Something went wrong. Try again.
Monorepo for Aesthetic.Computer aesthetic.computer
Something went wrong. Try again.
Shell
12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274#!/bin/bash# AC Native OS — Minimal reproducible build# Builds: C binary → initramfs → kernel → vmlinuz# Input: /src (repo), Output: /out/vmlinuzset -eu
SRC="${AC_SRC:-/repo}"OUT="${AC_OUT:-/out}"NATIVE="$SRC/fedac/native"BUILD="$NATIVE/build"KVER="${KERNEL_VERSION:-6.19.9}"KMAJOR="${KVER%%.*}"MEDIA_LAYOUT_LIB="$NATIVE/scripts/media-layout.sh"
log() { echo -e "\033[0;36m[ac-os]\033[0m $*"; }err() { echo -e "\033[0;31m[ac-os]\033[0m $*" >&2; }
# shellcheck source=/workspaces/aesthetic-computer/fedac/native/scripts/media-layout.shsource "$MEDIA_LAYOUT_LIB"
# Always build in /tmp inside the container to avoid bind-mount permission issuesBUILD="/tmp/ac-build"mkdir -p "$BUILD" "$OUT"
# ── Git info ──GIT_HASH="${AC_GIT_HASH:-$(cd "$SRC" 2>/dev/null && git rev-parse --short HEAD 2>/dev/null || echo unknown)}"BUILD_TS="${AC_BUILD_TS:-$(date -u '+%Y-%m-%dT%H:%M')}"BUILD_NAME="${AC_BUILD_NAME:-docker-build}"HANDLE="${AC_HANDLE:-jeffrey}"KERNEL_JOBS="${AC_KERNEL_JOBS:-$(nproc)}"
show_kernel_error_context() { local log_file="$1" local line local start local end
line=$(grep -n -m 1 -E '(^|[^[:alpha:]])error:|Error [0-9]+|No rule to make target|undefined reference' "$log_file" | cut -d: -f1 || true) if [ -n "$line" ]; then start=$((line > 80 ? line - 80 : 1)) end=$((line + 160)) err " Kernel error context (lines ${start}-${end}):" sed -n "${start},${end}p" "$log_file" >&2 fi err " Kernel build tail (last 220 lines):" tail -220 "$log_file" >&2 || true}
run_make_with_heartbeat() { local log_file="$1" shift local heartbeat_secs="${AC_KERNEL_HEARTBEAT_SECS:-20}" local last_count="-1" local last_line="" local line_count local current_line
: > "$log_file" "$@" >"$log_file" 2>&1 & local make_pid=$!
while kill -0 "$make_pid" 2>/dev/null; do sleep "$heartbeat_secs" [ -f "$log_file" ] || continue line_count=$(wc -l <"$log_file" 2>/dev/null || echo 0) current_line=$(tail -1 "$log_file" 2>/dev/null || true) current_line="${current_line:0:180}" if [ "$line_count" != "$last_count" ] || [ "$current_line" != "$last_line" ]; then log " [kernel] running... lines=$line_count last=$current_line" last_count="$line_count" last_line="$current_line" else log " [kernel] running... lines=$line_count (no new lines yet)" fi done
if wait "$make_pid"; then return 0 fi return $?}
# ── ccache setup (persisted via Docker volume at /ccache) ──export CCACHE_DIR="${CCACHE_DIR:-/ccache}"mkdir -p "$CCACHE_DIR"# 2G could not hold a 6.19 kernel tree plus ac-native even compressed, so the# cache thrashed and evicted the objects it was about to be asked for. Worth# raising now that the build stamp no longer poisons every lookup (see the# Makefile's STAMP_CFLAGS) and hits are actually achievable.export CCACHE_MAXSIZE="${CCACHE_MAXSIZE:-10G}"export CCACHE_COMPRESS=1if command -v ccache &>/dev/null; then CC_USE="ccache gcc" log "ccache: enabled (dir=$CCACHE_DIR, max=$CCACHE_MAXSIZE)" ccache -s 2>/dev/null | grep -E "cache size|hit rate" || trueelse CC_USE="gcc"fi
log "Building $BUILD_NAME ($GIT_HASH)"
# ══════════════════════════════════════════════# Step 1: Compile ac-native binary# ══════════════════════════════════════════════log "Step 1/4: Compiling ac-native..."cd "$NATIVE"
# Use cached QuickJS (from Docker image) or downloadif [ ! -f "$BUILD/quickjs/quickjs.h" ]; then if [ -d /cache/quickjs ]; then log " Using cached QuickJS..." cp -a /cache/quickjs-2024-01-13 "$BUILD/" ln -sf quickjs-2024-01-13 "$BUILD/quickjs" else log " Downloading QuickJS..." cd "$BUILD" curl -sL https://bellard.org/quickjs/quickjs-2024-01-13.tar.xz | tar xJ ln -sf quickjs-2024-01-13 quickjs fi cd "$NATIVE"fi
make -j$(nproc) CC="${CC_USE}" BUILDDIR="$BUILD" \ BUILD_TS="$BUILD_TS" GIT_HASH="$GIT_HASH" BUILD_NAME="$BUILD_NAME" \ > "$BUILD/.make.log" 2>&1 || true
[ -f "$BUILD/ac-native" ] || { show_kernel_error_context "$BUILD/.make.log"; cp "$BUILD/.make.log" "$OUT/ac-native.make.log" 2>/dev/null || true; err "Binary compilation failed"; exit 1; }log " Binary: $(stat -c%s "$BUILD/ac-native") bytes"log " NEEDED libs:"readelf -d "$BUILD/ac-native" 2>/dev/null | grep NEEDED | sed 's/.*\[/ /' | sed 's/\]//'ldd "$BUILD/ac-native" 2>&1 | grep -i "not found" && err " MISSING LIBS DETECTED" || log " All libs resolved"
# CL build happens after initramfs (step 2) — see below
# ══════════════════════════════════════════════# Step 2: Build initramfs from scratch# ══════════════════════════════════════════════log "Step 2/4: Building initramfs..."IROOT="$BUILD/initramfs-root"rm -rf "$IROOT"mkdir -p "$IROOT"/{bin,lib64,lib/firmware/i915,dev,proc,sys,tmp,run,scripts,etc,etc/pki/tls/certs}
# ── 2a: Static busybox (no shared lib deps for shell) ──BUSYBOX=$(command -v busybox)cp "$BUSYBOX" "$IROOT/bin/busybox"for cmd in sh sleep mkdir mount umount cat echo ls cp mv rm ln chmod chown \ date dd find grep head kill ps sed sort tail tee test touch tr wc which \ mktemp printf seq stat basename dirname env expr true false readlink \ realpath rmdir uniq yes tar gzip gunzip hostname id ip modprobe \ mkswap swapon vi df du diff xargs nohup pgrep killall cut whoami awk \ sync poweroff reboot halt mknod udhcpc \ pwd tty logger clear reset less more tac nl fold cmp hexdump md5sum \ sha256sum sha512sum base64 nslookup ping traceroute pkill timeout \ stty sysctl free uptime uname usleep unzip zcat; do ln -sf busybox "$IROOT/bin/$cmd"done# Real GNU bash — busybox's sh applet lacks bashisms (arrays, process# substitution, [[ ]], $'…' escapes, etc.) that Claude Code CLI's Bash tool# leans on, plus a lot of user-supplied commands. Ship the full binary from# the builder image + its shared lib dependencies so `bash -c "..."` works# without surprises.BASH_BIN=$(command -v bash)if [ -n "$BASH_BIN" ] && [ -f "$BASH_BIN" ]; then cp -L "$BASH_BIN" "$IROOT/bin/bash" chmod +x "$IROOT/bin/bash" for dep in $(ldd "$BASH_BIN" 2>/dev/null | grep -oP '/\S+'); do base=$(basename "$dep") [ ! -f "$IROOT/lib64/$base" ] && cp -L "$(readlink -f "$dep")" "$IROOT/lib64/$base" 2>/dev/null || true done log " Bundled GNU bash for Claude Code CLI"else log " bash not found on builder — Claude CLI Bash tool may fail"fi
# Additional tools Claude's Bash tool commonly wants: jq for JSON, file# for type detection, strace for debugging, git for version control, ssh# (OpenSSH client) for Tangled/GitHub pushes, rg (ripgrep) for code search.# Best-effort — skip if absent. git is installed in Dockerfile.builder; ssh# and rg require openssh-clients + ripgrep there (added in the same commit),# which only land once the builder image is rebuilt. The device commits over# HTTPS using /github-pat, so git alone is enough to unblock pushing.for bin in jq file strace git ssh rg; do SRC_BIN=$(command -v "$bin" 2>/dev/null || true) [ -z "$SRC_BIN" ] && continue cp -L "$SRC_BIN" "$IROOT/bin/$bin" for dep in $(ldd "$SRC_BIN" 2>/dev/null | grep -oP '/\S+'); do base=$(basename "$dep") [ ! -f "$IROOT/lib64/$base" ] && cp -L "$(readlink -f "$dep")" "$IROOT/lib64/$base" 2>/dev/null || true donedone# udhcpc also expected at /sbin/ by wifi.cln -sf ../bin/busybox "$IROOT/sbin/udhcpc" 2>/dev/null || true
# ── 2a2: curl + wget for HTTP fetches (captive portals, OTA, API calls) ──CURL_BIN=$(command -v curl)if [ -n "$CURL_BIN" ]; then cp "$CURL_BIN" "$IROOT/bin/curl" for lib in $(ldd "$CURL_BIN" 2>/dev/null | grep -oP '/\S+'); do [ -f "$lib" ] && cp -nL "$lib" "$IROOT/lib64/" 2>/dev/null || true donefi# busybox wget as fallbackln -s busybox "$IROOT/bin/wget" 2>/dev/null || true
# ── 2a3: dropbear SSH daemon + baked authorized_keys ──# notepat auto-starts sshd once wifi connects (system.startSSH in# js-bindings.c) and shows "ssh root@<ip>" on screen. OTA builds are# key-only: js_start_ssh disables password auth whenever# /root/.ssh/authorized_keys exists, baked here from# fedac/native/keys/authorized_keys. Without that file the daemon falls# back to -B (blank-password root) — local dev images only.## IMPORTANT: dropbear looks up authorized_keys via the passwd home dir# (getpwnam, NOT $HOME — everything else on the device uses HOME=/tmp) and# REFUSES the file if the home dir or ~/.ssh is group/other-writable. So# root's home is a dedicated /root at 0700 (the rootfs "/" is too loose),# with ~/.ssh 0700 and authorized_keys 0600 — see the matching passwd# entry "root:x:0:0:root:/root:/bin/sh" below.DROPBEAR_BIN=$(command -v dropbear 2>/dev/null || true)DROPBEARKEY_BIN=$(command -v dropbearkey 2>/dev/null || true)if [ -n "$DROPBEAR_BIN" ] && [ -n "$DROPBEARKEY_BIN" ]; then mkdir -p "$IROOT/usr/sbin" "$IROOT/etc/dropbear" "$IROOT/root/.ssh" chmod 700 "$IROOT/root" "$IROOT/root/.ssh" cp -L "$DROPBEAR_BIN" "$IROOT/usr/sbin/dropbear" cp -L "$DROPBEARKEY_BIN" "$IROOT/usr/sbin/dropbearkey" chmod +x "$IROOT/usr/sbin/dropbear" "$IROOT/usr/sbin/dropbearkey" ln -sf /usr/sbin/dropbear "$IROOT/bin/dropbear" ln -sf /usr/sbin/dropbearkey "$IROOT/bin/dropbearkey" for bin in "$DROPBEAR_BIN" "$DROPBEARKEY_BIN"; do for dep in $(ldd "$bin" 2>/dev/null | grep -oP '/\S+'); do base=$(basename "$dep") [ ! -f "$IROOT/lib64/$base" ] && cp -L "$(readlink -f "$dep")" "$IROOT/lib64/$base" 2>/dev/null || true done done if [ -f "$NATIVE/keys/authorized_keys" ]; then cp "$NATIVE/keys/authorized_keys" "$IROOT/root/.ssh/authorized_keys" chmod 600 "$IROOT/root/.ssh/authorized_keys" log " dropbear bundled (key-only via /root/.ssh/authorized_keys)" else log " dropbear bundled (no keys/authorized_keys — blank-password fallback)" fielse log " dropbear not on builder image — device ssh disabled"fi
# Minimal udhcpc script to configure interface after getting leasemkdir -p "$IROOT/usr/share/udhcpc"cat > "$IROOT/usr/share/udhcpc/default.script" << 'UDHCPC_SCRIPT'#!/bin/shcase "$1" in bound|renew) ip addr flush dev "$interface" ip addr add "$ip/${mask:-24}" dev "$interface" [ -n "$router" ] && ip route add default via "$router" dev "$interface" # DNS: use DHCP-provided + fallback to Google/Cloudflare { for d in $dns; do echo "nameserver $d"; done echo "nameserver 8.8.8.8" echo "nameserver 1.1.1.1" } > /etc/resolv.conf ;; deconfig) ip addr flush dev "$interface" ;;esacUDHCPC_SCRIPTchmod +x "$IROOT/usr/share/udhcpc/default.script"
# ── 2b: Init script ──cp "$NATIVE/initramfs/init" "$IROOT/init"chmod +x "$IROOT/init"cp "$NATIVE/initramfs-scripts/"*.sh "$IROOT/scripts/" 2>/dev/null || truechmod +x "$IROOT/scripts/"*.sh 2>/dev/null || true
# ── 2c: ac-native binary ──cp "$BUILD/ac-native" "$IROOT/ac-native"
# ── 2d: Pieces ──cp "$NATIVE/pieces/prompt.mjs" "$IROOT/piece.mjs"mkdir -p "$IROOT/pieces"cp "$NATIVE/pieces/"*.mjs "$IROOT/pieces/" 2>/dev/null || truebash "$NATIVE/scripts/bundle-oskiewar.sh" "$IROOT"log " Pieces: $(ls "$IROOT/pieces/" | wc -l)"
# ── 2d2: Piano sample bank ──# audio.c: load_piano_bank reads /samples/piano/<midi>.raw at startup —# header-less float32 mono @ 48kHz, filename is the anchor MIDI note.# Without these, sound.synth({type:"piano"}) returns silence and notepat's# piano voice is mute. ~14 MB / 26 anchors via prep-piano-samples.sh.if [ -d "$NATIVE/samples/piano" ]; then mkdir -p "$IROOT/samples/piano" cp "$NATIVE/samples/piano/"*.raw "$IROOT/samples/piano/" 2>/dev/null || true log " Piano samples: $(ls "$IROOT/samples/piano/" | wc -l) anchors, $(du -sh "$IROOT/samples/piano/" | cut -f1)"fi
# ── 2e: /dev nodes (needed before devtmpfs mounts) ──mknod "$IROOT/dev/console" c 5 1 2>/dev/null || truemknod "$IROOT/dev/null" c 1 3 2>/dev/null || truemknod "$IROOT/dev/tty" c 5 0 2>/dev/null || truemknod "$IROOT/dev/zero" c 1 5 2>/dev/null || true
# ── 2f: Dynamic linker ──cp -L /lib64/ld-linux-x86-64.so.2 "$IROOT/lib64/"
# ── 2g: Shared libraries (FOLLOW symlinks with cp -L) ──# Direct deps of ac-nativelog " Copying shared libraries..."for lib in $(ldd "$BUILD/ac-native" 2>/dev/null | grep -oP '/\S+'); do BASENAME=$(basename "$lib") REAL=$(readlink -f "$lib") [ -f "$REAL" ] && cp -L "$REAL" "$IROOT/lib64/$BASENAME"done
# SDL3 + Mesa/GPU libs — included for GPU acceleration via dlopen.# ac-native runs as a child of init (not PID 1), so if Mesa DRI crashes,# init catches the signal and restarts without SDL (AC_NO_SDL=1).for lib in libSDL3.so.0 \ libgbm.so.1 libEGL.so.1 libEGL_mesa.so.0 libGLESv2.so.2 \ libGL.so.1 libGLX_mesa.so.0 libGLdispatch.so.0 libglapi.so.0 \ libdrm_intel.so.1 libdrm_amdgpu.so.1; do REAL=$(readlink -f "/lib64/$lib" 2>/dev/null) [ -f "$REAL" ] && cp -L "$REAL" "$IROOT/lib64/$lib"done
# Mesa DRI driversif [ -d /lib64/dri ]; then mkdir -p "$IROOT/lib64/dri" for drv in /lib64/dri/i915_dri.so /lib64/dri/iris_dri.so /lib64/dri/kms_swrast_dri.so /lib64/dri/swrast_dri.so; do [ -f "$drv" ] && cp -L "$drv" "$IROOT/lib64/dri/" donefi
# GBM backend loader plugin. libgbm.so.1 has a hardcoded# /usr/lib64/gbm/dri_gbm.so path baked in at build time — without this# file, SDL3's KMSDRM probe segfaults during Mesa init and ac-native# falls back to DRM-only every boot. Ship it at both /lib64/gbm AND# /usr/lib64/gbm so the loader resolves regardless of root.for src in /usr/lib64/gbm/dri_gbm.so /lib64/gbm/dri_gbm.so; do if [ -f "$src" ]; then mkdir -p "$IROOT/lib64/gbm" "$IROOT/usr/lib64/gbm" cp -L "$src" "$IROOT/lib64/gbm/dri_gbm.so" cp -L "$src" "$IROOT/usr/lib64/gbm/dri_gbm.so" break fidone
# Gallium megadriverGALLIUM=$(readlink -f /lib64/libgallium-*.so 2>/dev/null || true)[ -f "$GALLIUM" ] && cp -L "$GALLIUM" "$IROOT/lib64/"
# Transitive deps — resolve everything in lib64log " Resolving transitive dependencies..."ADDED=1while [ "$ADDED" -gt 0 ]; do ADDED=0 for elf in "$IROOT/lib64/"*.so* "$IROOT/lib64/dri/"*.so* "$IROOT/ac-native"; do [ -f "$elf" ] || continue for needed in $(readelf -d "$elf" 2>/dev/null | grep NEEDED | sed 's/.*\[\(.*\)\]/\1/'); do if [ ! -f "$IROOT/lib64/$needed" ]; then REAL=$(readlink -f "/lib64/$needed" 2>/dev/null) if [ -f "$REAL" ]; then cp -L "$REAL" "$IROOT/lib64/$needed" ADDED=$((ADDED + 1)) fi fi done donedone
# ── 2g2: Verify DRI driver deps ──if [ -f "$IROOT/lib64/dri/iris_dri.so" ]; then log " Checking iris_dri.so dependencies..." MISSING_DRI="" for needed in $(LD_LIBRARY_PATH="$IROOT/lib64" ldd "$IROOT/lib64/dri/iris_dri.so" 2>/dev/null | grep "not found" | awk '{print $1}'); do MISSING_DRI="$MISSING_DRI $needed" # Try to find and copy the missing lib REAL=$(readlink -f "/lib64/$needed" 2>/dev/null || readlink -f "/usr/lib64/$needed" 2>/dev/null) if [ -f "$REAL" ]; then cp -L "$REAL" "$IROOT/lib64/$needed" log " Fixed: $needed" else log " MISSING: $needed (not found on build system)" fi done if [ -n "$MISSING_DRI" ]; then log " iris_dri.so had missing deps:$MISSING_DRI" # Re-run transitive dep resolution after fixing ADDED=1 while [ "$ADDED" -gt 0 ]; do ADDED=0 for elf in "$IROOT/lib64/"*.so* "$IROOT/lib64/dri/"*.so*; do [ -f "$elf" ] || continue for needed in $(readelf -d "$elf" 2>/dev/null | grep NEEDED | sed 's/.*\[\(.*\)\]/\1/'); do if [ ! -f "$IROOT/lib64/$needed" ]; then REAL=$(readlink -f "/lib64/$needed" 2>/dev/null || readlink -f "/usr/lib64/$needed" 2>/dev/null) if [ -f "$REAL" ]; then cp -L "$REAL" "$IROOT/lib64/$needed" ADDED=$((ADDED + 1)) fi fi done done done else log " iris_dri.so: all deps OK" fi # Final ldd check FINAL_MISSING=$(LD_LIBRARY_PATH="$IROOT/lib64" ldd "$IROOT/lib64/dri/iris_dri.so" 2>&1 | grep -c "not found" || true) log " iris_dri.so final check: ${FINAL_MISSING:-0} missing deps"fi
# ── 2h: Verify NO broken symlinks ──BROKEN=$(find "$IROOT/lib64/" -type l ! -exec test -e {} \; -print 2>/dev/null | wc -l)if [ "$BROKEN" -gt 0 ]; then err " WARNING: $BROKEN broken symlinks found, fixing..." for broken in $(find "$IROOT/lib64/" -type l ! -exec test -e {} \; -print 2>/dev/null); do name=$(basename "$broken") real=$(readlink -f "/lib64/$name" 2>/dev/null || readlink -f "/usr/lib64/$name" 2>/dev/null) if [ -f "$real" ]; then rm -f "$broken" cp "$real" "$broken" else rm -f "$broken" log " Removed unfixable: $name" fi donefi
LIB_COUNT=$(ls "$IROOT/lib64/"*.so* 2>/dev/null | wc -l)log " Libraries: $LIB_COUNT"
# ── 2i: WiFi tools ──for tool in wpa_supplicant wpa_cli iw dhclient rfkill; do SRC_BIN=$(command -v "$tool" 2>/dev/null || true) if [ -n "$SRC_BIN" ]; then cp -L "$SRC_BIN" "$IROOT/bin/"; fi # Copy their deps too if [ -n "$SRC_BIN" ]; then for dep in $(ldd "$SRC_BIN" 2>/dev/null | grep -oP '/\S+'); do BASENAME=$(basename "$dep") [ ! -f "$IROOT/lib64/$BASENAME" ] && cp -L "$(readlink -f "$dep")" "$IROOT/lib64/$BASENAME" 2>/dev/null || true done fidone
# ── 2i2: Disk/EFI tools (for HD install + OTA flash) ──# flashrom + cbfstool land here too so os.mjs's firmware panel can read the# current BIOS, swap the CBFS bootsplash, and write a customized MrChromebox# ROM without needing to drop to a ChromeOS shell. Only machines whose kernel# + firmware actually expose the SPI chip (see CONFIG_SPI_INTEL_PCI and# `flashrom --programmer internal` probe) get to use them; os.mjs gates on# /dev/mtd0 + /sys/class/dmi/id/bios_vendor before even surfacing the panel.for tool in sfdisk mkfs.vfat efibootmgr partprobe flashrom cbfstool; do SRC_BIN=$(command -v "$tool" 2>/dev/null || true) if [ -n "$SRC_BIN" ]; then cp -L "$SRC_BIN" "$IROOT/bin/" for dep in $(ldd "$SRC_BIN" 2>/dev/null | grep -oP '/\S+'); do BASENAME=$(basename "$dep") [ ! -f "$IROOT/lib64/$BASENAME" ] && cp -L "$(readlink -f "$dep")" "$IROOT/lib64/$BASENAME" 2>/dev/null || true done fidone
# Bundle install-firmware.sh — sourced from the same repo copy served at# aesthetic.computer/install-firmware.sh so the offline firmware update# path uses the exact same logic as `curl | bash` from ChromeOS dev shell.if [ -f "$AC_SRC/system/public/install-firmware.sh" ]; then cp "$AC_SRC/system/public/install-firmware.sh" "$IROOT/bin/ac-firmware-install" chmod +x "$IROOT/bin/ac-firmware-install" log " Bundled install-firmware.sh for os.mjs firmware panel"fi
# ── 2j: Firmware (trimmed to common Intel WiFi + GPU chips) ──log " Copying firmware..."FWDIR=""for d in /usr/lib/firmware /lib/firmware; do [ -d "$d/i915" ] && FWDIR="$d" && breakdoneif [ -n "$FWDIR" ]; then # WiFi — only common Intel chip families (covers ThinkPad, NUC, Surface) # Intel WiFi firmware is shipped using the internal chip codenames, NOT # the retail product names — so "iwlwifi-ax201*" matches nothing even # though AX201 hardware is common. Mapping: # AX200 (CC) → iwlwifi-cc-a0-* # AX201 (Jasper Lake) → iwlwifi-QuZ-a0-hr-b0-* # AX201 (TGL/CML) → iwlwifi-Qu-b0-hr-b0-*, iwlwifi-Qu-c0-hr-b0-* # AX201 (JF variant) → iwlwifi-QuZ-a0-jf-b0-*, iwlwifi-Qu-c0-jf-b0-* # AX210 (Typhoon Peak) → iwlwifi-ty-a0-gf-a0-* # AX211 (SnowOak) → iwlwifi-so-a0-gf-a0-*, iwlwifi-so-a0-hr-b0-* # AX411 → iwlwifi-ma-b0-* # BE200 (Gale Peak) → iwlwifi-gl-c0-fm-c0-* (already matched) # Older families (7260/7265/8000/9000/9260) match on the retail name. for chip in 3160 3168 7260 7265 8000C 8265 9000 9260 \ cc-a0 \ Qu-b0-hr Qu-c0-hr Qu-b0-jf Qu-c0-jf \ QuZ-a0-hr QuZ-a0-jf \ ty-a0-gf so-a0-gf so-a0-hr \ ma-b0-gf ma-b0-hr \ ax200 ax201 ax210 ax211 be200 gl; do for fw in "$FWDIR"/iwlwifi-${chip}*.ucode "$FWDIR"/iwlwifi-${chip}*.ucode.zst "$FWDIR"/iwlwifi-${chip}*.ucode.xz; do [ -f "$fw" ] && cp -L "$fw" "$IROOT/lib/firmware/" done done # Regulatory cp -L "$FWDIR/regulatory.db" "$IROOT/lib/firmware/" 2>/dev/null || true cp -L "$FWDIR/regulatory.db.p7s" "$IROOT/lib/firmware/" 2>/dev/null || true # GPU — only KBL/SKL/CFL/ICL/TGL/ADL/RPL (covers ~95% of target hardware) for pattern in kbl skl cfl icl tgl adl dg1 rkl rpl mtl; do for fw in "$FWDIR"/i915/${pattern}_*; do [ -f "$fw" ] && cp -L "$fw" "$IROOT/lib/firmware/i915/" done done # DMC firmware (display power management) for fw in "$FWDIR"/i915/*_dmc_*.bin "$FWDIR"/i915/*_dmc_*.bin.zst; do [ -f "$fw" ] && cp -L "$fw" "$IROOT/lib/firmware/i915/" done
# Realtek WiFi (rtw88/rtw89) — common in Chromebooks, budget laptops. # rtl8822b/c/ce/8723de/8821ce/8851be families live under rtw88/, rtl8851b/8852a/b/c/ce under rtw89/. for subdir in rtw88 rtw89; do if [ -d "$FWDIR/$subdir" ]; then mkdir -p "$IROOT/lib/firmware/$subdir" for fw in "$FWDIR/$subdir"/*.bin "$FWDIR/$subdir"/*.bin.zst "$FWDIR/$subdir"/*.bin.xz; do [ -f "$fw" ] && cp -L "$fw" "$IROOT/lib/firmware/$subdir/" done fi done
# MediaTek WiFi (MT7921/MT7925) — common in newer ChromeOS, budget laptops. if [ -d "$FWDIR/mediatek" ]; then mkdir -p "$IROOT/lib/firmware/mediatek" for pattern in WIFI_MT7922_ WIFI_RAM_CODE_MT7922 WIFI_MT7925_ WIFI_RAM_CODE_MT7925 mt7921 mt7925; do for fw in "$FWDIR/mediatek/${pattern}"* ; do [ -f "$fw" ] && cp -L "$fw" "$IROOT/lib/firmware/mediatek/" done done fi
# SOF (Sound Open Firmware) — Intel DSP audio path used by Chromebooks # (Jasper Lake, Alder Lake, Tiger Lake…) and many modern laptops where # audio doesn't go through plain HDA. Need the main .ri blob per # platform plus the matching topology under sof-tplg/. # # Recurse: Fedora's alsa-sof-firmware puts sof-<platform>.ri under # intel/sof/community/ and intel/sof/intel-signed/ (not directly under # intel/sof/), so a flat glob misses them. We preserve relative paths # so the kernel's firmware loader still finds them along the standard # SOF_FW_PATH search (which covers both community and intel-signed). for subdir in intel/sof intel/sof-tplg intel/sof-ace-tplg; do src="$FWDIR/$subdir" if [ -d "$src" ]; then mkdir -p "$IROOT/lib/firmware/$subdir" # Symlinks matter: sof-bin ships platform aliases as links # (community/sof-glk.ri -> sof-apl.ri), and `-type f` alone # left the Lenovo 500e (Gemini Lake) with no DSP firmware. # cp -L dereferences, so each alias lands as a real file. (cd "$src" && find . \( -type f -o -type l \) \ \( -name '*.ri' -o -name '*.tplg' \ -o -name '*.ri.xz' -o -name '*.tplg.xz' \ -o -name '*.ri.zst' -o -name '*.tplg.zst' \) \ -exec cp --parents -L {} "$IROOT/lib/firmware/$subdir/" \;) || true fi doneelse log " WARNING: No firmware directory found!"fi# Decompress any .zst or .xz files across all firmware subdirectories.while IFS= read -r -d '' zst; do zstd -d --rm "$zst" 2>/dev/null || truedone < <(find "$IROOT/lib/firmware" -name '*.zst' -print0 2>/dev/null)while IFS= read -r -d '' xzf; do xz -d "$xzf" 2>/dev/null || truedone < <(find "$IROOT/lib/firmware" -name '*.xz' -print0 2>/dev/null)FW_COUNT=$(find "$IROOT/lib/firmware" -type f | wc -l)FW_SIZE=$(du -sh "$IROOT/lib/firmware" | cut -f1)log " Firmware: $FW_COUNT files ($FW_SIZE)"
# ── 2k: SSL certs ──cp /etc/pki/tls/certs/ca-bundle.crt "$IROOT/etc/pki/tls/certs/" 2>/dev/null || true
# ── 2l: ALSA config ──if [ -d /usr/share/alsa ]; then mkdir -p "$IROOT/usr/share" cp -a /usr/share/alsa "$IROOT/usr/share/" 2>/dev/null || truefi# Layer ChromeOS-downstream UCM configs on top. These carry the sof-rt5682# Speaker/Headset verb definitions that upstream alsa-ucm-conf lacks, so the# Jasper Lake / Dedede family (G7, drawman, drawcia, ...) boards actually# route audio through their MAX98360A amp. See Dockerfile.builder for the# source repo (WeirdTreeThing/alsa-ucm-conf-cros).if [ -d /opt/alsa-ucm-conf-cros/ucm2 ]; then mkdir -p "$IROOT/usr/share/alsa/ucm2" cp -a /opt/alsa-ucm-conf-cros/ucm2/. "$IROOT/usr/share/alsa/ucm2/" 2>/dev/null || true # `overrides/` in the repo IS the conf.d layer (card-id → UCM tree). # Each subdir is a card id; contents get picked up by alsa-lib when # snd_use_case_mgr_open() looks for <card_id>/<card_id>.conf. if [ -d /opt/alsa-ucm-conf-cros/overrides ]; then mkdir -p "$IROOT/usr/share/alsa/ucm2/conf.d" cp -a /opt/alsa-ucm-conf-cros/overrides/. \ "$IROOT/usr/share/alsa/ucm2/conf.d/" 2>/dev/null || true fi # Kernel's ASoC card id strips hyphens (`sof-rt5682` → `sofrt5682`), # but WeirdTreeThing's UCM tree uses canonical hyphenated names. # Symlink the hyphen-less names → hyphenated counterparts so # snd_use_case_mgr_open("sofrt5682") resolves. for canonical in sof-rt5682 sof-cs42l42 sof-nau8825 sof-da7219 \ sof-rt5650 sof-rt5682s-hs-rt1019 sof-ssp_amp \ sof-glkda7219ma sof-bxtda7219ma; do stripped=$(echo "$canonical" | tr -d '-') [ -e "$IROOT/usr/share/alsa/ucm2/$canonical" ] || continue [ -e "$IROOT/usr/share/alsa/ucm2/$stripped" ] && continue ln -sf "$canonical" "$IROOT/usr/share/alsa/ucm2/$stripped" done log " Bundled ChromeOS UCM (sof-rt5682, sof-cs42l42, …)"fi
# ── 2m: /etc/group and /etc/passwd ──# Full 7-field passwd entry: dropbear resolves uid 0's home (/root, 0700,# where authorized_keys lives) and login shell from here. Home is /root —# NOT "/" — because dropbear refuses authorized_keys under a loosely-permed# home; interactive shells still use HOME=/tmp (set by init + pty.c).echo "root:x:0:" > "$IROOT/etc/group"echo "root:x:0:0:root:/root:/bin/sh" > "$IROOT/etc/passwd"
# ── 2n: Claude Code ──# Prefer a freshly-fetched native binary from the official GCS "latest"# channel so every OTA ships current Claude Code, regardless of how stale# the binary baked into the builder image (Dockerfile.builder, fetched at# image-build time) has become. Fall back to the builder-baked binary if# the network fetch fails.CLAUDE_BIN=""CLAUDE_GCS="https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases"CLAUDE_VER=$(curl -fsSL "${CLAUDE_GCS}/latest" 2>/dev/null || true)if [ -n "$CLAUDE_VER" ]; then log " Fetching Claude Code ${CLAUDE_VER} (latest from GCS)..." if curl -fsSL "${CLAUDE_GCS}/${CLAUDE_VER}/linux-x64/claude" -o /tmp/claude-latest 2>/dev/null \ && [ -s /tmp/claude-latest ]; then chmod +x /tmp/claude-latest CLAUDE_BIN=/tmp/claude-latest else log " Claude Code: GCS fetch failed — falling back to builder-baked binary" fifiif [ -z "$CLAUDE_BIN" ]; then for p in /claude-bin /usr/local/bin/claude-native /usr/local/bin/claude /root/.local/share/claude/versions/* /home/me/.local/share/claude/versions/*; do [ -f "$p" ] && CLAUDE_BIN="$p" && break donefiif [ -n "$CLAUDE_BIN" ]; then cp "$CLAUDE_BIN" "$IROOT/bin/claude" chmod +x "$IROOT/bin/claude" # Copy its shared libs for lib in $(ldd "$CLAUDE_BIN" 2>/dev/null | grep -oP '/\S+'); do [ -f "$lib" ] && cp -nL "$lib" "$IROOT/lib64/" 2>/dev/null || true done log " Claude Code: $(du -sh "$IROOT/bin/claude" | cut -f1)"else log " Claude Code: not available (mount with -v /path/to/claude:/claude-bin)"fi
# ── 2o: KidLisp bundle ──if command -v npx &>/dev/null && [ -f "$SRC/system/public/aesthetic.computer/lib/kidlisp.mjs" ]; then log " Bundling KidLisp..." cd "$SRC" npx esbuild system/public/aesthetic.computer/lib/kidlisp.mjs \ --bundle --format=iife --global-name=KidLispModule --platform=neutral \ --external:https --external:http --external:net --external:fs --external:path \ --outfile=/tmp/kidlisp-bundle.js 2>&1 || true if [ -f /tmp/kidlisp-bundle.js ]; then mkdir -p "$IROOT/jslib" cp /tmp/kidlisp-bundle.js "$IROOT/jslib/" fi cd "$NATIVE"fi
# ── 2o2: FPS system bundle (CamDoll + Camera + Dolly for `system="fps"` pieces) ──# Tree-shakes graph.mjs down to just Camera + Dolly and pulls in CamDoll.# Pieces like arena.mjs that export `system = "fps"` get this injected# by the piece loader (see js_load_piece in js-bindings.c) so web and# native share the exact same FPS camera/input source.if command -v npx &>/dev/null && [ -f "$NATIVE/scripts/fps-bundle-entry.mjs" ]; then log " Bundling FPS system (Camera + Dolly + CamDoll)..." cd "$SRC" # IIFE format so the bundle self-executes at load and exposes the # classes as `globalThis.__FpsSystem.{Camera,Dolly,CamDoll}` — lets # the piece loader wire them in synchronously without ES module # resolution. Mirrors the kidlisp-bundle.js pattern. npx esbuild "$NATIVE/scripts/fps-bundle-entry.mjs" \ --bundle --format=iife --global-name=__FpsSystem --platform=neutral \ --external:https --external:http --external:net --external:fs --external:path \ --outfile=/tmp/fps-system-bundle.js 2>&1 || true if [ -f /tmp/fps-system-bundle.js ]; then mkdir -p "$IROOT/jslib" cp /tmp/fps-system-bundle.js "$IROOT/jslib/fps-system-bundle.js" log " fps-system-bundle.js: $(stat -c%s /tmp/fps-system-bundle.js) bytes" fi cd "$NATIVE"fi
# ── 2p: ES module lib files for pieces (clock.mjs needs these) ──# These are pure JS with no DOM/browser deps — work in QuickJS as-is.# The module loader resolves "../lib/X.mjs" → "/lib/X.mjs" in the initramfs.mkdir -p "$IROOT/lib"for libmjs in melody-parser.mjs notepat-convert.mjs note-colors.mjs num.mjs percussion.mjs synth.mjs nom.mjs; do SRC_LIB="$SRC/system/public/aesthetic.computer/lib/$libmjs" if [ -f "$SRC_LIB" ]; then cp "$SRC_LIB" "$IROOT/lib/$libmjs" log " Bundled lib: $libmjs ($(stat -c%s "$SRC_LIB") bytes)" fidone
# ── 2q: Web pieces that work natively (bundled verbatim, no mods) ──# Every piece here must run unchanged under the QuickJS-based native# runtime. If you add a piece that uses browser-only APIs, the runtime# will throw — don't "port" the piece, expose the missing API in# js-bindings.c instead (so web and native stay in parity).for webpiece in clock.mjs arena.mjs speaker.mjs catnom.mjs; do SRC_PIECE="$SRC/system/public/aesthetic.computer/disks/$webpiece" if [ -f "$SRC_PIECE" ]; then cp "$SRC_PIECE" "$IROOT/pieces/$webpiece" log " Bundled web piece: $webpiece ($(stat -c%s "$SRC_PIECE") bytes)" fidone
# ── Final verification ──BROKEN_FINAL=$(find "$IROOT" -type l ! -exec test -e {} \; -print 2>/dev/null | wc -l)TOTAL_FILES=$(find "$IROOT" -type f | wc -l)log " Initramfs: $TOTAL_FILES files, $BROKEN_FINAL broken symlinks"[ "$BROKEN_FINAL" -gt 0 ] && err " WARNING: broken symlinks remain!"
# Write build metadata (C variant by default, CL overrides below)mkdir -p "$IROOT/etc"printf '%s\n%s\n%s\nc\n' "$BUILD_NAME" "$GIT_HASH" "$BUILD_TS" > "$IROOT/etc/ac-build"
# ── Embed SBCL + Swank for live CL development ──log "Step 2b: Embedding SBCL + Swank..."
# Build libquickjs.so for CL CFFI bindingsQJSDIR="/cache/quickjs-2024-01-13"log " Building libquickjs.so..."# ${CC_USE} rather than bare gcc: this compiles the whole QuickJS amalgam on# every build, and calling gcc directly walked straight past ccache — the one# place in the build where a cache hit is nearly free and worth the most.${CC_USE} -shared -fPIC -O2 -Wl,-soname,libquickjs.so \ -o /lib64/libquickjs.so \ "$QJSDIR/quickjs.c" "$QJSDIR/libunicode.c" \ "$QJSDIR/libregexp.c" "$QJSDIR/cutils.c" "$QJSDIR/libbf.c" \ '-DCONFIG_VERSION="0.8.0"' -lm 2>&1 || { err "libquickjs.so build failed"; }
CL_DIR="$NATIVE/cl"log " Building libquickjs-shim.so..."${CC_USE} -shared -fPIC -O2 -Wl,-soname,libquickjs-shim.so \ -o /lib64/libquickjs-shim.so \ "$CL_DIR/quickjs-shim.c" \ -I"$QJSDIR" -L/lib64 -lquickjs -lm 2>&1 || { err "shim build failed"; }
ldconfig 2>/dev/null || true
# Copy shared libs into initramfscp /lib64/libquickjs.so "$IROOT/lib64/"cp /lib64/libquickjs-shim.so "$IROOT/lib64/"for lib in /lib64/libzstd.so*; do [ -f "$lib" ] && cp -L "$lib" "$IROOT/lib64/" 2>/dev/nulldone
# Build SBCL Swank server image (standalone binary with Swank preloaded)export LD_LIBRARY_PATH="/lib64:${LD_LIBRARY_PATH:-}"log " Building SBCL Swank image..."sbcl --non-interactive \ --eval '(load "/opt/quicklisp/setup.lisp")' \ --eval '(require :asdf)' \ --eval "(push #P\"$CL_DIR/\" asdf:*central-registry*)" \ --eval '(asdf:load-system :ac-native)' \ --eval "(sb-ext:save-lisp-and-die \"$BUILD/ac-swank\" :toplevel #'ac-native:main :executable t :compression t)" \ 2>&1 || { err "SBCL Swank build failed (non-fatal)"; }
if [ -f "$BUILD/ac-swank" ]; then cp "$BUILD/ac-swank" "$IROOT/ac-swank" chmod +x "$IROOT/ac-swank" log " SBCL Swank: $(stat -c%s "$BUILD/ac-swank") bytes"else log " SBCL Swank: skipped (build failed, C-only build)"fi
# Copy CL pieces (only runnable .lisp pieces from pieces/ dir, not cl/ library)if ls "$NATIVE/pieces/"*.lisp 1>/dev/null 2>&1; then cp "$NATIVE/pieces/"*.lisp "$IROOT/pieces/"fiCL_PIECES=$(ls "$IROOT/pieces/"*.lisp 2>/dev/null | wc -l)log " CL pieces: $CL_PIECES"
# ══════════════════════════════════════════════# Step 3: Pack initramfs (cpio + gzip, one pass)# ══════════════════════════════════════════════log "Step 3/4: Packing initramfs..."cd "$IROOT"# The kernel's EFI stub loads this externally via the baked-in# `initrd=\initramfs.cpio.gz` cmdline token, so gzip is the shipping format and# the only one we need. This used to pack ~1GB through `lz4 -l -9` — lz4's# slowest mode — and then decompress that and re-gzip it a few hundred lines# later, paying max-effort compression for a file nothing ever read. Straight# to gzip, and in parallel when pigz is available.if command -v pigz >/dev/null 2>&1; then GZIP_CMD="pigz -6 -p $(nproc)"else GZIP_CMD="gzip -6"fi# -v was printing every filename straight into /dev/null.find . -print0 | cpio --null -o --format=newc 2>/dev/null \ | ${GZIP_CMD} -c > "$BUILD/initramfs.cpio.gz"INITRAMFS_SIZE=$(stat -c%s "$BUILD/initramfs.cpio.gz")log " Initramfs: $((INITRAMFS_SIZE / 1048576))MB compressed (${GZIP_CMD%% *})"
# ══════════════════════════════════════════════# Step 3b: Chromebook boot stub (embedded initramfs)# ══════════════════════════════════════════════# Stock Chromebook firmware (developer mode, Ctrl+U) boots a vboot-packed# kernel from a ChromeOS kernel partition and passes it NO initrd. So the# kernel carries a tiny embedded initramfs — static busybox + one script —# that finds the stick's ACBOOT partition, unpacks the real initramfs.cpio.gz# into a tmpfs and switch_roots into it. On UEFI boots the external initrd# overlays this one and its /init is never reached. See docs/chromebook-boot.md.log "Step 3b: Building Chromebook boot stub..."STUB_ROOT="$BUILD/stub-root"STUB_CPIO="$BUILD/stub-initramfs.cpio"rm -rf "$STUB_ROOT"mkdir -p "$STUB_ROOT"/{bin,sbin,dev,proc,sys,boot,newroot}if ! file "$BUSYBOX" | grep -q "statically linked"; then err "busybox at $BUSYBOX is not statically linked — the Chromebook stub cannot use it" exit 1fifor applet in sh mount umount gzip cpio switch_root sleep grep tr; do "$BUSYBOX" --list 2>/dev/null | grep -qx "$applet" \ || { err "busybox lacks the '$applet' applet the Chromebook stub needs"; exit 1; }donecp "$BUSYBOX" "$STUB_ROOT/bin/busybox"for cmd in sh mount umount gzip cpio sleep mkdir cat echo ls grep tr; do ln -sf busybox "$STUB_ROOT/bin/$cmd"doneln -sf ../bin/busybox "$STUB_ROOT/sbin/switch_root"# cfg80211 loads regulatory.db once, at kernel init — before the stub can# offer anything — so the world regdomain would stick for the whole session# on the Chromebook path. It is ~6 KB; carry it in the stub.mkdir -p "$STUB_ROOT/lib/firmware"for f in regulatory.db regulatory.db.p7s; do for cand in "$FWDIR/$f" "$FWDIR/$f.xz" "$FWDIR/$f.zst"; do [ -f "$cand" ] || continue cp -L "$cand" "$STUB_ROOT/lib/firmware/" case "$cand" in *.xz) xz -d "$STUB_ROOT/lib/firmware/$f.xz" ;; *.zst) zstd -d --rm "$STUB_ROOT/lib/firmware/$f.zst" ;; esac break donedone[ -f "$STUB_ROOT/lib/firmware/regulatory.db" ] && log " Stub carries regulatory.db" || log " WARNING: regulatory.db not found in $FWDIR — Chromebook path stays on the world regdomain"cp "$NATIVE/initramfs-stub/init" "$STUB_ROOT/init"chmod 755 "$STUB_ROOT/init"sh -n "$STUB_ROOT/init" || { err "initramfs-stub/init has a syntax error"; exit 1; }(cd "$STUB_ROOT" && find . -print0 | cpio --null -o -H newc --quiet > "$STUB_CPIO")[ -s "$STUB_CPIO" ] || { err "stub initramfs cpio is empty"; exit 1; }log " Stub: $(($(stat -c%s "$STUB_CPIO") / 1024))KB (busybox + init), embedded via CONFIG_INITRAMFS_SOURCE"
# ══════════════════════════════════════════════# Step 4: Build kernel with embedded initramfs# ══════════════════════════════════════════════log "Step 4/4: Building kernel..."
# Persistent kernel build tree lives on a Docker volume mounted at /kernel-build.# This preserves object files between oven runs so ccache + kbuild's own# dependency tracker produce true incremental rebuilds. Fall back to ephemeral# $BUILD when the volume isn't present (e.g. running docker-build.sh locally# without the oven wrapper).if [ -d /kernel-build ] && [ -w /kernel-build ]; then KBUILD_ROOT="/kernel-build" log " Using persistent kernel build tree at $KBUILD_ROOT"else KBUILD_ROOT="$BUILD" log " No persistent volume — kernel tree at $KBUILD_ROOT (ephemeral)"fiLINUX_DIR="$KBUILD_ROOT/linux-$KVER"
# Version sentinel: if the persisted tree is for a different kernel version,# wipe it before reinitializing from the Docker image's cached source.SENTINEL="$KBUILD_ROOT/.kver"if [ -f "$SENTINEL" ] && [ "$(cat "$SENTINEL")" != "$KVER" ]; then log " Kernel version changed ($(cat "$SENTINEL") → $KVER), wiping build tree" rm -rf "$KBUILD_ROOT/linux-"* rm -f "$SENTINEL"fi
# Use cached kernel source or downloadif [ ! -f "$LINUX_DIR/Makefile" ]; then if [ -d "/cache/linux-$KVER" ]; then log " Initializing $KBUILD_ROOT from cached Linux $KVER..." cp -a "/cache/linux-$KVER" "$KBUILD_ROOT/" else log " Downloading Linux $KVER..." cd "$KBUILD_ROOT" # cdn.kernel.org purges EOL series (and has outages); fall back to a # git.kernel.org tag snapshot, which exists for every release forever. curl -fsL "https://cdn.kernel.org/pub/linux/kernel/v${KMAJOR}.x/linux-${KVER}.tar.xz" | tar xJ \ || curl -fsL "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/snapshot/linux-${KVER}.tar.gz" | tar xz fi echo "$KVER" > "$SENTINEL"fi
# Copy config only if it differs — overwriting touches mtime and invalidates# large swaths of kbuild's dependency graph, forcing full rebuilds.if ! cmp -s "$NATIVE/kernel/config-minimal" "$LINUX_DIR/.config"; then log " Config changed, updating .config" cp "$NATIVE/kernel/config-minimal" "$LINUX_DIR/.config"else log " Config unchanged, preserving existing build tree"fi
# Stage built-in firmware blobs referenced by CONFIG_EXTRA_FIRMWARE# into a container-local directory and rewrite CONFIG_EXTRA_FIRMWARE_DIR.FIRMWARE_ABS="$BUILD/firmware"mkdir -p "$FIRMWARE_ABS"
HOST_FWDIR=""for d in /usr/lib/firmware /lib/firmware; do if [ -d "$d" ]; then HOST_FWDIR="$d" break fidone
copy_builtin_fw_blob() { local rel="$1" local src_base="$2" local dst="$FIRMWARE_ABS/$rel" mkdir -p "$(dirname "$dst")" if [ -f "$src_base/$rel" ]; then cp -L "$src_base/$rel" "$dst" return 0 fi if [ -f "$src_base/$rel.zst" ]; then zstd -d "$src_base/$rel.zst" -o "$dst" 2>/dev/null && return 0 fi if [ -f "$src_base/$rel.xz" ]; then xz -dc "$src_base/$rel.xz" >"$dst" 2>/dev/null && return 0 fi return 1}
FW_LIST=$(sed -n 's/^CONFIG_EXTRA_FIRMWARE="\([^"]*\)"/\1/p' "$LINUX_DIR/.config" | head -1)if [ -n "$FW_LIST" ]; then if [ -z "$HOST_FWDIR" ]; then err "Kernel config requests built-in firmware but no /usr/lib/firmware or /lib/firmware directory was found." exit 1 fi
missing_fw="" for fw in $FW_LIST; do if ! copy_builtin_fw_blob "$fw" "$HOST_FWDIR"; then missing_fw="$missing_fw $fw" fi done
if [ -n "$missing_fw" ]; then err "Missing built-in firmware blobs:$missing_fw" err "Looked under: $HOST_FWDIR (including .zst/.xz variants)" exit 1 fi
sed -i "s|^CONFIG_EXTRA_FIRMWARE_DIR=.*|CONFIG_EXTRA_FIRMWARE_DIR=\"$FIRMWARE_ABS\"|" "$LINUX_DIR/.config" log " Built-in firmware dir: $FIRMWARE_ABS" log " Built-in firmware files: $FW_LIST"fi
# The initramfs was already packed as gzip in Step 3 — the kernel's EFI stub# loads it externally via the baked-in `initrd=\initramfs.cpio.gz` cmdline# token, and the kernel no longer embeds it, so pure code changes skip the# kernel link step entirely. All that remains is publishing it to $OUT.## This copy is NOT allowed to fail quietly. It used to end in `|| true`, which# meant a failure here left whatever initramfs was already sitting in $OUT to# be picked up and published under the new build's name — a green build# shipping the previous release's userspace under a fresh kernel.[ -f "$BUILD/initramfs.cpio.gz" ] || { err "initramfs.cpio.gz missing after pack"; exit 1; }cp "$BUILD/initramfs.cpio.gz" "$OUT/initramfs.cpio.gz"log " initramfs.cpio.gz: $(($(stat -c%s "$BUILD/initramfs.cpio.gz") / 1048576))MB → \$OUT"
# Configure — force-disable bloated GPU drivers that olddefconfig enablescd "$LINUX_DIR"KCFG_LOG="$BUILD/kernel-olddefconfig.log"make olddefconfig >"$KCFG_LOG" 2>&1 || { err "Kernel olddefconfig failed"; tail -80 "$KCFG_LOG" >&2; exit 1; }tail -3 "$KCFG_LOG" || true
# Strip GPU drivers that Fedora defaults enable (they cause KALLSYMS overflow)scripts/config --disable DRM_AMDGPUscripts/config --disable DRM_NOUVEAUscripts/config --disable DRM_RADEONscripts/config --disable DRM_QXLscripts/config --disable DRM_BOCHSscripts/config --disable DRM_CIRRUS_QEMUscripts/config --disable DRM_VIRTIO_GPUscripts/config --enable DRM_SIMPLEDRM
# CRITICAL: force-enable audio/GPIO/pinctrl configs that olddefconfig# has been silently dropping on the oven (cause: upstream Fedora kernel# ships a newer/older Kconfig tree than what config-minimal was authored# against, so dependency resolution differs between dev environment and# the container's make olddefconfig run). Using scripts/config --enable# writes the symbol directly, bypassing olddefconfig's mutation pass, and# the final `make olddefconfig` below cleans up any dep auto-selects# (GPIOLIB, PINMUX, etc. — tristate symbols selected by our --enable'd# ones come along automatically).log " Force-enabling audio + GPIO + pinctrl configs..."for sym in \ IKCONFIG IKCONFIG_PROC \ GPIOLIB GPIOLIB_IRQCHIP GPIO_ACPI GPIO_SYSFS \ PINCTRL PINCTRL_INTEL \ PINCTRL_BAYTRAIL PINCTRL_CHERRYVIEW PINCTRL_SUNRISEPOINT \ PINCTRL_GEMINILAKE PINCTRL_ELKHARTLAKE PINCTRL_JASPERLAKE \ PINCTRL_TIGERLAKE PINCTRL_ALDERLAKE PINCTRL_METEORLAKE \ I2C I2C_DESIGNWARE_CORE I2C_DESIGNWARE_PLATFORM I2C_DESIGNWARE_PCI \ MMC MMC_BLOCK MMC_SDHCI MMC_SDHCI_PCI MMC_SDHCI_ACPI \ MTD MTD_BLOCK MTD_SPI_NOR \ SPI SPI_MASTER SPI_MEM SPI_INTEL SPI_INTEL_PCI \ MAGIC_SYSRQ \ RTW89 RTW89_PCI RTW89_8852B RTW89_8852BE RTW89_8852BT RTW89_8852BTE \ SND_SOC_MAX98357A SND_SOC_RT5682 SND_SOC_RT5682_I2C SND_SOC_RT5682S \ SND_SOC_INTEL_SOF_RT5682_MACH SND_SOC_INTEL_SOF_MAX98360A_MACH \ SND_SOC_SOF_JASPERLAKE \; do scripts/config --enable "CONFIG_$sym" 2>/dev/null || truedone# Embed the Chromebook boot stub (Step 3b). Path is build-specific, so it is# set here rather than in config-minimal. kbuild re-packs usr/initramfs_data# whenever the cpio changes.scripts/config --set-str INITRAMFS_SOURCE "$STUB_CPIO"make olddefconfig >>"$KCFG_LOG" 2>&1 || { err "Kernel olddefconfig (post-config) failed"; tail -120 "$KCFG_LOG" >&2; exit 1; }grep -q "^CONFIG_INITRAMFS_SOURCE=\"$STUB_CPIO\"" .config \ || { err "CONFIG_INITRAMFS_SOURCE did not stick (stub would be missing from vmlinuz)"; exit 1; }tail -1 "$KCFG_LOG" || true
# Verify the critical audio/GPIO symbols actually stuck after olddefconfig# dependency resolution. Fail the build loudly if any were silently dropped# — better to catch this in the build log than discover it from a silent# speaker on the target device.log " Verifying critical configs survived olddefconfig..."MISSING_CFGS=""for sym in GPIOLIB PINCTRL_INTEL PINCTRL_JASPERLAKE I2C_DESIGNWARE_PCI \ SND_SOC_INTEL_SOF_RT5682_MACH SND_SOC_MAX98357A; do if ! grep -q "^CONFIG_${sym}=y" .config; then MISSING_CFGS="$MISSING_CFGS $sym" fidoneif [ -n "$MISSING_CFGS" ]; then err "BUILD SANITY: the following configs did not survive olddefconfig:$MISSING_CFGS" err " (inspect $KCFG_LOG for why — likely a missing dep in the Kconfig tree)" exit 1filog " ✓ All critical audio/GPIO configs present"
# Config-hash sentinel — if the audio/GPIO/pinctrl configs changed since# the last build in this persistent /kernel-build volume, kbuild's# dependency tracker misses object files gated by obj-$(CONFIG_X) += y.o# (it sees the .config line change but the .o target is wholly absent# from the previous vmlinux so nothing re-evaluates it). Symptom: canary# check passes because .config is correct, but the built vmlinux is missing# drivers/pinctrl/intel/pinctrl-jasperlake.o, drivers/i2c/busses/i2c-designware-*,# etc. entirely. Fix: compute a hash of the critical configs and wipe the# specific subsystem build dirs when it changes. Much faster than a full# `make clean` while still forcing re-link of anything that toggled.CONFIG_SENTINEL_FILE="$KBUILD_ROOT/.audio-gpio-config-hash"CONFIG_HASH=$(grep -E '^CONFIG_(PINCTRL_|GPIOLIB|GPIO_|I2C_DESIGNWARE|SND_SOC_|MMC_|SPI_INTEL|RTW|IKCONFIG)' .config 2>/dev/null | sort | sha256sum | cut -c1-16)PREV_HASH=$(cat "$CONFIG_SENTINEL_FILE" 2>/dev/null || echo "")if [ "$CONFIG_HASH" != "$PREV_HASH" ]; then log " Config hash changed ($PREV_HASH → $CONFIG_HASH), wiping critical build dirs" # Only nuke dirs that contain drivers whose toggle-on we just forced. # Everything else stays cached and re-uses ccache. for d in drivers/pinctrl/intel drivers/i2c/busses drivers/mtd/spi-nor \ drivers/mmc/host drivers/spi drivers/net/wireless/realtek \ drivers/gpio sound/soc/intel sound/soc/sof sound/soc/codecs; do rm -rf "$d"/*.o "$d"/.*.o.cmd "$d"/built-in.a "$d"/.built-in.a.cmd 2>/dev/null || true done # Force vmlinux relink by removing it. rm -f vmlinux .vmlinux.cmd arch/x86/boot/bzImage echo "$CONFIG_HASH" > "$CONFIG_SENTINEL_FILE"else log " Config hash unchanged ($CONFIG_HASH) — incremental build"fi
# With ccache, skip make clean — stale objects get cache misses anyway,# and clean destroys the build tree that ccache relies on for hits.# Without ccache, clean to avoid config mismatch errors.if ! command -v ccache &>/dev/null; then make clean 2>/dev/null || truefi
# Buildlog " Compiling (${KERNEL_JOBS} cores)..."KERNEL_LOG="$BUILD/kernel-build.log"if ! run_make_with_heartbeat "$KERNEL_LOG" make -j"${KERNEL_JOBS}" CC="${CC_USE}" KALLSYMS_EXTRA_PASS=1 bzImage; then err "Kernel compile failed while building bzImage (parallel pass)." show_kernel_error_context "$KERNEL_LOG" if [ "${KERNEL_JOBS}" -gt 1 ]; then err "Retrying kernel build in serial mode (-j1, V=1) for deterministic diagnostics..." make clean 2>/dev/null || true KERNEL_LOG_RETRY="$BUILD/kernel-build-retry.log" if ! run_make_with_heartbeat "$KERNEL_LOG_RETRY" make -j1 V=1 CC="${CC_USE}" KALLSYMS_EXTRA_PASS=1 bzImage; then err "Kernel compile failed again in serial retry." show_kernel_error_context "$KERNEL_LOG_RETRY" exit 1 fi KERNEL_LOG="$KERNEL_LOG_RETRY" log " Serial retry succeeded." else exit 1 fifitail -3 "$KERNEL_LOG" || true
# Copy outputif [ ! -f arch/x86/boot/bzImage ]; then err "Kernel build completed but arch/x86/boot/bzImage is missing." show_kernel_error_context "$KERNEL_LOG" exit 1ficp arch/x86/boot/bzImage "$BUILD/vmlinuz"cp arch/x86/boot/bzImage "$OUT/vmlinuz" 2>/dev/null || true# Legacy alias: media-layout.sh + OTA code still look for `vmlinuz-slim`.# It is now the exact same bytes as `vmlinuz` since there is no monolithic# variant — the kernel's EFI stub loads initramfs externally on every path.cp arch/x86/boot/bzImage "$BUILD/vmlinuz-slim"cp arch/x86/boot/bzImage "$OUT/vmlinuz-slim" 2>/dev/null || true
# ── Chromebook kernel partition image ──# vbutil_kernel wraps the bzImage in a vboot keyblock + preamble signed with# the public developer keys. Stock Chromebook firmware accepts those in# developer mode (Ctrl+U), which is how the same stick boots a Chromebook# without touching its firmware. flash-mac.sh dd's this into a ChromeOS# kernel-type GPT partition. The kernel's built-in CONFIG_CMDLINE supplies# the real command line (x86 appends the bootloader's to it); the config# passed here is just a marker so /proc/cmdline shows which path booted.if [ "${AC_SKIP_KPART:-0}" = "1" ]; then log " Chromebook kpart: SKIPPED (AC_SKIP_KPART=1) — this release will not boot stock Chromebooks"else VBUTIL=$(command -v vbutil_kernel || true) DEVKEYS=$(dirname "$(find /usr/share /usr/local/share -path '*devkeys/kernel.keyblock' 2>/dev/null | head -1)" 2>/dev/null || true) if [ -z "$VBUTIL" ] || [ ! -f "$DEVKEYS/kernel.keyblock" ] || [ ! -f "$DEVKEYS/kernel_data_key.vbprivk" ]; then err "vbutil_kernel or the vboot devkeys are missing (Dockerfile.builder installs vboot-utils)." err " Set AC_SKIP_KPART=1 to build without Chromebook support." exit 1 fi KPART="$BUILD/vmlinuz.kpart" # snd_intel_dspcfg.dsp_driver=3 forces the SOF path for the audio DSP. # The kernel's auto-select takes SOF on Gemini/Jasper Lake only when the # NHLT table lists DMICs; the HP "Meep" (no DMICs in NHLT) fell back to # legacy HDA, got a codec-less "HDA Intel PCH" card and no sound # (2026-09-24). Every Chromebook that boots this kpart has a SOF-era DSP, # and the parameter is read-only after boot, so it rides the kpart # command line only — UEFI boots (ThinkPads, Macs) are untouched. printf 'ac.boot=chromeos snd_intel_dspcfg.dsp_driver=3' > "$BUILD/kpart-cmdline.txt" # x86 depthcharge ignores the bootloader blob but vbutil_kernel insists on one. dd if=/dev/zero of="$BUILD/kpart-bootstub.bin" bs=512 count=1 status=none "$VBUTIL" --pack "$KPART" \ --keyblock "$DEVKEYS/kernel.keyblock" \ --signprivate "$DEVKEYS/kernel_data_key.vbprivk" \ --version 1 \ --vmlinuz arch/x86/boot/bzImage \ --config "$BUILD/kpart-cmdline.txt" \ --bootloader "$BUILD/kpart-bootstub.bin" \ --arch x86 || { err "vbutil_kernel --pack failed"; exit 1; } "$VBUTIL" --verify "$KPART" --signpubkey "$DEVKEYS/kernel_subkey.vbpubk" >/dev/null 2>&1 \ || { err "vbutil_kernel --verify rejected the packed kernel"; exit 1; } cp "$KPART" "$OUT/vmlinuz.kpart" 2>/dev/null || true KPART_SIZE=$(stat -c%s "$KPART") KPART_SHA=$(sha256sum "$KPART" | awk '{print $1}') log " vmlinuz.kpart: $((KPART_SIZE / 1048576))MB (vboot devkeys, sha256: ${KPART_SHA:0:16}...)"fi
# Post-build verification: confirm critical driver objects actually got# compiled. The .config saying =y isn't enough — kbuild's persistent# build state could skip re-compiling a driver whose toggle changed.# Symptom (seen on G7): canary passed at config-check time but the# running kernel had no jasperlake-pinctrl driver, no symbols,# no gpiochip for the SoC pins. Grep vmlinux's symbol table for a# canonical symbol from each critical driver.log " Verifying critical driver symbols linked into vmlinux..."MISSING_DRVS=""for probe in "jsl_pinctrl_acpi_match:pinctrl-jasperlake" \ "max98357a_sdmode_event:snd-soc-max98357a" \ "rt5682_i2c_probe:rt5682-i2c" \ "i2c_dw_prepare_clk:i2c-designware-core"; do sym="${probe%%:*}" drv="${probe##*:}" if ! nm vmlinux 2>/dev/null | grep -q " ${sym}\$"; then MISSING_DRVS="$MISSING_DRVS $drv(${sym})" fidoneif [ -n "$MISSING_DRVS" ]; then err "BUILD SANITY: critical driver symbols missing from vmlinux:$MISSING_DRVS" err " This usually means the persistent /kernel-build volume has stale" err " object files and kbuild didn't rebuild them. Wipe the volume and" err " re-run: docker volume rm ac-os-kbuild (then re-trigger build)" exit 1filog " ✓ All critical driver symbols present in vmlinux"
VMLINUZ_SIZE=$(stat -c%s "$BUILD/vmlinuz")SHA=$(sha256sum "$BUILD/vmlinuz" | awk '{print $1}')log " vmlinuz: $((VMLINUZ_SIZE / 1048576))MB (external initramfs)"
# ══════════════════════════════════════════════# Step 5: Generate UEFI-bootable ISO# ══════════════════════════════════════════════log "Step 5: Building ISO..."ISO_DIR="$BUILD/iso-root"EFI_IMG="$BUILD/efi.img"ISO_OUT="$BUILD/ac-os.iso"CONFIG_TMP="$BUILD/identity-config.json"
rm -rf "$ISO_DIR" "$EFI_IMG" "$CONFIG_TMP"
ac_media_write_identity_config "$CONFIG_TMP"ac_media_stage_boot_tree "$ISO_DIR" "$BUILD/vmlinuz" "$CONFIG_TMP"ac_media_create_fat_image "$ISO_DIR" "$EFI_IMG" "AC_NATIVE"
# Build hybrid ISO with xorriso (EFI boot via El Torito + GPT for dd/USB)# Uses the same chainloader-first staged tree as ac-os generate_template_iso().if command -v xorriso &>/dev/null; then ac_media_build_hybrid_iso "$ISO_DIR" "$EFI_IMG" "$ISO_OUT" "AC_NATIVE"else # Fallback: raw EFI disk image (dd-able) log " No xorriso — creating raw disk image" cp "$EFI_IMG" "$ISO_OUT"fi
rm -f "$CONFIG_TMP"
if [ -f "$ISO_OUT" ]; then ISO_SIZE=$(stat -c%s "$ISO_OUT") ISO_SHA=$(sha256sum "$ISO_OUT" | awk '{print $1}') cp "$ISO_OUT" "$OUT/ac-os.iso" 2>/dev/null || true log " ISO: $((ISO_SIZE / 1048576))MB (sha256: ${ISO_SHA:0:16}...)"else log " ISO generation failed — vmlinuz still available"fi
log ""log "═══════════════════════════════════════════"log " Build complete: $BUILD_NAME"log " Kernel: $((VMLINUZ_SIZE / 1048576))MB"log " SHA256: $SHA"if [ -f "$ISO_OUT" ]; then log " ISO: $((ISO_SIZE / 1048576))MB"fiif command -v ccache &>/dev/null; then CCACHE_HIT=$(ccache -s 2>/dev/null | grep "cache hit rate" | head -1 || true) CCACHE_SIZE=$(ccache -s 2>/dev/null | grep "cache size" | head -1 || true) log " ccache: ${CCACHE_HIT:-n/a} | ${CCACHE_SIZE:-n/a}"filog "═══════════════════════════════════════════"
# Write metadatacat > "$OUT/build.json" << EOF{ "name": "$BUILD_NAME", "git_hash": "$GIT_HASH", "build_ts": "$BUILD_TS", "size": $VMLINUZ_SIZE, "sha256": "$SHA", "iso_size": ${ISO_SIZE:-0}, "iso_sha256": "${ISO_SHA:-}", "kpart_size": ${KPART_SIZE:-0}, "kpart_sha256": "${KPART_SHA:-}", "handle": "$HANDLE"}EOF