From b7a7fdc4b8a715157bfa2614c9541b96643cd2ba Mon Sep 17 00:00:00 2001
From: Andrey Smirnov <andrey.smirnov@siderolabs.com>
Date: Thu, 26 Dec 2024 19:41:53 +0400
Subject: [PATCH] refactor: generate /etc/os-release file static way

The file which is exported back to source via `make generate` is using
short tag (vX.Y.Z), while the one generated for the actual build comes
with full version tag.

Fixes #8898

Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
---
 Dockerfile                                    | 84 ++++++++++---------
 Makefile                                      |  4 +-
 .../app/machined/pkg/startup/os_release.go    | 60 -------------
 internal/app/machined/pkg/startup/startup.go  |  1 -
 pkg/machinery/version/gen.go                  | 25 ++++++
 pkg/machinery/version/os-release              |  8 ++
 pkg/machinery/version/osrelease.go            |  2 +
 7 files changed, 83 insertions(+), 101 deletions(-)
 delete mode 100644 internal/app/machined/pkg/startup/os_release.go
 create mode 100644 pkg/machinery/version/gen.go
 create mode 100644 pkg/machinery/version/os-release

diff --git a/Dockerfile b/Dockerfile
index 999d34018b..2e377a47ce 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -48,6 +48,8 @@ ARG PKG_TALOSCTL_CNI_BUNDLE_INSTALL=scratch
 
 ARG DEBUG_TOOLS_SOURCE=scratch
 
+ARG EMBED_TARGET=embed
+
 # Resolve package images using ${PKGS} to be used later in COPY --from=.
 
 FROM ${PKG_FHS} AS pkg-fhs
@@ -285,6 +287,43 @@ RUN --mount=type=cache,target=/.cache go mod verify
 
 # The generate target generates code from protobuf service definitions and machinery config.
 
+FROM build AS embed-generate
+ARG NAME
+ARG SHA
+ARG USERNAME
+ARG REGISTRY
+ARG TAG
+ARG ARTIFACTS
+ARG PKGS
+ARG EXTRAS
+RUN mkdir -p pkg/machinery/gendata/data && \
+    echo -n ${NAME} > pkg/machinery/gendata/data/name && \
+    echo -n ${SHA} > pkg/machinery/gendata/data/sha && \
+    echo -n ${USERNAME} > pkg/machinery/gendata/data/username && \
+    echo -n ${REGISTRY} > pkg/machinery/gendata/data/registry && \
+    echo -n ${EXTRAS} > pkg/machinery/gendata/data/extras && \
+    echo -n ${PKGS} > pkg/machinery/gendata/data/pkgs && \
+    echo -n ${TAG} > pkg/machinery/gendata/data/tag && \
+    echo -n ${ARTIFACTS} > pkg/machinery/gendata/data/artifacts
+
+FROM scratch AS embed
+COPY --from=embed-generate /src/pkg/machinery/gendata/data /pkg/machinery/gendata/data
+
+FROM embed-generate AS embed-abbrev-generate
+ARG ABBREV_TAG
+RUN echo -n "undefined" > pkg/machinery/gendata/data/sha && \
+    echo -n ${ABBREV_TAG} > pkg/machinery/gendata/data/tag
+RUN mkdir -p _out && \
+    echo PKGS=${PKGS} >> _out/talos-metadata && \
+    echo TAG=${TAG} >> _out/talos-metadata && \
+    echo EXTRAS=${EXTRAS} >> _out/talos-metadata
+
+FROM scratch AS embed-abbrev
+COPY --from=embed-abbrev-generate /src/pkg/machinery/gendata/data /pkg/machinery/gendata/data
+COPY --from=embed-abbrev-generate /src/_out/talos-metadata /_out/talos-metadata
+
+FROM ${EMBED_TARGET} AS embed-target
+
 # generate API descriptors
 FROM build AS api-descriptors-build
 WORKDIR /src/api
@@ -308,6 +347,7 @@ COPY --from=proto-format-build /src/api/ /api/
 FROM build-go AS go-generate
 COPY ./pkg ./pkg
 COPY ./hack/boilerplate.txt ./hack/boilerplate.txt
+COPY --from=embed-target / ./
 RUN --mount=type=cache,target=/.cache go generate ./pkg/...
 RUN goimports -w -local github.com/siderolabs/talos ./pkg/
 RUN gofumpt -w ./pkg/
@@ -350,43 +390,6 @@ RUN find /api/resource/definitions/ -type f -name "*.proto" | xargs -I {} /bin/s
 RUN goimports -w -local github.com/siderolabs/talos /api/
 RUN gofumpt -w /api/
 
-FROM build AS embed-generate
-ARG NAME
-ARG SHA
-ARG USERNAME
-ARG REGISTRY
-ARG TAG
-ARG ARTIFACTS
-ARG PKGS
-ARG EXTRAS
-RUN mkdir -p pkg/machinery/gendata/data && \
-    echo -n ${NAME} > pkg/machinery/gendata/data/name && \
-    echo -n ${SHA} > pkg/machinery/gendata/data/sha && \
-    echo -n ${USERNAME} > pkg/machinery/gendata/data/username && \
-    echo -n ${REGISTRY} > pkg/machinery/gendata/data/registry && \
-    echo -n ${EXTRAS} > pkg/machinery/gendata/data/extras && \
-    echo -n ${PKGS} > pkg/machinery/gendata/data/pkgs && \
-    echo -n ${TAG} > pkg/machinery/gendata/data/tag && \
-    echo -n ${ARTIFACTS} > pkg/machinery/gendata/data/artifacts
-
-FROM scratch AS embed
-COPY --from=embed-generate /src/pkg/machinery/gendata/data /pkg/machinery/gendata/data
-
-FROM embed-generate AS embed-abbrev-generate
-ARG ABBREV_TAG
-RUN echo -n "undefined" > pkg/machinery/gendata/data/sha && \
-    echo -n ${ABBREV_TAG} > pkg/machinery/gendata/data/tag
-RUN mkdir -p _out && \
-    echo PKGS=${PKGS} >> _out/talos-metadata && \
-    echo TAG=${TAG} >> _out/talos-metadata && \
-    echo EXTRAS=${EXTRAS} >> _out/talos-metadata
-COPY --from=pkg-kernel /certs/signing_key.x509 _out/signing_key.x509
-
-FROM scratch AS embed-abbrev
-COPY --from=embed-abbrev-generate /src/pkg/machinery/gendata/data /pkg/machinery/gendata/data
-COPY --from=embed-abbrev-generate /src/_out/talos-metadata /_out/talos-metadata
-COPY --from=embed-abbrev-generate /src/_out/signing_key.x509 /_out/signing_key.x509
-
 FROM tools AS selinux
 COPY ./internal/pkg/selinux/policy/* /selinux/
 RUN mkdir /policy; secilc -o /policy/policy.33 -f /policy/file_contexts -c 33 /selinux/**/*.cil -vvvvv -O
@@ -430,6 +433,7 @@ COPY --from=go-generate /src/pkg/machinery/config/schemas/ /pkg/machinery/config
 COPY --from=go-generate /src/pkg/machinery/config/types/ /pkg/machinery/config/types/
 COPY --from=go-generate /src/pkg/machinery/nethelpers/ /pkg/machinery/nethelpers/
 COPY --from=go-generate /src/pkg/machinery/extensions/ /pkg/machinery/extensions/
+COPY --from=go-generate /src/pkg/machinery/version/os-release /pkg/machinery/version/os-release
 COPY --from=ipxe-generate / /pkg/provision/providers/vm/internal/ipxe/data/ipxe/
 COPY --from=selinux-generate / /internal/pkg/selinux/
 COPY --from=embed-abbrev / /
@@ -743,9 +747,10 @@ COPY --chmod=0644 hack/cri-plugin.part /rootfs/etc/cri/conf.d/00-base.part
 COPY --chmod=0644 hack/udevd/99-default.link /rootfs/usr/lib/systemd/network/
 COPY --chmod=0644 hack/udevd/90-selinux.rules /rootfs/usr/lib/udev/rules.d/
 COPY --chmod=0644 hack/lvm.conf /rootfs/etc/lvm/lvm.conf
+COPY --chmod=0644 --from=base /src/pkg/machinery/version/os-release /rootfs/etc/os-release
 RUN <<END
     ln -s /usr/share/zoneinfo/Etc/UTC /rootfs/etc/localtime
-    touch /rootfs/etc/{extensions.yaml,resolv.conf,hosts,os-release,machine-id,cri/conf.d/cri.toml,cri/conf.d/01-registries.part,cri/conf.d/20-customization.part,cri/conf.d/base-spec.json,ssl/certs/ca-certificates,selinux/targeted/contexts/files/file_contexts}
+    touch /rootfs/etc/{extensions.yaml,resolv.conf,hosts,machine-id,cri/conf.d/cri.toml,cri/conf.d/01-registries.part,cri/conf.d/20-customization.part,cri/conf.d/base-spec.json,ssl/certs/ca-certificates,selinux/targeted/contexts/files/file_contexts}
     ln -s ca-certificates /rootfs/etc/ssl/certs/ca-certificates.crt
     ln -s /etc/ssl /rootfs/etc/pki
     ln -s /etc/ssl /rootfs/usr/share/ca-certificates
@@ -819,9 +824,10 @@ COPY --chmod=0644 hack/cri-plugin.part /rootfs/etc/cri/conf.d/00-base.part
 COPY --chmod=0644 hack/udevd/99-default.link /rootfs/usr/lib/systemd/network/
 COPY --chmod=0644 hack/udevd/90-selinux.rules /rootfs/usr/lib/udev/rules.d/
 COPY --chmod=0644 hack/lvm.conf /rootfs/etc/lvm/lvm.conf
+COPY --chmod=0644 --from=base /src/pkg/machinery/version/os-release /rootfs/etc/os-release
 RUN <<END
     ln -s /usr/share/zoneinfo/Etc/UTC /rootfs/etc/localtime
-    touch /rootfs/etc/{extensions.yaml,resolv.conf,hosts,os-release,machine-id,cri/conf.d/cri.toml,cri/conf.d/01-registries.part,cri/conf.d/20-customization.part,cri/conf.d/base-spec.json,ssl/certs/ca-certificates,selinux/targeted/contexts/files/file_contexts}
+    touch /rootfs/etc/{extensions.yaml,resolv.conf,hosts,machine-id,cri/conf.d/cri.toml,cri/conf.d/01-registries.part,cri/conf.d/20-customization.part,cri/conf.d/base-spec.json,ssl/certs/ca-certificates,selinux/targeted/contexts/files/file_contexts}
     ln -s /etc/ssl /rootfs/etc/pki
     ln -s ca-certificates /rootfs/etc/ssl/certs/ca-certificates.crt
     ln -s /etc/ssl /rootfs/usr/share/ca-certificates
diff --git a/Makefile b/Makefile
index 6602b55792..82bf36ae30 100644
--- a/Makefile
+++ b/Makefile
@@ -20,6 +20,7 @@ ARTIFACTS := _out
 TOOLS ?= ghcr.io/siderolabs/tools:v1.10.0-alpha.0-3-g0393558
 
 DEBUG_TOOLS_SOURCE := scratch
+EMBED_TARGET ?= embed
 
 PKGS_PREFIX ?= ghcr.io/siderolabs
 PKGS ?= v1.10.0-alpha.0-18-ge7eddcf
@@ -199,6 +200,7 @@ COMMON_ARGS += --build-arg=TOOLS=$(TOOLS)
 COMMON_ARGS += --build-arg=DEBUG_TOOLS_SOURCE=$(DEBUG_TOOLS_SOURCE)
 COMMON_ARGS += --build-arg=PKGS=$(PKGS)
 COMMON_ARGS += --build-arg=EXTRAS=$(EXTRAS)
+COMMON_ARGS += --build-arg=EMBED_TARGET=$(EMBED_TARGET)
 COMMON_ARGS += --build-arg=GOFUMPT_VERSION=$(GOFUMPT_VERSION)
 COMMON_ARGS += --build-arg=GOIMPORTS_VERSION=$(GOIMPORTS_VERSION)
 COMMON_ARGS += --build-arg=STRINGER_VERSION=$(STRINGER_VERSION)
@@ -356,7 +358,7 @@ hack-test-%: ## Runs the specified script in ./hack/test with well known environ
 
 .PHONY: generate
 generate: ## Generates code from protobuf service definitions and machinery config.
-	@$(MAKE) local-$@ DEST=./ PLATFORM=linux/amd64
+	@$(MAKE) local-$@ DEST=./ PLATFORM=linux/amd64 EMBED_TARGET=embed-abbrev
 
 .PHONY: docs
 docs: ## Generates the documentation for machine config, and talosctl.
diff --git a/internal/app/machined/pkg/startup/os_release.go b/internal/app/machined/pkg/startup/os_release.go
deleted file mode 100644
index 2f44189a6a..0000000000
--- a/internal/app/machined/pkg/startup/os_release.go
+++ /dev/null
@@ -1,60 +0,0 @@
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-package startup
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"go.uber.org/zap"
-	"golang.org/x/sys/unix"
-
-	"github.com/siderolabs/talos/internal/app/machined/pkg/runtime"
-	"github.com/siderolabs/talos/pkg/machinery/constants"
-	"github.com/siderolabs/talos/pkg/machinery/version"
-)
-
-// OSRelease renders a valid /etc/os-release file and writes it to disk.
-//
-// The node's OS Image field is reported by the node from /etc/os-release.
-func OSRelease(ctx context.Context, log *zap.Logger, rt runtime.Runtime, next NextTaskFunc) error {
-	if err := createBindMount(filepath.Join(constants.SystemEtcPath, "os-release"), "/etc/os-release"); err != nil {
-		return err
-	}
-
-	contents, err := version.OSRelease()
-	if err != nil {
-		return err
-	}
-
-	if err = os.WriteFile(filepath.Join(constants.SystemEtcPath, "os-release"), contents, 0o644); err != nil {
-		return fmt.Errorf("failed to write os-release: %w", err)
-	}
-
-	return next()(ctx, log, rt, next)
-}
-
-// createBindMount creates a common way to create a writable source file with a
-// bind mounted destination. This is most commonly used for well known files
-// under /etc that need to be adjusted during startup.
-func createBindMount(src, dst string) (err error) {
-	var f *os.File
-
-	if f, err = os.OpenFile(src, os.O_WRONLY|os.O_CREATE, 0o644); err != nil {
-		return err
-	}
-
-	if err = f.Close(); err != nil {
-		return err
-	}
-
-	if err = unix.Mount(src, dst, "", unix.MS_BIND, ""); err != nil {
-		return fmt.Errorf("failed to create bind mount for %s: %w", dst, err)
-	}
-
-	return nil
-}
diff --git a/internal/app/machined/pkg/startup/startup.go b/internal/app/machined/pkg/startup/startup.go
index 2ebd45ad84..14b695f801 100644
--- a/internal/app/machined/pkg/startup/startup.go
+++ b/internal/app/machined/pkg/startup/startup.go
@@ -46,6 +46,5 @@ func DefaultTasks() []Task {
 		SetEnvironmentVariables,
 		WriteIMAPolicy,
 		CreateSystemCgroups,
-		OSRelease,
 	}
 }
diff --git a/pkg/machinery/version/gen.go b/pkg/machinery/version/gen.go
new file mode 100644
index 0000000000..738743185e
--- /dev/null
+++ b/pkg/machinery/version/gen.go
@@ -0,0 +1,25 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+//go:build generate
+
+package main
+
+import (
+	"log"
+	"os"
+
+	"github.com/siderolabs/talos/pkg/machinery/version"
+)
+
+func main() {
+	data, err := version.OSRelease()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	if err = os.WriteFile("os-release", data, 0o644); err != nil {
+		log.Fatal(err)
+	}
+}
diff --git a/pkg/machinery/version/os-release b/pkg/machinery/version/os-release
new file mode 100644
index 0000000000..b169619b1b
--- /dev/null
+++ b/pkg/machinery/version/os-release
@@ -0,0 +1,8 @@
+NAME="Talos"
+ID=talos
+VERSION_ID=v1.10.0-alpha.0
+PRETTY_NAME="Talos (v1.10.0-alpha.0)"
+HOME_URL="https://www.talos.dev/"
+BUG_REPORT_URL="https://github.com/siderolabs/talos/issues"
+VENDOR_NAME="Sidero Labs"
+VENDOR_URL="https://www.siderolabs.com/"
diff --git a/pkg/machinery/version/osrelease.go b/pkg/machinery/version/osrelease.go
index ab0ef0baa0..89a1fb33b4 100644
--- a/pkg/machinery/version/osrelease.go
+++ b/pkg/machinery/version/osrelease.go
@@ -4,6 +4,8 @@
 
 package version
 
+//go:generate go run ./gen.go
+
 import (
 	"bytes"
 	"strings"