gen

Overview ¶

Command gen cross-compiles cmd/moat-init into the embed/ blobs and refreshes checksums.txt. It is invoked by `go generate ./internal/initbin` from the initbin package directory (go generate sets the working directory to the directory of the file containing the directive).

Build flags: CGO_ENABLED=0 for a static binary that runs on any base image (no dynamic loader / glibc dependency), -trimpath and -ldflags "-s -w" for reproducible, minimal blobs, and -buildvcs=false so the bytes do not embed the moat repo's git revision/dirty state. Without -buildvcs=false, building the entrypoint from a dirty tree (which `go generate` itself creates by rewriting embed/*) bakes vcs.modified=true into the blob; since builder.initHashComponent hashes these bytes into the image cache key, two builds of identical entrypoint source could then re-key cached images. The checksums are committed alongside the stubs; a unit test hashes the embedded bytes against checksums.txt to catch a stale or hand-edited blob. Note the checksums still pin the Go toolchain: a toolchain upgrade changes the -trimpath output and fails the checksum test until regenerated.