WIP: Use nix function to generate systemd config

I'm not sure this is a great idea, but throwing it up as a PR for discussion at least.
2025-03-24 13:40:14 +01:00
12 changed files with 282 additions and 235 deletions
--- a/flake.lock
+++ b/flake.lock
@ -20,11 +20,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1744932701,
-        "narHash": "sha256-fusHbZCyv126cyArUwwKrLdCkgVAIaa/fQJYFlCEqiU=",
+        "lastModified": 1739020877,
+        "narHash": "sha256-mIvECo/NNdJJ/bXjNqIh8yeoSjVLAuDuTUzAo7dzs8Y=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "b024ced1aac25639f8ca8fdfc2f8c4fbd66c48ef",
+        "rev": "a79cfe0ebd24952b580b1cf08cd906354996d547",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@ -18,14 +18,12 @@
        pkgs = import nixpkgs { inherit system; };
        patosPkgs = self.packages.${system};
        version = "0.0.1";
-        secureBoot = "false";
-        cpuArch = "intel";
        updateUrl = "http://10.0.2.2:8000/";
      in
      {
        packages = {
          default = patosPkgs.image;
-          image = pkgs.callPackage ./pkgs/image { inherit patosPkgs version updateUrl cpuArch secureBoot; };
+          image = pkgs.callPackage ./pkgs/image { inherit patosPkgs version updateUrl; };
          rootfs = pkgs.callPackage ./pkgs/rootfs/mkrootfs.nix { inherit patosPkgs version; };
          initrd = pkgs.callPackage ./pkgs/rootfs/mkinitrd.nix { inherit patosPkgs version; };
          kernel = pkgs.callPackage ./pkgs/kernel { };
--- a/pkgs/busybox/default.nix
+++ b/pkgs/busybox/default.nix
@ -1,7 +1,6 @@
 {
  stdenv,
  lib,
-  pkgs,
  buildPackages,
  fetchurl,
  fetchpatch,
@ -58,12 +57,15 @@ in

 stdenv.mkDerivation rec {
  pname = "busybox";
-  version = pkgs.busybox.version;
+  version = "1.36.1";

  # Note to whoever is updating busybox: please verify that:
  # nix-build pkgs/stdenv/linux/make-bootstrap-tools.nix -A test
  # still builds after the update.
-  src = pkgs.busybox.src;
+  src = fetchurl {
+    url = "https://busybox.net/downloads/${pname}-${version}.tar.bz2";
+    sha256 = "sha256-uMwkyVdNgJ5yecO+NJeVxdXOtv3xnKcJ+AzeUOR94xQ=";
+  };

  hardeningDisable = [
    "format"
--- a/pkgs/dbus-broker/default.nix
+++ b/pkgs/dbus-broker/default.nix
@ -100,9 +100,14 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "dbus-broker";
-  version = pkgs.dbus-broker.version;
+  version = "36";

-  src = pkgs.dbus-broker.src;
+  src = fetchFromGitHub {
+    owner = "bus1";
+    repo = "dbus-broker";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-5dAMKjybqrHG57vArbtWEPR/svSj2ION75JrjvnnpVM=";
+  };

  nativeBuildInputs = with pkgs; [
    docutils
--- a/pkgs/image/default.nix
+++ b/pkgs/image/default.nix
@ -5,252 +5,282 @@
  version,
  runCommand,
  updateUrl,
-  cpuArch ? "",
-  secureBoot ? "false"
 }:
 let
  pname = "patos-image";
-in
-runCommand pname {
-  inherit version cpuArch updateUrl secureBoot;

-  microcode = lib.optionalString (cpuArch == "amd") "--microcode ${pkgs.microcode-amd}/amd-ucode.img"
-      + lib.optionalString (cpuArch == "intel") "--microcode ${pkgs.microcode-intel}/intel-ucode.img";
+  writeConf =
+    name: attrs:
+    pkgs.writeTextFile {
+      name = name;
+      text = lib.generators.toINI {
+        mkKeyValue = lib.generators.mkKeyValueDefault {
+          mkValueString =
+            v:
+            if v == true then
+              ''"yes"''
+            else if v == false then
+              ''"no"''
+            else if lib.isString v then
+              ''"${v}"''
+            else
+              lib.generators.mkValueStringDefault { } v;
+        } "=";
+      } attrs;
+    };

-  buildInputs = with pkgs; [
-    erofs-utils
-    dosfstools
-    mtools
-    jq
-  ];
+  secureBootImportKeys = writeConf "secure-boot-import-keys.service" {
+    Unit = {
+      Description = "Import Secure Boot keys";
+      DefaultDependencies = false;
+      RequiresMountsFor = "/var/lib/sbctl /boot";
+      ConditionPathExists = "/boot/sbctl/keys";
+      After = "local-fs.target";
+    };

-  env = {
-    # vfat options won't efi won't find the fs otherwise.
-    SYSTEMD_REPART_MKFS_OPTIONS_VFAT = "-S 512 -c";
-    SYSTEMD_REPART_MKFS_OPTIONS_EROFS = "--all-root -zlz4hc,12 -C1048576 -Efragments,dedupe,ztailpacking";
+    Service = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = "sbctl import-keys -d /boot/sbctl/keys";
+      ExecStartPost = "rm -rf /boot/sbctl";
+    };
  };

-  kernelCmdLine = "console=ttyS0 patos.secureboot=${secureBoot}";
-}
-''
-mkdir -p $out/init.repart.d $out/final.repart.d
-pushd $out
+  ukiTransfer = writeConf "10-uki.transfer" {
+    Source = {
+      Path = updateUrl;
+      MatchPattern = "patos_@v.efi";
+      Type = "url-file";
+    };

-mkdir rootfs
-cp -prP ${patosPkgs.rootfs}/* rootfs/
-find rootfs/ -type d -exec chmod 755 {} \;
+    Target = {
+      InstancesMax = 2;
+      MatchPattern = "patos_@v+@l-@d.efi patos_@v+@l.efi patos_@v.efi";
+      Mode = "0444";
+      Path = "/EFI/Linux";
+      PathRelativeTo = "esp";
+      TriesDone = 0;
+      TriesLeft = 3;
+      Type = "regular-file";
+    };

-# package kernel modules as sysext (will reduce the image size a little bit (~3MB))
-mkdir rootfs/etc/extensions
-rm -rf rootfs/usr/lib/modules
-cp ${patosPkgs.kernel}/patos-kernel-modules* rootfs/etc/extensions/
+    Transfer = {
+      Verify = false;
+    };
+  };

-# set default target to multi-user
-ln -sf multi-user.target rootfs/usr/lib/systemd/system/default.target
+  rootVerityTransfer = writeConf "22-root-verity.transfer" {
+    Source = {
+      Type = "url-file";
+      Path = updateUrl;
+      MatchPattern = "patos_@v_@u.verity";
+    };

-# enable dbus
-ln -sf ../dbus.service rootfs/usr/lib/systemd/system/multi-user.target.wants/dbus.service
-ln -sf ../dbus.socket rootfs/usr/lib/systemd/system/sockets.target.wants/dbus.socket
+    Target = {
+      Type = "partition";
+      Path = "auto";
+      MatchPattern = "verity-@v";
+      MatchPartitionType = "root-verity";
+      ReadOnly = "1";
+    };

-# enable network services
-ln -sf ../systemd-networkd.service rootfs/usr/lib/systemd/system/sysinit.target.wants/systemd-networkd.service
-ln -sf ../systemd-resolved.service rootfs/usr/lib/systemd/system/sysinit.target.wants/systemd-resolved.service
-ln -sf ../systemd-timesyncd.service rootfs/usr/lib/systemd/system/multi-user.target.wants/systemd-timesyncd.service
-# enable default network config
-mv rootfs/usr/lib/systemd/network/89-ethernet.network.example rootfs/usr/lib/systemd/network/89-ethernet.network
+    Transfer = {
+      Verify = false;
+    };
+  };

-# enable confext/sysext services
-ln -sf ../systemd-confext.service rootfs/usr/lib/systemd/system/sysinit.target.wants/systemd-confext.service
-ln -sf ../systemd-sysext.service rootfs/usr/lib/systemd/system/sysinit.target.wants/systemd-sysext.service
+  rootTransfer = writeConf "22-root.transfer" {
+    Source = {
+      Type = "url-file";
+      Path = updateUrl;
+      MatchPattern = "patos_@v_@u.root";
+    };

-cat <<EOF > rootfs/usr/lib/systemd/system/secure-boot-import-keys.service
-[Unit]
-Description=Import Secure Boot keys
-DefaultDependencies=no
-RequiresMountsFor=/var/lib/sbctl /boot
-ConditionPathExists=/boot/sbctl/keys
-After=local-fs.target
+    Target = {
+      Type = "partition";
+      Path = "auto";
+      MatchPattern = "root-@v";
+      MatchPartitionType = "root";
+      ReadOnly = 1;
+    };
+    Transfer = {
+      Verify = false;
+    };
+  };
+in
+runCommand pname
+  {
+    inherit version;
+    inherit updateUrl;

-[Service]
-Type=oneshot
-RemainAfterExit=yes
-ExecStart=sbctl import-keys -d /boot/sbctl/keys
-ExecStartPost=rm -rf /boot/sbctl
-EOF
-ln -sf ../secure-boot-import-keys.service rootfs/usr/lib/systemd/system/sysinit.target.wants/secure-boot-import-keys.service
+    buildInputs = with pkgs; [
+      erofs-utils
+      dosfstools
+      mtools
+      jq
+    ];

-# sysupdate
-mkdir -p rootfs/etc/sysupdate.d
-cat <<EOF > rootfs/etc/sysupdate.d/10-uki.transfer
-[Source]
-Path=${updateUrl}
-MatchPattern=patos_@v.efi
-Type=url-file
+    env = {
+      # vfat options won't efi won't find the fs otherwise.
+      SYSTEMD_REPART_MKFS_OPTIONS_VFAT = "-S 512 -c";
+      SYSTEMD_REPART_MKFS_OPTIONS_EROFS = "--all-root -zlz4hc,12 -C1048576 -Efragments,dedupe,ztailpacking";
+    };

-[Target]
-InstancesMax=2
-MatchPattern=patos_@v+@l-@d.efi patos_@v+@l.efi patos_@v.efi
-Mode=0444
-Path=/EFI/Linux
-PathRelativeTo=esp
-TriesDone=0
-TriesLeft=3
-Type=regular-file
+    kernelCmdLine = "console=ttyS0 patos.secureboot=false";
+  }
+  ''
+    mkdir -p $out/init.repart.d $out/final.repart.d
+    pushd $out

-[Transfer]
-Verify=no
-EOF
+    mkdir rootfs
+    cp -prP ${patosPkgs.rootfs}/* rootfs/
+    find rootfs/ -type d -exec chmod 755 {} \;

-cat <<EOF > rootfs/etc/sysupdate.d/20-root-verity.transfer
-[Source]
-Type=url-file
-Path=${updateUrl}
-MatchPattern=patos_@v_@u.verity
+    # package kernel modules as sysext (will reduce the image size a little bit (~3MB))
+    mkdir rootfs/etc/extensions
+    rm -rf rootfs/usr/lib/modules
+    cp ${patosPkgs.kernel}/patos-kernel-modules* rootfs/etc/extensions/

-[Target]
-Type=partition
-Path=auto
-MatchPattern=verity-@v
-MatchPartitionType=root-verity
-ReadOnly=1
+    # set default target to multi-user
+    ln -sf multi-user.target rootfs/usr/lib/systemd/system/default.target

-[Transfer]
-Verify=no
-EOF
+    # enable dbus
+    ln -sf ../dbus.service rootfs/usr/lib/systemd/system/multi-user.target.wants/dbus.service
+    ln -sf ../dbus.socket rootfs/usr/lib/systemd/system/sockets.target.wants/dbus.socket

-cat <<EOF > rootfs/etc/sysupdate.d/22-root.transfer
-[Source]
-Type=url-file
-Path=${updateUrl}
-MatchPattern=patos_@v_@u.root
+    # enable network services
+    ln -sf ../systemd-networkd.service rootfs/usr/lib/systemd/system/sysinit.target.wants/systemd-networkd.service
+    ln -sf ../systemd-resolved.service rootfs/usr/lib/systemd/system/sysinit.target.wants/systemd-resolved.service
+    ln -sf ../systemd-timesyncd.service rootfs/usr/lib/systemd/system/multi-user.target.wants/systemd-timesyncd.service
+    # enable default network config
+    mv rootfs/usr/lib/systemd/network/89-ethernet.network.example rootfs/usr/lib/systemd/network/89-ethernet.network

-[Target]
-Type=partition
-Path=auto
-MatchPattern=root-@v
-MatchPartitionType=root
-ReadOnly=1
+    # enable confext/sysext services
+    ln -sf ../systemd-confext.service rootfs/usr/lib/systemd/system/sysinit.target.wants/systemd-confext.service
+    ln -sf ../systemd-sysext.service rootfs/usr/lib/systemd/system/sysinit.target.wants/systemd-sysext.service

-[Transfer]
-Verify=no
-EOF
+    cp ${secureBootImportKeys} rootfs/usr/lib/systemd/system/secure-boot-import-keys.service
+    ln -sf ../secure-boot-import-keys.service rootfs/usr/lib/systemd/system/sysinit.target.wants/secure-boot-import-keys.service

-# Initial partitioning
-cat <<EOF > init.repart.d/10-root.conf
-[Partition]
-Type=root
-Format=erofs
-Minimize=best
-CopyFiles=/rootfs:/
-Verity=data
-VerityMatchKey=root
-SplitName=root
-EOF
+    # sysupdate
+    mkdir -p rootfs/etc/sysupdate.d
+    cp ${rootTransfer} ${rootVerityTransfer} ${ukiTransfer} rootfs/etc/sysupdate.d/

-cat <<EOF > init.repart.d/20-root-verity.conf
-[Partition]
-Type=root-verity
-Verity=hash
-VerityMatchKey=root
-Minimize=best
-SplitName=verity
-EOF
+    # Initial partitioning
+    cat <<EOF > init.repart.d/10-root.conf
+    [Partition]
+    Type=root
+    Format=erofs
+    Minimize=best
+    CopyFiles=/rootfs:/
+    Verity=data
+    VerityMatchKey=root
+    SplitName=root
+    EOF

-#TODO: Add verity signature partition
+    cat <<EOF > init.repart.d/20-root-verity.conf
+    [Partition]
+    Type=root-verity
+    Verity=hash
+    VerityMatchKey=root
+    Minimize=best
+    SplitName=verity
+    EOF

-${patosPkgs.systemd}/usr/bin/systemd-repart \
-  --no-pager \
-  --empty=create \
-  --size=auto \
-  --definitions=./init.repart.d \
-  --split=true \
-  --json=pretty \
-  --root=$out \
-  patos_$version.raw > init-repart-output.json && rm -f patos_$version.raw
+    #TODO: Add verity signature partition

-roothash=$(jq -r '.[0].roothash' init-repart-output.json)
-rootPart=$(jq -r '.[0].split_path' init-repart-output.json)
-rootUuid=$(jq -r '.[0].uuid' init-repart-output.json)
+    ${patosPkgs.systemd}/usr/bin/systemd-repart \
+      --no-pager \
+      --empty=create \
+      --size=auto \
+      --definitions=./init.repart.d \
+      --split=true \
+      --json=pretty \
+      --root=$out \
+      patos_$version.raw > init-repart-output.json && rm -f patos_$version.raw

-verityPart=$(jq -r '.[1].split_path' init-repart-output.json)
-verityUuid=$(jq -r '.[1].uuid' init-repart-output.json)
+    roothash=$(jq -r '.[0].roothash' init-repart-output.json)
+    rootPart=$(jq -r '.[0].split_path' init-repart-output.json)
+    rootUuid=$(jq -r '.[0].uuid' init-repart-output.json)

-ln -sf patos_$version.verity.raw patos_${version}_$verityUuid.verity
-ln -sf patos_$version.root.raw patos_${version}_$rootUuid.root
+    verityPart=$(jq -r '.[1].split_path' init-repart-output.json)
+    verityUuid=$(jq -r '.[1].uuid' init-repart-output.json)

-${patosPkgs.systemd}/usr/bin/ukify build \
-  --linux ${patosPkgs.kernel}/bzImage \
-  --initrd ${patosPkgs.initrd}/initrd.xz \
-  $microcode \
-  --os-release @rootfs/etc/os-release \
-  --cmdline "$kernelCmdLine roothash=$roothash" \
-  -o patos_${version}.efi
+    ln -sf patos_$version.verity.raw patos_${version}_$verityUuid.verity
+    ln -sf patos_$version.root.raw patos_${version}_$rootUuid.root

-# install ESP
-SYSTEMD_RELAX_ESP_CHECKS=1 ${patosPkgs.systemd}/usr/bin/bootctl install --root ./rootfs --esp-path /boot
+    ${patosPkgs.systemd}/usr/bin/ukify build \
+      --linux ${patosPkgs.kernel}/bzImage \
+      --initrd ${patosPkgs.initrd}/initrd.xz \
+      --os-release @rootfs/etc/os-release \
+      --cmdline "$kernelCmdLine roothash=$roothash" \
+      -o patos_${version}.efi

-# setup factory reset
-mkdir -p rootfs/boot/EFI/tools
-cp ${pkgs.edk2-uefi-shell}/shell.efi rootfs/boot/EFI/tools/
+    # install ESP
+    SYSTEMD_RELAX_ESP_CHECKS=1 ${patosPkgs.systemd}/usr/bin/bootctl install --root ./rootfs --esp-path /boot

-cat <<EOF > rootfs/boot/EFI/tools/factoryreset.nsh
-setvar FactoryReset -guid 8cf2644b-4b0b-428f-9387-6d876050dc67 -nv -rt =%1
-reset
-EOF
+    # setup factory reset
+    mkdir -p rootfs/boot/EFI/tools
+    cp ${pkgs.edk2-uefi-shell}/shell.efi rootfs/boot/EFI/tools/

-cat <<EOF > rootfs/boot/loader/entries/factoryreset.conf
-title Enable Factory Reset
-options -nostartup -nomap
-options \EFI\tools\factoryreset.nsh L"t"
-efi EFI/tools/shell.efi
-EOF
+    cat <<EOF > rootfs/boot/EFI/tools/factoryreset.nsh
+    setvar FactoryReset -guid 8cf2644b-4b0b-428f-9387-6d876050dc67 -nv -rt =%1
+    reset
+    EOF

-echo "timeout 2" > rootfs/boot/loader/loader.conf
+    cat <<EOF > rootfs/boot/loader/entries/factoryreset.conf
+    title Enable Factory Reset
+    options -nostartup -nomap
+    options \EFI\tools\factoryreset.nsh L"t"
+    efi EFI/tools/shell.efi
+    EOF

-# install UKI
-cp patos_${version}.efi rootfs/boot/EFI/Linux
+    echo "timeout 2" > rootfs/boot/loader/loader.conf

-# Final partitioning
-cat <<EOF > final.repart.d/10-esp.conf
-[Partition]
-Type=esp
-Format=vfat
-SizeMinBytes=128M
-SizeMaxBytes=128M
-CopyFiles=/rootfs/boot:/
-EOF
+    # install UKI
+    cp patos_${version}.efi rootfs/boot/EFI/Linux

-cat <<EOF > final.repart.d/20-root.conf
-[Partition]
-Type=root
-Label=root-${version}
-CopyBlocks=/$rootPart
-UUID=$rootUuid
-SizeMinBytes=64M
-SizeMaxBytes=64M
-ReadOnly=1
-EOF
+    # Final partitioning
+    cat <<EOF > final.repart.d/10-esp.conf
+    [Partition]
+    Type=esp
+    Format=vfat
+    SizeMinBytes=128M
+    SizeMaxBytes=128M
+    CopyFiles=/rootfs/boot:/
+    EOF

-cat <<EOF > final.repart.d/22-root-verity.conf
-[Partition]
-Type=root-verity
-Label=verity-${version}
-CopyBlocks=/$verityPart
-UUID=$verityUuid
-ReadOnly=1
-EOF
+    cat <<EOF > final.repart.d/20-root.conf
+    [Partition]
+    Type=root
+    Label=root-${version}
+    CopyBlocks=/$rootPart
+    UUID=$rootUuid
+    SizeMinBytes=64M
+    SizeMaxBytes=64M
+    ReadOnly=1
+    EOF

-# finalize image ready for boot
-${patosPkgs.systemd}/usr/bin/systemd-repart \
-  --no-pager \
-  --empty=create \
-  --size=auto \
-  --definitions=./final.repart.d \
-  --root=$out \
-  patos_${version}.img > final-repart-output.json
+    cat <<EOF > final.repart.d/22-root-verity.conf
+    [Partition]
+    Type=root-verity
+    Label=verity-${version}
+    CopyBlocks=/$verityPart
+    UUID=$verityUuid
+    ReadOnly=1
+    EOF

-rm -rf rootfs init.repart.d final.repart.d *.json
-sha256sum *.root *.verity *.efi *.tar.xz > SHA256SUMS
+    # finalize image ready for boot
+    ${patosPkgs.systemd}/usr/bin/systemd-repart \
+      --no-pager \
+      --empty=create \
+      --size=auto \
+      --definitions=./final.repart.d \
+      --root=$out \
+      patos_${version}.img > final-repart-output.json

-popd
-''
+    rm -rf rootfs init.repart.d final.repart.d *.json
+    sha256sum *.root *.verity *.efi *.tar.xz > SHA256SUMS
+
+    popd
+  ''
--- a/pkgs/kernel/default.nix
+++ b/pkgs/kernel/default.nix
@ -1,7 +1,7 @@
 { pkgs }:
 let
-  version = "6.14.2";
-  hash = "sha256-xcaCo1TqMZATk1elfTSnnlw3IhrOgjqTjhARa1d6Lhs=";
+  version = "6.13.7";
+  hash = "sha256-Ojm2IDi3rC9D0mofhLQoPhl4BOHoF61jfpo9h0xHgB0=";
 in
 (pkgs.callPackage ./manual-config.nix { }) {
  version = "${version}-patos1";
--- a/pkgs/lvm2/default.nix
+++ b/pkgs/lvm2/default.nix
@ -1,6 +1,5 @@
 {
  stdenv,
-  pkgs,
  fetchurl,
  lib,
  pkg-config,
@ -8,11 +7,17 @@
  udev,
 }:

-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  pname = "lvm2";
-  version = pkgs.lvm2.version;
+  version = "2.03.30";

-  src = pkgs.lvm2.src;
+  src = fetchurl {
+    urls = [
+      "https://mirrors.kernel.org/sourceware/lvm2/LVM2.${version}.tgz"
+      "ftp://sourceware.org/pub/lvm2/LVM2.${version}.tgz"
+    ];
+    hash = "sha256-rXar7LjciHcz4GxEnLmt0Eo1BvnweAwSiBem4aF87AU=";
+  };

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/openssl/default.nix
+++ b/pkgs/openssl/default.nix
@ -1,6 +1,5 @@
 {
  lib,
-  pkgs,
  stdenv,
  fetchurl,
  perl,
@ -19,9 +18,13 @@

 stdenv.mkDerivation rec {
    pname = "openssl";
-    version = pkgs.openssl.version;
+    version = "3.4.1";
+    hash = "sha256-ACotazC1i/S+pGxDvdljZar42qbEKHgqpP7uBtoZffM=";

-    src = pkgs.openssl.src;
+    src = fetchurl {
+      url = "https://github.com/openssl/openssl/releases/download/openssl-${version}/openssl-${version}.tar.gz";
+      hash = hash;
+    };

    outputs = [ "out" ];

--- a/pkgs/rootfs/mkrootfs.nix
+++ b/pkgs/rootfs/mkrootfs.nix
@ -21,12 +21,11 @@ runCommand "patos-rootfs"
 ''
 ### create directory structure
 mkdir -p $out/etc/repart.d $out/dev $out/proc $out/sys \
-  $out/tmp $out/root $out/run $out/boot $out/mnt $out/home $out/srv $out/var
+  $out/tmp $out/root $out/run $out/boot $out/mnt $out/home $out/srv $out/var/tmp
 ln -sf /usr/bin $out/bin
 ln -sf /usr/bin $out/sbin
 ln -sf /usr/lib $out/lib
 ln -sf /usr/lib $out/lib64
-ln -sf /tmp $out/var/tmp
 ln -sf ../proc/self/mounts $out/etc/mtab

 ### install systemd
--- a/pkgs/systemd/default.nix
+++ b/pkgs/systemd/default.nix
@ -7,7 +7,7 @@
  ...
 }:
 let
-  version = "257.5";
+  version = "257.4";

  # Use the command below to update `releaseTimestamp` on every (major) version
  # change. More details in the commentary at mesonFlags.
--- a/pkgs/tpm2-tools/default.nix
+++ b/pkgs/tpm2-tools/default.nix
@ -1,6 +1,5 @@
 {
  stdenv,
-  pkgs,
  fetchurl,
  lib,
  pandoc,
@ -11,17 +10,19 @@
  libuuid,
 }:

-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  pname = "tpm2-tools";
-  version = pkgs.tpm2-tools.version;
+  version = "5.7";

-  src = pkgs.tpm2-tools.src;
+  src = fetchurl {
+    url = "https://github.com/tpm2-software/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
+    sha256 = "sha256-OBDTa1B5JW9PL3zlUuIiE9Q7EDHBMVON+KLbw8VwmDo=";
+  };

  nativeBuildInputs = [
    pandoc
    pkg-config
  ];
-
  buildInputs = [
    curl
    openssl
--- a/pkgs/tpm2-tss/default.nix
+++ b/pkgs/tpm2-tss/default.nix
@ -1,6 +1,5 @@
 {
  stdenv,
-  pkgs,
  lib,
  fetchFromGitHub,
  autoreconfHook,
@ -20,9 +19,14 @@

 stdenv.mkDerivation rec {
  pname = "tpm2-tss";
-  version = pkgs.tpm2-tss.version;
+  version = "4.1.3";

-  src = pkgs.tpm2-tss.src;
+  src = fetchFromGitHub {
+    owner = "tpm2-software";
+    repo = pname;
+    rev = version;
+    hash = "sha256-BP28utEUI9g1VNv3lCXuiKrDtEImFQxxZfIjLiE3Wr8=";
+  };

  patches = [
    ./no-shadow.patch