jschoubben
7e3481f025
The first real run of mesh-bootstrap stopped in preflight, dialling 192.0.2.250:5000 for ninety seconds on a machine whose network was fine. That address is the registry the lab used to raise; the substrate template still names the control plane by it, and step 3 replaces that reference with the id of the image this installer carries. Nothing ever pulls it. So preflight excludes the control plane's resource by identity, rather than by the happy accident of the template filling its slot with something that needs no registry. Every other container's registry is still dialled, because those are somebody else's images at somebody else's registry and a machine that cannot reach one fails inside a pull, which says the wrong thing. Also: `make bootstrap` takes BOOTSTRAP_OUT. The lab now builds the installer from source before every raise, into a path it chooses, and a caller that could not say where the output goes would have to copy it afterwards. Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF
101 lines
5.3 KiB
Makefile
101 lines
5.3 KiB
Makefile
SYSTEM ?= arch
|
|
# The gate. Green is the definition of done (novox/hq how-we-build §5).
|
|
VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo development)
|
|
LDFLAGS := -s -w -X main.builtFor=$(SYSTEM) -X main.version=$(VERSION)
|
|
|
|
# The bundle a host carries is built INTO it (novox/hq ADR 0038, ADR 0041): a host that needed
|
|
# a second file to arrive with it is not "copy it and run it".
|
|
BUNDLE ?=
|
|
|
|
.PHONY: check test vet fmt build clean host hosts bootstrap packaging-test
|
|
|
|
check: fmt vet test packaging-test build
|
|
|
|
# One binary per operating system (novox/hq ADR 0060). The system is pinned at link time; a
|
|
# host built without one refuses to touch a machine rather than guessing.
|
|
hosts:
|
|
@for s in arch alpine android; do \
|
|
CGO_ENABLED=0 go build -ldflags="-s -w -X main.builtFor=$$s -X main.version=$(VERSION)" \
|
|
-o mesh-host-$$s ./cmd/mesh-host || exit 1; \
|
|
echo "built mesh-host-$$s"; \
|
|
done
|
|
|
|
packaging-test:
|
|
@./packaging/rollback_test.sh
|
|
@./packaging/launch_test.sh
|
|
@./packaging/roused_test.sh
|
|
|
|
fmt:
|
|
@test -z "$$(gofmt -l . )" || { echo "unformatted:"; gofmt -l . ; exit 1; }
|
|
|
|
vet:
|
|
go vet ./...
|
|
|
|
# Structure and logic, and the same checks against this machine. The boundary is never mocked.
|
|
test:
|
|
go test ./... -count=1
|
|
|
|
# A default build carries no bundle and refuses to reconcile, which is the honest state for a
|
|
# host nobody has told what a substrate is.
|
|
build:
|
|
CGO_ENABLED=0 go build -ldflags="$(LDFLAGS)" -o mesh-host ./cmd/mesh-host
|
|
|
|
# A host for a real machine, carrying a real bundle:
|
|
# make host SYSTEM=arch BUNDLE=path/to/substrate.lock
|
|
#
|
|
# The bundle replaces the one for SYSTEM, because its contents are per operating system —
|
|
# package names and unit names differ (novox/hq ADR 0005).
|
|
host:
|
|
@test -n "$(BUNDLE)" || { echo "BUNDLE= is required; a host with no bundle cannot raise a first node"; exit 1; }
|
|
@test -f "$(BUNDLE)" || { echo "no such bundle: $(BUNDLE)"; exit 1; }
|
|
@test -f internal/bundle/substrate-$(SYSTEM).lock || { echo "no bundle slot for SYSTEM=$(SYSTEM)"; exit 1; }
|
|
@cp internal/bundle/substrate-$(SYSTEM).lock internal/bundle/substrate-$(SYSTEM).lock.default
|
|
@cp "$(BUNDLE)" internal/bundle/substrate-$(SYSTEM).lock
|
|
@CGO_ENABLED=0 go build -ldflags="$(LDFLAGS)" -o mesh-host ./cmd/mesh-host; \
|
|
status=$$?; \
|
|
mv internal/bundle/substrate-$(SYSTEM).lock.default internal/bundle/substrate-$(SYSTEM).lock; \
|
|
exit $$status
|
|
@echo "built for $(SYSTEM) carrying $(BUNDLE)"
|
|
|
|
# The installer, carrying the control plane's image:
|
|
# make bootstrap IMAGE=mesh-control:v1.2.3
|
|
#
|
|
# The image is BUILT ELSEWHERE and handed over — mesh-control's own `make image` — and embedded
|
|
# here at release time. Not built on the machine being bootstrapped, and not fetched: the forge
|
|
# that holds mesh-control's source runs on the mesh, so a bootstrap that had to fetch or build the
|
|
# control plane would need a mesh in order to raise one. Carrying it breaks that cycle, the same
|
|
# way carrying the bundle breaks the "copy it onto a machine and run it" one (novox/hq ADR 0005).
|
|
#
|
|
# The saved image occupies the embed slot for the length of one build and the placeholder goes
|
|
# back, exactly as `host:` does with the bundle. Nothing large is ever committed.
|
|
#
|
|
# IMAGE must be a NAME:TAG and not an id. The installer identifies the carried image by its tag,
|
|
# because an image id is the digest of the image's configuration and a runtime REWRITES that
|
|
# configuration as it loads — so the id in the archive is not the id the receiving machine will
|
|
# hold, and the tag is the only name that survives the transfer. Saving by id produces an archive
|
|
# with no tags at all, which the installer refuses; caught here instead, in front of the person who
|
|
# can fix it.
|
|
#
|
|
# BOOTSTRAP_OUT is where the binary is written, and it exists because something other than a person
|
|
# now builds this: the lab rebuilds every artifact it runs from source before a raise, into paths it
|
|
# chose (mesh-lab's src/rebuild.ts, and novox/hq 04-ISSUES/005 for why it does that at all). A
|
|
# caller that could not say where the output goes would have to copy it afterwards, which is one
|
|
# more step to forget.
|
|
BOOTSTRAP_OUT ?= mesh-bootstrap
|
|
|
|
bootstrap:
|
|
@test -n "$(IMAGE)" || { echo "IMAGE= is required; an installer carrying no control-plane image cannot raise a mesh"; exit 1; }
|
|
@case "$(IMAGE)" in sha256:*) echo "IMAGE=$(IMAGE) is an image id. The installer identifies the carried image by its tag, because an id is the digest of a configuration that a runtime rewrites as it loads. Pass a name:tag"; exit 1;; esac
|
|
@docker image inspect "$(IMAGE)" >/dev/null 2>&1 || { echo "this machine does not hold $(IMAGE) — build it in mesh-control with 'make image'"; exit 1; }
|
|
@test -n "$$(docker image inspect --format '{{len .RepoTags}}' "$(IMAGE)" | grep -v '^0$$')" || { echo "$(IMAGE) has no repository tag, so the saved archive would carry no name the installer can ask a runtime about. Tag it first: docker tag $(IMAGE) mesh-control:<version>"; exit 1; }
|
|
@cp internal/image/control-plane.tar internal/image/control-plane.tar.placeholder
|
|
@docker save --output internal/image/control-plane.tar "$(IMAGE)"
|
|
@CGO_ENABLED=0 go build -ldflags="-s -w -X main.version=$(VERSION)" -o "$(BOOTSTRAP_OUT)" ./cmd/mesh-bootstrap; \
|
|
status=$$?; \
|
|
mv internal/image/control-plane.tar.placeholder internal/image/control-plane.tar; \
|
|
exit $$status
|
|
@echo "built $(BOOTSTRAP_OUT) carrying $(IMAGE)"
|
|
|
|
clean:
|
|
rm -f mesh-host mesh-bootstrap
|