kali: A distribution based on Debian: https://www.kali.org/

Kali includes many packages suitable for offensive security tasks.
It follows a rolling release model and serves fewer architectures
than Debian.

Building a kali image requires installing kali-archive-keyring:
- Source: https://gitlab.com/kalilinux/packages/kali-archive-keyring
- Packages: https://pkg.kali.org/pkg/kali-archive-keyring

docs/bootable.md

@@ -69,6 +69,22 @@ Packages=linux-image-generic
          dbus
 ```
 
+## Kali
+
+```conf
+[Distribution]
+Distribution=kali
+
+[Content]
+Bootable=yes
+Packages=linux-image-generic
+         systemd
+         systemd-boot
+         systemd-sysv
+         udev
+         dbus
+```
+
 ## Ubuntu
 
 ```conf

mkosi.conf.d/20-kali/mkosi.conf

@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=kali
+
+[Distribution]
+Repositories=non-free-firmware
+
+[Host]
+ToolsTreeDistribution=kali
+
+[Content]
+Packages=
+        linux-perf

mkosi.conf.d/20-kali/mkosi.conf.d/20-arm64.conf

@@ -0,0 +1,8 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Architecture=arm64
+
+[Content]
+Packages=
+        linux-image-cloud-arm64

mkosi.conf.d/20-kali/mkosi.conf.d/20-x86-64.conf

@@ -0,0 +1,8 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Architecture=x86-64
+
+[Content]
+Packages=
+        linux-image-cloud-amd64

mkosi.conf.d/20-kali/mkosi.conf.d/20-x86.conf

@@ -0,0 +1,8 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Architecture=x86
+
+[Content]
+Packages=
+        linux-image-686

mkosi.conf.d/30-debian-ubuntu/mkosi.conf → mkosi.conf.d/30-debian-kali-ubuntu/mkosi.conf

@@ -2,6 +2,7 @@
 
 [Match]
 Distribution=|debian
+Distribution=|kali
 Distribution=|ubuntu
 
 [Content]

mkosi.extra/usr/lib/systemd/system-preset/00-mkosi.preset

@@ -4,7 +4,7 @@
 disable ssh.service
 disable sshd.service
 
-# Make sure dbus-broker is started by default on Debian/Ubuntu.
+# Make sure dbus-broker is started by default on Debian/Kali/Ubuntu.
 enable dbus-broker.service
 
 # Make sure we have networking available.

mkosi.extra/usr/lib/systemd/system-preset/99-mkosi.preset

@@ -1,4 +1,4 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
-# Make sure that services are disabled by default (primarily for Debian/Ubuntu).
+# Make sure that services are disabled by default (primarily for Debian/Kali/Ubuntu).
 disable *

mkosi.postinst

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -e
 
-if [[ "$DISTRIBUTION" =~ ubuntu|debian ]]; then
+if [[ "$DISTRIBUTION" =~ ubuntu|kali|debian ]]; then
     SUDO_GROUP=sudo
 else
     SUDO_GROUP=wheel

mkosi/distributions/__init__.py

@@ -76,6 +76,7 @@ class Distribution(StrEnum):
     # of the mkosi maintainers before implementing a new distribution.
     fedora       = enum.auto()
     debian       = enum.auto()
+    kali         = enum.auto()
     ubuntu       = enum.auto()
     arch         = enum.auto()
     opensuse     = enum.auto()
@@ -98,7 +99,7 @@ def is_centos_variant(self) -> bool:
         )
 
     def is_apt_distribution(self) -> bool:
-        return self in (Distribution.debian, Distribution.ubuntu)
+        return self in (Distribution.debian, Distribution.ubuntu, Distribution.kali)
 
     def is_rpm_distribution(self) -> bool:
         return self in (
@@ -180,7 +181,7 @@ def detect_distribution() -> tuple[Optional[Distribution], Optional[str]]:
         if d is not None:
             break
 
-    if d in {Distribution.debian, Distribution.ubuntu} and version_codename:
+    if d in {Distribution.debian, Distribution.ubuntu, Distribution.kali} and version_codename:
         version_id = version_codename
 
     return d, version_id

mkosi/distributions/kali.py

@@ -0,0 +1,60 @@
+# SPDX-License-Identifier: LGPL-2.1+
+
+from collections.abc import Iterable
+from pathlib import Path
+
+from mkosi.config import Architecture
+from mkosi.context import Context
+from mkosi.distributions import Distribution, debian
+from mkosi.installer.apt import AptRepository
+from mkosi.log import die
+from mkosi.util import listify
+
+
+class Installer(debian.Installer):
+    @classmethod
+    def pretty_name(cls) -> str:
+        return "Kali Linux"
+
+    @classmethod
+    def default_release(cls) -> str:
+        return "kali-rolling"
+
+    @classmethod
+    def default_tools_tree_distribution(cls) -> Distribution:
+        return Distribution.kali
+
+    @staticmethod
+    @listify
+    def repositories(context: Context, local: bool = True) -> Iterable[AptRepository]:
+        if context.config.local_mirror and local:
+            yield AptRepository(
+                types=("deb",),
+                url=context.config.local_mirror,
+                suite=context.config.release,
+                components=("main",),
+                signedby=None,
+            )
+            return
+
+        yield AptRepository(
+            types=("deb", "deb-src"),
+            url=context.config.mirror or "http://http.kali.org/kali",
+            suite=context.config.release,
+            components=("main", *context.config.repositories),
+            signedby=Path("/usr/share/keyrings/kali-archive-keyring.gpg"),
+        )
+
+    @classmethod
+    def architecture(cls, arch: Architecture) -> str:
+        a = {
+            Architecture.arm64: "arm64",
+            Architecture.arm: "armhf",
+            Architecture.x86_64: "amd64",
+            Architecture.x86: "i386",
+        }.get(arch)
+
+        if not a:
+            die(f"Architecture {arch} is not supported by {cls.pretty_name()}")
+
+        return a

mkosi/installer/apt.py

@@ -128,8 +128,8 @@ def setup(cls, context: Context, repos: Iterable[AptRepository]) -> None:
                 if repo.signedby and not repo.signedby.exists():
                     die(
                         f"Keyring for repo {repo.url} not found at {repo.signedby}",
-                        hint="Make sure the right keyring package (e.g. debian-archive-keyring or ubuntu-keyring) is "
-                             "installed",
+                        hint="Make sure the right keyring package (e.g. debian-archive-keyring, kali-archive-keyring "
+                             "or ubuntu-keyring) is installed",
                     )
 
             with sources.open("w") as f:

mkosi/resources/mkosi-initrd/mkosi.conf.d/10-debian-ubuntu/mkosi.conf → mkosi/resources/mkosi-initrd/mkosi.conf.d/10-debian-kali-ubuntu/mkosi.conf

@@ -2,6 +2,7 @@
 
 [Match]
 Distribution=|debian
+Distribution=|kali
 Distribution=|ubuntu
 
 [Content]

mkosi/resources/mkosi-initrd/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/10-libtss.conf → mkosi/resources/mkosi-initrd/mkosi.conf.d/10-debian-kali-ubuntu/mkosi.conf.d/10-libtss.conf

@@ -3,6 +3,9 @@
 [TriggerMatch]
 Distribution=debian
 
+[TriggerMatch]
+Distribution=kali
+
 [TriggerMatch]
 Distribution=ubuntu
 Release=!focal

mkosi/resources/mkosi-tools/mkosi.conf.d/10-debian-ubuntu/mkosi.conf → mkosi/resources/mkosi-tools/mkosi.conf.d/10-debian-kali-ubuntu/mkosi.conf

@@ -2,11 +2,13 @@
 
 [Match]
 Distribution=|debian
+Distribution=|kali
 Distribution=|ubuntu
 
 [Content]
 Packages=
         ?exact-name(distribution-gpg-keys)
+        ?exact-name(kali-archive-keyring)
         ?exact-name(grub-pc-bin)
         ?exact-name(systemd-boot)
         ?exact-name(systemd-repart)