From 42d2be2a0ade4a2d64c65c91440b6362f9dfec68 Mon Sep 17 00:00:00 2001
From: alexhulbert <alex@alexhulbert.com>
Date: Wed, 26 Nov 2025 20:49:01 +0900
Subject: [PATCH 1/4] Allow installing packages from debian backports

---
 base/add-backports.sh | 18 ++++++++++++++++++
 base/mkosi.conf       |  2 ++
 flake.nix             |  2 ++
 3 files changed, 22 insertions(+)
 create mode 100755 base/add-backports.sh

diff --git a/base/add-backports.sh b/base/add-backports.sh
new file mode 100755
index 00000000..5906824c
--- /dev/null
+++ b/base/add-backports.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# The mkosi sandbox environment should have a debian backports source list
+# that matches the archive timestamp of the main release.
+# See https://github.com/systemd/mkosi/issues/1755
+MIRROR=$(jq -r .Mirror /work/config.json)
+if [ "$MIRROR" = "null" ]; then
+    : > "$SRCDIR/mkosi.builddir/debian-backports.sources"
+else
+    cat > "$SRCDIR/mkosi.builddir/debian-backports.sources" <<EOF
+Types: deb deb-src
+URIs: $MIRROR
+Suites: ${RELEASE}-backports
+Components: main
+Enabled: yes
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+EOF
+fi
diff --git a/base/mkosi.conf b/base/mkosi.conf
index edfc6745..a6540059 100644
--- a/base/mkosi.conf
+++ b/base/mkosi.conf
@@ -5,6 +5,7 @@ Release=trixie
 
 [Build]
 PackageCacheDirectory=mkosi.cache
+SandboxTrees=mkosi.builddir/debian-backports.sources:/etc/apt/sources.list.d/debian-backports.sources
 Environment=KERNEL_IMAGE KERNEL_VERSION
 WithNetwork=true
 
@@ -23,6 +24,7 @@ FinalizeScripts=base/debloat.sh
 PostInstallationScripts=base/debloat-systemd.sh
 PostInstallationScripts=base/efi-stub.sh
 BuildScripts=kernel/mkosi.build
+SyncScripts=base/add-backports.sh
 
 CleanPackageMetadata=true
 Packages=kmod
diff --git a/flake.nix b/flake.nix
index c25d9788..84f5c6ad 100644
--- a/flake.nix
+++ b/flake.nix
@@ -71,6 +71,7 @@
             qemu-utils
             parted
             unzip
+            jq
           ]
           ++ [reprepro];
       };
@@ -92,6 +93,7 @@
         nativeBuildInputs = [(mkosi system) measured-boot measured-boot-gcp];
         shellHook = ''
           mkdir -p mkosi.packages mkosi.cache mkosi.builddir ~/.cache/mkosi
+          touch mkosi.builddir/debian-backports.sources
         '';
       };
     }) ["x86_64-linux" "aarch64-linux"]);

From 7b1d2216d0cc8ac427cc46706e24ac458f1f7cb3 Mon Sep 17 00:00:00 2001
From: alexhulbert <alex@alexhulbert.com>
Date: Wed, 26 Nov 2025 22:18:43 +0900
Subject: [PATCH 2/4] Replace L2 rustup with debian backports rustc/cargo

---
 l2/_op_rbuilder/mkosi.build                               | 8 --------
 l2/_op_rbuilder/mkosi.conf                                | 3 ++-
 .../mkosi.extra/etc/flashbots/op-rbuilder.yaml            | 3 ---
 3 files changed, 2 insertions(+), 12 deletions(-)

diff --git a/l2/_op_rbuilder/mkosi.build b/l2/_op_rbuilder/mkosi.build
index 8c5d7a10..07e0b597 100755
--- a/l2/_op_rbuilder/mkosi.build
+++ b/l2/_op_rbuilder/mkosi.build
@@ -4,19 +4,11 @@ set -euxo pipefail
 
 ENV_YAML="$SRCDIR/l2/_op_rbuilder/mkosi.extra/etc/flashbots/op-rbuilder.yaml"
 
-RUST_VERSION=$(mkosi-chroot yq -r .rust.version < "$ENV_YAML")
-
 OP_RBUILDER_REF=$(mkosi-chroot yq -r .op_rbuilder.git_reference < "$ENV_YAML")
 TDX_QUOTE_PROVIDER_REF=$(mkosi-chroot yq -r .tdx_quote_provider.git_reference < "$ENV_YAML")
 RPROXY_REF=$(mkosi-chroot yq -r .rproxy.git_reference < "$ENV_YAML")
 NODE_HEALTHCHECKER_REF=$(mkosi-chroot yq -r .node_healthchecker.git_reference < "$ENV_YAML")
 
-export RUSTUP_HOME="/rustup"
-export CARGO_HOME="/cargo"
-mkosi-chroot rustup toolchain install $RUST_VERSION
-mkosi-chroot rustup default $RUST_VERSION
-export PATH="$CARGO_HOME/bin:$PATH"
-
 source scripts/make_git_package.sh
 source scripts/build_rust_package.sh
 
diff --git a/l2/_op_rbuilder/mkosi.conf b/l2/_op_rbuilder/mkosi.conf
index 0e3d9662..2de2ba06 100644
--- a/l2/_op_rbuilder/mkosi.conf
+++ b/l2/_op_rbuilder/mkosi.conf
@@ -12,6 +12,7 @@ Packages=libtss2-dev
 
 BuildPackages=golang
               libssl-dev
-              rustup
+              cargo/trixie-backports
+              rustc/trixie-backports
               unzip
               yq
diff --git a/l2/_op_rbuilder/mkosi.extra/etc/flashbots/op-rbuilder.yaml b/l2/_op_rbuilder/mkosi.extra/etc/flashbots/op-rbuilder.yaml
index dd519a38..bad68109 100644
--- a/l2/_op_rbuilder/mkosi.extra/etc/flashbots/op-rbuilder.yaml
+++ b/l2/_op_rbuilder/mkosi.extra/etc/flashbots/op-rbuilder.yaml
@@ -1,6 +1,3 @@
-rust:
-  version: 1.91.1
-
 node_healthchecker:
   git_reference: v0.1.11
 

From 5c5240c47ab6e553c6528c2254968fa9867fdfb7 Mon Sep 17 00:00:00 2001
From: alexhulbert <alex@alexhulbert.com>
Date: Wed, 3 Dec 2025 21:43:50 +0900
Subject: [PATCH 3/4] Use default mirror uri, not empty file

---
 base/add-backports.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/base/add-backports.sh b/base/add-backports.sh
index 5906824c..c14a8bfc 100755
--- a/base/add-backports.sh
+++ b/base/add-backports.sh
@@ -5,9 +5,10 @@
 # See https://github.com/systemd/mkosi/issues/1755
 MIRROR=$(jq -r .Mirror /work/config.json)
 if [ "$MIRROR" = "null" ]; then
-    : > "$SRCDIR/mkosi.builddir/debian-backports.sources"
-else
-    cat > "$SRCDIR/mkosi.builddir/debian-backports.sources" <<EOF
+    MIRROR="http://deb.debian.org/debian"
+fi
+
+cat > "$SRCDIR/mkosi.builddir/debian-backports.sources" <<EOF
 Types: deb deb-src
 URIs: $MIRROR
 Suites: ${RELEASE}-backports
@@ -15,4 +16,3 @@ Components: main
 Enabled: yes
 Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
 EOF
-fi

From b39c9bb03c761d6cd577b3622544ef4f6f792791 Mon Sep 17 00:00:00 2001
From: Anton Bronnikov <anton@northernforest.nl>
Date: Tue, 16 Dec 2025 09:12:35 +0100
Subject: [PATCH 4/4] chore: tidy-up

---
 l2/_op_rbuilder/mkosi.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/l2/_op_rbuilder/mkosi.conf b/l2/_op_rbuilder/mkosi.conf
index 2de2ba06..306dc865 100644
--- a/l2/_op_rbuilder/mkosi.conf
+++ b/l2/_op_rbuilder/mkosi.conf
@@ -10,9 +10,9 @@ Packages=libtss2-dev
          sudo
          unzip
 
-BuildPackages=golang
+BuildPackages=cargo/trixie-backports
+              golang
               libssl-dev
-              cargo/trixie-backports
               rustc/trixie-backports
               unzip
               yq