* [Buildroot] [PATCH 0/1] package/rpi-eeprom new package @ 2024-12-16 12:57 Tim Gover via buildroot 2024-12-16 12:58 ` [Buildroot] [PATCH 1/1] package/rpi-eeprom: New package for RPi bootloader tools Tim Gover via buildroot 0 siblings, 1 reply; 4+ messages in thread From: Tim Gover via buildroot @ 2024-12-16 12:57 UTC (permalink / raw) To: buildroot; +Cc: Thomas Petazzoni, Tim Gover Add a new package to make it easier to include the Raspberry Pi bootloader configuration and code signing tools. Compute Module users often need to enable signed boot in order to create products covered by the Cyber Resilience Act. A first step in this direction is to make it easy to include the Raspberry Pi bootloader via a buildroot package. Tim Gover (1): package/rpi-eeprom: New package for RPi bootloader tools configs/raspberrypi5_defconfig | 1 + package/Config.in | 1 + package/Config.in.host | 1 + package/rpi-eeprom/Config.in | 9 +++++++++ package/rpi-eeprom/Config.in.host | 9 +++++++++ package/rpi-eeprom/rpi-eeprom.hash | 1 + package/rpi-eeprom/rpi-eeprom.mk | 27 +++++++++++++++++++++++++++ 7 files changed, 49 insertions(+) create mode 100644 package/rpi-eeprom/Config.in create mode 100644 package/rpi-eeprom/Config.in.host create mode 100644 package/rpi-eeprom/rpi-eeprom.hash create mode 100644 package/rpi-eeprom/rpi-eeprom.mk -- 2.34.1 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 4+ messages in thread
* [Buildroot] [PATCH 1/1] package/rpi-eeprom: New package for RPi bootloader tools 2024-12-16 12:57 [Buildroot] [PATCH 0/1] package/rpi-eeprom new package Tim Gover via buildroot @ 2024-12-16 12:58 ` Tim Gover via buildroot 2024-12-29 23:08 ` Thomas Petazzoni via buildroot 0 siblings, 1 reply; 4+ messages in thread From: Tim Gover via buildroot @ 2024-12-16 12:58 UTC (permalink / raw) To: buildroot; +Cc: Thomas Petazzoni, Tim Gover This package adds the host and OS tools for configuring the bootloader and building/signing tools for signed boot. Normally, the host tools would be invoked from a post-build script to sign the boot.img file. The device tools would be invoked from a custom on-device software update process e.g. using rpi-eeprom-digest to verify the signature of a boot.img file against a public key retrieved from the EEPROM. The current version does not download the EEPROM images because the bootloader EEPROM is not normally updated via a buildroot image. However, future versions might provide the facility to generate both a buildroot initramfs and accompanying signed EEPROM image e.g for network install. Signed-off-by: Tim Gover <tim.gover@raspberrypi.com> --- configs/raspberrypi5_defconfig | 1 + package/Config.in | 1 + package/Config.in.host | 1 + package/rpi-eeprom/Config.in | 9 +++++++++ package/rpi-eeprom/Config.in.host | 9 +++++++++ package/rpi-eeprom/rpi-eeprom.hash | 1 + package/rpi-eeprom/rpi-eeprom.mk | 27 +++++++++++++++++++++++++++ 7 files changed, 49 insertions(+) create mode 100644 package/rpi-eeprom/Config.in create mode 100644 package/rpi-eeprom/Config.in.host create mode 100644 package/rpi-eeprom/rpi-eeprom.hash create mode 100644 package/rpi-eeprom/rpi-eeprom.mk diff --git a/configs/raspberrypi5_defconfig b/configs/raspberrypi5_defconfig index 8cbd533eee..6d364ad32f 100644 --- a/configs/raspberrypi5_defconfig +++ b/configs/raspberrypi5_defconfig @@ -31,3 +31,4 @@ BR2_PACKAGE_HOST_DOSFSTOOLS=y BR2_PACKAGE_HOST_GENIMAGE=y BR2_PACKAGE_HOST_KMOD_XZ=y BR2_PACKAGE_HOST_MTOOLS=y +BR2_PACKAGE_HOST_RPI_EEPROM=y diff --git a/package/Config.in b/package/Config.in index 5fa344c321..c62e3cd6f2 100644 --- a/package/Config.in +++ b/package/Config.in @@ -456,6 +456,7 @@ menu "Firmware" source "package/qcom-db410c-firmware/Config.in" source "package/qoriq-fm-ucode/Config.in" source "package/rcw-smarc-sal28/Config.in" + source "package/rpi-eeprom/Config.in" source "package/rpi-firmware/Config.in" source "package/sunxi-boards/Config.in" source "package/ts4900-fpga/Config.in" diff --git a/package/Config.in.host b/package/Config.in.host index e06824ad6b..91959494be 100644 --- a/package/Config.in.host +++ b/package/Config.in.host @@ -100,6 +100,7 @@ menu "Host utilities" source "package/raspberrypi-usbboot/Config.in.host" source "package/rauc/Config.in.host" source "package/riscv-isa-sim/Config.in.host" + source "package/rpi-eeprom/Config.in.host" source "package/runc/Config.in.host" source "package/rustc/Config.in.host" source "package/s6-rc/Config.in.host" diff --git a/package/rpi-eeprom/Config.in b/package/rpi-eeprom/Config.in new file mode 100644 index 0000000000..02e1109264 --- /dev/null +++ b/package/rpi-eeprom/Config.in @@ -0,0 +1,9 @@ +config BR2_PACKAGE_RPI_EEPROM + bool "rpi-eeprom" + select BR2_PACKAGE_LIBOPENSSL + select BR2_PACKAGE_PYTHON3 + select BR2_PACKAGE_PYTHON_PYCRYPTODOMEX + help + Raspberry Pi bootloader tools. + + https://github.com/raspberrypi/rpi-eeprom diff --git a/package/rpi-eeprom/Config.in.host b/package/rpi-eeprom/Config.in.host new file mode 100644 index 0000000000..3d36d7bec8 --- /dev/null +++ b/package/rpi-eeprom/Config.in.host @@ -0,0 +1,9 @@ +config BR2_PACKAGE_HOST_RPI_EEPROM + bool "host rpi-eeprom" + select BR2_PACKAGE_LIBOPENSSL + select BR2_PACKAGE_PYTHON3 + select BR2_PACKAGE_PYTHON_PYCRYPTODOMEX + help + Raspberry Pi bootloader tools. + + https://github.com/raspberrypi/rpi-eeprom diff --git a/package/rpi-eeprom/rpi-eeprom.hash b/package/rpi-eeprom/rpi-eeprom.hash new file mode 100644 index 0000000000..27cd0bfdf3 --- /dev/null +++ b/package/rpi-eeprom/rpi-eeprom.hash @@ -0,0 +1 @@ +sha256 90970fd9a72c29449a8f4f27577395a1fb418f87b979adeb81d51300f959dab9 rpi-eeprom-fe7bfc720165464d9dfe2f85fe090ca22a625bd7.tar.gz diff --git a/package/rpi-eeprom/rpi-eeprom.mk b/package/rpi-eeprom/rpi-eeprom.mk new file mode 100644 index 0000000000..db1634315f --- /dev/null +++ b/package/rpi-eeprom/rpi-eeprom.mk @@ -0,0 +1,27 @@ +################################################################################ +# +# rpi-eeprom +# +################################################################################ + +RPI_EEPROM_VERSION = fe7bfc720165464d9dfe2f85fe090ca22a625bd7 +RPI_EEPROM_SITE = $(call github,raspberrypi,rpi-eeprom,$(RPI_EEPROM_VERSION)) +RPI_EEPROM_LICENSE = BSD-3-Clause +RPI_EEPROM_LICENSE_FILES = LICENSE + +HOST_RPI_EEPROM_INSTALL = YES +RPI_EEPROM_INSTALL = YES + +define HOST_RPI_EEPROM_INSTALL_CMDS + $(INSTALL) -D -m 0755 $(@D)/rpi-eeprom-digest $(HOST_DIR)/bin/rpi-eeprom-digest + $(INSTALL) -D -m 0755 $(@D)/rpi-eeprom-config $(HOST_DIR)/bin/rpi-eeprom-config +endef + +define RPI_EEPROM_INSTALL_TARGET_CMDS + $(INSTALL) -D -m 0755 $(@D)/rpi-eeprom-digest $(TARGET_DIR)/bin/rpi-eeprom-digest + $(INSTALL) -D -m 0755 $(@D)/tools/rpi-bootloader-key-convert $(TARGET_DIR)/bin/rpi-bootloader-key-convert + $(INSTALL) -D -m 0755 $(@D)/tools/rpi-otp-private-key $(TARGET_DIR)/bin/rpi-otp-private-key +endef + +$(eval $(generic-package)) +$(eval $(host-generic-package)) -- 2.34.1 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [Buildroot] [PATCH 1/1] package/rpi-eeprom: New package for RPi bootloader tools 2024-12-16 12:58 ` [Buildroot] [PATCH 1/1] package/rpi-eeprom: New package for RPi bootloader tools Tim Gover via buildroot @ 2024-12-29 23:08 ` Thomas Petazzoni via buildroot 2025-01-07 15:54 ` Tim Gover via buildroot 0 siblings, 1 reply; 4+ messages in thread From: Thomas Petazzoni via buildroot @ 2024-12-29 23:08 UTC (permalink / raw) To: Tim Gover via buildroot; +Cc: Tim Gover Hello Tim, Thanks a lot for your submission, and sorry for the delay in getting back to you! See below some feedback. On Mon, 16 Dec 2024 12:58:00 +0000 Tim Gover via buildroot <buildroot@buildroot.org> wrote: > This package adds the host and OS tools for configuring > the bootloader and building/signing tools for signed boot. > > Normally, the host tools would be invoked from a post-build > script to sign the boot.img file. The device tools would be > invoked from a custom on-device software update process e.g. > using rpi-eeprom-digest to verify the signature of a boot.img > file against a public key retrieved from the EEPROM. Thanks for the good explanation of why both a target and host package are needed. > configs/raspberrypi5_defconfig | 1 + > package/Config.in | 1 + > package/Config.in.host | 1 + > package/rpi-eeprom/Config.in | 9 +++++++++ > package/rpi-eeprom/Config.in.host | 9 +++++++++ > package/rpi-eeprom/rpi-eeprom.hash | 1 + > package/rpi-eeprom/rpi-eeprom.mk | 27 +++++++++++++++++++++++++++ > 7 files changed, 49 insertions(+) > create mode 100644 package/rpi-eeprom/Config.in > create mode 100644 package/rpi-eeprom/Config.in.host > create mode 100644 package/rpi-eeprom/rpi-eeprom.hash > create mode 100644 package/rpi-eeprom/rpi-eeprom.mk Could you please add an entry in the DEVELOPERS file for this new package? > diff --git a/configs/raspberrypi5_defconfig b/configs/raspberrypi5_defconfig > index 8cbd533eee..6d364ad32f 100644 > --- a/configs/raspberrypi5_defconfig > +++ b/configs/raspberrypi5_defconfig > @@ -31,3 +31,4 @@ BR2_PACKAGE_HOST_DOSFSTOOLS=y > BR2_PACKAGE_HOST_GENIMAGE=y > BR2_PACKAGE_HOST_KMOD_XZ=y > BR2_PACKAGE_HOST_MTOOLS=y > +BR2_PACKAGE_HOST_RPI_EEPROM=y I'd prefer to see this done as a separate commit (possibly in the same patch series). However, the bigger question is why is this only done for RPi5, and not the other RaspberryPi? Is there anything that makes this tool RPi5-specific? > diff --git a/package/rpi-eeprom/Config.in b/package/rpi-eeprom/Config.in > new file mode 100644 > index 0000000000..02e1109264 > --- /dev/null > +++ b/package/rpi-eeprom/Config.in > @@ -0,0 +1,9 @@ > +config BR2_PACKAGE_RPI_EEPROM > + bool "rpi-eeprom" > + select BR2_PACKAGE_LIBOPENSSL Why is openssl needed? You don't even depend on it in the .mk file. Also, you should directly select BR2_PACKAGE_LIBOPENSSL. But you should select BR2_PACKAGE_OPENSSL, and then if only openssl is supported (and not libressl), you also need to select BR2_PACKAGE_OPENSSL_FORCE_LIBOPENSSL. openssl is kind of a special beast, as it's a virtual package with two implementations: libopenssl and libressl. > + select BR2_PACKAGE_PYTHON3 > + select BR2_PACKAGE_PYTHON_PYCRYPTODOMEX Are these runtime dependencies? If so: select BR2_PACKAGE_PYTHON3 # runtime select BR2_PACKAGE_PYTHON_PYCRYPTODOMEX # runtime > + help > + Raspberry Pi bootloader tools. A slightly longer help text with more details would make sense, perhaps borrowing some details from your commit log on the use case (here for the target package). > + https://github.com/raspberrypi/rpi-eeprom > diff --git a/package/rpi-eeprom/Config.in.host b/package/rpi-eeprom/Config.in.host > new file mode 100644 > index 0000000000..3d36d7bec8 > --- /dev/null > +++ b/package/rpi-eeprom/Config.in.host > @@ -0,0 +1,9 @@ > +config BR2_PACKAGE_HOST_RPI_EEPROM > + bool "host rpi-eeprom" > + select BR2_PACKAGE_LIBOPENSSL > + select BR2_PACKAGE_PYTHON3 > + select BR2_PACKAGE_PYTHON_PYCRYPTODOMEX These selects don't make sense, as you're selecting target packages... while we're here in the option enabling the host variant of rpi-eeprom. Most likely you don't need any "select" here. > + help > + Raspberry Pi bootloader tools. > + > + https://github.com/raspberrypi/rpi-eeprom > diff --git a/package/rpi-eeprom/rpi-eeprom.hash b/package/rpi-eeprom/rpi-eeprom.hash > new file mode 100644 > index 0000000000..27cd0bfdf3 > --- /dev/null > +++ b/package/rpi-eeprom/rpi-eeprom.hash > @@ -0,0 +1 @@ > +sha256 90970fd9a72c29449a8f4f27577395a1fb418f87b979adeb81d51300f959dab9 rpi-eeprom-fe7bfc720165464d9dfe2f85fe090ca22a625bd7.tar.gz Please add a comment on where this hash comes from. Most likely: # Locally calculated Also, please add a hash for the LICENSE file (see other packages). > diff --git a/package/rpi-eeprom/rpi-eeprom.mk b/package/rpi-eeprom/rpi-eeprom.mk > new file mode 100644 > index 0000000000..db1634315f > --- /dev/null > +++ b/package/rpi-eeprom/rpi-eeprom.mk > @@ -0,0 +1,27 @@ > +################################################################################ > +# > +# rpi-eeprom > +# > +################################################################################ > + > +RPI_EEPROM_VERSION = fe7bfc720165464d9dfe2f85fe090ca22a625bd7 > +RPI_EEPROM_SITE = $(call github,raspberrypi,rpi-eeprom,$(RPI_EEPROM_VERSION)) > +RPI_EEPROM_LICENSE = BSD-3-Clause > +RPI_EEPROM_LICENSE_FILES = LICENSE > + > +HOST_RPI_EEPROM_INSTALL = YES > +RPI_EEPROM_INSTALL = YES Neither of these are needed/have an effect. You will most likely need: HOST_RPI_EEPROM_DEPENDENCIES = host-python3 host-python-pycryptodomex indeed, for the host package, we need the package to be fully functional right after its installation, as other packages depending on it might use it right after. However, for the target package, we only care that everything is on the target once it runs, hence select BR2_PACKAGE_PYTHON3 + select BR2_PACKAGE_PYTHON_PYCRYPTODOMEX in Config.in is sufficient. Could you have a look at adjusting those details and submitting a second iteration of this patch? Once again, thanks a lot! Thomas -- Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering and training https://bootlin.com _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Buildroot] [PATCH 1/1] package/rpi-eeprom: New package for RPi bootloader tools 2024-12-29 23:08 ` Thomas Petazzoni via buildroot @ 2025-01-07 15:54 ` Tim Gover via buildroot 0 siblings, 0 replies; 4+ messages in thread From: Tim Gover via buildroot @ 2025-01-07 15:54 UTC (permalink / raw) To: Thomas Petazzoni; +Cc: Tim Gover via buildroot On Sun, 29 Dec 2024 at 23:08, Thomas Petazzoni <thomas.petazzoni@bootlin.com> wrote: > > Hello Tim, > > Thanks a lot for your submission, and sorry for the delay in getting > back to you! See below some feedback. > > On Mon, 16 Dec 2024 12:58:00 +0000 > Tim Gover via buildroot <buildroot@buildroot.org> wrote: > > > This package adds the host and OS tools for configuring > > the bootloader and building/signing tools for signed boot. > > > > Normally, the host tools would be invoked from a post-build > > script to sign the boot.img file. The device tools would be > > invoked from a custom on-device software update process e.g. > > using rpi-eeprom-digest to verify the signature of a boot.img > > file against a public key retrieved from the EEPROM. > > Thanks for the good explanation of why both a target and host package > are needed. > > > configs/raspberrypi5_defconfig | 1 + > > package/Config.in | 1 + > > package/Config.in.host | 1 + > > package/rpi-eeprom/Config.in | 9 +++++++++ > > package/rpi-eeprom/Config.in.host | 9 +++++++++ > > package/rpi-eeprom/rpi-eeprom.hash | 1 + > > package/rpi-eeprom/rpi-eeprom.mk | 27 +++++++++++++++++++++++++++ > > 7 files changed, 49 insertions(+) > > create mode 100644 package/rpi-eeprom/Config.in > > create mode 100644 package/rpi-eeprom/Config.in.host > > create mode 100644 package/rpi-eeprom/rpi-eeprom.hash > > create mode 100644 package/rpi-eeprom/rpi-eeprom.mk > > Could you please add an entry in the DEVELOPERS file for this new > package? > > > diff --git a/configs/raspberrypi5_defconfig b/configs/raspberrypi5_defconfig > > index 8cbd533eee..6d364ad32f 100644 > > --- a/configs/raspberrypi5_defconfig > > +++ b/configs/raspberrypi5_defconfig > > @@ -31,3 +31,4 @@ BR2_PACKAGE_HOST_DOSFSTOOLS=y > > BR2_PACKAGE_HOST_GENIMAGE=y > > BR2_PACKAGE_HOST_KMOD_XZ=y > > BR2_PACKAGE_HOST_MTOOLS=y > > +BR2_PACKAGE_HOST_RPI_EEPROM=y > > I'd prefer to see this done as a separate commit (possibly in the same > patch series). However, the bigger question is why is this only done > for RPi5, and not the other RaspberryPi? Is there anything that makes > this tool RPi5-specific? The tools are common to the Pi4 and Pi5 family. In retrospect there was no need for the raspberrypi5_defconfig to be changed to enable this by default because right now most systems won't use this. > > > diff --git a/package/rpi-eeprom/Config.in b/package/rpi-eeprom/Config.in > > new file mode 100644 > > index 0000000000..02e1109264 > > --- /dev/null > > +++ b/package/rpi-eeprom/Config.in > > @@ -0,0 +1,9 @@ > > +config BR2_PACKAGE_RPI_EEPROM > > + bool "rpi-eeprom" > > + select BR2_PACKAGE_LIBOPENSSL > > Why is openssl needed? You don't even depend on it in the .mk file. > > Also, you should directly select BR2_PACKAGE_LIBOPENSSL. But you should > select BR2_PACKAGE_OPENSSL, and then if only openssl is supported (and > not libressl), you also need to select > BR2_PACKAGE_OPENSSL_FORCE_LIBOPENSSL. openssl is kind of a special > beast, as it's a virtual package with two implementations: libopenssl > and libressl. > > > + select BR2_PACKAGE_PYTHON3 > > + select BR2_PACKAGE_PYTHON_PYCRYPTODOMEX > > Are these runtime dependencies? If so: > > select BR2_PACKAGE_PYTHON3 # runtime > select BR2_PACKAGE_PYTHON_PYCRYPTODOMEX # runtime > > > + help > > + Raspberry Pi bootloader tools. > > A slightly longer help text with more details would make sense, perhaps > borrowing some details from your commit log on the use case (here for > the target package). > > > + https://github.com/raspberrypi/rpi-eeprom > > diff --git a/package/rpi-eeprom/Config.in.host b/package/rpi-eeprom/Config.in.host > > new file mode 100644 > > index 0000000000..3d36d7bec8 > > --- /dev/null > > +++ b/package/rpi-eeprom/Config.in.host > > @@ -0,0 +1,9 @@ > > +config BR2_PACKAGE_HOST_RPI_EEPROM > > + bool "host rpi-eeprom" > > + select BR2_PACKAGE_LIBOPENSSL > > + select BR2_PACKAGE_PYTHON3 > > + select BR2_PACKAGE_PYTHON_PYCRYPTODOMEX > > These selects don't make sense, as you're selecting target packages... > while we're here in the option enabling the host variant of rpi-eeprom. > Most likely you don't need any "select" here. > > > + help > > + Raspberry Pi bootloader tools. > > + > > + https://github.com/raspberrypi/rpi-eeprom > > diff --git a/package/rpi-eeprom/rpi-eeprom.hash b/package/rpi-eeprom/rpi-eeprom.hash > > new file mode 100644 > > index 0000000000..27cd0bfdf3 > > --- /dev/null > > +++ b/package/rpi-eeprom/rpi-eeprom.hash > > @@ -0,0 +1 @@ > > +sha256 90970fd9a72c29449a8f4f27577395a1fb418f87b979adeb81d51300f959dab9 rpi-eeprom-fe7bfc720165464d9dfe2f85fe090ca22a625bd7.tar.gz > > Please add a comment on where this hash comes from. Most likely: > > # Locally calculated > > Also, please add a hash for the LICENSE file (see other packages). > > > diff --git a/package/rpi-eeprom/rpi-eeprom.mk b/package/rpi-eeprom/rpi-eeprom.mk > > new file mode 100644 > > index 0000000000..db1634315f > > --- /dev/null > > +++ b/package/rpi-eeprom/rpi-eeprom.mk > > @@ -0,0 +1,27 @@ > > +################################################################################ > > +# > > +# rpi-eeprom > > +# > > +################################################################################ > > + > > +RPI_EEPROM_VERSION = fe7bfc720165464d9dfe2f85fe090ca22a625bd7 > > +RPI_EEPROM_SITE = $(call github,raspberrypi,rpi-eeprom,$(RPI_EEPROM_VERSION)) > > +RPI_EEPROM_LICENSE = BSD-3-Clause > > +RPI_EEPROM_LICENSE_FILES = LICENSE > > + > > +HOST_RPI_EEPROM_INSTALL = YES > > +RPI_EEPROM_INSTALL = YES > > Neither of these are needed/have an effect. > > You will most likely need: > > HOST_RPI_EEPROM_DEPENDENCIES = host-python3 host-python-pycryptodomex > > indeed, for the host package, we need the package to be fully > functional right after its installation, as other packages depending on > it might use it right after. > > However, for the target package, we only care that everything is on the > target once it runs, hence select BR2_PACKAGE_PYTHON3 + select > BR2_PACKAGE_PYTHON_PYCRYPTODOMEX in Config.in is sufficient. > > Could you have a look at adjusting those details and submitting a > second iteration of this patch? Thanks for the feedback. I'll endeavor to make those changes as soon as possible. I need to think a bit more about the weak runtime dependencies (optional features) but will probably recommend including real openssl because the rpi-eeprom-digest script launches the openssl binary to verify a signature. _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-01-07 15:54 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2024-12-16 12:57 [Buildroot] [PATCH 0/1] package/rpi-eeprom new package Tim Gover via buildroot 2024-12-16 12:58 ` [Buildroot] [PATCH 1/1] package/rpi-eeprom: New package for RPi bootloader tools Tim Gover via buildroot 2024-12-29 23:08 ` Thomas Petazzoni via buildroot 2025-01-07 15:54 ` Tim Gover via buildroot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox