sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Permanent SPDK trial

Browse Source
This commit is contained in:
Audiobuzz
2026-06-27 19:29:19 +09:30
parent ce5af959ad
commit e43112b0f1
12 changed files with 554 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/extract-artifacts.sh
+33 -2
View File
@@ -39,12 +39,41 @@ STIG=${STIG:-true}
# cmdline. dm-verity needs TWO namespaces — erofs DATA and the verity HASH tree
# — because this distro's systemd-veritysetup does not support the in-file
# hash-offset layout (it ignores hash-offset= and fails to load the superblock).
# MUST match ROOT_DATA_UUID / ROOT_HASH_UUID in serving/spdk-setup.sh (assigned
# on the target via add_ns -u).
# The serving side reads these back from verity.json (single source of truth) —
# see serving/spdk/spdk-release.sh, which assigns them on the target via add_ns -u.
#
# PER-VERSION UUIDs: so a LONG-LIVED NVMe-oF target can serve MULTIPLE rootfs
# versions at once (rolling updates, TODO #6) the two namespaces must be globally
# distinct per version — otherwise two versions collide on the same by-id symlink
# (/dev/disk/by-id/nvme-uuid.<uuid>) on the host. We derive them deterministically
# from IMAGE_VERSION (sha1sum — coreutils only, no uuidgen dependency) and bake
# the result into BOTH the immutable UKI cmdline and verity.json. Determinism
# preserves the reproducible-build invariant (same version -> same UUIDs). The
# value need not be an RFC-v5 UUID — it only has to be well-formed + unique, and
# the cmdline and the serving target consume the SAME value (cmdline from here,
# target from verity.json). An explicit ROOT_DATA_UUID/ROOT_HASH_UUID env wins;
# with no version it falls back to the legacy fixed pair (single-version serving).
IMAGE_VERSION=${IMAGE_VERSION:-$(basename "$OUT")}
sha2uuid() { # arbitrary string -> stable UUID-formatted (8-4-4-4-12) hex
local h
h=$(printf '%s' "$1" | sha1sum | cut -c1-32)
printf '%s-%s-%s-%s-%s' "${h:0:8}" "${h:8:4}" "${h:12:4}" "${h:16:4}" "${h:20:12}"
}
if [ -n "$IMAGE_VERSION" ] && command -v sha1sum >/dev/null 2>&1; then
ROOT_DATA_UUID=${ROOT_DATA_UUID:-$(sha2uuid "fleet-rootfs-data-${IMAGE_VERSION}")}
ROOT_HASH_UUID=${ROOT_HASH_UUID:-$(sha2uuid "fleet-rootfs-hash-${IMAGE_VERSION}")}
fi
ROOT_DATA_UUID=${ROOT_DATA_UUID:-f1ee7000-0000-4000-8000-000000000001}
ROOT_HASH_UUID=${ROOT_HASH_UUID:-f1ee7000-0000-4000-8000-000000000002}
ROOT_DATA_DEV="/dev/disk/by-id/nvme-uuid.${ROOT_DATA_UUID}"
ROOT_HASH_DEV="/dev/disk/by-id/nvme-uuid.${ROOT_HASH_UUID}"
# Per-version subsystem NQN (distinct NQN per release) — lets a host attach to
# exactly one version's subsystem and gives clean per-release drain/allow-listing
# on the long-lived target. Written to verity.json for the serving side; NOT in
# the cmdline (host still discovers + connects; the by-UUID verity refs select
# what mounts). An explicit SUBNQN env wins.
SUBNQN_BASE=${SUBNQN_BASE:-nqn.2026-06.org.example.fleet:rootfs}
SUBNQN=${SUBNQN:-${SUBNQN_BASE}-${IMAGE_VERSION}}
for bin in virt-copy-out virt-ls guestfish mkfs.erofs veritysetup jq getfattr; do
command -v "$bin" >/dev/null || { echo "ERROR: $bin not found on build host" >&2; exit 1; }
@@ -141,8 +170,10 @@ mv "$WORK/rootfs.hash" "$OUT/rootfs.hash"
jq -n --arg hash "$ROOT_HASH" --arg erofs_uuid "$FIXED_UUID" \
--arg data_uuid "$ROOT_DATA_UUID" --arg hash_uuid "$ROOT_HASH_UUID" \
--arg subnqn "$SUBNQN" --arg version "$IMAGE_VERSION" \
'{root_hash: $hash, erofs_uuid: $erofs_uuid,
data_ns_uuid: $data_uuid, hash_ns_uuid: $hash_uuid,
subnqn: $subnqn, image_version: $version,
data_block_size: 4096, hash_block_size: 4096}' \
> "$OUT/verity.json"