BoB L1: new tdx-init, LH 8.0.0 #43
Conversation
ilyaluk
requested review from
alexhulbert,
astarinmymind and
Copilot
and removed request for
Copilot
There was a problem hiding this comment.
Pull Request Overview
This PR updates the tdx-init version from v0.1.1 to v0.3.0 (a forward-incompatible change requiring fresh persistent disks) and enhances documentation with a clarifying note about image measurements tied to specific commits.
Key Changes:
- Bumped tdx-init version to v0.3.0 in bob-common build configuration
- Added measurement reproducibility guidance in bob-l1 readme
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| bob-common/mkosi.build | Updates tdx-init dependency from v0.1.1 to v0.3.0 |
| bob-l1/readme.md | Adds note about commit-specific measurements for reproducibility |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
ilyaluk
force-pushed
the
ilya/bob-l1-updates
branch
9 times, most recently
from
3aea2d2 to
359c931
Compare
ilyaluk
changed the title
ilyaluk
force-pushed
the
ilya/bob-l1-updates
branch
from
359c931 to
c05c1f0
Compare
ilyaluk
force-pushed
the
ilya/bob-l1-updates
branch
from
ed63823 to
efde407
Compare
| make_git_package \ | ||
| "lighthouse" \ | ||
| "v7.1.0" \ | ||
| "v8.0.0" \ |
There was a problem hiding this comment.
The lighthouse build process can be simplified starting with v8 like so: https://github.com/flashbots/flashbots-images/pull/38/files#diff-3c7f2c5d727d89202366ab0b86107555d64c34fed340037e8204c3f8959d80e7R28-R38
I'll make the necessary changes to this PR to get it working
| @@ -0,0 +1,6 @@ | |||
| Types: deb deb-src | |||
| URIs: https://snapshot.debian.org/archive/debian/20251113T083151Z | |||
There was a problem hiding this comment.
I'm slightly leaning towards a mkosi.* script so that we don't have to hard code the timestamp twice. What do you think? We could also just make this part of the base module. Everything should have backports, especially since it can help us avoid using rustup throughout the repo since it nontrivially slows down builds, depends on network access, and downloads untrusted binaries.
There was a problem hiding this comment.
Unfortunately, adding backports repo via mkosi.conf is not supported at the moment (or I could not figure it out). I assume that's becuase backports is a different suite. There's upstream issue about this, afaiu: systemd/mkosi#1755
Also, we can't add it via scripts (e.g. systemd/mkosi#3439), because build packages installation happens in sandbox, not image itself.
bob-common/mkosi.build
Outdated
|
|
||
| # Build fluent-bit | ||
| BUILD_CMD=" | ||
| # Install cmake 3.28 to fix build issues on Apple Silicon hosts |
There was a problem hiding this comment.
Fluent bit is not reproducible on apple silicon, so if we want to target that platform, we need to grab it from the official .deb file
There was a problem hiding this comment.
Oh, I see. Feel free to rollback this, not sure if there's use case for building bob images on apple silicon
| git | ||
| gcc | ||
| cargo | ||
| cargo/trixie-backports |
There was a problem hiding this comment.
Nice, i will look for other places we're using rustup in the repo to get newer version of rust and switch them out for this technique now that the backports version is new enough
kernel/mkosi.build
Outdated
|
|
||
| mkosi-chroot --chdir "/build/kernel-${KERNEL_VERSION}" make olddefconfig | ||
| mkosi-chroot --chdir "/build/kernel-${KERNEL_VERSION}" make -j "$(nproc 2>/dev/null || echo 2)" bzImage ARCH=x86_64 CONFIG_EFI_STUB=y | ||
| mkosi-chroot --chdir "/build/kernel-${KERNEL_VERSION}" make -j "$(nproc 2>/dev/null || echo 2)" bzImage ARCH=x86_64 CONFIG_EFI_STUB=y LDFLAGS="-Wl,--build-id=none" |
There was a problem hiding this comment.
Did this do anything? I vaguely recall trying these exact LDFLAGS before I left for vacation and iirc it didn't fix anything.
There was a problem hiding this comment.
Not sure, I don't think I've built without this flag. I've seen this commit in your branch and backported it, assuming you've added them for a reason 😄
There was a problem hiding this comment.
oh yeah meant to revert that before leaving for vacation, it didn't do anything
ilyaluk
force-pushed
the
ilya/bob-l1-updates
branch
from
efde407 to
2cf8e72
Compare
2 participants
tdx-init version is forward-incompatible, so those images would need to get fresh persistent disks.
They support disk upsizing though.
best viewed per-commit