diff --git a/build/build-image.sh b/build/build-image.sh index 2e44612..6e53233 100755 --- a/build/build-image.sh +++ b/build/build-image.sh @@ -2,15 +2,47 @@ set -euxo pipefail -mkdir -p /artifacts/dist -export EPREFIX="/build/artifacts/dist" +# Clean build dir and remake +rm -rf /build/artifacts/* +mkdir -p /build/artifacts/dist -rm -f /var/db/repos/gentoo/metadata/timestamp.chk -emerge --sync --quiet -eselect profile list | grep hardened +# Gentoo setup +mkdir -p /var/db/repos/gentoo +rm -f /var/db/repos/gentoo/metadata/timestamp.x +emerge-webrsync --quiet eselect profile set default/linux/amd64/23.0/musl/hardened/selinux +# SquashFS tools needed for image generation +emerge squashfstools + +# Copy in package list mkdir -p /etc/portage/sets cp /build/packages.txt /etc/portage/sets/halogenos -emerge @halogenos \ No newline at end of file +# Set install location +export ROOT="/build/artifacts/dist" + +# Emerge all packages +emerge -j $(nproc) --quiet @halogenos + +# Fix directory locations +mv /build/artifacts/dist/bin /build/artifacts/dist/usr/bin +mv /build/artifacts/dist/lib /build/artifacts/dist/usr/lib +mv /build/artifacts/dist/sbin /build/artifacts/dist/usr/sbin + +# Include any additional files + +# Make any additional config changes + +# Create images dir and img files +mkdir -p /build/artifacts/images +dd if=/dev/zero of=/build/images/usr.img bs=1 count=0 seek=2G +dd if=/dev/zero of=/build/images/verity.img bs=1 count=0 seek=2000M + +# Create squashfs +mksquashfs /build/artifacts/dist /build/artifacts/usr.squashfs + +# Image squashfs filesystem onto usr img +dd if=/build/artifacts/usr.squashfs of=/build/images/usr.img + +# Build verity \ No newline at end of file diff --git a/build/packages.txt b/build/packages.txt index b0e62ae..0a8e651 100644 --- a/build/packages.txt +++ b/build/packages.txt @@ -1 +1,3 @@ -app-shells/bash \ No newline at end of file +app-shells/bash +app-misc/hyfetch +sys-libs/musl \ No newline at end of file diff --git a/compose.yml b/compose.yml index 2efc042..c2bafeb 100644 --- a/compose.yml +++ b/compose.yml @@ -1,6 +1,6 @@ services: build: - image: docker.io/gentoo/stage3 + image: docker.io/gentoo/stage3:musl-hardened command: /build/build-image.sh volumes: - ./build:/build @@ -12,11 +12,11 @@ services: - signing_key_private - signing_key_public volumes: - - ./build/artifacts:/artifacts + - ./build/images:/images serve: image: docker.io/halverneus/static-file-server volumes: - - ./build/artifacts:/artifacts + - ./build/images:/images secrets: signing_key_password: