Initial commit

.github/workflows/repo.yml

@@ -0,0 +1,38 @@
+name: Repo
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  workflow_dispatch:
+
+jobs:
+  debian-repo:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [ amd64, arm64 ]
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Build the repo
+        run: ./build ostreeRepo-${{ matrix.arch }}
+        working-directory: ./debian
+
+  gardenlinux-repo:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [ amd64, arm64 ]
+        platform: [ kvm, metal ]
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Build the repo
+        run: ./build ${{ matrix.platform }}_dev_curl-ostreeRepo-${{ matrix.arch }}
+        working-directory: ./gardenlinux

LICENSE.md

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright 2017 Tianon Gravi <[email protected]>
+Copyright (c) 2023 SAP SE [email protected]
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,13 @@
+# OSTree Image Builder
+
+> **EXPERIMENTAL** This repository is part of a proof of concept.
+The Garden Linux team does not provide any support or gurantee for this repository.
+
+Builder for [OSTree](https://ostreedev.github.io/ostree/)-based operating system images using the [Garden Linux Builder](https://github.com/gardenlinux/builder).
+
+This repo contains two os builder definitions.
+
+The `debian` directory contains a build for a debian trixie image.
+
+The `gardenlinux` directory contains a build for a gardenlinux today image.
+This directory contains a lot of code taken from the [gardenlinux/gardenlinux](https://github.com/gardenlinux/gardenlinux) repo.

debian/.gitignore

@@ -0,0 +1 @@
+.build

debian/README.md

@@ -0,0 +1,43 @@
+# Debian OSTree Builder
+
+This is a experimental repo to build Debian OSTree images.
+
+## Build
+
+This repo is built using the [Garden Linux Builder](https://github.com/gardenlinux/builder#builder), which uses podman, see it's readme for setup instructions.
+
+This repo has two ostree related features (build targets).
+You can run them with the following commands:
+
+```bash
+$ ./build ostreeRepo
+$ ./build ostreeImage
+```
+
+For just getting a bootable system, use `ostreeImage`.
+This will produce a raw disk image that can be booted in qemu.
+See below for the command to boot the image.
+
+`ostreeRepo` will give you an OSTree repo in the form of a tarball.
+The output will have a name like `.build/ostreeRepo-*-trixie-*.ostreeRepo.tar.gz`
+This is the foundation for building the disk image, but it is also usable as a remote repo for upgrading the system.
+
+## Run
+
+Use the `bin/start-vm` script from [Garden Linux](https://github.com/gardenlinux/gardenlinux/blob/main/bin/start-vm).
+
+Depending on your architecture, it should look like this:
+
+```bash
+$ path/to/gardenlinux/bin/start-vm --no-watchdog .build/ostreeImage-arm64-trixie*.ostree.raw
+```
+
+```bash
+$ path/to/gardenlinux/bin/start-vm --no-watchdog .build/ostreeImage-amd64-trixie*.ostree.raw
+```
+
+Check for the actual name of the image in the `.build` directory.
+
+Inside the booted vm, you can run the `ostree-upgrade` script to upgrade your OS to the latest version.
+
+Refer to the [OSTree command man page](https://ostreedev.github.io/ostree/man/ostree.html) for instructions of using the cli.

debian/build

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+shopt -s nullglob
+
+container_image=ghcr.io/gardenlinux/builder:301ce9f70045c001c5d724c2f9d1a9503e1d5ccc
+container_engine=podman
+target_dir=.build
+
+container_run_opts=(
+	--security-opt seccomp=unconfined
+	--security-opt apparmor=unconfined
+	--security-opt label=disable
+	--read-only
+)
+
+container_cmd=()
+
+use_kms=0
+resolve_cname=0
+
+while [ $# -gt 0 ]; do
+	case "$1" in
+		--container-image)
+			container_image="$2"
+			shift 2
+			;;
+		--container-engine)
+			container_engine="$2"
+			shift 2
+			;;
+		--container-run-opts)
+			declare -a "container_run_opts=($2)"
+			shift 2
+			;;
+		--privileged)
+			container_run_opts+=(--privileged)
+			container_cmd=(--second-stage)
+			shift
+			;;
+		--kms)
+			use_kms=1
+			shift
+			;;
+		--print-container-image)
+			printf '%s\n' "$container_image"
+			exit 0
+			;;
+		--resolve-cname)
+			resolve_cname=1
+			shift
+			;;
+		--target)
+			target_dir="$2"
+			shift 2
+			;;
+		*)
+			break
+			;;
+	esac
+done
+
+[ -d "$target_dir" ] || mkdir "$target_dir"
+
+container_mount_opts=(
+	-v "$PWD/keyring.gpg:/builder/keyring.gpg:ro"
+	-v "$(realpath "$target_dir"):/builder/.build"
+)
+
+for feature in features/*; do
+	if [ -d "$feature" ]; then
+		container_mount_opts+=(-v "$(realpath -- "$feature"):/builder/$feature:ro")
+	fi
+done
+
+if [ "$container_image" = localhost/builder ]; then
+	dir="$(dirname -- "$(realpath -- "${BASH_SOURCE[0]}")")"
+	"$container_engine" build -t "$container_image" "$dir"
+fi
+
+repo="$(./get_repo)"
+commit="$(./get_commit)"
+timestamp="$(./get_timestamp)"
+default_version="$(./get_version)"
+
+
+if [ "$resolve_cname" = 1 ]; then
+	arch="$("$container_engine" run --rm "${container_run_opts[@]}" "${container_mount_opts[@]}" "$container_image" dpkg --print-architecture)"
+	cname="$("$container_engine" run --rm "${container_run_opts[@]}" "${container_mount_opts[@]}" "$container_image" /builder/parse_features --feature-dir /builder/features --default-arch "$arch" --default-version "$default_version" --cname "$1")"
+	short_commit="$(head -c 8 <<< "$commit")"
+	echo "$cname-$short_commit"
+	exit 0
+fi
+
+make_opts=(
+	REPO="$repo"
+	COMMIT="$commit"
+	TIMESTAMP="$timestamp"
+	DEFAULT_VERSION="$default_version"
+)
+
+if [ "$use_kms" = 1 ]; then
+	for e in AWS_DEFAULT_REGION AWS_REGION AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN; do
+		if [ -n "${!e-}" ]; then
+			make_opts+=("$e=${!e}")
+		fi
+	done
+fi
+
+if [ -d cert ]; then
+	container_mount_opts+=(-v "$PWD/cert:/builder/cert:ro")
+fi
+
+"$container_engine" run --rm "${container_run_opts[@]}" "${container_mount_opts[@]}" "$container_image" ${container_cmd[@]+"${container_cmd[@]}"} make --no-print-directory -C /builder "${make_opts[@]}" "$@"

debian/features/ostreeImage/file.exclude

@@ -0,0 +1 @@
+/boot/efi/loader/random-seed

debian/features/ostreeImage/fstab

@@ -0,0 +1,3 @@
+# <file system>    <dir>        <type>    <options>                                <makeimg args>
+LABEL=EFI          /boot/efi    vfat      umask=0077                               type=uefi,size=1G
+LABEL=ROOT         /            ext4      rw,prjquota,discard

debian/features/ostreeImage/image.ostree.raw

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+
+set -euxo pipefail
+
+export PATH="/builder/image.d:$PATH"
+
+rootfs_work="$(mktemp -d)"
+mount -t tmpfs tmpfs "$rootfs_work"
+
+MYROOT="$(mktemp -d)"
+mount -t tmpfs tmpfs "$MYROOT"
+mkdir -p "$MYROOT"/sysroot
+mkdir -p "$MYROOT"/sysroot/ostree/deploy
+mkdir -p "$MYROOT"/sysroot/ostree/deploy/debian/var
+OSTREE_SYSROOT="$MYROOT/sysroot"
+OSTREE_REPO=$OSTREE_SYSROOT/ostree/repo
+OSTREE_REF="debian/testing/$BUILDER_ARCH"
+
+rootfs="$1"
+output="$2"
+
+tar xf "$rootfs" -C "$rootfs_work"
+
+
+mkdir -p $OSTREE_REPO
+mkdir -p $OSTREE_SYSROOT
+download="$(mktemp -d)"
+pushd $download
+curl --remote-name http://ostree.gardenlinux.io/debian-testing-$BUILDER_ARCH.tar.gz
+tar xf debian-testing-$BUILDER_ARCH.tar.gz --directory $OSTREE_REPO
+ls -l $OSTREE_REPO
+popd
+rm -rf $download
+ostree admin deploy --karg=root=LABEL=ROOT --karg-append=rw --karg-append=efi=runtime --sysroot=$OSTREE_SYSROOT --os=debian $OSTREE_REF
+
+boot_hash=`ls "$OSTREE_SYSROOT"/ostree/boot.1.1/debian/`
+mkdir -p "$OSTREE_SYSROOT"/ostree/boot.1.1/debian/$boot_hash/0/sysroot
+
+mkdir -p "$OSTREE_SYSROOT"/ostree/deploy/debian/var/home
+mkdir -p "$OSTREE_SYSROOT"/ostree/deploy/debian/var/home/user
+mkdir -p "$OSTREE_SYSROOT"/ostree/deploy/debian/var/roothome
+mkdir -p "$OSTREE_SYSROOT"/ostree/deploy/debian/var/opt
+mkdir -p "$OSTREE_SYSROOT"/ostree/deploy/debian/var/srv
+
+chown 1000:1000 "$OSTREE_SYSROOT"/ostree/deploy/debian/var/home/user
+
+# Build disk image, this is hacky as of now, needs rework
+# Setup bootloader
+boot_dir=$(mktemp -d)
+cp -r $OSTREE_SYSROOT/boot/* $boot_dir
+LOADER_TEMP=$(mktemp -d)
+rm -rf $boot_dir/loader
+# move to temp dir to avoid errors with systemd-boot install
+mv $boot_dir/loader.1 $LOADER_TEMP
+mkdir -p $rootfs_work/boot/efi
+mount --bind $boot_dir $rootfs_work/boot/efi
+mount --rbind /proc $rootfs_work/proc
+mount --rbind /sys $rootfs_work/sys
+SYSTEMD_ESP_PATH=/boot/efi chroot $rootfs_work /usr/bin/bootctl --no-variables install
+umount -l $rootfs_work/proc
+umount -l $rootfs_work/sys
+umount $rootfs_work/boot/efi
+# recover from temp dir
+cp -r $LOADER_TEMP/* $boot_dir/loader.1
+cp -r $LOADER_TEMP/* $boot_dir/loader
+cp $boot_dir/loader/loader.1/entries/* $boot_dir/loader/entries
+cat $boot_dir/loader/entries/*
+echo 'timeout 7' > $boot_dir/loader/loader.conf
+
+efi_partition=$(mktemp)
+root_partition=$(mktemp)
+partitions=$(mktemp)
+
+# fixme: make disk size dynamic
+truncate -s 500M "$efi_partition"
+# make_reproducible_vfat $OSTREE_SYSROOT/boot "$efi_partition"
+make_reproducible_vfat -t 11111111 $boot_dir "$efi_partition"
+size_uefi=$(du -b "$efi_partition" | awk '{ padded_size = $1 + (MB - ($1 % MB) % MB); print (padded_size / MB) }' "MB=1048576")
+part_uuid_uefi=b0e0359c-007b-4361-a0d1-a7ca2d73fe3c
+echo -e "$part_uuid_uefi\tuefi\t$size_uefi\t0\t$efi_partition\tEFI" >> "$partitions"
+
+truncate -s 5G "$root_partition"
+make_reproducible_ext4 -t 11111111 -l ROOT "$MYROOT"/sysroot "$root_partition"
+size_rootfs=$(du -b "$root_partition" | awk '{ padded_size = $1 + (MB - ($1 % MB) % MB); print (padded_size / MB) }' "MB=1048576")
+part_uuid_rootfs=a9bef950-8218-4888-9f1c-1ad8bb481807
+echo -e "$part_uuid_rootfs\tlinux\t$size_rootfs\t0\t$root_partition\tROOT" >> "$partitions"
+
+makedisk $rootfs_work "$output" < "$partitions"

debian/features/ostreeImage/info.yaml

@@ -0,0 +1,2 @@
+description: 'image-based system using OSTree'
+type: platform

debian/features/ostreeImage/pkg.include

@@ -0,0 +1 @@
+systemd-boot

debian/features/ostreeRepo/exec.config

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+systemctl enable systemd-networkd
+systemctl enable systemd-resolved