noctix

Horizon ISO builder, Euri Linux.

Rust, BSD-3-Clause. Replaces euri-mklive.

status

Stages implemented so far:

• [1/8] sandbox bootstrap from hports (apk-tools, initramfs-tools, erofs-utils, xorriso, limine)
• [2/8] rootfs bootstrap from hports (Semi-FHS layout, no Alpine)
• [3/8] initramfs via initramfs-tools (erofs-live hooks)
• [4/8] mkfs.erofs, zstd
• [5/8] ISO tree (limine.conf + EFI/BIOS)
• [6/8] xorriso isohybrid
• [8/8] qemu smoke test

Missing: [7/8] attest in the build path.

locked decisions

• bootloader: limine only (BIOS + UEFI isohybrid, colon-syntax limine.conf)
• live rootfs image: EROFS, mkfs.erofs -b 4096 -T 0 -z zstd -E ztailpacking --force-uid=0 --force-gid=0
• initramfs: initramfs-tools with the erofs-live hooks, BOOT=erofs-live
• build rootless: privileged steps run inside a bwrap sandbox whose rootfs tree holds apk-tools, initramfs-tools, erofs-utils, xorriso, limine. nothing runs as root on the host.
• our repos only: nothing is fetched from Alpine or any upstream mirror. every byte comes from https://pkgs.euri-linux.pl/hports (hbuild-signed APKINDEX). sandbox tools ship as our own packages. config validation rejects foreign repo urls mechanically.
• contract: horizon.yaml is THE schema (distro/arch/libc/init/mirror/de_wm/ extra_repos/iso/live-session/users/rootfs/services/bootloader)
• attest: machine probe (~/.config/noctix/attest.toml, private, never committed) gives the founder-box verdict. the real officialness is an ed25519 detached signature; the signing key lives in a passphrase-encrypted age file, decrypted per build, never written back to disk.

usage

cargo run -p noctix -- rootfs --config horizon.yaml --out rootfs --repo <hports> --pubkey <key.pub>
cargo run -p noctix -- build --config horizon.yaml --rootfs rootfs --mkinitramfs
cargo run -p noctix -- build --config horizon.yaml --rootfs rootfs --image filesystem.erofs
cargo run -p noctix -- build --config horizon.yaml --rootfs rootfs --image filesystem.erofs --iso-dir iso
cargo run -p noctix -- build --config horizon.yaml --iso-dir iso --out horizon.iso
cargo run -p noctix -- run horizon.iso

road (v0.1 -> v0.2)

1. bwrap sandbox bootstrap: unpack tools from hports
2. rootfs install pass: rootfs.packages + packages-init
3. initramfs-tools generation (erofs-live hooks)
4. mkfs.erofs
5. ISO tree
6. xorriso isohybrid + limine bios-install
7. integrated attest (+ optional founder-key signature)
8. noctix run qemu smoke test with serial log grep