feat(tmachine): build local Debian artifacts (#4598)

* feat(tmachine): build local Debian artifacts

Signed-off-by: Evan Lezar <elezar@nvidia.com>

* refactor(tmachine): separate VM driver artifact build

Signed-off-by: Evan Lezar <elezar@nvidia.com>

---------

Signed-off-by: Evan Lezar <elezar@nvidia.com>

TESTING.md

@@ -317,6 +317,11 @@ Run the Podman-backed Rust CLI e2e suite:
 mise run e2e:podman
 ```
 
+`nix run .#build-artifacts` also builds
+`artifacts/packages/openshell.deb` for tmachine's `deb` installer, targeting the
+host's Linux architecture (`arm64` or `amd64`). Set `OPENSHELL_DEB_VERSION` to
+override the default package version, `0.0.0-local`.
+
 Run the portable subset in a disposable rootless Podman guest:
 
 ```shell

flake.nix

@@ -157,6 +157,14 @@
             type = "app";
             program = "${artifacts.binaries}/bin/build-artifacts-binaries";
           };
+          build-artifacts-vm-driver = {
+            type = "app";
+            program = "${artifacts.vmDriver}/bin/build-artifacts-vm-driver";
+          };
+          build-artifacts-deb = {
+            type = "app";
+            program = "${artifacts.deb}/bin/build-artifacts-deb";
+          };
           build-artifacts-test-archives = {
             type = "app";
             program = "${artifacts.testArchives}/bin/build-artifacts-test-archives";

nix/pkgs/vm-runtime.nix

@@ -13,7 +13,7 @@ let
     {
       x86_64-linux = {
         platform = "linux-x86_64";
-        hash = "sha256-kA6ZQz53geBp2zHx8tv+D8VcGkSrnC74Op/60H4fmck=";
+        hash = "sha256-mZwSUhs9IZ0pPLxzVs4AbRLdYWkUlHwP4lmfsbeiUGw=";
         artifacts = [
           "libkrun.so"
           "libkrunfw.so.5"
@@ -22,7 +22,7 @@ let
       };
       aarch64-linux = {
         platform = "linux-aarch64";
-        hash = "sha256-7FNqUtC6ixfw202EyoYCgZOLdyxJYfg/YzdlkTT/+sM=";
+        hash = "sha256-Yk5Rxn6JWxMu82Vkyx3eSAxh5/mnfUwcNDNeDIQJz4c=";
         artifacts = [
           "libkrun.so"
           "libkrunfw.so.5"

tests/artifacts.nix

@@ -12,6 +12,9 @@ let
   gnuToolchain = toolchains.${if isAarch64 then "aarch64-gnu" else "x86_64-gnu"};
   muslToolchain = toolchains.${if isAarch64 then "aarch64-musl" else "x86_64-musl"};
   dockerArch = if isAarch64 then "arm64" else "amd64";
+  linuxVmRuntime = pkgs.callPackage ../nix/pkgs/vm-runtime.nix {
+    stdenv = gnuToolchain.stdenv;
+  };
   toolchainEnv = pkgs.lib.foldl' (env: toolchain: env // toolchain.env) { } (
     builtins.attrValues toolchains
   );
@@ -222,7 +225,8 @@ rec {
 
       cargo build --target ${muslToolchain.target} \
         -p openshell-cli \
-        -p openshell-sandbox
+        -p openshell-sandbox \
+        -p openshell-prover-cli
 
       cargo build --target ${gnuToolchain.target} \
         -p openshell-gateway \
@@ -243,6 +247,55 @@ rec {
       install -D -m 0755 \
         target/${gnuToolchain.target}/debug/openshell-supervisor \
         artifacts/binaries/${gnuToolchain.target}/openshell-supervisor
+
+      install -D -m 0755 \
+        target/${muslToolchain.target}/debug/openshell-prover \
+        artifacts/binaries/${muslToolchain.target}/openshell-prover
+    '';
+  };
+
+  vmDriver = pkgs.writeShellApplication {
+    name = "build-artifacts-vm-driver";
+    runtimeInputs = [
+      pkgs.coreutils
+      pkgs.git
+      pkgs.zstd
+      rustToolchain
+    ];
+    runtimeEnv = toolchainEnv;
+    text = ''
+      root=$(git rev-parse --show-toplevel)
+      cd "$root"
+
+      cargo build --target ${muslToolchain.target} \
+        -p openshell-driver-vm --no-default-features --bin openshell-vm-init
+
+      install -D -m 0755 \
+        target/${muslToolchain.target}/debug/openshell-vm-init \
+        artifacts/binaries/${muslToolchain.target}/openshell-vm-init
+
+      compressed_dir=$(mktemp -d -p /tmp openshell-vm-runtime.XXXXXX)
+      cleanup() {
+        status=$?
+        trap - EXIT
+        rm -rf -- "$compressed_dir"
+        exit "$status"
+      }
+      trap cleanup EXIT
+      cp ${linuxVmRuntime}/compressed/*.zst "$compressed_dir/"
+      zstd -19 -T1 artifacts/binaries/${muslToolchain.target}/openshell-sandbox \
+        -o "$compressed_dir/openshell-sandbox.zst"
+      zstd -19 -T1 artifacts/binaries/${gnuToolchain.target}/openshell-supervisor \
+        -o "$compressed_dir/openshell-supervisor.zst"
+      zstd -19 -T1 artifacts/binaries/${muslToolchain.target}/openshell-vm-init \
+        -o "$compressed_dir/openshell-vm-init.zst"
+      OPENSHELL_VM_RUNTIME_COMPRESSED_DIR="$compressed_dir" \
+        cargo build --target ${gnuToolchain.target} \
+          -p openshell-driver-vm --bin openshell-driver-vm
+
+      install -D -m 0755 \
+        target/${gnuToolchain.target}/debug/openshell-driver-vm \
+        artifacts/binaries/${gnuToolchain.target}/openshell-driver-vm
     '';
   };
 
@@ -352,6 +405,32 @@ rec {
     '';
   };
 
+  deb = pkgs.writeShellApplication {
+    name = "build-artifacts-deb";
+    runtimeInputs = [
+      pkgs.coreutils
+      pkgs.dpkg
+      pkgs.git
+      pkgs.gzip
+    ];
+    text = ''
+      root=$(git rev-parse --show-toplevel)
+      cd "$root"
+
+      package_version="''${OPENSHELL_DEB_VERSION:-0.0.0-local}"
+      OPENSHELL_CLI_BINARY="$root/artifacts/binaries/${muslToolchain.target}/openshell" \
+        OPENSHELL_GATEWAY_BINARY="$root/artifacts/binaries/${gnuToolchain.target}/openshell-gateway" \
+        OPENSHELL_PROVER_BINARY="$root/artifacts/binaries/${muslToolchain.target}/openshell-prover" \
+        OPENSHELL_DRIVER_VM_BINARY="$root/artifacts/binaries/${gnuToolchain.target}/openshell-driver-vm" \
+        OPENSHELL_DEB_VERSION="$package_version" \
+        OPENSHELL_DEB_ARCH=${dockerArch} \
+        OPENSHELL_OUTPUT_DIR="$root/artifacts/packages" \
+        tasks/scripts/package-deb.sh
+      install -m 0644 "artifacts/packages/openshell_''${package_version}_${dockerArch}.deb" \
+        artifacts/packages/openshell.deb
+    '';
+  };
+
   helm = pkgs.writeShellApplication {
     name = "build-artifacts-helm";
     runtimeInputs = [
@@ -371,12 +450,16 @@ rec {
     name = "build-artifacts";
     runtimeInputs = [
       binaries
+      vmDriver
+      deb
       testArchives
       images
       helm
     ];
     text = ''
       build-artifacts-binaries
+      build-artifacts-vm-driver
+      build-artifacts-deb
       build-artifacts-test-archives
       build-artifacts-images
       build-artifacts-helm