refactor(os): colocate mkosi component definitions

kvinwang · kvinwang · commit 8500c94f8057 · 2026-07-22T22:21:57.000-07:00
diff --git a/os/mkosi/README.md b/os/mkosi/README.md
@@ -61,13 +61,21 @@ DSTACK_DEV_CACHE_DIR="$HOME/.cache/dstack/mkosi-dev" \
 The cache covers dstack Rust, the container stack, Sysbox, nvattest, the
 kernel build tree, NVIDIA, ZFS and both OVMF variants. Its key conservatively
 includes the inputs, tools, packages and component dependencies declared by
-each file in `components/`, plus architecture, flavor and
+each descriptor in `components/<name>/<name>.sh`, plus architecture, flavor and
 `SOURCE_DATE_EPOCH`. `build-components.sh` is intentionally only the ordered
 component list. Component install trees are merged with strict non-directory
 conflict detection. `image` and `repro-check` never pass the development-cache
 option. Release artifacts, Debian rootfs, dm-verity data and measurements are
 never cached.
 
+mkosi's `Incremental=`, `CacheDirectory=` and `BuildDirectory=` cover
+whole-image/rootfs and persistent-work-directory reuse; they do not provide
+independently keyed output trees for components or reject file collisions when
+those trees are installed. The small component layer only supplies those two
+missing policies. Source download, build, cache-key inputs and output ownership
+remain together under `components/<name>/`; production builds bypass the layer's
+archive cache completely.
+
 On a 16-job development host, a clean production work directory takes about
 17 minutes (measured 16m45s); allow 20--30 minutes with cold compiler and
 network caches. `repro-check` performs two such builds sequentially.
@@ -84,7 +92,7 @@ OVMF and UKI. Debian supplies the base userspace while the parity checker
 requires the Yocto-visible binaries, services, configuration, kernel modules
 and production/development separation before assembly is allowed to proceed.
 
-The firmware is not Debian's generic OVMF: `build-ovmf.sh` builds the same
+The firmware is not Debian's generic OVMF: `components/ovmf/ovmf-build.sh` builds the same
 EDK2 stable-202502 revision and `pre202505` TDX measurement layout selected by
 the Yocto recipe. A generic OVMF cannot be substituted because `dstack-mr`
 would produce invalid or unparseable TDX measurement material.
diff --git a/os/mkosi/components/container-stack/container-stack-build.sh b/os/mkosi/components/container-stack/container-stack-build.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: Apache-2.0
 set -euo pipefail
-ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)
 SELF="$ROOT/os/mkosi"
 # shellcheck source=/dev/null
 source "$SELF/versions.env"
@@ -30,7 +30,7 @@ fetch_sha256() {
 lnc="$BUILD_DIR/libnvidia-container"
 checkout https://github.com/NVIDIA/libnvidia-container.git "$LIBNVIDIA_CONTAINER_REVISION" "$lnc"
 patch -d "$lnc" -p1 --fuzz=0 < \
-  "$SELF/patches/libnvidia-container/0001-omit-prefix-map-from-build-flags.patch"
+  "$SELF/components/container-stack/patches/0001-omit-prefix-map-from-build-flags.patch"
 export CFLAGS="${CFLAGS:-} -O2 -g0 -ffile-prefix-map=$BUILD_DIR=/usr/src/container-stack -fmacro-prefix-map=$BUILD_DIR=/usr/src/container-stack"
 export LDFLAGS="${LDFLAGS:-} -Wl,--build-id=none"
 export CGO_CFLAGS="$CFLAGS"
diff --git a/os/mkosi/components/container-stack/container-stack.sh b/os/mkosi/components/container-stack/container-stack.sh
@@ -9,15 +9,15 @@ component_cache_key() {
     key_value "$NVIDIA_CONTAINER_TOOLKIT_REVISION" "$LIBNVIDIA_CONTAINER_REVISION" \
       "$NERDCTL_VERSION" "$NERDCTL_SHA256" "$CNI_VERSION" "$CNI_SHA256" \
       "$STARGZ_VERSION" "$STARGZ_SHA256"
-    key_file "$SELF/scripts/build-container-stack.sh" \
-      "$SELF/patches/libnvidia-container/0001-omit-prefix-map-from-build-flags.patch"
+    key_file "$COMPONENT_PATH/container-stack-build.sh" \
+      "$COMPONENT_PATH/patches/0001-omit-prefix-map-from-build-flags.patch"
     key_tree os/yocto/layers/meta-nvidia/recipes-graphics/nvidia-container-toolkit \
       os/yocto/layers/meta-dstack/recipes-containers
     key_tools gcc go
     key_packages libelf-dev libtirpc-dev
 }
 
 component_build() {
-    "$SELF/scripts/build-container-stack.sh" "$WORK/container-stack-build" \
+    "$COMPONENT_PATH/container-stack-build.sh" "$WORK/container-stack-build" \
       "$WORK/component-stages/container-stack"
 }
diff --git a/os/mkosi/components/container-stack/patches/0001-omit-prefix-map-from-build-flags.patch b/os/mkosi/components/container-stack/patches/0001-omit-prefix-map-from-build-flags.patch
diff --git a/os/mkosi/components/dstack-rust/dstack-rust-build.sh b/os/mkosi/components/dstack-rust/dstack-rust-build.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: Apache-2.0
 set -euo pipefail
-ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)
 DEST=${1:?staging tree required}
 DEST=$(realpath -m "$DEST")
 FLAVOR=${2:-prod}
diff --git a/os/mkosi/components/dstack-rust/dstack-rust.sh b/os/mkosi/components/dstack-rust/dstack-rust.sh
@@ -6,11 +6,11 @@ COMPONENT_ROOTFS_TREES=(component-stages/dstack-rust)
 COMPONENT_KERNEL_TREES=()
 
 component_cache_key() {
-    key_file "$SELF/scripts/stage-rootfs.sh"
+    key_file "$COMPONENT_PATH/dstack-rust-build.sh"
     key_tree dstack os/common/rootfs
     key_tools rustc cargo
 }
 
 component_build() {
-    "$SELF/scripts/stage-rootfs.sh" "$WORK/component-stages/dstack-rust" "$FLAVOR"
+    "$COMPONENT_PATH/dstack-rust-build.sh" "$WORK/component-stages/dstack-rust" "$FLAVOR"
 }
diff --git a/os/mkosi/components/kernel/kernel-build.sh b/os/mkosi/components/kernel/kernel-build.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: Apache-2.0
 set -euo pipefail
-ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)
 MKOSI_DIR="$ROOT/os/mkosi"
 # shellcheck source=/dev/null
 source "$MKOSI_DIR/versions.env"
@@ -58,7 +58,7 @@ done
 
 make -C "$src" O="$BUILD_DIR/kernel-build" PAHOLE="$pahole_wrapper" x86_64_defconfig
 "$src/scripts/kconfig/merge_config.sh" -m -O "$BUILD_DIR/kernel-build" \
-    "$BUILD_DIR/kernel-build/.config" "$MKOSI_DIR/kernel.config"
+    "$BUILD_DIR/kernel-build/.config" "$MKOSI_DIR/components/kernel/kernel.config"
 make -C "$src" O="$BUILD_DIR/kernel-build" PAHOLE="$pahole_wrapper" olddefconfig
 "$MKOSI_DIR/scripts/check-kernel-config.sh" "$BUILD_DIR/kernel-build/.config"
 make -C "$src" O="$BUILD_DIR/kernel-build" PAHOLE="$pahole_wrapper" -j"$JOBS" bzImage modules
diff --git a/os/mkosi/components/kernel/kernel.config b/os/mkosi/components/kernel/kernel.config
diff --git a/os/mkosi/components/kernel/kernel.sh b/os/mkosi/components/kernel/kernel.sh
@@ -7,13 +7,13 @@ COMPONENT_KERNEL_TREES=(component-stages/kernel)
 
 component_cache_key() {
     key_value "$KERNEL_VERSION" "$KERNEL_SHA256"
-    key_file "$SELF/scripts/build-kernel.sh" "$SELF/kernel.config" \
+    key_file "$COMPONENT_PATH/kernel-build.sh" "$COMPONENT_PATH/kernel.config" \
       "$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0001-x86-tdx-select-dma-direct-remap.patch" \
       "$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0002-acpi-sandbox-block-aml-systemmemory-ram-access.patch"
     key_tools gcc ld make pahole
     key_packages binutils dwarves bc bison flex libssl-dev libelf-dev
 }
 
 component_build() {
-    "$SELF/scripts/build-kernel.sh" "$WORK" "$WORK/component-stages/kernel"
+    "$COMPONENT_PATH/kernel-build.sh" "$WORK" "$WORK/component-stages/kernel"
 }
diff --git a/os/mkosi/components/nvattest/nvattest-build.sh b/os/mkosi/components/nvattest/nvattest-build.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: Apache-2.0
 set -euo pipefail
-ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)
 SELF="$ROOT/os/mkosi"
 # shellcheck source=/dev/null
 source "$SELF/versions.env"
@@ -35,7 +35,7 @@ cp -a "$checkout" "$src"
 patch -d "$src" -p1 --fuzz=0 < \
   "$ROOT/os/yocto/layers/meta-nvidia/recipes-graphics/nvattest/files/0001-validate-ocsp-response-freshness.patch"
 patch -d "$src" -p1 --fuzz=0 < \
-  "$SELF/patches/nvattest/0001-pin-fetchcontent-inputs.patch"
+  "$SELF/components/nvattest/patches/0001-pin-fetchcontent-inputs.patch"
 
 rm -rf "$build"
 export CFLAGS="${CFLAGS:-} -O2 -g0 -ffile-prefix-map=$canonical=/usr/src/nvattest -fmacro-prefix-map=$canonical=/usr/src/nvattest"
diff --git a/os/mkosi/components/nvattest/nvattest.sh b/os/mkosi/components/nvattest/nvattest.sh
@@ -7,14 +7,14 @@ COMPONENT_KERNEL_TREES=()
 
 component_cache_key() {
     key_value "$NVATTEST_VERSION" "$NVATTEST_REVISION"
-    key_file "$SELF/scripts/build-nvattest.sh"
+    key_file "$COMPONENT_PATH/nvattest-build.sh"
     key_tree os/mkosi/patches/nvattest \
       os/yocto/layers/meta-nvidia/recipes-graphics/nvattest
     key_tools gcc cmake ninja rustc cargo
     key_packages libssl-dev libcurl4-openssl-dev
 }
 
 component_build() {
-    "$SELF/scripts/build-nvattest.sh" "$WORK/nvattest-build" \
+    "$COMPONENT_PATH/nvattest-build.sh" "$WORK/nvattest-build" \
       "$WORK/component-stages/nvattest"
 }
diff --git a/os/mkosi/components/nvattest/patches/0001-pin-fetchcontent-inputs.patch b/os/mkosi/components/nvattest/patches/0001-pin-fetchcontent-inputs.patch
diff --git a/os/mkosi/components/nvidia/nvidia-build.sh b/os/mkosi/components/nvidia/nvidia-build.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: Apache-2.0
 set -euo pipefail
-ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)
 SELF="$ROOT/os/mkosi"
 # shellcheck source=/dev/null
 source "$SELF/versions.env"
@@ -31,7 +31,7 @@ fetch_sha256 "https://us.download.nvidia.com/tesla/$NVIDIA_VERSION/NVIDIA-Linux-
 rm -rf "$src"
 chmod +x "$run"
 "$run" -x --target "$src" >/dev/null
-patch -d "$src" -p1 --fuzz=0 < "$SELF/patches/nvidia/0001-linux-7.1-drop-legacy-of-gpio-api.patch"
+patch -d "$src" -p1 --fuzz=0 < "$SELF/components/nvidia/patches/0001-linux-7.1-drop-legacy-of-gpio-api.patch"
 module_map="-fdebug-prefix-map=$BUILD_DIR=/usr/src/nvidia -fmacro-prefix-map=$BUILD_DIR=/usr/src/nvidia -fdebug-prefix-map=$KERNEL_SRC=/usr/src/linux -fmacro-prefix-map=$KERNEL_SRC=/usr/src/linux -fdebug-prefix-map=$KERNEL_BUILD=/usr/src/linux-build -fmacro-prefix-map=$KERNEL_BUILD=/usr/src/linux-build"
 # Linux 7.1's gen-btf.sh cannot execute its space-containing PAHOLE wrapper
 # for external modules (the awk program is passed with literal quotes). Keep
diff --git a/os/mkosi/components/nvidia/nvidia.sh b/os/mkosi/components/nvidia/nvidia.sh
@@ -9,14 +9,14 @@ component_cache_key() {
     key_dependency kernel
     key_value "$NVIDIA_VERSION" "$NVIDIA_RUN_SHA256" \
       "$NVIDIA_FABRICMANAGER_SHA256" "$NVIDIA_NSCQ_SHA256"
-    key_file "$SELF/scripts/build-nvidia.sh" \
-      "$SELF/patches/nvidia/0001-linux-7.1-drop-legacy-of-gpio-api.patch"
+    key_file "$COMPONENT_PATH/nvidia-build.sh" \
+      "$COMPONENT_PATH/patches/0001-linux-7.1-drop-legacy-of-gpio-api.patch"
     key_tree os/yocto/layers/meta-nvidia/recipes-graphics/nvidia
     key_tools gcc make
 }
 
 component_build() {
-    "$SELF/scripts/build-nvidia.sh" "$WORK/nvidia-build" \
+    "$COMPONENT_PATH/nvidia-build.sh" "$WORK/nvidia-build" \
       "$WORK/linux-$KERNEL_VERSION" "$WORK/kernel-build" \
       "$WORK/component-stages/nvidia-root" "$WORK/component-stages/nvidia-kernel"
 }
diff --git a/os/mkosi/components/nvidia/patches/0001-linux-7.1-drop-legacy-of-gpio-api.patch b/os/mkosi/components/nvidia/patches/0001-linux-7.1-drop-legacy-of-gpio-api.patch
diff --git a/os/mkosi/components/ovmf/ovmf-build.sh b/os/mkosi/components/ovmf/ovmf-build.sh
@@ -3,7 +3,7 @@
 # Build the same pinned Intel TDX OVMF generation consumed by dstack-mr. A
 # stock distro OVMF is not compatible with dstack's TDX measurement format.
 set -euo pipefail
-ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)
 BUILD_DIR=${1:?build directory required}
 OUT=${2:?output file required}
 SEV_OUT=${3:?SEV output file required}
diff --git a/os/mkosi/components/ovmf/ovmf.sh b/os/mkosi/components/ovmf/ovmf.sh
@@ -6,15 +6,15 @@ COMPONENT_ROOTFS_TREES=()
 COMPONENT_KERNEL_TREES=(component-stages/ovmf)
 
 component_cache_key() {
-    key_file "$SELF/scripts/build-ovmf.sh" \
+    key_file "$COMPONENT_PATH/ovmf-build.sh" \
       "$ROOT/os/yocto/layers/meta-dstack/recipes-core/dstack-ovmf/dstack-ovmf/0004-Reproduciable.patch"
     key_tools gcc make python3
     key_packages nasm acpica-tools uuid-dev
 }
 
 component_build() {
     mkdir -p "$WORK/component-stages/ovmf"
-    "$SELF/scripts/build-ovmf.sh" "$WORK/ovmf-build" \
+    "$COMPONENT_PATH/ovmf-build.sh" "$WORK/ovmf-build" \
       "$WORK/component-stages/ovmf/ovmf.fd" \
       "$WORK/component-stages/ovmf/ovmf-sev.fd"
 }
diff --git a/os/mkosi/components/sysbox/sysbox-build.sh b/os/mkosi/components/sysbox/sysbox-build.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: Apache-2.0
 set -euo pipefail
-ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)
 SELF="$ROOT/os/mkosi"
 # shellcheck source=/dev/null
 source "$SELF/versions.env"
diff --git a/os/mkosi/components/sysbox/sysbox.sh b/os/mkosi/components/sysbox/sysbox.sh
@@ -9,13 +9,13 @@ component_cache_key() {
     key_value "$SYSBOX_VERSION" "$SYSBOX_REVISION" "$SYSBOX_RUNC_REVISION" \
       "$SYSBOX_FS_REVISION" "$SYSBOX_MGR_REVISION" "$SYSBOX_IPC_REVISION" \
       "$SYSBOX_LIBS_REVISION" "$SYSBOX_FUSE_REVISION"
-    key_file "$SELF/scripts/build-sysbox.sh"
+    key_file "$COMPONENT_PATH/sysbox-build.sh"
     key_tree os/yocto/layers/meta-dstack/recipes-core/dstack-sysbox
     key_tools go
     key_packages libseccomp-dev
 }
 
 component_build() {
-    "$SELF/scripts/build-sysbox.sh" "$WORK/sysbox-build" \
+    "$COMPONENT_PATH/sysbox-build.sh" "$WORK/sysbox-build" \
       "$WORK/component-stages/sysbox"
 }
diff --git a/os/mkosi/components/zfs/patches/0001-linux-6.19-7.1-compat.patch b/os/mkosi/components/zfs/patches/0001-linux-6.19-7.1-compat.patch
diff --git a/os/mkosi/components/zfs/zfs-build.sh b/os/mkosi/components/zfs/zfs-build.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: Apache-2.0
 set -euo pipefail
-ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)
 SELF="$ROOT/os/mkosi"
 # shellcheck source=/dev/null
 source "$SELF/versions.env"
@@ -21,7 +21,7 @@ git -C "$src" fetch -q --depth=1 origin "$ZFS_REVISION"
 git -C "$src" checkout -q --detach FETCH_HEAD
 git -C "$src" reset -q --hard "$ZFS_REVISION"
 git -C "$src" clean -qfdx
-patch -d "$src" -p1 --fuzz=0 < "$SELF/patches/zfs/0001-linux-6.19-7.1-compat.patch"
+patch -d "$src" -p1 --fuzz=0 < "$SELF/components/zfs/patches/0001-linux-6.19-7.1-compat.patch"
 patch -d "$src" -p1 --fuzz=0 < "$ROOT/os/yocto/layers/meta-dstack/recipes-core/dstack-zfs/dstack-zfs/0001-Define-strndupa-if-it-does-not-exist.patch"
 (cd "$src" && ./autogen.sh)
 mkdir -p "$B/build"
diff --git a/os/mkosi/components/zfs/zfs.sh b/os/mkosi/components/zfs/zfs.sh
@@ -8,15 +8,15 @@ COMPONENT_KERNEL_TREES=(component-stages/zfs-kernel)
 component_cache_key() {
     key_dependency kernel
     key_value "$ZFS_VERSION" "$ZFS_REVISION"
-    key_file "$SELF/scripts/build-zfs.sh" \
-      "$SELF/patches/zfs/0001-linux-6.19-7.1-compat.patch" \
+    key_file "$COMPONENT_PATH/zfs-build.sh" \
+      "$COMPONENT_PATH/patches/0001-linux-6.19-7.1-compat.patch" \
       "$ROOT/os/yocto/layers/meta-dstack/recipes-core/dstack-zfs/dstack-zfs/0001-Define-strndupa-if-it-does-not-exist.patch"
     key_tools gcc make autoconf automake
     key_packages libssl-dev libelf-dev zlib1g-dev libtool uuid-dev
 }
 
 component_build() {
-    "$SELF/scripts/build-zfs.sh" "$WORK/zfs-build" \
+    "$COMPONENT_PATH/zfs-build.sh" "$WORK/zfs-build" \
       "$WORK/linux-$KERNEL_VERSION" "$WORK/kernel-build" \
       "$WORK/component-stages/zfs-root" "$WORK/component-stages/zfs-kernel"
 }
diff --git a/os/mkosi/scripts/check-kernel-config.sh b/os/mkosi/scripts/check-kernel-config.sh
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 set -euo pipefail
 config=${1:?kernel .config required}
-fragment=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/kernel.config
+fragment=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/components/kernel/kernel.config
 failed=0
 while IFS= read -r line; do
     [[ $line =~ ^CONFIG_[A-Z0-9_]+=(y|m|n)$ ]] || continue
diff --git a/os/mkosi/scripts/component-framework.sh b/os/mkosi/scripts/component-framework.sh
@@ -66,7 +66,9 @@ key_dependency() {
 }
 
 component_run() {
-    local name=$1 definition="$COMPONENT_DIR/$1.sh" key
+    local name=$1 definition key
+    COMPONENT_PATH="$COMPONENT_DIR/$name"
+    definition="$COMPONENT_PATH/$name.sh"
     COMPONENT_NAME=''
     COMPONENT_CACHE_PATHS=()
     COMPONENT_ROOTFS_TREES=()
diff --git a/os/mkosi/tests/acceptance.sh b/os/mkosi/tests/acceptance.sh
@@ -2,6 +2,10 @@
 # SPDX-License-Identifier: Apache-2.0
 set -euo pipefail
 D=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+for component in dstack-rust container-stack sysbox nvattest kernel nvidia zfs ovmf; do
+  test -f "$D/components/$component/$component.sh"
+  test -x "$D/components/$component/$component-build.sh"
+done
 # shellcheck source=/dev/null
 source "$D/versions.env"
 [[ $KERNEL_VERSION == 7.* && $KERNEL_VERSION != *-rc* ]]
@@ -12,18 +16,18 @@ for key in ACPI ACPI_TABLE_UPGRADE INTEL_TDX_GUEST TDX_GUEST_DRIVER \
  AMD_MEM_ENCRYPT SEV_GUEST TCG_TPM VIRTIO_PCI VIRTIO_NET BLK_DEV_NVME \
  DM_CRYPT DM_VERITY OVERLAY_FS CGROUPS USER_NS SECCOMP BPF_SYSCALL \
  NF_TABLES VSOCKETS HARDENED_USERCOPY; do
-  grep -Eq "^CONFIG_${key}=(y|m)$" "$D/kernel.config" || { echo "missing CONFIG_$key"; exit 1; }
+  grep -Eq "^CONFIG_${key}=(y|m)$" "$D/components/kernel/kernel.config" || { echo "missing CONFIG_$key"; exit 1; }
 done
-grep -q '0002-acpi-sandbox' "$D/scripts/build-kernel.sh"
-grep -q -- '--fuzz=0' "$D/scripts/build-kernel.sh"
+grep -q '0002-acpi-sandbox' "$D/components/kernel/kernel-build.sh"
+grep -q -- '--fuzz=0' "$D/components/kernel/kernel-build.sh"
 for service in dstack-guest-agent dstack-prepare app-compose wg-checker; do
   grep -q "$service" "$D/mkosi.postinst"
 done
 grep -q 'artifact-manifest.json' "$D/scripts/make-release-artifacts.sh"
 grep -q 'image/assemble.sh' "$D/build.sh"
-grep -q 'build-ovmf.sh' "$D/components/ovmf.sh"
-grep -q 'fbe0805b2091393406952e84724188f8c1941837' "$D/scripts/build-ovmf.sh"
-grep -q 'AmdSev/AmdSevX64.dsc' "$D/scripts/build-ovmf.sh"
+grep -q 'ovmf-build.sh' "$D/components/ovmf/ovmf.sh"
+grep -q 'fbe0805b2091393406952e84724188f8c1941837' "$D/components/ovmf/ovmf-build.sh"
+grep -q 'AmdSev/AmdSevX64.dsc' "$D/components/ovmf/ovmf-build.sh"
 grep -q 'objcopy --strip-debug' "$D/build.sh"
 grep -q 'depmod -b.*KERNEL_VERSION-dstack' "$D/build.sh"
 grep -q 'prune-rootfs.sh' "$D/build.sh"
@@ -33,26 +37,26 @@ if grep -q '^[[:space:]]*ovmf$' "$D/mkosi.conf"; then
 fi
 grep -q '"firmware_sev":"files/ovmf-sev.fd"' "$D/scripts/make-release-artifacts.sh"
 grep -q 'measurement.snp.cbor' "$D/tests/check-output.sh"
-grep -q '0001-validate-ocsp-response-freshness.patch' "$D/scripts/build-nvattest.sh"
-grep -q -- '--fuzz=0' "$D/scripts/build-nvattest.sh"
-grep -q '0001-pin-fetchcontent-inputs.patch' "$D/scripts/build-nvattest.sh"
+grep -q '0001-validate-ocsp-response-freshness.patch' "$D/components/nvattest/nvattest-build.sh"
+grep -q -- '--fuzz=0' "$D/components/nvattest/nvattest-build.sh"
+grep -q '0001-pin-fetchcontent-inputs.patch' "$D/components/nvattest/nvattest-build.sh"
 grep -q '^NVATTEST_REVISION=9d12801cea8a198ea0f29640dfaf8a4017c841c5$' "$D/versions.env"
-grep -q '0001-linux-7.1-drop-legacy-of-gpio-api.patch' "$D/scripts/build-nvidia.sh"
+grep -q '0001-linux-7.1-drop-legacy-of-gpio-api.patch' "$D/components/nvidia/nvidia-build.sh"
 grep -q '^NVIDIA_VERSION=595.58.03$' "$D/versions.env"
 grep -q '^STARGZ_VERSION=0.18.2$' "$D/versions.env"
 grep -q '^NERDCTL_VERSION=2.2.1$' "$D/versions.env"
 grep -q '^[[:space:]]*docker-cli$' "$D/mkosi.conf"
 grep -q '^SYSBOX_VERSION=0.6.7$' "$D/versions.env"
 grep -q '^ZFS_VERSION=2.4.0$' "$D/versions.env"
-grep -q '0001-linux-6.19-7.1-compat.patch' "$D/scripts/build-zfs.sh"
-grep -q -- '--fuzz=0' "$D/scripts/build-zfs.sh"
+grep -q '0001-linux-6.19-7.1-compat.patch' "$D/components/zfs/zfs-build.sh"
+grep -q -- '--fuzz=0' "$D/components/zfs/zfs-build.sh"
 python3 -m json.tool "$D/parity.json" >/dev/null
 grep -q 'rootfs.img.parted.verity' "$D/../image/assemble.sh"
-bash -n "$D"/*.sh "$D"/scripts/*.sh "$D"/tests/*.sh
+bash -n "$D"/*.sh "$D"/scripts/*.sh "$D"/components/*/*.sh "$D"/tests/*.sh
 grep -Fq "[[ \$action == dev-image ]] && component_cache_args+=(--dev-cache)" "$D/build.sh"
 grep -q 'scripts/build-components.sh' "$D/build.sh"
 for component in dstack-rust container-stack sysbox nvattest kernel nvidia zfs ovmf; do
-  definition="$D/components/$component.sh"
+  definition="$D/components/$component/$component.sh"
   grep -q "^COMPONENT_NAME=$component$" "$definition"
   grep -q '^component_cache_key()' "$definition"
   grep -q '^component_build()' "$definition"
diff --git a/prek.toml b/prek.toml
@@ -11,15 +11,15 @@
 repo = "https://github.com/pre-commit/pre-commit-hooks"
 rev = "v5.0.0"
 hooks = [
-    { id = "trailing-whitespace", args = ["--markdown-linebreak-ext=md"], exclude = '^(os/yocto/|os/mkosi/patches/|tools/(dev-stack\.sh|vm-runner/)|dstack/(dstack-util/tests/fixtures/key-provider-docker-compose\.yaml|gateway/src/main_service/snapshots/.*))' },
-    { id = "end-of-file-fixer", exclude = "^(os/yocto/|os/mkosi/patches/|tools/(dev-stack\\.sh|vm-runner/))" },
+    { id = "trailing-whitespace", args = ["--markdown-linebreak-ext=md"], exclude = '^(os/yocto/|os/mkosi/(patches/|components/[^/]+/patches/)|tools/(dev-stack\.sh|vm-runner/)|dstack/(dstack-util/tests/fixtures/key-provider-docker-compose\.yaml|gateway/src/main_service/snapshots/.*))' },
+    { id = "end-of-file-fixer", exclude = "^(os/yocto/|os/mkosi/(patches/|components/[^/]+/patches/)|tools/(dev-stack\\.sh|vm-runner/))" },
     { id = "check-yaml", args = ["--allow-multiple-documents"], exclude = "dstack/gateway/templates/" },
     { id = "check-toml" },
     { id = "check-json" },
     { id = "check-merge-conflict" },
     { id = "check-added-large-files", args = ["--maxkb=500"] },
     { id = "check-symlinks" },
-    { id = "mixed-line-ending", args = ["--fix=lf"], exclude = "^(os/yocto/|os/mkosi/patches/|tools/(dev-stack\\.sh|vm-runner/))" },
+    { id = "mixed-line-ending", args = ["--fix=lf"], exclude = "^(os/yocto/|os/mkosi/(patches/|components/[^/]+/patches/)|tools/(dev-stack\\.sh|vm-runner/))" },
 ]
 
 # --- Rust: rustfmt ---

Original file line number	Diff line number	Diff line change
`@@ -6,11 +6,11 @@ COMPONENT_ROOTFS_TREES=(component-stages/dstack-rust)`
`6`	`6`	`COMPONENT_KERNEL_TREES=()`
`7`	`7`
`8`	`8`	`component_cache_key() {`
`9`		`- key_file "$SELF/scripts/stage-rootfs.sh"`
	`9`	`+ key_file "$COMPONENT_PATH/dstack-rust-build.sh"`
`10`	`10`	`key_tree dstack os/common/rootfs`
`11`	`11`	`key_tools rustc cargo`
`12`	`12`	`}`
`13`	`13`
`14`	`14`	`component_build() {`
`15`		`- "$SELF/scripts/stage-rootfs.sh" "$WORK/component-stages/dstack-rust" "$FLAVOR"`
	`15`	`+ "$COMPONENT_PATH/dstack-rust-build.sh" "$WORK/component-stages/dstack-rust" "$FLAVOR"`
`16`	`16`	`}`
Original file line number	Diff line number	Diff line change
`@@ -7,13 +7,13 @@ COMPONENT_KERNEL_TREES=(component-stages/kernel)`
`7`	`7`
`8`	`8`	`component_cache_key() {`
`9`	`9`	`key_value "$KERNEL_VERSION" "$KERNEL_SHA256"`
`10`		`- key_file "$SELF/scripts/build-kernel.sh" "$SELF/kernel.config" \`
	`10`	`+ key_file "$COMPONENT_PATH/kernel-build.sh" "$COMPONENT_PATH/kernel.config" \`
`11`	`11`	`"$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0001-x86-tdx-select-dma-direct-remap.patch" \`
`12`	`12`	`"$ROOT/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/0002-acpi-sandbox-block-aml-systemmemory-ram-access.patch"`
`13`	`13`	`key_tools gcc ld make pahole`
`14`	`14`	`key_packages binutils dwarves bc bison flex libssl-dev libelf-dev`
`15`	`15`	`}`
`16`	`16`
`17`	`17`	`component_build() {`
`18`		`- "$SELF/scripts/build-kernel.sh" "$WORK" "$WORK/component-stages/kernel"`
	`18`	`+ "$COMPONENT_PATH/kernel-build.sh" "$WORK" "$WORK/component-stages/kernel"`
`19`	`19`	`}`