Build from source

This is the advanced path for release engineering, auditing, and custom image work. Normal operators should use prebuilt release images.

Local builds create local signing keys, local measurements, and verifier-policy work. They are not drop-in replacements for release artifacts.

Host Tools

On macOS:

brew install qemu swtpm erlang rebar3 python@3

Install Docker Desktop or another Docker runtime. Linux hosts need equivalent Docker, QEMU, swtpm, Erlang, rebar3, Python, and build-tool packages.

Build Images

Generate local signing material:

make signing-keys

Build the default laptop image:

make runtime-image

Build the no-TME compatibility image:

TME=0 make runtime-image

Outputs are under:

build/images/

Apply Local Inputs

For a locally built image, place config.json and optional wifi.conf beside the Makefile, then run:

make operator-config-apply IMAGE=build/images/lapee-runtime-tme-signed.img

For the no-TME image:

make operator-config-apply IMAGE=build/images/lapee-runtime-no-tme-signed.img

This edits the ESP. It does not rebuild or re-sign the UKI.

Write A Built Image

make write-image DEV=/dev/diskN IMAGE=build/images/lapee-runtime-tme-signed.img

Or build and write in one step:

make runtime-write DEV=/dev/diskN

The target device is erased.

QEMU Checks

make qemu IMAGE=build/images/lapee-runtime-tme-signed.img
make qemu-operator-config

The QEMU path boots the same USB image shape that is written to hardware and checks live ~measurement@1.0 and ~system@1.0 endpoints through a forwarded port.

Source Map

Key source-tree paths:

Path	Role
Makefile	Build, write, signing, WiFi, config injection, and QEMU entry points.
arch/common/linux/	Shared Linux/Buildroot appliance packaging.
arch/android/	AndEE Android packaging and harnesses.
devices/common/	Measurement, system, TPM, SNP, and shared PermawebOS devices.
scripts/	Image assembly, Secure Boot, WiFi, QEMU, and verification helpers.
arch/common/linux/buildroot-external/board/lapee/rootfs-overlay/init	PID 1 for the Linux appliance.
arch/common/linux/buildroot-external/board/lapee/rootfs-overlay/etc/lapee/lapee.json	Base PermawebOS config.