151 lines
4.2 KiB
Markdown
151 lines
4.2 KiB
Markdown
Perfect — here’s a full sketch of a **pre-image capture workflow** for building your ASL-AUTH-HOST ISO with full provenance from zero. This is conceptual but grounded in your existing scripts and tools.
|
||
|
||
---
|
||
|
||
## **1. Directory Layout**
|
||
|
||
```
|
||
/work/
|
||
├─ iso_root/ # ISO staging area (debootstrap root)
|
||
├─ overlay/ # Overlay for binaries, scripts, configs
|
||
├─ asl-preimage-store/ # Temporary ASL store for pre-image artifacts
|
||
│ ├─ binaries/
|
||
│ ├─ scripts/
|
||
│ └─ per/
|
||
├─ build_logs/ # Capture logs from each step
|
||
└─ asl-workflow.sh # Orchestration script
|
||
```
|
||
|
||
---
|
||
|
||
## **2. Pre-image capture steps**
|
||
|
||
1. **Initialize pre-image ASL store**
|
||
|
||
```bash
|
||
#!/bin/bash
|
||
# pre-image store initialization
|
||
PRESTORE=/work/asl-preimage-store
|
||
mkdir -p $PRESTORE/{binaries,scripts,per}
|
||
asl-init-store --store $PRESTORE
|
||
```
|
||
|
||
> `asl-init-store` can be a thin wrapper around `libasl-capture` to create a temporary store.
|
||
|
||
---
|
||
|
||
2. **Wrap build commands in `asl-capture`**
|
||
|
||
All commands affecting the ISO will be executed via `asl-capture` to generate artifacts and PERs.
|
||
|
||
Example:
|
||
|
||
```bash
|
||
# Capture debootstrap
|
||
asl-capture --store $PRESTORE --cmd "debootstrap --arch=amd64 bullseye $ISO_ROOT http://deb.debian.org/debian/" \
|
||
--outdir $PRESTORE/per/debootstrap
|
||
|
||
# Capture package installation
|
||
asl-capture --store $PRESTORE --cmd "chroot $ISO_ROOT /bin/bash -c 'apt-get update && apt-get install -y ...'" \
|
||
--outdir $PRESTORE/per/apt_install
|
||
```
|
||
|
||
Each step generates:
|
||
|
||
* **Artifact of input** (command, scripts, downloaded packages)
|
||
* **Artifact of output** (installed files, overlays, logs)
|
||
* **Execution Receipt (PER)** linking inputs → outputs
|
||
|
||
---
|
||
|
||
3. **Capture overlay**
|
||
|
||
```bash
|
||
# Capture binaries and scripts
|
||
for f in $WORKDIR/binaries/* $WORKDIR/scripts/*; do
|
||
asl-capture --store $PRESTORE --file $f --outdir $PRESTORE/per/overlay
|
||
done
|
||
```
|
||
|
||
This ensures all binaries/scripts are **artifacts** with traceable lineage.
|
||
|
||
---
|
||
|
||
4. **Assemble ISO using captured artifacts**
|
||
|
||
```bash
|
||
asl-capture --store $PRESTORE --cmd "./build_asl_auth_host_iso.sh" \
|
||
--artifact-inputs $PRESTORE/binaries \
|
||
--artifact-inputs $PRESTORE/scripts \
|
||
--artifact-inputs $PRESTORE/per \
|
||
--outdir $PRESTORE/per/build_iso
|
||
```
|
||
|
||
> The ISO itself becomes a **final artifact** with its **own PER**, referencing all previous steps.
|
||
|
||
---
|
||
|
||
5. **Seed initial ASL host store in ISO**
|
||
|
||
Copy pre-image artifacts + PERs into ISO root:
|
||
|
||
```bash
|
||
cp -a $PRESTORE/binaries $ISO_ROOT/var/lib/asl/personal/binaries
|
||
cp -a $PRESTORE/per $ISO_ROOT/var/lib/asl/personal/per
|
||
cp -a $PRESTORE/scripts $ISO_ROOT/var/lib/asl/personal/scripts
|
||
```
|
||
|
||
> The offline host boots with an **already captured history** of how it was built.
|
||
|
||
---
|
||
|
||
## **3. Optional: Artifact DAG visualization**
|
||
|
||
After pre-image capture, you can generate a DAG of artifacts and receipts:
|
||
|
||
```bash
|
||
asl-dag --store $PRESTORE --out $WORKDIR/build_logs/preimage_dag.svg
|
||
```
|
||
|
||
This provides:
|
||
|
||
* Traceable provenance of **everything in the ISO**
|
||
* Easy inspection for audit
|
||
|
||
---
|
||
|
||
## **4. Workflow Summary**
|
||
|
||
```
|
||
Initialize Pre-image Store --> Capture debootstrap --> Capture apt install --> Capture overlay
|
||
| | |
|
||
+---------------------+-------------------------+
|
||
PERs + Artifacts
|
||
|
|
||
Build ISO using captured inputs
|
||
|
|
||
Seed ISO with captured store
|
||
|
|
||
Offline host boots with full pre-image provenance
|
||
```
|
||
|
||
---
|
||
|
||
### **Key Notes**
|
||
|
||
* `asl-capture` wraps **any shell command** or file copy, producing both **artifact** and **PER**.
|
||
* Pre-image store is **temporary** during build, but all artifacts go into ISO for the offline host.
|
||
* This method ensures **determinism, reproducibility, and full traceability** even before the host exists.
|
||
|
||
---
|
||
|
||
I can also draft a **concrete bash orchestration script (`asl-workflow.sh`)** that wires all of this together, including:
|
||
|
||
* Pre-image store initialization
|
||
* Step-by-step captured commands
|
||
* ISO assembly
|
||
* Seeding the offline host store
|
||
|
||
Do you want me to do that next?
|
||
|