Compare commits

...

33 Commits

Author SHA1 Message Date
sb10q e811c7c5d8 README: windows 11 2024-06-11 13:14:36 +08:00
Astro 8051ad647a utils.nix: pass all attrs
Fixes passing baseRtc and other parameters
2023-06-26 15:48:34 +02:00
Astro ec1c08956b default.nix: remove superfluous parentheses 2023-06-26 15:48:18 +02:00
Astro 7e09796a9b Revert "remove configurable efi flag"
This reverts commit af9218e652.
2023-06-08 18:42:48 +02:00
Sebastien Bourdeauducq 4dcd3699fe add 'nix run' demo 2023-05-27 15:36:00 +08:00
Sebastien Bourdeauducq bf681b20aa remove MSVC from demo image
Usually broken due to Microsoft's war on reproducibility.
2023-05-27 15:15:51 +08:00
Sebastien Bourdeauducq 3cbddd7218 update nixpkgs 2023-05-27 15:15:33 +08:00
Astro 3694b0a9f2 windowsIso: 22H2v1 -> 22H2v2 2023-05-26 00:13:21 +02:00
Astro b9e261de6f layers msvc cache: update outputHash 2023-05-25 15:59:36 +02:00
Astro 285b33a674 autounattend: fix installation without productKey 2023-05-25 15:59:36 +02:00
Astro 9a92143337 autounattend: disable forced password expiry in autounattended install stage already 2023-05-25 15:59:36 +02:00
Astro 16e041282f add enableTpm 2023-05-25 15:59:36 +02:00
Astro bc24fd6a2b autounattend: remove more optional bypasses 2023-05-25 15:59:36 +02:00
Astro af9218e652 remove configurable efi flag
Win11 is EFI-only
2023-05-25 15:59:36 +02:00
Astro fe347240f5 enable secureboot 2023-05-25 15:59:36 +02:00
Astro d2d9c7acf6 layers.msvc: update bootstapper sha256 2023-05-25 15:59:36 +02:00
Astro 267b3eec44 autounattend: explicitly set the InstallFrom/Path
Apparently required for Win11.
2023-05-25 15:59:36 +02:00
Astro 1550caf442 autounattend: add Bypass*Check
At least the TPM2.0 is missing from our qemu run but Windows 11's error
message doesn't reveal what else is missing. It is therefore hard to
estimate the work to do this properly.
2023-05-25 15:59:36 +02:00
Astro 598b311215 windowsIso: Win10_21H2 -> Win11_22H2 2023-05-25 15:59:36 +02:00
Astro 79c1685f89 virtioWinIso: 0.1.185-2 -> 0.1.229-1 2023-05-23 21:48:23 +02:00
Astro a3df68b61f README: add flakes section 2022-10-13 21:41:23 +02:00
Astro 6542c37863 wfvm/demo-image: make buildable from flake 2022-10-13 21:41:03 +02:00
Astro abd67ce2e6 wfvm/layers: update msvc binary sha256 2022-10-13 21:39:56 +02:00
Astro a6b677f564 wfvm/win: upgrade windowsIso from 21H1 to 21H2 2022-10-13 21:39:33 +02:00
Astro d8e9f9878b wfvm/utils: update baseRtc 2022-10-12 21:29:11 +02:00
Astro 5ba57fb502 wfvm/win: pass format of backing image to qemu-img
required since qemu 6.1.0
2022-10-12 21:05:39 +02:00
Astro dfdcf0f19a flake.lock: Update
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/c5924154f000e6306030300592f4282949b2db6c' (2022-10-08)
  → 'github:nixos/nixpkgs/285e77efe87df64105ec14b204de6636fb0a7a27' (2022-10-11)
2022-10-12 19:05:56 +02:00
Astro 9845a99863 flake.nix: switch input back to nixos-unstable now that fix PRs have landed 2022-10-12 19:04:51 +02:00
Astro 4f7aef8788 wfvm/win: replace libguestfs with guestfs-tools
tools like virt-make-fs have been split off into a separate package.
2022-10-11 00:10:58 +02:00
Astro c124cfc5dc flakify 2022-10-11 00:10:32 +02:00
Astro 3b87f787a8 s/runCommandNoCC/runCommand/ 2022-10-05 16:46:27 +02:00
Astro b33b71eec7 wfvm/win: lower wimsplit size to 4070 MB for more headroom 2022-10-05 16:07:06 +02:00
Astro c732c671d9 wfvm/layers: update vs_Community.exe sha256 2022-10-05 16:06:43 +02:00
10 changed files with 185 additions and 48 deletions

View File

@ -6,7 +6,7 @@ WFVM
A Nix library to create and manage virtual machines running Windows, a medieval operating system found on most computers in 2020. The F stands for "Functional" or a four-letter word of your choice.
* Reproducible - everything runs in the Nix sandbox with no tricks.
* Fully automatic, parameterizable Windows 10 installation.
* Fully automatic, parameterizable Windows 11 installation.
* Uses QEMU with KVM.
* Supports incremental installation (using "layers") of additional software via QEMU copy-on-write backing chains. For example, ``wfvm.makeWindowsImage { installCommands = [ wfvm.layers.anaconda3 ]; };`` gives you a VM image with Anaconda3 installed, and ``wfvm.makeWindowsImage { installCommands = [ wfvm.layers.anaconda3 wfvm.layers.msys2 ]; };`` gives you one with both Anaconda3 and MSYS2 installed. The base Windows installation and the Anaconda3 data are shared between both images, and only the MSYS2 installation is performed when building the second image after the first one has been built.
* Included layers: Anaconda3, a software installer chock full of bugs that pretends to be a package manager, Visual Studio, a spamming system for Microsoft accounts that includes a compiler, and MSYS2, which is the only sane component in the whole lot.
@ -52,3 +52,30 @@ Impure/pure mode
Sometimes it can be useful to build the image _outside_ of the Nix sandbox for debugging purposes.
For this purpose we have an attribute called `impureMode` which outputs the shell script used by Nix inside the sandbox to build the image.
Usage with Nix Flakes
---------------------
Build the demo by running:
```shell
nix build .#demoImage
```
This project's **flake.nix** exposes its functions under `lib`. To use
in your own project, setup your flake like this:
```nix
{
inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
wfvm.url = "git+https://git.m-labs.hk/m-labs/wfvm";
};
outputs = { self, nixpkgs, wfvm }: {
packages."x86_64-linux".flaky-os = wfvm.lib.makeWindowsImage {
# configuration parameters go here
};
};
}
```

27
flake.lock Normal file
View File

@ -0,0 +1,27 @@
{
"nodes": {
"nixpkgs": {
"locked": {
"lastModified": 1685004253,
"narHash": "sha256-AbVL1nN/TDicUQ5wXZ8xdLERxz/eJr7+o8lqkIOVuaE=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "3e01645c40b92d29f3ae76344a6d654986a91a91",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-23.05",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"nixpkgs": "nixpkgs"
}
}
},
"root": "root",
"version": 7
}

37
flake.nix Normal file
View File

@ -0,0 +1,37 @@
{
description = "WFVM: Windows Functional Virtual Machine";
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.05";
};
outputs = { self, nixpkgs }:
let
# only x64 is supported
system = "x86_64-linux";
pkgs = nixpkgs.legacyPackages.${system};
in rec {
lib = import ./wfvm {
inherit pkgs;
};
packages.${system} = rec {
demoImage = import ./wfvm/demo-image.nix {
inherit self;
};
default = lib.utils.wfvm-run {
name = "demo";
image = demoImage;
script =
''
echo "Windows booted. Press Enter to terminate VM."
read
'';
display = true;
};
};
};
}

View File

@ -15,7 +15,8 @@
, impureShellCommands ? []
, driveLetter ? "D:"
, efi ? true
, imageSelection ? "Windows 10 Pro"
, imageSelection ? "Windows 11 Pro N"
, enableTpm
, ...
}:
@ -58,18 +59,16 @@ let
assertCommand = c: builtins.typeOf c == "string" || builtins.typeOf c == "set" && builtins.hasAttr "Path" c && builtins.hasAttr "Description" c;
commands = builtins.map (x: assert assertCommand x; if builtins.typeOf x == "string" then { Path = x; Description = x; } else x) (
[
{
Path = "powershell.exe Set-ExecutionPolicy -Force Unrestricted";
Description = "Allow unsigned powershell scripts.";
}
]
++ [
{
Path = ''powershell.exe ${driveLetter}\win-bundle-installer.exe'';
Description = "Install any declared packages.";
}
]
[ {
Path = "powershell.exe Set-ExecutionPolicy -Force Unrestricted";
Description = "Allow unsigned powershell scripts.";
} {
Path = ''powershell.exe ${driveLetter}\win-bundle-installer.exe'';
Description = "Install any declared packages.";
} {
Path = "net accounts /maxpwage:unlimited";
Description = "Disable forced password expiry.";
} ]
++ setupCommands
++ [
{
@ -148,6 +147,14 @@ let
</DriverPaths>
</component>
<component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
${lib.optionalString (!enableTpm) ''
<RunSynchronous>
<RunSynchronousCommand wcm:action="add">
<Order>1</Order>
<Path>reg add HKLM\System\Setup\LabConfig /v BypassTPMCheck /t reg_dword /d 0x00000001 /f</Path>
</RunSynchronousCommand>
</RunSynchronous>
''}
<DiskConfiguration>
<Disk wcm:action="add">
@ -199,6 +206,7 @@ let
<PartitionID>3</PartitionID>
</InstallTo>
<InstallFrom>
<Path>\install.swm</Path>
<MetaData wcm:action="add">
<Key>/IMAGE/NAME</Key>
<Value>${imageSelection}</Value>
@ -209,7 +217,7 @@ let
<UserData>
<ProductKey>
${if productKey != null then "<Key>${productKey}</Key>" else ""}
${if productKey != null then "<Key>${productKey}</Key>" else "<Key/>"}
<WillShowUI>OnError</WillShowUI>
</ProductKey>
<AcceptEula>true</AcceptEula>
@ -299,13 +307,13 @@ let
</component>
</settings>
<cpi:offlineImage cpi:source="wim:c:/wim/windows-10/install.wim#${imageSelection}" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
<cpi:offlineImage cpi:source="wim:c:/wim/windows-11/install.wim#${imageSelection}" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
</unattend>
'';
in {
# Lint and format as a sanity check
autounattendXML = pkgs.runCommandNoCC "autounattend.xml" {} ''
autounattendXML = pkgs.runCommand "autounattend.xml" {} ''
${pkgs.libxml2}/bin/xmllint --format ${autounattendXML} > $out
'';

View File

@ -1,6 +1,6 @@
{ pkgs }:
pkgs.runCommandNoCC "win-bundle-installer.exe" {} ''
pkgs.runCommand "win-bundle-installer.exe" {} ''
mkdir bundle
cd bundle
cp ${./go.mod} go.mod

View File

@ -2,6 +2,6 @@
{
makeWindowsImage = attrs: import ./win.nix ({ inherit pkgs; } // attrs);
layers = (import ./layers { inherit pkgs; });
utils = (import ./utils.nix { inherit pkgs; });
layers = import ./layers { inherit pkgs; };
utils = import ./utils.nix { inherit pkgs; };
}

View File

@ -1,7 +1,17 @@
{ pkgs ? import <nixpkgs> {}, impureMode ? false }:
{ pkgs ? import <nixpkgs> {}
# Whether to generate just a script to start and debug the windows installation
, impureMode ? false
# Flake input `self`
, self ? null
}:
let
wfvm = (import ./default.nix { inherit pkgs; });
wfvm =
if self == null
# nix-build
then (import ./default.nix { inherit pkgs; })
# built from flake.nix
else self.lib;
in
wfvm.makeWindowsImage {
# Build install script & skip building iso
@ -9,9 +19,9 @@ wfvm.makeWindowsImage {
# Custom base iso
# windowsImage = pkgs.requireFile rec {
# name = "Win10_21H1_English_x64.iso";
# sha256 = "1sl51lnx4r6ckh5fii7m2hi15zh8fh7cf7rjgjq9kacg8hwyh4b9";
# message = "Get ${name} from https://www.microsoft.com/en-us/software-download/windows10ISO";
# name = "Win11_22H2_English_x64v1.iso";
# sha256 = "08mbppsm1naf73z8fjyqkf975nbls7xj9n4fq0yp802dv1rz3whd";
# message = "Get disk image ${name} from https://www.microsoft.com/en-us/software-download/windows11/";
# };
# impureShellCommands = [
@ -47,7 +57,7 @@ wfvm.makeWindowsImage {
disable-autolock
disable-firewall
])
anaconda3 msys2 msvc msvc-ide-unbreak
anaconda3 msys2
];
# services = {
@ -60,7 +70,7 @@ wfvm.makeWindowsImage {
# License key (required)
# productKey = throw "Search the f* web"
imageSelection = "Windows 10 Pro";
imageSelection = "Windows 11 Pro N";
# Locales

View File

@ -72,7 +72,7 @@ in
bootstrapper = pkgs.fetchurl {
name = "RESTRICTDIST-vs_Community.exe";
url = "https://aka.ms/vs/16/release/vs_community.exe";
sha256 = "0b3csxz0qsafnvc0d74ywfpralwz8chv4zf9k07akpm8lp8ycgq0";
sha256 = "sha256-l4ZKFZTgHf3BmD0eFWyGwsvb4lqB/LiQYizAABOs3gg=";
};
# This touchy-feely "community" piece of trash seems deliberately crafted to break Wine, so we use the VM to run it.
download-vs = wfvm.utils.wfvm-run {
@ -93,7 +93,7 @@ in
outputHashAlgo = "sha256";
outputHashMode = "recursive";
outputHash = "0ic3jvslp2y9v8yv9mfr2mafkvj2q5frmcyhmlbxj71si1x3kpag";
outputHash = "sha256-GoOKzln8DXVMx52jWGEjwkOFkpSW+wEffAVmBVugIyk=";
phases = [ "buildPhase" ];
buildInputs = [ download-vs ];

View File

@ -1,23 +1,45 @@
{ pkgs, baseRtc ? "2020-04-20T14:21:42", cores ? "4", qemuMem ? "4G", efi ? true }:
{ pkgs
, baseRtc ? "2022-10-10T10:10:10"
, cores ? "4"
, qemuMem ? "4G"
, efi ? true
, enableTpm ? false
, ...
}:
rec {
# qemu_test is a smaller closure only building for a single system arch
qemu = pkgs.qemu;
OVMF = pkgs.OVMF.override {
secureBoot = true;
};
mkQemuFlags = extraFlags: [
"-enable-kvm"
"-cpu host"
"-smp ${cores}"
"-m ${qemuMem}"
"-M q35"
"-M q35,smm=on"
"-vga qxl"
"-rtc base=${baseRtc}"
"-device qemu-xhci"
"-device virtio-net-pci,netdev=n1"
] ++ pkgs.lib.optionals efi [
"-bios ${pkgs.OVMF.fd}/FV/OVMF.fd"
"-bios ${OVMF.fd}/FV/OVMF.fd"
] ++ pkgs.lib.optionals enableTpm [
"-chardev" "socket,id=chrtpm,path=tpm.sock"
"-tpmdev" "emulator,id=tpm0,chardev=chrtpm"
"-device" "tpm-tis,tpmdev=tpm0"
] ++ extraFlags;
tpmStartCommands = pkgs.lib.optionalString enableTpm ''
mkdir -p tpmstate
${pkgs.swtpm}/bin/swtpm socket \
--tpmstate dir=tpmstate \
--ctrl type=unixio,path=tpm.sock &
'';
# Pass empty config file to prevent ssh from failing to create ~/.ssh
sshOpts = "-F /dev/null -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -o ConnectTimeout=1";
win-exec = pkgs.writeShellScriptBin "win-exec" ''
@ -93,6 +115,7 @@ rec {
]);
in pkgs.writeShellScriptBin "wfvm-run-${name}" ''
set -e -m
${tpmStartCommands}
${qemu}/bin/qemu-system-x86_64 ${pkgs.lib.concatStringsSep " " qemuParams} &
${win-wait}/bin/win-wait

View File

@ -5,16 +5,17 @@
, impureMode ? false
, installCommands ? []
, users ? {}
, enableTpm ? true
# autounattend always installs index 1, so this default is backward-compatible
, imageSelection ? "Windows 10 Pro"
, imageSelection ? "Windows 11 Pro N"
, efi ? true
, ...
}@attrs:
let
lib = pkgs.lib;
utils = import ./utils.nix { inherit pkgs efi; };
libguestfs = pkgs.libguestfs-with-appliance;
utils = import ./utils.nix ({ inherit pkgs efi enableTpm; } // attrs);
inherit (pkgs) guestfs-tools;
# p7zip on >20.03 has known vulns but we have no better option
p7zip = pkgs.p7zip.overrideAttrs(old: {
@ -24,7 +25,7 @@ let
});
runQemuCommand = name: command: (
pkgs.runCommandNoCC name { buildInputs = [ p7zip utils.qemu libguestfs ]; }
pkgs.runCommand name { buildInputs = [ p7zip utils.qemu guestfs-tools ]; }
(
''
if ! test -f; then
@ -36,15 +37,14 @@ let
);
windowsIso = if windowsImage != null then windowsImage else pkgs.requireFile rec {
name = "Win10_21H1_English_x64.iso";
sha256 = "1sl51lnx4r6ckh5fii7m2hi15zh8fh7cf7rjgjq9kacg8hwyh4b9";
message = "Get ${name} from https://www.microsoft.com/en-us/software-download/windows10ISO";
name = "Win11_22H2_English_x64v2.iso";
sha256 = "0xhhxy47yaf1jsfmskym5f65hljw8q0aqs70my86m402i6dsjnc0";
message = "Get disk image ${name} from https://www.microsoft.com/en-us/software-download/windows11/";
};
# stable as of 2021-04-08
virtioWinIso = pkgs.fetchurl {
url = "https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-virtio/virtio-win-0.1.185-2/virtio-win-0.1.185.iso";
sha256 = "11n3kjyawiwacmi3jmfmn311g9xvfn6m0ccdwnjxw1brzb4kqaxg";
url = "https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-virtio/virtio-win-0.1.229-1/virtio-win.iso";
sha256 = "1q5vrcd70kya4nhlbpxmj7mwmwra1hm3x7w8rzkawpk06kg0v2n8";
};
openSshServerPackage = pkgs.fetchurl {
@ -54,7 +54,7 @@ let
autounattend = import ./autounattend.nix (
attrs // {
inherit pkgs;
inherit pkgs enableTpm;
users = users // {
wfvm = {
password = "1234";
@ -109,7 +109,7 @@ let
''
#!${pkgs.runtimeShell}
set -euxo pipefail
export PATH=${lib.makeBinPath [ p7zip utils.qemu libguestfs pkgs.wimlib ]}:$PATH
export PATH=${lib.makeBinPath [ p7zip utils.qemu guestfs-tools pkgs.wimlib ]}:$PATH
# Create a bootable "USB" image
# Booting in USB mode circumvents the "press any key to boot from cdrom" prompt
@ -120,7 +120,7 @@ let
7z x -y ${windowsIso} -owin
# Split image so it fits in FAT32 partition
wimsplit win/sources/install.wim win/sources/install.swm 4090
wimsplit win/sources/install.wim win/sources/install.swm 4070
rm win/sources/install.wim
cp ${autounattend.autounattendXML} win/autounattend.xml
@ -132,18 +132,20 @@ let
''}
rm -rf win
${utils.tpmStartCommands}
# Qemu requires files to be rw
qemu-img create -f qcow2 c.img ${diskImageSize}
qemu-system-x86_64 ${lib.concatStringsSep " " qemuParams}
''
);
baseImage = pkgs.runCommandNoCC "RESTRICTDIST-windows.img" {} ''
baseImage = pkgs.runCommand "RESTRICTDIST-windows.img" {} ''
${installScript}
mv c.img $out
'';
finalImage = builtins.foldl' (acc: v: pkgs.runCommandNoCC "RESTRICTDIST-${v.name}.img" {
finalImage = builtins.foldl' (acc: v: pkgs.runCommand "RESTRICTDIST-${v.name}.img" {
buildInputs = with utils; [
qemu win-wait win-exec win-put
] ++ (v.buildInputs or []);
@ -158,8 +160,11 @@ let
]);
in ''
set -x
${utils.tpmStartCommands}
# Create an image referencing the previous image in the chain
qemu-img create -f qcow2 -b ${acc} c.img
qemu-img create -F qcow2 -f qcow2 -b ${acc} c.img
set -m
qemu-system-x86_64 ${lib.concatStringsSep " " qemuParams} &