Create rpi64 APT and ostree minimal unified images.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

This recipe is needed to produce ostree-based bootable images
for Raspberry Pi 3 and 4.
RPi requires MS-DOS partitioning and FAT-formatted 1-st partition,
hence the new recipe file is created.

The 1-st partition must be FAT and contain:
- config.txt -- boot configuration
- firmware files for initial boot
- DTB files
- u-boot.bin -- unified rpi64 U-Boot suitable for Rpi 3 and 4

The 2-nd partition containing extlinux config (/boot) must have a bootable
flag allowing U-Boot to find configuration.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Need to install U-Boot and firmware packages to have files for
the bootable image creation.
It wouldn't be possible to install packages after creation of ostree
commit from the one hand and we need to keep those files as a part of
commit for future updates of firmware and U-Boot on bootable partition.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

This recipe is needed to produce APT-based bootable images
for Raspberry Pi 3 and 4.
RPi requires MS-DOS partitioning and FAT-formatted 1-st partition,
hence the new recipe file is created.

The 1-st partition must be FAT and contain:
- config.txt -- boot configuration
- firmware files for initial boot
- DTB files
- u-boot.bin -- unified rpi64 U-Boot suitable for Rpi 3 and 4

The 2-nd partition containing extlinux config (/boot) must have a bootable
flag allowing U-Boot to find configuration.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Script is needed for copying required boot files from
ostree deployment to boot partition:
- u-boot binary
- Raspberry Pi firmware files
- DTB files for Raspberry Pi 3 and 4

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Add config file for booting RPi 3/4 in 64b mode via `u-boot`.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Enable `non-free` repository for Arm64 minimal and target ospack
recipes. Non-free repository contains firmmware files needed for
several boards correct work, e.g. Raspberry Pi at the moment.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

The kernel command line differed across the APT and OSTree images for no
good reason, so sync the APT ones to the OSTree ones.

This means that the `ro` flag has now become `rw`, but the rootfs on the
APT images was already writable anyway, so in the end this does not change
anything.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

A separate mktemp package is not a thing, so the replacement procedure
can be simplified a bit.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

The name of the binary produced by U-Boot for the SABRE Lite has
changed from `u-boot.imx` to `u-boot-dtb.imx` with the latest update to
U-Boot. This is causing the creation of the U-Boot installer to fail
and would also cause installation to fail.

Tweak the name to enable the U-Boot installer to be correctly built and
be able to install the U-Boot binary.

Signed-off-by: Martyn Welch <martyn.welch@collabora.com>

Some changes are merely cosmetic, but two are actually important:
* point to the v2021dev3 image builder Docker image for the GitLab CI
  image building pipeline
* use v2021dev3 in the `README.md` examples which are actually tested
  by the https://qa.apertis.org/sdk-debos-image-building.html

 testcase

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Frederic Danis authored 4 years ago and Martyn Welch committed 4 years ago

This commit adds the keys used by apertis-update-manager to try to unlock
the encrypted bundle update.
Since this commit is merged, only encrypted bundle updates can be used to
update the target using offline update process.

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

Make sure that the pkglist generated for the OSTree commit is propagated
to the upload job.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Ritesh Raj Sarraf <rrs@debian.org>

Added kernel option `systemd.gpt_auto=false` to explicitly
disable `systemd-gpt-auto-generator`.
With a bind-mount of `/boot` partition the GPT generator creates the
automount for EFI partition targeted to `/bind` and fail during the boot.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

In case if we don't use separate partition for /boot we need to
provide system's /boot for correct work of libostree. Do bind mount
of /boot to keep the ostree bootloader configuration in place.

Skip that bind mount in case if the target system have dedicated
boot partition.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Update everything, including the documentation, to point to v2021dev2.

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

As the apt_source script potentially upgrades various packages based on
newly added repositories it needs to be non-interactive otherwise it may
query for user input during image build.

Signed-off-by: Sjoerd Simons <sjoerd@collabora.com>

The script and debos recipe creates a file with 10% plus 18M bigger than
the original static delta bundle for filesystem and encryption.
It encrypts the device using Luks/dm-crypt, creates an ext2 filesystem and
copy original static delta bundle in it.

Up to 8 keys can be added to the encrypted bundle.
ENCRYPT_KEY_0 should be provided in GitLab CI variable to encrypt bundle.
Other keys, ENCRYPT_KEY_1 to ENCRYPT_KEY_7, are optional.
All keys are copied to calling directory to allow debos recipe to access
them.

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

This will prevent warnings in the log as support for encrypted devices has
been re-introduced in Udisks2.
This will be used to support encrypted update bundles.

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

* Drop vestigial partitions like `factory_reset`, `flags`, `boot_1`,
  `boot_2` and `flags_backup`
* Make all boot partitions 256M
* Fill the entire disk, starting at sector 0
* Drop unneeded options
* Make the system partitions 3000M everywhere except on the SDK

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

The default timestamps were removed in 70ad2ee3 but some
now-unused `timestamp` variable were left lingering.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Explicitly adding `ca-certificates` package to avoid problems
with SSL connections in case if `debootstrap` skip this package
by any reason.

Fixes: https://phabricator.apertis.org/T7106



Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

We have moved to assuming that the U-Boot bootloader is installed on the
SPI onboard flash memory a long time ago, so let's finally drop the
installation of the `u-boot-imx` package from the ostree-commit recipe.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Emanuele Aina authored 4 years ago and Martyn Welch committed 4 years ago

Use the LAVA job templates from apertis-test-cases in an attempt to
simplify their handling.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Combining `needs:` and `dependencies` is deprecated, so switch to
`artifacts: false` in the `needs:` entries when submitting tests.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

To work around https://gitlab.com/gitlab-org/gitlab/-/issues/213080

 a
number of transitive dependencies has been explicited.

Since we only need those to ensure the flow is correct, stop fetching
their artifacts.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

OSTREE_SIGNING_KEY variable can be used to sign static delta bundles using
ed25519 keys.
Add sections to:
- generate ed25519 keys
- provide secret key to GitLab-CI
- provide public key to Apertis

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

This shares the same command parameters than the one used to sign commits.

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

Sometimes the jobs takes more time than expected due to slow network
traffic or other unrelated issues.

Some other times the fakemachine startup gets stuck while mounting
filesystems and drops into the emergency shell, see
https://gitlab.apertis.org/infrastructure/apertis-image-recipes/-/jobs/332907

    [FAILED] Failed to mount /etc/alternatives.
    See 'systemctl status etc-alternatives.mount' for details.
    [DEPEND] Dependency failed for Local File Systems.

In some cases UML seems behave surprisingly, leading to crashes up in
the stack, for instance in the ostree locking from debos
https://gitlab.apertis.org/infrastructure/apertis-image-recipes/-/jobs/333401



    (process:1593): OSTree-CRITICAL **: 16:03:48.541: pop_repo_lock: assertion 'lock_table != NULL' failed
    (process:1593): GLib-CRITICAL **: 16:03:48.542: g_propagate_error: assertion 'src != NULL' failed
    ERROR:/usr/local/go/src/github.com/sjoerdsimons/ostree-go/pkg/glibobject/glibobject.go.h:6:_g_error_get_message: assertion failed: (error != NULL)
    SIGABRT: abort

Default to trying out the jobs again if they times out.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Due to a typo the amd64 devroot upload stage was named as the sysroot
upload stage, leading to one of the two being ignored.

Thanks Martyn for spotting it!

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

The `$VAR == ""` matches only when the variable is actually defined but
it is empty, which is not what we wanted here. Use `$VAR == null` to
detect when the variables storing the upload credentials are not defined
and skip the upload jobs accordingly.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Emanuele Aina authored 5 years ago and Martyn Welch committed 5 years ago

Include the `.img` extension in the pkglist filename for the sdk image
recipe as apparently it got missed from commit 93431e39
"images: Align the {pkg,file}list names to the matching artifacts".

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

The multimedia demo pack should be included in the target images as it
is used by the Frampton media player to show a list of songs on boot.

Without it, Frampton only shows an empty screen.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

While we were switching to the Debos UML backend to be able to use the
autoscaling runner on AWS we introduced the `aws` tag to avoid the old
`graviera` runner which was not configured to run UML.

Now the configuration for the old runner has been updated to include
the `tmpfs:exec` on `/scratch` and the `SYS_PTRACE` capability in the
Docker settings, and is thus able to run Debos with the UML backend.

We can now assume again that all the available runners configured to run
untagged jobs can execute Debos just fine, so drop the tags.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Add more workarounds to those introduced in commit 592b4203
"Work around miscalculation of deps with skipped jobs", addressing
https://gitlab.com/gitlab-org/gitlab/-/issues/213080



This commit should be reverted once the GitLab issue is fixed.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Emanuele Aina authored 5 years ago and Andrej Shadura committed 5 years ago

The upload jobs for the ARM 32 and 64 bit sysroot and devroot were
missing and thus the artifacts were not pushed on images.apertis.org.

The amd64 devroot upload job was missing as well.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>