This reverts commit fffab36d,
"ospack: Switch AppArmor profiles to complain mode".

After the rebase to Buster, some AppArmor profiles have become problematic and
prevent the components from working. In particular, the logind, Canterbury and
Ribchester profiles prevent the Mildenhall HMI from appearing on the screen so
they were forced into complain mode rather than enforce mode.

Now the underlying issue has been fixed in APERTIS-5840 the profiles can be
restored to their enforcing mode.

Fixes: https://phabricator.apertis.org/T6010



Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Emanuele Aina authored 5 years ago and Frédéric Dalleau committed 5 years ago

Add a script to extract the debos calls in the README and run them to ensure
that they can be succesfully run on the SDK.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Emanuele Aina authored 6 years ago and Frédéric Dalleau committed 5 years ago

Make GitLab render it nicely.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Emanuele Aina authored 6 years ago and Frédéric Dalleau committed 5 years ago

Guide newcomers through the process of building their own images using the
sample recipes.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Emanuele Aina authored 5 years ago and Frédéric Dalleau committed 5 years ago

Users should be able to build the Apertis images from the SDK, so ship Debos
and OSTree right from the start.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Martyn Welch authored 5 years ago and Frédéric Dalleau committed 5 years ago

The example recipes still contain zeroed timestamps that are used in the
output names. This has been removed from the main recipes so tweak the
sample recipes to remove the timestamp.

Signed-off-by: Martyn Welch <martyn.welch@collabora.com>

Emanuele Aina authored 6 years ago and Frédéric Dalleau committed 5 years ago

Introduce some actions to show where customization steps can be injected.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Trigger a debos dry run to prevent syntax errors in the YAML recipes.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Frédéric Dalleau authored 5 years ago and Denis Pynkin committed 5 years ago

The autosuspend is used to poweroff a USB device that is unused.
In the btusb module, the device happen to be suspended in the
middle of a bluetooth scan, causing tests failures.
Let's disable the autosuspend behavior of btusb in SDK images.

Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>

Make more room on the home partition to be able to build the sdk recipe
on the sdk itself:

   sudo debos apertis-sample-image-sdk.yaml --scratchsize=10G

Even if the total size is increased, this has no actual impact during
build: the raw image file is sparse and so is the output vdi file.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Emanuele Aina authored 5 years ago and Peter Senna Tschudin committed 5 years ago

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Emanuele Aina authored 5 years ago and Peter Senna Tschudin committed 5 years ago

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Emanuele Aina authored 5 years ago and Peter Senna Tschudin committed 5 years ago

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Use the Jenkins Pipeline Unit testing framework to catch errors in the
Jenkinsfile without submitting a real build.

For the moment no specific invariant is checked, but it should be suffcient to
catch syntax errors before starting the job on Jenkins.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Signed-off-by: Ritesh Raj Sarraf <ritesh.sarraf@collabora.com>

It is installed only on apt style images using uboot.
It uses tmpfiles.d

Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>

Add realtek firmware primarily for realtek USB wireless dongles as well
as Atheros firmware primarily for Atheros based bluetooth devices.

Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>

Martyn Welch authored 5 years ago and Sjoerd Simons committed 5 years ago

The iptables-basic tests expect a specific list of iptables rules to be
present on the target. Depending on whether netbase is installed or not,
the formatting of this list changes, when installed protocols are listed
by name and by number when it's not. The iptables `--numeric` option
can not be used with the `--list-rules` option.

The simplest way to resolve this is to ensure consistent output across all
image types by installing netbase on minimal images.

It appears netbase would have been installed into minimal images prior to
the ospack types being split into different debos configurations.

Signed-off-by: Martyn Welch <martyn.welch@collabora.com>

In the past our Tracker package used to ship a downstream patch with a
GSetting override instructing it to look into `/home/shared` as well to
search for files to be indexed, as that's where we install the contents
of the multimedia demopack.

We're no longer carrying that downstream patch, so do a quick workaround
to make the multimedia files available by making the `~/Music`,
`~/Pictures` and `~/Videos` be symlinks pointing to the folders in
`/home/shared` with the same names.

This has the downside that switching locale or the XDG dir configuration
may make the multimedia files unindexed and that installing new
multimedia files requires that the `/home/shared` subfolders are
writable by the user.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

They were disabled temporarily to quickly get the first batch of images
built after the Buster rebase. Now that we have the packages proper in
the apt archive, re-enable them in the recipe so that the same is
included in the SDK image

Signed-off-by: Ritesh Raj Sarraf <ritesh.sarraf@collabora.com>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Apertis: https://phabricator.apertis.org/T5822



Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

In previous releases gtk-doc-tools used to depend on gnome-common and
transitively on autoconf-archive, but it is no longer the case so install
autoconf-archive explicitly as most of the Apertis-specific packages need it.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

hostnamectl determines the chassis type in different ways depending
on whether we are running on laptop, pc, VM, container or target
hardware. This guess is not predictable.

Bluez set the class of device from the chassis type.
On a laptop or desktop chassis, BlueZ will automatically
set the Bluetooth Class of Device to "Laptop" or "Desktop" and this
is overwriting value configured in /etc/bluetooth/main.conf.

Let's statically configure the chassis type to "embedded" to avoid
any guess.

Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>

The downloader in Debos using the Golang stdlib often hits a TLS timeout
on the Jenkins workers for causes still not clearly understood:

    Download started: 'https://images.apertis.org/media/multimedia-demo.tar.gz' -> '/scratch/multimedia-demo.tar.gz'
    Action `download` failed at stage Run, error: Get https://images.apertis.org/media/multimedia-demo.tar.gz: net/http: TLS handshake timeout

As a first step to investigate the issue, download the multimedia
demopack with `wget` in debug mode.

See https://phabricator.collabora.com/T11930



Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

The Frome package has not been re-enabled in all the recipes that it's
used in after it was temporarily disabled to ease generation of the first
images after the Buster rebase. Re-enable where it makes sense and remove
commented out entries where it is not actually required.

Additionally, after the rebase to Buster some AppArmor profiles have
become problematic and prevent the components from working. This is the
case for Frome, put the AppArmor policy in complain mode for now.

Signed-off-by: Martyn Welch <martyn.welch@collabora.com>

After the rebase to Buster, some AppArmor profiles have become
problematic and prevent the components from working: this is the case for
Newport, which currently fails to start.

This was tweaked for the minimal and target images, but missed for the SDK
in commit 3938bda1.

Signed-off-by: Martyn Welch <martyn.welch@collabora.com>

In the past we started a proof-of-concept implementation of self-updating
OSTree-based LXC containers, but in the end the project which prompted this
development ended up updating containers from the host.

Since we have no planned use for them, they are not part of any formal release,
no test is performed on them and since they fell quite behind after the rebase
to Buster with several parts still commented out, let's drop them altogether.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

After the rebase to Buster some AppArmor profiles have become problematic,
preventing the components from working, in this is the case Rhosydd. Put
the tool in complain mode for now.

Signed-off-by: Martyn Welch <martyn.welch@collabora.com>

Rhosydd had been re-enabled in the target, but not in the SDK or devroot
where it had also previously been installed. Re-enable it on the SDK, but
just in 1 place, deleting the second. On the devroot, we should really
have the relevant library headers rather than rhosydd its self, so add
libcroesor-0-dev and librhosydd-0-dev to that image instead.

Signed-off-by: Martyn Welch <martyn.welch@collabora.com>

After the rebase to Buster some AppArmor profiles have become problematic,
preventing the components from working. This is the case for a number of
the tracker tools. Put tracker in complain mode for now.

Signed-off-by: Martyn Welch <martyn.welch@collabora.com>

After the rebase to Buster, some AppArmor profiles have become
problematic and prevent the components from working: this is the case for
Newport, which currently fails to start.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Emanuele Aina authored 5 years ago and Martyn Welch committed 5 years ago

Newport was listed twice, and there's no need to install
{ribchester,canterbury}-core separately from their full counterparts.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Need to have 'fsck' tool in initramfs for all images variants.
Include 'fsck' overlay into ospacks.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Need to have 'fsck' tool in initramfs for all images variants.
Moved appropriate rule for initramfs into separate feature.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

In previous versions of Apertis we were using a modified iptables package
containing custom scripting/systemd unit to load iptables rules at boot.
Debian contains the iptables-persistent package which performs this task.

Use this instead of adding the custom scripts to the new version. Add the
custom rules to an overlay so we don't need to modify the package.

Signed-off-by: Martyn Welch <martyn.welch@collabora.com>

This file contains name of files skipped during creation of the
rollback test delta. It does not need to be uploaded to the target.

Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>

Emanuele Aina authored 6 years ago and Frédéric Dalleau committed 6 years ago

Commit 3611bdcb moved the VersionNumber generation at the beginning of the
pipeline so we only generate it once.

The installer merge landed at roughly the same time so it missed that.

Align the stage generating the installer images to the new approach.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

With newer kernels it takes far longer in early boot to get random
numbers (as >= 4.18 kernels ensure good quality entropy is availble
before starting  providing randomness).

Commit 85cc6eba took care of the minimal ospack/images introducing
rng-tools to integrate with hardware random number generators
while jitterentropy-rngd can provide randomness without.

This commit applies the same change to the target, basesdk and sdk
ospacks/images.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>