v0.0.4

Using rules_mkosi

Add to your MODULE.bazel:

bazel_dep(name = "rules_mkosi", version = "0.0.4")

See the requirements for the supported Bazel versions and hosts, and the setup instructions for the module extensions to configure.

What's Changed

• feat: derive mkosi_image's version from the inputs of its build action by @maxbirkner in #197
• feat: serve Content-Digest and byte ranges from http_shares by @maxbirkner in #199
• ci: require type annotations on every new Python function by @maxbirkner in #200
• fix: keep Python bytecode out of the inputs of rules_mkosi's interpreter by @maxbirkner in #204
• feat: list the inputs of a derived image version in an output group by @maxbirkner in #203
• fix: derive the ext4 directory hash seed of release images from Seed= by @maxbirkner in #202

Full Changelog: v0.0.3...v0.0.4

v0.0.3

Using rules_mkosi

Add to your MODULE.bazel:

bazel_dep(name = "rules_mkosi", version = "0.0.3")

See the requirements for the supported Bazel versions and hosts, and the setup instructions for the module extensions to configure.

What's Changed

• feat: sign Secure Boot binaries at a deterministic signing time by @maxbirkner in #194
• docs: install rules_mkosi from the BCR by @maxbirkner in #153

Full Changelog: v0.0.2...v0.0.3

v0.0.2

Using rules_mkosi

Add to your MODULE.bazel:

bazel_dep(name = "rules_mkosi", version = "0.0.2")

See the requirements for the supported Bazel versions and hosts, and the setup instructions for the module extensions to configure.

What's Changed

• fix: reference the release builder workflows by tag so the BCR can verify attestations by @maxbirkner in #192

Full Changelog: v0.0.1...v0.0.2

v0.0.1

Note

This release is not published to the Bazel Central Registry: its attestations name the release builder workflows by commit SHA, which the registry's verifier rejects. Use v0.0.2 or later.

Using rules_mkosi

Add to your MODULE.bazel:

bazel_dep(name = "rules_mkosi", version = "0.0.1")

See the requirements for the supported Bazel versions and hosts, and the setup instructions for the module extensions to configure.

What's Changed

• chore: adopt prek quality checks by @maxbirkner in #1
• feat: add host-kernel preflight for unprivileged mkosi (#3) by @maxbirkner in #29
• feat: add pinned mkosi v27 CLI toolchain by @maxbirkner in #30
• feat: add Bazel-managed QEMU and OVMF test toolchains by @maxbirkner in #31
• feat: provide pinned Debian 13 build tools by @maxbirkner in #32
• fix: preserve Debian systemd user directory link by @maxbirkner in #41
• docs: add implementation retrospectives by @maxbirkner in #39
• build: raise Bazel compatibility baseline to 8 by @maxbirkner in #42
• docs: add orchestrator and worker agents by @maxbirkner in #44
• docs: let orchestrator merge reviewed PRs by @maxbirkner in #46
• feat(mkosi): build config-driven raw images by @maxbirkner in #47
• feat(test): boot Debian tracer under OVMF by @maxbirkner in #50
• docs(agents): define safe completed-worktree cleanup by @maxbirkner in #49
• ci: parallelize deterministic bootstrap checks by @maxbirkner in #51
• fix(debian): require descriptor-only typed mounts by @maxbirkner in #54
• feat(debian): add authenticated snapshot repository by @maxbirkner in #56
• feat: extract reusable serial boot tests by @maxbirkner in #57
• feat(mkosi): preserve configuration tree paths by @maxbirkner in #55
• ci: centralize Bazel rc configuration by @maxbirkner in #53
• refactor: simplify launcher and modernize Python by @maxbirkner in #59
• feat(mkosi): define image output contract by @maxbirkner in #61
• feat: preflight image and boot capabilities by @maxbirkner in #60
• feat(mkosi): add offline release image mode by @maxbirkner in #62
• feat: project validated release GPT metadata by @maxbirkner in #63
• test: prove clean release reproducibility by @maxbirkner in #65
• test: enforce public behavior matrix by @maxbirkner in #64
• ci: upload images for manual testing by @maxbirkner in #67
• docs: record Starlark coverage blocker by @maxbirkner in #69
• feat: add typed rootfs payloads by @maxbirkner in #70
• feat: add legacy BIOS release images by @maxbirkner in #71
• feat: add unsigned UKI and dm-verity outputs by @maxbirkner in #72
• test: qualify legacy BIOS boot with SeaBIOS by @maxbirkner in #73
• ci: pin Bazelisk 1.28.0 by @maxbirkner in #76
• feat: add offline Secure Boot signing boundary by @maxbirkner in #74
• feat: support consumer-owned multi-component Debian snapshots by @maxbirkner in #78
• feat: add systemd-sysupdate A/B updates with boot-counting rollback by @maxbirkner in #80
• fix: isolate Python line and static bootstrap toolchain from consumer defaults by @maxbirkner in #79
• ci: avoid rebuilding the repository in manifest passes and parallelize suites by @maxbirkner in #81
• feat: read mkosi_image versions from files at execution time by @maxbirkner in #83
• test: use KVM for QEMU boot tests when available by @maxbirkner in #82
• feat: build release images in a cached base and a versioned finalization by @maxbirkner in #85
• docs: make user documentation concise by @maxbirkner in #86
• refactor: split run_mkosi.py into small single-purpose modules by @maxbirkner in #87
• refactor: deduplicate test helpers, GPT constants, and file hashing by @maxbirkner in #88
• refactor: split long Starlark rule implementations into small helpers by @maxbirkner in #93
• refactor: split long Python functions and share sibling module loading by @maxbirkner in #94
• refactor: split C namespace runner and kernel preflight into small helpers by @maxbirkner in #99
• fix: harden namespace runner identity checks and kernel preflight edge cases by @maxbirkner in #102
• fix: close packages on digest errors, keep marker mtime, validate boot deadlines by @maxbirkner in #101
• refactor: share Debian archive path checks, control-file parsing and hashing helpers by @maxbirkner in #105
• fix: recognise all mkosi option spellings when staging and declaring inputs by @maxbirkner in #103
• test: pin the mkosi internals that release mode patches by @maxbirkner in #104
• fix: remove Debian tools scratch after each Secure Boot tool call by @maxbirkner in #107
• test: cover the QEMU fallback from KVM to TCG in CI by @maxbirkner in #108
• refactor(ci): share one group-free command wrapper across workflow steps by @maxbirkner in #113
• fix: build sysupdate helper scripts in the exec configuration by @maxbirkner in #109
• refactor: share one runfile lookup between shell tests by @maxbirkner in #106
• feat: output mkosi's JSON package manifest with mkosi_image(manifest = True) by @maxbirkner in #111
• refactor: share the static Python interpreter setup with the Debian toolchain by @maxbirkner in #115
• refactor!: rename the boot configuration provider and remove MkosiImageInfo.root_hash_signature by @maxbirkner in #110
• feat(deps)!: upgrade mkosi to v27.1 and always use its unprivileged user namespace by @maxbirkner in #118
• build(deps): bump Bazel module dependencies to their latest releases by @maxbirkner in #116
• build: test Bazel 8.8.2 and 9.3.1 and raise the minimum to 8.8.2 by @maxbirkner in #117
• deps: refresh Debian tools to trixie 13.7 and Python 3.14.10 by @maxbirkner in #122
• ci: require Conventional Commit pull request titles by @maxbirkner in #125
• ci: lint Python with ruff check by @maxbirkner in #131
• ci: format Python with ruff format by @maxbirkner in #132
• ci: lint shell scripts with ShellCheck by @maxbirkner in #126
• ci: lint GitHub Actions workflows with actionlint by @maxbirkner in #127
• ci: enable all buildifier warnings by @maxbirkner in #129
• ci: check C and C++ formatting with clang-format by @maxbirkner in #130
• ci: skip the squashed formatting commits in blame by @maxbirkner in #136
• build: compile the C and C++ helpers with strict warnings as errors by @maxbirkner in #128
• feat: reject unsized dm-verity hash partitions in release builds by @maxbirkner in #137
• chore: refresh the Debian tools snapshot with one command by @maxbirkner in #138
• chore: add one script...