Refactor bee CLI and LiveCD integration

2026-03-13 16:52:16 +03:00
parent b7c888edb1
commit 6aca1682b9
47 changed files with 3137 additions and 1201 deletions
--- a/iso/builder/Dockerfile
+++ b/iso/builder/Dockerfile
@@ -0,0 +1,44 @@
+FROM debian:12
+
+ARG GO_VERSION=1.23.6
+ARG DEBIAN_KERNEL_ABI=6.1.0-43
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update -qq && apt-get install -y \
+    ca-certificates \
+    live-build \
+    debootstrap \
+    squashfs-tools \
+    xorriso \
+    grub-pc-bin \
+    grub-efi-amd64-bin \
+    mtools \
+    git \
+    wget \
+    curl \
+    tar \
+    xz-utils \
+    rsync \
+    build-essential \
+    gcc \
+    make \
+    perl \
+    "linux-headers-${DEBIAN_KERNEL_ABI}-amd64" \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN arch="$(dpkg --print-architecture)" \
+    && case "$arch" in \
+        amd64) goarch=amd64 ;; \
+        arm64) goarch=arm64 ;; \
+        *) echo "unsupported architecture: $arch" >&2; exit 1 ;; \
+    esac \
+    && wget -q -O /tmp/go.tar.gz "https://go.dev/dl/go${GO_VERSION}.linux-${goarch}.tar.gz" \
+    && rm -rf /usr/local/go \
+    && tar -C /usr/local -xzf /tmp/go.tar.gz \
+    && rm -f /tmp/go.tar.gz
+
+ENV PATH=/usr/local/go/bin:${PATH}
+WORKDIR /work
+
+CMD ["/bin/bash"]
--- a/iso/builder/build-in-container.sh
+++ b/iso/builder/build-in-container.sh
@@ -0,0 +1,61 @@
+#!/bin/sh
+# build-in-container.sh — build the bee ISO inside a Debian container.
+
+set -e
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+BUILDER_DIR="${REPO_ROOT}/iso/builder"
+CONTAINER_TOOL="${CONTAINER_TOOL:-docker}"
+IMAGE_TAG="${BEE_BUILDER_IMAGE:-bee-iso-builder}"
+AUTH_KEYS=""
+
+. "${BUILDER_DIR}/VERSIONS"
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --authorized-keys)
+            AUTH_KEYS="$2"
+            shift 2
+            ;;
+        *)
+            echo "unknown arg: $1" >&2
+            exit 1
+            ;;
+    esac
+done
+
+if ! command -v "$CONTAINER_TOOL" >/dev/null 2>&1; then
+    echo "container tool not found: $CONTAINER_TOOL" >&2
+    exit 1
+fi
+
+if [ -n "$AUTH_KEYS" ]; then
+    [ -f "$AUTH_KEYS" ] || { echo "authorized_keys not found: $AUTH_KEYS" >&2; exit 1; }
+    AUTH_KEYS_ABS="$(cd "$(dirname "$AUTH_KEYS")" && pwd)/$(basename "$AUTH_KEYS")"
+    AUTH_KEYS_DIR="$(dirname "$AUTH_KEYS_ABS")"
+    AUTH_KEYS_BASE="$(basename "$AUTH_KEYS_ABS")"
+fi
+
+"$CONTAINER_TOOL" build \
+    --build-arg GO_VERSION="${GO_VERSION}" \
+    --build-arg DEBIAN_KERNEL_ABI="${DEBIAN_KERNEL_ABI}" \
+    -t "${IMAGE_TAG}:debian${DEBIAN_VERSION}" \
+    "${BUILDER_DIR}"
+
+set -- \
+    run --rm --privileged \
+    -v "${REPO_ROOT}:/work" \
+    -w /work \
+    "${IMAGE_TAG}:debian${DEBIAN_VERSION}" \
+    sh /work/iso/builder/build.sh
+
+if [ -n "$AUTH_KEYS" ]; then
+    set -- run --rm --privileged \
+        -v "${REPO_ROOT}:/work" \
+        -v "${AUTH_KEYS_DIR}:/tmp/bee-authkeys:ro" \
+        -w /work \
+        "${IMAGE_TAG}:debian${DEBIAN_VERSION}" \
+        sh /work/iso/builder/build.sh --authorized-keys "/tmp/bee-authkeys/${AUTH_KEYS_BASE}"
+fi
+
+"$CONTAINER_TOOL" "$@"
--- a/iso/builder/build.sh
+++ b/iso/builder/build.sh
@@ -14,6 +14,8 @@ BUILDER_DIR="${REPO_ROOT}/iso/builder"
 OVERLAY_DIR="${REPO_ROOT}/iso/overlay"
 DIST_DIR="${REPO_ROOT}/dist"
 VENDOR_DIR="${REPO_ROOT}/iso/vendor"
+BUILD_WORK_DIR="${DIST_DIR}/live-build-work"
+OVERLAY_STAGE_DIR="${DIST_DIR}/overlay-stage"
 AUTH_KEYS=""

 # parse args
@@ -26,36 +28,49 @@ done

 . "${BUILDER_DIR}/VERSIONS"
 export PATH="$PATH:/usr/local/go/bin"
+mkdir -p "${DIST_DIR}"

 echo "=== bee ISO build ==="
 echo "Debian: ${DEBIAN_VERSION}, Kernel ABI: ${DEBIAN_KERNEL_ABI}, Go: ${GO_VERSION}"
 echo ""

-# --- compile audit binary (static, Linux amd64) ---
-AUDIT_BIN="${DIST_DIR}/bee-audit-linux-amd64"
+# --- compile bee binary (static, Linux amd64) ---
+BEE_BIN="${DIST_DIR}/bee-linux-amd64"
 NEED_BUILD=1
-if [ -f "$AUDIT_BIN" ]; then
-    NEWEST_SRC=$(find "${REPO_ROOT}/audit" -name '*.go' -newer "$AUDIT_BIN" | head -1)
+if [ -f "$BEE_BIN" ]; then
+    NEWEST_SRC=$(find "${REPO_ROOT}/audit" -name '*.go' -newer "$BEE_BIN" | head -1)
    [ -z "$NEWEST_SRC" ] && NEED_BUILD=0
 fi

 if [ "$NEED_BUILD" = "1" ]; then
-    echo "=== building audit binary ==="
+    echo "=== building bee binary ==="
    cd "${REPO_ROOT}/audit"
    GOOS=linux GOARCH=amd64 CGO_ENABLED=0 \
        go build \
        -ldflags "-s -w -X main.Version=${AUDIT_VERSION:-$(date +%Y%m%d)}" \
-        -o "$AUDIT_BIN" \
-        ./cmd/audit
-    echo "binary: $AUDIT_BIN"
-    echo "size:   $(du -sh "$AUDIT_BIN" | cut -f1)"
+        -o "$BEE_BIN" \
+        ./cmd/bee
+    echo "binary: $BEE_BIN"
+    echo "size:   $(du -sh "$BEE_BIN" | cut -f1)"
 else
-    echo "=== audit binary up to date, skipping build ==="
+    echo "=== bee binary up to date, skipping build ==="
 fi

+echo "=== preparing staged overlay ==="
+rm -rf "${BUILD_WORK_DIR}" "${OVERLAY_STAGE_DIR}"
+mkdir -p "${BUILD_WORK_DIR}" "${OVERLAY_STAGE_DIR}"
+rsync -a "${BUILDER_DIR}/" "${BUILD_WORK_DIR}/"
+rsync -a "${OVERLAY_DIR}/" "${OVERLAY_STAGE_DIR}/"
+rm -f \
+    "${OVERLAY_STAGE_DIR}/etc/bee-ssh-password-fallback" \
+    "${OVERLAY_STAGE_DIR}/etc/bee-release" \
+    "${OVERLAY_STAGE_DIR}/root/.ssh/authorized_keys" \
+    "${OVERLAY_STAGE_DIR}/usr/local/bin/bee" \
+    "${OVERLAY_STAGE_DIR}/usr/local/bin/bee-smoketest"
+
 # --- inject authorized_keys for SSH access ---
-AUTHORIZED_KEYS_FILE="${OVERLAY_DIR}/root/.ssh/authorized_keys"
-mkdir -p "${OVERLAY_DIR}/root/.ssh"
+AUTHORIZED_KEYS_FILE="${OVERLAY_STAGE_DIR}/root/.ssh/authorized_keys"
+mkdir -p "${OVERLAY_STAGE_DIR}/root/.ssh"

 if [ -n "$AUTH_KEYS" ]; then
    cp "$AUTH_KEYS" "$AUTHORIZED_KEYS_FILE"
@@ -81,25 +96,25 @@ else
 fi

 if [ "${USE_PASSWORD_FALLBACK:-0}" = "1" ]; then
-    touch "${OVERLAY_DIR}/etc/bee-ssh-password-fallback"
+    touch "${OVERLAY_STAGE_DIR}/etc/bee-ssh-password-fallback"
 else
-    rm -f "${OVERLAY_DIR}/etc/bee-ssh-password-fallback"
+    rm -f "${OVERLAY_STAGE_DIR}/etc/bee-ssh-password-fallback"
 fi

-# --- copy audit binary into overlay ---
-mkdir -p "${OVERLAY_DIR}/usr/local/bin"
-cp "${DIST_DIR}/bee-audit-linux-amd64" "${OVERLAY_DIR}/usr/local/bin/audit"
-chmod +x "${OVERLAY_DIR}/usr/local/bin/audit"
+# --- copy bee binary into overlay ---
+mkdir -p "${OVERLAY_STAGE_DIR}/usr/local/bin"
+cp "${DIST_DIR}/bee-linux-amd64" "${OVERLAY_STAGE_DIR}/usr/local/bin/bee"
+chmod +x "${OVERLAY_STAGE_DIR}/usr/local/bin/bee"

 # --- inject smoketest into overlay so it runs directly on the live CD ---
-cp "${BUILDER_DIR}/smoketest.sh" "${OVERLAY_DIR}/usr/local/bin/bee-smoketest"
-chmod +x "${OVERLAY_DIR}/usr/local/bin/bee-smoketest"
+cp "${BUILDER_DIR}/smoketest.sh" "${OVERLAY_STAGE_DIR}/usr/local/bin/bee-smoketest"
+chmod +x "${OVERLAY_STAGE_DIR}/usr/local/bin/bee-smoketest"

 # --- vendor utilities (optional pre-fetched binaries) ---
 for tool in storcli64 sas2ircu sas3ircu mstflint; do
    if [ -f "${VENDOR_DIR}/${tool}" ]; then
-        cp "${VENDOR_DIR}/${tool}" "${OVERLAY_DIR}/usr/local/bin/${tool}"
-        chmod +x "${OVERLAY_DIR}/usr/local/bin/${tool}" || true
+        cp "${VENDOR_DIR}/${tool}" "${OVERLAY_STAGE_DIR}/usr/local/bin/${tool}"
+        chmod +x "${OVERLAY_STAGE_DIR}/usr/local/bin/${tool}" || true
        echo "vendor tool: ${tool} (included)"
    else
        echo "vendor tool: ${tool} (not found, skipped)"
@@ -116,29 +131,30 @@ NVIDIA_CACHE="${DIST_DIR}/nvidia-${NVIDIA_DRIVER_VERSION}-${KVER}"

 # Inject .ko files into overlay at /usr/local/lib/nvidia/
 OVERLAY_KMOD_DIR="${OVERLAY_DIR}/usr/local/lib/nvidia"
+OVERLAY_KMOD_DIR="${OVERLAY_STAGE_DIR}/usr/local/lib/nvidia"
 mkdir -p "${OVERLAY_KMOD_DIR}"
 cp "${NVIDIA_CACHE}/modules/"*.ko "${OVERLAY_KMOD_DIR}/"

 # Inject nvidia-smi and libnvidia-ml
-mkdir -p "${OVERLAY_DIR}/usr/local/bin" "${OVERLAY_DIR}/usr/lib"
-cp "${NVIDIA_CACHE}/bin/nvidia-smi" "${OVERLAY_DIR}/usr/local/bin/"
-chmod +x "${OVERLAY_DIR}/usr/local/bin/nvidia-smi"
-cp "${NVIDIA_CACHE}/bin/nvidia-bug-report.sh" "${OVERLAY_DIR}/usr/local/bin/" 2>/dev/null || true
-chmod +x "${OVERLAY_DIR}/usr/local/bin/nvidia-bug-report.sh" 2>/dev/null || true
-cp "${NVIDIA_CACHE}/lib/"* "${OVERLAY_DIR}/usr/lib/" 2>/dev/null || true
+mkdir -p "${OVERLAY_STAGE_DIR}/usr/local/bin" "${OVERLAY_STAGE_DIR}/usr/lib"
+cp "${NVIDIA_CACHE}/bin/nvidia-smi" "${OVERLAY_STAGE_DIR}/usr/local/bin/"
+chmod +x "${OVERLAY_STAGE_DIR}/usr/local/bin/nvidia-smi"
+cp "${NVIDIA_CACHE}/bin/nvidia-bug-report.sh" "${OVERLAY_STAGE_DIR}/usr/local/bin/" 2>/dev/null || true
+chmod +x "${OVERLAY_STAGE_DIR}/usr/local/bin/nvidia-bug-report.sh" 2>/dev/null || true
+cp "${NVIDIA_CACHE}/lib/"* "${OVERLAY_STAGE_DIR}/usr/lib/" 2>/dev/null || true

 # Inject GSP firmware into /lib/firmware/nvidia/<version>/
 if [ -d "${NVIDIA_CACHE}/firmware" ] && [ "$(ls -A "${NVIDIA_CACHE}/firmware" 2>/dev/null)" ]; then
-    mkdir -p "${OVERLAY_DIR}/lib/firmware/nvidia/${NVIDIA_DRIVER_VERSION}"
-    cp "${NVIDIA_CACHE}/firmware/"* "${OVERLAY_DIR}/lib/firmware/nvidia/${NVIDIA_DRIVER_VERSION}/"
-    echo "=== firmware: $(ls "${OVERLAY_DIR}/lib/firmware/nvidia/${NVIDIA_DRIVER_VERSION}/" | wc -l) files injected ==="
+    mkdir -p "${OVERLAY_STAGE_DIR}/lib/firmware/nvidia/${NVIDIA_DRIVER_VERSION}"
+    cp "${NVIDIA_CACHE}/firmware/"* "${OVERLAY_STAGE_DIR}/lib/firmware/nvidia/${NVIDIA_DRIVER_VERSION}/"
+    echo "=== firmware: $(ls "${OVERLAY_STAGE_DIR}/lib/firmware/nvidia/${NVIDIA_DRIVER_VERSION}/" | wc -l) files injected ==="
 fi

 # --- embed build metadata ---
-mkdir -p "${OVERLAY_DIR}/etc"
+mkdir -p "${OVERLAY_STAGE_DIR}/etc"
 BUILD_DATE="$(date +%Y-%m-%d)"
 GIT_COMMIT="$(git -C "${REPO_ROOT}" rev-parse --short HEAD 2>/dev/null || echo unknown)"
-cat > "${OVERLAY_DIR}/etc/bee-release" <<EOF
+cat > "${OVERLAY_STAGE_DIR}/etc/bee-release" <<EOF
 BEE_ISO_VERSION=${AUDIT_VERSION}
 BEE_AUDIT_VERSION=${AUDIT_VERSION}
 BUILD_DATE=${BUILD_DATE}
@@ -150,17 +166,17 @@ EOF

 # Patch motd with build info
 BEE_BUILD_INFO="${BUILD_DATE} git:${GIT_COMMIT} debian:${DEBIAN_VERSION} nvidia:${NVIDIA_DRIVER_VERSION}"
-if [ -f "${OVERLAY_DIR}/etc/motd" ]; then
-    sed "s/%%BUILD_INFO%%/${BEE_BUILD_INFO}/" "${OVERLAY_DIR}/etc/motd" \
-        > "${OVERLAY_DIR}/etc/motd.patched"
-    mv "${OVERLAY_DIR}/etc/motd.patched" "${OVERLAY_DIR}/etc/motd"
+if [ -f "${OVERLAY_STAGE_DIR}/etc/motd" ]; then
+    sed "s/%%BUILD_INFO%%/${BEE_BUILD_INFO}/" "${OVERLAY_STAGE_DIR}/etc/motd" \
+        > "${OVERLAY_STAGE_DIR}/etc/motd.patched"
+    mv "${OVERLAY_STAGE_DIR}/etc/motd.patched" "${OVERLAY_STAGE_DIR}/etc/motd"
 fi

 # --- sync overlay into live-build includes.chroot ---
-LB_DIR="${BUILDER_DIR}"
+LB_DIR="${BUILD_WORK_DIR}"
 LB_INCLUDES="${LB_DIR}/config/includes.chroot"
 mkdir -p "${LB_INCLUDES}"
-rsync -a "${OVERLAY_DIR}/" "${LB_INCLUDES}/"
+rsync -a "${OVERLAY_STAGE_DIR}/" "${LB_INCLUDES}/"

 # Ensure SSH authorized_keys perms are correct (rsync may alter)
 if [ -f "${LB_INCLUDES}/root/.ssh/authorized_keys" ]; then
@@ -169,7 +185,6 @@ if [ -f "${LB_INCLUDES}/root/.ssh/authorized_keys" ]; then
 fi

 # --- build ISO using live-build ---
-mkdir -p "${DIST_DIR}"
 echo ""
 echo "=== building ISO (live-build) ==="

--- a/iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot
+++ b/iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot
@@ -18,7 +18,7 @@ chmod +x /usr/local/bin/bee-nvidia-load 2>/dev/null || true
 chmod +x /usr/local/bin/bee-sshsetup   2>/dev/null || true
 chmod +x /usr/local/bin/bee-smoketest  2>/dev/null || true
 chmod +x /usr/local/bin/bee-tui        2>/dev/null || true
-chmod +x /usr/local/bin/audit          2>/dev/null || true
+chmod +x /usr/local/bin/bee            2>/dev/null || true

 # Reload udev rules
 udevadm control --reload-rules 2>/dev/null || true
--- a/iso/builder/config/package-lists/bee.list.chroot
+++ b/iso/builder/config/package-lists/bee.list.chroot
@@ -21,7 +21,6 @@ lsof
 file
 less
 vim-tiny
-dialog

 # QR codes (for displaying audit results)
 qrencode
--- a/iso/builder/setup-builder.sh
+++ b/iso/builder/setup-builder.sh
@@ -1,8 +1,9 @@
 #!/bin/sh
-# setup-builder.sh — prepare Debian 12 VM as bee ISO builder
+# setup-builder.sh — prepare Debian 12 host/VM as bee ISO builder
 #
-# Run once on a fresh Debian 12 (Bookworm) VM as root.
-# After this script completes, the VM can build bee ISO images.
+# Run once on a fresh Debian 12 (Bookworm) host/VM as root.
+# After this script completes, the machine can build bee ISO images directly.
+# Container alternative: use `iso/builder/build-in-container.sh`.
 #
 # Usage (on Debian VM):
 #   wget -O- https://git.mchus.pro/mchus/bee/raw/branch/main/iso/builder/setup-builder.sh | sh
--- a/iso/builder/smoketest.sh
+++ b/iso/builder/smoketest.sh
@@ -29,7 +29,7 @@ info "kernel: $KVER"

 # --- PATH & binaries ---
 echo "-- PATH & binaries --"
-for tool in dmidecode smartctl nvme ipmitool lspci audit; do
+for tool in dmidecode smartctl nvme ipmitool lspci bee; do
    if p=$(PATH="/usr/local/bin:$PATH" command -v "$tool" 2>/dev/null); then
        ok "$tool found: $p"
    else
@@ -114,14 +114,14 @@ for svc in ssh bee-sshsetup; do
 done

 echo ""
-echo "-- audit binary --"
-AUDIT=/usr/local/bin/audit
-if [ -x "$AUDIT" ]; then
-    ok "audit binary: present"
-    ver=$("$AUDIT" --version 2>/dev/null || "$AUDIT" version 2>/dev/null || echo "unknown")
-    info "audit version: $ver"
+echo "-- bee binary --"
+BEE=/usr/local/bin/bee
+if [ -x "$BEE" ]; then
+    ok "bee binary: present"
+    ver=$("$BEE" version 2>/dev/null || echo "unknown")
+    info "bee version: $ver"
 else
-    fail "audit binary: NOT FOUND at $AUDIT"
+    fail "bee binary: NOT FOUND at $BEE"
 fi

 echo ""