image: mkosi from nixpkgs

[malt3]

Context

This is a large step towards reproducible OS image builds. With this change, mkosi and all required tools are installed with nix.
In a follow up step, we will pin all RPMs required to build a Fedora image.

Proposed change(s)

• use rules_nixpkgs
• provide toolchains from nixpkgs (allows running bazel build directly on NixOS)
• mkosi ruleset
• refactor image build for new mkosi version
• reimplement measurement precalculation

How to review

Since this PR is quite large, it is probably a good idea to not have everyone review it in full.
Instead, review a part that you are the expert of and comment what you reviewed.
Also, please test if you can build an image on your (Linux) workstation.

How to test

• When creating a cluster, you can use the following debug image created by the pipeline: ref/feat-image-nix-mkosi-toolchain/stream/debug/v2.12.0-pre.0.20230926093438-08d3e02d2353
• On NixOS, add common --config=nix to .bazeloverwriterc and build images (see image/README.md)
• On non-NixOS
  • notice how image build fails without nix installed
  • notice how the rest still works as expected (go binaries)
  • install nix using the determinate systems installer
  • add common --config=nix to .bazeloverwriterc
  • run bazel clean --expunge and build images (see image/README.md)

Checklist

• Update docs
• Add labels (e.g., for changelog category)
• Is PR title adequate for changelog?
• Link to Milestone
• e2e tests
  • GCP
  • Azure
  • AWS
• build pipeline in CI

[netlify]

✅ Deploy Preview for constellation-docs canceled.

Name	Link
🔨 Latest commit	0820989
🔍 Latest deploy log	https://app.netlify.com/sites/constellation-docs/deploys/65143de62f018b000881c2c9

[katexochen]

We should add a formatter/linter/instantiate workflow to the CI (not in this PR, but soon).

[msanft]

Image builds complete successfully on NixOS after a cache clean, nice work!🤟

[daniel-weisse]

Image build worked for me on Fedora 37

[3u13r]

Small nit. Works on Ubuntu 22.04. Did not really review the bazel code as it is too complex for me.

[elchead]

I haven't build the image (on Mac) and have only overlooked the Terraform changes. Should we document the change to disabled secure boot on GCP?

[malt3]

Should we document the change to disabled secure boot on GCP?

I'll document this and also update the docs with the boot measurement table

[github-actions]

Coverage report

Package	Old	New	Trend
bootstrapper/cmd/bootstrapper	[no test files]	[no test files]	🚧
cli/internal/terraform	71.40%	71.40%	↔️
debugd/cmd/debugd	[no test files]	[no test files]	🚧
disk-mapper/cmd	[no test files]	[no test files]	🚧
image/measured-boot/cmd	0.00%	[no test files]	🚨
image/measured-boot/extract	0.00%	84.40%	🆕
image/measured-boot/fixtures	0.00%	[no test files]	🚨
image/measured-boot/measure	0.00%	76.70%	🆕
image/measured-boot/pesection	0.00%	[no test files]	🚨
image/upload/internal/cmd	[no test files]	[no test files]	🚧
internal/osimage	[no test files]	[no test files]	🚧
internal/osimage/aws	[no test files]	[no test files]	🚧
internal/osimage/gcp	[no test files]	[no test files]	🚧
measurement-reader/cmd	[no test files]	[no test files]	🚧
upgrade-agent/cmd	[no test files]	[no test files]	🚧