Merge pull request #346 from nix-community/renovate/all

fix(deps): update all dependencies

nix/tests/lanzaboote/systemd-pcrlock.nix

@@ -18,26 +18,10 @@
     ];
 
     systemd.additionalUpstreamSystemUnits = [
-      "systemd-pcrphase-initrd.service"
-
       "systemd-pcrphase.service"
       "systemd-pcrphase-sysinit.service"
     ];
 
-    boot.initrd.systemd.services.systemd-pcrphase-initrd = {
-      wantedBy = [ "initrd.target" ];
-    };
-
-    systemd.services.systemd-pcrphase-sysinit = {
-      wantedBy = [ "sysinit.target" ];
-    };
-
-    systemd.services.systemd-pcrphase = {
-      wantedBy = [ "sysinit.target" ];
-    };
-
-    boot.initrd.kernelModules = [ "tpm_tis" ];
-
     environment.etc = {
       systemd-pcrlock-builtin = {
         target = "pcrlock.d";
@@ -52,9 +36,9 @@
     machine.start()
 
     with subtest("Check if systemd-pcrphase measurements have been made"):
-      machine.succeed("systemctl is-active systemd-pcrphase.service")
-      machine.succeed("systemctl is-active systemd-pcrphase-sysinit.service")
-    
+      machine.wait_for_unit("systemd-pcrphase.service")
+      machine.wait_for_unit("systemd-pcrphase-sysinit.service")
+
     with subtest("Check if all expected IPL measurements are present"):
       (status, log_json) = machine.execute("${pkgs.systemd}/lib/systemd/systemd-pcrlock log --json=short")
       log_data = json.loads(log_json)

rust/tool/systemd/Cargo.toml

@@ -16,7 +16,7 @@ indoc = "2.0.5"
 serde_json = "1.0.115"
 sha2 = "0.10.8"
 tempfile = "3.10.1"
-nix = { version = "0.28.0", default-features = false, features = [ "fs" ] }
+nix = { version = "0.29.0", default-features = false, features = [ "fs" ] }
 
 [dev-dependencies]
 assert_cmd = "2.0.14"

rust/uefi/Cargo.toml

@@ -1,4 +1,5 @@
 [workspace]
+resolver = "2"
 
 members = [
     "stub",

rust/uefi/linux-bootloader/Cargo.toml

@@ -12,7 +12,7 @@ repository = "https://github.com/nix-community/lanzaboote/"
 rust-version = "1.68"
 
 [dependencies]
-uefi = { version = "0.27.0", default-features = false, features = [ "alloc", "global_allocator" ] }
+uefi = { version = "0.28.0", default-features = false, features = [ "alloc", "global_allocator" ] }
 # Update blocked by #237
 goblin = { version = "=0.6.1", default-features = false, features = [ "pe64", "alloc" ]}
 bitflags = "2.5.0"

rust/uefi/stub/Cargo.toml

@@ -5,8 +5,8 @@ edition = "2021"
 publish = false
 
 [dependencies]
-uefi = { version = "0.27.0", default-features = false, features = [ "alloc", "global_allocator" ] }
-uefi-services = { version = "0.24.0", default-features = false, features = [ "panic_handler", "logger" ] }
+uefi = { version = "0.28.0", default-features = false, features = [ "alloc", "global_allocator" ] }
+uefi-services = { version = "0.25.0", default-features = false, features = [ "panic_handler", "logger" ] }
 # Even in debug builds, we don't enable the debug logs, because they generate a lot of spam from goblin.
 log = { version = "0.4.21", default-features = false, features = [ "max_level_info", "release_max_level_warn" ]}
 # Use software implementation because the UEFI target seems to need it.

rust/uefi/stub/src/fat.rs

@@ -44,7 +44,7 @@ pub fn boot_linux(
     mut system_table: SystemTable<Boot>,
     dynamic_initrds: Vec<Vec<u8>>,
 ) -> Status {
-    uefi_services::init(&mut system_table).unwrap();
+    uefi::helpers::init(&mut system_table).unwrap();
 
     // SAFETY: We get a slice that represents our currently running
     // image and then parse the PE data structures from it. This is

rust/uefi/stub/src/main.rs

@@ -43,7 +43,7 @@ fn print_logo() {
 
 #[entry]
 fn main(handle: Handle, mut system_table: SystemTable<Boot>) -> Status {
-    uefi_services::init(&mut system_table).unwrap();
+    uefi::helpers::init(&mut system_table).unwrap();
 
     print_logo();
 

rust/uefi/stub/src/thin.rs

@@ -81,7 +81,7 @@ pub fn boot_linux(
     mut system_table: SystemTable<Boot>,
     dynamic_initrds: Vec<Vec<u8>>,
 ) -> uefi::Result<()> {
-    uefi_services::init(&mut system_table).unwrap();
+    uefi::helpers::init(&mut system_table).unwrap();
 
     // SAFETY: We get a slice that represents our currently running
     // image and then parse the PE data structures from it. This is