1 files changed, 11 insertions, 2 deletions

diff --git a/Makefile b/Makefile
index f507be0..54658af 100644
--- a/Makefile
+++ b/Makefile
@@ -174,6 +174,14 @@ get_loop_dev="$$(sudo losetup -n -O name -j $@~tmp)"
 get_backing_file="$$(sudo losetup -n -O back-file -j $@~tmp)"
 get_min_size="$$(btrfs inspect-internal min-dev-size --id 1 $@.mnt | (read b _; echo $$b))"
 
+%.btrfs.verity: %.btrfs
+        sudo veritysetup format $< $@ > $@.log
+        sudo chmod 644 $@
+        h=$$(sed -ne 's/^Root hash:[ \t]*//p' $@.log) && [ "$$h" ]
+
+%.btrfs.verity.log.asc: %.btrfs.verity.log
+        sudo gpg --armor --detach-sign $^
+
 rootfs/samizdat.seed.btrfs: rootfs/samizdat.btrfs
 ifneq ($(shell id -u),0)
         $(SUDO_MAKE) $@
@@ -282,7 +290,8 @@ gold.iso: rootfs/seed.iso reused-child
                 --protective-msdos-label
         mv $@~tmp $@
 
-rootfs/seed.iso: rootfs/samizdat.seed.btrfs
+rootfs/seed.iso: $(addprefix rootfs/samizdat.seed.btrf, s \
+                  $(if $(VERITY), s.verity s.verity.log $(if $(VERITY_SIGN), s.verity.log.asc)))
         rm -f $@~tmp
         touch $@~tmp
         fallocate -n -l 10G $@~tmp
@@ -293,7 +302,7 @@ rootfs/seed.iso: rootfs/samizdat.seed.btrfs
                 -volid SamizdatLive \
                 -pathspecs on \
                 -follow link \
-                -add /rootfs/samizdat.btrfs=$< -- \
+                -add $^ -- \
                 -follow default
         mv $@~tmp $@