nucleic/nucleic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vminit image: add 'make vminit-image-login' for Keychain-based GHCR auth

Browse Source 
cctl login stores the credential in the macOS Keychain, which cctl images push
reads automatically — so pushing needs no REGISTRY_* env vars after a one-time
login. Env vars remain as a fallback.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
abkslm
2026-07-13 19:37:06 -07:00
co-authored by Claude Opus 4.8
parent b81d12553c
commit 3dd014405b
2 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+10 -5
View File
@@ -230,7 +230,7 @@ runner-deploy: runner-build
CTZN_DIR := third_party/containerization
NUCLEIC_VMINIT_REF ?= ghcr.io/abkslm/vminit:0.34.0-nucleic1
.PHONY: vminit-image-prep vminit-image vminit-image-push
.PHONY: vminit-image-prep vminit-image vminit-image-login vminit-image-push
## vminit-image-prep: one-time — install swiftly + the musl static SDK for the guest cross-build
vminit-image-prep:
@@ -250,10 +250,15 @@ vminit-image:
bin/init.rootfs.tar.gz
@echo ""
@echo "Built $(NUCLEIC_VMINIT_REF) into the local cctl content store."
@echo "Push it (needs a GHCR token with write:packages):"
@echo " REGISTRY_HOST=ghcr.io REGISTRY_USERNAME=<user> REGISTRY_TOKEN=<PAT> make vminit-image-push"
@echo "Then set the vminit GHCR package Public."
@echo "Auth once with 'make vminit-image-login' (stores a GHCR token in your Keychain), then"
@echo "'make vminit-image-push'. Finally set the vminit GHCR package Public."
## vminit-image-push: push the built image to GHCR (set REGISTRY_HOST/USERNAME/TOKEN first)
## vminit-image-login: one-time — store a GHCR credential in the macOS Keychain (prompts for a
## username + a write:packages PAT; cctl push then authenticates from the Keychain, no env vars)
vminit-image-login:
cd $(CTZN_DIR) && ./bin/cctl login ghcr.io
## vminit-image-push: push the built image to GHCR (auth from the Keychain via vminit-image-login,
## or REGISTRY_HOST/USERNAME/TOKEN env as a fallback)
vminit-image-push:
cd $(CTZN_DIR) && ./bin/cctl images push $(NUCLEIC_VMINIT_REF)
third_party/containerization/PATCHES.md
Vendored
+3 -2
View File
@@ -82,8 +82,9 @@ Patches #8+ live in `vminitd/` (the guest agent), which rides in the initfs OCI
until that image is rebuilt from this source and published, and `ContainerEngine.vminitReference`
points at it. Build it with **`make vminit-image`** (root Makefile) — it builds cctl + the guest
vminitd/vmexec from this vendored tree and packages `ghcr.io/abkslm/vminit:<tag>` into the local cctl
store; `make vminit-image-push` (with GHCR creds in the environment) publishes it, and `vminitReference`
is pinned to that custom image. First time on a machine, run `make vminit-image-prep` once (installs
store; `make vminit-image-push` publishes it (authenticate once with `make vminit-image-login`, which
stores a GHCR token in the macOS Keychain — or set `REGISTRY_HOST`/`USERNAME`/`TOKEN`), and
`vminitReference` is pinned to that custom image. First time on a machine, run `make vminit-image-prep` once (installs
the swiftly toolchain + musl SDK the guest cross-build needs). Bump the `-nucleicN` tag suffix and
rebuild whenever a guest patch changes. Built locally, not in CI: the host framework needs the macOS
26+ Virtualization SDK that GitHub-hosted runners lack.