nabu-mipad5-linux-builder

Containerized ARM64 Linux image builder for Xiaomi Pad 5 / Mi Pad 5 (nabu, SM8150).

This project is designed for reproducible image artifact generation in Podman/Docker, with strict validation and explicit safety boundaries.

Related projects:

• nabu-linux-kernel
• nabu-linux-hardware-support

Safety First

• This project creates image artifacts only.
• It does not auto-flash block devices.
• Hardware bring-up topics (sensor/audio) are treated as investigation workflows unless there is concrete evidence.

Current Scope

Distros exposed by CLI

nabu-builder list-distros currently reports:

• armbian
• armbian-ubuntu
• debian-arm
• ubuntu-arm
• ubuntu-server-arm
• ubuntu-core-arm
• fedora-rawhide
• fedora-44
• fedora-43
• kubuntu-arm
• nobara-linux
• alpine-linux

Real runner coverage

Implemented runner dispatch exists for:

• fedora-*
• ubuntu-arm
• ubuntu-server-arm
• ubuntu-core-arm
• armbian-ubuntu
• debian-arm
• kubuntu-arm
• armbian

Planned/guarded distros:

• nobara-linux
• alpine-linux

These planned targets are intentionally guarded and return clear status instead of pretending to build full rootfs output.

Desktop/session options

nabu-builder list-desktops includes:

• kde-plasma, plasma-mobile, gnome, gnome-mobile
• cosmic-desktop, elementary, hyprland, posh
• mauikit, lxqt, lomiri, xfce, sway
• cinnamon, deepin, sxmo, no-desktop

Availability depends on distro/repo constraints; unsupported combinations fail fast with clear messages.

Host Requirements

Primary host target: Arch Linux.

sudo pacman -S --needed podman qemu-user-static qemu-user-static-binfmt

Docker is also supported.

Quick Start

cd nabu-linux-builder
make image
./run-builder.sh doctor
./run-builder.sh menu

Common Commands

# Interactive menu
./run-builder.sh menu

# Health checks in container
./run-builder.sh doctor

# Open container shell
./run-builder.sh shell

# Build from config (dry-run)
./run-builder.sh build configs/test-fedora43-gnome-tr-refind.yaml --dry-run

# Real build
./run-builder.sh build configs/test-fedora43-gnome-tr-refind.yaml

# Raw CLI passthrough
./run-builder.sh nabu-builder list-distros
./run-builder.sh nabu-builder list-desktops

Artifacts

Output root:

• artifacts/Nabu-Build-OUTs/<build-id>/

Typical outputs:

• *-system.img
• *-system.img.zst
• *-esp.img
• *-esp.img.zst
• *-efi-files.zip
• BUILD-REPORT.md
• build-manifest.json
• SHA256SUMS
• logs/

First-Boot Welcome Flow

The builder supports a welcome-driven user onboarding mode:

• user.mode: create-user-after-installation

In this mode, regular user creation is deferred to the welcome app workflow, and temporary first-boot session handling is provisioned accordingly. For Fedora + kde-plasma, the builder prefers KDE's native plasma-setup first-boot flow in this mode, with nabulinuxwelcome as fallback if unavailable. For Ubuntu/Kubuntu + kde-plasma, the builder uses KDE's native plasma-setup flow in this mode. If the package is not available in the distro repository, it builds the matching upstream plasma-setup release inside the target rootfs and does not fall back to nabulinuxwelcome.

GitHub Kubuntu Image Pipeline

The repository includes a GitHub Actions pipeline for Xiaomi Pad 5 / nabu Kubuntu-family images:

• gate builds: no-desktop for en_US.UTF-8 and tr_TR.UTF-8
• release builds: gnome, kde-plasma, and plasma-mobile for both locales
• release payload: six compressed system images plus one shared compressed ESP image and one shared EFI bundle

The workflow runs on push to main and through manual dispatch. KDE Plasma and Plasma Mobile profiles use KDE plasma-setup for first-boot provisioning. Build-time passwords are never stored in the repository; image builds require the NABU_USER_PASSWORD repository secret. Local builds can provide the same value as an environment variable.

Repository Layout

• run-builder.sh: host entrypoint (runtime detection, mounts, command dispatch)
• builder_cli/: Python CLI, menu, validation, runner dispatch
• scripts/: backend build logic and ops utilities
• configs/: example YAML build configs
• artifacts/, work/, cache/: generated runtime/build data

Known Constraints

• Planned distros remain intentionally guarded.
• Some filesystem/bootloader combinations are metadata/planned paths and may require explicit flags or return warnings.
• Device-specific hardware fixes are evidence-gated and should be validated before integration.

License

MIT. See LICENSE.