pixie-lab 0.2.0__tar.gz → 0.3.0__tar.gz

{pixie_lab-0.2.0 → pixie_lab-0.3.0}/.github/workflows/cicd.yaml

@@ -17,6 +17,14 @@ name: cicd
 #     version cannot be re-uploaded -- so the job gates on every
 #     prior job (test + integration + build-container + build-wheel
 #     + build-media + every PXE chain test) succeeding first.
+#   * ``publish-container``: build + push the appliance image to
+#     ghcr.io/<owner>/pixie (``:<version>`` + ``:latest``), v* tags
+#     only. Before this the image was smoke-built and thrown away, so
+#     the documented ghcr image was never populated by CI.
+#   * ``publish-release``: create the GitHub Release for the tag and
+#     attach the media ``build-media`` produces -- the netboot-pc
+#     live-env bake + the usbboot-pc bootable image + checksums. These
+#     used to live only as ephemeral, login-gated workflow artifacts.
 #
 # First publish (claiming the pixie-lab name) requires a one-time
 # PyPI setup: register a Pending Publisher on https://pypi.org
@@ -602,3 +610,127 @@ jobs:
           # later job is retrying), succeed silently rather than
           # fail.
           skip-existing: true
+
+  publish-container:
+    name: Publish container image to ghcr
+    # Build + push the appliance image to ghcr.io/<owner>/pixie on a
+    # v* tag: ``:<version>`` (the tag minus its leading ``v``) plus
+    # ``:latest``. This is the image the compose deploy runs; before
+    # this the ``build-container`` job only smoke-built it and threw it
+    # away, so ghcr.io/safl/pixie was never populated by CI. Gated on
+    # the whole pipeline like publish-pypi -- never ship an image the
+    # boot-chain tests did not pass against.
+    needs:
+      - test
+      - integration
+      - build-container
+      - build-wheel
+      - build-media
+      - test-pxe
+      - test-pxe-nbdboot
+      - test-pxe-inventory
+      - test-pxe-tui
+      - test-pxe-flash
+      - test-pxe-flash-always
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v6
+      - name: Log in to ghcr.io
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" \
+            | podman login ghcr.io -u "${{ github.actor }}" --password-stdin
+      - name: Build + push image
+        run: |
+          set -eu
+          IMAGE=ghcr.io/${{ github.repository_owner }}/pixie
+          VERSION=${GITHUB_REF_NAME#v}
+          podman build \
+            --build-arg PIXIE_VERSION="$VERSION" \
+            -t "$IMAGE:$VERSION" \
+            -t "$IMAGE:latest" \
+            -f Containerfile .
+          podman push "$IMAGE:$VERSION"
+          podman push "$IMAGE:latest"
+
+  publish-release:
+    name: Publish GitHub Release (media assets)
+    # Attach the media CI already builds -- the netboot-pc live-env
+    # bake (vmlinuz + initrd + squashfs) and the usbboot-pc bootable
+    # image -- to a GitHub Release on v* tags. Before this they only
+    # existed as ephemeral, login-gated workflow artifacts, so an
+    # operator had no released live-env or USB image to download. Same
+    # full-pipeline gate as the other publish jobs.
+    needs:
+      - test
+      - integration
+      - build-container
+      - build-wheel
+      - build-media
+      - test-pxe
+      - test-pxe-nbdboot
+      - test-pxe-inventory
+      - test-pxe-tui
+      - test-pxe-flash
+      - test-pxe-flash-always
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v6
+      - name: Download media artifacts
+        uses: actions/download-artifact@v8
+        with:
+          # Both build-media matrix legs upload under this shape:
+          # ``pixie-netboot-pc-x86_64`` + ``pixie-usbboot-pc-x86_64``.
+          # merge-multiple flattens both into one directory.
+          pattern: pixie-*-pc-x86_64
+          merge-multiple: true
+          path: release-assets
+      - name: List release assets
+        run: ls -la release-assets
+      - name: Assemble live-env fetch tarball
+        # pixie's in-app "Fetch live-env" pulls ONE tarball that unpacks
+        # to vmlinuz + initrd + live.squashfs (see catalog/_live_env.py).
+        # Repackage the netboot-pc trio under those stable names so
+        # ``.../releases/latest/download/pixie-live-env-x86_64.tar.gz``
+        # -- the default PIXIE_LIVE_ENV_SRC -- resolves.
+        run: |
+          set -eu
+          d=$(mktemp -d)
+          cp release-assets/pixie-netboot-pc-x86_64-*.vmlinuz  "$d/vmlinuz"
+          cp release-assets/pixie-netboot-pc-x86_64-*.initrd   "$d/initrd"
+          cp release-assets/pixie-netboot-pc-x86_64-*.squashfs "$d/live.squashfs"
+          tar -C "$d" -czf release-assets/pixie-live-env-x86_64.tar.gz \
+            vmlinuz initrd live.squashfs
+          ( cd release-assets && sha256sum pixie-live-env-x86_64.tar.gz \
+              > pixie-live-env-x86_64.tar.gz.sha256 )
+          # Ship the curated catalog (the netboot-capable nosi subset)
+          # so DEFAULT_CATALOG_URL (.../releases/latest/download/catalog.toml)
+          # resolves and pixie's Import + live-env TUI default work.
+          cp src/pixie/catalog/catalog.toml release-assets/catalog.toml
+          ls -la release-assets
+      - name: Create / update GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: release-assets/*
+          # Fail loud if the glob matched nothing -- a release with no
+          # media is the bug this job exists to prevent.
+          fail_on_unmatched_files: true
+          generate_release_notes: true
+          body: |
+            ## Distribution
+
+            - Container image: `ghcr.io/${{ github.repository_owner }}/pixie:latest` and the matching version tag (this tag without the leading `v`).
+            - Python CLI: `uv tool install pixie-lab` (or `pip install pixie-lab`).
+
+            ## Media assets attached here
+
+            - `pixie-live-env-x86_64.tar.gz` — the live-env trio packaged for pixie's in-app **Fetch live-env** action (the default `PIXIE_LIVE_ENV_SRC`). Click Fetch live-env on the dashboard and pixie pulls + stages this itself; no manual bake or copy.
+            - `pixie-netboot-pc-x86_64-*.{vmlinuz,initrd,squashfs}` — the same live-env (netboot-pc bake) as loose files, if you prefer to stage `PIXIE_LIVE_ENV_DIR` (`data/live-env/`) by hand. Used by the `pixie-flash-once` / `pixie-flash-always` / `pixie-inventory` / `pixie-tui` boot modes.
+            - `pixie-usbboot-pc-x86_64-*.iso.gz` — bootable USB / ISO media for the pixie live env.
+            - `*.sha256` — checksums for the above.

{pixie_lab-0.2.0 → pixie_lab-0.3.0}/CHANGELOG.md

@@ -11,6 +11,62 @@ operator-facing summary.
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-07-23
+
+Operator-facing surface + release plumbing. A fleet overlay-management
+page, a tightened inventory view, and a dedicated live-env pane; the
+release now ships the container image + boot media + a curated catalog,
+and pixie can fetch its own live-env.
+
+### Added
+
+**Fleet-wide overlay management page.** A new **Overlays** page
+(`/ui/overlays`) lists every persistent nbdboot qcow2 across the fleet
+with disk-used, last-modified, serving port, and a state
+(active / idle / orphaned / missing); per-row Reset and a Prune that
+reclaims only the orphaned + missing ones. The machine-detail Inventory
+view was tightened from stacked stat-cards into one dense summary.
+
+**Pixie ships a curated catalog and defaults to it, not nosi's.** A
+fresh (empty) catalog is seeded on first start from a `catalog.toml`
+bundled in the package: a strict subset of the upstream nosi catalog
+restricted to the four netboot-capable images pixie's nbdboot + live-env
+chains actually test and support (debian-13-headless, ubuntu-2404 /
+2604-headless, fedora-44-headless, each with its netboot bundle). The
+desktop / proxmox / rpios / freebsd variants that have no netboot bundle
+are omitted. The "Import catalog" field and the live-env TUI now default
+to the pixie release copy of this curated catalog rather than the full
+nosi catalog; both remain overridable by URL. Seeding is one-shot,
+never clobbers an operator-populated catalog, and is disabled with
+`PIXIE_SEED_CATALOG=0`.
+
+**Pixie can fetch its own live-env, from a dedicated Live-env pane.** A
+new **Live env** page (`/ui/live-env`) is the one place the live env is
+managed: staged-media readiness, a **Fetch live env** action, the fetch
+source, and the extra-kernel-cmdline override. Fetch downloads the
+netboot-pc bake as a single tarball (`PIXIE_LIVE_ENV_SRC`, defaulting to
+the latest GitHub release's `pixie-live-env-x86_64.tar.gz`) and stages
+`vmlinuz` + `initrd` + `live.squashfs` under `PIXIE_LIVE_ENV_DIR`,
+reusing the catalog fetch's curl transport. This replaces the only
+artifact an operator previously had to bake locally
+(`make build VARIANT=netboot-pc`) or hand-copy. The source is overridable
+per deploy (point at a mirror for air-gapped installs). The dashboard
+Live-env card is now status-only and links to the pane; the live-env
+knobs moved off the Settings page. The `publish-release` job assembles
+that tarball so the default source resolves.
+
+**Releases now ship the container image and the boot media, not just
+the PyPI package.** Tagging `v*` publishes the appliance image to
+`ghcr.io/safl/pixie` (`:<version>` + `:latest`) and creates a GitHub
+Release with the boot media attached: the netboot-pc live-env bake
+(`vmlinuz` + `initrd` + `squashfs`) that the `pixie-flash-once` /
+`pixie-flash-always` / `pixie-inventory` / `pixie-tui` modes chain
+into, and the `usbboot-pc` bootable `.iso.gz`, each with a `.sha256`.
+Previously a tag published only to PyPI, so the ghcr image that
+`pixie-lab deploy` pins and the live-env media both existed only as
+ephemeral CI artifacts or a local `make build` -- a fresh
+`pixie-lab deploy` pulled an image that was never pushed.
+
 ## [0.2.0] - 2026-07-22
 
 First real release after the 0.1.0 skeleton: nbdboot (ephemeral +

{pixie_lab-0.2.0 → pixie_lab-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pixie-lab
-Version: 0.2.0
+Version: 0.3.0
 Summary: Bare-metal netboot appliance: catalog + fetch + NBD + PXE + TFTP + operator TUI in one container
 Project-URL: Homepage, https://github.com/safl/pixie
 Project-URL: Repository, https://github.com/safl/pixie

{pixie_lab-0.2.0 → pixie_lab-0.3.0}/docs/src/deployment.md

@@ -93,6 +93,20 @@ podman build -t pixie:local -f Containerfile .
 cd /opt/pixie && podman compose --env-file envvars up -d
 ```
 
+### Stage the live env
+
+The `pixie-flash-*`, `pixie-inventory`, and `pixie-tui` boot modes chain
+into pixie's live env (`vmlinuz` + `initrd` + `live.squashfs`). Open the
+**Live env** page in the UI (`/ui/live-env`) and click **Fetch live
+env**: pixie pulls the netboot-pc bake from `PIXIE_LIVE_ENV_SRC`
+(default: the latest pixie GitHub release's
+`pixie-live-env-x86_64.tar.gz`) and stages it under `PIXIE_LIVE_ENV_DIR`
+itself - no manual bake or copy. For an air-gapped install, point
+`PIXIE_LIVE_ENV_SRC` (or the live override on the Live env page) at a
+local mirror of that tarball. You can still build it yourself with
+`make build VARIANT=netboot-pc` and drop the three files into
+`data/live-env/` by hand.
+
 ## Environment variables
 
 Pixie reads these at container startup. The compose file passes the
@@ -131,6 +145,17 @@ netboot bundles), `overlays/<mac>/<image_sha>/<profile>.qcow2`
 `pixie-*` boot modes degrade to an unavailable plan when this dir is
 missing or incomplete.
 
+**`PIXIE_LIVE_ENV_SRC`** (default: the latest pixie GitHub release's
+`pixie-live-env-x86_64.tar.gz`) - the tarball the dashboard **Fetch
+live-env** action downloads and stages into `PIXIE_LIVE_ENV_DIR`.
+Accepts `https://` or `oras://`; it must unpack to `vmlinuz` + `initrd`
++ `live.squashfs`. Overridable live on the Live env page.
+
+**`PIXIE_SEED_CATALOG`** (default: `1`) - seed a fresh (empty) catalog
+from the bundled curated catalog (the netboot-capable nosi subset) on
+first start. Set to `0` to start with an empty catalog. Runs once and
+never overwrites an operator-populated catalog.
+
 ### NBD supervisor
 
 **`PIXIE_NBD_BIND`** (default: `0.0.0.0`) - address nbdkit binds

{pixie_lab-0.2.0 → pixie_lab-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pixie-lab"
-version = "0.2.0"
+version = "0.3.0"
 description = "Bare-metal netboot appliance: catalog + fetch + NBD + PXE + TFTP + operator TUI in one container"
 readme = "README.md"
 requires-python = ">=3.11"

pixie_lab-0.3.0/src/pixie/catalog/__init__.py

@@ -0,0 +1,49 @@
+"""Operator-curated image library.
+
+Pixie's catalog holds two peer entry shapes: **disk images**
+(``format`` = ``img.gz`` / ``img.zst`` / ``img.xz`` / ``img`` / ...)
+that pixie can flash to a target disk or serve over NBD for nbdboot,
+and **netboot bundles** (``format`` = ``tar.gz``) whose contents pixie
+unpacks into a content-addressed artifacts directory (vmlinuz +
+initrd + manifest.json) so image-native nbdboot has kernel + initrd
+URLs to serve.
+
+Disk-image entries can carry a ``netboot_src`` field pointing at the
+sibling bundle by URL; the two are peer catalog entries rather than
+one nested under the other, so a nbdboot-only workflow can fetch a
+bundle standalone and never touch a disk image.
+
+There is ONE verb: :func:`pixie.catalog.fetch.fetch`. Downloads +
+sha256s the bytes; if the entry's ``format`` is ``tar.gz``, additionally
+unpacks vmlinuz + initrd + manifest.json into
+``<state_dir>/artifacts/<content-sha256>/``. Presence on disk IS
+readiness; no ready/pending vocabulary, no auto-fetch, no misses page.
+"""
+
+from __future__ import annotations
+
+from importlib.resources import files
+
+# Default "Import catalog" + live-env TUI source. Points at PIXIE's own
+# release copy of the curated catalog (a subset of nosi's, restricted to
+# the netboot-capable images pixie tests + supports), NOT the upstream
+# nosi catalog. Operators can still import the full nosi catalog by URL;
+# this is just the convenience default.
+DEFAULT_CATALOG_URL = "https://github.com/safl/pixie/releases/latest/download/catalog.toml"
+
+# The same curated catalog shipped INSIDE the package, used to seed a
+# fresh (empty) catalog on first start so a plain deploy comes up with
+# the known-good set offline -- no network, no release dependency.
+BUNDLED_CATALOG_RESOURCE = "catalog.toml"
+
+# Startup seeding is gated on this env (default on). Tests + operators
+# who want an empty catalog set it to ``0``. A one-shot settings marker
+# (below) records that the seed already ran so a later restart never
+# re-seeds after an operator curated the catalog down.
+SEED_CATALOG_ENV = "PIXIE_SEED_CATALOG"
+CATALOG_SEEDED_KEY = "catalog.seeded"
+
+
+def bundled_catalog_bytes() -> bytes:
+    """The curated ``catalog.toml`` shipped inside the package."""
+    return (files("pixie.catalog") / BUNDLED_CATALOG_RESOURCE).read_bytes()

pixie_lab-0.3.0/src/pixie/catalog/_live_env.py

@@ -0,0 +1,128 @@
+"""Fetch + stage the pixie live-env (the netboot-pc bake).
+
+The live env -- ``vmlinuz`` + ``initrd`` + ``live.squashfs`` that the
+``pixie-flash-*`` / ``pixie-inventory`` / ``pixie-tui`` boot modes chain
+into -- was the one artifact pixie could not retrieve itself: it had to
+be baked locally (``make build VARIANT=netboot-pc``) or hand-copied into
+``PIXIE_LIVE_ENV_DIR``. This module pulls it from a single tarball
+``src`` (the same ``https://`` / ``oras://`` schemes the catalog fetch
+speaks) and stages the three files atomically, reusing the catalog
+fetch pipeline's curl download + resume plumbing.
+
+Contract with CI's ``publish-release`` job: the tarball carries exactly
+``vmlinuz`` + ``initrd`` + ``live.squashfs`` at the archive root. Any
+other member is ignored; a missing one is a hard error (better a loud
+"tarball is wrong" than a live env that half-stages and boots into a
+mysterious squashfs-fetch hang).
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+import tarfile
+import tempfile
+from dataclasses import dataclass, field
+from pathlib import Path
+
+from pixie._util import CHUNK
+from pixie.catalog._fetcher import (
+    FetchError,
+    ProgressReporter,
+    _resolve_fetch_url,
+    _stream_to_tmpfile,
+)
+
+# The three files a target's iPXE chain pulls from
+# ``/boot/pixie-live-env/``. Names match what ``pixie-live-env.j2``
+# references (note ``live.squashfs``, not the bake's raw ``*.squashfs``
+# -- the CI tar step renames it).
+LIVE_ENV_FILES: frozenset[str] = frozenset({"vmlinuz", "initrd", "live.squashfs"})
+
+
+@dataclass
+class LiveEnvResult:
+    """Outcome of a successful stage: the src it came from, the sha256
+    of the downloaded tarball, its byte size, and the staged file
+    sizes."""
+
+    src: str
+    sha256: str
+    size: int
+    files: dict[str, int] = field(default_factory=dict)
+
+
+def _unpack_live_env_tar(tar_path: Path, live_env_dir: Path) -> dict[str, int]:
+    """Extract the live-env trio from ``tar_path`` into ``live_env_dir``
+    atomically. Returns ``{name: size_bytes}``.
+
+    Hardening mirrors :func:`pixie.catalog._fetcher._unpack_netboot_bundle`:
+    only basenames in :data:`LIVE_ENV_FILES` at the archive root are
+    accepted; nested paths, parent traversal, and dotfiles are dropped.
+    Files land in a staging subdir first, then each is ``os.replace``'d
+    onto its final name so a target fetching mid-stage sees the old
+    file or the new one, never a half-written squashfs.
+    """
+    live_env_dir.mkdir(parents=True, exist_ok=True)
+    staging = Path(tempfile.mkdtemp(prefix=".staging-", dir=str(live_env_dir)))
+    try:
+        # ``r:*`` transparently handles .tar / .tar.gz / .tar.xz so the
+        # CI side can pick whatever compression without a pixie change.
+        with tarfile.open(str(tar_path), mode="r:*") as tar:
+            for member in tar.getmembers():
+                if not member.isfile():
+                    continue
+                name = os.path.basename(member.name)
+                if not name or name.startswith(".") or name != member.name:
+                    continue
+                if name not in LIVE_ENV_FILES:
+                    continue
+                extracted = tar.extractfile(member)
+                if extracted is None:
+                    continue
+                with (staging / name).open("wb") as out:
+                    shutil.copyfileobj(extracted, out, length=CHUNK)
+
+        missing = LIVE_ENV_FILES - {p.name for p in staging.iterdir()}
+        if missing:
+            raise FetchError(
+                f"live-env tarball {tar_path.name} missing required file(s): {sorted(missing)}"
+            )
+
+        sizes: dict[str, int] = {}
+        for name in sorted(LIVE_ENV_FILES):
+            final = live_env_dir / name
+            os.replace(staging / name, final)
+            sizes[name] = final.stat().st_size
+        return sizes
+    finally:
+        shutil.rmtree(staging, ignore_errors=True)
+
+
+def stage_live_env(
+    src: str,
+    live_env_dir: Path,
+    *,
+    progress: ProgressReporter = None,
+) -> LiveEnvResult:
+    """Download the live-env tarball at ``src`` and stage its three
+    files into ``live_env_dir``.
+
+    Reuses the catalog fetch's curl transport (resume + retry + stall
+    detection). The tarball lands in ``live_env_dir`` itself so the
+    unpack + ``os.replace`` stay on one filesystem. Raises
+    :class:`FetchError` on an empty/bad src, an unsupported scheme, a
+    download failure, or a tarball missing a required file.
+    """
+    if not (src or "").strip():
+        raise FetchError("no live-env src configured (set PIXIE_LIVE_ENV_SRC)")
+    url, headers = _resolve_fetch_url(src.strip())
+    live_env_dir.mkdir(parents=True, exist_ok=True)
+    tmp_tar, sha256, size = _stream_to_tmpfile(url, headers, live_env_dir, progress)
+    try:
+        if progress is not None:
+            progress({"phase": "unpacking"})
+        sizes = _unpack_live_env_tar(tmp_tar, live_env_dir)
+    finally:
+        tmp_tar.unlink(missing_ok=True)
+    return LiveEnvResult(src=src.strip(), sha256=sha256, size=size, files=sizes)

pixie_lab-0.3.0/src/pixie/catalog/catalog.toml

@@ -0,0 +1,81 @@
+version = 1
+
+# pixie curated catalog -- a strict SUBSET of the upstream nosi catalog
+# (https://github.com/safl/nosi/releases/latest/download/catalog.toml),
+# restricted to the images that ship a netboot bundle. Those are the
+# only images pixie's nbdboot chain (and the flash / inventory / tui
+# live-env chains that ride the same bundle) actually test + support,
+# so shipping just this subset keeps a fresh pixie's catalog to the
+# known-good set instead of the full nosi menu (desktop / proxmox /
+# rpios / freebsd variants have no netboot bundle and are omitted).
+#
+# Pixie seeds a fresh (empty) catalog from this file on first start and
+# defaults its "Import catalog" + live-env TUI to the pixie release copy
+# of it, rather than the nosi catalog. Override either freely; this is a
+# convenience default, not a lock-in.
+#
+# Refs use the rolling ``:latest`` oras tags so the shipped catalog
+# stays current without re-releasing pixie; the layer digest is still
+# verified at fetch time. Each disk image cross-references its bundle by
+# URL via ``netboot_src`` (pixie's tight form), so the nbdboot renderer
+# resolves the pair without the legacy name-string ``netboot_ref``.
+
+[[images]]
+name = "nosi debian-13-headless"
+src = "oras://ghcr.io/safl/nosi/debian-13-headless:latest"
+format = "img.gz"
+arch = "x86_64"
+description = "Debian 13 (trixie) headless. General-purpose headless base with the nosi dev toolset."
+netboot_src = "oras://ghcr.io/safl/nosi/debian-13-headless-netboot:latest"
+
+[[images]]
+name = "nosi debian-13-headless netboot bundle"
+src = "oras://ghcr.io/safl/nosi/debian-13-headless-netboot:latest"
+format = "tar.gz"
+arch = "x86_64"
+description = "Netboot bundle for debian-13-headless: vmlinuz + initrd so pixie can nbdboot it over NBD."
+
+[[images]]
+name = "nosi ubuntu-2404-headless"
+src = "oras://ghcr.io/safl/nosi/ubuntu-2404-headless:latest"
+format = "img.gz"
+arch = "x86_64"
+description = "Ubuntu 24.04 LTS (noble) headless. Broad driver support for CUDA / ROCm devices and Mellanox NICs / DPUs."
+netboot_src = "oras://ghcr.io/safl/nosi/ubuntu-2404-headless-netboot:latest"
+
+[[images]]
+name = "nosi ubuntu-2404-headless netboot bundle"
+src = "oras://ghcr.io/safl/nosi/ubuntu-2404-headless-netboot:latest"
+format = "tar.gz"
+arch = "x86_64"
+description = "Netboot bundle for ubuntu-2404-headless: vmlinuz + initrd so pixie can nbdboot it over NBD."
+
+[[images]]
+name = "nosi ubuntu-2604-headless"
+src = "oras://ghcr.io/safl/nosi/ubuntu-2604-headless:latest"
+format = "img.gz"
+arch = "x86_64"
+description = "Ubuntu 26.04 LTS (resolute) headless. A more recent kernel and user-land on Ubuntu LTS."
+netboot_src = "oras://ghcr.io/safl/nosi/ubuntu-2604-headless-netboot:latest"
+
+[[images]]
+name = "nosi ubuntu-2604-headless netboot bundle"
+src = "oras://ghcr.io/safl/nosi/ubuntu-2604-headless-netboot:latest"
+format = "tar.gz"
+arch = "x86_64"
+description = "Netboot bundle for ubuntu-2604-headless: vmlinuz + initrd so pixie can nbdboot it over NBD."
+
+[[images]]
+name = "nosi fedora-44-headless"
+src = "oras://ghcr.io/safl/nosi/fedora-44-headless:latest"
+format = "img.gz"
+arch = "x86_64"
+description = "Fedora 44 headless. An RHEL-family alternative (dnf, SELinux, EL package universe)."
+netboot_src = "oras://ghcr.io/safl/nosi/fedora-44-headless-netboot:latest"
+
+[[images]]
+name = "nosi fedora-44-headless netboot bundle"
+src = "oras://ghcr.io/safl/nosi/fedora-44-headless-netboot:latest"
+format = "tar.gz"
+arch = "x86_64"
+description = "Netboot bundle for fedora-44-headless: vmlinuz + initrd so pixie can nbdboot it over NBD."

{pixie_lab-0.2.0 → pixie_lab-0.3.0}/src/pixie/events/_kinds.py

@@ -193,6 +193,24 @@ EVENTS_CLEARED = "events.cleared"
 right after the wipe so the freshly-empty log still records who reset
 it and when; carries the deleted-row count in ``details``."""
 
+# ---------- live-env fetch ------------------------------------------
+#
+# The operator "Fetch live-env" action pulls the netboot-pc bake into
+# PIXIE_LIVE_ENV_DIR. No subject (``subject_kind`` = ""): the live env
+# is per-pixie, not per-resource. Dotted ``.done`` / ``.failed`` names
+# mirror the catalog-fetch kinds so ``.failed`` auto-classifies as an
+# error via the ERROR_KINDS ``LIKE '%.failed'`` probe.
+
+LIVE_ENV_FETCH_DONE = "live_env.fetch.done"
+"""``POST /ui/live-env/fetch`` downloaded + staged vmlinuz + initrd +
+live.squashfs into PIXIE_LIVE_ENV_DIR. Carries the src + content sha in
+``details``."""
+
+LIVE_ENV_FETCH_FAILED = "live_env.fetch.failed"
+"""The live-env fetch failed (bad src scheme, download error, or a
+tarball missing a required file). Carries the src + error in
+``details``."""
+
 
 # The canonical closed set. Every kind above is registered here; the
 # ``EventsLog.emit`` call rejects anything not in this frozenset.
@@ -228,6 +246,8 @@ KNOWN_EVENT_KINDS: frozenset[str] = frozenset(
         AUTH_LOGIN_SUCCEEDED,
         AUTH_LOGIN_FAILED,
         EVENTS_CLEARED,
+        LIVE_ENV_FETCH_DONE,
+        LIVE_ENV_FETCH_FAILED,
     }
 )
 

{pixie_lab-0.2.0 → pixie_lab-0.3.0}/src/pixie/tui/_app.py

@@ -328,9 +328,11 @@ def collect_lshw(*, timeout: float = 30.0) -> object | None:
 # v0.46 stopped publishing a pixie-side catalog.toml mirror and pointed
 # pixie at the upstream image-builder (``safl/nosi``); the wizard's
 # ``[d] default`` shortcut tracks the same source so both consumers
-# resolve to one catalog. The pixie release no longer ships a
-# catalog.toml asset, so the old URL would 404.
-_BTY_DEFAULT_CATALOG_URL = "https://github.com/safl/nosi/releases/latest/download/catalog.toml"
+# resolve to one catalog. Points at pixie's curated catalog (the
+# netboot-capable nosi subset) shipped as a pixie release asset, so the
+# live-env wizard defaults to the same known-good set the appliance
+# seeds -- not the full upstream nosi catalog.
+_BTY_DEFAULT_CATALOG_URL = "https://github.com/safl/pixie/releases/latest/download/catalog.toml"
 
 
 # ---------------------------------------------------------------------------