Project: frostyard/snosi — a bootc/mkosi-based immutable Debian Trixie OS image build system. Pull request: frostyard/snosi#409 — Secure native A/B deployment path (Phases 0–8), alongside bootc.
A single autonomous Claude Code run took a design plan for a secure native A/B disk-image deployment path (mkosi EROFS/dm-verity roots + systemd-sysupdate + Secure Boot + TPM-unlocked LUKS) — adding cayo-ab / snow-ab / snowfield-ab native products
Here’s the concrete sysext plan I’d use.
Goal
Build an incus.raw system extension that overlays only /usr, while keeping Incus state on the host in /var/lib/incus, /var/cache/incus, /var/log/incus, and /run/incus.
1. Define The Artifact
Create a separate dakota-incus-sysext build artifact, initially out-of-tree.
The sysext should contain:
name: humanizer version: 2.5.1 description: | Remove signs of AI-generated writing from text. Use when editing or reviewing text to make it sound more natural and human-written. Based on Wikipedia's comprehensive "Signs of AI writing" guide. Detects and fixes patterns including: inflated symbolism, promotional language, superficial -ing analyses, vague attributions, em dash overuse, rule of three, AI vocabulary words, passive voice, negative parallelisms, and filler phrases.
mkosi uses GNU tar with --xattrs --pax-option=delete=atime,delete=ctime,delete=mtime to create OCI tar layers. This produces PAX extension headers that composefs-rs's custom Rust tar parser can't handle correctly. composefs-rs has an open issue (#2) acknowledging their "home-brew header handling code" needs PAX cleanup, but no fix is imminent.
The test script workaround sidesteps PAX headers but is lossy:
| === Step 7: Run tests === | |
| --- Running: 01-installation.sh --- | |
| 01-installation.sh 100% 1605 7.2MB/s 00:00 | |
| # Tier 1: Installation validation | |
| # system state: running | |
| ok - System has booted | |
| ok - Root filesystem is read-only | |
| ok - Composefs is active | |
| ok - usr is read-only |
You can keep secure boot on, snow supports chained secure boot from debian's shim.
| #!/bin/bash | |
| set -e | |
| # This script converts a raw image with 512 byte sectors to an iso with 2048 byte sectors. The conversion | |
| # allows for booting of the resulting iso as a (virtual) CDROM. | |
| if [ "$#" -ne 1 ]; then | |
| echo "Usage: $0 <input img>" | |
| exit 1 |
| #!/bin/bash | |
| # filepath: /opt/scripts/daily_backup_docker_stacks.sh | |
| set -e | |
| # Configuration | |
| ## dockge stack directory | |
| COMPOSE_ROOT="/opt/stacks" | |
| ## persistent data directory | |
| PERSIST_ROOT="/opt/persist" |
| #!/bin/bash | |
| # copy dev container files from the template directory into the current directory | |
| dc() { | |
| local template_dir=~/projects/templates | |
| # get the first argument | |
| local template=$1 | |
| if [ -z "$template" ]; then | |
| echo "Please provide a template parameter. Options:" | |
| # list all the templates in the template directory |
