live-iso common: TPM2-unlocked ZFS encryption (tpm-or-none), storage gates, swtpm harness, xfs fstab fix, pahole, vdb-prune #13

Closed

CanuteTheGreat wants to merge 0 commits from feat/tpm-unlock-patronus-fs-gates into main

CanuteTheGreat commented

2026-11-03 19:01:14 -08:00

Owner

Based on fix/gringotts-post-install-roots-v2: merge that first. Patronus vendors this common/.

CanuteTheGreat added 18 commits

2026-11-03 19:01:14 -08:00

gringotts first-boot root causes: clock (RTC written from a synced clock by the installer, horcrux-chrony-nm in every GNOME install via horcrux-gnome-defaults), firstboot waits for the network without limit, toolchain files kept, first-login Wi-Fi chooser, stale-base gates a79ce27a6a

- liveinst/rtc.py + Installer.finish(): hwclock -w -u only from a verified clock (chrony or HTTP Date), steps a months-off live clock first; never writes an unverified clock
- gnome-extra/horcrux-gnome-defaults-1-r1: RDEPEND net-misc/horcrux-chrony-nm (+chrony, NM, control-center), first-login Wi-Fi chooser autostart (once, only when offline with a Wi-Fi device); desktop.apply puts both into the target world
- gringotts-tools-1-r1: gringotts-firstboot waits for a network with no time limit, retries the tree sync every 10 min, is not a supervised daemon (OpenRC showed it crashed once finished); gringotts-install offers nmtui when the live stick is offline
- gnome-light Dockerfile: the size strip kept deleting /usr/include and every static lib (no C compiler on installed systems, no zfs-kmod rebuild on kernel updates): keep glibc/linux-headers/elfutils/openssl/zlib/zstd/xz/ncurses/libxcrypt dev files and gate a compile
- gringotts Dockerfile: stale-base gate (REUSE_ROOTFS base predating the hogshead fixes shipped without the clock hook / cups-browsed zeroconf)
- harness: -rtc base months off on every desktop boot; gates installer-writes-rtc-from-a-synced-clock, chrony-nm hook package-owned, chrony steps the months-off clock after the network, toolchain compiles; gringotts late-network phase (NIC link down 12 min via QMP set_link, firstboot must wait then complete and not show crashed)
- horcrux-backup-1-r1: exclude ~/Nextcloud

image: the package database must match the files, a kernel module must build (gringotts 2026-11-03 follow-up) 47d28b7593

- build.sh: unpack the rootfs with tar --anchored --exclude='dev/*': the unanchored pattern also dropped every directory named dev (kernel can/dev, dhcpcd/dev ...)
- setup-rootfs.sh: keep /usr/src/linux-<ver> (the kernel build tree, ~170 MB) - zfs-kmod and every other module build against it
- gringotts variant: same toolchain-keeping strip as gnome-light (it deleted /usr/include and every *.a)
- common/vdb-prune.py (+tests): drops the CONTENTS records of intentionally stripped files (reviewed groups: docs, non-English locale/help, pyc, SoC firmware, non-toolchain headers/static libs, clang), run as the last strip step
- QEMU gates package-contents-complete-no-missing-files (any installed package with a missing CONTENTS file fails) and kernel-module-builds-against-running-kernel (out-of-tree module against /lib/modules/$(uname -r)/build)

overlay: sys-apps/horcrux-repo-config owns the [horcrux] repos.conf entry (git sync from the overlay's own repo, auto-sync yes); horcrux-gnome-defaults-1-r2 pulls it into every GNOME install; images ship the tree as a git checkout; profiles/categories a03db34fc7

ci: overlay-sync workflow publishes gentoo/ as CanuteTheGreat/horcrux-overlay (git subtree split, fast-forward only) 3443d6aba4

setup-rootfs: print kernel/zfs-kmod state and rebuild zfs-kmod when the newest kernel has no zfs module (daily failed: dracut Failed to find module zfs) ffd5c93941

zfs: zfs-kmod/zfs USE=dist-kernel in every image (common/portage/package.use/00-zfs) and on installed machines (sys-kernel/horcrux-unlock-1-r2 ships package.use/horcrux-zfs); gate zfs-kmod-rebuilds-with-every-dist-kernel-update 7f5e93a775

Without the flag nothing rebuilds the ZFS module for a new kernel: the dist-kernel update installs an initramfs without zfs.ko (dracut: Failed to find module zfs) and a ZFS-root laptop would not boot. This is also what broke the daily ISO builds (cached zfs-kmod layer for the previous kernel).

ci: a failed build/test/publish step fails the Live ISO run (green-but-failed 8637); build.sh exit code checked 663356176c

keyring: GDM login starts ONE pam_gnome_keyring set (after elogind): horcrux-gnome-defaults-1-r2 fixes pambase's duplicate in system-local-login (no persistent login keyring => every Brave/Nextcloud/Proton sign-in lost at logout), horcrux-keyring-status, QEMU gate + stale-base gates c87cd6f831

horcrux-backup-1-r2: /etc/ctg-backup/required + 'ctg-restic content' (newest snapshot must hold the keyring, browser profiles, app logins; state file read by the freshness monitor), browser cache excludes, /var/lib/iwd 27be6da941

gringotts-tools-1-r2: gringotts-restore brings back the login keyring, ~/.config/Nextcloud, Proton configs (was: 'not restored on purpose'); refuses with a graphical session running (the keyring daemon would overwrite the file) ff13f40a86

keyring/backup packages renamed -r3 (another checkout shipped a different horcrux-gnome-defaults-1-r2 / backup-1-r1 to hogshead) e76c7e6595

ctg-restic content: count instead of grep -q (SIGPIPE false misses under pipefail) fd05e11ea4

live-iso common: TPM2-sealed unattended unlock for natively encrypted ZFS (profile encryption=tpm-or-none: encrypt only when a working TPM exists, else NOT encrypted, never a boot prompt); Patronus default fs ZFS/XFS in the QEMU harness; swtpm; storage gates (package-contents, kernel-module build, zfs dist-kernel, encryption decision, wrong-TPM negative); vdb-prune core in setup-rootfs; per-project ci-matrix hook 6b0117ae66

live-iso common: packages-late.txt honours arch-gated lines (x86_64? pkg), like packages-extra.txt a574481e87

qemu-test: swtpm is restarted before every VM (it exits when QEMU disconnects), same state dir = same TPM ace634c6da

vdb-prune: kernel postinst-moved files (arch/*/boot/initrd, uki.efi) and glib's giomodule.cache are intentional records; gate lists up to 4 missing paths per package 855a0e6591

packages-extra: dev-util/pahole (kernel module builds need it with CONFIG_DEBUG_INFO_BTF: zfs-kmod could not have been rebuilt on a kernel update) a2a8cc8177

installer: plain xfs/ext4 installs write /etc/fstab (root, /boot, ESP by UUID); without it /boot was not mounted on the installed system and kernel updates missed the partition GRUB reads