Build your own

You do not need to build anything to use pipeOS. This page is for building the image, changing it, and running a fleet on your own keys. Everything the image contains is at securedataresearch/pipeOS: overlay/ is the filesystem, scripts/ the pipeline in numbered order, and CI gates every piece.

Building the image

$ ./scripts/00-host-setup.sh   # deps for Arch, Debian, Fedora or Alpine; fetches and verifies the Alpine ISO
$ make chroot                  # the Alpine build chroot (sudo, once)
$ make apks                    # build and sign the package repos
$ make usb                     # out/pipeos-usb.img: write it with dd as on the live disk page
$ make vm                      # or boot it in qemu first: the wizard at http://localhost:8080/

The scripts are host-portable. A config-only change is make image; a package change reruns make apks first. For a shell, bake a public key in with AUTH_KEYS=~/.ssh/id_ed25519.pub; SSH is key-only and root has no password.

Your fleet, your keys, your origin

Nothing in a self-built pipeOS phones home to the vendor or trusts them:

signing key	the first make chroot generates a fresh keypair, kept outside the repository (~/.pipeos/keys or /data/keys/pipeos). Every image you build trusts your key only. Guard it; the build refuses to continue if it finds two different keys claiming to be yours
update origin	overlay/etc/pipeos/selfupdate.conf ships pointing at the project's GitHub Releases. Blank UPDATE_RELEASE_URL and your boxes never self-update; point it at your own Releases (make release) or any static host serving the digest file and pipeos-repo.tar.gz, and your fleet updates from you, hourly, through the same verified, atomic, self-rolling-back path
support relay	Vendor support access dials out only to the relay in /etc/pipeos/support.conf. It ships as [email protected] with the switch off; a box never switched on never speaks to it. Point it at your own relay, or blank it and the service refuses to start
pipe	optional and off by default

Updates are trusted by signature: the box verifies the repository index against its trusted keys before anything touches the media, so a wrong origin fails verification and leaves the box untouched.

Running a fleet

Serve the built repository directory over HTTP, set UPDATE_URL to it and blank the release URL, save, and the hourly run takes it from there. make stick CARD=… bakes a model card into the image so a named box boots as itself; the fence explains what the card generates. A plain image ships the generic card and is nobody's until claimed.

When something goes wrong

Troubleshooting for the box; an issue on the repository with the boot report text for the build.

Next

The box: back to the start of the manual.