Build NONOS from source the way the installer installs it

nonos-sync commented

2026-09-11 11:22:40 -04:00

Member

python3 tools/nonos-build walks a newcomer through the same seven step ritual the installer runs on a live USB: check the machine, mint the dev identity, build kernel and capsules, prove the kernel, verify the trust ledger, pack the boot partition, print a receipt.

Every step goes through the ordinary make surface, so the guide can never drift from what CI and release builds do. A step counts as done when its artifact exists and has the right shape, not because make exited zero, and each one says out loud what security material it creates and where it stays: dev seeds are minted from local randomness into gitignored paths and never travel. Interactive by default, --yes runs straight through, --from-step resumes after a fix.

The receipt at the end prints the kernel ELF hash with a note that an independent clean build of the same commit lands on the same value, which is now a checked fact rather than a slogan.

Opened on GitHub by eKisNonos as pull request 472. Review and merge happen there while this repository is kept in step from GitHub; this copy follows it, and is marked merged or closed when it is.

python3 tools/nonos-build walks a newcomer through the same seven step ritual the installer runs on a live USB: check the machine, mint the dev identity, build kernel and capsules, prove the kernel, verify the trust ledger, pack the boot partition, print a receipt. Every step goes through the ordinary make surface, so the guide can never drift from what CI and release builds do. A step counts as done when its artifact exists and has the right shape, not because make exited zero, and each one says out loud what security material it creates and where it stays: dev seeds are minted from local randomness into gitignored paths and never travel. Interactive by default, --yes runs straight through, --from-step resumes after a fix. The receipt at the end prints the kernel ELF hash with a note that an independent clean build of the same commit lands on the same value, which is now a checked fact rather than a slogan. --- Opened on GitHub by eKisNonos as [pull request 472](https://github.com/NON-OS/nonos-micro-kernel/pull/472). Review and merge happen there while this repository is kept in step from GitHub; this copy follows it, and is marked merged or closed when it is.

nonos-sync added 1 commit

2026-09-11 11:22:40 -04:00

tools: build NONOS from source the way the installer installs it f03ca137da

python3 tools/nonos-build walks the same seven step ritual the
installer runs: check the machine, mint the dev identity, build,
prove, verify the ledger, pack the boot partition, print a receipt.
Every step goes through the ordinary make surface, is verified by its
artifact rather than its exit code, and says out loud what security
material it creates and where it stays. Interactive by default,
--yes for a straight run, --from-step to resume.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin +refs/pull/13/head:nonos-sync/gh-472

git switch nonos-sync/gh-472

Rows
Columns

Build NONOS from source the way the installer installs it #13

Checkout