Taskfile.yaml

version: '3'
vars:
  ARTIFACT_NAME: cryptos-appliance
  TESTPARALLELISM: 4
  GOLIC_VERSION: v1.2.0
  GOLANGCI_VERSION: v2.12.2
  COMMON_LIC: "The CryptOS Authors."
  TEMPLATE_LIC: "apache2"
tasks:
  # ---- Image build (Linux host only; see build/README.md) ----
  # DRAFT recipes — not yet executed. Require a Linux toolchain
  # (kernel build, mksquashfs, ukify, sbsign, cpio). ARCH defaults to amd64.

  kernel:build:
    desc: "[Linux] Fetch + build the pinned hardened kernel (PLATFORM adds drivers)"
    cmds:
      - PLATFORM='{{.PLATFORM}}' bash build/kernel/build.sh {{.ARCH | default "amd64"}}

  cryptsetup:build:
    desc: "[Linux] Build the static cryptsetup from source (Docker + Alpine/musl)"
    cmds:
      - bash build/cryptsetup/build.sh {{.ARCH | default "amd64"}}

  e2fsprogs:build:
    desc: "[Linux] Build the static mke2fs/mkfs.ext4 from source (Docker + Debian/glibc)"
    cmds:
      - bash build/e2fsprogs/build.sh {{.ARCH | default "amd64"}}

  sgdisk:build:
    desc: "[Linux] Build the static sgdisk (gptfdisk) from source (Docker + Debian/glibc)"
    cmds:
      - bash build/gptfdisk/build.sh {{.ARCH | default "amd64"}}

  mkfsvfat:build:
    desc: "[Linux] Build the static mkfs.vfat (dosfstools) from source (Docker + Debian/glibc)"
    cmds:
      - bash build/dosfstools/build.sh {{.ARCH | default "amd64"}}

  rootfs:build:
    desc: "[Linux] Assemble the rootfs tree + pack the SquashFS (STATEKEY=tpm|nodeid; NO_ANCHOR=1 ignores SB_CERT)"
    cmds:
      # SB_CERT in the environment is stamped into /init as the image upgrade
      # anchor. NO_ANCHOR (set by the unsigned tasks) clears it for this step so
      # no anchor can be stamped, whatever the caller's environment holds.
      - >-
        {{if .NO_ANCHOR}}SB_CERT= {{end}}STATEKEY='{{.STATEKEY | default "tpm"}}'
        bash build/squashfs/build.sh {{.ARCH | default "amd64"}}

  uki:assemble:
    desc: "[Linux] Assemble the unsigned UKI (PROFILE=prod|qemu-dev)"
    cmds:
      - bash build/uki/assemble.sh {{.ARCH | default "amd64"}} {{.PROFILE | default "prod"}}

  uki:sign:
    desc: "[Linux] Secure Boot-sign the UKI (needs SB_KEY/SB_CERT)"
    cmds:
      - bash build/uki/sign.sh {{.ARCH | default "amd64"}}

  image:
    desc: "[Linux] Full prod image build (kernel + cryptsetup + rootfs + UKI + sign; STATEKEY=tpm|nodeid)"
    cmds:
      - task: kernel:build
        vars: {PLATFORM: '{{.PLATFORM}}'}
      - task: cryptsetup:build
      - task: e2fsprogs:build
      - task: sgdisk:build
      - task: mkfsvfat:build
      - task: rootfs:build
        vars: {STATEKEY: '{{.STATEKEY | default "tpm"}}'}
      - task: uki:assemble
      - task: uki:sign

  iso:
    desc: "[Linux] Build a UEFI-bootable ISO for a platform (PLATFORM=vmware STATEKEY=tpm|nodeid)"
    cmds:
      - task: image
        vars: {PLATFORM: '{{.PLATFORM | default "vmware"}}', STATEKEY: '{{.STATEKEY | default "tpm"}}'}
      - PLATFORM='{{.PLATFORM | default "vmware"}}' STATEKEY='{{.STATEKEY | default "tpm"}}' bash build/iso/build.sh {{.ARCH | default "amd64"}}

  # Unsigned path: the shape of the published release assets. Nothing is signed
  # and no upgrade anchor is stamped, even if SB_KEY/SB_CERT are exported, so
  # the output trusts no key. Sign it with your own key (task uki:sign, or a
  # full `task image` with SB_KEY/SB_CERT set); see docs/secure-boot.md.
  image:unsigned:
    desc: "[Linux] Full prod image build, unsigned, no upgrade anchor (-> build/out/cryptos-<arch>.uki.unsigned; STATEKEY=tpm|nodeid)"
    cmds:
      - task: kernel:build
        vars: {PLATFORM: '{{.PLATFORM}}'}
      - task: cryptsetup:build
      - task: e2fsprogs:build
      - task: sgdisk:build
      - task: mkfsvfat:build
      - task: rootfs:build
        vars: {STATEKEY: '{{.STATEKEY | default "tpm"}}', NO_ANCHOR: '1'}
      - task: uki:assemble

  iso:unsigned:
    desc: "[Linux] Unsigned UEFI ISO, no upgrade anchor (PLATFORM=vmware STATEKEY=tpm|nodeid; -> cryptos-<arch>-<platform>[-nodeid]-unsigned-<build>.iso)"
    cmds:
      - task: image:unsigned
        vars: {PLATFORM: '{{.PLATFORM | default "vmware"}}', STATEKEY: '{{.STATEKEY | default "tpm"}}'}
      - UNSIGNED=1 PLATFORM='{{.PLATFORM | default "vmware"}}' STATEKEY='{{.STATEKEY | default "tpm"}}' bash build/iso/build.sh {{.ARCH | default "amd64"}}

  image:debug:
    desc: "[Linux] Debug UKI (qemu-dev cmdline; STATEKEY=tpm|nodeid); never published"
    cmds:
      - task: kernel:build
        vars: {PLATFORM: '{{.PLATFORM}}'}
      - task: cryptsetup:build
      - task: e2fsprogs:build
      - task: sgdisk:build
      - task: mkfsvfat:build
      - task: rootfs:build
        vars: {STATEKEY: '{{.STATEKEY | default "tpm"}}'}
      - task: uki:assemble
        vars: {PROFILE: qemu-dev}

  qemu:run:
    desc: "[Linux] Boot the debug image in QEMU + swtpm (interactive)"
    cmds:
      - bash build/ci/qemu-run.sh {{.ARCH | default "amd64"}}

  build:test:
    desc: "Unit test the build and release helper scripts (git only; the ISO test skips without xorriso/mtools)"
    cmds:
      - bash build/ci/artifact-name_test.sh
      - bash build/ci/build-manifest_test.sh
      - bash build/release/check-unsigned_test.sh
      - bash build/release/guard_test.sh
      - bash build/release/pin_test.sh
      - bash build/release/reproducible_test.sh
      - bash build/iso/build_test.sh

  release:guard:
    desc: "Check release/pins.yaml: every pin present, a full commit, reachable, and cryptos-node matches go.mod"
    cmds:
      - bash build/release/guard.sh

  release:reproducible:
    desc: "[Linux] Build the unsigned UKI and ISO twice from HEAD in clean workspaces and compare SHA-256 (REPRO_STATEKEY=tpm|nodeid; needs the image toolchain)"
    cmds:
      - bash build/release/reproducible.sh

  e2e:image:
    desc: "[Linux] Full-image suite: boot the image in QEMU as a Root and an Intermediate and drive every step with cryptosctl (needs KVM, qemu, swtpm, OVMF, docker; skips without them)"
    cmds:
      - bash test/image/build.sh
      - bash test/image/run.sh

  e2e:bridge:
    desc: "[Linux] Bridge upgrade: build cryptos-node a77ae5b and this checkout with a throwaway key, boot the bridge in QEMU as a nodeid Root, upgrade it in place, roll back and upgrade again (needs KVM, qemu, swtpm, OVMF, sbsigntool, docker)"
    cmds:
      - bash test/image/build-bridge.sh
      - bash test/image/run-bridge.sh

  e2e:iso:
    desc: "[Linux] Signed ISO: build two unsigned ISOs, sign them with cryptosctl image sign and a throwaway key, check both UKI copies, install a node from the first in QEMU and upgrade it to the second (needs KVM, qemu, OVMF, xorriso, mtools, sbsigntool, docker)"
    cmds:
      - bash test/image/build-iso.sh
      - bash test/image/run-iso.sh

  test:integration:
    desc: "[Linux] Phase 1 QEMU + swtpm end-to-end acceptance (needs the toolchain; see test/integration)"
    cmds:
      - go test -tags=integration -count=1 -v ./test/integration/...

  default:
    cmds:
      - task: lint
  fmt:
    desc: Format Go sources
    cmds:
      - gofmt -w .
  build:
    desc: Build all packages
    cmds:
      - go build ./...
  test:
    desc: Run tests
    cmds:
      - go test -parallel {{.TESTPARALLELISM}} ./...
  vet:
    desc: Run go vet
    cmds:
      - go vet ./...
  ci:
    desc: Full local validation chain (fmt + lint + vet + test + build)
    cmds:
      - task: fmt
      - task: lint
      - task: vet
      - task: test
      - task: build
      - task: build:test
  test-cover:
    desc: Run tests with coverage reporting
    cmds:
      - go test ./... -cover
  lint:
    desc: Run golangci-lint
    cmds:
      - golangci-lint run ./...
  lint-init:
    desc: Install lint dependencies (golangci-lint is built with the local Go toolchain)
    cmds:
      - go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@{{.GOLANGCI_VERSION}}
  license:
    desc: Verify every source file carries the license header and LICENSE is the verbatim Apache 2.0 text (CI; never writes).
    cmds:
      - go install github.com/Bugs5382/golic/cmd/golic@{{.GOLIC_VERSION}}
      - golic inject -t {{.TEMPLATE_LIC}} -c "{{.COMMON_LIC}}" --license-file --dry -x
  license:fix:
    desc: Inject the license header into any source file missing it and rewrite LICENSE to the verbatim Apache 2.0 text.
    cmds:
      - go install github.com/Bugs5382/golic/cmd/golic@{{.GOLIC_VERSION}}
      - golic inject -t {{.TEMPLATE_LIC}} -c "{{.COMMON_LIC}}" --license-file