From 77fb889362314eea5b95900f934d3e3165019262 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Fri, 3 Mar 2023 12:48:08 -0500
Subject: [PATCH 01/36] Package all globzl zone tarballs into single tarball

---
 .github/buildomat/jobs/package.sh | 43 ++++++++++++++++++++++---------
 1 file changed, 31 insertions(+), 12 deletions(-)

diff --git a/.github/buildomat/jobs/package.sh b/.github/buildomat/jobs/package.sh
index 79250e91152..0571d1b7687 100644
--- a/.github/buildomat/jobs/package.sh
+++ b/.github/buildomat/jobs/package.sh
@@ -5,10 +5,14 @@
 #: target = "helios-latest"
 #: rust_toolchain = "1.66.1"
 #: output_rules = [
-#:	"=/work/package.tar.gz",
+#:	"=/work/global-zone-packages.tar.gz",
 #:	"=/work/zones/*.tar.gz",
 #: ]
 #:
+#: [[publish]]
+#: series = "image"
+#: name = "global-zone-packages"
+#: from_output = "/out/global-zone-packages.tar.gz"
 
 set -o errexit
 set -o pipefail
@@ -17,18 +21,33 @@ set -o xtrace
 cargo --version
 rustc --version
 
+# Build
 ptime -m ./tools/install_builder_prerequisites.sh -yp
-ptime -m ./tools/create_self_signed_cert.sh -yp
-
 ptime -m cargo run --locked --release --bin omicron-package -- package
 
-files=(
-	out/*.tar
-	package-manifest.toml
-	smf/sled-agent/config.toml
-	target/release/omicron-package
-	tools/create_virtual_hardware.sh
-)
-ptime -m tar cvzf /work/package.tar.gz "${files[@]}"
+# Assemble global zone files in a temporary directory.
+tmp=$(mktemp -d)
+mkdir -p "${tmp}/sled-agent"
+tar -xvzf out/omicron-sled-agent.tar -C "${tmp}/sled-agent"
+mkdir -p "${tmp}/maghemite"
+tar -xvzf out/maghemite.tar -C "${tmp}/maghemite"
+
+# Load those global zone files into a tarball that's ready to be exported.
+mkdir -p /work
+ptime -m tar cvzf /work/global-zone-packages.tar.gz -C "${tmp}" .
+
+# Assemble Zone Images into their respective output locations.
 mkdir -p /work/zones
-mv out/*.tar.gz /work/zones/
+zones=(
+	out/clickhouse.tar.gz
+	out/cockroachdb.tar.gz
+	out/crucible-pantry.tar.gz
+	out/crucible.tar.gz
+	out/external-dns.tar.gz
+	out/internal-dns.tar.gz
+	out/omicron-nexus.tar.gz
+	out/oximeter-collector.tar.gz
+	out/propolis-server.tar.gz
+	out/switch-asic.tar.gz
+)
+mv "${zones[@]}" /work/zones/

From eced651d3f6b1b8d990a77c88ae064d35bbc731f Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Fri, 3 Mar 2023 13:26:45 -0500
Subject: [PATCH 02/36] switch variant asic

---
 .github/buildomat/jobs/package.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/buildomat/jobs/package.sh b/.github/buildomat/jobs/package.sh
index 0571d1b7687..1e179cc62cc 100644
--- a/.github/buildomat/jobs/package.sh
+++ b/.github/buildomat/jobs/package.sh
@@ -23,7 +23,7 @@ rustc --version
 
 # Build
 ptime -m ./tools/install_builder_prerequisites.sh -yp
-ptime -m cargo run --locked --release --bin omicron-package -- package
+ptime -m cargo run --locked --release --bin omicron-package -- -t switch_variant=asic package
 
 # Assemble global zone files in a temporary directory.
 tmp=$(mktemp -d)

From 170ee348002f15b0357e11e4249352739e9f6b08 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Fri, 3 Mar 2023 14:05:58 -0500
Subject: [PATCH 03/36] update name of global zone packages

---
 .github/buildomat/jobs/deploy.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/buildomat/jobs/deploy.sh b/.github/buildomat/jobs/deploy.sh
index 6217e33d794..885f3ea33ff 100644
--- a/.github/buildomat/jobs/deploy.sh
+++ b/.github/buildomat/jobs/deploy.sh
@@ -109,7 +109,7 @@ pfexec mkdir /opt/oxide/work
 pfexec chown build:build /opt/oxide/work
 cd /opt/oxide/work
 
-ptime -m tar xvzf /input/package/work/package.tar.gz
+ptime -m tar xvzf /input/package/work/global-zone-packages.tar.gz
 cp /input/package/work/zones/* out/
 mkdir tests
 for p in /input/build-end-to-end-tests/work/*.gz; do

From 2b63d56991041d62f279cafd00419363b7b9c9c7 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Fri, 3 Mar 2023 14:50:00 -0500
Subject: [PATCH 04/36] More attempts to correctly use this assembled GZ
 package

---
 .github/buildomat/jobs/deploy.sh | 24 ++++++------------------
 1 file changed, 6 insertions(+), 18 deletions(-)

diff --git a/.github/buildomat/jobs/deploy.sh b/.github/buildomat/jobs/deploy.sh
index 885f3ea33ff..11ed6a369b1 100644
--- a/.github/buildomat/jobs/deploy.sh
+++ b/.github/buildomat/jobs/deploy.sh
@@ -109,8 +109,10 @@ pfexec mkdir /opt/oxide/work
 pfexec chown build:build /opt/oxide/work
 cd /opt/oxide/work
 
-ptime -m tar xvzf /input/package/work/global-zone-packages.tar.gz
+mkdir out/
+ptime -m tar xvzf /input/package/work/global-zone-packages.tar.gz -C out
 cp /input/package/work/zones/* out/
+
 mkdir tests
 for p in /input/build-end-to-end-tests/work/*.gz; do
 	ptime -m gunzip < "$p" > "tests/$(basename "${p%.gz}")"
@@ -144,27 +146,13 @@ pfexec svccfg import /var/svc/manifest/site/tcpproxy.xml
 #
 pfexec ipadm create-addr -T static -a 192.168.1.199/24 igb0/sidehatch
 
-#
-# Modify config-rss.toml in the sled-agent zone to use our system's IP and MAC
+# Modify config-rss.toml in the sled-agent to use our system's IP and MAC
 # address for upstream connectivity.
-#
-tar xf out/omicron-sled-agent.tar pkg/config-rss.toml
 sed -e 's/^# address =.*$/address = "192.168.1.199"/' \
 	-e "s/^mac =.*$/mac = \"$(dladm show-phys -m -p -o ADDRESS | head -n 1)\"/" \
-	-i pkg/config-rss.toml
-tar rf out/omicron-sled-agent.tar pkg/config-rss.toml
-rm -rf pkg
+	-i out/sled-agent/pkg/config-rss.toml
 
-#
-# This OMICRON_NO_UNINSTALL hack here is so that there is no implicit uninstall
-# before the install.  This doesn't work right now because, above, we made
-# /var/oxide a file system so you can't remove it (EBUSY) like a regular
-# directory.  The lab-netdev target is a ramdisk system that is always cleared
-# out between runs, so it has not had any state yet that requires
-# uninstallation.
-#
-OMICRON_NO_UNINSTALL=1 \
-    ptime -m pfexec ./target/release/omicron-package install
+svccfg import out/sled-agent/pkg/manifest.xml
 
 ./tests/bootstrap
 rm ./tests/bootstrap

From 748b0e93d1dcfe3945a2e9e6943bd8a22f2b11be Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Fri, 3 Mar 2023 16:22:08 -0500
Subject: [PATCH 05/36] try again with supplementary package

---
 .github/buildomat/jobs/deploy.sh  |  1 +
 .github/buildomat/jobs/package.sh | 12 ++++++++++++
 2 files changed, 13 insertions(+)

diff --git a/.github/buildomat/jobs/deploy.sh b/.github/buildomat/jobs/deploy.sh
index 11ed6a369b1..d28d9f52a7a 100644
--- a/.github/buildomat/jobs/deploy.sh
+++ b/.github/buildomat/jobs/deploy.sh
@@ -109,6 +109,7 @@ pfexec mkdir /opt/oxide/work
 pfexec chown build:build /opt/oxide/work
 cd /opt/oxide/work
 
+ptime -m tar xvzf /input/package/work/utilities-package.tar.gz
 mkdir out/
 ptime -m tar xvzf /input/package/work/global-zone-packages.tar.gz -C out
 cp /input/package/work/zones/* out/
diff --git a/.github/buildomat/jobs/package.sh b/.github/buildomat/jobs/package.sh
index 1e179cc62cc..50e815f55ca 100644
--- a/.github/buildomat/jobs/package.sh
+++ b/.github/buildomat/jobs/package.sh
@@ -5,6 +5,7 @@
 #: target = "helios-latest"
 #: rust_toolchain = "1.66.1"
 #: output_rules = [
+#:	"=/work/utilities-package.tar.gz",
 #:	"=/work/global-zone-packages.tar.gz",
 #:	"=/work/zones/*.tar.gz",
 #: ]
@@ -25,6 +26,17 @@ rustc --version
 ptime -m ./tools/install_builder_prerequisites.sh -yp
 ptime -m cargo run --locked --release --bin omicron-package -- -t switch_variant=asic package
 
+
+# Assemble some utilities into a tarball that can be used by deployment
+# phases of buildomat.
+
+utilities=(
+  package-manifest.toml
+  tools/create_virtual_hardware.sh
+)
+
+ptime -m tar cvzf /work/utilities-package.tar.gz "${utilities[@]}"
+
 # Assemble global zone files in a temporary directory.
 tmp=$(mktemp -d)
 mkdir -p "${tmp}/sled-agent"

From 3d34f05c16a96c31e49c88948cd20a60b64b0a76 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Fri, 3 Mar 2023 17:13:43 -0500
Subject: [PATCH 06/36] /opt/oxide paths

---
 .github/buildomat/jobs/deploy.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/buildomat/jobs/deploy.sh b/.github/buildomat/jobs/deploy.sh
index d28d9f52a7a..b37521054b2 100644
--- a/.github/buildomat/jobs/deploy.sh
+++ b/.github/buildomat/jobs/deploy.sh
@@ -153,7 +153,9 @@ sed -e 's/^# address =.*$/address = "192.168.1.199"/' \
 	-e "s/^mac =.*$/mac = \"$(dladm show-phys -m -p -o ADDRESS | head -n 1)\"/" \
 	-i out/sled-agent/pkg/config-rss.toml
 
-svccfg import out/sled-agent/pkg/manifest.xml
+mkdir -p /opt/oxide
+mv out/sled-agent /opt/oxide/
+svccfg import /opt/oxide/sled-agent/pkg/manifest.xml
 
 ./tests/bootstrap
 rm ./tests/bootstrap

From dcc9f6eaea84795ad2e6c36d1c59368a9ffc17b1 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Fri, 3 Mar 2023 19:44:43 -0500
Subject: [PATCH 07/36] Pfexec

---
 .github/buildomat/jobs/deploy.sh | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/buildomat/jobs/deploy.sh b/.github/buildomat/jobs/deploy.sh
index b37521054b2..5863588bdd1 100644
--- a/.github/buildomat/jobs/deploy.sh
+++ b/.github/buildomat/jobs/deploy.sh
@@ -153,9 +153,8 @@ sed -e 's/^# address =.*$/address = "192.168.1.199"/' \
 	-e "s/^mac =.*$/mac = \"$(dladm show-phys -m -p -o ADDRESS | head -n 1)\"/" \
 	-i out/sled-agent/pkg/config-rss.toml
 
-mkdir -p /opt/oxide
-mv out/sled-agent /opt/oxide/
-svccfg import /opt/oxide/sled-agent/pkg/manifest.xml
+pfexec mv out/sled-agent /opt/oxide/
+pfexec svccfg import /opt/oxide/sled-agent/pkg/manifest.xml
 
 ./tests/bootstrap
 rm ./tests/bootstrap

From 6e836016e6ab92eaf889610040bba742c8b61866 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Fri, 3 Mar 2023 20:51:29 -0500
Subject: [PATCH 08/36] I forgot maghemite

---
 .github/buildomat/jobs/deploy.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/buildomat/jobs/deploy.sh b/.github/buildomat/jobs/deploy.sh
index 5863588bdd1..6226bdcd5fd 100644
--- a/.github/buildomat/jobs/deploy.sh
+++ b/.github/buildomat/jobs/deploy.sh
@@ -154,6 +154,7 @@ sed -e 's/^# address =.*$/address = "192.168.1.199"/' \
 	-i out/sled-agent/pkg/config-rss.toml
 
 pfexec mv out/sled-agent /opt/oxide/
+pfexec mv out/maghemite /opt/oxide/
 pfexec svccfg import /opt/oxide/sled-agent/pkg/manifest.xml
 
 ./tests/bootstrap

From 0a195c14d3a7f3d58addde591919ce799b59141e Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Fri, 3 Mar 2023 21:40:13 -0500
Subject: [PATCH 09/36] jk it's called mg-ddm

---
 .github/buildomat/jobs/deploy.sh  | 2 +-
 .github/buildomat/jobs/package.sh | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/buildomat/jobs/deploy.sh b/.github/buildomat/jobs/deploy.sh
index 6226bdcd5fd..fc1e1b5b540 100644
--- a/.github/buildomat/jobs/deploy.sh
+++ b/.github/buildomat/jobs/deploy.sh
@@ -154,7 +154,7 @@ sed -e 's/^# address =.*$/address = "192.168.1.199"/' \
 	-i out/sled-agent/pkg/config-rss.toml
 
 pfexec mv out/sled-agent /opt/oxide/
-pfexec mv out/maghemite /opt/oxide/
+pfexec mv out/mg-ddm /opt/oxide/
 pfexec svccfg import /opt/oxide/sled-agent/pkg/manifest.xml
 
 ./tests/bootstrap
diff --git a/.github/buildomat/jobs/package.sh b/.github/buildomat/jobs/package.sh
index 50e815f55ca..90ad4a1950e 100644
--- a/.github/buildomat/jobs/package.sh
+++ b/.github/buildomat/jobs/package.sh
@@ -41,8 +41,8 @@ ptime -m tar cvzf /work/utilities-package.tar.gz "${utilities[@]}"
 tmp=$(mktemp -d)
 mkdir -p "${tmp}/sled-agent"
 tar -xvzf out/omicron-sled-agent.tar -C "${tmp}/sled-agent"
-mkdir -p "${tmp}/maghemite"
-tar -xvzf out/maghemite.tar -C "${tmp}/maghemite"
+mkdir -p "${tmp}/mg-ddm"
+tar -xvzf out/maghemite.tar -C "${tmp}/mg-ddm"
 
 # Load those global zone files into a tarball that's ready to be exported.
 mkdir -p /work

From 4c7127a6cb53ec609422542e2bcbaafcf000f85d Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Fri, 3 Mar 2023 22:33:04 -0500
Subject: [PATCH 10/36] ... are config files load-bearing to create virtual hw?

---
 .github/buildomat/jobs/package.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/buildomat/jobs/package.sh b/.github/buildomat/jobs/package.sh
index 90ad4a1950e..6a76d09b269 100644
--- a/.github/buildomat/jobs/package.sh
+++ b/.github/buildomat/jobs/package.sh
@@ -32,6 +32,7 @@ ptime -m cargo run --locked --release --bin omicron-package -- -t switch_variant
 
 utilities=(
   package-manifest.toml
+  mf/sled-agent/config.toml
   tools/create_virtual_hardware.sh
 )
 

From 8532c7eeb838662e4e5ed764421e682e3b89fe73 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Mon, 6 Mar 2023 10:07:57 -0500
Subject: [PATCH 11/36] fix typo

---
 .github/buildomat/jobs/package.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 mode change 100644 => 100755 .github/buildomat/jobs/package.sh

diff --git a/.github/buildomat/jobs/package.sh b/.github/buildomat/jobs/package.sh
old mode 100644
new mode 100755
index 6a76d09b269..7fca618bcae
--- a/.github/buildomat/jobs/package.sh
+++ b/.github/buildomat/jobs/package.sh
@@ -32,7 +32,7 @@ ptime -m cargo run --locked --release --bin omicron-package -- -t switch_variant
 
 utilities=(
   package-manifest.toml
-  mf/sled-agent/config.toml
+  smf/sled-agent/config.toml
   tools/create_virtual_hardware.sh
 )
 

From 8874d34d1b4bd0663851fc24c288d84f224bbf1e Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Mon, 6 Mar 2023 11:28:50 -0500
Subject: [PATCH 12/36] layered fs approach

---
 .github/buildomat/jobs/deploy.sh  | 14 +++++++----
 .github/buildomat/jobs/package.sh | 39 ++++++++++++++++++++++++-------
 2 files changed, 41 insertions(+), 12 deletions(-)

diff --git a/.github/buildomat/jobs/deploy.sh b/.github/buildomat/jobs/deploy.sh
index fc1e1b5b540..79cd61126d8 100644
--- a/.github/buildomat/jobs/deploy.sh
+++ b/.github/buildomat/jobs/deploy.sh
@@ -110,9 +110,17 @@ pfexec chown build:build /opt/oxide/work
 cd /opt/oxide/work
 
 ptime -m tar xvzf /input/package/work/utilities-package.tar.gz
+
+# Unpack all global zone files into "out".
+# Note that because this is packaged as a layered filesystem, most files
+# exist under "root/".
 mkdir out/
 ptime -m tar xvzf /input/package/work/global-zone-packages.tar.gz -C out
-cp /input/package/work/zones/* out/
+pfexec mv out/root/opt/oxide/sled-agent /opt/oxide/sled-agent
+pfexec mv out/root/opt/oxide/mg-ddm /opt/oxide/mg-ddm
+
+# Move all global zones to their installed location
+pfexec cp /input/package/work/zones/* /opt/oxide
 
 mkdir tests
 for p in /input/build-end-to-end-tests/work/*.gz; do
@@ -153,9 +161,7 @@ sed -e 's/^# address =.*$/address = "192.168.1.199"/' \
 	-e "s/^mac =.*$/mac = \"$(dladm show-phys -m -p -o ADDRESS | head -n 1)\"/" \
 	-i out/sled-agent/pkg/config-rss.toml
 
-pfexec mv out/sled-agent /opt/oxide/
-pfexec mv out/mg-ddm /opt/oxide/
-pfexec svccfg import /opt/oxide/sled-agent/pkg/manifest.xml
+pfexec svccfg import out/root/lib/svc/manifest/site/sled-agent.xml
 
 ./tests/bootstrap
 rm ./tests/bootstrap
diff --git a/.github/buildomat/jobs/package.sh b/.github/buildomat/jobs/package.sh
index 7fca618bcae..2ebbffb392d 100755
--- a/.github/buildomat/jobs/package.sh
+++ b/.github/buildomat/jobs/package.sh
@@ -26,6 +26,7 @@ rustc --version
 ptime -m ./tools/install_builder_prerequisites.sh -yp
 ptime -m cargo run --locked --release --bin omicron-package -- -t switch_variant=asic package
 
+tarball_src_dir="$(pwd)/out"
 
 # Assemble some utilities into a tarball that can be used by deployment
 # phases of buildomat.
@@ -39,15 +40,37 @@ utilities=(
 ptime -m tar cvzf /work/utilities-package.tar.gz "${utilities[@]}"
 
 # Assemble global zone files in a temporary directory.
-tmp=$(mktemp -d)
-mkdir -p "${tmp}/sled-agent"
-tar -xvzf out/omicron-sled-agent.tar -C "${tmp}/sled-agent"
-mkdir -p "${tmp}/mg-ddm"
-tar -xvzf out/maghemite.tar -C "${tmp}/mg-ddm"
+if ! tmp=$(mktemp -d); then
+  exit 1
+fi
+trap 'cd /; rm -rf "$tmp"' EXIT
+
+# Header file, identifying this is intended to be layered in the global zone.
+# Within the ramdisk, this means that all files under "root/foo" should appear
+# in the global zone as "/foo".
+echo '{"v":"1","t":"layer"}' > "$tmp/oxide.json"
+
+# Extract the sled-agent tarball for re-packaging into the layered GZ archive.
+pkg_dir="$tmp/root/opt/oxide/sled-agent"
+mkdir -p "$pkg_dir"
+cd "$pkg_dir"
+tar -xvfz "$tarball_src_dir/omicron-sled-agent.tar"
+# Ensure that the manifest for the sled agent exists in a location where it may
+# be automatically initialized.
+mkdir -p "$tmp/root/lib/svc/manifest/site/"
+mv pkg/manifest.xml "$tmp/root/lib/svc/manifest/site/sled-agent.xml"
+cd -
+
+# Extract the mg-ddm tarball for re-packaging into the layered GZ archive.
+pkg_dir="$tmp/root/opt/oxide/mg-ddm"
+mkdir -p "$pkg_dir"
+cd "$pkg_dir"
+tar -xvfz "$tarball_src_dir/maghemite.tar"
+cd -
 
-# Load those global zone files into a tarball that's ready to be exported.
 mkdir -p /work
-ptime -m tar cvzf /work/global-zone-packages.tar.gz -C "${tmp}" .
+cd "$tmp" && tar cvfz /work/global-zone-packages.tar.gz oxide.json root
+cd -
 
 # Assemble Zone Images into their respective output locations.
 mkdir -p /work/zones
@@ -63,4 +86,4 @@ zones=(
 	out/propolis-server.tar.gz
 	out/switch-asic.tar.gz
 )
-mv "${zones[@]}" /work/zones/
+cp "${zones[@]}" /work/zones/

From 0055c1647e5321e4873ef2bbf6426e39c3c9ad63 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Mon, 6 Mar 2023 11:36:01 -0500
Subject: [PATCH 13/36] Specify image type

---
 .github/buildomat/jobs/package.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/buildomat/jobs/package.sh b/.github/buildomat/jobs/package.sh
index 2ebbffb392d..ec822486bf6 100755
--- a/.github/buildomat/jobs/package.sh
+++ b/.github/buildomat/jobs/package.sh
@@ -24,7 +24,7 @@ rustc --version
 
 # Build
 ptime -m ./tools/install_builder_prerequisites.sh -yp
-ptime -m cargo run --locked --release --bin omicron-package -- -t switch_variant=asic package
+ptime -m cargo run --locked --release --bin omicron-package -- -t 'image_type=standard switch_variant=asic' package
 
 tarball_src_dir="$(pwd)/out"
 

From 73b4cec2d0bc6cef76ae20b64a7e94904fec15be Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Mon, 6 Mar 2023 12:17:50 -0500
Subject: [PATCH 14/36] path to config files

---
 .github/buildomat/jobs/deploy.sh | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/.github/buildomat/jobs/deploy.sh b/.github/buildomat/jobs/deploy.sh
index 79cd61126d8..a9b29ab8810 100644
--- a/.github/buildomat/jobs/deploy.sh
+++ b/.github/buildomat/jobs/deploy.sh
@@ -116,6 +116,13 @@ ptime -m tar xvzf /input/package/work/utilities-package.tar.gz
 # exist under "root/".
 mkdir out/
 ptime -m tar xvzf /input/package/work/global-zone-packages.tar.gz -C out
+
+# Modify config-rss.toml in the sled-agent to use our system's IP and MAC
+# address for upstream connectivity.
+sed -e 's/^# address =.*$/address = "192.168.1.199"/' \
+	-e "s/^mac =.*$/mac = \"$(dladm show-phys -m -p -o ADDRESS | head -n 1)\"/" \
+	-i out/root/opt/oxide/sled-agent/pkg/config-rss.toml
+
 pfexec mv out/root/opt/oxide/sled-agent /opt/oxide/sled-agent
 pfexec mv out/root/opt/oxide/mg-ddm /opt/oxide/mg-ddm
 
@@ -155,12 +162,6 @@ pfexec svccfg import /var/svc/manifest/site/tcpproxy.xml
 #
 pfexec ipadm create-addr -T static -a 192.168.1.199/24 igb0/sidehatch
 
-# Modify config-rss.toml in the sled-agent to use our system's IP and MAC
-# address for upstream connectivity.
-sed -e 's/^# address =.*$/address = "192.168.1.199"/' \
-	-e "s/^mac =.*$/mac = \"$(dladm show-phys -m -p -o ADDRESS | head -n 1)\"/" \
-	-i out/sled-agent/pkg/config-rss.toml
-
 pfexec svccfg import out/root/lib/svc/manifest/site/sled-agent.xml
 
 ./tests/bootstrap

From 331660454c5e48c14512d32c3ee4f34083873316 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Mon, 6 Mar 2023 12:52:30 -0500
Subject: [PATCH 15/36] Make the gz package generation purely additive for now

---
 .github/buildomat/jobs/deploy.sh  | 44 ++++++++++++++++---------------
 .github/buildomat/jobs/package.sh | 16 ++++++-----
 2 files changed, 33 insertions(+), 27 deletions(-)

diff --git a/.github/buildomat/jobs/deploy.sh b/.github/buildomat/jobs/deploy.sh
index a9b29ab8810..6217e33d794 100644
--- a/.github/buildomat/jobs/deploy.sh
+++ b/.github/buildomat/jobs/deploy.sh
@@ -109,26 +109,8 @@ pfexec mkdir /opt/oxide/work
 pfexec chown build:build /opt/oxide/work
 cd /opt/oxide/work
 
-ptime -m tar xvzf /input/package/work/utilities-package.tar.gz
-
-# Unpack all global zone files into "out".
-# Note that because this is packaged as a layered filesystem, most files
-# exist under "root/".
-mkdir out/
-ptime -m tar xvzf /input/package/work/global-zone-packages.tar.gz -C out
-
-# Modify config-rss.toml in the sled-agent to use our system's IP and MAC
-# address for upstream connectivity.
-sed -e 's/^# address =.*$/address = "192.168.1.199"/' \
-	-e "s/^mac =.*$/mac = \"$(dladm show-phys -m -p -o ADDRESS | head -n 1)\"/" \
-	-i out/root/opt/oxide/sled-agent/pkg/config-rss.toml
-
-pfexec mv out/root/opt/oxide/sled-agent /opt/oxide/sled-agent
-pfexec mv out/root/opt/oxide/mg-ddm /opt/oxide/mg-ddm
-
-# Move all global zones to their installed location
-pfexec cp /input/package/work/zones/* /opt/oxide
-
+ptime -m tar xvzf /input/package/work/package.tar.gz
+cp /input/package/work/zones/* out/
 mkdir tests
 for p in /input/build-end-to-end-tests/work/*.gz; do
 	ptime -m gunzip < "$p" > "tests/$(basename "${p%.gz}")"
@@ -162,7 +144,27 @@ pfexec svccfg import /var/svc/manifest/site/tcpproxy.xml
 #
 pfexec ipadm create-addr -T static -a 192.168.1.199/24 igb0/sidehatch
 
-pfexec svccfg import out/root/lib/svc/manifest/site/sled-agent.xml
+#
+# Modify config-rss.toml in the sled-agent zone to use our system's IP and MAC
+# address for upstream connectivity.
+#
+tar xf out/omicron-sled-agent.tar pkg/config-rss.toml
+sed -e 's/^# address =.*$/address = "192.168.1.199"/' \
+	-e "s/^mac =.*$/mac = \"$(dladm show-phys -m -p -o ADDRESS | head -n 1)\"/" \
+	-i pkg/config-rss.toml
+tar rf out/omicron-sled-agent.tar pkg/config-rss.toml
+rm -rf pkg
+
+#
+# This OMICRON_NO_UNINSTALL hack here is so that there is no implicit uninstall
+# before the install.  This doesn't work right now because, above, we made
+# /var/oxide a file system so you can't remove it (EBUSY) like a regular
+# directory.  The lab-netdev target is a ramdisk system that is always cleared
+# out between runs, so it has not had any state yet that requires
+# uninstallation.
+#
+OMICRON_NO_UNINSTALL=1 \
+    ptime -m pfexec ./target/release/omicron-package install
 
 ./tests/bootstrap
 rm ./tests/bootstrap
diff --git a/.github/buildomat/jobs/package.sh b/.github/buildomat/jobs/package.sh
index ec822486bf6..b5eee627053 100755
--- a/.github/buildomat/jobs/package.sh
+++ b/.github/buildomat/jobs/package.sh
@@ -5,7 +5,7 @@
 #: target = "helios-latest"
 #: rust_toolchain = "1.66.1"
 #: output_rules = [
-#:	"=/work/utilities-package.tar.gz",
+#:	"=/work/package.tar.gz",
 #:	"=/work/global-zone-packages.tar.gz",
 #:	"=/work/zones/*.tar.gz",
 #: ]
@@ -25,19 +25,22 @@ rustc --version
 # Build
 ptime -m ./tools/install_builder_prerequisites.sh -yp
 ptime -m cargo run --locked --release --bin omicron-package -- -t 'image_type=standard switch_variant=asic' package
+ptime -m cargo run --locked --release --bin omicron-package -- -t 'image_type=standard switch_variant=stub' package
 
 tarball_src_dir="$(pwd)/out"
 
 # Assemble some utilities into a tarball that can be used by deployment
 # phases of buildomat.
 
-utilities=(
-  package-manifest.toml
-  smf/sled-agent/config.toml
-  tools/create_virtual_hardware.sh
+files=(
+	out/*.tar
+	package-manifest.toml
+	smf/sled-agent/config.toml
+	target/release/omicron-package
+	tools/create_virtual_hardware.sh
 )
 
-ptime -m tar cvzf /work/utilities-package.tar.gz "${utilities[@]}"
+ptime -m tar cvzf /work/package.tar.gz "${files[@]}"
 
 # Assemble global zone files in a temporary directory.
 if ! tmp=$(mktemp -d); then
@@ -85,5 +88,6 @@ zones=(
 	out/oximeter-collector.tar.gz
 	out/propolis-server.tar.gz
 	out/switch-asic.tar.gz
+	out/switch-stub.tar.gz
 )
 cp "${zones[@]}" /work/zones/

From d64f99301e838233bc6933876348d0311e8d2a59 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Mon, 6 Mar 2023 16:20:54 -0500
Subject: [PATCH 16/36] [buildomat] Job to create Helios image

---
 .github/buildomat/jobs/host-image.sh | 76 ++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)
 create mode 100644 .github/buildomat/jobs/host-image.sh

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
new file mode 100644
index 00000000000..139cb0b0c50
--- /dev/null
+++ b/.github/buildomat/jobs/host-image.sh
@@ -0,0 +1,76 @@
+#!/bin/bash
+#:
+#: name = "helios / package"
+#: variety = "basic"
+#: target = "helios-latest"
+#: rust_toolchain = "1.66.1"
+#: output_rules = [
+#:	"=/work/helios/image/output/zfs.img",
+#:	"=/work/helios/image/output/rom",
+#: ]
+#: skip_clone = true
+#: access_repos = [
+#:	"oxidecomputer/amd-apcb",
+#:	"oxidecomputer/amd-efs",
+#:	"oxidecomputer/amd-firmware",
+#:	"oxidecomputer/amd-flash",
+#:	"oxidecomputer/helios",
+#:	"oxidecomputer/nanobl-rs",
+#: ]
+#:
+#: [dependencies.package]
+#: job = "helios / package"
+#:
+set -o errexit
+set -o pipefail
+set -o xtrace
+
+cargo --version
+rustc --version
+
+#
+# The token authentication mechanism that affords us access to other private
+# repositories requires that we use HTTPS URLs for GitHub, rather than SSH.
+#
+override_urls=(
+    'git://github.com/'
+    'git@github.com:'
+    'ssh://github.com/'
+    'ssh://git@github.com/'
+)
+for (( i = 0; i < ${#override_urls[@]}; i++ )); do
+	git config --add --global url.https://github.com/.insteadOf \
+	    "${override_urls[$i]}"
+done
+
+#
+# Require that cargo use the git CLI instead of the built-in support.  This
+# achieves two things: first, SSH URLs should be transformed on fetch without
+# requiring Cargo.toml rewriting, which is especially difficult in transitive
+# dependencies; second, Cargo does not seem willing on its own to look in
+# ~/.netrc and find the temporary token that buildomat generates for our job,
+# so we must use git which uses curl.
+#
+export CARGO_NET_GIT_FETCH_WITH_CLI=true
+
+pfexec mkdir -p /work
+cd /work
+
+# /work/gz: Global Zone artifacts to be placed in the Helios image.
+mkdir gz && cd gz
+ptime -m tar xvzf /input/package/work/global-zone-packages.tar.gz
+cd -
+
+# TODO: Consider importing zones here too?
+
+# Checkout helios at a pinned commit
+git clone https://github.com/oxidecomputer/helios.git
+cd helios
+git checkout ac8a7e7ef9e9b5ef27334bc8016f5d123f852449
+
+gmake setup
+./helios-build experiment-image \
+	-p helios-netdev=https://pkg.oxide.computer/helios-netdev \
+	-F optever=0.21 \
+	-B \
+	-P /work/gz/root

From 54424a57a4d87066029dfaa3bdd082b596cd01f8 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Mon, 6 Mar 2023 16:21:57 -0500
Subject: [PATCH 17/36] unique jobname

---
 .github/buildomat/jobs/host-image.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index 139cb0b0c50..66b0e82ff38 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 #:
-#: name = "helios / package"
+#: name = "helios / package image"
 #: variety = "basic"
 #: target = "helios-latest"
 #: rust_toolchain = "1.66.1"

From 75f6d5c7ed861ba4b651157cad75924ca2abe88b Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Mon, 6 Mar 2023 19:38:53 -0500
Subject: [PATCH 18/36] add omnios build

---
 .github/buildomat/jobs/host-image.sh | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index 66b0e82ff38..91bc4d69647 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -15,12 +15,9 @@
 #:	"oxidecomputer/amd-firmware",
 #:	"oxidecomputer/amd-flash",
 #:	"oxidecomputer/helios",
+#:	"oxidecomputer/helios-omnios-build",
 #:	"oxidecomputer/nanobl-rs",
 #: ]
-#:
-#: [dependencies.package]
-#: job = "helios / package"
-#:
 set -o errexit
 set -o pipefail
 set -o xtrace
@@ -57,9 +54,9 @@ pfexec mkdir -p /work
 cd /work
 
 # /work/gz: Global Zone artifacts to be placed in the Helios image.
-mkdir gz && cd gz
-ptime -m tar xvzf /input/package/work/global-zone-packages.tar.gz
-cd -
+# mkdir gz && cd gz
+# ptime -m tar xvzf /input/package/work/global-zone-packages.tar.gz
+# cd -
 
 # TODO: Consider importing zones here too?
 
@@ -72,5 +69,4 @@ gmake setup
 ./helios-build experiment-image \
 	-p helios-netdev=https://pkg.oxide.computer/helios-netdev \
 	-F optever=0.21 \
-	-B \
-	-P /work/gz/root
+	-B

From d044003a903e45631d7ee61c9b92bb91556347bb Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Mon, 6 Mar 2023 19:41:58 -0500
Subject: [PATCH 19/36] tweak access repos

---
 .github/buildomat/jobs/host-image.sh | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index 91bc4d69647..c1efbd1a0ac 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -10,13 +10,12 @@
 #: ]
 #: skip_clone = true
 #: access_repos = [
-#:	"oxidecomputer/amd-apcb",
-#:	"oxidecomputer/amd-efs",
-#:	"oxidecomputer/amd-firmware",
-#:	"oxidecomputer/amd-flash",
+#:	"oxidecomputer/amd-host-image-builder",
+#:	"oxidecomputer/boot-image-tools",
+#:	"oxidecomputer/chelsio-t6-roms",
 #:	"oxidecomputer/helios",
+#:	"oxidecomputer/helios-omnios-extra",
 #:	"oxidecomputer/helios-omnios-build",
-#:	"oxidecomputer/nanobl-rs",
 #: ]
 set -o errexit
 set -o pipefail

From 51c482449d8d357af6aa41e00ec9ce5955a413f4 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Mon, 6 Mar 2023 19:50:03 -0500
Subject: [PATCH 20/36] More private repo cloning

---
 .github/buildomat/jobs/host-image.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index c1efbd1a0ac..0ad8510cf6d 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -10,12 +10,14 @@
 #: ]
 #: skip_clone = true
 #: access_repos = [
+#:	"oxidecomputer/amd-firmware",
 #:	"oxidecomputer/amd-host-image-builder",
 #:	"oxidecomputer/boot-image-tools",
 #:	"oxidecomputer/chelsio-t6-roms",
 #:	"oxidecomputer/helios",
-#:	"oxidecomputer/helios-omnios-extra",
 #:	"oxidecomputer/helios-omnios-build",
+#:	"oxidecomputer/helios-omnios-extra",
+#:	"oxidecomputer/nanobl-rs",
 #: ]
 set -o errexit
 set -o pipefail

From 9e5a361f49e030fb5948a4126cc7779a92842acf Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Mon, 6 Mar 2023 19:58:58 -0500
Subject: [PATCH 21/36] amd-apcb

---
 .github/buildomat/jobs/host-image.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index 0ad8510cf6d..03f817e6f85 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 #:
-#: name = "helios / package image"
+#: name = "helios / build OS image"
 #: variety = "basic"
 #: target = "helios-latest"
 #: rust_toolchain = "1.66.1"
@@ -10,6 +10,7 @@
 #: ]
 #: skip_clone = true
 #: access_repos = [
+#:	"oxidecomputer/amd-apcb",
 #:	"oxidecomputer/amd-firmware",
 #:	"oxidecomputer/amd-host-image-builder",
 #:	"oxidecomputer/boot-image-tools",

From b8a19f6394db4d0d874950d1398f0aa1cc25faf5 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Mon, 6 Mar 2023 21:11:18 -0500
Subject: [PATCH 22/36] amd-efs

---
 .github/buildomat/jobs/host-image.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index 03f817e6f85..68132946f44 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -11,6 +11,7 @@
 #: skip_clone = true
 #: access_repos = [
 #:	"oxidecomputer/amd-apcb",
+#:	"oxidecomputer/amd-efs",
 #:	"oxidecomputer/amd-firmware",
 #:	"oxidecomputer/amd-host-image-builder",
 #:	"oxidecomputer/boot-image-tools",

From 336f229cd634a48cf5990893ce51a7c74ed0612e Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Mon, 6 Mar 2023 21:12:15 -0500
Subject: [PATCH 23/36] amd-flash

---
 .github/buildomat/jobs/host-image.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index 68132946f44..71a9de4c946 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -13,6 +13,7 @@
 #:	"oxidecomputer/amd-apcb",
 #:	"oxidecomputer/amd-efs",
 #:	"oxidecomputer/amd-firmware",
+#:	"oxidecomputer/amd-flash",
 #:	"oxidecomputer/amd-host-image-builder",
 #:	"oxidecomputer/boot-image-tools",
 #:	"oxidecomputer/chelsio-t6-roms",

From 89d4e86729323019566748876358d40180746e78 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Mon, 6 Mar 2023 21:28:17 -0500
Subject: [PATCH 24/36] pkg install

---
 .github/buildomat/jobs/host-image.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index 71a9de4c946..cb06b8de92c 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -70,6 +70,8 @@ cd helios
 git checkout ac8a7e7ef9e9b5ef27334bc8016f5d123f852449
 
 gmake setup
+pfexec pkg install /system/zones/brand/omicron1/tools
+
 ./helios-build experiment-image \
 	-p helios-netdev=https://pkg.oxide.computer/helios-netdev \
 	-F optever=0.21 \

From fde82e9acba2681ba1f80db40ebde276d7ee11bc Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Mon, 6 Mar 2023 21:40:11 -0500
Subject: [PATCH 25/36] get yourself a zfs filesystem

---
 .github/buildomat/jobs/host-image.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index cb06b8de92c..14cfbbcc340 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -69,8 +69,13 @@ git clone https://github.com/oxidecomputer/helios.git
 cd helios
 git checkout ac8a7e7ef9e9b5ef27334bc8016f5d123f852449
 
+# Create the "./helios-build" command, which lets us build images
 gmake setup
+
+# Commands that "./helios-build" would ask us to run (either explicitly
+# or implicitly, to avoid an error).
 pfexec pkg install /system/zones/brand/omicron1/tools
+pfexec zfs create rpool/images/build
 
 ./helios-build experiment-image \
 	-p helios-netdev=https://pkg.oxide.computer/helios-netdev \

From 4f37d1cb976036a0213270763668f6dc5c79462a Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Mon, 6 Mar 2023 21:54:19 -0500
Subject: [PATCH 26/36] parents

---
 .github/buildomat/jobs/host-image.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index 14cfbbcc340..7252e10a28a 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -75,7 +75,7 @@ gmake setup
 # Commands that "./helios-build" would ask us to run (either explicitly
 # or implicitly, to avoid an error).
 pfexec pkg install /system/zones/brand/omicron1/tools
-pfexec zfs create rpool/images/build
+pfexec zfs create -p rpool/images/build
 
 ./helios-build experiment-image \
 	-p helios-netdev=https://pkg.oxide.computer/helios-netdev \

From 6c024fd21e2fe7dbd231f14b3e2a44a940f36491 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Mon, 6 Mar 2023 22:13:37 -0500
Subject: [PATCH 27/36] Okay but actually include the omicron files now

---
 .github/buildomat/jobs/host-image.sh | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index 7252e10a28a..aef2cedff89 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -22,6 +22,11 @@
 #:	"oxidecomputer/helios-omnios-extra",
 #:	"oxidecomputer/nanobl-rs",
 #: ]
+#:
+#: [dependencies.package]
+#: job = "helios / package"
+#:
+
 set -o errexit
 set -o pipefail
 set -o xtrace
@@ -58,9 +63,9 @@ pfexec mkdir -p /work
 cd /work
 
 # /work/gz: Global Zone artifacts to be placed in the Helios image.
-# mkdir gz && cd gz
-# ptime -m tar xvzf /input/package/work/global-zone-packages.tar.gz
-# cd -
+mkdir gz && cd gz
+ptime -m tar xvzf /input/package/work/global-zone-packages.tar.gz
+cd -
 
 # TODO: Consider importing zones here too?
 
@@ -80,4 +85,5 @@ pfexec zfs create -p rpool/images/build
 ./helios-build experiment-image \
 	-p helios-netdev=https://pkg.oxide.computer/helios-netdev \
 	-F optever=0.21 \
+	-P /work/gz/root \
 	-B

From 79fa7135f3c39d7868a6949587fa255157a5d238 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Thu, 9 Mar 2023 23:35:02 -0500
Subject: [PATCH 28/36] Update helios rev

---
 .github/buildomat/jobs/host-image.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index aef2cedff89..887ff4b3fe6 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -72,7 +72,7 @@ cd -
 # Checkout helios at a pinned commit
 git clone https://github.com/oxidecomputer/helios.git
 cd helios
-git checkout ac8a7e7ef9e9b5ef27334bc8016f5d123f852449
+git checkout 49d501d2f37060e29a84a50e9026860315975794
 
 # Create the "./helios-build" command, which lets us build images
 gmake setup

From 95419e5d0d6d356567aa741e7ddf419a6c234681 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Thu, 9 Mar 2023 23:41:58 -0500
Subject: [PATCH 29/36] Make it easier to share helios version

---
 .github/buildomat/jobs/host-image.sh | 4 +++-
 tools/helios_version                 | 1 +
 2 files changed, 4 insertions(+), 1 deletion(-)
 create mode 100644 tools/helios_version

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index 887ff4b3fe6..61096cdf5c0 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -72,7 +72,9 @@ cd -
 # Checkout helios at a pinned commit
 git clone https://github.com/oxidecomputer/helios.git
 cd helios
-git checkout 49d501d2f37060e29a84a50e9026860315975794
+
+source "./tools/helios_version"
+git checkout "$COMMIT"
 
 # Create the "./helios-build" command, which lets us build images
 gmake setup
diff --git a/tools/helios_version b/tools/helios_version
new file mode 100644
index 00000000000..1ee72f349ac
--- /dev/null
+++ b/tools/helios_version
@@ -0,0 +1 @@
+COMMIT=49d501d2f37060e29a84a50e9026860315975794

From 9853dc91ccd572858672ff2fd7efed43fdfe7bf2 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Thu, 9 Mar 2023 23:45:14 -0500
Subject: [PATCH 30/36] source before cd

---
 .github/buildomat/jobs/host-image.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index 61096cdf5c0..2a8c6a58889 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -34,6 +34,8 @@ set -o xtrace
 cargo --version
 rustc --version
 
+source "./tools/helios_version"
+
 #
 # The token authentication mechanism that affords us access to other private
 # repositories requires that we use HTTPS URLs for GitHub, rather than SSH.
@@ -73,7 +75,6 @@ cd -
 git clone https://github.com/oxidecomputer/helios.git
 cd helios
 
-source "./tools/helios_version"
 git checkout "$COMMIT"
 
 # Create the "./helios-build" command, which lets us build images

From d9bb6888faea66a510a36e32d1ac48284cc09d3d Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Fri, 10 Mar 2023 00:31:56 -0500
Subject: [PATCH 31/36] abs path

---
 .github/buildomat/jobs/host-image.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index 2a8c6a58889..6064d27c4d1 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -34,7 +34,7 @@ set -o xtrace
 cargo --version
 rustc --version
 
-source "./tools/helios_version"
+source "/work/oxidecomputer/omicron/tools/helios_version"
 
 #
 # The token authentication mechanism that affords us access to other private

From 817ae144494d622d726deb622db6c831c36edace Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Fri, 10 Mar 2023 02:04:16 -0500
Subject: [PATCH 32/36] another attempt

---
 .github/buildomat/jobs/host-image.sh | 2 +-
 .github/buildomat/jobs/package.sh    | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index 6064d27c4d1..43ef92aca55 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -34,7 +34,7 @@ set -o xtrace
 cargo --version
 rustc --version
 
-source "/work/oxidecomputer/omicron/tools/helios_version"
+source "$(pwd)/tools/helios_version"
 
 #
 # The token authentication mechanism that affords us access to other private
diff --git a/.github/buildomat/jobs/package.sh b/.github/buildomat/jobs/package.sh
index 2f7c561af5d..4fc5dfb3c5a 100755
--- a/.github/buildomat/jobs/package.sh
+++ b/.github/buildomat/jobs/package.sh
@@ -34,6 +34,7 @@ ptime -m cargo run --locked --release --bin omicron-package -- -t 'image_type=st
 ptime -m cargo run --locked --release --bin omicron-package -- -t 'image_type=standard switch_variant=stub' package
 ptime -m cargo run --locked --release --bin omicron-package -- -t 'image_type=trampoline' package
 
+old_pwd="$(pwd)"
 tarball_src_dir="$(pwd)/out"
 
 # Assemble some utilities into a tarball that can be used by deployment
@@ -136,3 +137,5 @@ zones=(
 	out/switch-stub.tar.gz
 )
 cp "${zones[@]}" /work/zones/
+
+cd "$old_pwd"

From 58c3a9ca21065c29914cc7cc066c712d14358d6b Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Fri, 10 Mar 2023 12:19:07 -0500
Subject: [PATCH 33/36] clone repo

---
 .github/buildomat/jobs/host-image.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index 43ef92aca55..922c7ab756f 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -8,7 +8,6 @@
 #:	"=/work/helios/image/output/zfs.img",
 #:	"=/work/helios/image/output/rom",
 #: ]
-#: skip_clone = true
 #: access_repos = [
 #:	"oxidecomputer/amd-apcb",
 #:	"oxidecomputer/amd-efs",

From 4ccf9aca54bbe91fd26309ba22690821c85d62fe Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Fri, 10 Mar 2023 13:09:52 -0500
Subject: [PATCH 34/36] Add compliance pilot to repo list

---
 .github/buildomat/jobs/host-image.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index 922c7ab756f..d009b18f333 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -16,6 +16,7 @@
 #:	"oxidecomputer/amd-host-image-builder",
 #:	"oxidecomputer/boot-image-tools",
 #:	"oxidecomputer/chelsio-t6-roms",
+#:	"oxidecomputer/compliance-pilot",
 #:	"oxidecomputer/helios",
 #:	"oxidecomputer/helios-omnios-build",
 #:	"oxidecomputer/helios-omnios-extra",

From 4788bc02305d1e8cfe8b7bd64cee3a3d652ee162 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Fri, 10 Mar 2023 14:32:17 -0500
Subject: [PATCH 35/36] git and ssh

---
 .github/buildomat/jobs/host-image.sh | 2 ++
 .github/buildomat/jobs/package.sh    | 3 ---
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index d009b18f333..8785a13ed66 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -15,6 +15,7 @@
 #:	"oxidecomputer/amd-flash",
 #:	"oxidecomputer/amd-host-image-builder",
 #:	"oxidecomputer/boot-image-tools",
+#:	"oxidecomputer/boot-image-tools",
 #:	"oxidecomputer/chelsio-t6-roms",
 #:	"oxidecomputer/compliance-pilot",
 #:	"oxidecomputer/helios",
@@ -45,6 +46,7 @@ override_urls=(
     'git@github.com:'
     'ssh://github.com/'
     'ssh://git@github.com/'
+    'git+ssh://git@github.com/'
 )
 for (( i = 0; i < ${#override_urls[@]}; i++ )); do
 	git config --add --global url.https://github.com/.insteadOf \
diff --git a/.github/buildomat/jobs/package.sh b/.github/buildomat/jobs/package.sh
index 4fc5dfb3c5a..2f7c561af5d 100755
--- a/.github/buildomat/jobs/package.sh
+++ b/.github/buildomat/jobs/package.sh
@@ -34,7 +34,6 @@ ptime -m cargo run --locked --release --bin omicron-package -- -t 'image_type=st
 ptime -m cargo run --locked --release --bin omicron-package -- -t 'image_type=standard switch_variant=stub' package
 ptime -m cargo run --locked --release --bin omicron-package -- -t 'image_type=trampoline' package
 
-old_pwd="$(pwd)"
 tarball_src_dir="$(pwd)/out"
 
 # Assemble some utilities into a tarball that can be used by deployment
@@ -137,5 +136,3 @@ zones=(
 	out/switch-stub.tar.gz
 )
 cp "${zones[@]}" /work/zones/
-
-cd "$old_pwd"

From b2070f5a4c70fa7ccbb9a973255711c22a0d31e2 Mon Sep 17 00:00:00 2001
From: Sean Klein <sean@oxide.computer>
Date: Fri, 10 Mar 2023 15:17:31 -0500
Subject: [PATCH 36/36] Facade

---
 .github/buildomat/jobs/host-image.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index 8785a13ed66..726ad313f5c 100644
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -18,6 +18,7 @@
 #:	"oxidecomputer/boot-image-tools",
 #:	"oxidecomputer/chelsio-t6-roms",
 #:	"oxidecomputer/compliance-pilot",
+#:	"oxidecomputer/facade",
 #:	"oxidecomputer/helios",
 #:	"oxidecomputer/helios-omnios-build",
 #:	"oxidecomputer/helios-omnios-extra",