# veilor-os — BlueBuild recipe (v0.7 spike, 1-day target) # # Extends secureblue's hardened Kinoite OCI image with veilor branding, # threat-model-driven UX choices, and the three-layer mesh stack # (Tailscale + Yggdrasil + opt-in Reticulum). This is the OCI image # that the v0.7+ kickstart's `ostreecontainer` directive pulls into # the target root during the install pass. # # Build: bluebuild build recipe.yml # Test: podman run --rm -it ghcr.io/veilor-org/veilor-os:43 /bin/bash # CI: .github/workflows/build-bluebuild.yml signs + pushes to GHCR. # # Reference: https://blue-build.org/reference/recipe/ # # ── Module collapse history ────────────────────────────────────── # Run 183 (2026-05-08) ate 3h10min before runner timeout: each RUN/COPY # layer COMMIT under fuse-overlayfs over secureblue's 130-layer hardened # base costs ~40min wallclock (STEP 10..13 each 38–43min). Ergo: every # saved module = ~40min saved. Collapsed: # - 5× rpm-ostree → 1× (-4 layers) # - 2× containerfile (brand sed + systemctl enable) → 1× (-1 layer) # - 4× copy left as-is — BlueBuild copy module is one src/dest per # entry per https://blue-build.org/reference/modules/copy/ # Net: 12 → 7 modules, ~5×40min ≈ 3h20min off wallclock budget. --- name: veilor-os description: Hardened security-branded Fedora KDE on top of secureblue. # Base image: secureblue's hardened Kinoite variant with userns sandboxing. # That brings in: sysctl + kargs + custom SELinux policy + USBGuard + # hardened-malloc + Unbound DoT + chronyd NTS + Trivalent browser. base-image: ghcr.io/secureblue/kinoite-main-hardened image-version: latest modules: # ── 1. veilor branding overlay ────────────────────────────────── # `type: copy` is a low-level direct COPY (no chmod, no script). # `type: files` was failing with `chmod: Operation not permitted` on # the BlueBuild-shipped /tmp/modules/files/files.sh under buildah + # podman privileged in our runner — the script tries to make itself # executable inside its own bind-mounted layer. # # NOTE: Each copy module = one COPY layer (~40min commit on our # runner). BlueBuild's copy module accepts a single src/dest pair # only, so these four entries are the floor unless we move to a # hand-rolled Containerfile. - type: copy source: ../overlay destination: / - type: copy source: ../assets destination: /usr/share/veilor-os/assets - type: copy source: ../scripts destination: /usr/share/veilor-os/scripts - type: copy source: config/just destination: /usr/share/ublue-os/just # ── 2. All package layering in one rpm-ostree pass ────────────── # secureblue removes sudo + replaces with run0 (too disruptive for # daily-driver) — restore. Xwayland was disabled for attack-surface # reduction — restore for Element/Slack/Qt5 apps. Mullvad Browser # layered alongside Trivalent (Trivalent default per STRATEGY.md; # Mullvad for pseudonymous browsing). Mesh stack: Tailscale (Layer # 1, daily driver, pre-disabled), Yggdrasil-go (Layer 2, idle warm- # fallback). Reticulum/RetiNet stays opt-in via ujust. Memory # hygiene + ergonomic deps for veilor-postinstall + veilor-doctor. # # Collapsed from 5 rpm-ostree modules → 1 to drop 4 layer commits # (~160min wallclock on our buildah+fuse-overlayfs runner). - type: rpm-ostree install: - sudo - xorg-x11-server-Xwayland - mullvad-browser - tailscale - yggdrasil - zram-generator - jq - vim-enhanced - tmux - htop # ── 3. Branding overrides + systemd unit toggles in one RUN ───── # Use raw `type: containerfile` (RUN line) instead of `type: script` # / `type: systemd` — bluebuild's helper scripts fail 'chmod: # Operation not permitted' on their own bind-mounted layer under # podman/buildah privileged. Raw RUN bypasses the helper. # # Single snippet (= single layer) merges: # - brand sed of /etc/os-release + GRUB_DISTRIBUTOR # - kde-theme + v03-theme apply scripts # - plymouth default-theme # - chmod +x on shipped veilor-* scripts/binaries # - fc-cache rebuild # - systemctl enable yggdrasil + veilor-{firstboot,modules-lock, # postinstall}.service + veilor-doctor.timer # - systemctl disable tailscaled (Day-1-disabled per threat model) # # brand-leak grep moved to CI smoke-test in build-bluebuild.yml # (STEP 14 hung under buildah overlayfs, run 171 2026-05-07). - type: containerfile snippets: - | RUN sed -i -e 's|^GRUB_DISTRIBUTOR=.*|GRUB_DISTRIBUTOR="veilor-os"|' /etc/default/grub 2>/dev/null || true ; \ bash /usr/share/veilor-os/scripts/kde-theme-apply.sh 2>/dev/null || true ; \ bash /usr/share/veilor-os/scripts/30-apply-v03-theme.sh 2>/dev/null || true ; \ plymouth-set-default-theme details 2>/dev/null || true ; \ chmod +x /usr/share/veilor-os/scripts/*.sh \ /usr/share/veilor-os/scripts/selinux/*.sh \ /usr/local/bin/veilor-* 2>/dev/null || true ; \ fc-cache -f 2>/dev/null || true ; \ if [ -f /etc/os-release ]; then \ sed -i \ -e 's|^NAME=.*|NAME="veilor-os"|' \ -e 's|^PRETTY_NAME=.*|PRETTY_NAME="veilor-os 0.7 (atomic)"|' \ -e 's|^ID=.*|ID=veilor|' \ -e 's|^ID_LIKE=.*|ID_LIKE="fedora kinoite"|' \ /etc/os-release || true ; \ fi ; \ systemctl enable yggdrasil.service 2>/dev/null || true ; \ systemctl disable tailscaled.service 2>/dev/null || true ; \ systemctl enable veilor-firstboot.service 2>/dev/null || true ; \ systemctl enable veilor-modules-lock.service 2>/dev/null || true ; \ systemctl enable veilor-postinstall.service 2>/dev/null || true ; \ systemctl enable veilor-doctor.timer 2>/dev/null || true # ── 4. signing config ─────────────────────────────────────────── # cosign.pub committed alongside this recipe; cosign.key kept off # repo and provided to CI as Forgejo secret COSIGN_PRIVATE_KEY. # The action exports it to /tmp at build time. - type: signing