chore: Update BSL license to 6-year conversion (Jan 2032) #21
Conversation
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (1)
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. 📝 WalkthroughWalkthroughUpdated repository license headers and README badge from Apache-2.0 to BUSL-1.1, removed multiple Debian debhelper compatibility files, simplified live-build config (codename and options), and significantly reworked the GitHub Actions CI to use Debian-container package and ISO builds with new artifact paths. Changes
Sequence Diagram(s)sequenceDiagram
participant Repo as Repository (push/PR)
participant GH as GitHub Actions
participant Docker as Debian Container
participant LB as live-build (inside container)
participant Store as Artifact Storage
Repo->>GH: push / PR (includes scripts/**)
GH->>Docker: start Debian container, run package & ISO build steps
Docker->>Docker: build packages (loop), copy packages into lb config
Docker->>LB: run lb build (inside container)
LB-->>Docker: produce .iso, SHA256/512, build-log
Docker->>Store: upload output/*.iso, output/SHA*, output/build-log
GH-->>Repo: workflow completes (artifacts available)
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @mikejmorgan-ai, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request implements a strategic decision to extend the project's Business Source License (BSL) conversion period from four to six years. This change is reflected in the main Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the project's license from Apache 2.0 to BSL 1.1, extending the open-source conversion period to 6 years. The changes correctly update the LICENSE file, the README.md badges and license section, and the SPDX license identifiers for numerous shell scripts.
The review identified one area for improvement within the changed files. Additionally, a related file that was not part of this pull request appears to have been missed during the update.
- The SBOM generation script,
sbom/generate-sbom.sh, has been updated with the correct SPDX header, but it still contains hardcoded references to the oldApache-2.0license in the SBOM content it generates. This will lead to incorrect license information in the build artifacts. - The root
Makefilestill contains anSPDX-License-Identifier: Apache-2.0header. To ensure consistency across the project, this should also be updated toBUSL-1.1.
Overall, the changes are in the right direction, but addressing these points will ensure the license update is complete and consistent across the entire repository.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
sbom/generate-sbom.sh (2)
40-40: Critical: SBOM contains incorrect license information.The CycloneDX SBOM metadata still declares the license as Apache-2.0, which contradicts the actual BSL 1.1 license. This creates compliance and legal risks, as the SBOM is an authoritative source for license information.
🔧 Proposed fix
- "licenses": [{"license": {"id": "Apache-2.0"}}] + "licenses": [{"license": {"id": "BUSL-1.1"}}]
66-67: Critical: SBOM contains incorrect license information.The SPDX SBOM package metadata still declares the license as Apache-2.0 for both the main distribution and cortex-core package, which contradicts the actual BSL 1.1 license. This creates compliance and legal risks.
🔧 Proposed fix
- {"SPDXID": "SPDXRef-cortex-linux", "name": "Cortex Linux", "versionInfo": "${VERSION}", "licenseConcluded": "Apache-2.0", "downloadLocation": "https://cortexlinux.com"}, - {"SPDXID": "SPDXRef-cortex-core", "name": "cortex-core", "versionInfo": "${VERSION}", "licenseConcluded": "Apache-2.0", "downloadLocation": "https://repo.cortexlinux.com"}, + {"SPDXID": "SPDXRef-cortex-linux", "name": "Cortex Linux", "versionInfo": "${VERSION}", "licenseConcluded": "BUSL-1.1", "downloadLocation": "https://cortexlinux.com"}, + {"SPDXID": "SPDXRef-cortex-core", "name": "cortex-core", "versionInfo": "${VERSION}", "licenseConcluded": "BUSL-1.1", "downloadLocation": "https://repo.cortexlinux.com"},
🤖 Fix all issues with AI agents
In `@README.md`:
- Line 234: Several source files still carry the old Apache-2.0 SPDX header;
search the listed files (e.g., iso/preseed/cortex.preseed,
packages/cortex-core/* (cortex-verify.py, cortex-upgrade.py, cortex-gpu.py,
config/*, debian/rules), packages/cortex-full/debian/rules,
iso/live-build/auto/*, iso/live-build/config/*, Makefile,
packages/cortex-archive-keyring/debian/rules) for the existing SPDX line (e.g.,
"SPDX-License-Identifier: Apache-2.0") and replace it with the exact header
"SPDX-License-Identifier: BUSL-1.1" so all files match the LICENSE and README;
ensure the header formatting/placement is preserved in each file and run a quick
grep to verify no Apache-2.0 SPDX lines remain before committing.
| ## License | ||
|
|
||
| Apache 2.0 - See [LICENSE](LICENSE) | ||
| BSL 1.1 - See [LICENSE](LICENSE) |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's verify the README.md license section
git ls-files | grep -i readme
# Get line 234 of README.md if it exists
if [ -f README.md ]; then
echo "=== README.md line 234 ==="
sed -n '234p' README.md
fiRepository: cortexlinux/cortex-distro
Length of output: 138
🏁 Script executed:
#!/bin/bash
# Verify repository-wide license consistency
echo "=== Checking for any remaining Apache-2.0 SPDX headers ==="
rg -c "SPDX-License-Identifier:\s*Apache-2\.0" 2>/dev/null || echo "No matches found"
echo -e "\n=== Checking for any remaining Apache references in documentation ==="
rg -c -i "apache\s*2\.0" -t md 2>/dev/null || echo "No markdown files with Apache 2.0 references"
echo -e "\n=== Checking for BUSL-1.1 headers ==="
rg -c "SPDX-License-Identifier:\s*BUSL-1\.1" 2>/dev/null || echo "No BUSL-1.1 headers found"
echo -e "\n=== Checking LICENSE file content ==="
if [ -f LICENSE ]; then
head -20 LICENSE
else
echo "No LICENSE file found"
fi
echo -e "\n=== Repository files count by type ==="
find . -type f -name "*.md" | wc -l
find . -type f \( -name "*.js" -o -name "*.ts" -o -name "*.go" -o -name "*.py" -o -name "*.java" \) | wc -lRepository: cortexlinux/cortex-distro
Length of output: 1856
License migration incomplete across codebase.
While README.md correctly reflects BSL 1.1 and the LICENSE file is properly configured with BUSL-1.1 terms, 18 source files still retain Apache-2.0 SPDX headers and must be updated to maintain consistency:
- iso/preseed/cortex.preseed
- packages/cortex-full/debian/rules
- packages/cortex-core/cortex-verify.py
- iso/live-build/auto/config
- iso/live-build/auto/build
- packages/cortex-core/cortex-upgrade.py
- iso/live-build/auto/clean
- packages/cortex-archive-keyring/debian/rules
- iso/live-build/config/package-lists/cortex-full.list.chroot
- packages/cortex-core/cortex-gpu.py
- iso/live-build/config/package-lists/cortex-core.list.chroot
- Makefile
- packages/cortex-core/config/provision.yaml.example
- iso/live-build/config/hooks/live/0100-cortex-config.hook.chroot
- packages/cortex-core/config/cortex.yaml
- packages/cortex-core/config/cortex.sources
- packages/cortex-core/config/cortex.pref
- packages/cortex-core/debian/rules
Update all SPDX headers to: SPDX-License-Identifier: BUSL-1.1
🤖 Prompt for AI Agents
In `@README.md` at line 234, Several source files still carry the old Apache-2.0
SPDX header; search the listed files (e.g., iso/preseed/cortex.preseed,
packages/cortex-core/* (cortex-verify.py, cortex-upgrade.py, cortex-gpu.py,
config/*, debian/rules), packages/cortex-full/debian/rules,
iso/live-build/auto/*, iso/live-build/config/*, Makefile,
packages/cortex-archive-keyring/debian/rules) for the existing SPDX line (e.g.,
"SPDX-License-Identifier: Apache-2.0") and replace it with the exact header
"SPDX-License-Identifier: BUSL-1.1" so all files match the LICENSE and README;
ensure the header formatting/placement is preserved in each file and run a quick
grep to verify no Apache-2.0 SPDX lines remain before committing.
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
iso/live-build/auto/config (1)
4-5: Update SPDX header to BUSL-1.1 to match the new license.This script still declares Apache-2.0, which conflicts with the PR objective to update all scripts to BUSL-1.1.
🛠️ Proposed fix
-# SPDX-License-Identifier: Apache-2.0 +# SPDX-License-Identifier: BUSL-1.1
🤖 Fix all issues with AI agents
In `@iso/live-build/auto/config`:
- Around line 59-63: The script writes to
config/package-lists/debootstrap-includes.list.chroot but only ensures the
parent config directory exists (mkdir -p config), so the echo will fail when
config/package-lists doesn't exist; update the setup to create the package-lists
directory (e.g., run mkdir -p config/package-lists) before writing to
config/package-lists/debootstrap-includes.list.chroot so the echo succeeds under
set -e.
- Change Date: January 15, 2030 → January 15, 2032 - Update README badge from Apache 2.0 to BSL 1.1 - Update SPDX headers in all scripts
Ubuntu 24.04 requires build-essential:native for dpkg-buildpackage. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Modern debhelper uses debhelper-compat build-dependency in debian/control. Having both debian/compat and debhelper-compat causes build failure. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Removed deprecated options not supported by live-build on Ubuntu 24.04: - --bootloaders (use config files instead) - --updates (use apt config) - --color (not supported) - --debootstrap-options (moved to config/debootstrap) - --image-name (not supported) - --quiet/--verbose (not supported) Debootstrap includes now configured via package list file. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Debian Trixie (testing) doesn't have separate security or backports repositories - security updates are rolled into the main testing repo. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
mikejmorgan-ai
force-pushed
the
fix/license-6-year-update
branch
from
9bddfc5 to
ff4d1c2
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
iso/live-build/auto/config (1)
14-31: Document the reason for disabling security/backports on Trixie.The
--security falseand--backports falseflags do omit security updates from the build. Git history shows this was intentional for Trixie (testing distribution), which is reasonable since testing receives frequent updates. However, add an inline comment explaining this choice for future maintainers. If other Debian releases (stable, bookworm) are planned, consider gating this behavior by distribution type rather than hardcoding it.
♻️ Duplicate comments (3)
sbom/generate-sbom.sh (1)
40-40: SBOM still emits Apache-2.0 license IDs.
Line 40 and Lines 66–67 still hardcode Apache-2.0, so generated SBOMs will be incorrect for BUSL-1.1.🛠️ Proposed fix
- "licenses": [{"license": {"id": "Apache-2.0"}}] + "licenses": [{"license": {"id": "BUSL-1.1"}}] ... - {"SPDXID": "SPDXRef-cortex-linux", "name": "Cortex Linux", "versionInfo": "${VERSION}", "licenseConcluded": "Apache-2.0", "downloadLocation": "https://cortexlinux.com"}, - {"SPDXID": "SPDXRef-cortex-core", "name": "cortex-core", "versionInfo": "${VERSION}", "licenseConcluded": "Apache-2.0", "downloadLocation": "https://repo.cortexlinux.com"}, + {"SPDXID": "SPDXRef-cortex-linux", "name": "Cortex Linux", "versionInfo": "${VERSION}", "licenseConcluded": "BUSL-1.1", "downloadLocation": "https://cortexlinux.com"}, + {"SPDXID": "SPDXRef-cortex-core", "name": "cortex-core", "versionInfo": "${VERSION}", "licenseConcluded": "BUSL-1.1", "downloadLocation": "https://repo.cortexlinux.com"},Also applies to: 66-67
iso/live-build/auto/config (2)
5-5: SPDX header still Apache-2.0 — update to BUSL-1.1.
This script’s header is out of sync with the repo-wide license change.🛠️ Proposed fix
-# SPDX-License-Identifier: Apache-2.0 +# SPDX-License-Identifier: BUSL-1.1
59-63: Createconfig/package-listsbefore writing into it.
Withset -e, Line 62 fails if the directory doesn’t exist.🛠️ Proposed fix
-mkdir -p config +mkdir -p config config/package-lists
The minbase variant doesn't include gnupg, causing apt-get to fail when verifying package signatures during chroot setup. - Add gnupg and debian-archive-keyring to debootstrap --include - Add gnupg and debian-archive-keyring to workflow dependencies Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Change distribution from trixie (testing) to bookworm (stable) - Trixie lacks proper GPG package availability in minbase - Re-enable security and backports repos (available in bookworm) - Use Docker-based builds for consistency with ini-2 branch - Build packages and ISO inside debian:bookworm container This resolves the 'gpg: No such file or directory' error during apt signature verification in the chroot. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove --cache-stages true (invalid stage value) - Remove --initramfs-compression xz (not supported in bookworm) These options don't exist in Debian bookworm's live-build 1:20230502. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
iso/live-build/auto/config (1)
1-5: Update SPDX header to BUSL-1.1 for license consistency.PR objectives call for BUSL-1.1 across scripts, but this header still declares Apache-2.0, creating mixed licensing metadata.
🛠️ Proposed fix
-# SPDX-License-Identifier: Apache-2.0 +# SPDX-License-Identifier: BUSL-1.1.github/workflows/build-iso.yml (1)
1-4: Update SPDX header to BUSL-1.1 for license consistency.This workflow header still declares Apache-2.0 while the PR objective is BUSL-1.1.
🛠️ Proposed fix
-# SPDX-License-Identifier: Apache-2.0 +# SPDX-License-Identifier: BUSL-1.1
🤖 Fix all issues with AI agents
In @.github/workflows/build-iso.yml:
- Around line 103-132: The pipeline masks failures from the lb build step
because the shell lacks pipefail; ensure the build failure is propagated by
enabling pipefail before running lb build (e.g., add set -o pipefail in the same
shell block where lb build is run) or wrap the lb build invocation so a non-zero
exit from lb build causes the script to exit non-zero (e.g., check the exit
status of lb build piped to tee). Target the shell block that runs the lb build
command (the segment containing lb build 2>&1 | tee /workspace/build.log) and
modify it to enable pipefail or explicitly fail on lb build errors.
- Around line 76-85: The workflow step "Free disk space" currently uses the
mutable action reference jlumbroso/free-disk-space@main; replace the `@main` ref
with a specific commit SHA for that action (e.g.
jlumbroso/free-disk-space@<COMMIT_SHA>) so the action is immutable, and add a
comment next to the SHA noting the corresponding release tag (e.g. // tag:
vX.Y.Z) for future tracking; ensure Dependabot configuration can detect and
suggest updates when you change the SHA.
| - name: Free disk space | ||
| uses: jlumbroso/free-disk-space@main | ||
| with: | ||
| tool-cache: true | ||
| android: true | ||
| dotnet: true | ||
| haskell: true | ||
| large-packages: true | ||
| docker-images: false | ||
| swap-storage: true |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/build-iso.yml | sed -n '70,90p'Repository: cortexlinux/cortex-distro
Length of output: 697
🌐 Web query:
GitHub Actions version pinning commit SHA best practices supply chain security
💡 Result:
Short best-practices for pinning GitHub Actions to commit SHAs (supply‑chain security):
-
Pin to a full-length commit SHA (not
@main/@tag) so the action code is immutable for your workflow. Verify the SHA originates from the action’s official repo (not a fork). [1][4] -
Prefer SHAs that correspond to official tagged releases (and comment the tag/version in the workflow) so Dependabot can recommend updates while retaining immutability. [1]
-
Audit the action’s source for mutable dependencies (unpinned container images, scripts that download code at runtime, composite actions that pull external code) — pinning SHA does not help if the action itself fetches mutable artifacts. Reject “unpinnable” actions. [1][2][4]
-
Enforce SHA pinning and blocklists at org/enterprise level (Allowed actions & reusable workflows policy) so non-pinned or known-malicious actions fail policy checks. Use explicit block entries for compromised actions. [1][3][4]
-
Use Dependabot (or similar) to surface outdated/vulnerable actions, but note Dependabot alerts behave differently for SHA-pinned dependencies — prefer SHAs tied to tags to keep update signals. [1]
-
Minimize risk via least-privilege: narrow GITHUB_TOKEN permissions, require environment approvals for prod workflows, and rotate/separate secrets accessible to Actions. Monitor for exfiltration patterns. [1][4]
-
Add operational controls: workflow review/PR gating, automated checks (e.g., “ensure SHA pinned” linter/action), CI audits of used actions, and alerting for new external references. [3]
-
When available, prefer vendor-provided “immutable releases” (GitHub immutable releases / verified creators) so you can safely pin to semantic versions instead of raw SHAs. Still verify provenance. [1][5]
Trade-offs / notes:
- SHAs maximize integrity but cost maintainability (manual updates). Tag+SHA comment is a practical compromise to get Dependabot help. [1]
- SHA pinning can’t fully protect if the action downloads mutable artifacts at runtime — inspect runtime behavior. [2]
- Enforce org policies and monitoring to respond quickly if a widely-used action is compromised. [3]
Sources: GitHub Well‑Architected / Actions security guidance; GitHub Docs (secure use & allowed actions); GitHub changelog on SHA enforcement; industry analysis of “unpinnable” actions; marketplace/tools for enforcing SHA pinning. [1][4][3][2][3]
Pin jlumbroso/free-disk-space to a commit SHA.
Using @main is mutable and weakens supply-chain security. Pin to a trusted commit SHA tied to an official release tag (comment the tag in the workflow) so the action code is immutable and Dependabot can track updates.
🛠️ Proposed fix
- uses: jlumbroso/free-disk-space@main
+ uses: jlumbroso/free-disk-space@<PINNED_SHA>🤖 Prompt for AI Agents
In @.github/workflows/build-iso.yml around lines 76 - 85, The workflow step
"Free disk space" currently uses the mutable action reference
jlumbroso/free-disk-space@main; replace the `@main` ref with a specific commit SHA
for that action (e.g. jlumbroso/free-disk-space@<COMMIT_SHA>) so the action is
immutable, and add a comment next to the SHA noting the corresponding release
tag (e.g. // tag: vX.Y.Z) for future tracking; ensure Dependabot configuration
can detect and suggest updates when you change the SHA.
| debian:bookworm /bin/bash -c ' | ||
| set -e | ||
| echo "=== Installing build dependencies ===" | ||
| apt-get update | ||
| apt-get install -y \ | ||
| live-build \ | ||
| debootstrap \ | ||
| squashfs-tools \ | ||
| xorriso \ | ||
| isolinux \ | ||
| syslinux-efi \ | ||
| grub-pc-bin \ | ||
| grub-efi-amd64-bin \ | ||
| mtools \ | ||
| dosfstools \ | ||
| gnupg \ | ||
| debian-archive-keyring | ||
| echo "=== Configuring live-build ===" | ||
| cd /workspace/iso/live-build | ||
| chmod +x auto/* 2>/dev/null || true | ||
| lb config | ||
| echo "=== Copying packages to chroot ===" | ||
| mkdir -p config/packages.chroot/ | ||
| cp /workspace/packages/*.deb config/packages.chroot/ 2>/dev/null || echo "No packages to copy" | ||
| echo "=== Building ISO ===" | ||
| lb build 2>&1 | tee /workspace/build.log | ||
There was a problem hiding this comment.
Ensure lb build failure is not masked by tee.
Without pipefail, a failing build can still appear successful when piped.
🛠️ Proposed fix
- set -e
+ set -e
+ set -o pipefail📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| debian:bookworm /bin/bash -c ' | |
| set -e | |
| echo "=== Installing build dependencies ===" | |
| apt-get update | |
| apt-get install -y \ | |
| live-build \ | |
| debootstrap \ | |
| squashfs-tools \ | |
| xorriso \ | |
| isolinux \ | |
| syslinux-efi \ | |
| grub-pc-bin \ | |
| grub-efi-amd64-bin \ | |
| mtools \ | |
| dosfstools \ | |
| gnupg \ | |
| debian-archive-keyring | |
| echo "=== Configuring live-build ===" | |
| cd /workspace/iso/live-build | |
| chmod +x auto/* 2>/dev/null || true | |
| lb config | |
| echo "=== Copying packages to chroot ===" | |
| mkdir -p config/packages.chroot/ | |
| cp /workspace/packages/*.deb config/packages.chroot/ 2>/dev/null || echo "No packages to copy" | |
| echo "=== Building ISO ===" | |
| lb build 2>&1 | tee /workspace/build.log | |
| debian:bookworm /bin/bash -c ' | |
| set -e | |
| set -o pipefail | |
| echo "=== Installing build dependencies ===" | |
| apt-get update | |
| apt-get install -y \ | |
| live-build \ | |
| debootstrap \ | |
| squashfs-tools \ | |
| xorriso \ | |
| isolinux \ | |
| syslinux-efi \ | |
| grub-pc-bin \ | |
| grub-efi-amd64-bin \ | |
| mtools \ | |
| dosfstools \ | |
| gnupg \ | |
| debian-archive-keyring | |
| echo "=== Configuring live-build ===" | |
| cd /workspace/iso/live-build | |
| chmod +x auto/* 2>/dev/null || true | |
| lb config | |
| echo "=== Copying packages to chroot ===" | |
| mkdir -p config/packages.chroot/ | |
| cp /workspace/packages/*.deb config/packages.chroot/ 2>/dev/null || echo "No packages to copy" | |
| echo "=== Building ISO ===" | |
| lb build 2>&1 | tee /workspace/build.log | |
🤖 Prompt for AI Agents
In @.github/workflows/build-iso.yml around lines 103 - 132, The pipeline masks
failures from the lb build step because the shell lacks pipefail; ensure the
build failure is propagated by enabling pipefail before running lb build (e.g.,
add set -o pipefail in the same shell block where lb build is run) or wrap the
lb build invocation so a non-zero exit from lb build causes the script to exit
non-zero (e.g., check the exit status of lb build piped to tee). Target the
shell block that runs the lb build command (the segment containing lb build 2>&1
| tee /workspace/build.log) and modify it to enable pipefail or explicitly fail
on lb build errors.
Remove package copying to config/packages.chroot/ which causes permission errors when live-build creates the local apt repository. The custom Cortex packages can be installed post-boot or via a separate package repository once the base ISO build succeeds. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
iso/live-build/auto/config (1)
4-5: Update SPDX header to BUSL-1.1 to match the new license.This file still declares
Apache-2.0, which contradicts the PR objective to update scripts to BUSL-1.1 and creates license inconsistency.🛠️ Proposed fix
-# SPDX-License-Identifier: Apache-2.0 +# SPDX-License-Identifier: BUSL-1.1
🤖 Fix all issues with AI agents
In `@iso/live-build/auto/config`:
- Line 15: Update the stale comment string "# Ubuntu 24.04 compatible live-build
options" to reflect the actual target distro (e.g., "Debian Bookworm compatible
live-build options" or a neutral "Debian (bookworm) compatible live-build
options") so the top-of-file comment in the auto/config matches the script's
configuration; locate and edit the exact comment line shown ("# Ubuntu 24.04
compatible live-build options") and replace the text accordingly.
| ARCH="amd64" | ||
| VERSION="0.1.0" | ||
|
|
||
| # Ubuntu 24.04 compatible live-build options |
There was a problem hiding this comment.
Fix stale Ubuntu reference in comment.
The comment says “Ubuntu 24.04” but the script is configured for Debian bookworm, which can mislead maintainers.
📝 Suggested update
-# Ubuntu 24.04 compatible live-build options
+# Debian bookworm live-build options📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # Ubuntu 24.04 compatible live-build options | |
| # Debian bookworm live-build options |
🤖 Prompt for AI Agents
In `@iso/live-build/auto/config` at line 15, Update the stale comment string "#
Ubuntu 24.04 compatible live-build options" to reflect the actual target distro
(e.g., "Debian Bookworm compatible live-build options" or a neutral "Debian
(bookworm) compatible live-build options") so the top-of-file comment in the
auto/config matches the script's configuration; locate and edit the exact
comment line shown ("# Ubuntu 24.04 compatible live-build options") and replace
the text accordingly.
Changes
Why
Per founder decision: 6-year conversion period provides longer commercial protection while still guaranteeing eventual open source release.
Verification
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.