From Thin Air to Bootable Images: The Tine Build System
2 days ago
- tine is a new Buck2-based build system for building operating system images with cryptographically verifiable integrity.
- It requires only git, python3 (for bootstrapping), and user namespaces, then bootstraps everything from pinned declarations for reproducibility.
- tine uses 'boxes' as declared and pinned environments for build tasks, similar to containers but integrated with Buck2's caching and rebuilding.
- It provides rules for building RPMs, Go and Rust projects, UKIs, and images, with support for signing via PKCS#11 or local keys.
- The build system ensures full control over inputs, pinning every software component, and supports multiple upstream distributions.
- It offers cheap world rebuilds, hermetic and bitwise reproducible builds, and native image building with concurrent support.
- A walkthrough demonstrates building a bootable Fedora Rawhide image with a Go project (duf) and booting it in QEMU.
- tine integrates SBOM generation (e.g., CycloneDX) via Syft for security scanning compatibility.
- It was developed after evaluating mkosi, Open Build Service, BuildStream, and Antlir, finding shortcomings in flexibility, bootstrapping, or minimal host requirements.
- Buck2, the underlying engine, uses hash-based caching for correct incremental builds and supports shared caches.