Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

Current asserts on AumBootState object in aum_boot_state_*() functions
ends up when there is no boot state backend available, i.e. for UEFI AMD64
targets, by trying to rollback the OS.
Replacing those asserts by tests returning default values allows AUM to
handle this case gracefully and with better debug message.

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

New `uboot.cnt` file format appears in u-boot 2019.01+dfsg-7co7.

AUM should be able to work with both legacy and new u-boot, and their
`uboot.cnt` respective file formats. Otherwise AUM consider the file is
corrupted and triggers a rollback.
This commit allows to update AUM in a first step, work with the current
u-boot before upgrading it.

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

After a successful upgrade, multiple failures during boot sequence may
trigger the u-boot altbootcmd process which will trigger an unexpected
rollback.
This patch adds a version and an upgrade_available entries to the
bootcount file to enable/disable the bootcount check.

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Calling the ostree_sysroot_cleanup() function with initialized
error variable cause assertion:
  "_ostree_repo_lock_push: assertion 'error == NULL || *error == NULL' failed"

This issue is preventing correct repository prune in case of any problem
occurred during upgrade.

We do not want to mark the upgrade process as failed in case of any error
acquired during cleanup, hence just drop a warning message.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Andrew Lee (李健秋) authored 5 years ago and Denis Pynkin committed 5 years ago

Signed-off-by: Andrew Lee (李健秋) <ajqlee@debian.org>

Allow to install configuration file.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Explicitly disable OTA updates in config file.
Added all other supported options commented out.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

This method enable network updates and immediately start server polling.
Added appropriate handler in update manager.
Added option "--check-network-updates|-u" for CLI utility `updatectl` to
call this method.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Added function `aum_ostree_upgrader_set_ready()` to reset the timer
to start the server pooling immediately if polling is set.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Added check of metadata first, so we do not need to download the whole
commit to decide if it fits for our system.
Refactored `_ostree_upgrader_update_thread()` function to allow to use
the advantages of metadata check prior downloading the commit.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Almost no chance to catch this error but have to return correct error
state in any case.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

In case if 'origin' file contain some transient state the online upgrade
fails with error:
"OSTree:ERROR:src/libostree/ostree-repo-pull.c:1823:scan_commit_object: assertion failed: (ref)"

In case of Apertis the "override-commit" is heavily used for test
purposes. Have to cleanup the origin prior to pulling the upgrade.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

We track the version of AUM via package version.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Fix the issue with system reboot after update -- executing of 'systemctl'
doesn't reboot the system. Call the Reboot() method of systemd via dbus
instead of execution the 'systemctl'.

Fixes: APERTIS-5907

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Remove error message which cause to return incorrect status in case if
we try to upgrade to the same or older commit.

Fixes: APERTIS-5903

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

In case if local remote is not configured for Collection ID
usage we allow to install the update.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Check if commit timestamp from static bundle is not older
than already deployed.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Starting from this commit any static delta file without
Collection ID and correct refs will be refused with error.

On the target device at least one remote must have the correct
'collection-id' field and branch listed in 'ostree.ref-binding'
metadata of inlined commit from upgrade bundle.

Function 'aum_get_target_checksum()' has been renamed to 'aum_get_target_metadata()'
with changed API and functionality. Currently this function tries to
get needed information from upgrade bundle and validate the collected
information.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>

g_key_file_get_* functions returns FALSE or NULL when an error
occurs. The current code does not account for that as the code bails out.
Let's check that the key exists before trying to read it and assign
sane defaults.

Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>

Since we have a configuration file, there is no use to have
a hard coded boot limit. Let's put it in a configuration file

Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>

Selecting BootState automatically has drawbacks
Some files may not be created initially at boot time
Some file can be check on the wrong platform.
This patch adds an option to select to boot state in the configuration file.

Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>

The bootcount will soon change to be store on the ext filesystem
in /boot/failures. The formar is two bytes { 0xbc, <bootcount> }.
To handle this new format, the update manager needs an update.
The bootcount is no longer saved, only u-boot will have to write it.
The upgrade_available variable is not available, so the file is written
at each boot.
The bootlimit is hardcoded in the update-manager and must stay in sync
with u-boot.

Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>

Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>

Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>

Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>

Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>

If an update handler is registered, the reboot is not done after an
upgrade.  Instead the upgrade handler is notified and can decide whether
to reboot or not.  However if the handler terminates, the upgrade and
reboot is forced.  This is causing a problem in LAVA: LAVA test shell
waits for all processes before terminating, and as long as the handler
is running, it will wait causing a LAVA timeout.  If the reboot is done
without control from LAVA, LAVA also times out.

Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

In case if administrator remove manually the failed deploy but
doesn't clean up the U-Boot environment -- U-Boot always use rollback
mechanism increasing the `bootcount` which affect to MMC wearing.
This fix allow to cleanup update state in case if we boot in roolback
mode but there is no "pending" deployment.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>