VM image: one file, named like the ISO
The image was a folder, vm/, holding base.qcow2 and what boots it. It is now one file next to the ISO, with the ISO's name and its own checksum file, the way Ubuntu, Debian, Arch, Fedora and CentOS publish theirs: edge/<version>/omarchy-edge-<version>.qcow2 stable/<version>/<run>/omarchy-<version>.qcow2 The image boots by itself through UEFI. What a direct boot needs, the kernel, initramfs, kernel arguments and vm-boot, is in an unpacked/ folder beside it, Ubuntu's name for the same thing. The firmware variables are no longer published: a boot with the firmware's defaults finds the disk. latest.json follows: vm.url, vm.sha256 and vm.size are the image, as url, sha256 and size are the ISO; vm.unpacked and vm.unpacked_files are the folder. vm-boot takes the image file. The publish job compares every file it uploaded, whatever the layout. README, tests and the workflow's header say the same.
This commit is contained in:
Emir Beganovic committed
1 parent
2b8d012688
commit
f9d184f2bc
6 files changed
+136
-90
No files matched your search
+18
-11
@@ -58,7 +58,7 @@ refused "a date in another form" "$plan" 2026-10-09 431 1 schedule v4.0.4 ""
|
||||
sealed() { # directory: what vm-seal leaves
|
||||
rm -rf "$1"; mkdir -p "$1"
|
||||
local file
|
||||
for file in base.qcow2 OVMF_VARS.4m.fd vmlinuz initrd cmdline; do echo "$file of ${1##*/}" >"$1/$file"; done
|
||||
for file in base.qcow2 vmlinuz initrd cmdline; do echo "$file of ${1##*/}" >"$1/$file"; done
|
||||
echo "sums of the seal" >"$1/SHA256SUMS"
|
||||
}
|
||||
export SITE=https://nightly.example ISO_SITE=https://iso.example ISO_COMMIT=0123456789abcdef0123456789abcdef01234567
|
||||
@@ -77,12 +77,14 @@ dir=$tmp/out/edge/2026.10.09.431
|
||||
field() { jq -r "$1" "$json"; }
|
||||
|
||||
equal "edge: files published" "$(cd "$tmp/out" && find . -type f | sort | paste -sd' ')" \
|
||||
"./edge/2026.10.09.431/omarchy-edge-2026.10.09.431.iso ./edge/2026.10.09.431/omarchy-edge-2026.10.09.431.iso.sha256 ./edge/2026.10.09.431/vm/OVMF_VARS.4m.fd ./edge/2026.10.09.431/vm/SHA256SUMS ./edge/2026.10.09.431/vm/base.qcow2 ./edge/2026.10.09.431/vm/cmdline ./edge/2026.10.09.431/vm/initrd ./edge/2026.10.09.431/vm/vm-boot ./edge/2026.10.09.431/vm/vmlinuz ./edge/latest.json"
|
||||
(cd "$dir" && sha256sum -c --quiet ./*.sha256) || fail "edge: the ISO's checksum file does not match the ISO"
|
||||
(cd "$dir/vm" && sha256sum -c --quiet SHA256SUMS) || fail "edge: SHA256SUMS does not match the image"
|
||||
"./edge/2026.10.09.431/omarchy-edge-2026.10.09.431.iso ./edge/2026.10.09.431/omarchy-edge-2026.10.09.431.iso.sha256 ./edge/2026.10.09.431/omarchy-edge-2026.10.09.431.qcow2 ./edge/2026.10.09.431/omarchy-edge-2026.10.09.431.qcow2.sha256 ./edge/2026.10.09.431/unpacked/SHA256SUMS ./edge/2026.10.09.431/unpacked/cmdline ./edge/2026.10.09.431/unpacked/initrd ./edge/2026.10.09.431/unpacked/vm-boot ./edge/2026.10.09.431/unpacked/vmlinuz ./edge/latest.json"
|
||||
(cd "$dir" && sha256sum -c --quiet ./*.sha256) || fail "edge: a checksum file does not match the file it is for"
|
||||
equal "edge: the ISO and the image each have a checksum file" "$(cd "$dir" && ls ./*.sha256 | wc -l)" "2"
|
||||
equal "edge: the image is the sealed disk" "$(cat "$dir/omarchy-edge-2026.10.09.431.qcow2")" "base.qcow2 of sealed-edge"
|
||||
(cd "$dir/unpacked" && sha256sum -c --quiet SHA256SUMS) || fail "edge: SHA256SUMS does not match the unpacked files"
|
||||
equal "edge: SHA256SUMS covers every file beside it" \
|
||||
"$(awk '{ print $2 }' "$dir/vm/SHA256SUMS" | sort | paste -sd' ')" "$(cd "$dir/vm" && ls | grep -v SHA256SUMS | sort | paste -sd' ')"
|
||||
cmp -s "$dir/vm/vm-boot" "$ROOT/test/vm-image/vm-boot" || fail "edge: the published vm-boot is not the repository's"
|
||||
"$(awk '{ print $2 }' "$dir/unpacked/SHA256SUMS" | sort | paste -sd' ')" "$(cd "$dir/unpacked" && ls | grep -v SHA256SUMS | sort | paste -sd' ')"
|
||||
cmp -s "$dir/unpacked/vm-boot" "$ROOT/test/vm-image/vm-boot" || fail "edge: the published vm-boot is not the repository's"
|
||||
equal "edge: version" "$(field .version)" "2026.10.09.431"
|
||||
equal "edge: channel" "$(field .channel)" "edge"
|
||||
equal "edge: url" "$(field .url)" "https://nightly.example/edge/2026.10.09.431/omarchy-edge-2026.10.09.431.iso"
|
||||
@@ -92,9 +94,12 @@ equal "edge: iso_commit" "$(field .iso_commit)" "$ISO_COMMIT"
|
||||
equal "edge: omarchy_version, once" "$(field .omarchy_version)" "4.0.0.r6818.gc352b62-2"
|
||||
equal "edge: omarchy_commit" "$(field .omarchy_commit)" "c352b62"
|
||||
equal "edge: kernel" "$(field .kernel)" "7.2.8-5-omarchy-bore"
|
||||
equal "edge: image address" "$(field .vm.disk)" "https://nightly.example/edge/2026.10.09.431/vm/base.qcow2"
|
||||
equal "edge: image checksum is the disk's" "$(field .vm.disk_sha256)" "$(sha256sum "$dir/vm/base.qcow2" | cut -d' ' -f1)"
|
||||
equal "edge: every listed file is published" "$(field '.vm.files[]' | sort | paste -sd' ')" "$(cd "$dir/vm" && ls | sort | paste -sd' ')"
|
||||
equal "edge: image address" "$(field .vm.url)" "https://nightly.example/edge/2026.10.09.431/omarchy-edge-2026.10.09.431.qcow2"
|
||||
equal "edge: image checksum is the image's" "$(field .vm.sha256)" "$(sha256sum "$dir/omarchy-edge-2026.10.09.431.qcow2" | cut -d' ' -f1)"
|
||||
equal "edge: image size is the image's" "$(field .vm.size)" "$(stat -c %s "$dir/omarchy-edge-2026.10.09.431.qcow2")"
|
||||
equal "edge: the ISO and the image differ only in their ending" "$(field .url | sed 's/\.iso$//')" "$(field .vm.url | sed 's/\.qcow2$//')"
|
||||
equal "edge: unpacked folder" "$(field .vm.unpacked)" "https://nightly.example/edge/2026.10.09.431/unpacked/"
|
||||
equal "edge: every unpacked file listed is published" "$(field '.vm.unpacked_files[]' | sort | paste -sd' ')" "$(cd "$dir/unpacked" && ls | sort | paste -sd' ')"
|
||||
[[ $(field .built_at) =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9:]{8}Z$ ]] || fail "edge: built_at is '$(field .built_at)'"
|
||||
# What a consumer does with the ISO's name: the first run of three or more
|
||||
# dotted numbers is the version.
|
||||
@@ -115,8 +120,10 @@ equal "stable: sha256 is the ISO's" "$(field .sha256)" "$(sha256sum "$tmp/releas
|
||||
equal "stable: version" "$(field .version)" "4.0.4"
|
||||
equal "stable: omarchy_version" "$(field .omarchy_version)" "4.0.4-1"
|
||||
equal "stable: a release names no commit" "$(field .omarchy_commit)" ""
|
||||
equal "stable: image address has the run number" "$(field .vm.disk)" "https://nightly.example/stable/4.0.4/431/vm/base.qcow2"
|
||||
(cd "$tmp/out/stable/4.0.4/431/vm" && sha256sum -c --quiet SHA256SUMS) || fail "stable: SHA256SUMS does not match the image"
|
||||
equal "stable: image address has the run number" "$(field .vm.url)" "https://nightly.example/stable/4.0.4/431/omarchy-4.0.4.qcow2"
|
||||
equal "stable: unpacked folder" "$(field .vm.unpacked)" "https://nightly.example/stable/4.0.4/431/unpacked/"
|
||||
(cd "$tmp/out/stable/4.0.4/431" && sha256sum -c --quiet omarchy-4.0.4.qcow2.sha256) || fail "stable: the image's checksum file does not match it"
|
||||
(cd "$tmp/out/stable/4.0.4/431/unpacked" && sha256sum -c --quiet SHA256SUMS) || fail "stable: SHA256SUMS does not match the unpacked files"
|
||||
|
||||
# Nothing half-made is described.
|
||||
sealed "$tmp/sealed-short"; rm "$tmp/sealed-short/initrd"
|
||||
|
||||
@@ -13,14 +13,21 @@
|
||||
# Env: SITE (https://nightly.omarchy.org), ISO_SITE (https://iso.omarchy.org),
|
||||
# ISO_COMMIT (the omarchy-iso commit, default: HEAD of this checkout).
|
||||
#
|
||||
# out_dir gets <release>/vm/ with the image, its checksums and vm-boot, and
|
||||
# <channel>/latest.json. The edge ISO is published too, next to the image.
|
||||
# The released one already has its place: latest.json points there and the
|
||||
# ISO stays where it is.
|
||||
# out_dir gets, under <release>/:
|
||||
#
|
||||
# omarchy-<...>.qcow2 and .qcow2.sha256 the VM image: one file, which boots
|
||||
# by itself through UEFI
|
||||
# unpacked/ its kernel, initramfs and kernel
|
||||
# arguments for booting it directly,
|
||||
# vm-boot, and their SHA256SUMS
|
||||
# omarchy-edge-<version>.iso and .sha256 edge only
|
||||
#
|
||||
# and <channel>/latest.json. The released ISO already has its place:
|
||||
# latest.json points there and the ISO stays where it is.
|
||||
#
|
||||
# The ISO and the image are moved, not copied: they are gigabytes.
|
||||
set -euo pipefail
|
||||
[[ $# -eq 7 ]] || { sed -n '2,13p' "$0" >&2; exit 2; }
|
||||
[[ $# -eq 7 ]] || { sed -n '2,12p' "$0" >&2; exit 2; }
|
||||
channel=$1 version=$2 release=$3 iso_file=$4 sealed=$5 packages=$6 out=$7
|
||||
here=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
|
||||
site=${SITE:-https://nightly.omarchy.org}
|
||||
@@ -30,8 +37,8 @@ fail() { echo "nightly-layout: $*" >&2; exit 1; }
|
||||
|
||||
[[ $channel == edge || $channel == stable ]] || fail "'$channel' is not a channel"
|
||||
[[ -f $iso_file ]] || fail "no ISO at $iso_file"
|
||||
files=(base.qcow2 OVMF_VARS.4m.fd vmlinuz initrd cmdline)
|
||||
for file in "${files[@]}"; do
|
||||
unpacked=(vmlinuz initrd cmdline)
|
||||
for file in base.qcow2 "${unpacked[@]}"; do
|
||||
[[ -s $sealed/$file ]] || fail "the sealed image has no $file"
|
||||
done
|
||||
|
||||
@@ -43,46 +50,52 @@ kernel=$(tail -n 1 "$packages")
|
||||
omarchy_commit=$(sed -nE 's/.*\.g([0-9a-f]+)-.*/\1/p' <<<"$omarchy")
|
||||
|
||||
dir=$out/$release
|
||||
mkdir -p "$dir/vm" "$out/$channel"
|
||||
mkdir -p "$dir/unpacked" "$out/$channel"
|
||||
if [[ $channel == edge ]]; then
|
||||
iso=omarchy-$channel-$version.iso
|
||||
name=omarchy-$channel-$version
|
||||
iso=$name.iso
|
||||
iso_url=$site/$release/$iso
|
||||
mv "$iso_file" "$dir/$iso"
|
||||
(cd "$dir" && sha256sum "$iso" >"$iso.sha256")
|
||||
iso_sha256=$(cut -d' ' -f1 "$dir/$iso.sha256") iso_size=$(stat -c %s "$dir/$iso")
|
||||
else
|
||||
iso=omarchy-$version.iso
|
||||
name=omarchy-$version
|
||||
iso=$name.iso
|
||||
[[ ${iso_file##*/} == "$iso" ]] || fail "the released ISO is $iso, not ${iso_file##*/}"
|
||||
iso_url=$iso_site/$iso
|
||||
iso_sha256=$(sha256sum "$iso_file" | cut -d' ' -f1) iso_size=$(stat -c %s "$iso_file")
|
||||
fi
|
||||
|
||||
for file in "${files[@]}"; do mv "$sealed/$file" "$dir/vm/$file"; done
|
||||
cp "$here/vm-boot" "$dir/vm/vm-boot"
|
||||
files+=(vm-boot)
|
||||
(cd "$dir/vm" && sha256sum "${files[@]}" >SHA256SUMS)
|
||||
# The image has the ISO's name, so the two are told apart by their endings.
|
||||
image=$name.qcow2
|
||||
mv "$sealed/base.qcow2" "$dir/$image"
|
||||
(cd "$dir" && sha256sum "$image" >"$image.sha256")
|
||||
|
||||
for file in "${unpacked[@]}"; do mv "$sealed/$file" "$dir/unpacked/$file"; done
|
||||
cp "$here/vm-boot" "$dir/unpacked/vm-boot"
|
||||
unpacked+=(vm-boot)
|
||||
(cd "$dir/unpacked" && sha256sum "${unpacked[@]}" >SHA256SUMS)
|
||||
|
||||
latest=$out/$channel/latest.json
|
||||
jq -n \
|
||||
--arg version "$version" --arg channel "$channel" --arg vm "$site/$release/vm" \
|
||||
--arg version "$version" --arg channel "$channel" --arg release "$site/$release" --arg image "$image" \
|
||||
--arg built_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
|
||||
--arg url "$iso_url" --arg sha256 "$iso_sha256" --argjson size "$iso_size" \
|
||||
--arg iso_commit "$iso_commit" --arg omarchy_version "$omarchy" --arg omarchy_commit "$omarchy_commit" \
|
||||
--arg kernel "$kernel" \
|
||||
--arg disk_sha256 "$(awk '$2 == "base.qcow2" { print $1 }' "$dir/vm/SHA256SUMS")" \
|
||||
--argjson disk_size "$(stat -c %s "$dir/vm/base.qcow2")" \
|
||||
--arg vm_sha256 "$(cut -d' ' -f1 "$dir/$image.sha256")" --argjson vm_size "$(stat -c %s "$dir/$image")" \
|
||||
--args '{
|
||||
version: $version, channel: $channel, built_at: $built_at,
|
||||
url: $url, sha256: $sha256, size: $size,
|
||||
iso_commit: $iso_commit, omarchy_version: $omarchy_version, omarchy_commit: $omarchy_commit,
|
||||
kernel: $kernel,
|
||||
vm: {
|
||||
url: "\($vm)/", disk: "\($vm)/base.qcow2", disk_sha256: $disk_sha256, disk_size: $disk_size,
|
||||
files: ($ARGS.positional + ["SHA256SUMS"]),
|
||||
url: "\($release)/\($image)", sha256: $vm_sha256, size: $vm_size,
|
||||
unpacked: "\($release)/unpacked/", unpacked_files: ($ARGS.positional + ["SHA256SUMS"]),
|
||||
user: "omarchy", password: "omarchy",
|
||||
ssh: "keys only; vm-boot makes one for each boot"
|
||||
}
|
||||
}' "${files[@]}" >"$latest"
|
||||
}' "${unpacked[@]}" >"$latest"
|
||||
|
||||
# What is about to be published has to say what it should: one value in every
|
||||
# field, and checksums that are checksums.
|
||||
@@ -93,6 +106,7 @@ jq -e --arg channel "$channel" '
|
||||
and (.url | test("^https://[^\n ]+\\.iso$")) and (.sha256 | sha) and .size > 0
|
||||
and (.iso_commit | test("^[0-9a-f]{40}$"))
|
||||
and (.omarchy_version | one_line) and (.omarchy_commit | test("^[0-9a-f]*$")) and (.kernel | one_line)
|
||||
and (.vm.disk | test("^https://[^\n ]+/vm/base\\.qcow2$")) and (.vm.disk_sha256 | sha) and .vm.disk_size > 0
|
||||
and (.vm.url | test("^https://[^\n ]+\\.qcow2$")) and (.vm.sha256 | sha) and .vm.size > 0
|
||||
and (.vm.unpacked | test("^https://[^\n ]+/unpacked/$")) and (.vm.unpacked_files | length) == 5
|
||||
' "$latest" >/dev/null || { cat "$latest" >&2; fail "latest.json does not say what it should"; }
|
||||
cat "$latest"
|
||||
+19
-8
@@ -1,11 +1,16 @@
|
||||
#!/bin/bash
|
||||
# Boots a sealed Omarchy image (vm-seal) as a throwaway machine.
|
||||
#
|
||||
# vm-boot <sealed_dir> boot, print how to log in, run until Ctrl-C
|
||||
# vm-boot <sealed_dir> <command...> boot, run the command over SSH, power off;
|
||||
# exits with the command's status
|
||||
# vm-boot <image> boot, print how to log in, run until Ctrl-C
|
||||
# vm-boot <image> <command...> boot, run the command over SSH, power off;
|
||||
# exits with the command's status
|
||||
#
|
||||
# Nothing is written to sealed_dir: the machine runs on a copy-on-write overlay
|
||||
# <image> is a downloaded disk, omarchy-<...>.qcow2, with vmlinuz, initrd and
|
||||
# cmdline in the same directory as this script, as in a published "unpacked"
|
||||
# folder. Or it is a directory as vm-seal leaves it, holding base.qcow2 and
|
||||
# those three files.
|
||||
#
|
||||
# Nothing is written to the image: the machine runs on a copy-on-write overlay
|
||||
# that is deleted on exit. Each boot gets a new SSH key and a new machine ID;
|
||||
# the image itself holds no key and its SSH takes no password.
|
||||
#
|
||||
@@ -14,9 +19,15 @@
|
||||
# kernel arguments), QEMU_EXTRA (more qemu arguments, split on spaces),
|
||||
# VM_STATE_DIR (/var/tmp; holds the overlay, so it needs room to grow).
|
||||
set -euo pipefail
|
||||
[[ $# -ge 1 ]] || { sed -n '2,16p' "$0" >&2; exit 2; }
|
||||
base=$(realpath "$1"); shift
|
||||
for f in base.qcow2 vmlinuz initrd cmdline; do
|
||||
[[ $# -ge 1 ]] || { sed -n '2,21p' "$0" >&2; exit 2; }
|
||||
image=$(realpath "$1"); shift
|
||||
if [[ -d $image ]]; then
|
||||
base=$image disk=$image/base.qcow2
|
||||
else
|
||||
base=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd) disk=$image
|
||||
fi
|
||||
[[ -s $disk ]] || { echo "vm-boot: there is no disk image at $disk" >&2; exit 1; }
|
||||
for f in vmlinuz initrd cmdline; do
|
||||
[[ -s $base/$f ]] || { echo "vm-boot: $base/$f is missing" >&2; exit 1; }
|
||||
done
|
||||
[[ -r /dev/kvm && -w /dev/kvm ]] || { echo "vm-boot: /dev/kvm is not usable" >&2; exit 1; }
|
||||
@@ -45,7 +56,7 @@ keys=$(printf 'd /home/omarchy/.ssh 0700 omarchy omarchy -\nf+ /home/omarchy/.ss
|
||||
ssh_opts=(-i "$state/id_ed25519" -p "$port" -o BatchMode=yes -o IdentitiesOnly=yes
|
||||
-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR)
|
||||
|
||||
qemu-img create -qf qcow2 -b "$base/base.qcow2" -F qcow2 "$state/run.qcow2"
|
||||
qemu-img create -qf qcow2 -b "$disk" -F qcow2 "$state/run.qcow2"
|
||||
t0=$(date +%s%N)
|
||||
# shellcheck disable=SC2086
|
||||
qemu-system-x86_64 -cpu host -enable-kvm -machine q35,accel=kvm -smp "${SMP:-4}" -m "${MEM:-4G}" \
|
||||
|
||||
@@ -7,10 +7,9 @@
|
||||
#
|
||||
# installed_dir holds base.qcow2, OVMF_VARS.4m.fd and id_ed25519, which is
|
||||
# what test/integration leaves in test-runs/<iso>-integration once its install
|
||||
# has passed. sealed_dir gets a standalone, zstd-compressed base.qcow2, the
|
||||
# firmware variables that boot it through UEFI, and the UKI's vmlinuz, initrd
|
||||
# and cmdline for booting it directly. It holds no key: each boot is handed
|
||||
# one (see vm-boot).
|
||||
# has passed. sealed_dir gets a standalone, zstd-compressed base.qcow2, which
|
||||
# boots by itself through UEFI, and the UKI's vmlinuz, initrd and cmdline for
|
||||
# booting it directly. It holds no key: each boot is handed one (see vm-boot).
|
||||
#
|
||||
# The image keeps the installer's user and password (GUEST_PASSWORD, default
|
||||
# omarchy) for the desktop and sudo. SSH takes keys only.
|
||||
@@ -145,8 +144,5 @@ tr -d '\0' <"$state/cmdline" | tr ' ' '\n' | { grep -vE '^(resume|resume_offset)
|
||||
|
||||
# zstd clusters: QEMU reads them as they are, so the download boots as it is.
|
||||
qemu-img convert -c -O qcow2 -o compression_type=zstd -m 16 -W "$state/edit.qcow2" "$out/base.qcow2"
|
||||
# The variables hold the boot entry the installer registered; a firmware boot
|
||||
# of this disk needs them, a direct kernel boot does not.
|
||||
cp "$in/OVMF_VARS.4m.fd" "$out/OVMF_VARS.4m.fd"
|
||||
( cd "$out" && sha256sum base.qcow2 OVMF_VARS.4m.fd vmlinuz initrd cmdline >SHA256SUMS )
|
||||
( cd "$out" && sha256sum base.qcow2 vmlinuz initrd cmdline >SHA256SUMS )
|
||||
echo "sealed: $out ($(du -sh "$out/base.qcow2" | cut -f1)); cmdline: $(cat "$out/cmdline")"
|
||||
Reference in new issue
Block a user