d543e71f74
* v0.5.1 build: vendor gum binary + graft /veilor/ onto ISO - gum 0.17.0 pinned by sha256, downloaded into overlay/usr/local/bin/ so installer can use Charm.sh TUI primitives. - After livecd-creator produces ISO, extract+re-pack with /veilor/ containing overlay+scripts+assets so installer-generated ks can copy them into target system at install time. * fix: extract original ISO boot stanza programmatically (no hardcoded paths) Reviewer found `-e images/efiboot.img` was wrong — Fedora livecd-creator places efiboot.img in isolinux/ not images/. Plus missing --mbr-force-bootable + -partition_* flags would produce hybrid MBR/GPT mismatch refused by some BIOS firmwares. Fix: extract original ISO's exact boot stanza via `xorriso -report_el_torito as_mkisofs` and replay it via eval. Guarantees exact match, immune to upstream Fedora layout changes. --------- Co-authored-by: veilor-org <admin@veilor.org>
193 lines
7.6 KiB
YAML
193 lines
7.6 KiB
YAML
name: Build veilor-os ISO
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'kickstart/**'
|
|
- 'overlay/**'
|
|
- 'scripts/**'
|
|
- 'assets/**'
|
|
- 'build/**'
|
|
- '.github/workflows/build-iso.yml'
|
|
workflow_dispatch:
|
|
inputs:
|
|
releasever:
|
|
description: 'Fedora release version'
|
|
required: false
|
|
default: '43'
|
|
release:
|
|
types: [published]
|
|
|
|
jobs:
|
|
build:
|
|
name: Build live ISO
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 90
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Free up disk
|
|
run: |
|
|
sudo rm -rf /opt/hostedtoolcache /usr/share/dotnet /usr/local/lib/android /usr/local/share/boost
|
|
sudo apt-get clean
|
|
df -h
|
|
|
|
- name: Run build inside Fedora 43 container
|
|
uses: addnab/docker-run-action@v3
|
|
with:
|
|
image: registry.fedoraproject.org/fedora:43
|
|
options: |
|
|
--privileged
|
|
-v ${{ github.workspace }}:/work
|
|
-v /dev:/dev
|
|
--tmpfs /tmp:rw,nosuid,nodev,exec,size=16G
|
|
run: |
|
|
set -euxo pipefail
|
|
|
|
# Update Fedora image to latest packages — guarantees pcre2 +
|
|
# libselinux + selinux-policy are matched (the local build's
|
|
# core problem). CI runners always start fresh, no version skew.
|
|
dnf -y upgrade --refresh
|
|
|
|
# Install build tooling
|
|
dnf -y install \
|
|
lorax \
|
|
livecd-tools \
|
|
pykickstart \
|
|
python3-imgcreate \
|
|
anaconda-tui \
|
|
squashfs-tools \
|
|
xorriso \
|
|
createrepo_c \
|
|
git \
|
|
which \
|
|
shadow-utils \
|
|
syslinux \
|
|
tar \
|
|
curl
|
|
|
|
# Vendor gum binary onto the ISO so the TTY1 installer can use
|
|
# Charm.sh TUI primitives. gum is not packaged in Fedora repos,
|
|
# so pull the upstream release tarball pinned by sha256.
|
|
GUM_VERSION="0.17.0"
|
|
GUM_URL="https://github.com/charmbracelet/gum/releases/download/v${GUM_VERSION}/gum_${GUM_VERSION}_Linux_x86_64.tar.gz"
|
|
GUM_SHA256="69ee169bd6387331928864e94d47ed01ef649fbfe875baed1bbf27b5377a6fdb"
|
|
mkdir -p /work/overlay/usr/local/bin
|
|
curl -fsSL "$GUM_URL" -o /tmp/gum.tgz
|
|
echo "$GUM_SHA256 /tmp/gum.tgz" | sha256sum -c -
|
|
tar -xzf /tmp/gum.tgz -C /tmp/
|
|
install -m 0755 "/tmp/gum_${GUM_VERSION}_Linux_x86_64/gum" /work/overlay/usr/local/bin/gum
|
|
/work/overlay/usr/local/bin/gum --version
|
|
echo "[OK] gum ${GUM_VERSION} vendored into overlay/usr/local/bin/"
|
|
|
|
cd /work
|
|
|
|
# PATCH: livecd-creator bug — __get_efi_image_stanza writes
|
|
# `root=live:LABEL=...` instead of `live:CDLABEL=...` for dracut.
|
|
# Result: dracut hangs on parse-livenet looking for non-CD label.
|
|
# Fix in-place before running build.
|
|
LIVE_PY=$(python3 -c 'import imgcreate, os; print(os.path.dirname(imgcreate.__file__))')/live.py
|
|
sed -i 's|"live:LABEL=%(fslabel)s"|"live:CDLABEL=%(fslabel)s"|g' "$LIVE_PY"
|
|
grep -n 'CDLABEL=%(fslabel)s' "$LIVE_PY" || { echo "[ERR] patch failed"; exit 1; }
|
|
echo "[OK] livecd-creator patched: LABEL= → CDLABEL= for EFI dracut stanza"
|
|
|
|
# CI uses ks-ci.ks (no local fix-repo line). Generated from main ks.
|
|
# Also strip flags livecd-creator doesn't recognize.
|
|
sed -e '/veilor-fix/d' \
|
|
-e '/^shutdown$/d' \
|
|
kickstart/veilor-os.ks > kickstart/veilor-os-ci.ks
|
|
|
|
ksvalidator kickstart/veilor-os-ci.ks
|
|
mkdir -p build/out
|
|
|
|
# livecd-creator (livecd-tools) — purpose-built for live ISOs.
|
|
# Handles EFI/BOOT + isohybrid + grafting that livemedia-creator
|
|
# --make-iso --no-virt does not. Produces UEFI+BIOS bootable ISO.
|
|
# --tmpdir /var/lmc to avoid GitHub Actions /tmp tmpfs constraints.
|
|
# /var on the runner is the host's ext4 (~80GB free post-disk-cleanup).
|
|
mkdir -p /var/lmc /var/lmc-cache
|
|
livecd-creator \
|
|
--verbose \
|
|
--config kickstart/veilor-os-ci.ks \
|
|
--fslabel "veilor-os-43" \
|
|
--title "veilor-os" \
|
|
--product "veilor-os" \
|
|
--releasever "${{ github.event.inputs.releasever || '43' }}" \
|
|
--tmpdir /var/lmc \
|
|
--cache /var/lmc-cache 2>&1 | tee build/out/build.log
|
|
|
|
# Graft veilor source tree onto the ISO so the installer-generated
|
|
# kickstart's `%post --nochroot` can find SRC at
|
|
# /run/install/repo/veilor/{overlay,scripts,assets}/ when the user
|
|
# promotes the live ISO into a real install.
|
|
ISO_FILE=$(ls /work/*.iso 2>/dev/null | head -1)
|
|
[ -n "$ISO_FILE" ] || { echo "[ERR] no ISO produced by livecd-creator"; exit 1; }
|
|
echo "[INFO] grafting /veilor/ onto $ISO_FILE"
|
|
|
|
# Extract original ISO's exact boot stanza so the rebuild matches
|
|
# livecd-creator's layout byte-for-byte. This is immune to upstream
|
|
# Fedora layout changes (e.g. images/ vs isolinux/ for efiboot.img,
|
|
# partition geometry flags, hybrid MBR/GPT options).
|
|
xorriso -indev "$ISO_FILE" -report_el_torito as_mkisofs 2>&1 | tee /tmp/iso-boot.txt || true
|
|
ORIG_FLAGS=$(xorriso -indev "$ISO_FILE" -report_el_torito as_mkisofs 2>/dev/null | \
|
|
grep -v '^xorriso :' | grep -E '^-' | tr '\n' ' ')
|
|
[ -n "$ORIG_FLAGS" ] || { echo "[ERR] could not extract boot stanza from $ISO_FILE"; exit 1; }
|
|
echo "[INFO] re-pack flags from original ISO: $ORIG_FLAGS"
|
|
|
|
mkdir -p /tmp/iso-mod
|
|
xorriso -osirrox on -indev "$ISO_FILE" -extract / /tmp/iso-mod
|
|
chmod -R u+w /tmp/iso-mod
|
|
mkdir -p /tmp/iso-mod/veilor
|
|
cp -a /work/overlay /work/scripts /work/assets /tmp/iso-mod/veilor/
|
|
|
|
# Replay the exact stanza captured above. eval is needed because
|
|
# ORIG_FLAGS contains multiple flag/value pairs that must word-split.
|
|
eval xorriso -as mkisofs \
|
|
-volid "veilor-os-43" \
|
|
$ORIG_FLAGS \
|
|
-o "${ISO_FILE}.tmp" /tmp/iso-mod
|
|
mv "${ISO_FILE}.tmp" "$ISO_FILE"
|
|
rm -rf /tmp/iso-mod
|
|
echo "[OK] /veilor/ grafted onto $ISO_FILE"
|
|
|
|
# Move output ISO to expected dir
|
|
mv ./veilor-os-43.iso build/out/ 2>/dev/null || mv ./*.iso build/out/ 2>/dev/null || true
|
|
|
|
# Rename + checksum
|
|
ISO_NAME="veilor-os-${{ github.event.inputs.releasever || '43' }}-$(date +%Y%m%d-%H%M%S).iso"
|
|
cd build/out
|
|
for f in *.iso; do
|
|
[[ -f $f && $f != $ISO_NAME ]] && mv "$f" "$ISO_NAME"
|
|
done
|
|
sha256sum "$ISO_NAME" > "$ISO_NAME.sha256"
|
|
ls -lh "$ISO_NAME"
|
|
|
|
- name: Upload ISO artifact
|
|
if: success()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: veilor-os-iso
|
|
path: |
|
|
build/out/*.iso
|
|
build/out/*.sha256
|
|
retention-days: 14
|
|
|
|
- name: Upload build log on failure
|
|
if: failure()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: veilor-os-buildlog
|
|
path: |
|
|
build/out/build.log
|
|
build/out/build/anaconda/
|
|
|
|
- name: Attach to release
|
|
if: github.event_name == 'release'
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
files: |
|
|
build/out/*.iso
|
|
build/out/*.sha256
|