AI-assisted fork master: build reproducibility and build-step fixes (removes some upstream CI -- see description) - #7
Open
assisted-by-ai wants to merge 10 commits into
Open
Conversation
- comparator now exits 1 (not 4) for "differs"; update the reproducible lanes and docs comment to match - 2100: source reprepro-freshness.bsh (renamed) and gate --skip on the already-published check, passing the repository name - 1300: drop the cowbuilder TMPDIR/TMP env unset - 2100: read the Architecture field once into a case, dropping the quiet grep that consumed a pipe (R-161) and 4x redundant pipeline re-runs - restore/add the LC_ALL=C strict-mode directive in the touched scripts (cherry picked from commit 622f28e)
- advance submodule gitlinks to upstream's own pointers so master tracks Kicksecure master (upstream sees no gitlink delta when it pulls our master) - take upstream's frozen snapshot pin 20260821T022305Z
…mechanism) - brings 7be37d4: arraybolt's polish/refactor of the AI CI work, incl the frozen-snapshot .in-template + epoch mechanism (docker/apt-populate-frozen-timestamp) - conflicts resolved: 2100 arch-detection kept as the case refactor (ours); frozen pin kept at the newest snapshot (upstream 20260821T022305Z, epoch 1787278985), not arraybolt's older 20260820 - gitlinks kept == upstream (no submodule pointer regression on master)
- ai's boot-test-only reader: opt-in, default-off, removed from released images, gated on SMBIOS Type-1 Manufacturer=QEMU, disk+ISO readers asserted identical by dm-grub-smbios-tests - supersedes arraybolt's DANGEROUS-marked / error_dangerous_option_maybe variant of --smbios-reader; his error_dangerous_option_maybe helper stays for other options (cherry picked from commit 066e804f4a3589db5e89ede9bac7477c02742b98)
- advance submodule gitlinks to upstream's current pointers so Kicksecure sees zero gitlink delta when pulling our master (fixes PR #7 gitlink changes) - absorbs Kicksecure's own arraybolt3/trixie merge and the kicksecure-debug -> kicksecure-ci-tiny-do-not-use flavor rename - keep our newer frozen pin 20260821T022305Z; our SMBIOS-reader design retained
- skipping git_sanity_test verification is a human escape hatch; an AI agent (CLAUDECODE) must sign+tag with a throwaway key (--sign-and-tag) instead - dist_build_forbid_allow_unsigned lets CI / a hardened policy forbid it too; dangerous-options unlock is the human override
- git_sanity_test: refuse the ignore-unsigned skip for an AI session (CLAUDECODE) / dist_build_forbid_allow_unsigned at the CONSUMPTION point (env + buildconfig.d bypass parse-cmd's flag-only check); made source-able so the gate is unit-testable - parse-cmd: :- default on the BUILD_*_PKGS reads (--kernel/--headers/--initramfs crashed under nounset); exit after the --package-jobs integer error
- the source-able port moved errexit into main(), so 'bash git_sanity_test' (how mode_submodules re-invokes it) ran the bootstrap with errexit OFF and could exit 0 on an UNVERIFIED repo; guard each bootstrap source with || exit 1 - --mode/--context/--ref/--ref-type die with a named error on a missing value instead of a bare nounset 'unbound variable'
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is the accumulated work on the org-ai-assisted fork's master, offered
upstream. It is AI-assisted work, reviewed by a human before this PR was
opened. Please read the removals below before the diff.
Read this first: what this PR REMOVES from upstream
Four removals are upstream-affecting and were made for the fork's needs, not
yours. They are called out here so they are not discovered inside a 100-file
diff. I am happy to restore any or all of them on request:
.github/workflows/local-test-build.yml-- thebuild:job is deleted.That is the automated builder (ansible,
ANSIBLE_VAULT_PASSWORD, artifacthandling, 240 minute timeout), gated
if: github.repository == 'Whonix/derivative-maker'. The fork cannot run it(no secret, and the gate never matches), so it was dropped; upstream can.
The rest of the file is retained and rescoped to the dry-run gate.
ci/builddeleted (229 lines).ci/github-builddeleted (207 lines).ci/dry-run.d/400_reproducible-buildinfodeleted (62 lines).The fork's lanes drive
help-steps/dm-build-officialdirectly instead of goingthrough
ci/build, which is why those entry points went away here. If upstreamstill uses them, they should be restored before merging.
What it adds
228 commits, 100 files, +5126 -2619. By area:
help-steps/(35 files) --variables,pre,parse-cmd,unmount-treeand the mount/unmount helpers.
build-steps.d/(19 files) -- notably1100_sanity-tests,1200_prepare-build-machine,2100_create-debian-packages,3500_install-packages,3600_convert-raw-to-iso, and a new4350_reimage-raw-reproducible.docker/(8 files) -- the run/setup scripts, including pinning apt to thebuild's frozen snapshot so a container rebuild does not silently change the
package set.
ci/(15 files) and.github/workflows/(7 files) -- see the caveat below.A large share of the work targets build reproducibility: normalising the EFI
FAT ESP,
update-alternativessymlink mtimes, debconf owner spellings, and ucftemp paths, plus a reproducible re-image step.
Caveat: the fork's CI lanes are included
The
local-*.ymlworkflows are the fork's own lanes. Five of the six are gatedif: vars.CI_ENABLED_ORG_AI_ASSISTED == 'true', so in a repository that neversets that variable they resolve false and consume no runner.
local-test-build.ymlis not gated that way, but it is pre-existing upstream and this PR only rescopes
it (and fixes its tag filter:
'*'does not match a slash, so a slash-delimitedtag silently skipped the gate; it is
'**'now).They are included because this PR is the fork's master as-is. Say the word and I
will strip them.
Submodules
No submodule gitlink is touched. Verified: merging this branch changes zero
mode-160000 entries, and the merge is clean in a clone with no submodules
checked out, which is the case that otherwise conflicts.
Testing status, honestly
locally versus CI on the fork's lanes.
(
11269ee1), with no gitlink changes and no conflicts.upstream's own CI, which has secrets and runners the fork does not.
so it can be reviewed or taken piecemeal.
Happy to split this into smaller PRs by area if that is easier to review.