Include updates and security repositories

On image generation only main repositories are used, which causes that
updates are not applied. Include both updates and security repositories
similar as it is done with standard Apertis images.

Signed-off-by: Walter Lozano <walter.lozano@collabora.com>

.gitlab-ci/templates-ospack-build.yml

@@ -6,10 +6,20 @@
   script:
     - mkdir -p a/${PIPELINE_VERSION}/${architecture}/${type}
     - cd a/${PIPELINE_VERSION}/${architecture}/${type}
+    - |
+      case $release in
+        v*dev*|v*pre)
+          stable=false
+          ;;
+        *)
+          stable=true
+          ;;
+      esac
     - debos ${debosarguments}
         --show-boot
         -t architecture:${architecture}
         -t suite:${release}
+        -t stable:${stable}
         -t ospack:ospack_${release}-${architecture}-nfs.tar.gz
         $CI_PROJECT_DIR/recipes/apertis-ospack-nfs.yaml
   artifacts:

recipes/apertis-ospack-nfs.yaml

 {{- $architecture := or .architecture "amd64" }}
 {{- $mirror := or .mirror "https://repositories.apertis.org/apertis/" -}}
 {{- $suite := or .suite "18.09" -}}
+{{- $stable := or .stable "" -}}
 {{- $ospack := or .ospack (printf "ospack_%s-%s-nfs.tar.gz" $suite $architecture ) -}}
 
 architecture: {{ $architecture }}
@@ -19,7 +20,11 @@ actions:
 
   - action: run
     chroot: true
-    script: scripts/apt_source.chroot -m {{ $mirror }} -r {{ $suite }} development
+    script: scripts/apt_source.chroot -m {{ $mirror }} -r {{ $suite }} {{if eq $stable "true"}} --updates --security {{end}} target
+
+  - action: run
+    chroot: true
+    script: scripts/apt_source.chroot -m {{ $mirror }} -r {{ $suite }} {{if eq $stable "true"}} --updates --security {{end}} development
 
   - action: apt
     description: "Install package for needed boot and flashing"

recipes/scripts/apt_source.chroot

@@ -5,14 +5,33 @@ set -eu
 SRCLIST=/etc/apt/sources.list
 MIRROR=
 RELEASE=
+SECURITY=
+UPDATES=
 
-opts=$(getopt -o "m:r:" -l "mirror:,release:" -- "$@")
+add_entry () {
+    local MIRROR=$1
+    local RELEASE=$2
+    local dist=$3
+    local SRCLIST=$4
+
+    if ! grep -q "^deb .*$MIRROR.*$RELEASE.*$dist" $SRCLIST; then
+        echo "deb $MIRROR $RELEASE $dist" >> $SRCLIST
+    fi
+
+    if ! grep -q "^deb-src .*$MIRROR.*$RELEASE.*$dist" $SRCLIST; then
+        echo "deb-src $MIRROR $RELEASE $dist" >> $SRCLIST
+    fi
+}
+
+opts=$(getopt -o "m:r:" -l "mirror:,release:,updates,security" -- "$@")
 eval set -- "$opts"
 
 while [ $# -gt 0 ]; do
     case $1 in
         -m|--mirror) MIRROR="$2"; shift 2;;
         -r|--release) RELEASE="$2"; shift 2;;
+        --updates) UPDATES=1; shift;;
+        --security) SECURITY=1; shift;;
         --) shift; break;;
         *) ;;
     esac
@@ -24,11 +43,18 @@ if [ -z "$MIRROR" ] || [ -z "$RELEASE" ] || [ $# -eq 0 ]; then
 fi
 
 for dist in $@; do
-    if ! grep -q "^deb .*$MIRROR.*$RELEASE.*$dist" $SRCLIST; then
-        echo "deb $MIRROR $RELEASE $dist" >> $SRCLIST
-    fi
+    add_entry $MIRROR $RELEASE $dist $SRCLIST
 
-    if ! grep -q "^deb-src .*$MIRROR.*$RELEASE.*$dist" $SRCLIST; then
-        echo "deb-src $MIRROR $RELEASE $dist" >> $SRCLIST
+    if [ -n "$UPDATES" ]; then
+        add_entry $MIRROR $RELEASE-updates $dist $SRCLIST
+    fi
+    if [ -n "$SECURITY" ]; then
+        add_entry $MIRROR $RELEASE-security $dist $SRCLIST
     fi
-done
\ No newline at end of file
+done
+
+# the -security and -updates repositories may ship updates to already-installed
+# packages, so make sure they get pulled in
+export DEBIAN_FRONTEND=noninteractive
+apt-get update
+apt-get upgrade -y --no-install-recommends
\ No newline at end of file