[FEATURE] Demonstrate two complete generations of EriX built inside EriX #9

Open
opened 2026-09-12 07:56:30 +02:00 by erikinkinen · 0 comments
Owner

Problem and motivation

The required result is a full build of EriX performed within EriX, then repeated within the newly guest-built system. A hello-world, one crate, host cross-build, precompiled product cache or external image assembly does not meet that result.

Proposed behavior and scope

Boot a private admitted seed image, run the complete source-only product build from exsh, and produce signed boot artifacts, complete clean/selected extended disks and documentation. Boot the first generation, repeat the complete build with fresh output/tmp and immutable sources/tools, compare the full inventories, and run matching runtime/regression and trust-chain tests.

This issue records planned work; its unchecked criteria are not implementation proof. The normative basis is Phase 6 and AC1–AC24.

Authority, security and reliability

The guest realm receives explicit source/toolchain reads, scoped output/tmp/execution and finite child/signing routes, with no raw devices, general keys, network, host build RPC or cross-realm control. The external supervisor may record, verify, export authorized outputs and boot VMs; it cannot repair or assemble missing results.

Apply the priority order: security, reliability, then performance. Keep suspected vulnerabilities in the repository’s restricted SECURITY.md reporting channel.

Acceptance criteria

  • Freeze the acceptance source/toolchain/recipe/image hashes, complete output
    inventory, resource/timeout policy and exact build command in a reviewed runbook. Fix all
    prerequisites before declaring the timed demonstration started.
  • Provision a private seed extended image with admitted EriX-hosted tools and
    source-only inputs. Use an empty output tree and no prior EriX object, incremental, image,
    generated-metadata or host tool cache.
  • Boot the seed EriX and record guest identity, native process/realm provenance,
    mounted authority inventory and tool versions; disable networking and host
    shared-directory/build-RPC fallbacks.
  • From exsh in that EriX session, execute the complete build command. Record each
    compile/link/generate/sign/package step as an EriX process with exact input/output evidence
    and actual exit status.
  • Complete all integration#1 outputs, including every EriX component, signed boot image, UEFI
    loader, clean dev/release disks, selected extended disks and generated
    documentation/manifests. Compare inventory cardinality and hashes; a missing target or
    substituted prebuilt output fails the demonstration.
  • Run guest fmt/strict Clippy/unit/doctest checks and relevant guest
    tool/authority-negative tests on that graph; preserve zero-warning full logs.
  • Validate partition/ELF/signature/source closure, then export only completed
    artifacts/evidence through an explicitly authorized path. The host may record, independently
    verify and boot them, but may not repair or assemble a missing build output.
  • Boot the newly guest-built clean dev and release images and run their canonical
    runtime probes; boot the guest-built extended-dev image for the second-generation build.
    Record exact booted image hashes.
  • In that newly built EriX, provision the same immutable sources/tools and fresh
    empty output/tmp trees, then perform a second complete build without importing
    first-generation compiled EriX artifacts or mutable caches.
  • Compare first/second-generation complete artifact inventories and deterministic
    bytes/signatures using the fixed inputs. Investigate every difference; normalization is
    allowed only for fields explicitly specified before the run, never to erase unexplained
    payload differences.
  • Run the complete maintained VM catalog and post-image probes on matching
    guest-built artifacts. The external supervisor may start test VMs; nested virtualization
    inside EriX is not required and must not conceal a host-side build step.
  • Demonstrate source read-only, output/tmp confinement, executable scope, no
    device/raw-block/key/network/global discovery and no cross-realm control; test denied access,
    interrupted build and complete realm teardown.
  • Profile the self-host builds, report actual elapsed/CPU/I/O/memory figures and
    apply the predeclared budgets; close proven bottlenecks through reviewed fixes and a new
    complete evidence cohort, not partial retries to green.
  • Publish a reproducible evidence bundle: source graph, manifests, tool
    licenses/recipes, commands, full logs, profile summaries, negative tests, output
    hashes/signatures, boot/test results and independent review.
  • Include bootloader#1 trust-chain verification in both generations: custom-key Secure Boot,
    signed boot image and all rootfs authority/code objects. Exercise tampering/revocation
    failures before declaring the guest-built result accepted.
  • Initiate/observe the build through integration#5's real serial/PS2 CLI input paths, run
    native boot/hash tools, and verify ttyd#1's independent TTY/default-clear behavior, vtty
    switching, mouse selection/paste, boot logo and help/man/extop acceptance on the newly
    produced images.

For each implementation slice, retain actual formatting, strict Clippy, unit/doctest and warning-denied build results for all altered Rust repositories and valid configurations. Add relevant runtime VM coverage, monitor older unit/VM regressions in exact-head CI, and update canonical component documents and affected technical-manual/API material. Every authored code file must remain below 1,000 physical lines, with meaningful inline documentation and missing_docs enforcement in Rust crates.

Alternatives and tradeoffs

The running seed or first-generation OS and required libc/runtime are inventoried compiled execution substrates, not reusable target objects. Every EriX-authored product and native packaging helper is rebuilt in each generation. The imported compiler and its required Rust/LLVM/C/C++ runtime closure must first be built from source for EriX against its libc/sysroot, as tracked in the EriX-hosted toolchain issue. That initial toolchain may be cross-built on Linux. The extended development image must also rebuild that upstream Rust/LLVM toolchain inside EriX using the supplied offline recipes and dependencies, validate the resulting tools and runtime linkage, and use the guest-built compiler for at least one of the two complete EriX builds. No unrecorded porting changes, downloads, Linux executables or host-side build delegation may fill a missing guest step.

Tracking and rollout

Dependencies: integration#6, integration#1, integration#2, docs#1, integration#3, lib-posixabi#1, posixd#1, posixd#2, kernel#1, posixd#3, lib-cstd#1, dynlinkd#1, exsh#1, integration#4, integration#7, integration#8, meta#2, integration#5, bootloader#1, ttyd#1

Dependencies identify required contracts and closure gates; preparatory inventory/design can proceed in parallel under one owner per edited file. Link bounded implementation issues and their PRs here before claiming acceptance. Use feature/posix-compat, regular signed commits in the canonical contribution format, and WIP PRs linked to the exact coherent component graph. All cross-repository Cargo/catalog selections and CI helpers use full 40-character lowercase commit hashes, including transitive dependencies; do not substitute branch, tag or implicit HEAD selection.

Close criteria only with their own reviewed deliverables and validation evidence. Pending, skipped, cancelled, failed or predecessor-only results remain distinct. Keep main images unchanged until explicit promotion direction; technical completion does not authorize merges, release tags or publication.

## Problem and motivation The required result is a full build of EriX performed within EriX, then repeated within the newly guest-built system. A hello-world, one crate, host cross-build, precompiled product cache or external image assembly does not meet that result. ## Proposed behavior and scope Boot a private admitted seed image, run the complete source-only product build from exsh, and produce signed boot artifacts, complete clean/selected extended disks and documentation. Boot the first generation, repeat the complete build with fresh output/tmp and immutable sources/tools, compare the full inventories, and run matching runtime/regression and trust-chain tests. This issue records planned work; its unchecked criteria are not implementation proof. The normative basis is [Phase 6 and AC1–AC24](https://git.erikinkinen.fi/erix/docs/src/branch/main/phases/6.md). ## Authority, security and reliability The guest realm receives explicit source/toolchain reads, scoped output/tmp/execution and finite child/signing routes, with no raw devices, general keys, network, host build RPC or cross-realm control. The external supervisor may record, verify, export authorized outputs and boot VMs; it cannot repair or assemble missing results. Apply the priority order: security, reliability, then performance. Keep suspected vulnerabilities in the repository’s restricted SECURITY.md reporting channel. ## Acceptance criteria - [ ] Freeze the acceptance source/toolchain/recipe/image hashes, complete output inventory, resource/timeout policy and exact build command in a reviewed runbook. Fix all prerequisites before declaring the timed demonstration started. - [ ] Provision a private seed extended image with admitted EriX-hosted tools and source-only inputs. Use an empty output tree and no prior EriX object, incremental, image, generated-metadata or host tool cache. - [ ] Boot the seed EriX and record guest identity, native process/realm provenance, mounted authority inventory and tool versions; disable networking and host shared-directory/build-RPC fallbacks. - [ ] From exsh in that EriX session, execute the complete build command. Record each compile/link/generate/sign/package step as an EriX process with exact input/output evidence and actual exit status. - [ ] Complete all [integration#1](https://git.erikinkinen.fi/erix/integration/issues/1) outputs, including every EriX component, signed boot image, UEFI loader, clean dev/release disks, selected extended disks and generated documentation/manifests. Compare inventory cardinality and hashes; a missing target or substituted prebuilt output fails the demonstration. - [ ] Run guest fmt/strict Clippy/unit/doctest checks and relevant guest tool/authority-negative tests on that graph; preserve zero-warning full logs. - [ ] Validate partition/ELF/signature/source closure, then export only completed artifacts/evidence through an explicitly authorized path. The host may record, independently verify and boot them, but may not repair or assemble a missing build output. - [ ] Boot the newly guest-built clean dev and release images and run their canonical runtime probes; boot the guest-built extended-dev image for the second-generation build. Record exact booted image hashes. - [ ] In that newly built EriX, provision the same immutable sources/tools and fresh empty output/tmp trees, then perform a second complete build without importing first-generation compiled EriX artifacts or mutable caches. - [ ] Compare first/second-generation complete artifact inventories and deterministic bytes/signatures using the fixed inputs. Investigate every difference; normalization is allowed only for fields explicitly specified before the run, never to erase unexplained payload differences. - [ ] Run the complete maintained VM catalog and post-image probes on matching guest-built artifacts. The external supervisor may start test VMs; nested virtualization inside EriX is not required and must not conceal a host-side build step. - [ ] Demonstrate source read-only, output/tmp confinement, executable scope, no device/raw-block/key/network/global discovery and no cross-realm control; test denied access, interrupted build and complete realm teardown. - [ ] Profile the self-host builds, report actual elapsed/CPU/I/O/memory figures and apply the predeclared budgets; close proven bottlenecks through reviewed fixes and a new complete evidence cohort, not partial retries to green. - [ ] Publish a reproducible evidence bundle: source graph, manifests, tool licenses/recipes, commands, full logs, profile summaries, negative tests, output hashes/signatures, boot/test results and independent review. - [ ] Include [bootloader#1](https://git.erikinkinen.fi/erix/bootloader/issues/1) trust-chain verification in both generations: custom-key Secure Boot, signed boot image and all rootfs authority/code objects. Exercise tampering/revocation failures before declaring the guest-built result accepted. - [ ] Initiate/observe the build through [integration#5](https://git.erikinkinen.fi/erix/integration/issues/5)'s real serial/PS2 CLI input paths, run native boot/hash tools, and verify [ttyd#1](https://git.erikinkinen.fi/erix/ttyd/issues/1)'s independent TTY/default-clear behavior, vtty switching, mouse selection/paste, boot logo and help/man/extop acceptance on the newly produced images. For each implementation slice, retain actual formatting, strict Clippy, unit/doctest and warning-denied build results for all altered Rust repositories and valid configurations. Add relevant runtime VM coverage, monitor older unit/VM regressions in exact-head CI, and update canonical component documents and affected technical-manual/API material. Every authored code file must remain below 1,000 physical lines, with meaningful inline documentation and missing_docs enforcement in Rust crates. ## Alternatives and tradeoffs The running seed or first-generation OS and required libc/runtime are inventoried compiled execution substrates, not reusable target objects. Every EriX-authored product and native packaging helper is rebuilt in each generation. The imported compiler and its required Rust/LLVM/C/C++ runtime closure must first be built from source for EriX against its libc/sysroot, as tracked in [the EriX-hosted toolchain issue](https://git.erikinkinen.fi/erix/integration/issues/7). That initial toolchain may be cross-built on Linux. The extended development image must also rebuild that upstream Rust/LLVM toolchain inside EriX using the supplied offline recipes and dependencies, validate the resulting tools and runtime linkage, and use the guest-built compiler for at least one of the two complete EriX builds. No unrecorded porting changes, downloads, Linux executables or host-side build delegation may fill a missing guest step. ## Tracking and rollout Dependencies: [integration#6](https://git.erikinkinen.fi/erix/integration/issues/6), [integration#1](https://git.erikinkinen.fi/erix/integration/issues/1), [integration#2](https://git.erikinkinen.fi/erix/integration/issues/2), [docs#1](https://git.erikinkinen.fi/erix/docs/issues/1), [integration#3](https://git.erikinkinen.fi/erix/integration/issues/3), [lib-posixabi#1](https://git.erikinkinen.fi/erix/lib-posixabi/issues/1), [posixd#1](https://git.erikinkinen.fi/erix/posixd/issues/1), [posixd#2](https://git.erikinkinen.fi/erix/posixd/issues/2), [kernel#1](https://git.erikinkinen.fi/erix/kernel/issues/1), [posixd#3](https://git.erikinkinen.fi/erix/posixd/issues/3), [lib-cstd#1](https://git.erikinkinen.fi/erix/lib-cstd/issues/1), [dynlinkd#1](https://git.erikinkinen.fi/erix/dynlinkd/issues/1), [exsh#1](https://git.erikinkinen.fi/erix/exsh/issues/1), [integration#4](https://git.erikinkinen.fi/erix/integration/issues/4), [integration#7](https://git.erikinkinen.fi/erix/integration/issues/7), [integration#8](https://git.erikinkinen.fi/erix/integration/issues/8), [meta#2](https://git.erikinkinen.fi/erix/meta/issues/2), [integration#5](https://git.erikinkinen.fi/erix/integration/issues/5), [bootloader#1](https://git.erikinkinen.fi/erix/bootloader/issues/1), [ttyd#1](https://git.erikinkinen.fi/erix/ttyd/issues/1) Dependencies identify required contracts and closure gates; preparatory inventory/design can proceed in parallel under one owner per edited file. Link bounded implementation issues and their PRs here before claiming acceptance. Use `feature/posix-compat`, regular signed commits in the canonical contribution format, and WIP PRs linked to the exact coherent component graph. All cross-repository Cargo/catalog selections and CI helpers use full 40-character lowercase commit hashes, including transitive dependencies; do not substitute branch, tag or implicit HEAD selection. Close criteria only with their own reviewed deliverables and validation evidence. Pending, skipped, cancelled, failed or predecessor-only results remain distinct. Keep main images unchanged until explicit promotion direction; technical completion does not authorize merges, release tags or publication.
erikinkinen changed title from [FEATURE] [P16] Demonstrate two complete generations of EriX built inside EriX to [FEATURE] Demonstrate two complete generations of EriX built inside EriX 2026-09-12 08:02:07 +02:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
erix/integration#9
No description provided.