[Draft] Migrate to mkosi + sysupdate

.github/workflows/daily-9.0.yml → .github/workflows/monthly-image-9.0.yml

@@ -1,11 +1,11 @@
-name: Daily OS 9
+name: Monthly Image-based OS 9
 
 on:
   push:
     branches:
       - main
   schedule:
-    - cron: "0 0 * * *"
+    - cron: "0 0 1 * *"
   workflow_dispatch: {}
 
 jobs:
@@ -30,6 +30,10 @@ jobs:
     - name: Clone build scripts
       uses: actions/checkout@v7
 
-    - name: Build and upload daily .iso
+    - name: Build
       run: |
-        ./workflows.sh etc/terraform-daily-9.0-azure-${{ matrix.arch }}.conf "${{ secrets.key }}" "${{ secrets.secret }}" "${{ secrets.endpoint }}" "${{ secrets.bucket }}"
+        ./build.sh etc/terraform-daily-9.0-azure-${{ matrix.arch }}.conf
+
+    - name: Upload
+      run: |
+        ./upload.sh "${{ secrets.key }}" "${{ secrets.secret }}" "${{ secrets.endpoint }}" "${{ secrets.bucket }}" "${{ secrets.install_bucket }}"

.github/workflows/release.yaml

@@ -0,0 +1,65 @@
+name: Build and Release DDI (Elementary OS 9)
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build-and-release:
+    name: Build Image and Release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Maximize build space
+        uses: ublue-os/remove-unwanted-software@v8
+
+      - name: Install mkosi
+        uses: systemd/mkosi@v26
+
+      - name: Generate key
+        run: mkosi genkey
+
+      - name: Build image with mkosi
+        run: |
+          sudo mkosi -B --debug --force --profile=elementaryos
+
+      - name: Update permissions
+        run: sudo chown -R $USER:$USER mkosi.output
+
+      - name: Compress (xz7) usr.raw
+        run: |
+          find mkosi.output -type f -name "*.usr-*.raw" ! -name "*verity*" -exec xz -7v -T0 {} +
+
+      - name: Generate SHA256SUMS
+        run: |
+          cd mkosi.output
+          sha256sum *.efi *.usr-*.raw.xz *.usr-*-verity*.raw *.usr-*-verity-sig*.raw > SHA256SUMS
+
+          echo "Generated SHA256SUMS:"
+          cat SHA256SUMS
+
+      - name: Extract Date
+        id: get_date
+        run: |
+          FILE_PATH=$(ls mkosi.output/Elementary_*.raw | head -n 1)
+          FILE_NAME=$(basename "$FILE_PATH")
+          TIMESTAMP=$(echo "$FILE_NAME" | sed 's/^Elementary_//;s/\..*//')
+
+          echo "RELEASE_TAG=os9-$TIMESTAMP" >> "$GITHUB_OUTPUT"
+          echo "Generated tag: os9-$TIMESTAMP"
+
+      - name: Create Release and Upload Artifacts
+        uses: softprops/action-gh-release@v3
+        with:
+          tag_name: ${{ steps.get_date.outputs.RELEASE_TAG }}
+          name: Release ${{ steps.get_date.outputs.RELEASE_TAG }}
+          files: |
+            mkosi.output/*.efi
+            mkosi.output/*.usr-*.raw.xz
+            mkosi.output/*.usr-*-verity*.raw
+            mkosi.output/*.usr-*-verity-sig*.raw
+            mkosi.output/SHA256SUMS

.gitignore

@@ -1,5 +1,20 @@
-.DS_Store
-tmp
-artifacts
-builds
-*~
+cosign.key
+**/cosign.key
+cache
+_build_*
+output
+_build-*/**
+*.img
+*.raw
+mkosi.local/
+mkosi.local.conf
+mkosi.output/
+mkosi.cache/
+mkosi.tools/
+mkosi.tools.manifest
+mkosi.key
+mkosi.crt
+mkosi.version
+mkosi.rootpw
+.mkosi-private
+*.efi

Justfile

@@ -0,0 +1,57 @@
+# resize:
+#     qemu-img resize ./mkosi.output/Elementary_x86-64.raw +40G
+
+default:
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    just build-sysupdate
+
+build-sysupdate:
+    rm -rf mkosi.output/
+    just run-in-podman mkosi -B --debug --force --profile=elementaryos --profile=sysexts --workspace-directory=/workspace
+    sudo chown -R {{env_var('USER')}}:{{env_var('USER')}} ./mkosi.output/
+
+genkey:
+    just run-in-podman mkosi genkey
+
+run-in-podman +command:
+    mkdir -p {{env_var('HOME')}}/.cache/mkosi-workspace
+
+    sudo podman run --rm -it \
+        --privileged \
+        --security-opt label=disable \
+        -v /dev:/dev \
+        -v "{{invocation_directory()}}:/work" \
+        -w /work \
+        -v "{{env_var('HOME')}}/.cache/mkosi-workspace:/workspace" \
+        ghcr.io/jumpyvi/mkosi-debian:26 \
+        {{command}}
+
+build-iso:
+    rm -rf mkosi.output/ && \
+    just run-in-podman mkosi -B --debug --force --profile=liveiso --workspace-directory=/workspace && \
+    sudo chown -R {{env_var('USER')}}:{{env_var('USER')}} ./mkosi.output/
+
+
+flash:
+    #!/bin/bash
+    read -p "Enter .raw image path: " raw_img
+    read -p "Enter destination (/dev/sdX): " dest_dev
+
+    sudo systemd-repart --copy-from "$raw_img" --definitions=./mkosi.profiles/liveiso/mkosi.extra/etc/repart-config/ --dry-run=no --empty=force "$dest_dev"
+
+clean:
+    just run-in-podman mkosi clean
+    sudo rm -r mkosi.tools/ mkosi.cache/
+
+sign-repo:
+    #!/usr/bin/env bash
+    cd mkosi.output
+    echo "Repo will not be signed, use verify=no."
+    echo "Generating SHA256..."
+    sha256sum Elementary_*.usr-x86-64-verity-sig.*.raw \
+          Elementary_*.usr-x86-64-verity.*.raw \
+          Elementary_*.usr-x86-64.*.raw \
+          Elementary_*.efi \
+          > SHA256SUMS
+    cd ..