feat(guanghu-os): add pre-root supervisor source slice
This commit is contained in:
parent
0a39761bed
commit
29bb023455
13 changed files with 403 additions and 3 deletions
|
|
@ -1404,3 +1404,10 @@ server deployment.
|
|||
- **`.github/workflows/release.yml`** — Alpha prereleases from every push to `main` using calendar-semver technical versions (`YYYY.M.D-alpha.N`) and clean `Alpha YYYY.M.D.N` release names. GitHub alpha tags zero-pad the prerelease sequence (`alpha-vYYYY.M.D-alpha.NNNN`) so GitHub release ordering stays chronological while the shipped app version remains `YYYY.M.D-alpha.N`. Publishes `alpha/latest.json` with macOS Apple Silicon/Intel, Linux x64, and Windows x64 updater entries, then refreshes the legacy `latest.json` / `latest-canary.json` aliases to the alpha feed. The Windows job always requires Tauri updater signatures, uses Authenticode signing and `Get-AuthenticodeSignature` verification when Windows certificate secrets are present, and warns while building updater-signed-only artifacts when those secrets are absent. The Linux job uses Tauri's stock linuxdeploy AppImage output plugin and validates that installer and updater-signature artifacts exist before upload. The docs/release Pages job reads the stable manifest from the latest stable release asset instead of copying the live Pages URL, uploads the built site as a Pages artifact, and deploys it with GitHub's official Pages action so the public updater JSON changes as part of the release workflow. Changes to the shared artifact workflow are not ignored by the alpha trigger, so release-pipeline fixes produce a fresh alpha run. macOS release assets use `Tolaria_<version>_macOS_Silicon` and `Tolaria_<version>_macOS_Intel` base names. Packaged builds pass the computed version as `VITE_SENTRY_RELEASE`, which is retained as a diagnostic build-version tag but not registered as a normal Sentry release for alpha builds.
|
||||
- **`.github/workflows/release-stable.yml`** — Stable releases from `stable-vYYYY.M.D` tags. Publishes `stable/latest.json`, macOS Apple Silicon and Intel DMG/updater artifacts, Windows x64 installers plus Tauri-signed updater bundles, Linux x86_64 `.deb` / `.rpm` / AppImage artifacts, and a static public download page that starts selected non-Windows installers without replacing the page with a blank download navigation. Windows visitors see an explicit installer action and managed-device guidance instead of an automatic download. Authenticode publisher signing is added to Windows artifacts when certificate secrets are configured; until then, the workflow warns and publishes updater-signed-only Windows artifacts. Linux visitors default to the AppImage target while the page exposes RPM as a manual Linux package option when the stable release includes one. The Linux job uses the same stock Tauri/linuxdeploy AppImage packaging and artifact validation as alpha releases. The Pages job reads the alpha manifest from the latest alpha release asset instead of copying the live Pages URL, uploads the built site as a Pages artifact, and deploys it with GitHub's official Pages action so stable and alpha manifests stay fresh. Stable macOS DMG/updater assets use the same `Tolaria_<version>_macOS_Silicon` and `Tolaria_<version>_macOS_Intel` base names. Packaged builds pass the computed stable version as `VITE_SENTRY_RELEASE`, which is registered as Sentry's release.
|
||||
- **Beta cohorts** are handled in PostHog targeting only. There is no beta updater feed.
|
||||
# Guanghu first-boot handoff
|
||||
|
||||
The pre-root handoff is evidence from one kernel boot, not an authority token.
|
||||
It binds node, DMI instance, boot ID, root UUID, rescue entry, and the pending
|
||||
repository bridge before full Linux userspace starts. Later control layers
|
||||
must re-read live state and must not infer persistent Guanghu master control
|
||||
from the handoff alone.
|
||||
|
|
|
|||
|
|
@ -1521,3 +1521,11 @@ Features that work on both platforms without changes:
|
|||
**Capabilities:** `src-tauri/capabilities/default.json` targets desktop; `mobile.json` targets iOS/Android with a minimal permission set.
|
||||
|
||||
**Detailed feasibility report:** `docs/IPAD-PROTOTYPE.md`
|
||||
# Guanghu pre-root control slice
|
||||
|
||||
The Guanghu OS transition includes a fail-closed initramfs stage before the
|
||||
complete Ubuntu root filesystem is mounted. Its source lives under
|
||||
`guanghu-os/scripts/guanghu-first-boot-supervisor.sh` with packaging in
|
||||
`guanghu-os/packaging/initramfs-tools/`. It produces a boot-scoped handoff for
|
||||
the later hosted repository bridge; it is not yet the persistent first-boot
|
||||
supervisor or final on-demand Linux topology.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,39 @@
|
|||
---
|
||||
type: ADR
|
||||
id: "0176"
|
||||
title: "Guanghu pre-root supervisor over a Linux hardware-compatibility substrate"
|
||||
status: accepted
|
||||
date: 2026-08-15
|
||||
refines: "0175"
|
||||
---
|
||||
|
||||
# 光湖先启动监督器与 Linux 硬件兼容底座
|
||||
|
||||
## 背景
|
||||
|
||||
`JD-FD-PRIMARY` 是运行在 KVM 上的云主机。当前现场没有向来宾暴露 VMX/SVM，也没有
|
||||
`/dev/kvm`，因此不能在现有光湖小内核下面再用硬件虚拟化启动一套完整 Linux 来宾。把完整
|
||||
Ubuntu 永久作为先启动宿主，又不能满足 ADR-0175 的光湖先启动主控。
|
||||
|
||||
## 决定
|
||||
|
||||
第一现实切片使用当前受支持的 Linux 内核与 initramfs 作为硬件兼容底座，但在挂载完整
|
||||
Ubuntu 根系统之前运行光湖监督器。监督器必须绑定精确节点、DMI、根 UUID、本轮启动 ID、显式
|
||||
内核启动标记、Linux 救援槽和仓库桥名称，随后留下同一启动周期的受限交接状态。完整 Linux
|
||||
用户态在这个时点保持休眠；后续阶段只允许把登记的仓库数据面接成有界协作层。
|
||||
|
||||
这条路线不把 Linux 内核删除，也不把内核驱动归属误写成系统主权。主权仍由谁先恢复光湖控制
|
||||
状态、签发后续生命周期、验收回读、收回协作层以及保留救援决定。
|
||||
|
||||
## 当前边界
|
||||
|
||||
initramfs 前置脚本和交接合同只证明“完整根系统之前已有光湖控制状态”的源码能力。脚本返回后
|
||||
尚未证明监督器跨 `switch_root` 持续存活，也没有证明完整 Linux 用户态可以按需唤醒和收回。
|
||||
因此以下谓词继续为零：
|
||||
|
||||
- `independent_guanghu_first_boot_supervisor`；
|
||||
- `linux_on_demand_subcontrol`；
|
||||
- `final_guanghu_os_master`。
|
||||
|
||||
下一门先在京东同核 QEMU 中证明前置执行与失败关闭，再单独实现跨根切换的持续监督实体；任何
|
||||
真实 GRUB、initramfs 默认项、重启或磁盘更改仍需服务器工作单、回滚和节点自有回执。
|
||||
Loading…
Reference in a new issue