feat(os): one-flag debug builds — build-image.sh --ssh; updater defaults to rauc - #816
Merged
Merged
Conversation
…lts to rauc The bench recipe kept getting reinvented: the debug variant needed a remembered env var (PITHEAD_TEST_SSH_PUBKEY) and the updater another (PITHEAD_UPDATER), and forgetting the latter built an image that could never take an A/B update (the R2 RC candidate's first build did exactly that — verify-image caught it). --ssh [PUBKEY_FILE] bakes the key and enables sshd, defaulting to the builder's own public key; no flag stays the shell-less release variant. The updater arg now defaults to rauc, the only updater the boot contract supports. Closes #815 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The bench recipe kept getting reinvented from env vars. Now:
os/build-image.sh --ssh [PUBKEY_FILE]= the debug/bench variant: bakes the key (default: the builder's own~/.ssh/id_ed25519.pub, thenid_rsa.pub) as root's authorized key and enables sshd. No flag = the shell-less release variant, unchanged.PITHEAD_UPDATERdefaults torauc— the first R2 RC build ran without it and produced an image that could never take another A/B update; verify-image caught it (52/53), but the silent-empty default was the only wrong option. Closes build-image.sh: PITHEAD_UPDATER defaults to empty — a plain build produces an image that cannot update itself #815.docs/dev/appliance-release.mddocuments the two variants and the take-a-release-update-lose-SSH consequence observed live on the bench today.Verified
shellcheck clean,
make lintgreen; the same key-bake path (PITHEAD_TEST_SSH_PUBKEY) just built the bench debug image on gouda and passedverify-image --test51/0 — the flag is a front door on a proven path, not new mechanism.🤖 Generated with Claude Code