utils.nix: pass all attrs

Fixes passing baseRtc and other parameters
default.nix: remove superfluous parentheses
2023-06-26 15:48:34 +02:00 · 2023-06-26 15:48:18 +02:00 · 2023-06-08 18:42:48 +02:00 · 2023-05-27 15:36:00 +08:00 · 2023-05-27 15:15:51 +08:00 · 2023-05-27 15:15:33 +08:00
8 changed files with 94 additions and 46 deletions
--- a/flake.lock
+++ b/flake.lock
@ -2,16 +2,16 @@
  "nodes": {
    "nixpkgs": {
      "locked": {
-        "lastModified": 1665449268,
-        "narHash": "sha256-cw4xrQIAZUyJGj58Dp5VLICI0rscd+uap83afiFzlcA=",
-        "owner": "nixos",
+        "lastModified": 1685004253,
+        "narHash": "sha256-AbVL1nN/TDicUQ5wXZ8xdLERxz/eJr7+o8lqkIOVuaE=",
+        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "285e77efe87df64105ec14b204de6636fb0a7a27",
+        "rev": "3e01645c40b92d29f3ae76344a6d654986a91a91",
        "type": "github"
      },
      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
+        "owner": "NixOS",
+        "ref": "nixos-23.05",
        "repo": "nixpkgs",
        "type": "github"
      }
--- a/flake.nix
+++ b/flake.nix
@ -2,7 +2,7 @@
  description = "WFVM: Windows Functional Virtual Machine";

  inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.05";
  };

  outputs = { self, nixpkgs }:
@ -12,13 +12,26 @@

      pkgs = nixpkgs.legacyPackages.${system};

-    in {
+    in rec {
      lib = import ./wfvm {
        inherit pkgs;
      };

-      packages.${system}.demoImage = import ./wfvm/demo-image.nix {
-        inherit self;
+      packages.${system} = rec {
+        demoImage = import ./wfvm/demo-image.nix {
+          inherit self;
+        };
+
+        default = lib.utils.wfvm-run {
+          name = "demo";
+          image = demoImage;
+          script =
+            ''
+            echo "Windows booted. Press Enter to terminate VM."
+            read
+            '';
+          display = true;
+        };
      };
    };
 }
--- a/wfvm/autounattend.nix
+++ b/wfvm/autounattend.nix
@ -15,7 +15,8 @@
 , impureShellCommands ? []
 , driveLetter ? "D:"
 , efi ? true
-, imageSelection ? "Windows 10 Pro"
+, imageSelection ? "Windows 11 Pro N"
+, enableTpm
 , ...
 }:

@ -58,18 +59,16 @@ let
  assertCommand = c: builtins.typeOf c == "string" || builtins.typeOf c == "set" && builtins.hasAttr "Path" c && builtins.hasAttr "Description" c;

  commands = builtins.map (x: assert assertCommand x; if builtins.typeOf x == "string" then { Path = x; Description = x; } else x) (
-    [
-      {
-        Path = "powershell.exe Set-ExecutionPolicy -Force Unrestricted";
-        Description = "Allow unsigned powershell scripts.";
-      }
-    ]
-    ++ [
-      {
-        Path = ''powershell.exe ${driveLetter}\win-bundle-installer.exe'';
-        Description = "Install any declared packages.";
-      }
-    ]
+    [ {
+      Path = "powershell.exe Set-ExecutionPolicy -Force Unrestricted";
+      Description = "Allow unsigned powershell scripts.";
+    } {
+      Path = ''powershell.exe ${driveLetter}\win-bundle-installer.exe'';
+      Description = "Install any declared packages.";
+    } {
+      Path = "net accounts /maxpwage:unlimited";
+      Description = "Disable forced password expiry.";
+    } ]
    ++ setupCommands
    ++ [
      {
@ -148,6 +147,14 @@ let
          </DriverPaths>
        </component>
        <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+          ${lib.optionalString (!enableTpm) ''
+            <RunSynchronous>
+              <RunSynchronousCommand wcm:action="add">
+                <Order>1</Order>
+                <Path>reg add HKLM\System\Setup\LabConfig /v BypassTPMCheck /t reg_dword /d 0x00000001 /f</Path>
+              </RunSynchronousCommand>
+            </RunSynchronous>
+          ''}

          <DiskConfiguration>
            <Disk wcm:action="add">
@ -199,6 +206,7 @@ let
                <PartitionID>3</PartitionID>
              </InstallTo>
              <InstallFrom>
+                <Path>\install.swm</Path>
                <MetaData wcm:action="add">
                  <Key>/IMAGE/NAME</Key>
                  <Value>${imageSelection}</Value>
@ -209,7 +217,7 @@ let

          <UserData>
            <ProductKey>
-              ${if productKey != null then "<Key>${productKey}</Key>" else ""}
+              ${if productKey != null then "<Key>${productKey}</Key>" else "<Key/>"}
              <WillShowUI>OnError</WillShowUI>
            </ProductKey>
            <AcceptEula>true</AcceptEula>
@ -299,7 +307,7 @@ let
        </component>
      </settings>

-       <cpi:offlineImage cpi:source="wim:c:/wim/windows-10/install.wim#${imageSelection}" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
+       <cpi:offlineImage cpi:source="wim:c:/wim/windows-11/install.wim#${imageSelection}" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
    </unattend>
  '';

--- a/wfvm/default.nix
+++ b/wfvm/default.nix
@ -2,6 +2,6 @@

 {
  makeWindowsImage = attrs: import ./win.nix ({ inherit pkgs; } // attrs);
-  layers = (import ./layers { inherit pkgs; });
-  utils = (import ./utils.nix { inherit pkgs; });
+  layers = import ./layers { inherit pkgs; };
+  utils = import ./utils.nix { inherit pkgs; };
 }
--- a/wfvm/demo-image.nix
+++ b/wfvm/demo-image.nix
@ -19,9 +19,9 @@ wfvm.makeWindowsImage {

  # Custom base iso
  # windowsImage = pkgs.requireFile rec {
-  #   name = "Win10_21H1_English_x64.iso";
-  #   sha256 = "1sl51lnx4r6ckh5fii7m2hi15zh8fh7cf7rjgjq9kacg8hwyh4b9";
-  #   message = "Get ${name} from https://www.microsoft.com/en-us/software-download/windows10ISO";
+  #   name = "Win11_22H2_English_x64v1.iso";
+  #   sha256 = "08mbppsm1naf73z8fjyqkf975nbls7xj9n4fq0yp802dv1rz3whd";
+  #   message = "Get disk image ${name} from https://www.microsoft.com/en-us/software-download/windows11/";
  # };

  # impureShellCommands = [
@ -57,7 +57,7 @@ wfvm.makeWindowsImage {
        disable-autolock
        disable-firewall
      ])
-      anaconda3 msys2 msvc msvc-ide-unbreak
+      anaconda3 msys2
    ];

  # services = {
@ -70,7 +70,7 @@ wfvm.makeWindowsImage {

  # License key (required)
  # productKey = throw "Search the f* web"
-  imageSelection = "Windows 10 Pro";
+  imageSelection = "Windows 11 Pro N";


  # Locales
--- a/wfvm/layers/default.nix
+++ b/wfvm/layers/default.nix
@ -72,7 +72,7 @@ in
      bootstrapper = pkgs.fetchurl {
        name = "RESTRICTDIST-vs_Community.exe";
        url = "https://aka.ms/vs/16/release/vs_community.exe";
-        sha256 = "sha256-4X8NhdcNyfHkN6eKkNz8Unvv49wRZE4CQ1vf6P1R2ic=";
+        sha256 = "sha256-l4ZKFZTgHf3BmD0eFWyGwsvb4lqB/LiQYizAABOs3gg=";
      };
      # This touchy-feely "community" piece of trash seems deliberately crafted to break Wine, so we use the VM to run it.
      download-vs = wfvm.utils.wfvm-run {
@ -93,7 +93,7 @@ in

        outputHashAlgo = "sha256";
        outputHashMode = "recursive";
-        outputHash = "0ic3jvslp2y9v8yv9mfr2mafkvj2q5frmcyhmlbxj71si1x3kpag";
+        outputHash = "sha256-GoOKzln8DXVMx52jWGEjwkOFkpSW+wEffAVmBVugIyk=";

        phases = [ "buildPhase" ];
        buildInputs = [ download-vs ];
--- a/wfvm/utils.nix
+++ b/wfvm/utils.nix
@ -1,23 +1,45 @@
-{ pkgs, baseRtc ? "2022-10-10T10:10:10", cores ? "4", qemuMem ? "4G", efi ? true }:
+{ pkgs
+, baseRtc ? "2022-10-10T10:10:10"
+, cores ? "4"
+, qemuMem ? "4G"
+, efi ? true
+, enableTpm ? false
+, ...
+}:

 rec {
  # qemu_test is a smaller closure only building for a single system arch
  qemu = pkgs.qemu;

+  OVMF = pkgs.OVMF.override {
+    secureBoot = true;
+  };
+
  mkQemuFlags = extraFlags: [
    "-enable-kvm"
    "-cpu host"
    "-smp ${cores}"
    "-m ${qemuMem}"
-    "-M q35"
+    "-M q35,smm=on"
    "-vga qxl"
    "-rtc base=${baseRtc}"
    "-device qemu-xhci"
    "-device virtio-net-pci,netdev=n1"
  ] ++ pkgs.lib.optionals efi [
-    "-bios ${pkgs.OVMF.fd}/FV/OVMF.fd"
+    "-bios ${OVMF.fd}/FV/OVMF.fd"
+  ] ++ pkgs.lib.optionals enableTpm [
+    "-chardev" "socket,id=chrtpm,path=tpm.sock"
+    "-tpmdev" "emulator,id=tpm0,chardev=chrtpm"
+    "-device" "tpm-tis,tpmdev=tpm0"
  ] ++ extraFlags;

+  tpmStartCommands = pkgs.lib.optionalString enableTpm ''
+    mkdir -p tpmstate
+    ${pkgs.swtpm}/bin/swtpm socket \
+      --tpmstate dir=tpmstate \
+      --ctrl type=unixio,path=tpm.sock &
+  '';
+
  # Pass empty config file to prevent ssh from failing to create ~/.ssh
  sshOpts = "-F /dev/null -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -o ConnectTimeout=1";
  win-exec = pkgs.writeShellScriptBin "win-exec" ''
@ -93,6 +115,7 @@ rec {
      ]);
    in pkgs.writeShellScriptBin "wfvm-run-${name}" ''
      set -e -m
+      ${tpmStartCommands}
      ${qemu}/bin/qemu-system-x86_64 ${pkgs.lib.concatStringsSep " " qemuParams} &

      ${win-wait}/bin/win-wait
--- a/wfvm/win.nix
+++ b/wfvm/win.nix
@ -5,15 +5,16 @@
 , impureMode ? false
 , installCommands ? []
 , users ? {}
+, enableTpm ? true
 # autounattend always installs index 1, so this default is backward-compatible
-, imageSelection ? "Windows 10 Pro"
+, imageSelection ? "Windows 11 Pro N"
 , efi ? true
 , ...
 }@attrs:

 let
  lib = pkgs.lib;
-  utils = import ./utils.nix { inherit pkgs efi; };
+  utils = import ./utils.nix ({ inherit pkgs efi enableTpm; } // attrs);
  inherit (pkgs) guestfs-tools;

  # p7zip on >20.03 has known vulns but we have no better option
@ -36,15 +37,14 @@ let
  );

  windowsIso = if windowsImage != null then windowsImage else pkgs.requireFile rec {
-    name = "Win10_21H2_English_x64.iso";
-    sha256 = "0kr3m0bjy086whcbssagsshdxj6lffcz7wmvbh50zhrkxgq3hrbz";
-    message = "Get ${name} from https://www.microsoft.com/en-us/software-download/windows10ISO";
+    name = "Win11_22H2_English_x64v2.iso";
+    sha256 = "0xhhxy47yaf1jsfmskym5f65hljw8q0aqs70my86m402i6dsjnc0";
+    message = "Get disk image ${name} from https://www.microsoft.com/en-us/software-download/windows11/";
  };

-  # stable as of 2021-04-08
  virtioWinIso = pkgs.fetchurl {
-    url = "https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-virtio/virtio-win-0.1.185-2/virtio-win-0.1.185.iso";
-    sha256 = "11n3kjyawiwacmi3jmfmn311g9xvfn6m0ccdwnjxw1brzb4kqaxg";
+    url = "https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-virtio/virtio-win-0.1.229-1/virtio-win.iso";
+    sha256 = "1q5vrcd70kya4nhlbpxmj7mwmwra1hm3x7w8rzkawpk06kg0v2n8";
  };

  openSshServerPackage = pkgs.fetchurl {
@ -54,7 +54,7 @@ let

  autounattend = import ./autounattend.nix (
    attrs // {
-      inherit pkgs;
+      inherit pkgs enableTpm;
      users = users // {
        wfvm = {
          password = "1234";
@ -132,6 +132,8 @@ let
        ''}
        rm -rf win

+        ${utils.tpmStartCommands}
+
        # Qemu requires files to be rw
        qemu-img create -f qcow2 c.img ${diskImageSize}
        qemu-system-x86_64 ${lib.concatStringsSep " " qemuParams}
@ -159,6 +161,8 @@ let

  in ''
    set -x
+    ${utils.tpmStartCommands}
+
    # Create an image referencing the previous image in the chain
    qemu-img create -F qcow2 -f qcow2 -b ${acc} c.img
Author	SHA1	Message	Date
Astro	8051ad647a	utils.nix: pass all attrs Fixes passing baseRtc and other parameters	2023-06-26 15:48:34 +02:00
Astro	ec1c08956b	default.nix: remove superfluous parentheses	2023-06-26 15:48:18 +02:00
Astro	7e09796a9b	Revert "remove configurable efi flag" This reverts commit `af9218e652`.	2023-06-08 18:42:48 +02:00
Sebastien Bourdeauducq	4dcd3699fe	add 'nix run' demo	2023-05-27 15:36:00 +08:00
Sebastien Bourdeauducq	bf681b20aa	remove MSVC from demo image Usually broken due to Microsoft's war on reproducibility.	2023-05-27 15:15:51 +08:00
Sebastien Bourdeauducq	3cbddd7218	update nixpkgs	2023-05-27 15:15:33 +08:00
Astro	3694b0a9f2	windowsIso: 22H2v1 -> 22H2v2	2023-05-26 00:13:21 +02:00
Astro	b9e261de6f	layers msvc cache: update outputHash	2023-05-25 15:59:36 +02:00
Astro	285b33a674	autounattend: fix installation without productKey	2023-05-25 15:59:36 +02:00
Astro	9a92143337	autounattend: disable forced password expiry in autounattended install stage already	2023-05-25 15:59:36 +02:00
Astro	16e041282f	add enableTpm	2023-05-25 15:59:36 +02:00
Astro	bc24fd6a2b	autounattend: remove more optional bypasses	2023-05-25 15:59:36 +02:00
Astro	af9218e652	remove configurable efi flag Win11 is EFI-only	2023-05-25 15:59:36 +02:00
Astro	fe347240f5	enable secureboot	2023-05-25 15:59:36 +02:00
Astro	d2d9c7acf6	layers.msvc: update bootstapper sha256	2023-05-25 15:59:36 +02:00
Astro	267b3eec44	autounattend: explicitly set the InstallFrom/Path Apparently required for Win11.	2023-05-25 15:59:36 +02:00
Astro	1550caf442	autounattend: add Bypass*Check At least the TPM2.0 is missing from our qemu run but Windows 11's error message doesn't reveal what else is missing. It is therefore hard to estimate the work to do this properly.	2023-05-25 15:59:36 +02:00
Astro	598b311215	windowsIso: Win10_21H2 -> Win11_22H2	2023-05-25 15:59:36 +02:00
Astro	79c1685f89	virtioWinIso: 0.1.185-2 -> 0.1.229-1	2023-05-23 21:48:23 +02:00