From 59ddef6573ed2dd27efc1bfdccef97a3fb4c2e89 Mon Sep 17 00:00:00 2001 From: Evan Lezar Date: Thu, 15 Oct 2026 13:37:42 +0000 Subject: [PATCH] feat(tmachine): build local Debian artifacts (#4598) * feat(tmachine): build local Debian artifacts Signed-off-by: Evan Lezar * refactor(tmachine): separate VM driver artifact build Signed-off-by: Evan Lezar --------- Signed-off-by: Evan Lezar --- TESTING.md | 5 +++ flake.nix | 8 ++++ nix/pkgs/vm-runtime.nix | 4 +- tests/artifacts.nix | 85 ++++++++++++++++++++++++++++++++++++++++- 4 files changed, 99 insertions(+), 3 deletions(-) diff --git a/TESTING.md b/TESTING.md index 316cbbbfa..771b60210 100644 --- a/TESTING.md +++ b/TESTING.md @@ -317,6 +317,11 @@ Run the Podman-backed Rust CLI e2e suite: mise run e2e:podman ``` +`nix run .#build-artifacts` also builds +`artifacts/packages/openshell.deb` for tmachine's `deb` installer, targeting the +host's Linux architecture (`arm64` or `amd64`). Set `OPENSHELL_DEB_VERSION` to +override the default package version, `0.0.0-local`. + Run the portable subset in a disposable rootless Podman guest: ```shell diff --git a/flake.nix b/flake.nix index 4928d2f15..21b2e1b09 100644 --- a/flake.nix +++ b/flake.nix @@ -157,6 +157,14 @@ type = "app"; program = "${artifacts.binaries}/bin/build-artifacts-binaries"; }; + build-artifacts-vm-driver = { + type = "app"; + program = "${artifacts.vmDriver}/bin/build-artifacts-vm-driver"; + }; + build-artifacts-deb = { + type = "app"; + program = "${artifacts.deb}/bin/build-artifacts-deb"; + }; build-artifacts-test-archives = { type = "app"; program = "${artifacts.testArchives}/bin/build-artifacts-test-archives"; diff --git a/nix/pkgs/vm-runtime.nix b/nix/pkgs/vm-runtime.nix index eb3819c09..baf5523b6 100644 --- a/nix/pkgs/vm-runtime.nix +++ b/nix/pkgs/vm-runtime.nix @@ -13,7 +13,7 @@ let { x86_64-linux = { platform = "linux-x86_64"; - hash = "sha256-kA6ZQz53geBp2zHx8tv+D8VcGkSrnC74Op/60H4fmck="; + hash = "sha256-mZwSUhs9IZ0pPLxzVs4AbRLdYWkUlHwP4lmfsbeiUGw="; artifacts = [ "libkrun.so" "libkrunfw.so.5" @@ -22,7 +22,7 @@ let }; aarch64-linux = { platform = "linux-aarch64"; - hash = "sha256-7FNqUtC6ixfw202EyoYCgZOLdyxJYfg/YzdlkTT/+sM="; + hash = "sha256-Yk5Rxn6JWxMu82Vkyx3eSAxh5/mnfUwcNDNeDIQJz4c="; artifacts = [ "libkrun.so" "libkrunfw.so.5" diff --git a/tests/artifacts.nix b/tests/artifacts.nix index 50faab5f7..ef5e26988 100644 --- a/tests/artifacts.nix +++ b/tests/artifacts.nix @@ -12,6 +12,9 @@ let gnuToolchain = toolchains.${if isAarch64 then "aarch64-gnu" else "x86_64-gnu"}; muslToolchain = toolchains.${if isAarch64 then "aarch64-musl" else "x86_64-musl"}; dockerArch = if isAarch64 then "arm64" else "amd64"; + linuxVmRuntime = pkgs.callPackage ../nix/pkgs/vm-runtime.nix { + stdenv = gnuToolchain.stdenv; + }; toolchainEnv = pkgs.lib.foldl' (env: toolchain: env // toolchain.env) { } ( builtins.attrValues toolchains ); @@ -222,7 +225,8 @@ rec { cargo build --target ${muslToolchain.target} \ -p openshell-cli \ - -p openshell-sandbox + -p openshell-sandbox \ + -p openshell-prover-cli cargo build --target ${gnuToolchain.target} \ -p openshell-gateway \ @@ -243,6 +247,55 @@ rec { install -D -m 0755 \ target/${gnuToolchain.target}/debug/openshell-supervisor \ artifacts/binaries/${gnuToolchain.target}/openshell-supervisor + + install -D -m 0755 \ + target/${muslToolchain.target}/debug/openshell-prover \ + artifacts/binaries/${muslToolchain.target}/openshell-prover + ''; + }; + + vmDriver = pkgs.writeShellApplication { + name = "build-artifacts-vm-driver"; + runtimeInputs = [ + pkgs.coreutils + pkgs.git + pkgs.zstd + rustToolchain + ]; + runtimeEnv = toolchainEnv; + text = '' + root=$(git rev-parse --show-toplevel) + cd "$root" + + cargo build --target ${muslToolchain.target} \ + -p openshell-driver-vm --no-default-features --bin openshell-vm-init + + install -D -m 0755 \ + target/${muslToolchain.target}/debug/openshell-vm-init \ + artifacts/binaries/${muslToolchain.target}/openshell-vm-init + + compressed_dir=$(mktemp -d -p /tmp openshell-vm-runtime.XXXXXX) + cleanup() { + status=$? + trap - EXIT + rm -rf -- "$compressed_dir" + exit "$status" + } + trap cleanup EXIT + cp ${linuxVmRuntime}/compressed/*.zst "$compressed_dir/" + zstd -19 -T1 artifacts/binaries/${muslToolchain.target}/openshell-sandbox \ + -o "$compressed_dir/openshell-sandbox.zst" + zstd -19 -T1 artifacts/binaries/${gnuToolchain.target}/openshell-supervisor \ + -o "$compressed_dir/openshell-supervisor.zst" + zstd -19 -T1 artifacts/binaries/${muslToolchain.target}/openshell-vm-init \ + -o "$compressed_dir/openshell-vm-init.zst" + OPENSHELL_VM_RUNTIME_COMPRESSED_DIR="$compressed_dir" \ + cargo build --target ${gnuToolchain.target} \ + -p openshell-driver-vm --bin openshell-driver-vm + + install -D -m 0755 \ + target/${gnuToolchain.target}/debug/openshell-driver-vm \ + artifacts/binaries/${gnuToolchain.target}/openshell-driver-vm ''; }; @@ -352,6 +405,32 @@ rec { ''; }; + deb = pkgs.writeShellApplication { + name = "build-artifacts-deb"; + runtimeInputs = [ + pkgs.coreutils + pkgs.dpkg + pkgs.git + pkgs.gzip + ]; + text = '' + root=$(git rev-parse --show-toplevel) + cd "$root" + + package_version="''${OPENSHELL_DEB_VERSION:-0.0.0-local}" + OPENSHELL_CLI_BINARY="$root/artifacts/binaries/${muslToolchain.target}/openshell" \ + OPENSHELL_GATEWAY_BINARY="$root/artifacts/binaries/${gnuToolchain.target}/openshell-gateway" \ + OPENSHELL_PROVER_BINARY="$root/artifacts/binaries/${muslToolchain.target}/openshell-prover" \ + OPENSHELL_DRIVER_VM_BINARY="$root/artifacts/binaries/${gnuToolchain.target}/openshell-driver-vm" \ + OPENSHELL_DEB_VERSION="$package_version" \ + OPENSHELL_DEB_ARCH=${dockerArch} \ + OPENSHELL_OUTPUT_DIR="$root/artifacts/packages" \ + tasks/scripts/package-deb.sh + install -m 0644 "artifacts/packages/openshell_''${package_version}_${dockerArch}.deb" \ + artifacts/packages/openshell.deb + ''; + }; + helm = pkgs.writeShellApplication { name = "build-artifacts-helm"; runtimeInputs = [ @@ -371,12 +450,16 @@ rec { name = "build-artifacts"; runtimeInputs = [ binaries + vmDriver + deb testArchives images helm ]; text = '' build-artifacts-binaries + build-artifacts-vm-driver + build-artifacts-deb build-artifacts-test-archives build-artifacts-images build-artifacts-helm