3c247bc601
Initial scaffold for the v0.7 hybrid path. Spike branch only — does
NOT land in main until success criteria pass (see bluebuild/README.md).
## What this commits
- bluebuild/recipe.yml — BlueBuild recipe extending
ghcr.io/secureblue/securecore-kinoite-hardened-userns:latest with:
* veilor branding overlay (overlay/, assets/, scripts/ at /usr/share/veilor-os)
* sudo restored (revert secureblue's run0-only)
* Xwayland restored (some apps still need it)
* mullvad-browser layered alongside Trivalent (default browser kept)
* tailscale + yggdrasil packages (mesh stack layers 1 + 2)
* tailscaled.service pre-disabled (awaits first-boot prompt)
* yggdrasil.service enabled (idle warm-fallback per STRATEGY.md)
* veilor-firstboot.service + veilor-modules-lock.service enabled
* cosign signing module configured
- bluebuild/config/just/60-veilor.just — ujust recipes:
* install-reticulum (RetiNet AGPL fork — mesh layer 3)
* install-reticulum-rnode (LoRa hardware)
* install-thorium (opt-in browser with explicit CVE-lag warning)
* veilor-mesh-join (token paste / QR for tailscale onboarding)
- bluebuild/README.md — spike doc + smoke-test commands + 5-item
success criteria checklist
- kickstart/install-ostreecontainer.ks — install kickstart template
for the v0.7 path. No %packages block; uses
`ostreecontainer --url=ghcr.io/veilor-org/veilor-os:43 --transport=registry`
to populate / from the OCI image directly during anaconda's install
pass. No first-boot rebase, no transition window. Keeps existing
LUKS+btrfs partitioning verbatim.
- .github/workflows/build-bluebuild.yml — GH Actions workflow:
* Triggered on push to v0.7-bluebuild-spike, weekly cron, dispatch
* Uses blue-build/github-action@v1 (TODO: pin to commit SHA per
CI hardening agent 8 follow-up)
* Builds + cosign-signs (keyless via Sigstore) + pushes to GHCR
* Smoke-tests the OCI image (sudo, mullvad-browser, yggdrasil,
tailscale all present)
* Generates SBOM (SPDX) via anchore/sbom-action
* Publishes SLSA build provenance attestation
## What this does NOT change
- main branch is untouched. v0.5.x kickstart path keeps shipping.
- kickstart/veilor-os.ks (the live-ISO ks) is untouched — the v0.7
hybrid uses the existing live-ISO build path; only the install-time
ks (install-ostreecontainer.ks) is new.
- overlay/, scripts/, assets/ are untouched on this branch — the
recipe pulls them in via `type: files` modules at build time.
## Spike success criteria (reproduced from bluebuild/README.md)
- [ ] `bluebuild build recipe.yml` exits 0
- [ ] `bootc container lint` exits 0 on resulting image
- [ ] `podman run` smoke-test passes
- [ ] CI workflow builds + cosign-signs + pushes to GHCR
- [ ] Installer ISO using `ostreecontainer` against this OCI reaches
SDDM with admin login on first boot
If all 5 land, merge v0.7-bluebuild-spike → main as v0.7.0.
## Reference
- docs/STRATEGY.md (full plan)
- docs/ROADMAP.md v0.7 (schedule)
- docs/THREAT-MODEL.md (publish before v0.7 ship)
- secureblue: https://github.com/secureblue/secureblue
- BlueBuild: https://blue-build.org
- ostreecontainer: https://docs.fedoraproject.org/en-US/bootc/anaconda-install/
99 lines
3.3 KiB
YAML
99 lines
3.3 KiB
YAML
name: Build veilor-os OCI (BlueBuild)
|
|
|
|
# v0.7 spike — builds the bootable OCI image used by the bootstrap
|
|
# kickstart's `ostreecontainer` directive. Active only on the
|
|
# `v0.7-bluebuild-spike` branch until the spike passes success
|
|
# criteria (see bluebuild/README.md).
|
|
#
|
|
# Reference: https://blue-build.org/how-to/setup-build-action/
|
|
#
|
|
# Security note: all `${{ }}` interpolations in this file are restricted
|
|
# to vetted GitHub-controlled values (repository_owner, run number,
|
|
# secrets, signed action outputs). No `github.event.issue.title` or
|
|
# similar untrusted-user-input is read in run blocks.
|
|
|
|
on:
|
|
push:
|
|
branches: [v0.7-bluebuild-spike]
|
|
paths:
|
|
- 'bluebuild/**'
|
|
- 'overlay/**'
|
|
- 'assets/**'
|
|
- 'scripts/**'
|
|
- '.github/workflows/build-bluebuild.yml'
|
|
pull_request:
|
|
branches: [main, v0.7-bluebuild-spike]
|
|
schedule:
|
|
# Rebuild weekly so we pick up upstream secureblue + Fedora updates.
|
|
- cron: '0 6 * * 1'
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
name: Build + sign + push OCI
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 30
|
|
permissions:
|
|
contents: read
|
|
packages: write # push to ghcr.io/veilor-org/veilor-os
|
|
id-token: write # cosign keyless signing via Sigstore
|
|
attestations: write # SLSA build provenance
|
|
|
|
env:
|
|
OCI_IMAGE: ghcr.io/${{ github.repository_owner }}/veilor-os
|
|
OCI_TAG: latest
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Free up disk
|
|
run: |
|
|
sudo rm -rf /opt/hostedtoolcache /usr/share/dotnet /usr/local/lib/android
|
|
sudo apt-get clean
|
|
df -h
|
|
|
|
# BlueBuild action wraps: image build, cosign sign (keyless via
|
|
# Sigstore), GHCR push. To pin to a commit SHA in a follow-up
|
|
# once the workflow shape stabilises (CI hardening agent 8,
|
|
# 2026-05-05 wave).
|
|
- name: Build + push veilor-os OCI
|
|
id: bluebuild
|
|
uses: blue-build/github-action@v1
|
|
with:
|
|
recipe: bluebuild/recipe.yml
|
|
registry_token: ${{ secrets.GITHUB_TOKEN }}
|
|
pr_event_number: ${{ github.event.number }}
|
|
maximize_build_space: true
|
|
|
|
- name: Smoke-test OCI image
|
|
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
|
|
run: |
|
|
podman pull "$OCI_IMAGE:$OCI_TAG"
|
|
podman run --rm "$OCI_IMAGE:$OCI_TAG" /bin/bash -c '
|
|
set -e
|
|
echo "-- os-release"
|
|
head -5 /etc/os-release
|
|
echo "-- sudo present"; which sudo
|
|
echo "-- mullvad-browser present"; which mullvad-browser
|
|
echo "-- yggdrasil present"; which yggdrasil
|
|
echo "-- tailscale present"; which tailscale
|
|
'
|
|
|
|
- name: SBOM (SPDX)
|
|
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
|
|
uses: anchore/sbom-action@v0
|
|
with:
|
|
image: ${{ env.OCI_IMAGE }}:${{ env.OCI_TAG }}
|
|
format: spdx-json
|
|
output-file: veilor-os-oci.spdx.json
|
|
|
|
- name: Build provenance attestation
|
|
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
|
|
uses: actions/attest-build-provenance@v2
|
|
with:
|
|
subject-name: ${{ env.OCI_IMAGE }}
|
|
subject-digest: ${{ steps.bluebuild.outputs.digest }}
|