From 2d392f9d6962d71628e552f5be88451145964cfb Mon Sep 17 00:00:00 2001 From: ckoch Date: Wed, 29 Jul 2026 14:11:09 -0400 Subject: [PATCH] Build-it-yourself model: bluebuild switch, no published image, drop CI workflow Co-Authored-By: Claude Fable 5 --- .gitea/workflows/build.yml | 42 ----------- README.md | 148 ++++++++++++------------------------- recipes/recipe.yml | 6 +- 3 files changed, 51 insertions(+), 145 deletions(-) delete mode 100644 .gitea/workflows/build.yml diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml deleted file mode 100644 index 5a8b7f3..0000000 --- a/.gitea/workflows/build.yml +++ /dev/null @@ -1,42 +0,0 @@ -# Gitea Actions workflow. Uses the BlueBuild CLI directly — the blue-build/github-action -# is a GitHub-context composite and is not supported outside GitHub/GitLab CI. -# Runner requirement: act_runner must allow privileged job containers -# (container.privileged: true in the runner's config.yaml) — buildah needs it. -# NOTE: manual-only for now — no Actions runner is registered on the instance, and the -# image is currently built/pushed locally (see README "Building locally"). When a runner -# exists, restore the schedule + push triggers below to make builds fully automatic: -# schedule: -# - cron: "00 06 * * *" # daily rebuild pulls in base-image updates -# push: -# branches: [main] -# paths-ignore: ["**.md"] -name: bluebuild -on: - workflow_dispatch: - -jobs: - bluebuild: - name: Build Custom Image - runs-on: ubuntu-latest - container: - image: ghcr.io/blue-build/cli:v0.9 - options: --privileged - env: - # Auto-signs on push when this + cosign.pub (repo root) are present. - COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} - # Gitea's auto job token cannot push packages (documented limitation), - # so registry auth uses a PAT with write:package scope. - BB_REGISTRY: git.lazypugs.com - BB_REGISTRY_NAMESPACE: ckoch - BB_USERNAME: ckoch - BB_PASSWORD: ${{ secrets.REGISTRY_TOKEN }} - steps: - # Plain clone instead of actions/checkout: the CLI job container isn't - # guaranteed to have node, and the repo is public. - - name: Clone repo - run: | - git config --global --add safe.directory "$(pwd)" - git clone --depth 1 --branch "${GITHUB_REF_NAME:-main}" "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" . - - - name: Build and push signed image - run: bluebuild build --verbose --push --retry-push recipes/recipe.yml diff --git a/README.md b/README.md index 5c9b88c..d19eb74 100644 --- a/README.md +++ b/README.md @@ -1,9 +1,8 @@ # main-desktop -Custom [Bazzite DX](https://github.com/ublue-os/bazzite-dx) image for my desktop, built with -[BlueBuild](https://blue-build.org), published signed (cosign) to the container registry on my -Gitea instance (**git.lazypugs.com**) — built locally today, Gitea Actions-ready when a runner -is registered. +Custom [Bazzite DX](https://github.com/ublue-os/bazzite-dx) image for my desktop, defined with +[BlueBuild](https://blue-build.org). **There is no published image** — clone this repo and build +it yourself; `bluebuild switch` rebases the running system straight onto the local build. - **Base:** `ghcr.io/ublue-os/bazzite-dx-nvidia` — Bazzite DX, KDE Plasma, **NVIDIA open kernel modules**. There is no separate `-open` DX image anymore: DX NVIDIA is open-driver-only, which @@ -14,110 +13,56 @@ is registered. - **This image layers almost nothing.** The base already includes Steam and the gaming stack, Flatpak, Docker CE + CLI, Podman, VS Code, Homebrew, **and nvidia-container-toolkit with automatic CDI setup** (`ublue-nvctk-cdi.service` regenerates `/etc/cdi/nvidia.yaml` each boot). - What this recipe adds: the cosign signature-verification policy and a declarative first-boot - Flatpak set. That's it — by design. + What this recipe adds: a declarative first-boot Flatpak set (and a dormant signing policy). + That's it — by design. -Why BlueBuild instead of the raw Containerfile template: with the container toolkit already -in-image, the whole custom layer is "install these Flatpaks on first boot + trust my signature", -which the `default-flatpaks` and `signing` modules express declaratively in ~40 lines of YAML — -no hand-rolled first-boot systemd unit needed. +Why BlueBuild instead of a raw Containerfile: the whole custom layer is "install these Flatpaks +on first boot", which the `default-flatpaks` module expresses declaratively — and +`bluebuild switch` gives a one-command build-and-rebase with no registry involved. -## Building & publishing +## Getting onto this image (fresh desktop rebuild) -### Locally (current path) +1. Install stock **Bazzite DX (NVIDIA)** from the official ISO at + [bazzite.gg](https://bazzite.gg) and boot into it. +2. Install the BlueBuild CLI and switch: -The image is built and pushed from a workstation with the BlueBuild CLI driving Docker. From -the repo root (needs `cosign.key` present there, and ~25 GB free for layers): + ```bash + git clone https://git.lazypugs.com/ckoch/main-desktop.git && cd main-desktop + podman run --pull always --rm ghcr.io/blue-build/cli:latest-installer | bash + bluebuild switch recipes/recipe.yml # add --reboot to reboot when done + ``` + + `switch` builds the image locally, stores it as an oci-archive under `/etc/bluebuild/`, and + rebases `rpm-ostree` onto it. First build pulls the multi-GB base — give it time and disk + (~25 GB free). +3. Reboot. Done — the first-boot service then installs the Flatpak list below (needs a few + minutes on first login; check with `flatpak list --system`). + +Alternatively, `bluebuild generate-iso recipes/recipe.yml` can produce installer media with the +custom image baked in, skipping step 1's stock install. + +**Updating later** (pulls the newest Bazzite `stable-44` base plus any recipe changes): ```bash -# One-time CLI install (extracts a static binary to /usr/local/bin/bluebuild): -docker run --pull always --rm ghcr.io/blue-build/cli:latest-installer | bash - -# Build, push, and sign in one shot: -BB_USERNAME=ckoch BB_PASSWORD= \ - bluebuild build --push --retry-push \ - --registry git.lazypugs.com --registry-namespace ckoch \ - recipes/recipe.yml +cd main-desktop && git pull && bluebuild update recipes/recipe.yml --reboot ``` -Tags are pinned in the recipe (`alt-tags: latest, stable-44`), so the pushed refs are the same -no matter where the build runs. Signing happens automatically because `cosign.pub` is in the -repo root and the key is available. **Rebuild cadence is manual under this model** — run the -build when you want base-image updates rolled in; the OS then picks them up on its normal -update timer. - -### Gitea Actions (optional, needs a runner) - -[.gitea/workflows/build.yml](.gitea/workflows/build.yml) runs the same **BlueBuild CLI** build -(the `blue-build/github-action` is GitHub-only). It is currently `workflow_dispatch`-only -because no Actions runner is registered on the instance; when one exists, restore the -commented-out `schedule` + `push` triggers in the workflow to make builds fully automatic -(daily rebuilds = true self-updating). - -Repo secrets (already configured): - -- `SIGNING_SECRET` — contents of `cosign.key` (generated with an empty password; the public half - is committed as `cosign.pub`). The CLI signs automatically on push when both are present. -- `REGISTRY_TOKEN` — a Gitea personal access token with **write:package** scope, used to push to - the registry. Gitea's automatic per-job token *cannot* publish packages (documented Gitea - limitation), hence the PAT. **Currently seeded with a temporary token — before revoking it, - create a durable PAT (Settings → Applications → Generate token, `write:package`) and update - the secret** (repo Settings → Actions → Secrets, or - `PUT /api/v1/repos/ckoch/main-desktop/actions/secrets/REGISTRY_TOKEN`). - -Runner requirements when you set one up (act_runner): - -- **Privileged job containers must be allowed** — the build runs buildah inside the job - container (`ghcr.io/blue-build/cli`). In the runner's `config.yaml`: - `container: { privileged: true }`. Without it the build fails at the buildah stage. -- Internet access (pulls the multi-GB Bazzite base from ghcr.io) and ~25+ GB free scratch disk. - -## Rebasing the desktop onto this image - -From the existing Bazzite install, rebase in two steps — first unsigned (this installs the image, -which contains the signing policy and public key), then signed: - -```bash -# Step 1: unsigned rebase, then reboot -rpm-ostree rebase ostree-unverified-registry:git.lazypugs.com/ckoch/main-desktop:latest -systemctl reboot - -# Step 2: switch to the signed ref, then reboot -rpm-ostree rebase ostree-image-signed:docker://git.lazypugs.com/ckoch/main-desktop:latest -systemctl reboot -``` - -After step 2, every update is signature-verified. `:latest` is fine here — the Fedora pin lives -in the recipe, so `latest` never crosses a major until the recipe says so. - Roll back anytime with `rpm-ostree rollback` (or pick the previous deployment in the boot menu). -Notes for a self-hosted registry: - -- The repo/package is public, so anonymous pulls work and the desktop needs no auth config. If - you ever make it private, the *host* needs credentials in `/etc/ostree/auth.json` - (containers-auth.json format) — `podman login` alone does not cover OS updates. -- Updates only flow while git.lazypugs.com is reachable; if the box is down, updates pause and - retry later. The running system is unaffected. +Note on signing: local oci-archive rebases are inherently unsigned (`ostree-unverified-image`), +so cosign doesn't apply here. The recipe keeps the `signing` module and `cosign.pub` so that +publishing signed images to a registry later is just a `bluebuild build --push` away. ## Install-time checklist 1. **Driver sanity:** `nvidia-smi` reports driver **≥ 580** (currently 610.x) and the RTX 5090 is listed. Confirm open kernel modules: `modinfo -F license nvidia` should say `Dual MIT/GPL` (the proprietary module says `NVIDIA`). Blackwell only works on the open modules. -2. **Signature:** verify the published image against the committed public key: - - ```bash - cosign verify --key cosign.pub git.lazypugs.com/ckoch/main-desktop:latest - ``` - -3. **Deployment:** `rpm-ostree status` shows the booted deployment is - `ostree-image-signed:docker://git.lazypugs.com/ckoch/main-desktop` and the base version - matches a recent build. -4. **Flatpaks:** the first-boot service installs the whole list below; give it a few minutes on - first login (it notifies when done). Check with `flatpak list --system`. -5. **Docker group:** run `ujust dx-group` (adds you to `docker` and friends), then log out/in. -6. **GPU in containers:** see the section below — run the one-liner test. +2. **Deployment:** `rpm-ostree status` shows the booted deployment is the local build + (`ostree-unverified-image:oci-archive:/etc/bluebuild/...`) with the expected base version. +3. **Flatpaks:** all installed (`flatpak list --system` — 19 apps from the list below). +4. **Docker group:** run `ujust dx-group` (adds you to `docker` and friends), then log out/in. +5. **GPU in containers:** run the one-liner test in the next section. ## GPU in containers (CUDA on the 5090) @@ -212,13 +157,14 @@ no local hypervisor tooling in this image. ## Maintenance -- **Change the Flatpak list / packages:** edit [recipes/recipe.yml](recipes/recipe.yml), push, - rebuild (see "Building & publishing"), and the next OS update picks it up. (Removing an app - from the list does not uninstall it from the machine; `flatpak uninstall` it once by hand.) +- **Change the Flatpak list / packages:** edit [recipes/recipe.yml](recipes/recipe.yml), commit, + and re-run `bluebuild switch`. (Removing an app from the list does not uninstall it from the + machine; `flatpak uninstall` it once by hand.) - **Jump Fedora majors:** change `image-version: stable-44` → `stable-45` in the recipe when - ready, rebuild, then update normally. -- **Pull in base-image updates:** just rebuild — the base tag is `stable-44`, so each rebuild - picks up the newest Bazzite build within Fedora 44. -- **Key hygiene:** `cosign.key` is git-ignored and lives only on the workstation + in the - `SIGNING_SECRET` secret — keep a backup (password manager). Losing it means generating a new - pair, updating the secret, and re-doing the two-step rebase to re-establish trust. + ready, then `bluebuild switch`. +- **Reclaim build disk:** `bluebuild prune` cleans build caches. +- **Publishing later:** if this ever moves to a registry + signed rebases, the pieces are in + place — `cosign.pub` is committed, the signing module is in the recipe, and + `bluebuild build --push --registry --registry-namespace ` does the rest (note: + as of CLI v0.9.36, local `build` runs bake the signing policy for `localhost` — a registry + push should be done from CI or with a `bluebuild generate`-based two-step). diff --git a/recipes/recipe.yml b/recipes/recipe.yml index a85cba2..cf4d397 100644 --- a/recipes/recipe.yml +++ b/recipes/recipe.yml @@ -46,6 +46,8 @@ modules: - org.godotengine.Godot - org.videolan.VLC - # Installs the cosign public key + container signature-verification policy - # so `bootc`/`rpm-ostree` signed rebases work. Requires cosign.pub at repo root. + # Installs the cosign public key + container signature-verification policy. + # Unused in the current build-locally model (`bluebuild switch` rebases from a + # local oci-archive, unsigned) — kept so publishing to a registry later only + # requires a push, not a recipe change. Requires cosign.pub at repo root. - type: signing