deploy-disk.sh had its own hardcoded tool check that was out of sync with
check-host-deps.sh, so builds got past the host gate and then failed at
deploy time with "missing host tool mkfs.btrfs" (btrfs-progs was never in
check-host-deps.sh).
- check-host-deps.sh: add mkfs.btrfs/btrfs (btrfs-progs) plus curl/git so
`make deps` / check-host-deps --install covers the entire build + deploy
path in one go.
- deploy-disk.sh: pre-flight now checks the full tool set (sgdisk,
partprobe, mkfs.btrfs, btrfs, rsync, wipefs, truncate, + mkfs.vfat for
efi) and reports ALL missing tools at once with the exact apt install
command, instead of dying on the first one.
- build-live.sh: the live image explicitly installs gdisk, parted,
dosfstools, btrfs-progs, rsync so the graphical installer always has the
deploy tooling regardless of edition.
The installer failed with:
deploy-disk.sh /dev/vda ... workstation --boot
error: --boot must be bios|efi (got --boot)
Two bugs:
1. deploy-disk.sh treated $4 as the bare boot value, but every caller
(installer, build-image.sh, install.sh) passes "--boot <val>", so $4
was the literal "--boot". It now parses "--boot <bios|efi>", accepts a
bare positional too, and falls back to the BOOT build variable. This
also fixes build-image.sh / install.sh, which had the same mismatch.
2. installer/arcline-installer built the boot ComboBox with append(id,text)
arguments swapped, so get_active_id() returned "UEFI (grub-efi-amd64)"
instead of "efi". Fixed the id/text order.
Xorg failed to start with:
(EE) xf86OpenConsole: Cannot open virtual console 1 (Permission denied)
udev leaves console VTs as 620 root:tty — group tty has write-only, so
even a tty-group member can't open /dev/tty1 read+write (display managers
normally get this via logind seat ACLs, which a manually-started X
doesn't have). The session script now chowns the dedicated VT to
liveuser before starting X; the unit already Conflicts with getty@tty1 so
nothing else needs it.
The workstation ISO failed to start X with:
(EE) unrecognized option --allow-root
Debian trixie ships Xorg 21.1.x, which removed --allow-root / -allowRoot
entirely — running the X server as root is no longer supported. The live
session now:
- creates a dedicated unprivileged `liveuser` account (in tty, video,
input, audio groups) in build-live.sh;
- starts Xorg as `liveuser` on vt1 (no -allow-root flag at all);
- grants root display access (xhost +SI:localuser:root);
- still runs the installer itself as root, since deploy-disk.sh needs
root. xinit is no longer used (and dropped from the package list).
The ISO now boots straight into a GTK installer instead of dropping to a
tty. Structure:
- installer/arcline-installer: small GTK3 (Python) frontend that drives
scripts/deploy-disk.sh — pick a disk, choose boot mode, type the device
path to confirm, watch the deploy log, reboot. Pure helper logic is
tested against lsblk (lowercase keys, pseudo-devices filtered).
- scripts/build-live.sh: builds build/rootfs/<edition>-live by cloning the
CLEAN rootfs and layering on live-boot, a minimal X session (Xorg +
openbox), the installer, and the deploy tooling under /usr/lib/arcline
(deploy-disk.sh + btrfs/init.sh + edition fstabs, laid out so the
scripts' own path resolution works unchanged).
- overlays/live/: arcline-installer.service + session script that start
Xorg on vt1 (with -allow-root) and run the installer as the X client.
- build-iso.sh: builds the live rootfs for the squashfs AND stages the
clean rootfs archive into isofiles/install/ — the installer deploys the
clean archive, so what's installed is the hardened system, never the
live session with the installer in it.
- Refactor: ARCLINE_LIVE handling removed from build-rootfs.sh and
configure-system.sh (now lives entirely in build-live.sh).
- validate.sh now checks overlays shell scripts + installer python.
- docs updated (building.md, architecture.md, installer/README.md).
Enabling sddm created the graphical.target.wants symlink but the system
still booted to multi-user (tty), because the default boot target was
never switched. configure-system.sh now sets graphical.target whenever
an enabled service list includes sddm, so the workstation edition boots
straight to the KDE login screen.
BOOT=efi only changed the GRUB inside the rootfs squashfs — grub-mkrescue
builds the ISO bootloader from the build host's GRUB, so an ISO assembled
on a host without the x86_64-efi modules + mtools shipped with NO UEFI
boot entry. Booting that ISO on a UEFI machine showed:
"make sure there is a bootable uefi x64 image"
- check-host-deps.sh now verifies the GRUB module dirs it needs for a
hybrid ISO (/usr/lib/grub/x86_64-efi from grub-efi-amd64-bin,
/usr/lib/grub/i386-pc from grub-pc-bin) and mtools, not just
grub-mkrescue.
- build-iso.sh verifies the finished ISO has both EFI and BIOS boot
entries (xorriso El Torito report) and prints the result; BOOT=efi
builds FAIL if the EFI entry is missing.
- GitLab CI build image gains grub-pc-bin, grub-efi-amd64-bin, mtools.
- docs/building.md: hybrid-ISO burning instructions (dd) and the
"bootable uefi x64 image" troubleshooting path.
The edition package lists installed BOTH grub-pc and grub-efi-amd64
(+ shim-signed). Those provide the same bootloader role and conflict in
apt, so every rootfs build failed with "unable to correct problems, you
have held broken packages".
A rootfs now carries exactly ONE bootloader, chosen by the BOOT variable
(mirroring the existing --boot bios|efi deploy option):
- versions.mk / common.sh: BOOT := bios (bios -> grub-pc,
efi -> grub-efi-amd64 + shim-signed + mokutil), exported via the
Makefile.
- build-rootfs.sh validates BOOT early and injects the matching boot
packages into the apt install; the static package lists no longer
contain any grub package.
- deploy-disk.sh / build-image.sh / install.sh default --boot from the
same BOOT variable, so a rootfs and the artifact deployed from it can
never disagree (BOOT=efi make image-cloud produces a UEFI image).
- mokutil is now installed explicitly in the efi flavour (it was not
pulled in because we install with --no-install-recommends).
- docs updated (building.md knob + rationale, secureboot.md note).
Bookworm became oldstable in July 2026 (standard support ended
2026-07-11). A new distro should be built on the current stable, which
is now Trixie (13.6): newer kernel (6.12 LTS vs 6.1, whose LTS ends Dec
2026), newer systemd/containers/toolchains, KDE 6 for the workstation
edition, and a year of stability behind it (full support until
2028-08-09).
- versions.mk / common.sh: DEBIAN_SUITE bookworm -> trixie, kernel 6.1 -> 6.12
- package list header comments: bookworm -> trixie
- GitLab CI: debian:bookworm -> debian:trixie build images
- docs (architecture, building): base references updated
All packages used across the three editions exist in Trixie unchanged.
check-host-deps (and the build scripts themselves) reported build
dependencies as missing even though the packages were installed. Several
tools — debootstrap, sgdisk, losetup, partprobe, mkfs.vfat, grub-install —
live in /usr/sbin or /sbin, which non-root users and CI runners often
don't have on PATH, so `command -v` failed.
- common.sh now prepends /usr/local/sbin:/usr/sbin:/sbin to PATH, so every
script finds these tools no matter who invokes the build.
- check-host-deps now distinguishes "package not installed" from "installed
but not on PATH" via dpkg-query, so the message tells you exactly what is
wrong instead of a misleading "missing package".
- docs/secureboot.md: MOK workflow (generate, build, enroll).
- docs/building.md: image + install quickstart, new outputs, ARCLINE_SIGN.
- docs/observability.md: vendor .debs are now the primary packaging path.
- docs/editions.md: cloud ships a qcow2; qemu test command.
- docs/architecture.md: full pipeline table incl. deploy/install; the
four follow-up items are now implemented; new "on the horizon" list.
- README: updated feature list, quickstart, and status.
- scripts/secureboot/gen-keys.sh: generates a Machine Owner Key pair
(MOK.priv / MOK.pem / MOK.der) for self-signing the boot chain.
- scripts/secureboot/sign-image.sh: signs kernels and EFI binaries
(already-signed files skipped) with sbsign.
- arcline-mok-enroll.service (+ script): one-time MOK enrollment at first
boot via mokutil; no-ops when no key was shipped.
- build-iso.sh: ARCLINE_SIGN=1 signs the live boot chain and ships the
public MOK in the image. Smoke test now asserts the enroll unit exists.
- toolchain/build-vendor.sh: packages the observability components that
are not in Debian main — grafana (official OSS deb, vendored as-is),
loki + promtail (static binaries from the Loki GitHub release, wrapped
in minimal debs that install the overlays/server configs and systemd
units from toolchain/vendor/). Version-pinned, overridable, and
download failures skip with a warning (never break the OS build).
- configure-system.sh: auto-enables grafana-server/loki/promtail when
their binaries land in the image.
- New `make vendor` target.
- deploy-disk.sh: the shared "write a finished system to a disk" step —
partition (GPT bios/efi) -> btrfs layout via btrfs/init.sh -> rsync
rootfs -> chroot (real fstab, GRUB, hostname). Carries the optional
ARCLINE_SIGN hook; the signing tooling itself lands in a later commit.
- apply-fstab.sh: renders the edition fstab template with real root/efi
UUIDs and drops the swap line.
- build-image.sh: rootfs -> bootable qcow2/raw disk image (sparse file +
loop device + deploy), the cloud edition's primary output.
- install.sh: scripted installer for a real disk, confirmation-gated.
- Makefile: image-<edition> targets (+ minimal variants); build-edition.sh
learns the "image" stage; cloud metadata now ships a disk image.
- check-host-deps.sh / GitLab CI: add gdisk, parted, rsync, dosfstools,
qemu-utils, dpkg, sbsigntool to the build image.
Document the design and how to operate it: architecture, building
(including toolchain-free/minimal builds), hardening guide, editions,
observability, and the toolchain. README ties it together.
Harness that clones the 11 Go tools (arcline-uptime, -check, -audit,
-dns, -vault, -email, -migrate, -billing, -portal, -website, -status)
from git.arcline.it, builds release binaries, and packages each into a
.deb that configure-system installs into the image. Tools that cannot
be fetched or built are skipped without breaking the OS build.
- init.sh: creates the @ / @home / @log / @snapshots subvolume layout
on a target device (the installer step).
- snapshot.sh: scheduled read-only snapshots with pruning, installed as
/usr/local/sbin/arcline-snapshot.
- rollback.sh: safe boot-to-snapshot rollback that refuses to touch the
live @ and promotes a snapshot atomically.
Define the three flagship editions as plain-text manifests:
- server (bastion): production server - observability stack, containers.
- workstation (forge): curated KDE Plasma + dev toolchains.
- cloud (nimbus): cloud kernel, cloud-init, guest agents.
Each manifest carries metadata (services to enable/mask), a package
list, a hardened kernel cmdline, and a btrfs fstab template.
Scaffold the Arcline OS build system ("the wires"): a transparent,
auditable pipeline that turns a Debian bookworm base into hardened OS
images for the server, workstation, and cloud editions.
- Makefile orchestrates everything (make iso-<edition>, check, test,
toolchain, clean); versions.mk is the single source of truth for
versions and paths.
- scripts/ is the plain-bash pipeline: debootstrap -> install packages
-> apply overlays -> in-chroot configure -> live ISO, plus a rootfs
archive along the way.
- ARCLINE_TOOLCHAIN=auto|skip|require controls whether the 11 Go tools
are bundled into an image (auto by default; minimal builds available
via make iso-<edition>-minimal).
- GPL-3.0 licensed, sponsored by Arcline IT LLC.
