@@ -1,5 +1,6 @@
|
||||
# The quick check on every push: each board's image builds, and the v4 tests pass. A pull
|
||||
# request into master is gated by acceptance.yml, the full acceptance protocol.
|
||||
# The quick check on every push to the working branch: each board's image builds, and the v4
|
||||
# tests pass. A pull request into master is gated by acceptance.yml, the full acceptance protocol;
|
||||
# master itself is not checked again after a merge -- its content is what acceptance just passed.
|
||||
# Nothing is published here. The nightlies own the rest: nightly.yml (the QEMU acceptance boots,
|
||||
# the 32-bit build, the Isabelle/HOL proofs, the images to Nexus) and nightly-docs.yml (the
|
||||
# documents to Nexus).
|
||||
@@ -7,7 +8,7 @@ name: Build
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [master, StarForth-v4.0.0]
|
||||
branches: [StarForth-v4.0.0] # not master: what reaches it has just passed acceptance (#119)
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
|
||||
@@ -0,0 +1,49 @@
|
||||
# Builds the CI runner image (ci/runner-image/Dockerfile, #120) and publishes it to this
|
||||
# repository's package registry, tagged with the commit it was built from:
|
||||
#
|
||||
# gitea.starshipos-f18.org/rajames/lithosananke-runner:<commit>
|
||||
#
|
||||
# The workflows name that tag as their container once it is published and has passed acceptance.
|
||||
#
|
||||
# Needs the runner to give jobs its Docker daemon (act_runner config.yaml, container.docker_host:
|
||||
# automount), and a secret PACKAGES_TOKEN -- a token with write:package -- unless the Actions
|
||||
# token may publish packages here.
|
||||
name: Runner image
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [master]
|
||||
paths: ['ci/runner-image/**', 'Makefile']
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
image:
|
||||
name: Build and publish the runner image
|
||||
runs-on: ubuntu-latest
|
||||
container:
|
||||
image: gitea/runner-images:ubuntu-24.04-v26.11.03
|
||||
timeout-minutes: 60
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
lfs: false
|
||||
|
||||
- name: Docker is reachable
|
||||
run: |
|
||||
docker info >/dev/null 2>&1 || {
|
||||
echo "::error::No Docker daemon in this job. Set container.docker_host: automount in the runner's config.yaml, or build the image on the server: see this file's header."
|
||||
exit 1; }
|
||||
|
||||
- name: Build and publish
|
||||
env:
|
||||
TOKEN: ${{ secrets.PACKAGES_TOKEN || secrets.GITEA_TOKEN }}
|
||||
run: |
|
||||
set -e
|
||||
img=gitea.starshipos-f18.org/rajames/lithosananke-runner
|
||||
tag=$(git rev-parse --short=12 HEAD)
|
||||
ctx=$(mktemp -d) # not the repository: 7 GB of context
|
||||
cp -r Makefile boards ci/runner-image/Dockerfile "$ctx/"
|
||||
docker build -t "$img:$tag" "$ctx"
|
||||
echo "$TOKEN" | docker login gitea.starshipos-f18.org -u rajames --password-stdin
|
||||
docker push "$img:$tag"
|
||||
echo "Published $img:$tag"
|
||||
@@ -314,7 +314,8 @@ init:
|
||||
$(SUDO) env DEBIAN_FRONTEND=noninteractive apt-get update -qq
|
||||
$(SUDO) env DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \
|
||||
$(INIT_COMMON) $(if $(filter 0,$(INIT_DOCS)),,$(INIT_DOCPKGS)) $(foreach a,$(INIT_ARCHES),$(INIT_$(a)))
|
||||
git lfs install --local
|
||||
@# the LFS hook for this checkout -- none when init runs outside one (the CI image, ci/runner-image)
|
||||
if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then git lfs install --local; fi
|
||||
$(call fetch,$(SYFT_TGZ),$(SYFT_URL),$(SYFT_SHA_$(SYFT_ARCH)))
|
||||
@mkdir -p $(INIT_TOOLS)/syft-$(SYFT_VERSION)
|
||||
tar -xzf $(INIT_DL)/$(SYFT_TGZ) -C $(INIT_TOOLS)/syft-$(SYFT_VERSION) syft
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
# The CI runner image (#120): gitea/runner-images' Ubuntu 24.04 with Node -- which
|
||||
# actions/checkout and upload-artifact run on -- plus everything the jobs install at their start:
|
||||
# what `make ARCH=amd64,aarch64,riscv64 init INIT_DOCS=0` installs (taken from the Makefile
|
||||
# itself, not copied, so the two cannot drift), and Maven and a JRE for the publish steps.
|
||||
#
|
||||
# Built by .gitea/workflows/runner-image.yml, from a context of the Makefile, boards/ and this file.
|
||||
FROM gitea/runner-images:ubuntu-24.04-v26.11.03
|
||||
COPY Makefile /opt/starship-init/Makefile
|
||||
COPY boards /opt/starship-init/boards
|
||||
WORKDIR /opt/starship-init
|
||||
RUN make --no-print-directory ARCH=amd64,aarch64,riscv64 init INIT_DOCS=0 \
|
||||
&& DEBIAN_FRONTEND=noninteractive apt-get install -y -qq maven default-jre-headless \
|
||||
&& rm -rf /var/lib/apt/lists/* /opt/starship-init/build/cache/downloads
|
||||
WORKDIR /
|
||||
+3
-3
@@ -21,8 +21,8 @@ XWiki "Try it" page (iframe) -> Apache: TLS, websocket -> ttyd -> start-session.
|
||||
| `console.py` | Joins the visitor's terminal to the machine only once it runs, discarding keys typed while it loads |
|
||||
| `qemu-args.sh` | The machine, shared by the two above: a resumed machine must match the saved one exactly |
|
||||
| `starshipos-demo.service` | ttyd as a systemd service, on localhost, at most 3 sessions (#114) |
|
||||
| `apache-demo.conf` | Example vhost: TLS, the websocket, framing allowed for the XWiki only (#115) |
|
||||
| `xwiki-try-it.xwiki` | The XWiki "Try it" page, with the console embedded (XWiki 2.1 syntax) |
|
||||
| `apache-demo.conf` | Example vhost: TLS, the websocket, framing allowed for the `.com` only (#115) |
|
||||
| `xwiki-try-it.xwiki` | The "Try it" page, its own page on the `.com` XWiki (`TryIt`), in the landing page's style |
|
||||
|
||||
## What a visitor cannot do
|
||||
|
||||
@@ -45,7 +45,7 @@ DEMO_PROMPT='[zuse@Hera]' demo/make-snapshot.sh /tmp/StarshipOS.iso /var/lib/sta
|
||||
```
|
||||
|
||||
Then install `starshipos-demo.service` and `apache-demo.conf` (their headers say how), and paste
|
||||
`xwiki-try-it.xwiki` into a page on the XWiki. The `{{html}}` macro there needs a page author
|
||||
`xwiki-try-it.xwiki` into the page `TryIt` on the `.com` XWiki. The `{{html}}` macro there needs a page author
|
||||
with script rights.
|
||||
|
||||
A new image means re-running `build-iso.sh` and `make-snapshot.sh`: the saved machine belongs to
|
||||
|
||||
@@ -2,14 +2,14 @@
|
||||
# name, the certificate paths and the XWiki allowed to embed it are Captain Bob's to set.
|
||||
# a2enmod proxy proxy_http proxy_wstunnel headers ssl rewrite
|
||||
<VirtualHost *:443>
|
||||
ServerName try.strshipos.com
|
||||
ServerName try.starshipos-f18.com
|
||||
SSLEngine on
|
||||
SSLCertificateFile /etc/letsencrypt/live/try.strshipos.com/fullchain.pem
|
||||
SSLCertificateKeyFile /etc/letsencrypt/live/try.strshipos.com/privkey.pem
|
||||
SSLCertificateFile /etc/letsencrypt/live/try.starshipos-f18.com/fullchain.pem
|
||||
SSLCertificateKeyFile /etc/letsencrypt/live/try.starshipos-f18.com/privkey.pem
|
||||
|
||||
# The terminal may be framed by the XWiki's "Try it" page, and by nothing else.
|
||||
# The terminal may be framed by the "Try it" page on the .com (TryIt), and by nothing else.
|
||||
Header always unset X-Frame-Options
|
||||
Header always set Content-Security-Policy "frame-ancestors https://www.starshipos-f18.org https://starshipos-f18.org"
|
||||
Header always set Content-Security-Policy "frame-ancestors https://starshipos-f18.com https://www.starshipos-f18.com"
|
||||
|
||||
ProxyPreserveHost On
|
||||
RewriteEngine On
|
||||
|
||||
+60
-17
@@ -1,28 +1,71 @@
|
||||
= Try StarshipOS =
|
||||
{{box cssClass="floatinginfobox" title="**Your Machine**"}}
|
||||
* **System**: StarshipOS -- LithosAnanke v2.1.0, StarForth v4 (the F18 engine)
|
||||
* **Architecture**: amd64, emulated
|
||||
* **Build**: the latest that passed acceptance on all three architectures
|
||||
* **Logged in as**: Zuse, the superuser -- of this machine only
|
||||
* **Network**: none
|
||||
* **Lasts**: up to 30 minutes, then it is gone
|
||||
{{/box}}
|
||||
|
||||
This is StarshipOS, running. Below is the console of a real StarshipOS machine -- the amd64 build
|
||||
from the latest version that passed its acceptance tests -- started just for you. You are logged
|
||||
in as Zuse, the superuser, of a machine that exists only for your session: there is nothing to
|
||||
= [[Try StarshipOS>>https://starshipos-f18.com/bin/view/TryIt/]] =
|
||||
|
||||
This is a real StarshipOS machine, started just for you and already at its prompt. It is not a
|
||||
simulation of StarshipOS and not a recording: the console below is the serial console of an
|
||||
amd64 machine running the same image the project publishes every night. You are logged in as
|
||||
**Zuse**, the superuser -- of a machine that exists only for your session. There is nothing to
|
||||
break, and nothing you do is kept. Close the page and it is gone.
|
||||
|
||||
{{html clean="false"}}
|
||||
<iframe src="https://try.strshipos.com/" title="StarshipOS console"
|
||||
<iframe src="https://try.starshipos-f18.com/" title="StarshipOS console"
|
||||
style="width:100%; height:34em; border:1px solid #888; border-radius:6px; background:#000;"></iframe>
|
||||
{{/html}}
|
||||
|
||||
== Things to try ==
|
||||
{{info}}
|
||||
If the console does not connect, every machine we run is in use -- try again in a few minutes.
|
||||
{{/info}}
|
||||
|
||||
StarshipOS speaks FORTH. Type a line and press Enter; ##ok## means it was done.
|
||||
----
|
||||
|
||||
|=You type|=It answers
|
||||
|##3 4 + .##|##7 ok## -- numbers go on a stack, ##+## adds the top two, ##.## prints the result
|
||||
|##: SQUARE DUP * ;##|##ok## -- you have just defined a new word
|
||||
|##7 SQUARE .##|##49 ok## -- and used it
|
||||
== Things to Try ==
|
||||
|
||||
== What you are looking at ==
|
||||
StarshipOS speaks **FORTH**. Type a line and press Enter; ##ok## means it was done.
|
||||
|
||||
* A machine of your own, booted from the same image the project publishes every night, resumed at
|
||||
its prompt so you do not wait for it to boot.
|
||||
* It runs in an emulator on our server. It has no network, and it lasts at most 30 minutes.
|
||||
* If the console does not connect, the few machines we run are all in use -- try again in a few
|
||||
minutes.
|
||||
|=You type|=It answers|=What happened
|
||||
|##3 4 + .##|##7 ok##|Numbers go on a stack; ##+## adds the top two; ##.## prints the result
|
||||
|##: SQUARE DUP * ;##|##ok##|You defined a new word, ##SQUARE##
|
||||
|##7 SQUARE .##|##49 ok##|...and used it, as if it had always been there
|
||||
|
||||
----
|
||||
|
||||
== What You Are Looking At ==
|
||||
|
||||
=== A Machine of Your Own ===
|
||||
|
||||
Each visitor gets a separate machine, resumed at its prompt from one that booted, passed its
|
||||
power-on self-test (538 checks) and logged Zuse in -- so you do not wait for it to boot. When you
|
||||
leave, or after 30 minutes, it is stopped and discarded; the next visitor starts from the same
|
||||
clean state.
|
||||
|
||||
=== The Build ===
|
||||
|
||||
The demo always runs the most recent build that passed the project's **acceptance protocol**:
|
||||
booting on amd64, aarch64 and riscv64, the PC stick loaded the way a PC loads it, and the 32-bit
|
||||
build's tests -- the same checks every change must pass before it reaches the main line.
|
||||
|
||||
=== Zuse ===
|
||||
|
||||
**Zuse** is StarshipOS's superuser: whoever holds Zuse's identity drive. Here that drive is a
|
||||
demo Zuse minted for this page alone, attached to every session with its writes thrown away --
|
||||
not anyone's real identity.
|
||||
|
||||
{{warning}}
|
||||
The demo runs in an emulator on a small server: it is slower than StarshipOS on real hardware,
|
||||
and only a few people can use it at once.
|
||||
{{/warning}}
|
||||
|
||||
----
|
||||
|
||||
== Find Out More ==
|
||||
|
||||
* [[StarshipOS>>https://starshipos-f18.com/bin/view/Main/]] -- what StarshipOS is, and how it is built
|
||||
* [[The source>>https://gitea.starshipos-f18.org/rajames/LithosAnanke]] -- the kernel, StarForth, and this demo (##demo/##)
|
||||
|
||||
Reference in New Issue
Block a user