switch to systemd-boot+clover for iso

[Eeems]

Summary by CodeRabbit

• New Features

  • ISO images now boot using Clover and systemd-boot, with serial console support at 115200 baud.
  • Added a command to list valid build targets.
  • Added quiet checks that show output only when failures occur.
  • Added BIOS boot testing for ISO releases.
  • VPN setup now uses automatic routing and DNS handling.

• Bug Fixes

  • ISO files are removed only after successful completion.
  • Invalid build targets now produce clear errors.

• Changes

  • Removed legacy GRUB and Syslinux boot entries.
  • Updated validation documentation.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The ISO pipeline now uses Clover and systemd-boot instead of GRUB and Syslinux. Build commands validate targets through a shared target list. The check command supports quiet output. VPN setup uses sshuttle. QEMU tests now cover legacy BIOS boots in CI.

Changes

ISO bootloader migration

Layer / File(s)	Summary
Clover staging and build integration overlay/base/etc/system/Isofile, overlay/base/etc/system/clover-config.plist	The image definition downloads and verifies Clover, stages its files, passes the UUID to create_live_bootloader, and installs the Clover configuration.
Systemd-boot and Clover image creation overlay/base/usr/lib/system/create_live_bootloader	The script creates a 256 MB FAT EFI image, installs systemd-boot, stages UUID-specific loader files, and copies Clover and its CD boot image into the archiso tree.
Archiso boot configuration and assembly overlay/base/etc/system/archiso/..., overlay/base/usr/lib/system/_os/cli/iso.py	The systemd-boot entry enables serial output. Legacy GRUB and Syslinux configuration is removed. GRUB-specific UUID substitution and xorriso handling are removed.
ISO target handling make/iso.py	The ISO command validates targets, uses typed Podman storage metadata, and deletes matching ISO files after the build completes.

Build target tooling

Layer / File(s)	Summary
Target discovery and validation make/config.py, make/build.py, make/checkupdates.py, make/hash.py, make/run.py, make/scan.py	all_targets() defines valid targets. Build commands reject unknown targets before starting their operations.
Target listing command make/targets.py	The new targets command prints all valid targets in sorted order.

Quiet check mode

Layer / File(s)	Summary
Quiet check output and documentation make/check.py, AGENTS.md	Quiet mode captures check output and replays it to stderr when a check fails. The check suite verifies traceback replay. Documentation describes unit-test execution and the updated quiet validation command.

SSH VPN transport

Layer / File(s)	Summary
sshuttle transport and tunnel verification overlay/eeems/usr/bin/sshvpn, variants/eeems.Containerfile	The VPN script uses sshuttle, records its process ID, uses HTTPS for public-IP checks, and verifies a changed public IP while the process remains active. The image installs sshuttle.

BIOS boot testing

Layer / File(s)	Summary
QEMU BIOS control and test runner make/boot.py, make/test.py	QEMU supports legacy BIOS mode, QMP control, and configurable login timeouts. The test runner sends boot keys through QMP and captures diagnostics.
BIOS CI release gate .github/workflows/iso.yaml	CI runs a BIOS installation test and requires it before release.

Base image cleanup

Layer / File(s)	Summary
Base package cleanup variants/base.Containerfile	The package layer removes /usr/bin/su with hook files and no longer removes resolver utilities.

Estimated code review effort: 5 (Critical) | ~90 minutes

Merge Risk:🟠 High · up to 26c6b

The PR changes both ISO boot behavior and VPN networking, but the BIOS boot path may lack the configuration required for the intended systemd-boot selection, while VPN startup, routing, listener exposure, and teardown can produce incorrect or unsafe behavior. The PR should not merge until these boot and networking issues are fixed or explicitly accepted by the owners.

Sequence Diagram(s)

sequenceDiagram
participant TestCommand
participant QEMU
participant QMP
participant Login
TestCommand->>QEMU: Start legacy BIOS boot
QEMU->>QMP: Expose TCP monitor
TestCommand->>QMP: Send Enter key events
QMP->>QEMU: Drive bootloader
TestCommand->>Login: Wait with BIOS timeout

Loading

Poem

A rabbit packs Clover with care
Into an EFI image square
Old boot paths fade away
New targets list the way
BIOS boots join the tests
Quiet checks report the rest

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 11 files. (4 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary ISO bootloader change from GRUB to systemd-boot with Clover integration.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 11 files. (4 skipped: 4 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Eeems]

Summary by CodeRabbit

• New Features

  • ISO images now boot using Clover and systemd-boot, with serial console support at 115200 baud.
  • Added a command to list valid build targets.
  • Added quiet checks that show output only when failures occur.
  • Added BIOS boot testing for ISO releases.
  • VPN setup now uses automatic routing and DNS handling.

• Bug Fixes

  • ISO files are removed only after successful completion.
  • Invalid build targets now produce clear errors.

• Changes

  • Removed legacy GRUB and Syslinux boot entries.
  • Updated validation documentation.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The ISO pipeline now uses Clover and systemd-boot instead of GRUB and Syslinux. Build commands validate targets through a shared target list. The check command supports quiet output. VPN setup uses sshuttle. QEMU tests now cover legacy BIOS boots in CI.

Changes

ISO bootloader migration

Layer / File(s)	Summary
Clover staging and build integration overlay/base/etc/system/Isofile, overlay/base/etc/system/clover-config.plist	The image definition downloads and verifies Clover, stages its files, passes the UUID to create_live_bootloader, and installs the Clover configuration.
Systemd-boot and Clover image creation overlay/base/usr/lib/system/create_live_bootloader	The script creates a 256 MB FAT EFI image, installs systemd-boot, stages UUID-specific loader files, and copies Clover and its CD boot image into the archiso tree.
Archiso boot configuration and assembly overlay/base/etc/system/archiso/..., overlay/base/usr/lib/system/_os/cli/iso.py	The systemd-boot entry enables serial output. Legacy GRUB and Syslinux configuration is removed. GRUB-specific UUID substitution and xorriso handling are removed.
ISO target handling make/iso.py	The ISO command validates targets, uses typed Podman storage metadata, and deletes matching ISO files after the build completes.

Build target tooling

Layer / File(s)	Summary
Target discovery and validation make/config.py, make/build.py, make/checkupdates.py, make/hash.py, make/run.py, make/scan.py	all_targets() defines valid targets. Build commands reject unknown targets before starting their operations.
Target listing command make/targets.py	The new targets command prints all valid targets in sorted order.

Quiet check mode

Layer / File(s)	Summary
Quiet check output and documentation make/check.py, AGENTS.md	Quiet mode captures check output and replays it to stderr when a check fails. The check suite verifies traceback replay. Documentation describes unit-test execution and the updated quiet validation command.

SSH VPN transport

Layer / File(s)	Summary
sshuttle transport and tunnel verification overlay/eeems/usr/bin/sshvpn, variants/eeems.Containerfile	The VPN script uses sshuttle, records its process ID, uses HTTPS for public-IP checks, and verifies a changed public IP while the process remains active. The image installs sshuttle.

BIOS boot testing

Layer / File(s)	Summary
QEMU BIOS control and test runner make/boot.py, make/test.py	QEMU supports legacy BIOS mode, QMP control, and configurable login timeouts. The test runner sends boot keys through QMP and captures diagnostics.
BIOS CI release gate .github/workflows/iso.yaml	CI runs a BIOS installation test and requires it before release.

Base image cleanup

Layer / File(s)	Summary
Base package cleanup variants/base.Containerfile	The package layer removes /usr/bin/su with hook files and no longer removes resolver utilities.

Estimated code review effort: 5 (Critical) | ~90 minutes

Merge Risk:🟠 High · up to 26c6b

The PR changes both ISO boot behavior and VPN networking, but the BIOS boot path may lack the configuration required for the intended systemd-boot selection, while VPN startup, routing, listener exposure, and teardown can produce incorrect or unsafe behavior. The PR should not merge until these boot and networking issues are fixed or explicitly accepted by the owners.

Sequence Diagram(s)

sequenceDiagram
participant TestCommand
participant QEMU
participant QMP
participant Login
TestCommand->>QEMU: Start legacy BIOS boot
QEMU->>QMP: Expose TCP monitor
TestCommand->>QMP: Send Enter key events
QMP->>QEMU: Drive bootloader
TestCommand->>Login: Wait with BIOS timeout

Loading

Poem

A rabbit packs Clover with care
Into an EFI image square
Old boot paths fade away
New targets list the way
BIOS boots join the tests
Quiet checks report the rest

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 11 files. (4 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary ISO bootloader change from GRUB to systemd-boot with Clover integration.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 11 files. (4 skipped: 4 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Eeems]

Summary by CodeRabbit

• New Features

  • ISO images now boot using Clover and systemd-boot, with serial console support at 115200 baud.
  • Added a command to list valid build targets.
  • Added quiet checks that show output only when failures occur.
  • Added BIOS boot testing for ISO releases.
  • VPN setup now uses automatic routing and DNS handling.

• Bug Fixes

  • ISO files are removed only after successful completion.
  • Invalid build targets now produce clear errors.

• Changes

  • Removed legacy GRUB and Syslinux boot entries.
  • Updated validation documentation.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The ISO pipeline now uses Clover and systemd-boot instead of GRUB and Syslinux. Build commands validate targets through a shared target list. The check command supports quiet output. VPN setup uses sshuttle. QEMU tests now cover legacy BIOS boots in CI.

Changes

ISO bootloader migration

Layer / File(s)	Summary
Clover staging and build integration overlay/base/etc/system/Isofile, overlay/base/etc/system/clover-config.plist	The image definition downloads and verifies Clover, stages its files, passes the UUID to create_live_bootloader, and installs the Clover configuration.
Systemd-boot and Clover image creation overlay/base/usr/lib/system/create_live_bootloader	The script creates a 256 MB FAT EFI image, installs systemd-boot, stages UUID-specific loader files, and copies Clover and its CD boot image into the archiso tree.
Archiso boot configuration and assembly overlay/base/etc/system/archiso/..., overlay/base/usr/lib/system/_os/cli/iso.py	The systemd-boot entry enables serial output. Legacy GRUB and Syslinux configuration is removed. GRUB-specific UUID substitution and xorriso handling are removed.
ISO target handling make/iso.py	The ISO command validates targets, uses typed Podman storage metadata, and deletes matching ISO files after the build completes.

Build target tooling

Layer / File(s)	Summary
Target discovery and validation make/config.py, make/build.py, make/checkupdates.py, make/hash.py, make/run.py, make/scan.py	all_targets() defines valid targets. Build commands reject unknown targets before starting their operations.
Target listing command make/targets.py	The new targets command prints all valid targets in sorted order.

Quiet check mode

Layer / File(s)	Summary
Quiet check output and documentation make/check.py, AGENTS.md	Quiet mode captures check output and replays it to stderr when a check fails. The check suite verifies traceback replay. Documentation describes unit-test execution and the updated quiet validation command.

SSH VPN transport

Layer / File(s)	Summary
sshuttle transport and tunnel verification overlay/eeems/usr/bin/sshvpn, variants/eeems.Containerfile	The VPN script uses sshuttle, records its process ID, uses HTTPS for public-IP checks, and verifies a changed public IP while the process remains active. The image installs sshuttle.

BIOS boot testing

Layer / File(s)	Summary
QEMU BIOS control and test runner make/boot.py, make/test.py	QEMU supports legacy BIOS mode, QMP control, and configurable login timeouts. The test runner sends boot keys through QMP and captures diagnostics.
BIOS CI release gate .github/workflows/iso.yaml	CI runs a BIOS installation test and requires it before release.

Base image cleanup

Layer / File(s)	Summary
Base package cleanup variants/base.Containerfile	The package layer removes /usr/bin/su with hook files and no longer removes resolver utilities.

Estimated code review effort: 5 (Critical) | ~90 minutes

Merge Risk:🟠 High · up to 26c6b

The PR changes both ISO boot behavior and VPN networking, but the BIOS boot path may lack the configuration required for the intended systemd-boot selection, while VPN startup, routing, listener exposure, and teardown can produce incorrect or unsafe behavior. The PR should not merge until these boot and networking issues are fixed or explicitly accepted by the owners.

Sequence Diagram(s)

sequenceDiagram
participant TestCommand
participant QEMU
participant QMP
participant Login
TestCommand->>QEMU: Start legacy BIOS boot
QEMU->>QMP: Expose TCP monitor
TestCommand->>QMP: Send Enter key events
QMP->>QEMU: Drive bootloader
TestCommand->>Login: Wait with BIOS timeout

Loading

Poem

A rabbit packs Clover with care
Into an EFI image square
Old boot paths fade away
New targets list the way
BIOS boots join the tests
Quiet checks report the rest

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 11 files. (4 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary ISO bootloader change from GRUB to systemd-boot with Clover integration.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 11 files. (4 skipped: 4 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Eeems]

Summary by CodeRabbit

• New Features

  • ISO images now boot using Clover and systemd-boot, with serial console support at 115200 baud.
  • Added a command to list valid build targets.
  • Added quiet checks that show output only when failures occur.
  • Added BIOS boot testing for ISO releases.
  • VPN setup now uses automatic routing and DNS handling.

• Bug Fixes

  • ISO files are removed only after successful completion.
  • Invalid build targets now produce clear errors.

• Changes

  • Removed legacy GRUB and Syslinux boot entries.
  • Updated validation documentation.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The ISO pipeline now uses Clover and systemd-boot instead of GRUB and Syslinux. Build commands validate targets through a shared target list. The check command supports quiet output. VPN setup uses sshuttle. QEMU tests now cover legacy BIOS boots in CI.

Changes

ISO bootloader migration

Layer / File(s)	Summary
Clover staging and build integration overlay/base/etc/system/Isofile, overlay/base/etc/system/clover-config.plist	The image definition downloads and verifies Clover, stages its files, passes the UUID to create_live_bootloader, and installs the Clover configuration.
Systemd-boot and Clover image creation overlay/base/usr/lib/system/create_live_bootloader	The script creates a 256 MB FAT EFI image, installs systemd-boot, stages UUID-specific loader files, and copies Clover and its CD boot image into the archiso tree.
Archiso boot configuration and assembly overlay/base/etc/system/archiso/..., overlay/base/usr/lib/system/_os/cli/iso.py	The systemd-boot entry enables serial output. Legacy GRUB and Syslinux configuration is removed. GRUB-specific UUID substitution and xorriso handling are removed.
ISO target handling make/iso.py	The ISO command validates targets, uses typed Podman storage metadata, and deletes matching ISO files after the build completes.

Build target tooling

Layer / File(s)	Summary
Target discovery and validation make/config.py, make/build.py, make/checkupdates.py, make/hash.py, make/run.py, make/scan.py	all_targets() defines valid targets. Build commands reject unknown targets before starting their operations.
Target listing command make/targets.py	The new targets command prints all valid targets in sorted order.

Quiet check mode

Layer / File(s)	Summary
Quiet check output and documentation make/check.py, AGENTS.md	Quiet mode captures check output and replays it to stderr when a check fails. The check suite verifies traceback replay. Documentation describes unit-test execution and the updated quiet validation command.

SSH VPN transport

Layer / File(s)	Summary
sshuttle transport and tunnel verification overlay/eeems/usr/bin/sshvpn, variants/eeems.Containerfile	The VPN script uses sshuttle, records its process ID, uses HTTPS for public-IP checks, and verifies a changed public IP while the process remains active. The image installs sshuttle.

BIOS boot testing

Layer / File(s)	Summary
QEMU BIOS control and test runner make/boot.py, make/test.py	QEMU supports legacy BIOS mode, QMP control, and configurable login timeouts. The test runner sends boot keys through QMP and captures diagnostics.
BIOS CI release gate .github/workflows/iso.yaml	CI runs a BIOS installation test and requires it before release.

Base image cleanup

Layer / File(s)	Summary
Base package cleanup variants/base.Containerfile	The package layer removes /usr/bin/su with hook files and no longer removes resolver utilities.

Estimated code review effort: 5 (Critical) | ~90 minutes

Merge Risk:🟠 High · up to 26c6b

The PR changes both ISO boot behavior and VPN networking, but the BIOS boot path may lack the configuration required for the intended systemd-boot selection, while VPN startup, routing, listener exposure, and teardown can produce incorrect or unsafe behavior. The PR should not merge until these boot and networking issues are fixed or explicitly accepted by the owners.

Sequence Diagram(s)

sequenceDiagram
participant TestCommand
participant QEMU
participant QMP
participant Login
TestCommand->>QEMU: Start legacy BIOS boot
QEMU->>QMP: Expose TCP monitor
TestCommand->>QMP: Send Enter key events
QMP->>QEMU: Drive bootloader
TestCommand->>Login: Wait with BIOS timeout

Loading

Poem

A rabbit packs Clover with care
Into an EFI image square
Old boot paths fade away
New targets list the way
BIOS boots join the tests
Quiet checks report the rest

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 11 files. (4 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary ISO bootloader change from GRUB to systemd-boot with Clover integration.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 11 files. (4 skipped: 4 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Eeems]

Summary by CodeRabbit

• New Features

  • ISO images now boot using Clover and systemd-boot, with serial console support at 115200 baud.
  • Added a command to list valid build targets.
  • Added quiet checks that show output only when failures occur.
  • Added BIOS boot testing for ISO releases.
  • VPN setup now uses automatic routing and DNS handling.

• Bug Fixes

  • ISO files are removed only after successful completion.
  • Invalid build targets now produce clear errors.

• Changes

  • Removed legacy GRUB and Syslinux boot entries.
  • Updated validation documentation.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The ISO pipeline now uses Clover and systemd-boot instead of GRUB and Syslinux. Build commands validate targets through a shared target list. The check command supports quiet output. VPN setup uses sshuttle. QEMU tests now cover legacy BIOS boots in CI.

Changes

ISO bootloader migration

Layer / File(s)	Summary
Clover staging and build integration overlay/base/etc/system/Isofile, overlay/base/etc/system/clover-config.plist	The image definition downloads and verifies Clover, stages its files, passes the UUID to create_live_bootloader, and installs the Clover configuration.
Systemd-boot and Clover image creation overlay/base/usr/lib/system/create_live_bootloader	The script creates a 256 MB FAT EFI image, installs systemd-boot, stages UUID-specific loader files, and copies Clover and its CD boot image into the archiso tree.
Archiso boot configuration and assembly overlay/base/etc/system/archiso/..., overlay/base/usr/lib/system/_os/cli/iso.py	The systemd-boot entry enables serial output. Legacy GRUB and Syslinux configuration is removed. GRUB-specific UUID substitution and xorriso handling are removed.
ISO target handling make/iso.py	The ISO command validates targets, uses typed Podman storage metadata, and deletes matching ISO files after the build completes.

Build target tooling

Layer / File(s)	Summary
Target discovery and validation make/config.py, make/build.py, make/checkupdates.py, make/hash.py, make/run.py, make/scan.py	all_targets() defines valid targets. Build commands reject unknown targets before starting their operations.
Target listing command make/targets.py	The new targets command prints all valid targets in sorted order.

Quiet check mode

Layer / File(s)	Summary
Quiet check output and documentation make/check.py, AGENTS.md	Quiet mode captures check output and replays it to stderr when a check fails. The check suite verifies traceback replay. Documentation describes unit-test execution and the updated quiet validation command.

SSH VPN transport

Layer / File(s)	Summary
sshuttle transport and tunnel verification overlay/eeems/usr/bin/sshvpn, variants/eeems.Containerfile	The VPN script uses sshuttle, records its process ID, uses HTTPS for public-IP checks, and verifies a changed public IP while the process remains active. The image installs sshuttle.

BIOS boot testing

Layer / File(s)	Summary
QEMU BIOS control and test runner make/boot.py, make/test.py	QEMU supports legacy BIOS mode, QMP control, and configurable login timeouts. The test runner sends boot keys through QMP and captures diagnostics.
BIOS CI release gate .github/workflows/iso.yaml	CI runs a BIOS installation test and requires it before release.

Base image cleanup

Layer / File(s)	Summary
Base package cleanup variants/base.Containerfile	The package layer removes /usr/bin/su with hook files and no longer removes resolver utilities.

Estimated code review effort: 5 (Critical) | ~90 minutes

Merge Risk:🟠 High · up to 26c6b

The PR changes both ISO boot behavior and VPN networking, but the BIOS boot path may lack the configuration required for the intended systemd-boot selection, while VPN startup, routing, listener exposure, and teardown can produce incorrect or unsafe behavior. The PR should not merge until these boot and networking issues are fixed or explicitly accepted by the owners.

Sequence Diagram(s)

sequenceDiagram
participant TestCommand
participant QEMU
participant QMP
participant Login
TestCommand->>QEMU: Start legacy BIOS boot
QEMU->>QMP: Expose TCP monitor
TestCommand->>QMP: Send Enter key events
QMP->>QEMU: Drive bootloader
TestCommand->>Login: Wait with BIOS timeout

Loading

Poem

A rabbit packs Clover with care
Into an EFI image square
Old boot paths fade away
New targets list the way
BIOS boots join the tests
Quiet checks report the rest

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 11 files. (4 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary ISO bootloader change from GRUB to systemd-boot with Clover integration.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 11 files. (4 skipped: 4 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Eeems]

Summary by CodeRabbit

• New Features

  • ISO images now boot using Clover and systemd-boot, with serial console support at 115200 baud.
  • Added a command to list valid build targets.
  • Added quiet checks that show output only when failures occur.
  • Added BIOS boot testing for ISO releases.
  • VPN setup now uses automatic routing and DNS handling.

• Bug Fixes

  • ISO files are removed only after successful completion.
  • Invalid build targets now produce clear errors.

• Changes

  • Removed legacy GRUB and Syslinux boot entries.
  • Updated validation documentation.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The ISO pipeline now uses Clover and systemd-boot instead of GRUB and Syslinux. Build commands validate targets through a shared target list. The check command supports quiet output. VPN setup uses sshuttle. QEMU tests now cover legacy BIOS boots in CI.

Changes

ISO bootloader migration

Layer / File(s)	Summary
Clover staging and build integration overlay/base/etc/system/Isofile, overlay/base/etc/system/clover-config.plist	The image definition downloads and verifies Clover, stages its files, passes the UUID to create_live_bootloader, and installs the Clover configuration.
Systemd-boot and Clover image creation overlay/base/usr/lib/system/create_live_bootloader	The script creates a 256 MB FAT EFI image, installs systemd-boot, stages UUID-specific loader files, and copies Clover and its CD boot image into the archiso tree.
Archiso boot configuration and assembly overlay/base/etc/system/archiso/..., overlay/base/usr/lib/system/_os/cli/iso.py	The systemd-boot entry enables serial output. Legacy GRUB and Syslinux configuration is removed. GRUB-specific UUID substitution and xorriso handling are removed.
ISO target handling make/iso.py	The ISO command validates targets, uses typed Podman storage metadata, and deletes matching ISO files after the build completes.

Build target tooling

Layer / File(s)	Summary
Target discovery and validation make/config.py, make/build.py, make/checkupdates.py, make/hash.py, make/run.py, make/scan.py	all_targets() defines valid targets. Build commands reject unknown targets before starting their operations.
Target listing command make/targets.py	The new targets command prints all valid targets in sorted order.

Quiet check mode

Layer / File(s)	Summary
Quiet check output and documentation make/check.py, AGENTS.md	Quiet mode captures check output and replays it to stderr when a check fails. The check suite verifies traceback replay. Documentation describes unit-test execution and the updated quiet validation command.

SSH VPN transport

Layer / File(s)	Summary
sshuttle transport and tunnel verification overlay/eeems/usr/bin/sshvpn, variants/eeems.Containerfile	The VPN script uses sshuttle, records its process ID, uses HTTPS for public-IP checks, and verifies a changed public IP while the process remains active. The image installs sshuttle.

BIOS boot testing

Layer / File(s)	Summary
QEMU BIOS control and test runner make/boot.py, make/test.py	QEMU supports legacy BIOS mode, QMP control, and configurable login timeouts. The test runner sends boot keys through QMP and captures diagnostics.
BIOS CI release gate .github/workflows/iso.yaml	CI runs a BIOS installation test and requires it before release.

Base image cleanup

Layer / File(s)	Summary
Base package cleanup variants/base.Containerfile	The package layer removes /usr/bin/su with hook files and no longer removes resolver utilities.

Estimated code review effort: 5 (Critical) | ~90 minutes

Merge Risk:🟠 High · up to 26c6b

The PR changes both ISO boot behavior and VPN networking, but the BIOS boot path may lack the configuration required for the intended systemd-boot selection, while VPN startup, routing, listener exposure, and teardown can produce incorrect or unsafe behavior. The PR should not merge until these boot and networking issues are fixed or explicitly accepted by the owners.

Sequence Diagram(s)

sequenceDiagram
participant TestCommand
participant QEMU
participant QMP
participant Login
TestCommand->>QEMU: Start legacy BIOS boot
QEMU->>QMP: Expose TCP monitor
TestCommand->>QMP: Send Enter key events
QMP->>QEMU: Drive bootloader
TestCommand->>Login: Wait with BIOS timeout

Loading

Poem

A rabbit packs Clover with care
Into an EFI image square
Old boot paths fade away
New targets list the way
BIOS boots join the tests
Quiet checks report the rest

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 11 files. (4 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary ISO bootloader change from GRUB to systemd-boot with Clover integration.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 11 files. (4 skipped: 4 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Eeems]

Summary by CodeRabbit

• New Features

  • ISO images now boot using Clover and systemd-boot, with serial console support at 115200 baud.
  • Added a command to list valid build targets.
  • Added quiet checks that show output only when failures occur.
  • Added BIOS boot testing for ISO releases.
  • VPN setup now uses automatic routing and DNS handling.

• Bug Fixes

  • ISO files are removed only after successful completion.
  • Invalid build targets now produce clear errors.

• Changes

  • Removed legacy GRUB and Syslinux boot entries.
  • Updated validation documentation.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The ISO pipeline now uses Clover and systemd-boot instead of GRUB and Syslinux. Build commands validate targets through a shared target list. The check command supports quiet output. VPN setup uses sshuttle. QEMU tests now cover legacy BIOS boots in CI.

Changes

ISO bootloader migration

Layer / File(s)	Summary
Clover staging and build integration overlay/base/etc/system/Isofile, overlay/base/etc/system/clover-config.plist	The image definition downloads and verifies Clover, stages its files, passes the UUID to create_live_bootloader, and installs the Clover configuration.
Systemd-boot and Clover image creation overlay/base/usr/lib/system/create_live_bootloader	The script creates a 256 MB FAT EFI image, installs systemd-boot, stages UUID-specific loader files, and copies Clover and its CD boot image into the archiso tree.
Archiso boot configuration and assembly overlay/base/etc/system/archiso/..., overlay/base/usr/lib/system/_os/cli/iso.py	The systemd-boot entry enables serial output. Legacy GRUB and Syslinux configuration is removed. GRUB-specific UUID substitution and xorriso handling are removed.
ISO target handling make/iso.py	The ISO command validates targets, uses typed Podman storage metadata, and deletes matching ISO files after the build completes.

Build target tooling

Layer / File(s)	Summary
Target discovery and validation make/config.py, make/build.py, make/checkupdates.py, make/hash.py, make/run.py, make/scan.py	all_targets() defines valid targets. Build commands reject unknown targets before starting their operations.
Target listing command make/targets.py	The new targets command prints all valid targets in sorted order.

Quiet check mode

Layer / File(s)	Summary
Quiet check output and documentation make/check.py, AGENTS.md	Quiet mode captures check output and replays it to stderr when a check fails. The check suite verifies traceback replay. Documentation describes unit-test execution and the updated quiet validation command.

SSH VPN transport

Layer / File(s)	Summary
sshuttle transport and tunnel verification overlay/eeems/usr/bin/sshvpn, variants/eeems.Containerfile	The VPN script uses sshuttle, records its process ID, uses HTTPS for public-IP checks, and verifies a changed public IP while the process remains active. The image installs sshuttle.

BIOS boot testing

Layer / File(s)	Summary
QEMU BIOS control and test runner make/boot.py, make/test.py	QEMU supports legacy BIOS mode, QMP control, and configurable login timeouts. The test runner sends boot keys through QMP and captures diagnostics.
BIOS CI release gate .github/workflows/iso.yaml	CI runs a BIOS installation test and requires it before release.

Base image cleanup

Layer / File(s)	Summary
Base package cleanup variants/base.Containerfile	The package layer removes /usr/bin/su with hook files and no longer removes resolver utilities.

Estimated code review effort: 5 (Critical) | ~90 minutes

Merge Risk:🟠 High · up to 26c6b

The PR changes both ISO boot behavior and VPN networking, but the BIOS boot path may lack the configuration required for the intended systemd-boot selection, while VPN startup, routing, listener exposure, and teardown can produce incorrect or unsafe behavior. The PR should not merge until these boot and networking issues are fixed or explicitly accepted by the owners.

Sequence Diagram(s)

sequenceDiagram
participant TestCommand
participant QEMU
participant QMP
participant Login
TestCommand->>QEMU: Start legacy BIOS boot
QEMU->>QMP: Expose TCP monitor
TestCommand->>QMP: Send Enter key events
QMP->>QEMU: Drive bootloader
TestCommand->>Login: Wait with BIOS timeout

Loading

Poem

A rabbit packs Clover with care
Into an EFI image square
Old boot paths fade away
New targets list the way
BIOS boots join the tests
Quiet checks report the rest

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 11 files. (4 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary ISO bootloader change from GRUB to systemd-boot with Clover integration.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 11 files. (4 skipped: 4 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Eeems]

Summary by CodeRabbit

• New Features

  • ISO images now boot using Clover and systemd-boot, with serial console support at 115200 baud.
  • Added a command to list valid build targets.
  • Added quiet checks that show output only when failures occur.
  • Added BIOS boot testing for ISO releases.
  • VPN setup now uses automatic routing and DNS handling.

• Bug Fixes

  • ISO files are removed only after successful completion.
  • Invalid build targets now produce clear errors.

• Changes

  • Removed legacy GRUB and Syslinux boot entries.
  • Updated validation documentation.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The ISO pipeline now uses Clover and systemd-boot instead of GRUB and Syslinux. Build commands validate targets through a shared target list. The check command supports quiet output. VPN setup uses sshuttle. QEMU tests now cover legacy BIOS boots in CI.

Changes

ISO bootloader migration

Layer / File(s)	Summary
Clover staging and build integration overlay/base/etc/system/Isofile, overlay/base/etc/system/clover-config.plist	The image definition downloads and verifies Clover, stages its files, passes the UUID to create_live_bootloader, and installs the Clover configuration.
Systemd-boot and Clover image creation overlay/base/usr/lib/system/create_live_bootloader	The script creates a 256 MB FAT EFI image, installs systemd-boot, stages UUID-specific loader files, and copies Clover and its CD boot image into the archiso tree.
Archiso boot configuration and assembly overlay/base/etc/system/archiso/..., overlay/base/usr/lib/system/_os/cli/iso.py	The systemd-boot entry enables serial output. Legacy GRUB and Syslinux configuration is removed. GRUB-specific UUID substitution and xorriso handling are removed.
ISO target handling make/iso.py	The ISO command validates targets, uses typed Podman storage metadata, and deletes matching ISO files after the build completes.

Build target tooling

Layer / File(s)	Summary
Target discovery and validation make/config.py, make/build.py, make/checkupdates.py, make/hash.py, make/run.py, make/scan.py	all_targets() defines valid targets. Build commands reject unknown targets before starting their operations.
Target listing command make/targets.py	The new targets command prints all valid targets in sorted order.

Quiet check mode

Layer / File(s)	Summary
Quiet check output and documentation make/check.py, AGENTS.md	Quiet mode captures check output and replays it to stderr when a check fails. The check suite verifies traceback replay. Documentation describes unit-test execution and the updated quiet validation command.

SSH VPN transport

Layer / File(s)	Summary
sshuttle transport and tunnel verification overlay/eeems/usr/bin/sshvpn, variants/eeems.Containerfile	The VPN script uses sshuttle, records its process ID, uses HTTPS for public-IP checks, and verifies a changed public IP while the process remains active. The image installs sshuttle.

BIOS boot testing

Layer / File(s)	Summary
QEMU BIOS control and test runner make/boot.py, make/test.py	QEMU supports legacy BIOS mode, QMP control, and configurable login timeouts. The test runner sends boot keys through QMP and captures diagnostics.
BIOS CI release gate .github/workflows/iso.yaml	CI runs a BIOS installation test and requires it before release.

Base image cleanup

Layer / File(s)	Summary
Base package cleanup variants/base.Containerfile	The package layer removes /usr/bin/su with hook files and no longer removes resolver utilities.

Estimated code review effort: 5 (Critical) | ~90 minutes

Merge Risk:🟠 High · up to 26c6b

The PR changes both ISO boot behavior and VPN networking, but the BIOS boot path may lack the configuration required for the intended systemd-boot selection, while VPN startup, routing, listener exposure, and teardown can produce incorrect or unsafe behavior. The PR should not merge until these boot and networking issues are fixed or explicitly accepted by the owners.

Sequence Diagram(s)

sequenceDiagram
participant TestCommand
participant QEMU
participant QMP
participant Login
TestCommand->>QEMU: Start legacy BIOS boot
QEMU->>QMP: Expose TCP monitor
TestCommand->>QMP: Send Enter key events
QMP->>QEMU: Drive bootloader
TestCommand->>Login: Wait with BIOS timeout

Loading

Poem

A rabbit packs Clover with care
Into an EFI image square
Old boot paths fade away
New targets list the way
BIOS boots join the tests
Quiet checks report the rest

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 11 files. (4 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary ISO bootloader change from GRUB to systemd-boot with Clover integration.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 11 files. (4 skipped: 4 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}