Emil_Shanaty/Hydra-OS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add read-only laptop doctor and trusted image recovery entrypoints

Browse Source
This commit is contained in:
Codex
2026-10-13 21:52:38 +03:00
parent 87003e92c6
commit 00aa0229cc
7 changed files with 471 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hydra/image.py
+24 -5
View File
@@ -269,8 +269,10 @@ def brand_os_release(root):
def configure_rootfs(root, source):
root, source = Path(root), Path(source)
# Refuse incomplete integrations before changing the exported copy.
for name in ('bin/hydra', 'bin/hydra-install', 'hydra/session.py', 'hydra/installer.py'):
if not (source / name).is_file():
for name in ('bin/hydra', 'bin/hydra-install', 'hydra/session.py', 'hydra/installer.py',
'bin/hydra-update', 'bin/hydra-update-recover', 'hydra/update_engine.py',
'bin/hydra-system', 'hydra/system_recovery.py', 'image/rootfs/etc/hydra/update.pub'):
if (source / name).is_symlink() or not (source / name).is_file():
raise ImageError(f'Required committed runtime/installer asset is missing: {name}')
version = kernel_version(root)
kernel = kernel_image(root)
@@ -287,11 +289,28 @@ def configure_rootfs(root, source):
for module in sorted((source / 'hydra').glob('*.py')):
shutil.copyfile(module, root_path(root, 'usr/lib/hydra/hydra/' + module.name))
# Session helpers derive this checkout-compatible launcher from __file__.
for name in ('hydra', 'hydra-install'):
for name in ('hydra', 'hydra-install', 'hydra-system'):
write(root, 'usr/lib/hydra/bin/' + name, (source / 'bin' / name).read_text(), 0o755)
for name, module in (('hydra', 'cli'), ('hydra-install', 'installer')):
# The updater bootstrap and engine are independently installed trusted files.
# They must retain their isolated runpy launchers, outside runtime imports.
for destination, asset, mode in (
('usr/lib/hydra-update/engine.py', 'hydra/update_engine.py', 0o644),
('usr/bin/hydra-update', 'bin/hydra-update', 0o755),
('usr/bin/hydra-update-recover', 'bin/hydra-update-recover', 0o755),
('etc/hydra/update.pub', 'image/rootfs/etc/hydra/update.pub', 0o644),
):
remove(root, destination)
path = write(root, destination, (source / asset).read_text(), mode)
if os.geteuid() == 0: # Assembly runs as root; source fixtures remain unprivileged.
os.chown(path, 0, 0)
engine_directory = root_path(root, 'usr/lib/hydra-update')
engine_directory.chmod(0o755)
if os.geteuid() == 0:
os.chown(engine_directory, 0, 0)
for name, module in (('hydra', 'cli'), ('hydra-install', 'installer'),
('hydra-system', 'system_recovery')):
write(root, 'usr/bin/' + name,
'#!/usr/bin/python3\nimport sys\nsys.path.insert(0, "/usr/lib/hydra")\n'
'#!/usr/bin/python3 -I\nimport sys\nsys.path.insert(0, "/usr/lib/hydra")\n'
f'from hydra.{module} import main\nraise SystemExit(main())\n', 0o755)
write(root, 'usr/bin/hydra-session', '#!/bin/sh\nexec /usr/bin/hydra session "$@"\n', 0o755)
write(root, 'usr/bin/hydra-network', '#!/usr/bin/python3\nimport sys\nsys.path.insert(0, "/usr/lib/hydra")\n'