Emil_Shanaty/Hydra-OS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add verified rootless Gentoo image builder and package inputs

Browse Source
This commit is contained in:
Codex
2026-10-13 04:12:00 +03:00
parent e6bec555c4
commit 440fe42464
11 changed files with 478 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
image/README.md
+38
View File
@@ -0,0 +1,38 @@
HydraOS builds start from the pinned amd64 systemd stage3 and pinned Gentoo
repository in `sources.json`. Run the builder as the normal user with Python 3,
Podman and GnuPG available; temporary tool environments are sufficient. It
refuses host root and work/cache paths outside the primary project checkout.
```
scripts/hydra-build fetch
scripts/hydra-build prepare
scripts/hydra-build packages --pretend
scripts/hydra-build packages
scripts/hydra-build status
```
`--work PATH`, `--cache PATH`, `--podman PATH` and `--gpg PATH` override defaults.
Linked worktrees use the primary checkout's `build/` and `cache/`. The build
lock prevents simultaneous writes in the same work directory. Interrupted
package installation resumes through Portage; successful steps write
`build/manifest.json`, signature evidence and the installed package/version/USE
inventory in `build/artifacts/`. Downloaded inputs are reverified on every
prepare; missing or changed files cannot be trusted from a checkpoint alone.
The dedicated rootless Podman store is `build/podman`, separate from default
Podman and Distrobox storage. The build container mounts inputs and repository
read-only and retains its writable layer across failures. Host networking makes
the existing local VPN/proxy available. `SYS_ADMIN` operates within the rootless
user namespace; package sandbox features incompatible with it are disabled.
No host disks or `/dev/kvm` are passed into the builder. Hydra never prunes
containers/images or changes host services.
Official Gentoo binpkgs require signatures. USE mismatches and selective testing
keywords can cause source builds; concurrency is four compiler processes and
one emerge job. Keep licenses and Portage's `/var/db/pkg`, world and repository
for installed-system updates. Rolling binhost contents can change; resulting
versions/USE are recorded without claiming bit-identical output. The pinned
service-keyring hash may need deliberate review when Gentoo rotates keys.
`rootfs` and `iso` are reserved assembly commands and currently return an
explicit error until the live-image assembly implementation is integrated.