnx2*,brcm,cypress,tigon}
+_package linux-firmware-broadcom
+
+_pick linux-firmware-cirrus "${fwdir}"/{cirrus,cs42l43*}
+_package linux-firmware-cirrus
+
+_pick linux-firmware-intel "${fwdir}"/{e100,hfi1_*,i915,intel,isci,iwlwifi*,ixp4xx,qat_*,xe}
+_package linux-firmware-intel
+
+_pick linux-firmware-liquidio "${fwdir}"/liquidio
+_package linux-firmware-liquidio
+
+_pick linux-firmware-marvell "${fwdir}"/{libertas,mwl8k,mwlwifi,mrvl}
+_package linux-firmware-marvell
+
+_pick linux-firmware-mediatek "${fwdir}"/{mediatek,mt7*,vpu_*,rt[237]*}
+_package linux-firmware-mediatek
+
+_pick linux-firmware-mellanox "${fwdir}"/mellanox
+_package linux-firmware-mellanox
+
+_pick linux-firmware-nfp "${fwdir}"/netronome
+_package linux-firmware-nfp
+
+_pick linux-firmware-nvidia "${fwdir}"/nvidia
+_package linux-firmware-nvidia
+
+_pick linux-firmware-qcom "${fwdir}"/{qcom,a300_*}
+_package linux-firmware-qcom
+
+_pick linux-firmware-qlogic "${fwdir}"/{qlogic,qed,ql2???_*,c{b,t,t2}fw-*}
+_package linux-firmware-qlogic
+
+_pick linux-firmware-radeon "${fwdir}"/radeon
+_package linux-firmware-radeon
+
+_pick linux-firmware-realtek "${fwdir}"/{realtek,rtlwifi,rtw8*,rtl_*}
+_package linux-firmware-realtek
+
+#clean up
+rm -rf $out/usr
+
+pushd $out
+sha256sum * > SHA256SUMS
+popd