The developers of the postmarketOS project, which is developing a Linux distribution for mobile devices, have announced the creation of an atomically updatable version of the distribution. The new edition is being developed under the name Duranium and is notable for delivering the system as a single whole, without splitting it into separate packages. It is emphasized that the new version aligns with the idea that the device should simply work, without the user needing to know about the existence of a terminal or delve into the system's intricacies.
The system environment in the /usr section is mounted in read-only mode using the EROFS filesystem and is verified at each boot via a digital signature. The /usr section is 5GB in size. To ensure data integrity in the /usr section, dm-verity is utilized, and if any modification of the content is detected, the boot process is blocked. The verification hash is embedded in the Unified Kernel Image (UKI), which combines the handler for loading the kernel from UEFI (UEFI boot stub), the Linux kernel image, and the initrd that is loaded into memory, used for initial initialization before mounting the root filesystem. The UKI image is formatted as a single executable file in PE format and is invoked by the UEFI bootloader.
All other directories, except for /usr, are part of the root partition, which is writable and preserved between reboots and updates. The content of the root partition is mandatory encrypted using LUKS2, which raises hardware requirements. The encrypted root filesystem is created during the first boot or after performing a factory reset. A blank key is created by default, allowing for the automatic unlocking of the encrypted partition. During the initial setup wizard and configuration, the user is prompted to set a password for decryption.
Default settings are stored within the system image in the /usr/share/factory/etc directory. During the first boot, symbolic links to all files in /usr/share/factory/etc are created in the /etc directory, except for the files passwd, group, shadow, fstab, machine-id, and hostname. If changes to the settings are needed during operation, the symbolic link is replaced with a copy of the file.
Updates are installed by replacing the entire system image. Two identical root partitions are created on the drive — active and passive. The new update is installed in the passive partition, with no effect on the active one. After verification of the installed update's correctness and a successful reboot, the partitions switch places — the partition with the update becomes active, while the previously active partition is switched to passive mode and waits for the next update. If there are boot issues after the update, an automatic rollback to the previous system version occurs.
This approach significantly simplifies debugging and problem diagnosis, as developers can precisely reproduce the state in which the failure occurred, without needing to replicate the user's system composition at the level of individual packages and account for existing package version combinations. The downside is higher hardware requirements, which will not allow Duranium to be used on all devices supported in postmarketOS.
The contents of the Duranium system image are formed from a unified package base with postmarketOS, based on Alpine Linux, the standard C library Musl, and a set of BusyBox utilities. The releases of postmarketOS and Duranium are almost identical in composition but differ in their methods of system delivery. Components like systemd-sysupdate, systemd-repart, and systemd-verity-setup are used for the formation, installation, and updating of system images.
Additional applications are installed in the Flatpak format or using the Coldbrew package manager. Coldbrew allows the installation of packages from Alpine Linux repositories into the user's home directory. When launched, such packages are isolated using the bubblewrap tool.
Source: opennet.ru
