pixie-lab 0.4.1__tar.gz → 0.4.3__tar.gz

{pixie_lab-0.4.1 → pixie_lab-0.4.3}/.github/workflows/cicd.yaml

@@ -7,9 +7,9 @@ name: cicd
 #     (real nbdkit, real HTTP, real NBD wire).
 #   * ``build-container``: separate smoke build kept for the "does
 #     the Containerfile parse on a fresh runner" signal.
-#   * ``build-media``: build the live-env media (netboot-pc + usbboot-pc
-#     variants) via the cijoe pipelines under cijoe/tasks/. Requires
-#     live-build + passwordless sudo; the runner has both.
+#   * ``build-media``: build the usbboot-pc bootable .iso via the cijoe
+#     live-build pipeline under cijoe/tasks/. Requires live-build +
+#     passwordless sudo; the runner has both.
 #   * ``verify-usbboot``: structurally verify the usbboot-pc .iso
 #     (hybrid ISO + El Torito BIOS & UEFI entries + sha256), then boot
 #     it via a real Ventoy stick in QEMU and assert the pixie live env
@@ -27,9 +27,9 @@ name: cicd
 #     only. Before this the image was smoke-built and thrown away, so
 #     the documented ghcr image was never populated by CI.
 #   * ``publish-release``: create the GitHub Release for the tag and
-#     attach the media ``build-media`` produces -- the netboot-pc
-#     live-env bake + the usbboot-pc bootable image + checksums. These
-#     used to live only as ephemeral, login-gated workflow artifacts.
+#     attach the media -- the pixie-live-env nbdboot image + the
+#     usbboot-pc bootable .iso + checksums. These used to live only as
+#     ephemeral, login-gated workflow artifacts.
 #
 # First publish (claiming the pixie-lab name) requires a one-time
 # PyPI setup: register a Pending Publisher on https://pypi.org
@@ -106,7 +106,7 @@ jobs:
     name: Build ${{ matrix.variant }} image
     needs: test
     runs-on: ubuntu-latest
-    # A cold live-build (netboot-pc / usbboot-pc) finishes in
+    # A cold live-build (usbboot-pc .iso) finishes in
     # 25-40 min on a warm GHA runner. The dominant failure mode is
     # a HANG (in-chroot apt / debootstrap has no timeout), so a 60
     # min cap fails a stuck build fast; the cijoe-output artifact
@@ -116,7 +116,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        variant: [netboot-pc, usbboot-pc]
+        variant: [usbboot-pc]
     steps:
       - uses: actions/checkout@v6
 
@@ -171,17 +171,6 @@ jobs:
           path: cijoe/cijoe-output
           if-no-files-found: warn
 
-      - name: Upload artifact (netboot-pc)
-        if: matrix.variant == 'netboot-pc'
-        uses: actions/upload-artifact@v7
-        with:
-          name: pixie-netboot-pc-x86_64
-          path: |
-            ~/system_imaging/disk/pixie-netboot-pc-x86_64-v*.vmlinuz
-            ~/system_imaging/disk/pixie-netboot-pc-x86_64-v*.initrd
-            ~/system_imaging/disk/pixie-netboot-pc-x86_64-v*.squashfs
-            ~/system_imaging/disk/pixie-netboot-pc-x86_64-v*.sha256
-
       - name: Upload artifact (usbboot-pc)
         if: matrix.variant == 'usbboot-pc'
         uses: actions/upload-artifact@v7
@@ -191,6 +180,67 @@ jobs:
             ~/system_imaging/disk/pixie-usbboot-pc-x86_64-v*.iso
             ~/system_imaging/disk/pixie-usbboot-pc-x86_64-v*.sha256
 
+  build-live-env-image:
+    name: Build pixie-live-env image
+    # The image the live-env boot modes nbdboot: the nosi arch-headless
+    # base disk image with the pixie CLI + pixie-on-tty1 service injected
+    # (cijoe/tasks/live-env-image.yaml). Unlike the live-build bakes this
+    # does NOT run debootstrap/mksquashfs; it qemu-nbd-mounts a copy of a
+    # pulled base image, injects userspace, slims, and gzips. Wired to
+    # ``test`` so we don't pay for the ORAS pull + qemu transform on a
+    # broken lint/typecheck.
+    needs: test
+    runs-on: ubuntu-latest
+    # 60 min cap for the same reason as build-media: the real ORAS pull
+    # of the arch-headless base (~1.6 GiB) + decompress + qemu transform
+    # + gzip dominate wall clock.
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install build dependencies (qemu-nbd, rsync, nbd module)
+        run: |
+          set -eu
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            qemu-utils rsync gzip
+          # The transform attaches a copy of the base image to /dev/nbdX
+          # via qemu-nbd; load the module with partition scanning so the
+          # root partition shows up as nbdXp1.
+          sudo modprobe nbd max_part=16
+          ls -la /dev/nbd0
+
+      - name: Install cijoe
+        run: pipx install --force cijoe
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.1.0
+
+      - name: Build pixie-live-env image
+        run: make live-env-image
+
+      # cijoe captures the full run (per-command output + report.html)
+      # under cijoe/cijoe-output/. Upload it ALWAYS so a transform
+      # failure leaves a diagnosable artifact.
+      - name: Upload cijoe output
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: cijoe-output-live-env-image
+          path: cijoe/cijoe-output
+          if-no-files-found: warn
+
+      - name: Upload artifact (pixie-live-env-image)
+        uses: actions/upload-artifact@v7
+        with:
+          name: pixie-live-env-image-x86_64
+          path: |
+            ~/system_imaging/disk/pixie-live-env-x86_64.img.gz
+            ~/system_imaging/disk/pixie-live-env-x86_64.img.gz.sha256
+            ~/system_imaging/disk/pixie-live-env-x86_64.content-sha256
+            ~/system_imaging/disk/pixie-live-env-catalog.toml
+          if-no-files-found: error
+
   test-pxe:
     name: PXE bootstrap chain test (containerized pixie + client QEMU VM)
     # Independent of the media bake: the chain test only needs the
@@ -257,9 +307,8 @@ jobs:
     # netboot bundle, root disk from nosi's img.gz -- and asserts a
     # real Debian userspace comes up over NBD.
     #
-    # 60 min timeout for the same reasons as test-pxe-flash: the real
-    # oras pull (~2.6 GiB compressed) + img.gz decompression to
-    # pixie's blob store dominates wall clock.
+    # 60 min timeout because the real oras pull (~2.6 GiB compressed) +
+    # img.gz decompression to pixie's blob store dominates wall clock.
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
@@ -304,146 +353,20 @@ jobs:
           path: cijoe/_build/test-pxe
           if-no-files-found: warn
 
-  test-pxe-inventory:
-    name: PXE inventory chain test (containerized pixie + client QEMU VM)
-    # Depends on the netboot-pc bake for the live-env media that
-    # pixie serves at /boot/pixie-live-env/. No disk image assembly
-    # here (unlike nbdboot), so the runner does not need
-    # squashfs-tools / rsync / mkfs.ext4.
-    needs: build-media
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Install host tools (qemu, dnsmasq, ipxe, bridge)
-        run: |
-          set -eu
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            qemu-system-x86 \
-            qemu-utils \
-            dnsmasq \
-            ipxe \
-            bridge-utils \
-            iproute2
-          sudo chmod a+rw /dev/kvm
-          ls -la /dev/kvm
-
-      - name: Install cijoe
-        run: pipx install --force cijoe
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
-
-      - name: Download netboot-pc bake artifacts
-        uses: actions/download-artifact@v7
-        with:
-          name: pixie-netboot-pc-x86_64
-          path: ~/system_imaging/disk/
-
-      - name: Show downloaded artifact contents
-        run: |
-          set -eu
-          echo "--- ~/system_imaging/disk (recursive) ---"
-          find ~/system_imaging/disk -maxdepth 5 -print
-
-      - name: Run PXE inventory chain test
-        run: make test-pxe-inventory
-
-      - name: Upload cijoe output
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: cijoe-output-test-pxe-inventory
-          path: cijoe/cijoe-output
-          if-no-files-found: warn
-
-      - name: Upload PXE workspace (serial logs, dnsmasq.log)
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: test-pxe-inventory-workspace
-          path: cijoe/_build/test-pxe
-          if-no-files-found: warn
-
-  test-pxe-flash:
-    name: PXE flash chain test (containerized pixie + client QEMU VM)
-    # Same artifact dependency as test-pxe-inventory (the netboot-pc
-    # bake for the live-env media). qemu-utils lands qemu-img which
-    # we use to read the client disk's sector 0 for a boot-signature
-    # check without a full-disk convert.
+  test-pxe-live-env-modes:
+    name: PXE live-env modes chain test (containerized pixie + client QEMU VM)
+    # Consolidated: nbdboots the pixie-live-env image ONCE, then runs
+    # pixie-inventory / -tui / -flash-once against it in sequence (one
+    # heavy image fetch, three client boots, destructive flash last).
+    # Fetches the pinned pixie-live-env release image (https) + its
+    # arch-headless netboot bundle (oras) + the nosi flash target
+    # (oras). No build-media dependency.
     #
-    # Wider timeout (60 min) because the pipeline pulls a real nosi
-    # image via oras (~2.6 GiB compressed) + decompresses img.gz +
-    # dds ~10 GiB sparsely to the client qcow2 -- not the synthetic
-    # 16 MiB marker file the earlier test-pxe-flash iterations used.
-    needs: build-media
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Install host tools (qemu, dnsmasq, ipxe, bridge)
-        run: |
-          set -eu
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            qemu-system-x86 \
-            qemu-utils \
-            dnsmasq \
-            ipxe \
-            bridge-utils \
-            iproute2
-          sudo chmod a+rw /dev/kvm
-          ls -la /dev/kvm
-
-      - name: Install cijoe
-        run: pipx install --force cijoe
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
-
-      - name: Download netboot-pc bake artifacts
-        uses: actions/download-artifact@v7
-        with:
-          name: pixie-netboot-pc-x86_64
-          path: ~/system_imaging/disk/
-
-      - name: Show downloaded artifact contents
-        run: |
-          set -eu
-          echo "--- ~/system_imaging/disk (recursive) ---"
-          find ~/system_imaging/disk -maxdepth 5 -print
-
-      - name: Run PXE flash chain test
-        run: make test-pxe-flash
-
-      - name: Upload cijoe output
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: cijoe-output-test-pxe-flash
-          path: cijoe/cijoe-output
-          if-no-files-found: warn
-
-      - name: Upload PXE workspace (serial logs, dnsmasq.log)
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: test-pxe-flash-workspace
-          path: cijoe/_build/test-pxe
-          if-no-files-found: warn
-
-  test-pxe-flash-always:
-    name: PXE flash-always chain test (containerized pixie + client QEMU VM)
-    # Same dependencies + real-nosi pipeline as test-pxe-flash. The
-    # difference is a one-line config knob + an inverted assertion:
-    # pixie-flash-always must NOT flip its bind on the CLI's /done.
-    # 60 min for the same reasons -- real oras pull dominates.
-    needs: build-media
+    # 90 min: the pixie-live-env img.gz fetch + the flash submode's
+    # ~2.6 GiB nosi image pull/decompress + three sequential QEMU boots
+    # dominate wall clock.
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 90
     steps:
       - uses: actions/checkout@v6
 
@@ -467,26 +390,14 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v8.1.0
 
-      - name: Download netboot-pc bake artifacts
-        uses: actions/download-artifact@v7
-        with:
-          name: pixie-netboot-pc-x86_64
-          path: ~/system_imaging/disk/
-
-      - name: Show downloaded artifact contents
-        run: |
-          set -eu
-          echo "--- ~/system_imaging/disk (recursive) ---"
-          find ~/system_imaging/disk -maxdepth 5 -print
-
-      - name: Run PXE flash-always chain test
-        run: make test-pxe-flash-always
+      - name: Run PXE live-env modes chain test
+        run: make test-pxe-live-env-modes
 
       - name: Upload cijoe output
         if: always()
         uses: actions/upload-artifact@v7
         with:
-          name: cijoe-output-test-pxe-flash-always
+          name: cijoe-output-test-pxe-live-env-modes
           path: cijoe/cijoe-output
           if-no-files-found: warn
 
@@ -494,70 +405,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@v7
         with:
-          name: test-pxe-flash-always-workspace
-          path: cijoe/_build/test-pxe
-          if-no-files-found: warn
-
-  test-pxe-tui:
-    name: PXE tui chain test (containerized pixie + client QEMU VM)
-    # Same live-env media dependency as test-pxe-flash. No qemu-utils
-    # here -- the tui test does not read the target disk; it just
-    # asserts the wizard entered its picker screen (a serial marker
-    # coming out of pixie CLI's _screen_select_image).
-    needs: build-media
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Install host tools (qemu, dnsmasq, ipxe, bridge)
-        run: |
-          set -eu
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            qemu-system-x86 \
-            qemu-utils \
-            dnsmasq \
-            ipxe \
-            bridge-utils \
-            iproute2
-          sudo chmod a+rw /dev/kvm
-          ls -la /dev/kvm
-
-      - name: Install cijoe
-        run: pipx install --force cijoe
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
-
-      - name: Download netboot-pc bake artifacts
-        uses: actions/download-artifact@v7
-        with:
-          name: pixie-netboot-pc-x86_64
-          path: ~/system_imaging/disk/
-
-      - name: Show downloaded artifact contents
-        run: |
-          set -eu
-          echo "--- ~/system_imaging/disk (recursive) ---"
-          find ~/system_imaging/disk -maxdepth 5 -print
-
-      - name: Run PXE tui chain test
-        run: make test-pxe-tui
-
-      - name: Upload cijoe output
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: cijoe-output-test-pxe-tui
-          path: cijoe/cijoe-output
-          if-no-files-found: warn
-
-      - name: Upload PXE workspace (serial logs, dnsmasq.log)
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: test-pxe-tui-workspace
+          name: test-pxe-live-env-modes-workspace
           path: cijoe/_build/test-pxe
           if-no-files-found: warn
 
@@ -650,12 +498,10 @@ jobs:
       - build-container
       - build-wheel
       - build-media
+      - build-live-env-image
       - test-pxe
       - test-pxe-nbdboot
-      - test-pxe-inventory
-      - test-pxe-tui
-      - test-pxe-flash
-      - test-pxe-flash-always
+      - test-pxe-live-env-modes
       - verify-usbboot
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
@@ -692,12 +538,10 @@ jobs:
       - build-container
       - build-wheel
       - build-media
+      - build-live-env-image
       - test-pxe
       - test-pxe-nbdboot
-      - test-pxe-inventory
-      - test-pxe-tui
-      - test-pxe-flash
-      - test-pxe-flash-always
+      - test-pxe-live-env-modes
       - verify-usbboot
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
@@ -725,11 +569,11 @@ jobs:
 
   publish-release:
     name: Publish GitHub Release (media assets)
-    # Attach the media CI already builds -- the netboot-pc live-env
-    # bake (vmlinuz + initrd + squashfs) and the usbboot-pc bootable
-    # image -- to a GitHub Release on v* tags. Before this they only
-    # existed as ephemeral, login-gated workflow artifacts, so an
-    # operator had no released live-env or USB image to download. Same
+    # Attach the media CI already builds -- the pixie-live-env nbdboot
+    # image and the usbboot-pc bootable .iso -- to a GitHub Release on
+    # v* tags. Before this they only existed as ephemeral, login-gated
+    # workflow artifacts, so an operator had no released live-env or
+    # USB image to download. Same
     # full-pipeline gate as the other publish jobs.
     needs:
       - test
@@ -737,12 +581,10 @@ jobs:
       - build-container
       - build-wheel
       - build-media
+      - build-live-env-image
       - test-pxe
       - test-pxe-nbdboot
-      - test-pxe-inventory
-      - test-pxe-tui
-      - test-pxe-flash
-      - test-pxe-flash-always
+      - test-pxe-live-env-modes
       - verify-usbboot
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
@@ -753,33 +595,28 @@ jobs:
       - name: Download media artifacts
         uses: actions/download-artifact@v8
         with:
-          # Both build-media matrix legs upload under this shape:
-          # ``pixie-netboot-pc-x86_64`` + ``pixie-usbboot-pc-x86_64``.
-          # merge-multiple flattens both into one directory.
+          # build-media uploads the usbboot-pc .iso under this shape.
           pattern: pixie-*-pc-x86_64
           merge-multiple: true
           path: release-assets
+      - name: Download pixie-live-env image
+        # The nbdboot live-env image (arch-headless + injected pixie CLI
+        # / service): the gzipped disk image + its .sha256, the
+        # .content-sha256 sidecar (the value an operator sets
+        # PIXIE_LIVE_ENV_IMAGE_SHA to), and the catalog fragment.
+        uses: actions/download-artifact@v8
+        with:
+          name: pixie-live-env-image-x86_64
+          path: release-assets
       - name: List release assets
         run: ls -la release-assets
-      - name: Assemble live-env fetch tarball
-        # pixie's in-app "Fetch live-env" pulls ONE tarball that unpacks
-        # to vmlinuz + initrd + live.squashfs (see catalog/_live_env.py).
-        # Repackage the netboot-pc trio under those stable names so
-        # ``.../releases/latest/download/pixie-live-env-x86_64.tar.gz``
-        # -- the default PIXIE_LIVE_ENV_SRC -- resolves.
+      - name: Stage curated catalog
+        # Ship the curated catalog (the nosi subset + the pixie-live-env
+        # image) so DEFAULT_CATALOG_URL
+        # (.../releases/latest/download/catalog.toml) resolves and
+        # pixie's Import + live-env TUI default work.
         run: |
           set -eu
-          d=$(mktemp -d)
-          cp release-assets/pixie-netboot-pc-x86_64-*.vmlinuz  "$d/vmlinuz"
-          cp release-assets/pixie-netboot-pc-x86_64-*.initrd   "$d/initrd"
-          cp release-assets/pixie-netboot-pc-x86_64-*.squashfs "$d/live.squashfs"
-          tar -C "$d" -czf release-assets/pixie-live-env-x86_64.tar.gz \
-            vmlinuz initrd live.squashfs
-          ( cd release-assets && sha256sum pixie-live-env-x86_64.tar.gz \
-              > pixie-live-env-x86_64.tar.gz.sha256 )
-          # Ship the curated catalog (the netboot-capable nosi subset)
-          # so DEFAULT_CATALOG_URL (.../releases/latest/download/catalog.toml)
-          # resolves and pixie's Import + live-env TUI default work.
           cp src/pixie/catalog/catalog.toml release-assets/catalog.toml
           ls -la release-assets
       - name: Create / update GitHub Release
@@ -798,7 +635,8 @@ jobs:
 
             ## Media assets attached here
 
-            - `pixie-live-env-x86_64.tar.gz` — the live-env trio packaged for pixie's in-app **Fetch live-env** action (the default `PIXIE_LIVE_ENV_SRC`). Click Fetch live-env on the dashboard and pixie pulls + stages this itself; no manual bake or copy.
-            - `pixie-netboot-pc-x86_64-*.{vmlinuz,initrd,squashfs}` — the same live-env (netboot-pc bake) as loose files, if you prefer to stage `PIXIE_LIVE_ENV_DIR` (`data/live-env/`) by hand. Used by the `pixie-flash-once` / `pixie-flash-always` / `pixie-inventory` / `pixie-tui` boot modes.
-            - `pixie-usbboot-pc-x86_64-*.iso` — bootable USB / ISO media for the pixie live env (uncompressed; `dd` / Etcher / Ventoy ready).
+            - `pixie-live-env-x86_64.img.gz` — the **nbdboot** live-env image: the nosi `arch-headless` base disk image with the pixie CLI + `pixie-on-tty1` service injected. Fetch it from the **Catalog** tab (it seeds into a fresh catalog), then set `PIXIE_LIVE_ENV_IMAGE_SHA` to select it for the `pixie-flash-once` / `pixie-flash-always` / `pixie-inventory` / `pixie-tui` boot modes so they nbdboot this image ephemerally.
+            - `pixie-live-env-x86_64.content-sha256` — the raw-image sha256 to set `PIXIE_LIVE_ENV_IMAGE_SHA` to (identical to the `content_sha256` pixie assigns after fetching the `pixie-live-env` catalog entry).
+            - `pixie-live-env-catalog.toml` — the catalog fragment (the `pixie-live-env` disk image + its arch-headless netboot bundle) with `content_sha256` filled in; the shipped `catalog.toml` also lists these entries.
+            - `pixie-usbboot-pc-x86_64-*.iso` — bootable USB / ISO media for ad-hoc flash-install of images (uncompressed; `dd` / Etcher / Ventoy ready).
             - `*.sha256` — checksums for the above.

{pixie_lab-0.4.1 → pixie_lab-0.4.3}/CHANGELOG.md

@@ -11,6 +11,50 @@ operator-facing summary.
 
 ## [Unreleased]
 
+## [0.4.3] - 2026-07-26
+
+### Removed
+
+**The squashfs live-env path is retired.** The live-env boot modes
+(`pixie-inventory` / `pixie-tui` / `pixie-flash-once` / `pixie-flash-always`)
+now boot the disk image selected by `PIXIE_LIVE_ENV_IMAGE_SHA` over
+ephemeral nbdboot, full stop -- the old Debian live-boot squashfs
+delivery is gone. Removed: the `boot=live fetch=<squashfs>` render
+fallback (an unset image sha now degrades to the unavailable plan, so
+select an image on the Live env page), the in-app "Fetch live-env"
+action and `/ui/live-env/src/edit` route, the `PIXIE_LIVE_ENV_SRC` /
+`PIXIE_LIVE_ENV_DIR` settings and the `/boot/pixie-live-env` mount, and
+the `netboot-pc` live-build bake (with its `pixie-live-env-x86_64.tar.gz`
+release asset). The `usbboot-pc` bootable `.iso` -- for ad-hoc
+flash-install of images -- is unchanged.
+
+## [0.4.2] - 2026-07-26
+
+### Added
+
+**The live-env boots as an ephemeral-nbdboot disk image, not a
+live-boot squashfs.** The inventory / tui / flash boot modes now
+nbdboot a normal disk image (nosi `arch-headless` with the pixie CLI +
+`pixie-on-tty1` service injected) with a tmpfs overlay, instead of
+fetching a live-boot squashfs. This fixes boxes whose NIC never came up
+under the old Debian live-boot initramfs (dual-NIC Intel `igb` among
+them): the image rides the same dracut ramboot path that nbdboot
+already uses, which brings those NICs up. Point pixie at it by fetching
+the `pixie-live-env` catalog entry and setting `PIXIE_LIVE_ENV_IMAGE_SHA`
+(or the `live_env.image_sha` setting) to its content sha; the image ships
+as a release asset (`pixie-live-env-x86_64.img.gz`, under 2 GB) built and
+published by CI.
+
+### Fixed
+
+**Rootfs extraction picks the Linux root partition by GPT type.** The
+fetcher extracted partition 1 as `rootfs.raw`, correct for the
+ubuntu/debian cloud images (root at p1) but not for arch/fedora, whose
+images place BIOS-boot + ESP first and root at p3 -- there it produced a
+1 MiB stub that could not mount. It now selects by type (Linux-root GUID,
+then the largest Linux filesystem, then the largest non-firmware/boot/swap
+partition), so every nosi image extracts its real root.
+
 ## [0.4.1] - 2026-07-25
 
 ### Changed