Adopt the stage0 standalone build/test pattern#10
Merged
Conversation
stage0 now lives in its own repo (github.com/lockboot/stage0) and is the
canonical reference. This repo (the netboot UKI / stage1 track) still carried a
full duplicate of stage0 and used the old per-repo Makefile style. Align it with
stage0 so stage1, mkuki, and example-stage2 build the same way inside the shared
workspace AND standalone on CI, ahead of renaming lockboot -> stage1.
- Remove the vendored stage0: crates/stage0, crates/stage0-test-payload,
tools/build-stage0/, the stage0-v* release track, and the stage0 make targets.
stage0 is consumed externally now (like vaportpm from git): the chain test
borrows ../stage0/build/<arch>/boot.disk and the shared lockboot:harness image.
- Makefile: adopt stage0's DOCKER_RUN plumbing (parent-workspace mount at /src,
findmnt host-path translation, CI-keyed ephemeral caches, stat-based ownership),
preserving the docker.sock + KVM passthrough the UKI build and chain test need.
Add build/<arch>/stage2 and a SIGN=1 ed25519 chain mode. Default SERVE_HOST to
the tap IP so the guest's _stage2 hop needs no DNS.
- CI: drop the stage0-v* track; build the UKI + example-stage2 and ship the leaf
as a first-class artifact. Keep the uki-v* + ghcr runtime tracks.
- Delete Dockerfile.dev (qemu harness borrowed from stage0 as lockboot:harness),
the redundant tools/qemu-test/, and the per-repo .devcontainer/.
- Excise stage0-domain artifacts duplicated/orphaned here: the cloud AMI/image
publishers (tools/publish/{ec2,gcp,azure}), the Secure Boot key generator
(tools/build-uki/keys), and the FAT-timestamp normalizer (disk/ESP repro - the
UKI has no filesystem). Keep the UKI publisher, renamed to tools/publish.sh.
- Dockerfile.build kept byte-identical to stage0's.
Verified in-workspace with real QEMU + KVM: make x86_64 (UKI) and stage2 build;
the full chain (stage0 -> UKI -> stage1 -> example-stage2 -> poweroff) passes in
both sha256-pin and SIGN=1 ed25519 admission modes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Aligns this repo (the netboot UKI / stage1 track) with the now-canonical stage0 repo, ahead of renaming
lockboot→stage1. Mostly subtractive: +253 / −5065 across 47 files.What & why
stage0 was extracted into its own repo but this repo still carried a full duplicate of it and used the old per-repo Makefile style. Now stage0 is consumed externally (like
vaportpmfrom git), and the build/test/CI follow stage0's standalone pattern sostage1,mkuki, andexample-stage2build the same way in-workspace and standalone on CI.Changes
crates/stage0,crates/stage0-test-payload,tools/build-stage0/, thestage0-v*release track + stage0 make targets. The chain test borrows the external../stage0/build/<arch>/boot.diskand the sharedlockboot:harnessimage.DOCKER_RUNplumbing (parent-workspace mount at/src,findmnthost-path translation, CI-keyed ephemeral caches, stat-based ownership), keeping the docker.sock + KVM passthrough the UKI build / chain test need. Addbuild/<arch>/stage2and aSIGN=1ed25519 chain mode; defaultSERVE_HOSTto the tap IP so the guest_stage2hop needs no DNS.stage0-v*track; build UKI + example-stage2 and ship the leaf as a first-class artifact. Keepuki-v*+ ghcr runtime tracks.Dockerfile.dev(harness borrowed aslockboot:harness), redundanttools/qemu-test/, and per-repo.devcontainer/.tools/publish/{ec2,gcp,azure}), the Secure Boot key generator (tools/build-uki/keys), and the FAT-timestamp normalizer (disk/ESP repro — the UKI has no filesystem). Kept the UKI publisher, renamedupload-uki.sh→tools/publish.sh.Dockerfile.buildkept byte-identical to stage0's.Verification (in-workspace, real QEMU + KVM)
make x86_64(full UKI) andmake stage2-x86_64build ✓stage0 → UKI → stage1 → example-stage2 → poweroffpasses in both admission modes: sha256 pin ✓ andSIGN=1ed25519 ✓ (openssl-rawinsig verifies against stage0's verifier).vaportpmgit-only;Cargo.lockcommitted — so this CI run is the standalone-build proof.🤖 Generated with Claude Code