This is based on bootc (bootable containers), so note that the OS build is described in a normal Dockerfile: https://github.com/pocketblue/pocketblue/blob/main/Container... which is then run by the Github action (or locally). Very similar to how Universal Blue, Bazzite, Bluefin etc. build at https://github.com/ublue-os/bazzite (see their Containerfile), but for mobile. Has a similar mission to https://postmarketos.or…
Are we really bringing OCI to freaking OS builds? Nothing about OCI is pleasant. A list of Tarballs is the most backwards boot format I can think of. Terrible for reproducibility. Terrible for security. Boot images should be Dm-verity protected EROFS images. We should not be building new things on OCI. It's really mind-blowing to me that this is a new direction people who are supposed to be top of class OS builders a…
> Boot images should be Dm-verity protected EROFS images
Maybe I'm misunderstanding you - I gather that you think the boot images are distributed as OCI images? That's not the case, bootc is more about building the image, updating it and the overall structure. Booting an image built with bootc does not involve any container infrastructure (unless you start services that depend on containers, I guess - but that's deep in userspace). There's technically nothing preventing this from using verified read-only images.