nordisk/holger

xtask/src/installer_iso.rs

//! **`installer-iso`** — holger's installer media, through the Build Thing.
//!
//! ```text
//! cargo xtask installer-iso \
//!     [--variant holger-installer | holger-installer-metered] \
//!     [--build kernel] \
//!     --param holger_ron=@site.ron \
//!     [--param pairing_seed=@seed.toml] [--param hub_conf=@fixture] …
//! ```
//!
//! A thin caller of `dwarves buildthing <this checkout> --variant <medium>`
//! ([`crate::forge_door`]). Until 2026-09-27 this verb composed the medium
//! in-process with an operator `--kernel`; every holger medium now DECLARES
//! `tunnr/tunnr-kernel-sandbox` (owner: "tunnr and 3 images just like gunnar"), and the
//! owner's rule is that every artifact goes through the Build Thing. So the forge
//! builds the payload in the pinned container, reads the donor kernel off its pin
//! (`--build kernel` builds it as a step), and runs dwarves' media steps — the
//! root key (a METERED medium without a real seed is refused), the plugins the
//! payload consumes (holger's own signed monetize plugin for
//! `holger-installer-metered`, held to this commit) and the medium record.
//!
//! Signing is the forge's contract, read from the environment it inherits:
//! `KORP_ROOT_SIGNING_KEY` (root of trust), `KORP_SECURE_BOOT_KEY` +
//! `KORP_SECURE_BOOT_CERT` (Authenticode). `--unenrolled <why>` composes an OPEN
//! medium with no anchor on purpose.
//!
//! Compose from a real clone, not a worktree: the payload's build reference is
//! read inside the container, which cannot see a worktree's git dir (the forge
//! refuses a plugin-carrying medium from a worktree by name).

use std::path::Path;

use anyhow::Result;
use nornir_build_thing::variant::ArtifactKind;

use crate::forge_door;

/// The variant built when the operator names none.
pub const DEFAULT_VARIANT: &str = "holger-installer";

/// Run the verb.
pub fn run() -> Result<()> {
    run_with(std::env::args().skip(2), &crate::workspace_root())
}

fn run_with(args: impl IntoIterator<Item = String>, repo_root: &Path) -> Result<()> {
    let ask = forge_door::parse("installer-iso", args)?;
    let variant = ask
        .variant
        .clone()
        .unwrap_or_else(|| DEFAULT_VARIANT.to_string());
    let suite = forge_door::declared_medium(
        &variant,
        ArtifactKind::Installer,
        "cargo xtask appliance-iso",
    )?;
    forge_door::run("installer-iso", repo_root, &suite, &variant, &ask).map(|_| ())
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn both_installer_media_resolve_and_boot_tunnrs_kernel() {
        let set = holger_recipe::declared();
        for v in [DEFAULT_VARIANT, "holger-installer-metered"] {
            forge_door::declared_medium(v, ArtifactKind::Installer, "x").unwrap();
            let row = set.installers.iter().find(|i| i.name == v).unwrap();
            let d = row.kernel_donor.as_ref().expect("a declared donor");
            assert_eq!(
                (d.repo.as_str(), d.kernel.as_str()),
                ("tunnr", "tunnr-kernel-sandbox"),
                "{v}"
            );
        }
    }

    #[test]
    fn a_non_installer_variant_is_refused_by_kind() {
        let e = forge_door::declared_medium("mvp-server-musl", ArtifactKind::Installer, "x")
            .unwrap_err()
            .to_string();
        assert!(
            e.contains("not 'installer'") && e.contains("holger-installer"),
            "{e}"
        );
        let e = forge_door::declared_medium("no-such", ArtifactKind::Installer, "x")
            .unwrap_err()
            .to_string();
        assert!(e.contains("no-such"), "{e}");
    }
}