josh
6c6d20710f
Previous run actually built the 518 MB rootfs with firmware-misc-nonfree et al. installed — the real payload is working. Two follow-ups: - check-initrd was reading stat on a symlink path and getting 30 bytes (the symlink's own size), not the 6.1.0-44-amd64 kernel initrd it points to. Switched to wc -c, which follows symlinks, and to du -hL for the OK message. - Add zstd to Packages= so COMPRESS=zstd in initramfs.conf can be honored; without it update-initramfs falls back to gzip with a "No zstd in PATH" warning. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
66 lines
2.0 KiB
Plaintext
66 lines
2.0 KiB
Plaintext
# Vetting live image (Phase 2 skeleton).
|
|
#
|
|
# Produces a Debian-based rootfs packaged as squashfs plus a kernel
|
|
# image, ready to be served over HTTP to iPXE. The image is deliberately
|
|
# small: only what the agent needs to run Phase 2 (the Hello / Claim /
|
|
# Heartbeat loop). Phase 4+ adds smartctl, stress-ng, fio, iperf3, etc.
|
|
|
|
[Distribution]
|
|
Distribution=debian
|
|
Release=bookworm
|
|
# non-free-firmware is where bookworm landed i915 GuC/HuC, iwlwifi,
|
|
# amdgpu, nvidia-*, realtek NIC firmware, etc. — anything we'd want
|
|
# when PXE-booting a random repaired host. Without it i915 wedges
|
|
# on Tiger Lake+ and drags the serial console with it.
|
|
#
|
|
# Belt-and-suspenders: mkosi.sources.d/debian.sources ships an
|
|
# explicit deb822 sources drop-in so the bootstrap step sees the
|
|
# component regardless of how this shorthand is interpreted by the
|
|
# mkosi version doing the build.
|
|
Repositories=main non-free-firmware
|
|
|
|
[Output]
|
|
Format=directory
|
|
Output=build
|
|
|
|
[Content]
|
|
# PXE live image — iPXE loads vmlinuz+initrd from TFTP, so the rootfs
|
|
# itself doesn't need an EFI bootloader. Bootable=no skips mkosi's
|
|
# systemd-boot/bootctl dance; we still get /vmlinuz + /initrd.img
|
|
# symlinks courtesy of the linux-image-amd64 postinst.
|
|
Bootable=no
|
|
BuildPackages=
|
|
Packages=
|
|
systemd
|
|
systemd-sysv
|
|
udev
|
|
linux-image-amd64
|
|
live-boot
|
|
iproute2
|
|
iputils-ping
|
|
openssh-server
|
|
ca-certificates
|
|
curl
|
|
dmidecode
|
|
pciutils
|
|
usbutils
|
|
initramfs-tools
|
|
zstd
|
|
# Firmware. firmware-linux-nonfree on bookworm is a thin metapackage
|
|
# that does NOT pull i915 GuC/HuC — those live in firmware-misc-nonfree.
|
|
# Enumerate explicitly so the blob for whatever hardware we boot on
|
|
# actually lands in /lib/firmware and then in the initrd.
|
|
firmware-misc-nonfree
|
|
firmware-iwlwifi
|
|
firmware-realtek
|
|
firmware-amd-graphics
|
|
firmware-intel-sound
|
|
intel-microcode
|
|
amd64-microcode
|
|
firmware-linux-nonfree
|
|
|
|
# Phase 4 will add: smartmontools stress-ng fio iperf3 lshw lm-sensors
|
|
|
|
[Host]
|
|
# Copy the prebuilt Go agent in from the repo root via postinst.
|