From 327799a666983cea76dfd330cb9c00e2eab9dea0 Mon Sep 17 00:00:00 2001
From: Audiobuzz <audiobuzz@gmail.com>
Date: Sat, 13 Jun 2026 05:07:49 +0000
Subject: [PATCH] Adding packer host tooling

---
 .gitea/workflows/gitea-main-ci.yaml | 16 +++++++++++++++-
 CLAUDE.md                           | 10 ++++++++++
 README.md                           |  3 ++-
 diskless.pkr.hcl                    |  5 ++++-
 4 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/gitea-main-ci.yaml b/.gitea/workflows/gitea-main-ci.yaml
index 4f501bb..3586099 100644
--- a/.gitea/workflows/gitea-main-ci.yaml
+++ b/.gitea/workflows/gitea-main-ci.yaml
@@ -75,11 +75,17 @@ jobs:
         # libguestfs (virt-*), erofs-utils (mkfs.erofs), cryptsetup
         # (veritysetup), jq, systemd-ukify (ukify), buildah (OCI), plus qemu +
         # shellcheck for the lint gate.
+        #
+        # libguestfs builds a supermin appliance on first use, which needs a
+        # kernel + modules present on the runner (incl. xfs, to read the build
+        # VM's xfs root). The runner container ships none, so install one and
+        # make /boot readable (Ubuntu ships vmlinuz mode 0600).
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
-            qemu-system-x86 qemu-utils libguestfs-tools \
+            qemu-system-x86 qemu-utils libguestfs-tools linux-image-generic \
             erofs-utils cryptsetup-bin jq systemd-ukify buildah shellcheck
+          sudo chmod 0644 /boot/vmlinuz-* 2>/dev/null || true
 
       -
         name: Setup Packer
@@ -106,6 +112,14 @@ jobs:
         name: packer validate
         run: packer validate .
 
+      -
+        name: Verify libguestfs appliance (fast gate)
+        # Fail in ~1 min if supermin can't build/boot the appliance, instead of
+        # after the ~17-min VM build when extract-artifacts.sh first runs virt-ls.
+        env:
+          LIBGUESTFS_BACKEND: direct
+        run: libguestfs-test-tool
+
       -
         name: Registry login
         # Enables oci_push=true in the build step below.
diff --git a/CLAUDE.md b/CLAUDE.md
index b3ec231..6dece16 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -7,6 +7,16 @@ immutable **erofs + dm-verity root over NVMe/TCP**. Each release is a signed
 **UKI** plus root image packaged as a **FROM-scratch OCI artifact image**.
 The authoritative architecture document is
 `docs/diskless-fleet-design-v2.pdf` — read it before structural changes.
+`docs/design-v2-errata.md` records where the as-built RHEL/Rocky 9
+implementation diverges from it (pending a consolidated v3).
+
+## Backlog (read at session start)
+
+`docs/TODO.md` is the **persistent backlog** and the durable source of truth for
+outstanding work — it survives across sessions (the TodoWrite task tracker does
+not). At the start of a session, read it and mirror its open items into the
+TodoWrite tracker. Whenever items change (added, started, completed), update
+**both** `docs/TODO.md` and the tracker so they stay in sync.
 
 ## Repo layout
 
diff --git a/README.md b/README.md
index a60e6d5..d86b352 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,8 @@ authenticate with 802.1X EAP-TLS (TPM-held key, certificate in TPM NV) and run
 MACsec on the access link. The root filesystem is an immutable, reproducible
 **erofs image with an appended dm-verity hash tree**, served as a single
 shared **read-only NVMe/TCP namespace**, with a tmpfs overlay for runtime
-state. Companion to `docs/diskless-fleet-design-v2.pdf`.
+state. Companion to `docs/diskless-fleet-design-v2.pdf` (see
+`docs/design-v2-errata.md` for as-built deltas on RHEL/Rocky 9).
 
 ## Layout
 
diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl
index 40ebac2..217d607 100644
--- a/diskless.pkr.hcl
+++ b/diskless.pkr.hcl
@@ -179,7 +179,10 @@ build {
       # omits it; without it network-legacy fails dracut's check() and the
       # diskless module 'cannot be installed'. (Strategic path: port the hook to
       # the 'network-manager' dracut module — see CLAUDE.md bench-verify notes.)
-      "dnf -y install wpa_supplicant tpm2-tools tpm2-tss nvme-cli cryptsetup dracut-network dhcp-client openssl",
+      # zstd: dracut compresses the initramfs with compress="zstd"
+      # (90-diskless.conf); the minimal ISO lacks the zstd binary, so without it
+      # dracut warns and silently falls back to gzip (a larger initramfs).
+      "dnf -y install wpa_supplicant tpm2-tools tpm2-tss nvme-cli cryptsetup dracut-network dhcp-client zstd openssl",
 
       # Stage etc files into place
       "install -D -m0644 /tmp/etc-stage/dot1x/radius-ca.pem            /etc/dot1x/radius-ca.pem",