3c247bc601
Initial scaffold for the v0.7 hybrid path. Spike branch only — does
NOT land in main until success criteria pass (see bluebuild/README.md).
## What this commits
- bluebuild/recipe.yml — BlueBuild recipe extending
ghcr.io/secureblue/securecore-kinoite-hardened-userns:latest with:
* veilor branding overlay (overlay/, assets/, scripts/ at /usr/share/veilor-os)
* sudo restored (revert secureblue's run0-only)
* Xwayland restored (some apps still need it)
* mullvad-browser layered alongside Trivalent (default browser kept)
* tailscale + yggdrasil packages (mesh stack layers 1 + 2)
* tailscaled.service pre-disabled (awaits first-boot prompt)
* yggdrasil.service enabled (idle warm-fallback per STRATEGY.md)
* veilor-firstboot.service + veilor-modules-lock.service enabled
* cosign signing module configured
- bluebuild/config/just/60-veilor.just — ujust recipes:
* install-reticulum (RetiNet AGPL fork — mesh layer 3)
* install-reticulum-rnode (LoRa hardware)
* install-thorium (opt-in browser with explicit CVE-lag warning)
* veilor-mesh-join (token paste / QR for tailscale onboarding)
- bluebuild/README.md — spike doc + smoke-test commands + 5-item
success criteria checklist
- kickstart/install-ostreecontainer.ks — install kickstart template
for the v0.7 path. No %packages block; uses
`ostreecontainer --url=ghcr.io/veilor-org/veilor-os:43 --transport=registry`
to populate / from the OCI image directly during anaconda's install
pass. No first-boot rebase, no transition window. Keeps existing
LUKS+btrfs partitioning verbatim.
- .github/workflows/build-bluebuild.yml — GH Actions workflow:
* Triggered on push to v0.7-bluebuild-spike, weekly cron, dispatch
* Uses blue-build/github-action@v1 (TODO: pin to commit SHA per
CI hardening agent 8 follow-up)
* Builds + cosign-signs (keyless via Sigstore) + pushes to GHCR
* Smoke-tests the OCI image (sudo, mullvad-browser, yggdrasil,
tailscale all present)
* Generates SBOM (SPDX) via anchore/sbom-action
* Publishes SLSA build provenance attestation
## What this does NOT change
- main branch is untouched. v0.5.x kickstart path keeps shipping.
- kickstart/veilor-os.ks (the live-ISO ks) is untouched — the v0.7
hybrid uses the existing live-ISO build path; only the install-time
ks (install-ostreecontainer.ks) is new.
- overlay/, scripts/, assets/ are untouched on this branch — the
recipe pulls them in via `type: files` modules at build time.
## Spike success criteria (reproduced from bluebuild/README.md)
- [ ] `bluebuild build recipe.yml` exits 0
- [ ] `bootc container lint` exits 0 on resulting image
- [ ] `podman run` smoke-test passes
- [ ] CI workflow builds + cosign-signs + pushes to GHCR
- [ ] Installer ISO using `ostreecontainer` against this OCI reaches
SDDM with admin login on first boot
If all 5 land, merge v0.7-bluebuild-spike → main as v0.7.0.
## Reference
- docs/STRATEGY.md (full plan)
- docs/ROADMAP.md v0.7 (schedule)
- docs/THREAT-MODEL.md (publish before v0.7 ship)
- secureblue: https://github.com/secureblue/secureblue
- BlueBuild: https://blue-build.org
- ostreecontainer: https://docs.fedoraproject.org/en-US/bootc/anaconda-install/
73 lines
No EOL
3.2 KiB
Text
73 lines
No EOL
3.2 KiB
Text
# veilor-os ujust recipes — opt-in components
|
|
# Loaded into /usr/share/ublue-os/just/ at image build time;
|
|
# `ujust install-X` discovers + dispatches.
|
|
|
|
# install Reticulum / RetiNet AGPL fork + Sideband (mesh layer 3)
|
|
install-reticulum:
|
|
#!/usr/bin/env bash
|
|
echo "═══ Reticulum (RetiNet AGPL fork) install ═══"
|
|
echo
|
|
echo "Installs RetiNet (AGPL fork — NOT upstream RNS due to anti-AI"
|
|
echo "license) plus Sideband messenger. Default config: AutoInterface"
|
|
echo "(LAN multicast) + 1-2 TCP backbone peers. RNode hardware (LoRa"
|
|
echo "transceiver) is a separate install."
|
|
echo
|
|
read -p "Proceed? [y/N]: " confirm
|
|
if [[ "$confirm" != "y" ]]; then echo "Cancelled."; exit 0; fi
|
|
rpm-ostree install python3-pip
|
|
pip install --user retinet sideband-cli
|
|
echo
|
|
echo "Done. To attach an RNode (LoRa transceiver), run:"
|
|
echo " ujust install-reticulum-rnode"
|
|
|
|
# install Reticulum RNode hardware support (LoRa transceiver)
|
|
install-reticulum-rnode:
|
|
#!/usr/bin/env bash
|
|
echo "═══ RNode (LoRa transceiver) hardware install ═══"
|
|
echo
|
|
echo "Adds RNode firmware-update tooling + udev rules for the LoRa"
|
|
echo "USB hardware. Required only if you have an RNode device."
|
|
echo
|
|
read -p "Proceed? [y/N]: " confirm
|
|
if [[ "$confirm" != "y" ]]; then echo "Cancelled."; exit 0; fi
|
|
pip install --user rnodeconf
|
|
echo "Done. Plug in your RNode via USB; it will appear as a serial device."
|
|
|
|
# install Thorium browser (OPT-IN, with explicit CVE-lag warning)
|
|
install-thorium:
|
|
#!/usr/bin/env bash
|
|
echo "═══ Thorium browser install ═══"
|
|
echo
|
|
echo "WARNING: Thorium is a perf/media-focused fork of Chromium that"
|
|
echo "uses LTS Chromium as its base. As of 2026-05 it lags upstream"
|
|
echo "stable by ~9 milestones (months of CVE backlog)."
|
|
echo
|
|
echo "veilor-os ships Trivalent (secureblue's hardened Chromium fork,"
|
|
echo "tracking upstream M147+ within hours) as the default browser."
|
|
echo "Thorium is provided as an OPT-IN profile for users who"
|
|
echo "explicitly need its perf characteristics (e.g. WebGL games,"
|
|
echo "media decode profiles)."
|
|
echo
|
|
echo "DO NOT use Thorium as your daily-driver browser. Use Trivalent"
|
|
echo "or Mullvad Browser for that."
|
|
echo
|
|
read -p "Acknowledge CVE-lag risk and continue? [y/N]: " confirm
|
|
if [[ "$confirm" != "y" ]]; then echo "Cancelled."; exit 0; fi
|
|
flatpak install --user -y org.thorium.Thorium 2>/dev/null || \
|
|
rpm-ostree install thorium-browser
|
|
echo "Done. Launch via Plasma menu or `flatpak run org.thorium.Thorium`."
|
|
|
|
# join the veilor mesh (Tailscale via Headscale)
|
|
veilor-mesh-join:
|
|
#!/usr/bin/env bash
|
|
echo "═══ Join veilor mesh (Tailscale via Headscale) ═══"
|
|
echo
|
|
echo "Pre-auth keys are minted by the Misskey signup page at"
|
|
echo "x.veilor (TTL 24h, single-use). You can paste the hex key"
|
|
echo "directly OR scan the QR code shown after signup."
|
|
echo
|
|
read -p "Hex key (paste): " preauth
|
|
if [[ -z "$preauth" ]]; then echo "Empty key. Cancelled."; exit 0; fi
|
|
sudo systemctl enable --now tailscaled
|
|
sudo tailscale up --login-server=https://hs.s8n.ru --auth-key="$preauth"
|
|
echo "Done. Status: $(sudo tailscale status | head -1)" |