Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

When we try to apply a delta file with an unsigned superblock, the
apertis-update-manager crash with SEGV.
g_autoptr variable need to be initialized to NULL, in case function exits
before the variable is assigned and used.

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

The encrypted interface of the loop device object in udisks2 can take times
to appear, this occurs only after boot.
If after 2 seconds (20 tries with 0.1s delay) the interface is still not
available, it may be because there's no encrypted data in the file.

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

If the `/usr/share/apertis-update-manager` directory exists and an
external device, USB or SDCard, has a `static-update.bundle.enc` in its
root directory, this file is decrypted (using loopback device and dm-crypt)
and mounted. This will trigger a new `mount-added` signal, which will be
able to found the `static-update.bundle` file and process with he update.

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

All item returned by g_variant_iter_next_value() should be unrefed.

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

The error needs to be de-referenced to get the real error pointer.

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

Add `aum_get_target_metadata` to verify the superblock metadata, expect
signature and commits.

Add `aum_load_target_superblock` to load static delta superblock, used by
`aum_get_target_metadata` and `aum_target_superblock_verify_signature`.
This prevents 2 times read problem, i.e. a first read from the media device
to check signature and claim static delta as a "safe" file followed by a
second read to parse the superblock again. The special HW with USB media
"emulation" may substitute bits to others for the second read.

Add function to load keys, shared by `aum_check_signature` and
`aum_target_superblock_verify_signature`.

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Allow to use relative path including local directory for
ostree deltas for updatectl tool.
This help to avoid confusion with non-existion file for end users.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

New `uboot.cnt` file format appears in u-boot 2019.01+dfsg-7co7.

AUM should be able to work with both legacy and new u-boot, and their
`uboot.cnt` respective file formats. Otherwise AUM consider the file is
corrupted and triggers a rollback.
This commit allows to update AUM in a first step, work with the current
u-boot before upgrading it.

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

After a successful upgrade, multiple failures during boot sequence may
trigger the u-boot altbootcmd process which will trigger an unexpected
rollback.
This patch adds a version and an upgrade_available entries to the
bootcount file to enable/disable the bootcount check.

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Calling the ostree_sysroot_cleanup() function with initialized
error variable cause assertion:
  "_ostree_repo_lock_push: assertion 'error == NULL || *error == NULL' failed"

This issue is preventing correct repository prune in case of any problem
occurred during upgrade.

We do not want to mark the upgrade process as failed in case of any error
acquired during cleanup, hence just drop a warning message.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Signed-off-by: Andrew Lee (李健秋) <ajqlee@debian.org>

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Verify if commit provided in delta file is signed with valid `ed25519`
signature.

Public key for signature could be provided in config via file or key
itself by using options for remote `verification-file` and
`verification-key` respectively.
If none of above is provided, then public keys provided by system are used.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Allow to install configuration file.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Explicitly disable OTA updates in config file.
Added all other supported options commented out.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

This method enable network updates and immediately start server polling.
Added appropriate handler in update manager.
Added option "--check-network-updates|-u" for CLI utility `updatectl` to
call this method.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Added function `aum_ostree_upgrader_set_ready()` to reset the timer
to start the server pooling immediately if polling is set.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Added check of metadata first, so we do not need to download the whole
commit to decide if it fits for our system.
Refactored `_ostree_upgrader_update_thread()` function to allow to use
the advantages of metadata check prior downloading the commit.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Almost no chance to catch this error but have to return correct error
state in any case.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

In case if 'origin' file contain some transient state the online upgrade
fails with error:
"OSTree:ERROR:src/libostree/ostree-repo-pull.c:1823:scan_commit_object: assertion failed: (ref)"

In case of Apertis the "override-commit" is heavily used for test
purposes. Have to cleanup the origin prior to pulling the upgrade.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

We track the version of AUM via package version.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Fix the issue with system reboot after update -- executing of 'systemctl'
doesn't reboot the system. Call the Reboot() method of systemd via dbus
instead of execution the 'systemctl'.

Fixes: APERTIS-5907

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Remove error message which cause to return incorrect status in case if
we try to upgrade to the same or older commit.

Fixes: APERTIS-5903

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

In case if local remote is not configured for Collection ID
usage we allow to install the update.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Check if commit timestamp from static bundle is not older
than already deployed.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Starting from this commit any static delta file without
Collection ID and correct refs will be refused with error.

On the target device at least one remote must have the correct
'collection-id' field and branch listed in 'ostree.ref-binding'
metadata of inlined commit from upgrade bundle.

Function 'aum_get_target_checksum()' has been renamed to 'aum_get_target_metadata()'
with changed API and functionality. Currently this function tries to
get needed information from upgrade bundle and validate the collected
information.

Signed-off-by: Denis Pynkin <denis.pynkin@collabora.com>

Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>