Reduce node-image tools to complete required Nix closures

sean commented

2026-09-11 02:33:05 +00:00

Owner

Build node-image-tools v3 from the complete registered Nix dependencies of the required bake tools in a fresh final image. Preserve firmware, certificate configuration, Podman helpers and upstream Python dependencies. The Go bake helper is unchanged. Public Python aliases are omitted without deleting files inside upstream outputs.

Validation: exact qualified context matches this commit; registered Nix hashes and runtime executable/filesystem/QEMU startup contracts pass on Linux AMD64; native helper behavior tests pass; source checks reject22 malformed selections and72 interpreter alias cases. Qualification OCI layers total803,027,266compressed bytes versus2,839,289,019for v2 (126layers to5). This is an image-size measurement, not measured pipeline latency. The full bake with v3 remains a separate activation gate; the active reader stays on v2.

Actual builds caught and fixed donor CA link preservation, pinned Nix tool lookup, mutable bootstrap configuration, and upstream interpreter aliases. An export in a256Mi release-agent container hit its memory limit; the exact build exported successfully through a separate2Gi client. No runtime dependency integrity check was relaxed.

Build node-image-tools v3 from the complete registered Nix dependencies of the required bake tools in a fresh final image. Preserve firmware, certificate configuration, Podman helpers and upstream Python dependencies. The Go bake helper is unchanged. Public Python aliases are omitted without deleting files inside upstream outputs. Validation: exact qualified context matches this commit; registered Nix hashes and runtime executable/filesystem/QEMU startup contracts pass on Linux AMD64; native helper behavior tests pass; source checks reject22 malformed selections and72 interpreter alias cases. Qualification OCI layers total803,027,266compressed bytes versus2,839,289,019for v2 (126layers to5). This is an image-size measurement, not measured pipeline latency. The full bake with v3 remains a separate activation gate; the active reader stays on v2. Actual builds caught and fixed donor CA link preservation, pinned Nix tool lookup, mutable bootstrap configuration, and upstream interpreter aliases. An export in a256Mi release-agent container hit its memory limit; the exact build exported successfully through a separate2Gi client. No runtime dependency integrity check was relaxed.

sean added 1 commit

2026-09-11 02:33:05 +00:00