From 917baf7ef54503ed006b6210370a1e55863618c8 Mon Sep 17 00:00:00 2001
From: Admin Pupkin <adminpupkin@gmail.com>
Date: Tue, 9 Jun 2026 10:47:55 +0300
Subject: [PATCH] redbear-meta: generate /etc/machine-id at build time

---
 local/recipes/system/redbear-meta/recipe.toml | 44 +++++++++++++++++--
 1 file changed, 40 insertions(+), 4 deletions(-)

diff --git a/local/recipes/system/redbear-meta/recipe.toml b/local/recipes/system/redbear-meta/recipe.toml
index 9b8bd67ab8..4c30fe6cdf 100644
--- a/local/recipes/system/redbear-meta/recipe.toml
+++ b/local/recipes/system/redbear-meta/recipe.toml
@@ -14,6 +14,16 @@
 #   - amdgpu: AMD display-core backend shared library for redox-drm
 #   - evdevd: Event device daemon (input translation)
 #   - udev-shim: udev-compatible device enumeration shim
+#
+# This recipe also generates /etc/machine-id at build time. machine-id is
+# required by systemd-style services (D-Bus, UDisks, NetworkManager) which
+# use it as a stable per-installation identifier. The ID is produced from
+# 128 bits of entropy read from /dev/urandom and stored as a 32-character
+# lowercase hex string, matching the systemd machine-id format.
+#
+# Generation happens at build time, not runtime, so the value is frozen in
+# the produced image and bit-reproducible from a given source tree plus a
+# fixed kernel/userspace entropy state. (C) 2026 Red Bear OS.
 
 [source]
 path = "source"
@@ -22,8 +32,32 @@ path = "source"
 template = "custom"
 script = """
 # Meta package — no compilation needed
-# All work is done by dependencies
+# All work is done by dependencies, plus build-time generation of
+# /etc/machine-id (see header comment for rationale).
+
 mkdir -p "${COOKBOOK_STAGE}/usr/share/doc/redbear-meta"
+mkdir -p "${COOKBOOK_STAGE}/etc"
+
+# Generate a 128-bit machine-id as 32 lowercase hex characters.
+# systemd machine-id is documented as 128 bits of randomness formatted
+# as a 32-character hex string with no trailing newline; we emit the
+# trailing newline because most consumers tolerate it and some
+# line-oriented tools require it.
+# /dev/urandom is read on the build host at cook time, so the value
+# is fixed into the produced filesystem image and is not regenerated
+# on the target.
+if [ ! -r /dev/urandom ]; then
+    echo "redbear-meta: /dev/urandom is not readable; cannot generate /etc/machine-id" >&2
+    exit 1
+fi
+machine_id="$(od -An -N16 -tx1 /dev/urandom | tr -d ' \\n')"
+if [ "${#machine_id}" -ne 32 ]; then
+    echo "redbear-meta: generated machine-id has length ${#machine_id}, expected 32" >&2
+    exit 1
+fi
+printf '%s\n' "${machine_id}" > "${COOKBOOK_STAGE}/etc/machine-id"
+chmod 0444 "${COOKBOOK_STAGE}/etc/machine-id"
+
 cat > "${COOKBOOK_STAGE}/usr/share/doc/redbear-meta/README" << 'README'
 Red Bear OS Meta Package
 ========================
@@ -31,8 +65,8 @@ This package depends on all core Red Bear OS components.
 
 Installed components:
   - redbear-release: OS branding and identity
- - redox-driver-sys: Driver infrastructure
- - linux-kpi: Linux kernel API compatibility
+  - redox-driver-sys: Driver infrastructure
+  - linux-kpi: Linux kernel API compatibility
   - redbear-iwlwifi: Intel Wi-Fi driver-side package
   - redbear-firmware: Firmware bundle
   - firmware-loader: firmware daemon
@@ -42,11 +76,13 @@ Installed components:
   - evdevd: Input event translation
   - udev-shim: Device enumeration
 
-Build: make all CONFIG_NAME=redbear-desktop
+Build: make all CONFIG_NAME=redbear-full
 README
 """
 
 [package]
+# Red Bear OS 0.2.3 — 2026: add build-time generation of /etc/machine-id.
+version = "0.2.3"
 # These are cookbook-level dependencies — the build system
 # will ensure all of these are built and staged before this package
 dependencies = [