Building x0ne OS from source
Works today (measured 2026-10-09). Every target below exists today. The source repository is not published yet.
Build the packages, the repository and the images yourself. Every step runs in a throwaway container.
Prerequisites
- podman (rootless is fine), make, git.
- KVM for the boot tests, optional.
- Nothing is installed on the host.
Build and test everything
$ make all $ make test $ make status
make all builds packages, the signed repository, the OCI image, the qcow2 and the microVM, then runs every test suite.
Targets
| Target | Does |
|---|---|
| make build | The metapackages (.deb). |
| make repo | The signed apt repository. |
| make oci | The OCI image x0ne-os:base. |
| make qcow2 | The bootable amd64 qcow2. |
| make microvm | The microVM image: root filesystem, kernel, initrd. |
| make vmm | The image with QEMU, Firecracker and Cloud Hypervisor. |
| make iso | The live ISO and the installer ISO, hybrid BIOS and UEFI, with SBOM and SHA256SUMS signed by the test key. |
| make test-acceptance | Landing spec, lightness, images, agent user. |
| make test-security | Packages, repository, images, supply chain. |
| make test-public | Secrets, internal names, licence, commits. |
| make test-iso | The live ISO: layout, Secure Boot chain, security, signatures, boots. |
| make bench-boot | Boot time, 20 boots each: QEMU microvm, Firecracker, UEFI qcow2. |
| make run, make run-microvm | Boot the qcow2 or the microVM on the serial console. The first boot asks for your account. |
| make byol, make byoi | The OVHcloud images: Bring Your Own Linux, and the encrypted one. |
| make installer-auto | An unattended installer ISO for one host, with its SSH key. |
| make test-byoi, make test-installer-auto | The OVHcloud encrypted image, and the unattended installer. |
| make debug-qcow2 | Test only: boot the qcow2 to a shell, nothing saved. |
| make clean | Remove out/, keep the test key. |
| make help | Every target. |
Expected output
Results land in out/results/SUITE.json. Last runs:
| Suite | Date | Pass | Expected failures | Skipped |
|---|---|---|---|---|
| acceptance | 2026-10-12 | 91 | 7 | 3 |
| security | 2026-10-11 | 61 | 1 | 0 |
| public | 2026-10-11 | 16 | 2 | 0 |
| iso | 2026-10-11 | 44 | 1 | 0 |
| byoi | 2026-10-11 | 36 | 0 | 0 |
| auto | 2026-10-11 | 32 | 0 | 0 |
| autoi | 2026-10-10 | 7 | 0 | 0 |
Seven suites: 287 pass, 11 expected failures, 3 skipped.
Expected failures name what is missing, for example llama.cpp not in Debian 13. Skipped tests wait for a released image.
Signing key
The first build makes a throwaway test key in .test-key/. It is git-ignored and never released.
How to verify
Build twice with the same SOURCE_DATE_EPOCH: the .deb files are byte-identical.
How to undo
$ make cleanContainers and images are named x0ne-os-*. Remove them by name, never with a prune.