quine-linux/Taskfile.yml

version: '3'

vars:
  IMAGE: quine-linux
  INSTALLER_IMAGE: quine-installer
  # dnf .repo for the patched anaconda-webui, built by the fork's CI.
  RPM_REPO_URL: https://forge.quinefoundation.com/api/packages/quine/rpm.repo
  # Checksum of that repo's current metadata; passed as a build arg so the
  # installer's dnf layer is rebuilt exactly when a new RPM gets published.
  RPM_REPO_REV:
    sh: |
      [ -n "{{.RPM_REPO_URL}}" ] || exit 0
      base=$(curl -fsSL "{{.RPM_REPO_URL}}" | sed -n 's/^baseurl=//p' | head -1)
      sum() { if command -v sha256sum >/dev/null; then sha256sum; else shasum -a 256; fi; }
      curl -fsSL "$base/repodata/repomd.xml" 2>/dev/null | sum | cut -c1-16      
  OUTPUT_DIR: ./output
  # Any docker-CLI-compatible runtime works for plain builds. Prefers podman,
  # falls back to docker; override with CONTAINER_RUNTIME=... (env or task var).
  CONTAINER_RUNTIME:
    sh: echo "${CONTAINER_RUNTIME:-$(command -v podman >/dev/null 2>&1 && echo podman || echo docker)}"
  # bootc-image-builder now lives in github.com/osbuild/image-builder and is
  # published here; quay.io/centos-bootc/bootc-image-builder is frozen.
  BIB_IMAGE: ghcr.io/osbuild/bootc-image-builder:latest
  # Aurora is amd64-only (and the kmod stage hardcodes x86_64), so pin it
  # explicitly; otherwise an arm64 host (e.g. Apple Silicon) builds for arm64.
  PLATFORM: linux/amd64
  TARGET_ARCH: amd64
  SKOPEO_IMAGE: quay.io/skopeo/stable:latest
  # bootc-image-builder reads images from a containers-storage mounted at
  # /var/lib/containers/storage. Under podman that's root's real store; docker
  # has no such store, so images get copied (via skopeo) into this volume.
  DOCKER_STORAGE_VOLUME: quine-containers-storage
  STORAGE: '{{if eq .CONTAINER_RUNTIME "podman"}}/var/lib/containers/storage{{else}}{{.DOCKER_STORAGE_VOLUME}}{{end}}'
  PULL_FLAG: '{{if eq .CONTAINER_RUNTIME "podman"}}--pull=newer{{else}}--pull=always{{end}}'

tasks:
  default:
    desc: List available tasks
    cmds:
      - task --list
    silent: true

  build-image:
    desc: >-
      Build the quine-linux bootc container image, as root (under podman
      this lands in root's containers-storage, which bootc and
      bootc-image-builder read; under docker, the ISO tasks copy it over).      
    cmds:
      - sudo {{.CONTAINER_RUNTIME}} build --platform {{.PLATFORM}} -t {{.IMAGE}} -f Containerfile .
    sources:
      - Containerfile
      - overlay/**/*
      - patches/**/*

  build-iso:
    desc: >-
      Build a bootable install ISO from the local quine-linux image, via
      bootc-image-builder. Output lands in {{.OUTPUT_DIR}}/bootiso/install.iso.      
    deps: [build-image]
    cmds:
      - task: export-to-storage
        vars: { IMAGES: "{{.IMAGE}}" }
      - mkdir -p {{.OUTPUT_DIR}}
      - >-
        sudo {{.CONTAINER_RUNTIME}} run --rm --privileged {{.PULL_FLAG}}
        --security-opt label=type:unconfined_t
        -v {{.OUTPUT_DIR}}:/output
        -v {{.STORAGE}}:/var/lib/containers/storage
        {{.BIB_IMAGE}}
        --target-arch {{.TARGET_ARCH}}
        --type iso localhost/{{.IMAGE}}        
    generates:
      - "{{.OUTPUT_DIR}}/bootiso/install.iso"

  build-installer-image:
    desc: >-
      Build the patched-Anaconda installer-environment container (see
      installer/Containerfile and docs/patched-anaconda-installer.md). This
      is separate from the quine-linux OS image itself. Defaults to the
      anaconda-webui build at {{.RPM_REPO_URL}}; override with
      `task build-installer-image RPM_REPO_URL=...` (empty = stock Fedora).      
    cmds:
      - sudo {{.CONTAINER_RUNTIME}} build --platform {{.PLATFORM}} -t {{.INSTALLER_IMAGE}} --build-arg RPM_REPO_URL={{.RPM_REPO_URL}} --build-arg RPM_REPO_REV={{.RPM_REPO_REV}} -f installer/Containerfile installer/

  build-installer-iso:
    desc: >-
      Build a bootable install ISO using the patched-Anaconda installer
      image to install the quine-linux bootc image, via
      bootc-image-builder's `bootc-installer` type. Output lands in
      {{.OUTPUT_DIR}}/bootc-installer/install.iso. Uses the same RPM_REPO_URL
      default/override as build-installer-image.      
    deps: [build-image]
    cmds:
      - task: build-installer-image
        vars: { RPM_REPO_URL: "{{.RPM_REPO_URL}}" }
      - task: export-to-storage
        vars: { IMAGES: "{{.IMAGE}} {{.INSTALLER_IMAGE}}" }
      - mkdir -p {{.OUTPUT_DIR}}
      - >-
        sudo {{.CONTAINER_RUNTIME}} run --rm --privileged {{.PULL_FLAG}}
        --security-opt label=type:unconfined_t
        -v {{.OUTPUT_DIR}}:/output
        -v {{.STORAGE}}:/var/lib/containers/storage
        {{.BIB_IMAGE}}
        --target-arch {{.TARGET_ARCH}}
        --type bootc-installer
        --bootc-installer-payload-ref localhost/{{.IMAGE}}
        localhost/{{.INSTALLER_IMAGE}}        
    generates:
      - "{{.OUTPUT_DIR}}/bootc-installer/install.iso"

  export-to-storage:
    internal: true
    desc: >-
      Under docker, copy IMAGES (space-separated local tags) from the docker
      daemon into the containers-storage volume bootc-image-builder reads.
      No-op under podman, which builds straight into containers-storage.      
    status:
      - '[ "{{.CONTAINER_RUNTIME}}" = podman ]'
    cmds:
      - for: { var: IMAGES }
        cmd: >-
          sudo {{.CONTAINER_RUNTIME}} run --rm --privileged
          -v /var/run/docker.sock:/var/run/docker.sock
          -v {{.STORAGE}}:/var/lib/containers/storage
          {{.SKOPEO_IMAGE}}
          copy docker-daemon:{{.ITEM}}:latest containers-storage:localhost/{{.ITEM}}:latest          

  status:
    desc: Show current bootc deployment status (what's booted, what's staged/rollback).
    cmds:
      - bootc status

  test:stage:
    desc: >-
      Build the local image and stage it as the next-boot target on THIS
      machine (bootc switch, no reboot yet). This is the fast way to test a
      change -- especially the CS8409 mic-fix kernel module -- against the
      real running system without building an ISO or reinstalling anything.
      Reboot separately when ready: `task test:boot`, or `sudo systemctl reboot`.      
    deps: [build-image]
    cmds:
      # bootc reads the host's own containers-storage, i.e. podman's (which
      # every bootc host ships), so a docker-built image is loaded into it.
      - cmd: sudo docker save {{.IMAGE}} | sudo podman load
        platforms: [linux]
        if: '[ "{{.CONTAINER_RUNTIME}}" != podman ]'
      - sudo bootc switch --transport containers-storage localhost/{{.IMAGE}}
      - bootc status --booted
      - echo "Staged localhost/{{.IMAGE}} for next boot. Run task test:boot when ready to reboot into it."

  test:boot:
    desc: Stage the local image (if not already) and reboot into it now.
    prompt: This will reboot this machine into the locally-built {{.IMAGE}} image. Continue?
    deps: [test:stage]
    cmds:
      - sudo systemctl reboot

  revert:
    desc: >-
      Roll back to the previously-booted deployment and reboot into it --
      undoes a `test:boot` switch (or any other deployment change) if
      something's wrong. Safe even if nothing was ever switched: bootc/
      rpm-ostree always keep the prior deployment around for exactly this.      
    prompt: This will reboot this machine back into the previous deployment. Continue?
    cmds:
      - sudo bootc rollback
      - sudo systemctl reboot