tawasuyu/brahman

1#!/usr/bin/env bash
2# build-arje-initrd.sh — empaqueta ente-zero + shims compat + Tarjeta Semilla
3# en un initramfs CPIO+gzip listo para arrancar bajo QEMU o como /init real.
4#
5# Layout del initrd resultante:
6#   /init                         → wrapper sh que exec /sbin/ente-zero
7#   /sbin/ente-zero               → PID 1
8#   /usr/sbin/ente-*-compat       → shims systemd
9#   /usr/sbin/ente-echo, ente-policy-provider
10#   /ente/seed.card.json          → Tarjeta Semilla
11#   /bin/{sh,ls,cat,...}          → busybox o glibc-static (depende del flag)
12#   /dev, /proc, /sys, /run       → puntos de montaje (ente-zero los monta)
13#
14# Uso:
15#   scripts/build-arje-initrd.sh [seed.card.json] [out.cpio.gz]
16#
17#   seed     default: seeds/arje-prod.card.json
18#   out      default: out/arje.initrd.cpio.gz
19#
20# Env:
21#   BUSYBOX_BIN   path a un busybox-static (default: $(which busybox))
22#   EXTRA_BINS    binarios extra a copiar, separados por espacio
23#
24# Requisitos: cpio, gzip, ldd (sólo si no usás busybox-static).
25
26set -euo pipefail
27
28SEED="${1:-seeds/arje-prod.card.json}"
29OUT="${2:-out/arje.initrd.cpio.gz}"
30BUSYBOX_BIN="${BUSYBOX_BIN:-$(command -v busybox 2>/dev/null || true)}"
31EXTRA_BINS="${EXTRA_BINS:-}"
32
33SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
34REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
35cd "$REPO_DIR"
36
37if [ ! -f "$SEED" ]; then
38  echo "[build-initrd] seed no encontrada: $SEED" >&2
39  exit 2
40fi
41
42# 1. Build release de ente-zero y todos los compat shims.
43echo "[build-initrd] cargo build --release de ente-zero + shims"
44cargo build --release \
45  -p ente-zero \
46  -p ente-echo \
47  -p ente-logind-compat \
48  -p ente-hostnamed-compat \
49  -p ente-timedated-compat \
50  -p ente-localed-compat \
51  -p ente-journald-compat \
52  -p ente-resolved-compat \
53  -p ente-polkit-compat \
54  -p ente-machined-compat \
55  -p ente-systemd1-compat \
56  -p ente-notify-compat \
57  -p ente-timer-compat \
58  -p ente-tmpfiles-compat \
59  -p ente-binfmt-compat \
60  -p ente-policy-provider
61
62# 2. Validar la seed.
63if ! seeds/validate.sh "$SEED" >/dev/null 2>&1; then
64  echo "[build-initrd] seed inválida: $SEED" >&2
65  exit 3
66fi
67
68# 3. Stage root del initrd.
69STAGE="$(mktemp -d -t arje-initrd.XXXXXX)"
70trap 'rm -rf "$STAGE"' EXIT
71mkdir -p "$STAGE"/{bin,sbin,usr/sbin,etc,ente,proc,sys,dev,run,tmp,sys/fs/cgroup}
72
73# 4. Copiar binarios arje.
74install -m 0755 target/release/ente-zero               "$STAGE/sbin/ente-zero"
75for b in ente-echo ente-policy-provider \
76         ente-logind-compat ente-hostnamed-compat ente-timedated-compat \
77         ente-localed-compat ente-journald-compat ente-resolved-compat \
78         ente-polkit-compat ente-machined-compat ente-systemd1-compat \
79         ente-notify-compat ente-timer-compat ente-tmpfiles-compat \
80         ente-binfmt-compat; do
81  install -m 0755 "target/release/$b" "$STAGE/usr/sbin/$b"
82done
83
84# 5. Userspace mínimo (sh, ls, mount, mkdir, ...). Dos rutas:
85#    (a) busybox-static apuntado por $BUSYBOX_BIN → 1 binario, todo simlink.
86#    (b) sin busybox → copiar /bin/sh + deps con ldd (libc dinámica).
87if [ -n "$BUSYBOX_BIN" ] && [ -x "$BUSYBOX_BIN" ]; then
88  echo "[build-initrd] usando busybox-static: $BUSYBOX_BIN"
89  install -m 0755 "$BUSYBOX_BIN" "$STAGE/bin/busybox"
90  ( cd "$STAGE/bin" && for app in sh ls cat mount umount mkdir cp mv \
91       echo grep sed awk ps kill sleep insmod modprobe poweroff reboot \
92       sysctl dmesg ip ifconfig; do
93       ln -sf busybox "$app"
94    done )
95else
96  echo "[build-initrd] sin busybox — copiando /bin/sh + deps via ldd"
97  install -m 0755 /bin/sh "$STAGE/bin/sh"
98  copy_lib() {
99    local lib="$1"
100    [ -f "$lib" ] || return 0
101    local dest="$STAGE${lib}"
102    mkdir -p "$(dirname "$dest")"
103    cp -L "$lib" "$dest"
104  }
105  for b in /bin/sh /bin/ls /bin/cat /bin/mount /bin/umount /bin/mkdir; do
106    [ -x "$b" ] || continue
107    cp -L "$b" "$STAGE${b}"
108    while read -r lib; do copy_lib "$lib"; done < <(
109      ldd "$b" 2>/dev/null | awk '{ for (i=1;i<=NF;i++) if ($i ~ /^\//) print $i }'
110    )
111  done
112fi
113
114# 6. Tarjeta Semilla. Path canónico en prod: /ente/seed.card.json
115install -m 0644 "$SEED" "$STAGE/ente/seed.card.json"
116
117# 7. /init wrapper. El kernel pasa control a /init; nosotros invocamos
118#    ente-zero como PID 1 real con su env mínimo.
119cat > "$STAGE/init" <<'EOF'
120#!/bin/sh
121# arje /init — kernel → este script → ente-zero (PID 1 lo hereda via exec)
122export PATH=/usr/sbin:/usr/bin:/sbin:/bin
123export RUST_LOG="${RUST_LOG:-ente_zero=info,brahman_handshake=info,info}"
124# ente-zero monta /proc /sys /dev /sys/fs/cgroup él mismo.
125exec /sbin/ente-zero
126EOF
127chmod 0755 "$STAGE/init"
128
129# 8. Binarios extra a vendorear.
130if [ -n "$EXTRA_BINS" ]; then
131  for b in $EXTRA_BINS; do
132    [ -x "$b" ] || { echo "[build-initrd] EXTRA_BINS: $b no existe"; exit 4; }
133    install -m 0755 "$b" "$STAGE/usr/sbin/$(basename "$b")"
134  done
135fi
136
137# 9. Empaquetar CPIO + gzip. Formato newc (estándar para Linux initramfs).
138mkdir -p "$(dirname "$OUT")"
139( cd "$STAGE" && find . -print0 | cpio -o -H newc --null --quiet ) | gzip -9 > "$OUT"
140echo "[build-initrd] generado: $OUT ($(du -h "$OUT" | cut -f1))"