Breadway/bos
1
0
Fork 0
Code Issues 5 Pull requests 1 Projects Releases 9 Packages Wiki Activity Actions

"Build it yourself" copies binaries from the builder's home directory #59

Merged
Breadway merged 6 commits from fix/bos-37-pinned-bakery-binaries into main 2026-10-02 14:28:49 +08:00
Conversation 3 Commits 6 Files changed 4 +67 -32
Breadway commented 2026-09-30 02:24:15 +08:00
Owner
Copy link

Local ISO builds now run scripts/ci-stage-bakery.py into a temporary LAPTOP_HOME by default, so binaries come from the signed index and lockfile pins. The temporary home is removed on exit. BAKE_FROM_HOME=1 preserves the builder's installed versions for development, and CI continues using its separately staged home.

The build writes a temporary GPGDir into its staged pacman config and removes it on exit. Repository key trust and local signatures stay out of the host pacman keyring. Updated stale comments in build-local.sh and the lockfile header to describe the pinned staging default. README and the Unreleased changelog describe the default and override.

Updated stale bakery, bread-theme, and breadpaper lockfile pins to their current signed stable-index versions, following the lockfile's pin refresh policy.

Verified shell syntax, Python compilation, and git diff --check. A clean Arch container completed a FAST_BUILD=1 ISO build without bread tools installed. The signed index verified, all 19 required /usr/local/bin binaries in the ISO matched signed-index SHA-256 values and lockfile versions, the host keyring did not acquire the [breadway] key, and the temporary GPGDir was removed. mkinitcpio emitted its existing missing nbd-client hook warning, but the ISO build completed successfully.

The public BOS landing page copy is in Breadway/bos-site PR #4, stacked on source import PR #1. Merge the site PRs and publish the static page before marking BOS-37 DONE.

Closes #37

Local ISO builds now run `scripts/ci-stage-bakery.py` into a temporary `LAPTOP_HOME` by default, so binaries come from the signed index and lockfile pins. The temporary home is removed on exit. `BAKE_FROM_HOME=1` preserves the builder's installed versions for development, and CI continues using its separately staged home. The build writes a temporary `GPGDir` into its staged pacman config and removes it on exit. Repository key trust and local signatures stay out of the host pacman keyring. Updated stale comments in `build-local.sh` and the lockfile header to describe the pinned staging default. README and the Unreleased changelog describe the default and override. Updated stale bakery, bread-theme, and breadpaper lockfile pins to their current signed stable-index versions, following the lockfile's pin refresh policy. Verified shell syntax, Python compilation, and `git diff --check`. A clean Arch container completed a `FAST_BUILD=1` ISO build without bread tools installed. The signed index verified, all 19 required `/usr/local/bin` binaries in the ISO matched signed-index SHA-256 values and lockfile versions, the host keyring did not acquire the `[breadway]` key, and the temporary GPGDir was removed. mkinitcpio emitted its existing missing `nbd-client` hook warning, but the ISO build completed successfully. The public BOS landing page copy is in Breadway/bos-site PR #4, stacked on source import PR #1. Merge the site PRs and publish the static page before marking BOS-37 DONE. Closes #37
# Conflicts:
#	CHANGELOG.md
Breadway commented 2026-09-30 04:08:19 +08:00
Author
Owner
Copy link

Independent site-source review found PR #1 changes data/projects.toml in the obsolete Zola catalog, which has no CI or deployment path. It does not update the live BOS site, served from the separate BOS Website [bos.breadway.dev] checkout. The BOS issue's site-copy acceptance therefore remains unmet. Keep this issue open until the live source has a reviewable change and the published page is verified.

Independent site-source review found PR #1 changes `data/projects.toml` in the obsolete Zola catalog, which has no CI or deployment path. It does not update the live BOS site, served from the separate `BOS Website [bos.breadway.dev]` checkout. The BOS issue's site-copy acceptance therefore remains unmet. Keep this issue open until the live source has a reviewable change and the published page is verified.
Breadway commented 2026-10-01 15:35:45 +08:00
Author
Owner
Copy link

Independent re-review of PR #59 at 0af7f8af4f53da3f9a5f1c9e5758981ca59b36c0

Acceptance mapping: the default local build stages signed, lockfile-pinned bakery binaries through build-local.sh:143-154; BAKE_FROM_HOME=1 and CI's existing staged-home path are covered at build-local.sh:143-148. Temporary GPGDir setup and cleanup keep trust changes out of the host keyring at build-local.sh:28-41,74-81. The README, lockfile comments, package pins and Unreleased changelog are in the diff. The clean Arch ISO evidence on BOS-37 reports all 19 required binaries match signed-index hashes and lockfile versions, with no new host keyring trust.

The BOS-site copy is separately reviewed in PR #4 at index.html:1447,1451, but is stacked on site PR #1 and is not yet published. Forgejo reports no CI statuses for PR #59; it is mergeable. BOS is release-sensitive, so this is a recommendation for the maintainer and I have not merged. BOS-37 remains open until the site stack is landed and published.

## Independent re-review of PR #59 at `0af7f8af4f53da3f9a5f1c9e5758981ca59b36c0` Acceptance mapping: the default local build stages signed, lockfile-pinned bakery binaries through `build-local.sh:143-154`; `BAKE_FROM_HOME=1` and CI's existing staged-home path are covered at `build-local.sh:143-148`. Temporary GPGDir setup and cleanup keep trust changes out of the host keyring at `build-local.sh:28-41,74-81`. The README, lockfile comments, package pins and Unreleased changelog are in the diff. The clean Arch ISO evidence on BOS-37 reports all 19 required binaries match signed-index hashes and lockfile versions, with no new host keyring trust. The BOS-site copy is separately reviewed in PR #4 at `index.html:1447,1451`, but is stacked on site PR #1 and is not yet published. Forgejo reports no CI statuses for PR #59; it is mergeable. BOS is release-sensitive, so this is a recommendation for the maintainer and I have not merged. BOS-37 remains open until the site stack is landed and published.
Breadway commented 2026-10-01 15:36:34 +08:00
Author
Owner
Copy link

Independent re-review

The current PR #59 head remains 0af7f8af4f53da3f9a5f1c9e5758981ca59b36c0. Acceptance mapping:

  1. Default builds stage signed-index, lockfile-pinned binaries into a temporary home: build-local.sh:143-153. The recorded clean Arch acceptance checks all 19 ISO binaries against the signed index and pins.
  2. BAKE_FROM_HOME=1 uses the builder's installed bakery versions, while CI retains its separately staged home: build-local.sh:143-148, README.md:134-153.
  3. Temporary bakery home and staged pacman GPGDir are cleaned on exit, and the pacman config scopes repository trust to that temporary keyring: build-local.sh:30-41,74-80. The recorded acceptance confirms the host keyring remained unchanged.
  4. README, changelog and lockfile pins are updated. The site copy is now in correct source repository PR #4, stacked on source import PR #1.

No CI statuses are configured for this BOS PR. Forgejo reports it mergeable. Code review is complete, but BOS is release-sensitive so the merge remains with the maintainer. BOS-37 stays in TODO because PR #1 needs the deployment target privacy rework noted on that PR; do not mark the parent issue done before the site PRs are safely merged and the page is verified live.

## Independent re-review The current PR #59 head remains `0af7f8af4f53da3f9a5f1c9e5758981ca59b36c0`. Acceptance mapping: 1. Default builds stage signed-index, lockfile-pinned binaries into a temporary home: `build-local.sh:143-153`. The recorded clean Arch acceptance checks all 19 ISO binaries against the signed index and pins. 2. `BAKE_FROM_HOME=1` uses the builder's installed bakery versions, while CI retains its separately staged home: `build-local.sh:143-148`, `README.md:134-153`. 3. Temporary bakery home and staged pacman GPGDir are cleaned on exit, and the pacman config scopes repository trust to that temporary keyring: `build-local.sh:30-41,74-80`. The recorded acceptance confirms the host keyring remained unchanged. 4. README, changelog and lockfile pins are updated. The site copy is now in correct source repository PR #4, stacked on source import PR #1. No CI statuses are configured for this BOS PR. Forgejo reports it mergeable. Code review is complete, but BOS is release-sensitive so the merge remains with the maintainer. BOS-37 stays in TODO because PR #1 needs the deployment target privacy rework noted on that PR; do not mark the parent issue done before the site PRs are safely merged and the page is verified live.
Merge remote-tracking branch 'origin/main' into push/pr59
All checks were successful
Build and publish calamares / calamares (pull_request) Successful in 4m32s
Details
Build and publish calamares / calamares (push) Successful in 4m34s
Details
Build and publish powerlevel10k / powerlevel10k (push) Successful in 1m9s
Details
af534de7f2 
# Conflicts:
#	iso/bread-lockfile.toml
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
P0

   
P1

   
P2

   
P3

   
audio

   
bakery

   
boot

   
breadbug

   
bug

   
build

   
ci

   
dependencies

   
design

   
disk

   
docs

   
encryption

   
final

   
firewall

   
graphics

   
hardware

   
idle

   
installer

   
keybinds

   
nvidia

   
packages

   
phase-1

   
polish

   
recovery

   
reliability

   
reproducibility

   
secure-boot

   
security

   
shell

   
signing

   
snapshots

   
supply-chain

   
swap

   
tech-debt

   
theming

   
ux

   
website
No labels
P0
P1
P2
P3
audio
bakery
boot
breadbug
bug
build
ci
dependencies
design
disk
docs
encryption
final
firewall
graphics
hardware
idle
installer
keybinds
nvidia
packages
phase-1
polish
recovery
reliability
reproducibility
secure-boot
security
shell
signing
snapshots
supply-chain
swap
tech-debt
theming
ux
website
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Breadway/bos!59
No description provided.