Skip to content

Commit 2152d79

Browse files
alexhulbertalexhulbert
authored
Merge pull request #10 from flashbots/bob
Bob
2 parents 1a9c0a1 + 626b343 commit 2152d79

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

60 files changed

+5545
-217
lines changed

‎base/base.conf‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,15 @@
22
Distribution=debian
33
Release=trixie
44

5+
[Build]
6+
PackageCacheDirectory=mkosi.cache
7+
Environment=KERNEL_IMAGE KERNEL_VERSION
8+
59
[Output]
610
Format=uki
11+
ManifestFormat=json
712
ImageId=tdx-debian
813
OutputDirectory=build
9-
PackageCacheDirectory=mkosi.cache
1014
Seed=630b5f72-a36a-4e83-b23d-6ef47c82fd9c
1115

1216
[Host]
@@ -15,19 +19,20 @@ Seed=630b5f72-a36a-4e83-b23d-6ef47c82fd9c
1519
[Content]
1620
SourceDateEpoch=0
1721
KernelCommandLine=console=tty0 console=ttyS0,115200n8 mitigations=auto,nosmt spec_store_bypass_disable=on nospectre_v2
18-
Environment=KERNEL_IMAGE KERNEL_VERSION
1922
SkeletonTrees=base/mkosi.skeleton
2023
FinalizeScripts=base/debloat.sh
2124
PostInstallationScripts=base/debloat-systemd.sh
2225
BuildScripts=base/mkosi.build
23-
PrepareScripts=base/export-packages.sh
2426

2527
CleanPackageMetadata=true
2628
Packages=kmod
2729
systemd
2830
systemd-boot-efi
2931
busybox
3032
util-linux
33+
procps
34+
ca-certificates
35+
openssl
3136
iproute2
3237
udhcpc
3338
e2fsprogs
@@ -37,4 +42,4 @@ BuildPackages=build-essential
3742
cmake
3843
pkg-config
3944
clang
40-
cargo
45+
cargo

‎base/debloat-systemd.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ systemd_bin_whitelist=(
2222
"systemctl"
2323
"journalctl"
2424
"systemd"
25+
"systemd-tty-ask-password-agent"
2526
)
2627

2728
mkosi-chroot dpkg-query -L systemd | grep -E '^/usr/bin/' | while read -r bin_path; do

‎base/debloat.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ debloat_paths=(
2727
"/usr/share/mime"
2828
"/usr/lib/modules"
2929
"/usr/lib/udev/hwdb.d"
30+
"/usr/lib/udev/hwdb.bin"
3031
"/usr/lib/systemd/catalog"
3132
"/usr/lib/systemd/user"
3233
"/usr/lib/systemd/user-generators"
@@ -35,7 +36,6 @@ debloat_paths=(
3536
"/usr/lib/tmpfiles.d"
3637
"/etc/systemd/network"
3738
"/etc/credstore"
38-
"/usr/lib/x86_64-linux-gnu/security"
3939
)
4040

4141
for p in "${debloat_paths[@]}"; do rm -rf "$BUILDROOT$p"; done

‎base/export-packages.sh‎

Lines changed: 0 additions & 5 deletions
This file was deleted.

‎base/mkosi.skeleton/etc/systemd/system/persistent-mount.service‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[Unit]
2+
Description=Wait for Persistent Directory Mount
3+
DefaultDependencies=no
4+
Conflicts=shutdown.target
5+
Before=minimal.target
6+
After=local-fs-pre.target
7+
8+
[Service]
9+
Type=oneshot
10+
ExecStart=/bin/bash -c 'until grep -q " /persistent " /proc/mounts; do sleep 1; done'
11+
RemainAfterExit=yes
12+
13+
[Install]
14+
WantedBy=minimal.target

‎base/mkosi.skeleton/init‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,5 +8,10 @@ mount -t devtmpfs none /dev
88
mount -t tmpfs none /run
99
mount -t configfs none /sys/kernel/config
1010

11-
# Execute systemd
12-
exec /lib/systemd/systemd systemd.unit=minimal.target
11+
# Workaround to make pivot_root work
12+
# https://aconz2.github.io/2024/07/29/container-from-initramfs.html
13+
exec unshare --mount sh -c '
14+
mkdir /@
15+
mount --rbind / /@
16+
cd /@ && mount --move . /
17+
exec chroot . /lib/systemd/systemd systemd.unit=minimal.target'

‎base/mkosi.skeleton/usr/bin/azure-complete-provisioning‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
#!/bin/sh
2+
# Report VM is ready to Azure API in the absence of the Azure VM Agent
3+
# Adapted from https://learn.microsoft.com/en-us/azure/virtual-machines/linux/no-agent#bash-script
4+
5+
set -e
6+
7+
attempts=1
8+
retrieved_goal_state=false
9+
until [ "$attempts" -gt 5 ]
10+
do
11+
echo "obtaining goal state - attempt $attempts"
12+
goalstate=$(curl --fail -v -X 'GET' -H "x-ms-agent-name: azure-vm-register" \
13+
-H "Content-Type: text/xml;charset=utf-8" \
14+
-H "x-ms-version: 2012-11-30" \
15+
"http://168.63.129.16/machine/?comp=goalstate")
16+
if [ $? -eq 0 ]
17+
then
18+
echo "successfully retrieved goal state"
19+
retrieved_goal_state=true
20+
break
21+
fi
22+
sleep 5
23+
attempts=$((attempts+1))
24+
done
25+
26+
if [ "$retrieved_goal_state" != "true" ]
27+
then
28+
echo "failed to obtain goal state - cannot register this VM"
29+
exit 1
30+
fi
31+
32+
container_id=$(echo "$goalstate" | grep ContainerId | sed 's/\s*<\/*ContainerId>//g' | sed 's/\r$//')
33+
instance_id=$(echo "$goalstate" | grep InstanceId | sed 's/\s*<\/*InstanceId>//g' | sed 's/\r$//')
34+
35+
ready_doc=$(cat << EOF
36+
<?xml version="1.0" encoding="utf-8"?>
37+
<Health xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
38+
<GoalStateIncarnation>1</GoalStateIncarnation>
39+
<Container>
40+
<ContainerId>$container_id</ContainerId>
41+
<RoleInstanceList>
42+
<Role>
43+
<InstanceId>$instance_id</InstanceId>
44+
<Health>
45+
<State>Ready</State>
46+
</Health>
47+
</Role>
48+
</RoleInstanceList>
49+
</Container>
50+
</Health>
51+
EOF
52+
)
53+
54+
attempts=1
55+
until [ "$attempts" -gt 5 ]
56+
do
57+
echo "registering with Azure - attempt $attempts"
58+
curl --fail -v -X 'POST' -H "x-ms-agent-name: azure-vm-register" \
59+
-H "Content-Type: text/xml;charset=utf-8" \
60+
-H "x-ms-version: 2012-11-30" \
61+
-d "$ready_doc" \
62+
"http://168.63.129.16/machine?comp=health"
63+
if [ $? -eq 0 ]
64+
then
65+
echo "successfully register with Azure"
66+
exit 0
67+
fi
68+
sleep 5 # sleep to prevent throttling from wire server
69+
attempts=$((attempts+1))
70+
done
71+
72+
echo "failed to register with Azure after $attempts attempts"
73+
exit 1

‎bob.conf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
[Include]
2+
Include=base/base.conf
3+
Include=bob/bob.conf
4+
5+
[Distribution]
6+
Mirror=https://snapshot.debian.org/archive/debian/20250526T142542Z/
7+
8+
[Build]
9+
ToolsTreeMirror=https://snapshot.debian.org/archive/debian/20250526T142542Z/

‎bob/bob.conf‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
[Build]
2+
Environment=LIGHTHOUSE_BINARY
3+
WithNetwork=true
4+
5+
[Content]
6+
ExtraTrees=bob/mkosi.extra
7+
PostInstallationScripts=bob/mkosi.postinst
8+
BuildScripts=bob/mkosi.build
9+
10+
Packages=podman
11+
runc
12+
dropbear
13+
socat
14+
iptables
15+
iproute2
16+
conntrack
17+
netfilter-persistent
18+
openntpd
19+
curl
20+
jq
21+
ncat
22+
logrotate
23+
sudo
24+
uidmap
25+
passt
26+
fuse-overlayfs
27+
cryptsetup
28+
openssh-sftp-server
29+
udev
30+
libsnappy1v5
31+
32+
BuildPackages=build-essential
33+
git
34+
gcc
35+
zlib1g-dev
36+
libzstd-dev
37+
libleveldb-dev
38+
libsnappy-dev
39+
libpq-dev
40+
libssl-dev
41+
golang

‎bob/mkosi.build‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#!/bin/bash
2+
set -euxo pipefail
3+
4+
source scripts/build_rust_package.sh
5+
source scripts/make_git_package.sh
6+
7+
# Compile searchersh
8+
mkdir -p "$DESTDIR/usr/bin"
9+
mkosi-chroot gcc -o "$DESTDIR/usr/bin/searchersh" "$SRCDIR/bob/searchersh.c"
10+
chmod 755 "$DESTDIR/usr/bin/searchersh"
11+
12+
# Compile lighthouse
13+
build_rust_package \
14+
"lighthouse" \
15+
"v7.0.1" \
16+
"https://github.com/sigp/lighthouse.git" \
17+
"$LIGHTHOUSE_BINARY" \
18+
"modern" \
19+
"-l z -l zstd -l snappy"
20+
21+
# Build tdx-init
22+
make_git_package \
23+
"tdx-init" \
24+
"v0.1.1" \
25+
"https://github.com/flashbots/tdx-init" \
26+
'go build -trimpath -ldflags "-s -w -buildid=" -o ./build/tdx-init' \
27+
"build/tdx-init:/usr/bin/tdx-init"
28+
29+
# Build ssh-pubkey-server
30+
make_git_package \
31+
"ssh-pubkey-server" \
32+
"second-key" \
33+
"https://github.com/flashbots/ssh-pubkey-server" \
34+
'go build -trimpath -ldflags "-s -w -buildid= -X github.com/flashbots/go-template/common.Version=v1.0.0" -o ./build/ssh-pubkey-server cmd/httpserver/main.go' \
35+
"build/ssh-pubkey-server:/usr/bin/ssh-pubkey-server"
36+
37+
make_git_package \
38+
"cvm-reverse-proxy" \
39+
"v0.1.7" \
40+
"https://github.com/flashbots/cvm-reverse-proxy" \
41+
"make build-proxy-server" \
42+
"build/proxy-server:/usr/bin/cvm-reverse-proxy"

0 commit comments

Comments
 (0)