Skip to content

Commit ab16e40

Browse files
Kabuki94Kabuki94
committed
book-keepings.
1 parent 2020804 commit ab16e40

12 files changed

Lines changed: 124 additions & 26 deletions

File tree

‎automation/10-gnome.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ BIBATA_VER=$( (scurl -sL --connect-timeout 15 --max-time 30 \
7979
| grep -m1 '"tag_name"' | sed 's/.*"v\?\([^"]*\)".*/\1/') 2>/dev/null || true)
8080

8181
[[ -n "$BIBATA_VER" ]] || die "Bibata: api.github.com release-latest lookup returned empty"
82-
echo "[10-gnome] Latest release: v${BIBATA_VER}"
82+
record_version bibata "v${BIBATA_VER}" "https://github.com/ful1e5/Bibata_Cursor/releases/tag/v${BIBATA_VER}"
8383

8484
BIBATA_URL="https://github.com/ful1e5/Bibata_Cursor/releases/download/v${BIBATA_VER}/Bibata-Modern-Classic.tar.xz"
8585
BIBATA_DIR="/usr/share/icons/Bibata-Modern-Classic"

‎automation/13-ceph-k3s.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ fi
4242

4343
if [[ -n "$K3S_TAG" ]]; then
4444
echo "[13-ceph-k3s] Latest K3s tag: $K3S_TAG"
45+
record_version k3s "$K3S_TAG" "https://github.com/k3s-io/k3s/releases/tag/${K3S_TAG}"
4546

4647
echo "[13-ceph-k3s] Downloading K3s binary, checksum, and install script..."
4748
K3S_URL="https://github.com/k3s-io/k3s/releases/download/${K3S_TAG}/k3s"

‎automation/19-k3s-selinux.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ if [[ -z "${K3S_SELINUX_TAG:-}" ]]; then
2222
| tail -n1) || true
2323
K3S_SELINUX_TAG="${K3S_SELINUX_TAG:-master}"
2424
fi
25+
record_version k3s-selinux "$K3S_SELINUX_TAG" "https://github.com/k3s-io/k3s-selinux/tree/${K3S_SELINUX_TAG}"
2526

2627
echo "==> Cloning k3s-selinux at ref ${K3S_SELINUX_TAG}..."
2728
git clone --depth 1 --branch "${K3S_SELINUX_TAG}" \

‎automation/37-aichat.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ AICHAT_NG_TAG=$( (scurl -s https://api.github.com/repos/blob42/aichat-ng/release
1919

2020
[[ -n "$AICHAT_TAG" ]] || die "AIChat: api.github.com release-latest lookup returned empty"
2121
[[ -n "$AICHAT_NG_TAG" ]] || die "AIChat-NG: api.github.com release-latest lookup returned empty"
22-
echo "[37-aichat] AIChat latest: ${AICHAT_TAG}"
23-
echo "[37-aichat] AIChat-NG latest: ${AICHAT_NG_TAG}"
22+
record_version aichat "$AICHAT_TAG" "https://github.com/sigoden/aichat/releases/tag/${AICHAT_TAG}"
23+
record_version aichat-ng "$AICHAT_NG_TAG" "https://github.com/blob42/aichat-ng/releases/tag/${AICHAT_NG_TAG}"
2424

2525
# ── AIChat ────────────────────────────────────────────────────────────────────
2626
AICHAT_ARCH="aichat-${AICHAT_TAG}-x86_64-unknown-linux-musl.tar.gz"

‎automation/42-cosign-policy.sh‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,18 @@ source "$(dirname "$0")/lib/common.sh"
1414

1515
log "42-cosign-policy: ensuring cosign + trust roots + policy.json"
1616

17-
# 1. Install cosign binary (pinned to v2.x for rpm-ostree compatibility)
17+
# 1. Install cosign binary
18+
# Project policy: every dependency tracks :latest from its source. Cosign is
19+
# constrained to the v2.x series here because v3+ breaks rpm-ostree OCI 1.1
20+
# bundle format (see header). Lift the v2 filter when v3 compat is confirmed.
1821
if ! command -v cosign >/dev/null 2>&1; then
19-
COSIGN_VERSION="v2.4.3"
22+
COSIGN_VERSION=$( (scurl -s https://api.github.com/repos/sigstore/cosign/releases?per_page=30 \
23+
| grep -Po '"tag_name": "\Kv2\.[^"]+' \
24+
| head -n1) 2>/dev/null || true)
25+
[[ -n "$COSIGN_VERSION" ]] || die "cosign: api.github.com release lookup returned no v2.x match"
2026
COSIGN_BASE_URL="https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}"
27+
record_version cosign "$COSIGN_VERSION" "https://github.com/sigstore/cosign/releases/tag/${COSIGN_VERSION}"
28+
log " resolved cosign latest v2.x: ${COSIGN_VERSION}"
2129
log " downloading cosign ${COSIGN_VERSION} static binary..."
2230
mkdir -p /tmp/cosign-dl
2331
scurl -sfL "${COSIGN_BASE_URL}/cosign-linux-amd64" -o /tmp/cosign-dl/cosign-linux-amd64

‎automation/53-bake-lookingglass-client.sh‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,17 @@ if [[ -n "$MISSING" ]]; then
3535
exit 0
3636
fi
3737

38-
LG_BRANCH="${LG_BRANCH:-B7}"
38+
# Resolve latest Looking Glass release branch from upstream. Project policy:
39+
# every dependency tracks :latest from its source. LG uses letter-numbered
40+
# release branches (B6, B7, …); pick the highest by version sort.
41+
if [[ -z "${LG_BRANCH:-}" ]]; then
42+
LG_BRANCH=$(git ls-remote --heads https://github.com/gnif/LookingGlass.git 'B*' 2>/dev/null \
43+
| awk -F/ '{print $NF}' \
44+
| sort -V \
45+
| tail -n1 || true)
46+
[[ -n "$LG_BRANCH" ]] || die "Looking Glass: git ls-remote returned no B* release branch"
47+
fi
48+
record_version looking-glass "$LG_BRANCH" "https://github.com/gnif/LookingGlass/tree/${LG_BRANCH}"
3949
BUILD_DIR="/tmp/LookingGlass-build"
4050

4151
# --- Clone -----------------------------------------------------------------

‎automation/build.sh‎

Lines changed: 70 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,17 @@ _section_header
211211
echo ""
212212

213213
TOTAL_START=$SECONDS
214+
215+
# ── Build-time version manifest (records :latest -> observed-version) ────────
216+
# Project policy: every dependency tracks :latest from upstream. To make
217+
# day-0 images reproducible-after-the-fact, every script that resolves a
218+
# floating tag calls record_version (lib/common.sh). build.sh seeds the
219+
# manifest with image-level metadata; phase scripts append component rows.
220+
rm -f "$MIOS_VERSION_MANIFEST"
221+
record_version mios "$VERSION_STR" "git:$(cat /ctx/VERSION 2>/dev/null || echo unknown)"
222+
record_version base-image "${BASE_IMAGE:-ghcr.io/ublue-os/ucore-hci:stable-nvidia}" "build-time floating tag"
223+
record_version kernel "$(find /usr/lib/modules/ -mindepth 1 -maxdepth 1 -printf '%f\n' 2>/dev/null | sort -V | tail -1)" "from base image"
224+
214225
SCRIPT_COUNT=0
215226
SCRIPT_FAIL=0
216227
WARN_FAIL=0
@@ -325,28 +336,71 @@ else
325336
_row " WARNING: 99-postcheck.sh not found -- skipping"
326337
fi
327338

328-
# ── Log preservation (flatten all chain logs into /usr/lib/mios/logs/) ──────
339+
# ── Quadlet image digest capture (build-day :latest snapshot) ───────────────
340+
# Quadlets are pulled by bootc at deploy time, not at OCI-build time, so
341+
# their :latest will re-resolve on every deploy. Record the digest skopeo
342+
# sees right now, so the shipped image carries a precise snapshot of what
343+
# build day's :latest pointed at — even though deploys may differ later.
344+
echo ""
345+
_hline '-' '+' '+'
346+
_row " POST-BUILD: Capturing Quadlet image digests"
347+
_hline '-' '+' '+'
348+
if command -v skopeo >/dev/null 2>&1; then
349+
shopt -s nullglob
350+
for q in /usr/share/containers/systemd/*.container /etc/containers/systemd/*.container; do
351+
img=$(awk -F= '/^Image=/{print $2; exit}' "$q" 2>/dev/null)
352+
[[ -n "$img" ]] || continue
353+
digest=$(skopeo inspect "docker://${img}" 2>/dev/null \
354+
| python3 -c 'import json,sys;d=json.load(sys.stdin);print(d.get("Digest",""))' 2>/dev/null \
355+
|| true)
356+
record_version "quadlet:$(basename "$q" .container)" "$img" "${digest:-<unresolved>}"
357+
done
358+
shopt -u nullglob
359+
else
360+
warn "skopeo not available — Quadlet image digests not captured"
361+
fi
362+
363+
# ── Log preservation (flatten all chain logs + version manifest into /usr) ──
329364
echo ""
330365
_hline '-' '+' '+'
331-
_row " LOG CHAIN: Flattening all build logs -> /usr/lib/mios/logs/"
366+
_row " LOG CHAIN: Flattening logs + version manifest -> /usr/lib/mios/logs/"
332367
_hline '-' '+' '+'
333368
mkdir -p /usr/lib/mios/logs
334369
cp -v /var/log/dnf5.log* /var/log/hawkey.log /usr/lib/mios/logs/ 2>/dev/null || true
335-
# Flatten per-step logs into single unified chain log
370+
371+
# Promote machine-readable version manifest (TSV, kept uncompressed for grep/awk)
372+
if [[ -f "$MIOS_VERSION_MANIFEST" ]]; then
373+
install -m 0644 "$MIOS_VERSION_MANIFEST" /usr/lib/mios/logs/mios-build-versions.tsv
374+
_row " Version manifest: /usr/lib/mios/logs/mios-build-versions.tsv ($(wc -l < "$MIOS_VERSION_MANIFEST") rows)"
375+
fi
376+
377+
# Flatten per-step logs + manifest + main build log into single unified chain
336378
UNIFIED_LOG="/usr/lib/mios/logs/mios-build-chain.log"
337-
echo "# MiOS ${VERSION_STR} Unified Build Log Chain — $(date '+%Y-%m-%d %H:%M:%S')" > "$UNIFIED_LOG"
338-
for step_log in /tmp/mios-step-*.log; do
339-
[[ -f "$step_log" ]] || continue
340-
echo "" >> "$UNIFIED_LOG"
341-
echo "# ====== $(basename "$step_log") ======" >> "$UNIFIED_LOG"
342-
cat "$step_log" >> "$UNIFIED_LOG"
343-
done
344-
# Append main build log
345-
echo "" >> "$UNIFIED_LOG"
346-
echo "# ====== mios-build.log ======" >> "$UNIFIED_LOG"
347-
[[ -f "$BUILD_LOG" ]] && cat "$BUILD_LOG" >> "$UNIFIED_LOG" || true
379+
{
380+
echo "# MiOS ${VERSION_STR} Unified Build Log Chain — $(date '+%Y-%m-%d %H:%M:%S')"
381+
echo ""
382+
echo "# ====== build-time :latest -> observed-version manifest ======"
383+
if [[ -f "$MIOS_VERSION_MANIFEST" ]]; then
384+
cat "$MIOS_VERSION_MANIFEST"
385+
else
386+
echo "(no manifest produced)"
387+
fi
388+
for step_log in /tmp/mios-step-*.log; do
389+
[[ -f "$step_log" ]] || continue
390+
echo ""
391+
echo "# ====== $(basename "$step_log") ======"
392+
cat "$step_log"
393+
done
394+
echo ""
395+
echo "# ====== mios-build.log ======"
396+
[[ -f "$BUILD_LOG" ]] && cat "$BUILD_LOG" || true
397+
} > "$UNIFIED_LOG"
348398
cp "$UNIFIED_LOG" /usr/lib/mios/logs/mios-build.log 2>/dev/null || true
349-
_row " Unified chain log: /usr/lib/mios/logs/mios-build-chain.log"
399+
400+
# Compress the bulky logs; keep the TSV manifest uncompressed for direct query.
401+
gzip -9f /usr/lib/mios/logs/mios-build-chain.log /usr/lib/mios/logs/mios-build.log 2>/dev/null || true
402+
gzip -9f /usr/lib/mios/logs/dnf5.log* /usr/lib/mios/logs/hawkey.log 2>/dev/null || true
403+
_row " Unified chain log: /usr/lib/mios/logs/mios-build-chain.log.gz"
350404
_row " Step count in chain: $(ls /tmp/mios-step-*.log 2>/dev/null | wc -l)"
351405

352406
# ── Cleanup ─────────────────────────────────────────────────────────────────
@@ -356,7 +410,7 @@ rm -rf /usr/share/doc/* /usr/share/man/* /usr/share/info/* 2>/dev/null || true
356410
rm -rf /usr/share/gnome/help/* /usr/share/help/* 2>/dev/null || true
357411
rm -f /var/log/dnf5.log* /var/log/hawkey.log 2>/dev/null || true
358412
rm -rf /run/ceph /run/cockpit /run/k3s /tmp/mios-step-*.log 2>/dev/null || true
359-
rm -f /var/lib/systemd/random-seed /tmp/mios-build.log 2>/dev/null || true
413+
rm -f /var/lib/systemd/random-seed /tmp/mios-build.log "$MIOS_VERSION_MANIFEST" 2>/dev/null || true
360414

361415
# ── Final summary + failure/warn report ──────────────────────────────────────
362416
TOTAL_ELAPSED=$(( SECONDS - TOTAL_START ))

‎automation/lib/common.sh‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,3 +43,27 @@ fi
4343
# String variant for legacy/debug visibility only. Do NOT use in commands.
4444
export DNF_SETOPT_STR="${DNF_SETOPT[*]}"
4545
export DNF_OPTS_STR="${DNF_OPTS[*]}"
46+
47+
# --- Build-time version manifest --------------------------------------------
48+
# Project policy: every dependency tracks :latest from upstream (no human
49+
# pins). To keep day-0 builds reproducible-after-the-fact, every phase script
50+
# that resolves a :latest tag MUST call record_version so the observed value
51+
# is captured into the per-image manifest. build.sh promotes this file into
52+
# /usr/lib/mios/logs/ at the end of the build, alongside the flattened log.
53+
#
54+
# Usage: record_version <component> <version_or_tag> [resolved_to]
55+
# component short id, e.g. "aichat", "cosign", "quadlet:mios-k3s"
56+
# version_or_tag what was observed, e.g. "v0.30.1" or "docker.io/x:latest"
57+
# resolved_to optional: digest, source URL, or commit ref
58+
export MIOS_VERSION_MANIFEST="${MIOS_VERSION_MANIFEST:-/tmp/mios-build-versions.tsv}"
59+
60+
record_version() {
61+
local component="$1" version="$2" resolved_to="${3:-}"
62+
if [[ ! -f "$MIOS_VERSION_MANIFEST" ]]; then
63+
printf 'component\tversion\tresolved_to\trecorded_at\n' > "$MIOS_VERSION_MANIFEST"
64+
fi
65+
printf '%s\t%s\t%s\t%s\n' \
66+
"$component" "$version" "$resolved_to" "$(log_ts)" \
67+
>> "$MIOS_VERSION_MANIFEST"
68+
log "version: ${component} = ${version}${resolved_to:+ (${resolved_to})}"
69+
}

‎etc/containers/systemd/mios-ai.container‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ Wants=network-online.target
1212
ConditionPathIsDirectory=/etc/mios/ai
1313

1414
[Container]
15-
Image=docker.io/localai/localai:v2.20.0
15+
Image=docker.io/localai/localai:latest
1616
ContainerName=mios-ai
1717
PublishPort=8080:8080
1818
Volume=/srv/ai/models:/build/models:Z

‎etc/containers/systemd/mios-ceph.container‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ ConditionPathExists=/etc/ceph/ceph.conf
1818
ConditionVirtualization=!container
1919

2020
[Container]
21-
Image=quay.io/ceph/ceph:v18
21+
Image=quay.io/ceph/ceph:latest
2222
ContainerName=mios-ceph
2323
Network=mios.network
2424
Volume=/var/lib/ceph:/var/lib/ceph:Z

0 commit comments

Comments
 (0)