feat(build): COMPRESS_IMG=1 emits .img.xz + .sha256 — the pair the skill and runbook already promise #279

Merged

clawdie merged 1 commit from feat/compress-img-flag into main

2026-07-19 16:24:46 +02:00

clawdie commented

2026-07-19 14:27:28 +02:00

Owner

Grew out of the blank-spaces sweep, via the other agent's find: skills/iso-build/SKILL.md lists .img.xz + .img.xz.sha256 as typical artifacts and RELEASE-BUILD-RUNBOOK.md's publish checklist requires the pair — but nothing in the pipeline ever produced them.

Changes (opt-in, default off):

build.cfg: COMPRESS_IMG="${COMPRESS_IMG:-0}" knob next to the other build knobs.
build.sh: after the step-6 report, xz -T0 -f -k the output image and write sha256 > .img.xz.sha256. -k keeps the raw .img so dd needs no decompress round-trip. Sparse holes are zeros and compress at memory speed; the time cost is the ~8G of real data.
Prints a secrets reminder: dev-channel images can carry baked provider.env keys — verify before the .xz goes anywhere. (Today's clawdie-quindecim-0.13.0.img is exactly that case: keys baked, LAN-only, must NOT hit the iso-publish lane.)

Deliberately NOT added to the doas nopass keep-list — set via build.cfg or doas env (catch-all rule).

Gates: sh -n build.sh clean, ./scripts/check-format.sh green.

🤖 Generated with Claude Code

Grew out of the blank-spaces sweep, via the other agent's find: `skills/iso-build/SKILL.md` lists `.img.xz` + `.img.xz.sha256` as *typical artifacts* and `RELEASE-BUILD-RUNBOOK.md`'s publish checklist requires the pair — but nothing in the pipeline ever produced them. Changes (opt-in, default off): - `build.cfg`: `COMPRESS_IMG="${COMPRESS_IMG:-0}"` knob next to the other build knobs. - `build.sh`: after the step-6 report, `xz -T0 -f -k` the output image and write `sha256 > .img.xz.sha256`. `-k` keeps the raw `.img` so `dd` needs no decompress round-trip. Sparse holes are zeros and compress at memory speed; the time cost is the ~8G of real data. - Prints a **secrets reminder**: dev-channel images can carry baked provider.env keys — verify before the `.xz` goes anywhere. (Today's `clawdie-quindecim-0.13.0.img` is exactly that case: keys baked, LAN-only, must NOT hit the iso-publish lane.) Deliberately NOT added to the doas nopass keep-list — set via build.cfg or `doas env` (catch-all rule). Gates: `sh -n build.sh` clean, `./scripts/check-format.sh` green. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

clawdie added 1 commit

2026-07-19 14:27:31 +02:00

feat(build): COMPRESS_IMG=1 emits .img.xz + .sha256 — the pair the skill and runbook already promise

format-check / prettier (pull_request) Successful in 11s

Details

7d73cbd835

skills/iso-build/SKILL.md lists compressed .img.xz and matching
.img.xz.sha256 as typical artifacts, and RELEASE-BUILD-RUNBOOK's publish
checklist requires them — but no pipeline step ever produced either.

Add an opt-in flag (build.cfg knob, default 0): after the step-6 report,
xz -T0 -k the output (raw .img kept so dd needs no decompress) and write
the sha256. Prints a reminder that dev-channel images can carry baked
provider.env keys and must be verified before the .xz goes anywhere.

Not in the doas nopass keep-list on purpose — set it via build.cfg or
doas env (catch-all rule).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

clawdie merged commit da76072c3c into main

2026-07-19 16:24:46 +02:00

clawdie referenced this pull request from a commit

2026-07-19 16:24:49 +02:00

Merge pull request 'feat(build): COMPRESS_IMG=1 emits .img.xz + .sha256 — the pair the skill and runbook already promise' (#279) from feat/compress-img-flag into main

clawdie deleted branch feat/compress-img-flag

2026-07-19 16:24:58 +02:00