Skip to main content

max / alloy

Defer distribution: CI is build+lint only until image is worth publishing sr.ht CI no longer tries to sign or push; runs podman build + bootc container lint. No secrets required. When Alloy has an image worth distributing, re-add sign + push tasks and provision quay.io/alloy + sr.ht secrets.
Co-Authored-By
Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Author: Max Johnson <me@maxj.phd> · 2026-07-04 13:16 UTC
Signed with PGP, not checked
Commit: 0900bc1c258ce9f695d69f24041328283a39e98e
Parent: 7ebe7e5
3 files changed, +21 insertions, -50 deletions
M .builds/alloy-image.yml +6 -40
@@ -1,66 +1,32 @@
1 1 # Alloy image build — builds.sr.ht
2 2 #
3 - # Builds the Alloy bootable container image with podman, lints via
4 - # `bootc container lint`, signs with cosign, and publishes to
5 - # quay.io/alloy/alloy.
3 + # Build-and-lint smoke test. Validates the Containerfile on every push
4 + # without publishing anywhere. Sign + push tasks are added back when
5 + # Alloy is ready to distribute (see IMAGE.md open questions).
6 6 #
7 7 # Triggered by push to main + weekly cron for upstream base updates.
8 - # See docs/IMAGE.md for the full delivery strategy.
9 8
10 9 image: fedora/41
11 10
12 11 packages:
13 12 - podman
14 13 - buildah
15 - - skopeo
16 - - cosign
17 -
18 - secrets:
19 - # sr.ht secret IDs (populated at repo-config time):
20 - # - <uuid> quay.io robot token (username + password)
21 - # - <uuid> cosign private key (base64-encoded)
22 14
23 15 sources:
24 16 - https://git.sr.ht/~maxmj/alloy
25 17
26 18 environment:
27 - IMAGE: quay.io/alloy/alloy
28 - TAG_LATEST: latest
29 - TAG_VERSION: "41"
19 + IMAGE_TAG: alloy:ci
30 20
31 21 tasks:
32 22 - build: |
33 23 cd alloy
34 - TAG_DATE="41-$(date -u +%Y%m%d)"
35 - podman build \
36 - -t "$IMAGE:$TAG_LATEST" \
37 - -t "$IMAGE:$TAG_VERSION" \
38 - -t "$IMAGE:$TAG_DATE" \
39 - .
40 - echo "$TAG_DATE" > /tmp/tag_date
24 + podman build -t "$IMAGE_TAG" .
41 25
42 26 - lint: |
43 - # bootc container lint runs inside the Containerfile at build time,
44 - # but re-verify on the produced image explicitly.
45 - podman run --rm --entrypoint /usr/bin/bootc "$IMAGE:$TAG_LATEST" \
27 + podman run --rm --entrypoint /usr/bin/bootc "$IMAGE_TAG" \
46 28 container lint
47 29
48 - - sign: |
49 - cd alloy
50 - # cosign key restored from the sr.ht secret to ./cosign.key
51 - export COSIGN_PASSWORD=""
52 - TAG_DATE="$(cat /tmp/tag_date)"
53 - for tag in "$TAG_LATEST" "$TAG_VERSION" "$TAG_DATE"; do
54 - cosign sign --yes --key=./cosign.key "$IMAGE:$tag"
55 - done
56 -
57 - - push: |
58 - # quay.io robot creds from sr.ht secret land in ~/.docker/config.json
59 - TAG_DATE="$(cat /tmp/tag_date)"
60 - for tag in "$TAG_LATEST" "$TAG_VERSION" "$TAG_DATE"; do
61 - podman push "$IMAGE:$tag"
62 - done
63 -
64 30 triggers:
65 31 - action: email
66 32 condition: failure
M docs/IMAGE.md +7 -8
@@ -46,18 +46,17 @@
46 46
47 47 sr.ht ships Fedora build VMs with `dnf`, `podman`, `buildah`, `skopeo` preinstalled. Fits Alloy's build needs without additional plumbing. The build file lives at `.builds/alloy-image.yml` in the repo root.
48 48
49 - ### Registry: `quay.io`
49 + ### Registry: `quay.io` (deferred until distribution starts)
50 50
51 - Red Hat's container registry. Free for public images. Two reasons chosen over ghcr.io:
51 + Red Hat's container registry is the intended destination once Alloy has an image worth distributing. Free for public images, ecosystem-coherent with the `quay.io/fedora/fedora-bootc:41` base.
52 52
53 - 1. **Ecosystem coherence.** Alloy's base is `quay.io/fedora/fedora-bootc:41`; publishing to the same registry means `bootc switch quay.io/alloy/alloy:latest` reads consistent. No cross-registry indirection.
54 - 2. **Ideological consistency.** Source is on sr.ht partly to sit outside GitHub-adjacent infrastructure. Publishing containers to ghcr.io would reintroduce GitHub at exactly the layer where users install the OS. quay.io keeps that off the critical path.
53 + **Current state:** no registry provisioned. `.builds/alloy-image.yml` runs a **build + lint smoke test** only — validates the Containerfile on every push, without publishing anywhere. When the image is worth distributing, the CI file grows back `sign` and `push` tasks and `quay.io/alloy/alloy` gets provisioned with a robot account.
55 54
56 - Rejected: ghcr.io (source-registry ecosystem mismatch), Docker Hub (pull rate limits, no advantage), self-hosted (real infra commitment, not worth v0 operational load — revisit v2+).
55 + Rejected alternatives (for when distribution starts): ghcr.io (source-registry ecosystem mismatch), Docker Hub (pull rate limits, no advantage), self-hosted (real infra commitment, not worth v0 operational load — revisit v2+).
57 56
58 - ### Signing: cosign
57 + ### Signing: cosign (deferred alongside distribution)
59 58
60 - Runs as a CI task. Private key stored as an sr.ht secret; public key published in the Alloy repo. Users verify via `bootc switch --signature-source=<url>`.
59 + Once a registry is publishing images, cosign signs them as a CI task. Private key stored as an sr.ht secret; public key published in the Alloy repo. Users verify via `bootc switch --signature-source=<url>`. Nothing to set up until distribution starts.
61 60
62 61 ## Layer structure
63 62
@@ -92,5 +91,5 @@
92 91 - [ ] Verify which Alloy packages are in Fedora main vs. need COPRs. Candidates that may need COPRs: `anyrun`, `satty`, `wl-screenrec` (depending on Fedora version). Audit at v0 packaging time.
93 92 - [ ] `bootc-image-builder` for ISO generation. First-time-user path is `bootc install` from a live environment; the ISO is what makes that a smooth experience. Verify the ISO builder handles Alloy's specific package set.
94 93 - [ ] Single-stage vs. multi-stage Containerfile. Single-stage until rebuild time hurts.
95 - - [ ] sr.ht account: `~maxmj` vs. `~makecreative`. LLC-owned makes sense long-term; personal is simpler v0. Recommend `~maxmj` for v0, migrate later if it grows.
94 + - [x] sr.ht account: **`~maxmj`** for v0. LLC-owned `~makecreative` remains the long-term target; migration if/when the project grows.
96 95 - [ ] Whether to publish `:latest`, `:41`, and `:41-YYYYMMDD` tags. Recommend all three — `:latest` for casual users, `:41` for version-pinned users, `:41-YYYYMMDD` for reproducibility.
M docs/todo.md +8 -2
@@ -10,10 +10,16 @@
10 10 - [ ] Validate the dark-mode L stops against measured WCAG contrast on a calibrated display (deferred from TOKENS.md).
11 11 - [ ] Audit Departure's unicode coverage; document the fallback chain (Iosevka) for out-of-range code points.
12 12 - [ ] Branding assets: wordmark/logotype, repo social card, favicon. Deferred until first user-facing surface ships.
13 - - [ ] Push Alloy to `git.sr.ht/~maxmj/alloy` (or `~makecreative/alloy` — pick per open question in IMAGE.md).
13 + - [x] Push Alloy to `git.sr.ht/~maxmj/alloy`. Repo auto-created on first push; `srht` remote tracking `main`.
14 + - [ ] First green build of `Containerfile` (build + lint only, no distribution yet). Audit which packages need COPRs vs. Fedora main.
15 +
16 + ## When distribution starts
17 +
18 + Deferred until Alloy has something worth pulling. Re-add `sign` and `push` tasks to `.builds/alloy-image.yml` and populate the sr.ht secrets when doing this.
19 +
14 20 - [ ] Provision `quay.io/alloy` org and robot credentials for CI.
15 21 - [ ] Populate sr.ht secrets: quay.io robot token, cosign private key.
16 - - [ ] First green build of `Containerfile` end-to-end. Audit which packages need COPRs vs. Fedora main.
22 + - [ ] Generate cosign keypair; commit `cosign.pub`, keep `cosign.key` in the sr.ht secret.
17 23 - [x] Repackage all `configs/*/` into `etc/skel/.config/*`, `etc/*`, and `usr/share/alloy/*` layout the Containerfile expects.
18 24 - [x] Write systemd presets files (`etc/systemd/system-preset/50-alloy.preset` and `etc/systemd/user-preset/50-alloy.preset`) with the defaults per IMAGE.md and CONTINUITY.md.
19 25 - [x] Draft `etc/os-release` skeleton (name, ID, URLs pointing at sr.ht, vendor = Make Creative). Full branding (wordmark, logo, plymouth) still deferred.