nordisk/edda

crates/nornir-build-thing/examples/mint_cargo_toolchain.rs

//! **Mint the declared cargo toolchain image into THIS box's container store**
//! — the door a compose needs when a declaration pins a digest the box has
//! never minted.
//!
//! MEASURED 2026-09-05 (gunnar): the cargo road does not mint its image, it
//! PULLS the pinned digest — `pull image nordisk-cargo-toolchain@sha256:72ab…`
//! — and there is no registry behind that name, so the first compose after a
//! re-pin refuses on a box where the reproducible recipe has not run yet. The
//! kernel road mints in its step 1; the cargo road had no equivalent door
//! outside the live gate test (`tests/toolchain_images_live.rs`), which mints
//! into fresh throw-away stores on purpose. This example mints into the
//! DEFAULT store, through the same [`DraupnirCargoRunner::build_toolchain_image`]
//! the runner uses — `build_image_reproducible` with the Containerfile's own
//! `SOURCE_DATE_EPOCH` — so the digest it lands is the digest the declaration
//! pins, on every box, or the recipe is not reproducible and this is where you
//! find out.
//!
//! ```text
//! cargo run -p nornir-build-thing --features cargo-container --example mint_cargo_toolchain
//! cargo run … --example mint_cargo_toolchain -- nordisk-cargo-toolchain:live   # an explicit tag
//! ```
//!
//! With no argument it mints under the recipe's own tag,
//! `nordisk-cargo-toolchain:recipe-<16 hex of the Containerfile's sha256>`, which
//! no other recipe can ever write. It used to default to `:live`, and a mint of a
//! newer recipe moved `:live` off the image gunnar and holger pin, un-naming it
//! (2026-10-05: Build Thing's pulls of the pin failed 403). An explicit tag is
//! still honoured, but never moved off another image: that is refused by name
//! (`cargo_container::mint_toolchain_into`).
//!
//! Prints what the runner returns (the image reference it built) and exits 0;
//! the podman store then carries the tag at the reproducible digest, which is
//! what `podman images --digests` and the next compose read.

#[cfg(feature = "cargo-container")]
fn main() -> anyhow::Result<()> {
    use nornir_build_thing::cargo_container::{
        cargo_toolchain_recipe_tag, DraupnirCargoRunner, CARGO_TOOLCHAIN_IMAGE,
    };
    let tag = std::env::args()
        .nth(1)
        .unwrap_or_else(|| cargo_toolchain_recipe_tag(CARGO_TOOLCHAIN_IMAGE));
    // The build context holds one file, the embedded Containerfile; it lives
    // under the user's scratch, not /tmp (RAM on this constellation's boxes).
    let home = std::env::var("HOME").unwrap_or_else(|_| ".".into());
    let ctx = std::path::PathBuf::from(home).join("scratch").join("nordisk-mint-cargo-toolchain");
    let built = DraupnirCargoRunner::new().build_toolchain_image(&ctx, &tag)?;
    println!("{built}");
    Ok(())
}

#[cfg(not(feature = "cargo-container"))]
fn main() {
    eprintln!("mint_cargo_toolchain needs `--features cargo-container` (the draupnir container engine)");
    std::process::exit(2);
}