Migrate to mkosi + sysupdate

.github/workflows/release-daily.yaml

@@ -0,0 +1,107 @@
+name: Build and Release Daily (elementary OS 9)
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build-and-release:
+    name: Build Image and Release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      # systemd architecture ID, as expanded by %a in the sysupdate transfer config.
+      # Must be x86-64 or arm64
+      ARCH: x86-64
+      # OS Version should be quoted so 9.0 isn't recuded to just 9
+      OS_VERSION: "9.0"
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Maximize build space
+        uses: ublue-os/remove-unwanted-software@v8
+
+      - name: Install deps
+        run: sudo apt-get update && sudo apt-get install just podman -y
+
+      - name: Generate key
+        run: just genkey
+
+      - name: Release
+        run: just do-daily
+
+      - name: Fix output dir ownership
+        run: |
+          sudo chown -R "$(id -u):$(id -g)" mkosi.output
+          sudo chmod -R u+rwX mkosi.output
+
+      - name: Generate SHA256SUMS (all partitions)
+        run: just checksum-repo
+
+      - name: Extract Date
+        run: |
+          set -euo pipefail
+          FILE_PATH=$(ls mkosi.output/*.usr-*.raw.zst | head -n 1)
+          TIMESTAMP=$(basename "$FILE_PATH" | grep -oE '[0-9]{14}' | head -n 1 || true)
+          if [ -z "$TIMESTAMP" ]; then
+            echo "Fatal: No timpestamped file found."
+            exit 0
+          fi
+          echo "Release date: $TIMESTAMP"
+          echo "RELEASE_DATE=$TIMESTAMP" >> "$GITHUB_OUTPUT"
+
+      - name: Upload sysupdate, iso and SHA256SUMS to Bucket
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: auto
+          AWS_ENDPOINT_URL: ${{ secrets.R2_ENDPOINT }}
+        run: |
+          set -euo pipefail
+
+          # 1. Images
+          cd mkosi.output
+          find . -maxdepth 1 -type f \( \
+              -name "*.esp.raw" \
+              -o -name "*.usr-*.*.raw.zst" \
+              -o -name "*.usr-*-verity.*.raw.zst" \
+              -o -name "*.usr-*-verity-sig.*.raw.zst" \
+            \) -print0 | while IFS= read -r -d '' f; do
+              aws s3 cp "$f" "s3://${{ secrets.R2_BUCKET_DAILY_UPDATES }}/$ARCH/" --cache-control "public, max-age=31536000, immutable"
+            done
+          cd ..
+
+
+          # 2. SHA256SUMS
+          # not cached, will change when new updates are uploaded
+          aws s3 cp mkosi.output/SHA256SUMS \
+            "s3://${{ secrets.R2_BUCKET_DAILY_UPDATES }}/$ARCH/SHA256SUMS" \
+            --content-type "text/plain" \
+            --cache-control "no-cache"
+
+          # 3. Live ISO + hash
+          ISO=$(basename $(ls mkosi.output/elementaryos-*.iso | head -n 1))
+          ( cd mkosi.output && sha256sum "$ISO" > "$ISO.sha256.txt" )
+
+          ISO_DEST="s3://${{ secrets.R2_BUCKET_DAILY_INSTALLER }}/$ARCH"
+
+          aws s3 cp "mkosi.output/$ISO" "$ISO_DEST/$ISO" \
+            --cache-control "public, max-age=31536000, immutable"
+
+          aws s3 cp "mkosi.output/$ISO.sha256.txt" "$ISO_DEST/$ISO.sha256.txt" \
+            --content-type "text/plain" \
+            --cache-control "public, max-age=31536000, immutable"
+
+      - name: Checksum Extensions
+        run: just checksum-ext
+
+      - name: Release Extensions
+        uses: softprops/action-gh-release@v3
+        with:
+          tag_name: ${{ steps.get_date.outputs.RELEASE_DATE }}
+          name: Extension release ${{ steps.get_date.outputs.RELEASE_DATE }}
+          files: |
+            mkosi.output/ext/ext-*.raw.zst
+            mkosi.output/ext/SHA256SUMS

.gitignore

@@ -1,5 +1,21 @@
-.DS_Store
-tmp
-artifacts
-builds
-*~
+cosign.key
+**/cosign.key
+cache
+_build_*
+output
+_build-*/**
+*.img
+*.raw
+*.iso
+mkosi.local/
+mkosi.local.conf
+mkosi.output/
+mkosi.cache/
+mkosi.tools/
+mkosi.tools.manifest
+mkosi.key
+mkosi.crt
+mkosi.version
+mkosi.rootpw
+.mkosi-private
+*.efi

Justfile

@@ -0,0 +1,67 @@
+default:
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    just --choose
+
+do-daily:
+    #!/usr/bin/env bash
+    sudo rm -rf mkosi.output/ && \
+    just run-in-podman mkosi -B --debug --profile=daily --force --workspace-directory=/workspace && \
+    sudo ./assemble-iso.sh
+
+
+do-release:
+    #!/usr/bin/env bash
+    echo "nyi, run do-daily instead"
+
+genkey:
+    just run-in-podman mkosi genkey
+
+run-in-podman +command:
+    mkdir -p {{env_var('HOME')}}/.cache/mkosi-workspace
+    sudo mkdir -p /var/cache/mkosi
+
+    sudo podman run --rm -it \
+        --network host \
+        --dns 8.8.8.8 \
+        --privileged \
+        --security-opt label=disable \
+        -v /var/cache/mkosi:/var/cache/mkosi \
+        -v /dev:/dev \
+        -v "{{invocation_directory()}}:/work" \
+        -w /work \
+        -v "{{env_var('HOME')}}/.cache/mkosi-workspace:/workspace" \
+        ghcr.io/jumpyvi/mkosi:tanit \
+        {{command}}
+
+
+
+clean:
+    just run-in-podman mkosi clean
+    sudo rm -r mkosi.tools/ mkosi.cache/ /var/cache/mkosi/*
+
+checksum-repo:
+    #!/usr/bin/env bash
+    cd mkosi.output
+    sha256sum elementary_*.efi \
+        elementary_*.usr-*.*.raw.zst \
+        elementary_*.usr-*-verity.*.raw.zst \
+        elementary_*.usr-*-verity-sig.*.raw.zst \
+        > SHA256SUMS
+    cat SHA256SUMS
+
+checksum-ext:
+    #!/usr/bin/env bash
+    cd mkosi.output
+    mkdir ext
+    mv ext-*.raw.zst ext/
+    cd ext/
+    sha256sum ext-*.raw.zst > SHA256SUMS
+    cat SHA256SUMS
+
+serve:
+    #!/usr/bin/env bash
+    cd mkosi.output
+    echo "Sysupdate accessible in Gnome Boxes at http://10.0.2.2:7070"
+    echo "Extensions accessible in Gnome Boxes at http://10.0.2.2:7070/ext/"
+    python -m http.server 7070