Build Alpha.5 local rig profiles and flight sheets

Cargo.toml

@@ -10,6 +10,7 @@ members = [
   "crates/rigos-contract",
   "crates/rigos-pool",
   "crates/rigos-state",
+  "crates/rigos-config",
 ]
 resolver = "2"
 

README.md

@@ -2,7 +2,7 @@
 
 Local-first CPU appliance delivered as a bootable USB image.
 
-Current preview is `RIGOS 0.0.4-alpha.4`.
+Current development preview is `RIGOS 0.0.4-alpha.5`.
 
 The persistent appliance uses a raw MBR disk image for Legacy BIOS and removable-media UEFI boot.
 
@@ -22,9 +22,10 @@ The recovery ISO is stateless and does not grow the state partition.
 0.0.4-alpha.2  MBR image reached GRUB ROOT_A systemd and password setup
 0.0.4-alpha.3  fixed console order but kept the first boot screen hidden
 0.0.4-alpha.4  keeps the first boot screen on tty and captures answers separately
+0.0.4-alpha.5  adds local rig profiles and portable XMRig Flight Sheets
 ```
 
-Alpha four still requires a new image build, checksum, QEMU boot matrix and physical first-boot completion.
+Alpha five is isolated on its development branch. Alpha four physical state validation remains separate.
 
 ## Verification
 

build/usb/Dockerfile

@@ -1,4 +1,4 @@
-FROM rust:1.85.1-bookworm
+FROM docker.io/library/rust:1.85.1-bookworm
 
 RUN apt-get update \
  && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \

build/usb/bootloaders/grub-pc/live-theme/theme.txt

@@ -1,6 +1,6 @@
 title-color: "#ffffff"
 title-font: "Unifont Regular 16"
-title-text: "RIGOS Recovery 0.0.4-alpha.4 - Stateless Diagnostics"
+title-text: "RIGOS Recovery 0.0.4-alpha.5 - Stateless Diagnostics"
 message-font: "Unifont Regular 16"
 terminal-font: "Unifont Regular 16"
 

build/usb/bootloaders/syslinux_common/live.cfg.in

@@ -1,12 +1,12 @@
 label rigos-@FLAVOUR@
-	menu label ^RIGOS Recovery 0.0.4-alpha.4
+	menu label ^RIGOS Recovery 0.0.4-alpha.5
 	menu default
 	linux @LINUX@
 	initrd @INITRD@
 	append @APPEND_LIVE@
 
 label rigos-@FLAVOUR@-failsafe
-	menu label RIGOS Recovery 0.0.4-alpha.4 -- ^safe mode
+	menu label RIGOS Recovery 0.0.4-alpha.5 -- ^safe mode
 	linux @LINUX@
 	initrd @INITRD@
 	append @APPEND_LIVE_FAILSAFE@

build/usb/hooks/010-rigos.chroot

@@ -7,8 +7,8 @@ passwd --lock rigosadmin
 install -d -o rigos -g rigos -m 0750 /var/lib/rigos /run/rigos
 install -d -m 0755 /usr/lib/rigos
 
-chmod 0755 /usr/local/sbin/rigos-firstboot /usr/lib/rigos/rigos-state-init /usr/lib/rigos/xmrig
-systemctl enable NetworkManager.service rigos-state.service rigos-firstboot.service tmp.mount
+chmod 0755 /usr/local/sbin/rigos-firstboot /usr/lib/rigos/rigos-state-init /usr/lib/rigos/rigos-config /usr/lib/rigos/xmrig
+systemctl enable NetworkManager.service rigos-state.service rigos-profile-apply.service rigos-firstboot.service rigos-miner.service tmp.mount
 systemctl disable apt-daily.timer apt-daily-upgrade.timer logrotate.timer fstrim.timer 2>/dev/null || true
 systemctl disable systemd-journald-audit.socket 2>/dev/null || true
 

build/usb/includes.chroot/etc/systemd/system/rigos-firstboot.service

@@ -1,9 +1,8 @@
 [Unit]
 Description=RIGOS first-boot configuration
-After=network-online.target rigos-state.service
+After=network-online.target rigos-state.service rigos-profile-apply.service
 Wants=network-online.target
 Requires=rigos-state.service
-Conflicts=getty@tty1.service
 Before=getty@tty1.service
 ConditionPathExists=!/var/lib/rigos/policy.json
 
@@ -17,7 +16,6 @@ TTYPath=/dev/tty1
 TTYReset=yes
 TTYVHangup=yes
 TTYVTDisallocate=yes
-RemainAfterExit=yes
 
 [Install]
 WantedBy=multi-user.target

build/usb/includes.chroot/etc/systemd/system/rigos-miner.service

@@ -1,6 +1,6 @@
 [Unit]
 Description=RIGOS managed XMRig
-After=network-online.target rigos-state.service
+After=network-online.target rigos-state.service rigos-profile-apply.service
 Wants=network-online.target
 Requires=rigos-state.service
 ConditionPathExists=/var/lib/rigos/xmrig.json
@@ -9,6 +9,7 @@ ConditionPathExists=/var/lib/rigos/xmrig.json
 Type=simple
 User=rigos
 Group=rigos
+ExecCondition=/usr/lib/rigos/rigos-config gate
 ExecStart=/usr/lib/rigos/xmrig --config=/var/lib/rigos/xmrig.json
 Restart=on-failure
 RestartSec=5s

build/usb/includes.chroot/etc/systemd/system/rigos-profile-apply.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Apply RIGOS persistent machine profile
+After=rigos-state.service
+Requires=rigos-state.service
+Before=rigos-firstboot.service rigos-miner.service
+
+[Service]
+Type=oneshot
+ExecStartPre=/usr/lib/rigos/rigos-config recover
+ExecStart=/usr/lib/rigos/rigos-config timezone
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

build/usb/includes.chroot/etc/systemd/system/rigos-state.service

@@ -6,6 +6,8 @@ Before=local-fs.target rigos-firstboot.service rigos-miner.service
 
 [Service]
 Type=oneshot
+RuntimeDirectory=rigos
+RuntimeDirectoryMode=0755
 ExecStart=/usr/lib/rigos/rigos-state-init
 RemainAfterExit=yes
 

build/usb/includes.chroot/usr/lib/rigos/lsblk-compat

@@ -0,0 +1,122 @@
+#!/usr/bin/python3
+
+import json
+import os
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+MAJOR_MINOR_RE = re.compile(r"^[0-9]+:[0-9]+$")
+
+
+def runtime_paths() -> tuple[str, Path]:
+    test_mode = os.environ.get("RIGOS_LSBLK_COMPAT_TEST") == "1"
+    if test_mode:
+        real_lsblk = os.environ.get("RIGOS_REAL_LSBLK", "/usr/bin/lsblk")
+        sysfs_root = Path(os.environ.get("RIGOS_SYSFS_BLOCK_ROOT", "/sys/dev/block"))
+        return real_lsblk, sysfs_root
+    return "/usr/bin/lsblk", Path("/sys/dev/block")
+
+
+def remove_partn_column(arguments: list[str]) -> tuple[list[str], bool]:
+    updated = list(arguments)
+    requested = False
+    index = 0
+    while index < len(updated):
+        argument = updated[index]
+        if argument in {"--output", "-o"}:
+            if index + 1 >= len(updated):
+                raise ValueError(f"{argument} requires a value")
+            columns = updated[index + 1].split(",")
+            if "PARTN" in columns:
+                requested = True
+                columns = [column for column in columns if column != "PARTN"]
+                updated[index + 1] = ",".join(columns)
+            index += 2
+            continue
+        if argument.startswith("--output="):
+            columns = argument.split("=", 1)[1].split(",")
+            if "PARTN" in columns:
+                requested = True
+                columns = [column for column in columns if column != "PARTN"]
+                updated[index] = "--output=" + ",".join(columns)
+        index += 1
+    return updated, requested
+
+
+def partition_number(device: dict, sysfs_root: Path) -> int:
+    major_minor = device.get("maj:min")
+    path = device.get("path", "unknown device")
+    if not isinstance(major_minor, str) or not MAJOR_MINOR_RE.fullmatch(major_minor):
+        raise ValueError(f"invalid block identity for {path}")
+    source = sysfs_root / major_minor / "partition"
+    try:
+        raw = source.read_text(encoding="ascii").strip()
+    except OSError as error:
+        raise ValueError(f"partition number unavailable for {path} at {source}: {error}") from error
+    try:
+        number = int(raw, 10)
+    except ValueError as error:
+        raise ValueError(f"invalid partition number for {path} at {source}") from error
+    if number <= 0 or number > 0xFFFFFFFF:
+        raise ValueError(f"partition number out of range for {path} at {source}")
+    return number
+
+
+def add_partition_numbers(devices: list[dict], sysfs_root: Path) -> None:
+    for device in devices:
+        if device.get("type") == "part":
+            device["partn"] = partition_number(device, sysfs_root)
+        else:
+            device["partn"] = None
+        children = device.get("children")
+        if children is not None:
+            if not isinstance(children, list):
+                raise ValueError("lsblk children field is not a list")
+            add_partition_numbers(children, sysfs_root)
+
+
+def main() -> int:
+    real_lsblk, sysfs_root = runtime_paths()
+    try:
+        arguments, requested_partn = remove_partn_column(sys.argv[1:])
+    except ValueError as error:
+        print(f"lsblk-compat: {error}", file=sys.stderr)
+        return 2
+
+    if not requested_partn:
+        os.execv(real_lsblk, [real_lsblk, *arguments])
+
+    if "--json" not in arguments and "-J" not in arguments:
+        print("lsblk-compat: PARTN compatibility requires JSON output", file=sys.stderr)
+        return 2
+
+    result = subprocess.run(
+        [real_lsblk, *arguments],
+        check=False,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+    )
+    if result.stderr:
+        sys.stderr.buffer.write(result.stderr)
+    if result.returncode != 0:
+        return result.returncode
+
+    try:
+        document = json.loads(result.stdout)
+        devices = document.get("blockdevices")
+        if not isinstance(devices, list):
+            raise ValueError("lsblk JSON has no blockdevices list")
+        add_partition_numbers(devices, sysfs_root)
+    except (json.JSONDecodeError, UnicodeDecodeError, ValueError) as error:
+        print(f"lsblk-compat: {error}", file=sys.stderr)
+        return 2
+
+    json.dump(document, sys.stdout, separators=(",", ":"))
+    sys.stdout.write("\n")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())