Skip to content

README.md

Latest commit

 

History

History
48 lines (32 loc) · 2.08 KB

README.md

File metadata and controls

48 lines (32 loc) · 2.08 KB
Raw

fedbuild

ci license: MIT

Reproducible Fedora 43 VM image builder. One pipeline; multiple variants for distinct shipping artifacts.

Each variant produces a small firstboot RPM (systemd oneshot for first-boot bootstrap) and a bootable Fedora 43 image (.raw.zst) built via image-builder.

Supply chain: reproducible same-tree RPMs (SOURCE_DATE_EPOCH), SHA256SUMS cosign-signed (keyless Sigstore), per-variant size budget enforced, optional extra-rpms/ pickup with EXPECTED_SHA256 verification, syft SBOM, SLSA v1 provenance.

Quick Start

make && make image && make smoke

Prerequisites, SSH key setup, VM lifecycle, and variant-specific flows: HUMANS.md.

Highlights

  • Multi-variant pipeline — devbox, bastion-edge, and bastion-core from one Makefile-driven tree
  • Reproducible RPMs — SOURCE_DATE_EPOCH locks same-tree byte identity across rebuilds
  • Signed artifacts — keyless Sigstore cosign on SHA256SUMS
  • Supply-chain visibility — syft SBOM and SLSA v1 provenance per image
  • Size budgets — per-variant baselines enforced in CI smoke tests
  • Optional upstream RPM pickup — extra-rpms/ with EXPECTED_SHA256 verification

Documentation

Doc Audience
HUMANS.md Quick start, release flow, what first-boot installs
AGENTS.md LLM reference: commands, architecture, blueprint format, gotchas, reproducibility scope
CONTRIBUTING.md PR checklist, file-change map, commit style
CHANGELOG.md Auto-generated from Conventional Commits (make changelog)
SECURITY.md Vulnerability reporting
specs/ Active and completed work specs

License

MIT — Copyright (c) 2026 Rethunk.Tech, LLC