hakurei, branch v0.3.3low-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/?h=v0.3.32025-12-15T11:34:45Zrelease: 0.3.32025-12-15T11:34:45ZOphestracat@gensokyo.uk2025-12-15T11:34:45Zurn:sha1:8cb0b433b283e7b6e4aa258d408d116d891e279f
Signed-off-by: Ophestra <cat@gensokyo.uk>
test: check shim private dir cleanup2025-12-15T11:30:19ZOphestracat@gensokyo.uk2025-12-15T11:14:39Zurn:sha1:767f1844d222bdd5afc99868df7b5b42e7e2fad4
This asserts that no shim private dir was left behind after all containers terminate.
Signed-off-by: Ophestra <cat@gensokyo.uk>
internal/outcome: expose pipewire via pipewire-pulse2025-12-15T03:57:06ZOphestracat@gensokyo.uk2025-12-15T03:43:58Zurn:sha1:54610aaddcc01e335c34087bc0c3bc1de6d23cf8
This no longer exposes the pipewire socket to the container, and instead mediates access via pipewire-pulse. This makes insecure parts of the protocol inaccessible as explained in the doc comment in hst.
Closes #29.
Signed-off-by: Ophestra <cat@gensokyo.uk>
internal/outcome: look up pipewire-pulse path2025-12-15T03:38:39ZOphestracat@gensokyo.uk2025-12-15T03:35:43Zurn:sha1:2e806601693e0262641386ce5430d7e8d84b2a77
This is for setting up the pipewire-pulse container in shim, for #29.
Signed-off-by: Ophestra <cat@gensokyo.uk>
internal/outcome: optional shim private dir2025-12-15T03:32:46ZOphestracat@gensokyo.uk2025-12-15T03:32:05Zurn:sha1:d0a3c6a2f3ac4da3921fa525cf1ee5ea7d68eb1c
This is a private work directory owned by the specific shim. Useful for sockets owned by this instance of the shim and requires no direct assistance from the priv-side process.
Signed-off-by: Ophestra <cat@gensokyo.uk>
hst: add direct hardware option2025-12-15T03:29:32ZOphestracat@gensokyo.uk2025-12-15T03:29:32Zurn:sha1:0c0e3d6fc2bf37eef703e9295fc56ef2a2fc5808
This is unfortunately the only possible setup to securely expose PipeWire to the container. Further explanation explained in the doc comment and #29.
This will be implemented in a future commit.
Signed-off-by: Ophestra <cat@gensokyo.uk>
container: sync stubbed wait4 loop after notify2025-12-14T01:22:48ZOphestracat@gensokyo.uk2025-12-14T01:22:48Zurn:sha1:fae910a1ad0a107a2d3cd49011430c857838d2a8
This ensures consistent state observed by wait4 loop when running against stub.
Signed-off-by: Ophestra <cat@gensokyo.uk>
internal/pipewire: handle SecurityContext::Create error2025-12-14T00:41:28ZOphestracat@gensokyo.uk2025-12-14T00:41:28Zurn:sha1:178c8bc28bc7ff5efc63415796c0c79e649b3cd7
This method can result in an error targeting it, so it is handled here. This change also causes a call to Create to also Core::Sync, as it should have done.
Signed-off-by: Ophestra <cat@gensokyo.uk>
internal/pipewire: SecurityContext as destructible2025-12-14T00:31:50ZOphestracat@gensokyo.uk2025-12-14T00:31:50Zurn:sha1:30dcab07340610bfd6d015e10022b9ca2a27bb51
This proxy can be destroyed by sending a Core::Destroy targeting it. This change implements the Destroy method by embedding destructible.
Signed-off-by: Ophestra <cat@gensokyo.uk>
internal/pipewire: reorder context struct2025-12-14T00:26:30ZOphestracat@gensokyo.uk2025-12-14T00:26:30Zurn:sha1:0ea051062b127717bba2b28870a50f62825b55c4
This change reorders and groups struct elements. This improves readability since this struct holds a lot of state loosely related to each other.
Signed-off-by: Ophestra <cat@gensokyo.uk>