Crucible

Crucible is an experimental ALT Linux RPM build tool written in Rust. It bootstraps an ALT apt-rpm root filesystem, creates a private writable copy for every build, and executes rpmbuild with explicit read-only input and writable output mounts.

Implemented behavior

• Exact HTTPS apt-rpm targets for Sisyphus and p11, including noarch and ALT signing-key selectors.
• Fail-closed rootfs creation: incomplete bootstraps have no ready marker and are never reused.
• Per-build rootfs copies and direct rpmbuild argument execution (no shell interpolation).
• User, mount, PID, UTS, IPC, and optional network namespaces where the kernel permits them.
• CPU/file/process/address-space rlimits, wall-clock timeout, concurrent output draining, and process-group termination.
• A constrained subset of Gear rules: copy/compress/tar/zip/diff. tags, type, and specsubst are rejected.
• Managed rootfs, cache, and repository names are restricted to one safe path component.
• Bash and zsh completion generation.

The following are not claimed as complete: cgroups v2, seccomp, overlayfs snapshots, recursive Gear dependency builds, SRPM input, hooks in the build lifecycle, cache reuse in the build command, fakeroot credential emulation, and an ALT apt-rpm-compatible local repository generator. The repository command requires a successful external createrepo_c/createrepo invocation.

Requirements

• Linux host with curl, GNU tar, and access to registry.altlinux.org. Docker, Podman, and host ALT tools are not required; Crucible downloads and verifies the official sisyphus/alt or p11/alt OCI layers itself.
• Linux namespaces enabled; unprivileged mode requires user namespaces.
• Rust 1.85 or newer. The RPM build is locked and offline, so crate sources must already be vendored or present in Cargo's source cache.

Build and checks

cargo fmt --all -- --check
cargo clippy --all-targets --all-features -- -D warnings
cargo test --all-targets
cargo build --locked --offline

Basic use

crucible init
crucible build --spec package.spec --output results
crucible build --repo-dir . --output results
crucible completions bash
crucible completions zsh

--offline performs no APT update or download. It reports missing BuildRequires from the per-build rootfs. --bb and --bs are mutually exclusive.

Configuration layers are merged in this order: /etc/crucible/config.toml, user config, project crucible.toml, environment, then CLI flags. Invalid environment values are errors.

Security model and limitations

Rootfs creation pulls an official ALT OCI image over TLS, records its immutable SHA-256 repository digest, installs the CA bundle through the image's signed stock ALT repository, and then switches to HTTPS-only configured repositories. ALT apt-rpm, RPM queries, and package scripts execute inside an OCI container; the host package manager and host ALT vendor files are never used. Build inputs are mounted read-only at /build/input (and generated Gear sources at /build/sources), outputs at /build/output, and the build tree is /build/rpm. Host absolute paths are never handed to rpmbuild inside the sandbox.

Namespace and mount availability depends on the host kernel and runner privileges. Crucible fails when required setup fails. Do not use chroot_style = "none" for untrusted builds; it is a debugging mode and provides no isolation.

CI

The repository uses its Forgejo runner workflow for the ALT p11 self-build. The ignored privileged integration test can also be enabled on a Linux host with mount/PID namespace privileges and network access.

License: GPL-3.0-or-later.