Make release disk a separate build target

Earlier release disk build had a critical problem: the built disk would
have optimized partition sizes based on the current system's image size.
This meant that newer releases would potentially not fit in the system
partition if they increase in size.

To avoid this issue, we create disk images which have system partition
sizes equal to (default PlayOS size - 1 GiB). The 1GiB is subtracted as a
safety threshold to avoid releasing something that is very near max
capacitiy.

This gets rid of the extra top-level `extraModules` argument in
default.nix along the way.

.github/workflows/gen-release-summary.sh

@@ -25,7 +25,7 @@ echo -e "
 
 ## Artifacts
 
-- Test disk: [https://dividat-playos-test-disks.s3.amazonaws.com/by-tag/playos-disk-$RELEASE_TAG.img.zst](https://dividat-playos-test-disks.s3.amazonaws.com/by-tag/playos-disk-$RELEASE_TAG.img.zst)
+- Test disk: [https://dividat-playos-test-disks.s3.amazonaws.com/by-tag/playos-release-disk-$RELEASE_TAG.img.zst](https://dividat-playos-test-disks.s3.amazonaws.com/by-tag/playos-release-disk-$RELEASE_TAG.img.zst)
 
 ## Changelog
 

.github/workflows/upload-test-disk.sh

@@ -4,7 +4,7 @@ RELEASE_TAG="$1"
 
 set -euo pipefail
 set -x
-disk_path="$(readlink ./result/playos-disk-$RELEASE_TAG.img)"
-target_url="s3://dividat-playos-test-disks/by-tag/playos-disk-$RELEASE_TAG.img.zst"
-echo "Compressing and uploading test disk to: $target_url"
-zstd --stdout "$disk_path" | aws s3 cp - "$target_url"
+disk_path="$(readlink ./result/playos-release-disk-$RELEASE_TAG.img.zst)"
+target_url="s3://dividat-playos-test-disks/by-tag/playos-release-disk-$RELEASE_TAG.img.zst"
+echo "Uploading test disk to: $target_url"
+aws s3 cp "$disk_path" "$target_url"

build

@@ -109,15 +109,22 @@ elif [ "$TARGET" == "shed-key" ]; then
 # builds a disk to be used as a base image in ./testing/release-validation.nix
 elif [ "$TARGET" == "release-disk" ]; then
 
+  echo -e "
+Building release disk image for release validation tests.
+
+Note: requires around 30GiB of free space for storing the intermediate disk
+images. The final compressed disk image is much smaller (~4 GiB).
+"
+
   (set -x; nix-build \
       --arg kioskUrl "http://kiosk-server.local/" \
       --arg updateUrl "http://update-server.local/" \
       --arg buildVm false \
       --arg buildInstaller false \
       --arg buildBundle false \
       --arg buildLive false \
-      --arg buildDisk true \
-      --arg extraModules '[ ./testing/system/passwordless-root.nix ]'
+      --arg buildDisk false \
+      --arg buildReleaseDisk true
   )
 
 elif [ "$TARGET" == "default" ]; then

default.nix

@@ -16,13 +16,11 @@ in
 
 , applicationPath ? ./application.nix
 
-# extra modules to include in the systemImage, used in ./build release-disk
-, extraModules ? [ ]
-
   ##### Allow disabling the build of unused artifacts when developing/testing #####
 , buildInstaller ? true
 , buildBundle ? true
 , buildDisk ? true
+, buildReleaseDisk ? false
 , buildLive ? true
 }:
 
@@ -34,8 +32,9 @@ let
     applicationOverlays = application.overlays;
   });
 
-  # lib.makeScope returns consistent set of packages that depend on each other (and is my new favorite nixpkgs trick)
-  components = with pkgs; lib.makeScope newScope (self: with self; {
+  # lib.makeScope returns consistent set of packages that depend on each other
+  mkComponents = { application, extraModules ? [ ], rescueSystemOpts ? {}, diskBuildEnabled ? buildDisk }:
+  (with pkgs; lib.makeScope newScope (self: with self; {
 
     inherit updateUrl deployUrl kioskUrl;
     inherit (application) version safeProductName fullProductName;
@@ -92,8 +91,18 @@ let
     # Script for spinning up VMs
     run-in-vm = callPackage ./testing/run-in-vm {};
 
-  });
+  }));
+
+  components = mkComponents { inherit application; };
 
+  releaseDiskComponents = mkComponents {
+    inherit application;
+    extraModules = [ ./testing/system/passwordless-root.nix ];
+  };
+
+  releaseDisk = pkgs.callPackage ./testing/disk/release.nix {
+    inherit (releaseDiskComponents) install-playos;
+  };
 in
 
 with pkgs; stdenv.mkDerivation {
@@ -124,6 +133,9 @@ with pkgs; stdenv.mkDerivation {
   + lib.optionalString buildDisk ''
     ln -s ${components.disk} $out/${components.safeProductName}-disk-${components.version}.img
   ''
+  + lib.optionalString buildReleaseDisk ''
+    ln -s ${releaseDisk} $out/${components.safeProductName}-release-disk-${components.version}.img.zst
+  ''
   # Installer ISO image
   + lib.optionalString buildInstaller ''
     ln -s ${components.installer}/iso/${components.safeProductName}-installer-${components.version}.iso $out/${components.safeProductName}-installer-${components.version}.iso

testing/disk/release.nix

@@ -0,0 +1,49 @@
+# Similarly to testing/disk/default.nix, this builds a disk image containing
+# a full PlayOS installation, with these differences:
+# - It uses default system and boot partition sizes. Total disk size is ~20 GiB
+# - It produces a (sparsified) qcow2 image rather than a raw one. This reduces
+#   the image size to ~8GiB
+# - It compresses the final image using zstd to reduce disk usage.
+#   Final compressed file size is around ~4GiB.
+{ pkgs
+, lib
+, install-playos
+}:
+with pkgs;
+with lib;
+let
+  # all sizes in MiB
+  partSizes = {
+    boot = 525; # 525 MiB (matches install-playos default)
+    system = 1024 * 9;  # 9 GiB (install-playos default - 1GiB)
+    data = 400; # 400 MiB (same as testing/disk/default.nix)
+  };
+  diskSizeMiB = 8 + partSizes."boot" + partSizes."data" + (partSizes."system" * 2) + 1;
+in
+vmTools.runInLinuxVM (
+  runCommand "build-playos-release-disk"
+    {
+      buildInputs = [install-playos];
+
+      preVM = ''
+        diskImage=nixos.raw
+        truncate -s ${toString diskSizeMiB}MiB $diskImage
+      '';
+
+      postVM = ''
+        mkdir -p $out
+        ${pkgs.qemu}/bin/qemu-img convert -f raw -O qcow2 $diskImage $out/playos-disk.img
+        rm $diskImage
+        ${pkgs.zstd}/bin/zstd --rm -f $out/playos-disk.img -o $out/playos-disk.img.zst
+        diskImage=$out/playos-disk.img.zst
+      '';
+      memSize = 1024;
+    }
+    ''
+      # machine-id of development image is hardcoded.
+      install-playos \
+        --device /dev/vda \
+        --machine-id "f414cca8312548d29689ebf287fb67e0" \
+        --no-confirm
+    ''
+) + "/playos-disk.img.zst"