josh/Vetting
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
50 Commits 1 Branch 0 Tags
6c6d20710fdbbe8c5311d7bdbf228efae7ba3278
Commit Graph
4 Commits
Author SHA1 Message Date
joshandClaude Opus 4.7 6c6d20710f live-image: fix check-initrd size measurement; add zstd to image
CI / Lint + build + test (push) Successful in 1m28s
Details
Release / release (push) Failing after 4m10s
Details 
Previous run actually built the 518 MB rootfs with firmware-misc-nonfree
et al. installed — the real payload is working. Two follow-ups:

- check-initrd was reading stat on a symlink path and getting 30 bytes
  (the symlink's own size), not the 6.1.0-44-amd64 kernel initrd it
  points to. Switched to wc -c, which follows symlinks, and to du -hL
  for the OK message.
- Add zstd to Packages= so COMPRESS=zstd in initramfs.conf can be
  honored; without it update-initramfs falls back to gzip with a
  "No zstd in PATH" warning.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-04-18 14:00:07 -04:00
joshandClaude Opus 4.7 28918bad15 live-image: fix firmware so i915 actually loads at boot
CI / Lint + build + test (push) Successful in 1m35s
Details
Release / release (push) Failing after 22s
Details 
Previous attempt (c962d6d) added firmware-linux-nonfree to mkosi.conf,
but the CI bundle was still 63 MB and Tiger Lake wedged on tgl_guc.
Two reasons: (1) firmware-linux-nonfree on bookworm is a thin
metapackage that doesn't include firmware-misc-nonfree, which is where
i915 GuC/HuC blobs actually live; (2) Ubuntu's apt-packaged mkosi is
old enough that Repositories=non-free-firmware shorthand likely isn't
wired through to the debootstrap invocation, so firmware packages
silently miss the bootstrap step entirely.

Changes:
- Enumerate firmware packages explicitly in mkosi.conf (firmware-
  misc-nonfree, firmware-iwlwifi, firmware-realtek, firmware-amd-
  graphics, firmware-intel-sound, intel/amd64-microcode).
- Ship mkosi.sources.d/debian.sources with explicit deb822 so the
  non-free-firmware component is unambiguously available.
- Install mkosi 24.3 via pip in CI instead of apt's older build.
- Pin MODULES=most and COMPRESS=zstd via a tracked initramfs-tools
  config under mkosi.extra/.
- Narrow .gitignore so only the generated agent binary is ignored,
  not the whole mkosi.extra/ tree.
- New check-initrd Makefile target asserts both size (>=150 MB) and
  actual presence of i915/tgl_guc_*.bin inside the built initrd, so
  a silent firmware-drop regression fails the build loudly.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-04-18 13:38:40 -04:00
joshandClaude Opus 4.7 a893b0d817 live-image: stage agent binary via mkosi.extra
CI / Lint + build + test (push) Successful in 1m33s
Details
Release / release (push) Failing after 1m43s
Details 
mkosi only mounts live-image/ as /work/src, so the postinst couldn't
reach the repo-root bin/vetting-agent.linux-amd64 — the build failed
in CI with `install: cannot stat '/work/src/bin/vetting-agent.linux-amd64'`.

The Makefile now copies the prebuilt agent into mkosi.extra/, which
mkosi merges into the image root automatically. The postinst is
reduced to creating the multi-user.target.wants symlink.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-04-18 03:13:38 -04:00
josh 9bb4b09a04 Initial commit: full Phases 1-6 implementation
CI / Lint + build + test (push) Has been cancelled
Details 
Post-repair hardware validation pipeline for Proxmox cluster hosts.
Go orchestrator + in-image agent + mkosi live image + bundled dnsmasq
PXE + SQLite + HTMX/SSE UI + notify registry + janitor + full docs.
 2026-04-17 21:32:10 -04:00