14e5ea9e1e
Scaffold the Arcline OS build system ("the wires"): a transparent,
auditable pipeline that turns a Debian bookworm base into hardened OS
images for the server, workstation, and cloud editions.
- Makefile orchestrates everything (make iso-<edition>, check, test,
toolchain, clean); versions.mk is the single source of truth for
versions and paths.
- scripts/ is the plain-bash pipeline: debootstrap -> install packages
-> apply overlays -> in-chroot configure -> live ISO, plus a rootfs
archive along the way.
- ARCLINE_TOOLCHAIN=auto|skip|require controls whether the 11 Go tools
are bundled into an image (auto by default; minimal builds available
via make iso-<edition>-minimal).
- GPL-3.0 licensed, sponsored by Arcline IT LLC.
144 lines
6.6 KiB
Bash
Executable File
144 lines
6.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Arcline OS — rootfs builder
|
|
#
|
|
# scripts/build-rootfs.sh <edition>
|
|
#
|
|
# Pipeline:
|
|
# 1. debootstrap a minimal Debian base
|
|
# 2. configure apt sources (main + security)
|
|
# 3. install the edition package set
|
|
# 4. apply overlays (hardening, configs, service units)
|
|
# 5. run configure-system.sh inside the chroot
|
|
# 6. clean and tar the result → build/artifacts/arcline-<edition>-<version>.tar.xz
|
|
#
|
|
# Root is required (re-execs under sudo when needed).
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
set -euo pipefail
|
|
source "$(dirname "${BASH_SOURCE[0]}")/common.sh"
|
|
|
|
EDITION="${1:?usage: build-rootfs.sh <edition>}"
|
|
validate_edition "$EDITION"
|
|
|
|
# Re-exec under sudo if we aren't root (debootstrap/chroot/mount need it).
|
|
require_root "$0" "$@"
|
|
|
|
# Fail fast on a bad toolchain policy before debootstrap does any work.
|
|
case "$ARCLINE_TOOLCHAIN" in
|
|
auto|skip|require) ;;
|
|
*) die "ARCLINE_TOOLCHAIN must be auto|skip|require (got '$ARCLINE_TOOLCHAIN')" ;;
|
|
esac
|
|
|
|
EDIR="$(edition_dir "$EDITION")"
|
|
ROOTFS="$ROOTFS_DIR/$EDITION"
|
|
ARTIFACT="$ARTIFACT_DIR/arcline-$EDITION-$VERSION-$ARCH.tar.xz"
|
|
LIVE="${ARCLINE_LIVE:-0}"
|
|
|
|
mkdir -p "$ROOTFS_DIR" "$LOG_DIR" "$ARTIFACT_DIR"
|
|
rm -rf "$ROOTFS" "$ARTIFACT"
|
|
|
|
log "═══ building Arcline $EDITION rootfs ($DISTRO_NAME $VERSION) ═══"
|
|
|
|
# ── 1. bootstrap ────────────────────────────────────────────────────────────
|
|
log "[1/6] debootstrap $DEBIAN_SUITE ($ARCH)"
|
|
debootstrap \
|
|
--arch="$ARCH" \
|
|
--variant=minbase \
|
|
--include=apt-transport-https,ca-certificates,gnupg,curl \
|
|
"$DEBIAN_SUITE" "$ROOTFS" "$DEBIAN_MIRROR" \
|
|
| tee "$LOG_DIR/bootstrap-$EDITION.log"
|
|
|
|
# ── 2. apt sources ──────────────────────────────────────────────────────────
|
|
log "[2/6] configuring apt sources"
|
|
cat > "$ROOTFS/etc/apt/sources.list" <<EOF
|
|
deb $DEBIAN_MIRROR $DEBIAN_SUITE main contrib non-free-firmware
|
|
deb $DEBIAN_MIRROR $DEBIAN_SUITE-updates main contrib non-free-firmware
|
|
deb $SECURITY_MIRROR $DEBIAN_SUITE-security main contrib non-free-firmware
|
|
EOF
|
|
|
|
# ── chroot helpers (bind-mount pseudo-fs, run in chroot, unmount on exit) ──
|
|
mount_pseudo() {
|
|
mount --bind /dev "$ROOTFS/dev"
|
|
mount --bind /proc "$ROOTFS/proc"
|
|
mount --bind /sys "$ROOTFS/sys"
|
|
mount --bind /dev/pts "$ROOTFS/dev/pts" 2>/dev/null || true
|
|
}
|
|
unmount_pseudo() {
|
|
umount -l "$ROOTFS/dev/pts" 2>/dev/null || true
|
|
umount -l "$ROOTFS/sys" 2>/dev/null || true
|
|
umount -l "$ROOTFS/proc" 2>/dev/null || true
|
|
umount -l "$ROOTFS/dev" 2>/dev/null || true
|
|
}
|
|
trap 'unmount_pseudo' EXIT
|
|
chroot_run() { chroot "$ROOTFS" /bin/bash -c "$*"; }
|
|
|
|
# ── 3. install edition packages ─────────────────────────────────────────────
|
|
log "[3/6] installing edition packages (${EDITION})"
|
|
PKGS="$(grep -vE '^\s*(#|$)' "$EDIR/packages.list" | tr '\n' ' ')"
|
|
mount_pseudo
|
|
chroot_run "export DEBIAN_FRONTEND=noninteractive; apt-get update -qq && apt-get install -y --no-install-recommends $PKGS" \
|
|
| tee "$LOG_DIR/packages-$EDITION.log"
|
|
unmount_pseudo
|
|
|
|
# ── 4. overlays ─────────────────────────────────────────────────────────────
|
|
log "[4/6] applying overlays"
|
|
"$ROOT/scripts/apply-overlays.sh" "$ROOTFS" "$EDITION"
|
|
|
|
# copy btrfs snapshot/rollback tooling into the image
|
|
install -Dm0755 "$ROOT/btrfs/snapshot.sh" "$ROOTFS/usr/local/sbin/arcline-snapshot"
|
|
install -Dm0755 "$ROOT/btrfs/rollback.sh" "$ROOTFS/usr/local/sbin/arcline-rollback"
|
|
|
|
# ── 5. configure system in chroot ───────────────────────────────────────────
|
|
log "[5/6] configuring system in chroot"
|
|
install -m0755 "$ROOT/scripts/configure-system.sh" "$ROOTFS/root/configure-system.sh"
|
|
# Stage the edition manifest INSIDE the chroot (the hook runs in there and
|
|
# cannot see host paths).
|
|
mkdir -p "$ROOTFS/root/arcline-edition"
|
|
cp "$EDIR/kernel.cmdline" "$EDIR/metadata.yaml" "$ROOTFS/root/arcline-edition/"
|
|
|
|
# Toolchain policy — the Arcline tools are optional in an image build. See
|
|
# ARCLINE_TOOLCHAIN in scripts/common.sh (auto | skip | require).
|
|
HAVE_DEBS=0
|
|
if [[ -d "$DEB_DIR" ]] && ls "$DEB_DIR"/*.deb >/dev/null 2>&1; then
|
|
HAVE_DEBS=1
|
|
fi
|
|
case "$ARCLINE_TOOLCHAIN" in
|
|
require)
|
|
[[ $HAVE_DEBS -eq 1 ]] || die "ARCLINE_TOOLCHAIN=require but no .deb files in $DEB_DIR (run: make toolchain)"
|
|
mkdir -p "$ROOTFS/arcline-debs"
|
|
cp "$DEB_DIR"/*.deb "$ROOTFS/arcline-debs/"
|
|
log "toolchain: staging $(ls "$DEB_DIR"/*.deb | wc -l) packages (required)"
|
|
;;
|
|
skip)
|
|
log "toolchain: skipped (ARCLINE_TOOLCHAIN=skip) — building without Arcline tools"
|
|
;;
|
|
auto)
|
|
if [[ $HAVE_DEBS -eq 1 ]]; then
|
|
mkdir -p "$ROOTFS/arcline-debs"
|
|
cp "$DEB_DIR"/*.deb "$ROOTFS/arcline-debs/"
|
|
log "toolchain: staging $(ls "$DEB_DIR"/*.deb | wc -l) packages"
|
|
else
|
|
warn "no toolchain .debs in $DEB_DIR — building WITHOUT Arcline tools (run: make toolchain)"
|
|
fi
|
|
;;
|
|
*)
|
|
die "ARCLINE_TOOLCHAIN must be auto|skip|require (got '$ARCLINE_TOOLCHAIN')"
|
|
;;
|
|
esac
|
|
|
|
mount_pseudo
|
|
chroot_run "ARCLINE_EDITION_DIR='/root/arcline-edition' ARCLINE_LIVE='$LIVE' ARCLINE_LOCK_ROOT='${ARCLINE_LOCK_ROOT:-0}' ARCLINE_EXTRA_REPOS='${ARCLINE_EXTRA_REPOS:-0}' /root/configure-system.sh '$EDITION'"
|
|
rm -f "$ROOTFS/root/configure-system.sh"
|
|
rm -rf "$ROOTFS/root/arcline-edition" "$ROOTFS/arcline-debs"
|
|
unmount_pseudo
|
|
|
|
# ── 6. clean + archive ──────────────────────────────────────────────────────
|
|
log "[6/6] cleaning and archiving"
|
|
chroot_run "apt-get clean 2>/dev/null; rm -rf /var/lib/apt/lists/* /var/cache/apt/* /tmp/* /root/.bash_history"
|
|
rm -f "$ROOTFS/etc/machine-id"
|
|
: > "$ROOTFS/etc/machine-id"
|
|
|
|
tar -C "$ROOTFS" -cJf "$ARTIFACT" .
|
|
log "rootfs artifact: $ARTIFACT"
|
|
sha256sum "$ARTIFACT" | tee "$ARTIFACT.sha256"
|