ospack: Switch AppArmor profiles to complain mode

After the rebase to Buster, some AppArmor profiles have become problematic and prevent the components from working.

In particular, the logind, Canterbury and Ribchester profiles prevent the Mildenhall HMI from appearing on the screen.

Until they get updated, switch them to complain mode rather than enforcing.

apertis-ospack-minimal.yaml

@@ -4,6 +4,7 @@
 {{- $suite := or .suite "v2019dev0" -}}
 {{- $timestamp := or .timestamp "" -}}
 {{- $ospack := or .ospack (printf "ospack_%s-%s-%s" $suite $architecture $type) -}}
+{{- $ivitools := or .ivitools "enabled" -}}
 {{- $lxc := or .lxc "enabled" -}}
 
 architecture: {{ $architecture }}
@@ -62,12 +63,14 @@ actions:
       - apparmor
       - chaiwala-apparmor-profiles
 
+  {{ if eq $ivitools "enabled" }}
   - action: apt
     description: "Application framework packages"
     packages:
       - canterbury-core
       - newport
       - ribchester-core
+  {{ end }}
 
   - action: apt
     description: "Test environment packages"

[Sjoerd Simons]

why? I really dislike the ivitools variable littered over the recipes and your commit doesn't explain what the goal is there. Minimal was always meant to have the app framework as well

[Emanuele Aina]

I'm not too enthusiastic about it either, but it provides a readily available toggle for product teams that will try to base their work on the sample recipes in !113 (merged).

Now, I'm not sure this is has the best naming, mechanism and approach, but since it is here, for consistency with other recipes it seemed appropriate to introduce it in the minimal recipe as well.

[Emanuele Aina]

The reason aa-complain takes the difficult route is that the force-complain symlinks break the AppArmor cache.

I don't think we're too concerned about that, this is a stop-gap in any case, so I will rework my patch to use the symlinks approach.