# Seeded font bases

The image cuts its two house faces from pinned upstream bases (`quasi-type`,
wiki `typography-standard`). The pins name files on raw.githubusercontent.com,
which rate-limits by IP, and a 429 there fails the whole build an hour in,
behind every expensive layer. Alloy's only install path is building the image
yourself, so a fetch that cannot run is an install that cannot run.

Anything dropped in this directory is copied into the `quasi-type` checkout's
own `bases/cache/` before the cut runs, which is the directory the tool reads
before it fetches anything. This `README.md` is skipped, and is what keeps the
directory in git.

## What the seed covers

The two cuts the image runs, and nothing else. A build makes three requests to
that host: these two, and a third from shop's own build script, which cuts the
terminal's bundled face while `cargo install shop` runs. This directory
does not cover that third one: shop's build script passes its own `OUT_DIR` as
the cache directory, so there is no path for the image build to point at a
carried copy. Covering it with a seed needs a change in shop (read the cache
directory and the offline flag from the environment).

What covers all three without that change is the mirror. `QUASI_TYPE_MIRROR`,
set in the Containerfile to `https://makenot.work/static/bases`, is read inside
`quasi-type` itself, so it reaches the fetch this directory cannot. It is a
second source and not a carried copy: files are addressed by the sha256 the pin
already carries and verified against it, upstream stays the fallback, and
`sealed` still means the two cuts. A warm cargo target directory is what covers
the terminal's fetch on a host that has built once.

The rest of the build is not offline either, in any mode: it clones two
repositories, resolves crates.io, and installs packages.

## The four files

Named exactly as `quasi-type` caches them:

    atkinson-mono-2.001-AtkinsonHyperlegibleMono%5Bwght%5D.ttf
    atkinson-mono-2.001-LICENSE.txt
    atkinson-next-2.001-AtkinsonHyperlegibleNext%5Bwght%5D.ttf
    atkinson-next-2.001-LICENSE.txt

Copy them from a warm checkout, `~/Code/Libraries/quasi-type/bases/cache/`, or
from any machine that has built the image once. Do not commit them: a font in a
repo is a second source of truth that nothing rebuilds, which is the same
reason the built faces are not committed either. `.gitignore` here says so.

The list above is what the pins name today. The build does not read it: it
derives the names from the pinned checkout's own `bases/pins.toml`, so a
`QUASI_TYPE_REV` bump that moves to a new base version asks for the new names
and this list is what goes stale.

Seeding cannot forge a base. Every cached file is checked against the pin's
sha256 exactly as a downloaded one is, so a wrong or tampered copy fails the
cut rather than shipping.

## Using it

    build/build-iso.sh --build-arg QUASI_BASES=sealed

`sealed` passes `--offline` to the cut, so the cut may not reach the network. If
the seed is short of a file the pins name, the build says which files before the
tool is compiled, rather than at the cut. Use it on a build host with a
warm cache. The default, `fetch`, uses whatever is seeded and downloads the
rest, which is what a stranger with an empty directory gets.

Keeping the bases outside the repo is possible with

    podman build -v ~/Code/Libraries/quasi-type/bases/cache:/base-cache:ro .

The mount shadows this directory for the length of the build. Note what that
costs: `build/build-iso.sh` and `build/build-image.sh` forward `--build-arg` and
nothing else, so this route means driving `podman build` yourself, and a build
started that way carries no build stamp and reports its version as
`0.1 (Fedora 43)` (docs/IMAGE.md). Copying the files in here is the route that
works with the scripts.

## What none of this is

A fix. It is a carried copy of two files and it goes stale the first time
`QUASI_TYPE_REV` moves. The durable answer is the mirror above: the same files
on infrastructure we own, addressed by the same sha256, so an unseeded build has
somewhere to reach that is not somebody else's rate limiter, and reached from
inside `quasi-type` so it covers shop's fetch too.

What the seed buys on top of the mirror is `sealed`: a cut that reaches no
network at all, which is the only way to prove the two faces came from the bytes
the pins name and nothing else.