feat: scaffold Arcline OS build system
Scaffold the Arcline OS build system ("the wires"): a transparent,
auditable pipeline that turns a Debian bookworm base into hardened OS
images for the server, workstation, and cloud editions.
- Makefile orchestrates everything (make iso-<edition>, check, test,
toolchain, clean); versions.mk is the single source of truth for
versions and paths.
- scripts/ is the plain-bash pipeline: debootstrap -> install packages
-> apply overlays -> in-chroot configure -> live ISO, plus a rootfs
archive along the way.
- ARCLINE_TOOLCHAIN=auto|skip|require controls whether the 11 Go tools
are bundled into an image (auto by default; minimal builds available
via make iso-<edition>-minimal).
- GPL-3.0 licensed, sponsored by Arcline IT LLC.
This commit is contained in:
Blake Ridgway
143
scripts/build-rootfs.sh
Executable file
143
scripts/build-rootfs.sh
Executable file
@@ -0,0 +1,143 @@
|
||||
#!/usr/bin/env bash
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
# Arcline OS — rootfs builder
|
||||
#
|
||||
# scripts/build-rootfs.sh <edition>
|
||||
#
|
||||
# Pipeline:
|
||||
# 1. debootstrap a minimal Debian base
|
||||
# 2. configure apt sources (main + security)
|
||||
# 3. install the edition package set
|
||||
# 4. apply overlays (hardening, configs, service units)
|
||||
# 5. run configure-system.sh inside the chroot
|
||||
# 6. clean and tar the result → build/artifacts/arcline-<edition>-<version>.tar.xz
|
||||
#
|
||||
# Root is required (re-execs under sudo when needed).
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
set -euo pipefail
|
||||
source "$(dirname "${BASH_SOURCE[0]}")/common.sh"
|
||||
|
||||
EDITION="${1:?usage: build-rootfs.sh <edition>}"
|
||||
validate_edition "$EDITION"
|
||||
|
||||
# Re-exec under sudo if we aren't root (debootstrap/chroot/mount need it).
|
||||
require_root "$0" "$@"
|
||||
|
||||
# Fail fast on a bad toolchain policy before debootstrap does any work.
|
||||
case "$ARCLINE_TOOLCHAIN" in
|
||||
auto|skip|require) ;;
|
||||
*) die "ARCLINE_TOOLCHAIN must be auto|skip|require (got '$ARCLINE_TOOLCHAIN')" ;;
|
||||
esac
|
||||
|
||||
EDIR="$(edition_dir "$EDITION")"
|
||||
ROOTFS="$ROOTFS_DIR/$EDITION"
|
||||
ARTIFACT="$ARTIFACT_DIR/arcline-$EDITION-$VERSION-$ARCH.tar.xz"
|
||||
LIVE="${ARCLINE_LIVE:-0}"
|
||||
|
||||
mkdir -p "$ROOTFS_DIR" "$LOG_DIR" "$ARTIFACT_DIR"
|
||||
rm -rf "$ROOTFS" "$ARTIFACT"
|
||||
|
||||
log "═══ building Arcline $EDITION rootfs ($DISTRO_NAME $VERSION) ═══"
|
||||
|
||||
# ── 1. bootstrap ────────────────────────────────────────────────────────────
|
||||
log "[1/6] debootstrap $DEBIAN_SUITE ($ARCH)"
|
||||
debootstrap \
|
||||
--arch="$ARCH" \
|
||||
--variant=minbase \
|
||||
--include=apt-transport-https,ca-certificates,gnupg,curl \
|
||||
"$DEBIAN_SUITE" "$ROOTFS" "$DEBIAN_MIRROR" \
|
||||
| tee "$LOG_DIR/bootstrap-$EDITION.log"
|
||||
|
||||
# ── 2. apt sources ──────────────────────────────────────────────────────────
|
||||
log "[2/6] configuring apt sources"
|
||||
cat > "$ROOTFS/etc/apt/sources.list" <<EOF
|
||||
deb $DEBIAN_MIRROR $DEBIAN_SUITE main contrib non-free-firmware
|
||||
deb $DEBIAN_MIRROR $DEBIAN_SUITE-updates main contrib non-free-firmware
|
||||
deb $SECURITY_MIRROR $DEBIAN_SUITE-security main contrib non-free-firmware
|
||||
EOF
|
||||
|
||||
# ── chroot helpers (bind-mount pseudo-fs, run in chroot, unmount on exit) ──
|
||||
mount_pseudo() {
|
||||
mount --bind /dev "$ROOTFS/dev"
|
||||
mount --bind /proc "$ROOTFS/proc"
|
||||
mount --bind /sys "$ROOTFS/sys"
|
||||
mount --bind /dev/pts "$ROOTFS/dev/pts" 2>/dev/null || true
|
||||
}
|
||||
unmount_pseudo() {
|
||||
umount -l "$ROOTFS/dev/pts" 2>/dev/null || true
|
||||
umount -l "$ROOTFS/sys" 2>/dev/null || true
|
||||
umount -l "$ROOTFS/proc" 2>/dev/null || true
|
||||
umount -l "$ROOTFS/dev" 2>/dev/null || true
|
||||
}
|
||||
trap 'unmount_pseudo' EXIT
|
||||
chroot_run() { chroot "$ROOTFS" /bin/bash -c "$*"; }
|
||||
|
||||
# ── 3. install edition packages ─────────────────────────────────────────────
|
||||
log "[3/6] installing edition packages (${EDITION})"
|
||||
PKGS="$(grep -vE '^\s*(#|$)' "$EDIR/packages.list" | tr '\n' ' ')"
|
||||
mount_pseudo
|
||||
chroot_run "export DEBIAN_FRONTEND=noninteractive; apt-get update -qq && apt-get install -y --no-install-recommends $PKGS" \
|
||||
| tee "$LOG_DIR/packages-$EDITION.log"
|
||||
unmount_pseudo
|
||||
|
||||
# ── 4. overlays ─────────────────────────────────────────────────────────────
|
||||
log "[4/6] applying overlays"
|
||||
"$ROOT/scripts/apply-overlays.sh" "$ROOTFS" "$EDITION"
|
||||
|
||||
# copy btrfs snapshot/rollback tooling into the image
|
||||
install -Dm0755 "$ROOT/btrfs/snapshot.sh" "$ROOTFS/usr/local/sbin/arcline-snapshot"
|
||||
install -Dm0755 "$ROOT/btrfs/rollback.sh" "$ROOTFS/usr/local/sbin/arcline-rollback"
|
||||
|
||||
# ── 5. configure system in chroot ───────────────────────────────────────────
|
||||
log "[5/6] configuring system in chroot"
|
||||
install -m0755 "$ROOT/scripts/configure-system.sh" "$ROOTFS/root/configure-system.sh"
|
||||
# Stage the edition manifest INSIDE the chroot (the hook runs in there and
|
||||
# cannot see host paths).
|
||||
mkdir -p "$ROOTFS/root/arcline-edition"
|
||||
cp "$EDIR/kernel.cmdline" "$EDIR/metadata.yaml" "$ROOTFS/root/arcline-edition/"
|
||||
|
||||
# Toolchain policy — the Arcline tools are optional in an image build. See
|
||||
# ARCLINE_TOOLCHAIN in scripts/common.sh (auto | skip | require).
|
||||
HAVE_DEBS=0
|
||||
if [[ -d "$DEB_DIR" ]] && ls "$DEB_DIR"/*.deb >/dev/null 2>&1; then
|
||||
HAVE_DEBS=1
|
||||
fi
|
||||
case "$ARCLINE_TOOLCHAIN" in
|
||||
require)
|
||||
[[ $HAVE_DEBS -eq 1 ]] || die "ARCLINE_TOOLCHAIN=require but no .deb files in $DEB_DIR (run: make toolchain)"
|
||||
mkdir -p "$ROOTFS/arcline-debs"
|
||||
cp "$DEB_DIR"/*.deb "$ROOTFS/arcline-debs/"
|
||||
log "toolchain: staging $(ls "$DEB_DIR"/*.deb | wc -l) packages (required)"
|
||||
;;
|
||||
skip)
|
||||
log "toolchain: skipped (ARCLINE_TOOLCHAIN=skip) — building without Arcline tools"
|
||||
;;
|
||||
auto)
|
||||
if [[ $HAVE_DEBS -eq 1 ]]; then
|
||||
mkdir -p "$ROOTFS/arcline-debs"
|
||||
cp "$DEB_DIR"/*.deb "$ROOTFS/arcline-debs/"
|
||||
log "toolchain: staging $(ls "$DEB_DIR"/*.deb | wc -l) packages"
|
||||
else
|
||||
warn "no toolchain .debs in $DEB_DIR — building WITHOUT Arcline tools (run: make toolchain)"
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
die "ARCLINE_TOOLCHAIN must be auto|skip|require (got '$ARCLINE_TOOLCHAIN')"
|
||||
;;
|
||||
esac
|
||||
|
||||
mount_pseudo
|
||||
chroot_run "ARCLINE_EDITION_DIR='/root/arcline-edition' ARCLINE_LIVE='$LIVE' ARCLINE_LOCK_ROOT='${ARCLINE_LOCK_ROOT:-0}' ARCLINE_EXTRA_REPOS='${ARCLINE_EXTRA_REPOS:-0}' /root/configure-system.sh '$EDITION'"
|
||||
rm -f "$ROOTFS/root/configure-system.sh"
|
||||
rm -rf "$ROOTFS/root/arcline-edition" "$ROOTFS/arcline-debs"
|
||||
unmount_pseudo
|
||||
|
||||
# ── 6. clean + archive ──────────────────────────────────────────────────────
|
||||
log "[6/6] cleaning and archiving"
|
||||
chroot_run "apt-get clean 2>/dev/null; rm -rf /var/lib/apt/lists/* /var/cache/apt/* /tmp/* /root/.bash_history"
|
||||
rm -f "$ROOTFS/etc/machine-id"
|
||||
: > "$ROOTFS/etc/machine-id"
|
||||
|
||||
tar -C "$ROOTFS" -cJf "$ARTIFACT" .
|
||||
log "rootfs artifact: $ARTIFACT"
|
||||
sha256sum "$ARTIFACT" | tee "$ARTIFACT.sha256"
|
||||
Reference in New Issue
Block a user