[isar-cip-core][PATCH v1 0/2] Enable debian forky builds & tests

[isar-cip-core][PATCH v1 0/2] Enable debian forky builds & tests

[Shivanand.Kunijadar]

From: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>

This patch series adds the debian forky based image build & CI test support.

NOTE: The base/security image builds are failing locally due to some dependency
issues in package installation not because of recipe changes.

I request you to create a scheduled pipeline similar to sid and add the
CI variable CI_RUN_UNSTABLE_FORKY with some value. 


Shivanand Kunijadar (2):
  Enable the support of Debian forky based builds
  Enable CI image build and test support for forky

 .gitlab-ci.yml                                | 93 +++++++++++++++++++
 Kconfig                                       |  4 +
 conf/distro/cip-core-forky.conf               | 13 +++
 kas/opt/forky.yml                             | 15 +++
 .../files/forky/PkKek-1-snakeoil.key          | 30 ++++++
 .../files/forky/PkKek-1-snakeoil.pem          | 23 +++++
 .../swupdate-certificates/files/forky         |  1 +
 start-qemu.sh                                 |  2 +
 8 files changed, 181 insertions(+)
 create mode 100644 conf/distro/cip-core-forky.conf
 create mode 100644 kas/opt/forky.yml
 create mode 100644 recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key
 create mode 100644 recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem
 create mode 120000 recipes-devtools/swupdate-certificates/files/forky

-- 
2.39.5

[isar-cip-core][PATCH v1 1/2] Enable the support of Debian forky based builds

[Shivanand.Kunijadar]

From: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>

The .key & .pem files are addded using below .deb package,
https://snapshot.debian.org/file/d32d11a5aacbf5685b81e8176a27a6918e9b55fb/ovmf-generic_2025.11-5_all.deb

Signed-off-by: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
---
 Kconfig                                       |  4 +++
 conf/distro/cip-core-forky.conf               | 13 ++++++++
 kas/opt/forky.yml                             | 15 ++++++++++
 .../files/forky/PkKek-1-snakeoil.key          | 30 +++++++++++++++++++
 .../files/forky/PkKek-1-snakeoil.pem          | 23 ++++++++++++++
 .../swupdate-certificates/files/forky         |  1 +
 start-qemu.sh                                 |  2 ++
 7 files changed, 88 insertions(+)
 create mode 100644 conf/distro/cip-core-forky.conf
 create mode 100644 kas/opt/forky.yml
 create mode 100644 recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key
 create mode 100644 recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem
 create mode 120000 recipes-devtools/swupdate-certificates/files/forky

diff --git a/Kconfig b/Kconfig
index 438234c..14cd677 100644
--- a/Kconfig
+++ b/Kconfig
@@ -241,6 +241,9 @@ config DEBIAN_TRIXIE
 config DEBIAN_SID
 	bool "Sid (Unstable)"
 
+config DEBIAN_FORKY
+	bool "forky (14)"
+
 endchoice
 
 config KAS_INCLUDE_DEBIAN
@@ -250,6 +253,7 @@ config KAS_INCLUDE_DEBIAN
 	default "kas/opt/bookworm.yml" if DEBIAN_BOOKWORM
 	default "kas/opt/trixie.yml" if DEBIAN_TRIXIE
 	default "kas/opt/sid.yml" if DEBIAN_SID
+	default "kas/opt/forky.yml" if DEBIAN_FORKY
 
 comment "Image features"
 
diff --git a/conf/distro/cip-core-forky.conf b/conf/distro/cip-core-forky.conf
new file mode 100644
index 0000000..7a868ce
--- /dev/null
+++ b/conf/distro/cip-core-forky.conf
@@ -0,0 +1,13 @@
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Toshiba Corporation, 2026
+#
+# Authors:
+#  Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
+#
+# SPDX-License-Identifier: MIT
+#
+
+require conf/distro/debian-forky.conf
+require cip-core-common.inc
diff --git a/kas/opt/forky.yml b/kas/opt/forky.yml
new file mode 100644
index 0000000..6c4fcdc
--- /dev/null
+++ b/kas/opt/forky.yml
@@ -0,0 +1,15 @@
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Toshiba Corporation, 2026
+#
+# Authors:
+#  Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
+#
+# SPDX-License-Identifier: MIT
+#
+
+header:
+  version: 14
+
+distro: cip-core-forky
diff --git a/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key
new file mode 100644
index 0000000..dd7f492
--- /dev/null
+++ b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key
@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIs4RXCLmGLJgCAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECHer6014IEhGBIIEyO8O2zL8CJwV
+auQpWLJsMMWxu2aSh1WadX9+rg+O61mukuS4rQSH5shMQ2krZZKzyXx0q8+2AySD
+EtDXwhLvep60gUxOoNqK1+l3AxSFfIGOY8NC6yW67VX+G09ajWpgHj3ox63VRW8v
+6mA8TFWYbOIwB8J7ScF4NszVwyiUnW13oKi7svoBM3LYYG2IMvre+gOvyMGfM8uv
+X3txcYqAjhRV6n7vGo9LRLIIRSPKzaJbm/W7nT38LRUJP8JMSQUOPKgeEwQvOTVZ
++1kd7WeaGZrjagTDM4yhBjpOmB3D8aeT6xkjBlUwuddPzbdi0N7GrU520RcJMjxt
+JMyOgabHKUKmPTX4m0ZCKi2jSILi7/6fBF+TZDxpakLwAwpTzm6kXArXb6AYtTEX
+GPihB4O69ZgEc90jp3EnZt7HtKZn1HTbPNQAlWgvESgJ7hWHnTlM5Obqnyb78tj5
+VdcOfTSQRYmw4Rh/lSUX0vQLhdmYSVLiMFFvT4IepXZgQ6McIdcvqoVrPgr0HoVz
+5YILZdmbs80VcgYL853lMfQ84kRwUcw8jNyz7mBK7V7rE5QhaF5lunZ/R41ZRXRy
+1ys1rNvLPvtOq/K51+A9U+h5lLM9LjeoOR+IUk2Vg4aIap+Z+lxbImH0gcJTrpem
+ctA/2sBjLN7w811EjB/Tlu2awzbsKLpIDFVGHiGBI2zb41gtPd2RkijmiZab6nuM
+ETg4ad3GscMoa++01oX/lrnVe386ECSjurmThb7I01eTNZrBlNsLyBeFzlEIEoBR
+TqUXHLiDACxzL6U4vWzdnvVrCOW9fwvJJqChj7Wy822w2LXxVhOryNujBmZCmOht
+mgDaJ15QiF+DACcX6VoBbm/462z+9Skxa0DqGwGzMOD5HldwvQSyZSykk/BzGFWP
+rXfLYoMjN+dgA/yNfem64ayGsmoPUAjnsE4YasD58UVO0XwwtdMGJSOVmkdyWMcM
+t+lN74kX/gmIvciK06N6prBfowgBEIJ6ev2dzlydSN8rGORmQ+OFzjP14rT0O+1Q
+O48yR2ZZ9jl4YPUKSFJ3EUc/Qt9vO+chNiNYSy6TABGXur0WWiDvGURG9K5fWTqq
+U2KydSRoYD5iF0caOgMZecNhZV+4CX927j3XuuKKx49qTAt3WMtmJ/UQFHMtQ833
+XDFWHpEKDImfHfyiB1f8bOmqYmPuE6Shup0UMJsMFel4QVJM0Jn9+wHw/0qqPiS3
+a769S/u9U2dfyZY5PfymY8UjFRMDtLaUoJSRaGp6RNc6LynuMMKdzho0GwvL3+m9
+xKLDbbks8hVdmtcxxDKiio+F0hp3yc/2PyA/VGAlARiGp7876WTCZox9Bwnf6lkS
+k9eYLSabe/r3Ag1SbWEGpFk3VO37qCyfp2xTfrHXK1ZJlvFwj3FFSprUaMrV+81K
+FCEcSozXpVsQ7e7d11A7S8rTbtp09Q/J2oxyR0A9lk/ia5Qd/xwbPl4QJcWK2Jar
+K3yFK8VrUNib7CjI1kdB479KIllD8oK6druBkzwGzFxDtcl47RlfkqW96XSQT7x/
+h/YKSLcpMx9x9TJd2GDKj2t4oE9eGTBC0YbdH+HJNSrjEsWkjgY6Uw++S6VzKvQZ
+DDsMJfxwcChc2zKRou+BFA==
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem
new file mode 100644
index 0000000..7cd2487
--- /dev/null
+++ b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIID1zCCAr+gAwIBAgIUDMG7xGGEPj+ABvbflim0PNb/loowDQYJKoZIhvcNAQEL
+BQAwejELMAkGA1UEBhMCVVMxETAPBgNVBAgMCENvbG9yYWRvMRUwEwYDVQQHDAxG
+b3J0IENvbGxpbnMxETAPBgNVBAoMCFNuYWtlT2lsMS4wLAYDVQQDDCVTbmFrZU9p
+bCBUZXN0IEtleSBmb3IgRUZJIFNlY3VyZSBCb290MCAXDTIzMDUxOTIzMTE0NVoY
+DzIwNTMwNTE3MjMxMTQ1WjB6MQswCQYDVQQGEwJVUzERMA8GA1UECAwIQ29sb3Jh
+ZG8xFTATBgNVBAcMDEZvcnQgQ29sbGluczERMA8GA1UECgwIU25ha2VPaWwxLjAs
+BgNVBAMMJVNuYWtlT2lsIFRlc3QgS2V5IGZvciBFRkkgU2VjdXJlIEJvb3QwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIi65d6LmojD5S9q8vE/LI2HHQ
+boiO5/1KrFVc6kpxD6XdkJwpBoItYIfSls9CPnzvNWOAxR3hIeBd1U/prAPPxvQ1
+wuDLMXfWkcGaYHfPnme/YluAjnpuLH1MQcumgOzj5xYBvZZk+RbytX/phH7FW4Tx
++L1oBYnsfh3BSE/NTtEEHV1nXAXpa/dvyefWMlrlbwjfM5362lZzM6yrJGcOcWEy
+I66UYCIVO2Yhe/ZVF5B/tPGtd2oACz11xLeqLPM1WBjlekAG2Zi7UCPIvDCpdn5u
+Vna2ZRQmJyDDdh0Ja2VMC19dkMd/5nOAI21O+FvYPOkBWYX8f4DzDyVQlmIFAgMB
+AAGjUzBRMB0GA1UdDgQWBBRjuNXuXfh7mi8I3eTboeYGyFTa2zAfBgNVHSMEGDAW
+gBRjuNXuXfh7mi8I3eTboeYGyFTa2zAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
+DQEBCwUAA4IBAQBBxlfo6MxBN44mXBIhE/QUbJZ+bo/Vrqv2DIZqOlV5+Sk6KnK8
+X9Rz2IJwoqLjB6cW9yInk5P/QS45880K1fDT/lu5/2U64i3l1ZFK75qLDCn4/khF
+birV2U6LBZpxLe3UvXk3xZMoUPzvT2rhrsf78G0pSmAnP8li8Co8F6hTjQzB8IgC
+DpYVATCoWBH6GhudtjUp+CJSyGApdL+HKX6i6oD7vutvWYBf0Hx5r1NrqIv31Y4V
+bhwvK5zajFamj/VYeVy7/roqD06hNF1ImhsuBOqoJlKu+cHMGN9DOJqjGup1T9aI
+2dpEOK5vbKXFrox/yCLgXmUkdwZ3BK4lcxCq
+-----END CERTIFICATE-----
diff --git a/recipes-devtools/swupdate-certificates/files/forky b/recipes-devtools/swupdate-certificates/files/forky
new file mode 120000
index 0000000..2719d00
--- /dev/null
+++ b/recipes-devtools/swupdate-certificates/files/forky
@@ -0,0 +1 @@
+../../secure-boot-secrets/files/forky
\ No newline at end of file
diff --git a/start-qemu.sh b/start-qemu.sh
index d12fa23..0b783d6 100755
--- a/start-qemu.sh
+++ b/start-qemu.sh
@@ -47,6 +47,8 @@ if [ -z "${DISTRO_RELEASE}" ]; then
 		DISTRO_RELEASE="trixie"
 	elif grep -s -q "DEBIAN_SID: true" .config.yaml; then
 		DISTRO_RELEASE="sid"
+	elif grep -s -q "DEBIAN_FORKY: true" .config.yaml; then
+		DISTRO_RELEASE="forky"
 	else
 		echo "No supported Debian release configured"
 		exit 1
-- 
2.39.5

[isar-cip-core][PATCH v1 2/2] Enable CI image build and test support for forky

[Shivanand.Kunijadar]

From: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>

Keep these jobs as scheduled and can be scheduled to run every week
just to monitor and fix if there are any issues.
Also set allow_failure:true for these jobs as forky is not officially
released and there will always be some build & test issues.

Signed-off-by: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
---
 .gitlab-ci.yml | 93 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 93 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b53def4..977ae01 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -64,6 +64,7 @@ default:
     - if [ "${release}" = "bookworm" ]; then base_yaml="${base_yaml}:kas/opt/bookworm.yml"; fi
     - if [ "${release}" = "trixie" ]; then base_yaml="${base_yaml}:kas/opt/trixie.yml"; fi
     - if [ "${release}" = "sid" ]; then base_yaml="${base_yaml}:kas/opt/sid.yml"; fi
+    - if [ "${release}" = "forky" ]; then base_yaml="${base_yaml}:kas/opt/forky.yml"; fi
     - if [ "${encrypt}" = "enable" ]; then base_yaml="${base_yaml}:kas/opt/encrypt-data.yml"; fi
     - if [ "${factory_reset}" = "enable" ]; then base_yaml="${base_yaml}:kas/opt/factory-reset.yml"; fi
     - if [ "${watchdog}" = "disable" ]; then base_yaml="${base_yaml}:kas/opt/disable-watchdog.yml"; fi
@@ -399,6 +400,57 @@ build:qemu-arm-base-sid:
     separate_home_partition: enable
     deploy: enable
 
+# forky image builds
+.build_base_forky:
+  extends:
+    - .build_base
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: never
+    - if: '$CI_PIPELINE_SOURCE == "schedule" && $CI_RUN_UNSTABLE_FORKY'
+    - if: $CI_COMMIT_BRANCH != "master"
+      when: never
+  allow_failure: true
+
+build:qemu-amd64-base-forky:
+  extends:
+    - .build_base_forky
+  variables:
+    target: qemu-amd64
+    use_rt: disable
+    release: forky
+    extension: security
+    security_test: enable
+    build_updates: enable
+    separate_home_partition: enable
+    deploy: enable
+
+build:qemu-arm64-base-forky:
+  extends:
+    - .build_base_forky
+  variables:
+    target: qemu-arm64
+    use_rt: disable
+    release: forky
+    extension: security
+    security_test: enable
+    build_updates: enable
+    separate_home_partition: enable
+    deploy: enable
+
+build:qemu-arm-base-forky:
+  extends:
+    - .build_base_forky
+  variables:
+    target: qemu-arm
+    extension: security
+    security_test: enable
+    use_rt: disable
+    release: forky
+    build_updates: enable
+    separate_home_partition: enable
+    deploy: enable
+
 .test-cip-core:
   stage: test
   image: $CI_REGISTRY_IMAGE/lavacli
@@ -764,6 +816,47 @@ test:qemu-arm-IEC-sid:
     test_function: IEC
     iec_test_timeout: 40
 
+# Tests for forky images
+.test-cip-core-forky:
+  extends:
+    - .test-cip-core
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: never
+    - if: '$CI_PIPELINE_SOURCE == "schedule" && $CI_RUN_UNSTABLE_FORKY'
+    - if: $CI_COMMIT_BRANCH != "master"
+      when: never
+  allow_failure: true
+
+test:qemu-amd64-IEC-forky:
+  extends:
+   - .test-cip-core-forky
+  variables:
+    target: qemu-amd64
+    release: forky
+    test_function: IEC
+    iec_test_timeout: 40
+
+test:qemu-arm64-IEC-forky:
+  extends:
+   - .test-cip-core-forky
+  needs: ["build:qemu-arm64-base-forky"]
+  variables:
+    target: qemu-arm64
+    release: forky
+    test_function: IEC
+    iec_test_timeout: 40
+
+test:qemu-arm-IEC-forky:
+  extends:
+   - .test-cip-core-forky
+  needs: ["build:qemu-arm-base-forky"]
+  variables:
+    target: qemu-arm
+    release: forky
+    test_function: IEC
+    iec_test_timeout: 40
+
 cve-checks:
   stage: cve-check
   needs: []
-- 
2.39.5

Re: [isar-cip-core][PATCH v1 1/2] Enable the support of Debian forky based builds

[Jan Kiszka]

On 27.07.26 16:11, Shivanand.Kunijadar@toshiba-tsip.com wrote:
> From: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
> 
> The .key & .pem files are addded using below .deb package,
> https://snapshot.debian.org/file/d32d11a5aacbf5685b81e8176a27a6918e9b55fb/ovmf-generic_2025.11-5_all.deb
> 
> Signed-off-by: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
> ---
>  Kconfig                                       |  4 +++
>  conf/distro/cip-core-forky.conf               | 13 ++++++++
>  kas/opt/forky.yml                             | 15 ++++++++++
>  .../files/forky/PkKek-1-snakeoil.key          | 30 +++++++++++++++++++
>  .../files/forky/PkKek-1-snakeoil.pem          | 23 ++++++++++++++

So, current sid uses different keys that forky? Is that always the case?

>  .../swupdate-certificates/files/forky         |  1 +
>  start-qemu.sh                                 |  2 ++
>  7 files changed, 88 insertions(+)
>  create mode 100644 conf/distro/cip-core-forky.conf
>  create mode 100644 kas/opt/forky.yml
>  create mode 100644 recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key
>  create mode 100644 recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem
>  create mode 120000 recipes-devtools/swupdate-certificates/files/forky
> 
> diff --git a/Kconfig b/Kconfig
> index 438234c..14cd677 100644
> --- a/Kconfig
> +++ b/Kconfig
> @@ -241,6 +241,9 @@ config DEBIAN_TRIXIE
>  config DEBIAN_SID
>  	bool "Sid (Unstable)"
>  
> +config DEBIAN_FORKY
> +	bool "forky (14)"
> +

Let's sort forky before sid.

>  endchoice
>  
>  config KAS_INCLUDE_DEBIAN
> @@ -250,6 +253,7 @@ config KAS_INCLUDE_DEBIAN
>  	default "kas/opt/bookworm.yml" if DEBIAN_BOOKWORM
>  	default "kas/opt/trixie.yml" if DEBIAN_TRIXIE
>  	default "kas/opt/sid.yml" if DEBIAN_SID
> +	default "kas/opt/forky.yml" if DEBIAN_FORKY
>  

Here as well.

>  comment "Image features"
>  
> diff --git a/conf/distro/cip-core-forky.conf b/conf/distro/cip-core-forky.conf
> new file mode 100644
> index 0000000..7a868ce
> --- /dev/null
> +++ b/conf/distro/cip-core-forky.conf
> @@ -0,0 +1,13 @@
> +#
> +# CIP Core, generic profile
> +#
> +# Copyright (c) Toshiba Corporation, 2026
> +#
> +# Authors:
> +#  Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
> +#
> +# SPDX-License-Identifier: MIT
> +#
> +
> +require conf/distro/debian-forky.conf
> +require cip-core-common.inc
> diff --git a/kas/opt/forky.yml b/kas/opt/forky.yml
> new file mode 100644
> index 0000000..6c4fcdc
> --- /dev/null
> +++ b/kas/opt/forky.yml
> @@ -0,0 +1,15 @@
> +#
> +# CIP Core, generic profile
> +#
> +# Copyright (c) Toshiba Corporation, 2026
> +#
> +# Authors:
> +#  Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
> +#
> +# SPDX-License-Identifier: MIT
> +#
> +
> +header:
> +  version: 14
> +
> +distro: cip-core-forky
> diff --git a/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key
> new file mode 100644
> index 0000000..dd7f492
> --- /dev/null
> +++ b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key
> @@ -0,0 +1,30 @@
> +-----BEGIN ENCRYPTED PRIVATE KEY-----
> +MIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIs4RXCLmGLJgCAggA
> +MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECHer6014IEhGBIIEyO8O2zL8CJwV
> +auQpWLJsMMWxu2aSh1WadX9+rg+O61mukuS4rQSH5shMQ2krZZKzyXx0q8+2AySD
> +EtDXwhLvep60gUxOoNqK1+l3AxSFfIGOY8NC6yW67VX+G09ajWpgHj3ox63VRW8v
> +6mA8TFWYbOIwB8J7ScF4NszVwyiUnW13oKi7svoBM3LYYG2IMvre+gOvyMGfM8uv
> +X3txcYqAjhRV6n7vGo9LRLIIRSPKzaJbm/W7nT38LRUJP8JMSQUOPKgeEwQvOTVZ
> ++1kd7WeaGZrjagTDM4yhBjpOmB3D8aeT6xkjBlUwuddPzbdi0N7GrU520RcJMjxt
> +JMyOgabHKUKmPTX4m0ZCKi2jSILi7/6fBF+TZDxpakLwAwpTzm6kXArXb6AYtTEX
> +GPihB4O69ZgEc90jp3EnZt7HtKZn1HTbPNQAlWgvESgJ7hWHnTlM5Obqnyb78tj5
> +VdcOfTSQRYmw4Rh/lSUX0vQLhdmYSVLiMFFvT4IepXZgQ6McIdcvqoVrPgr0HoVz
> +5YILZdmbs80VcgYL853lMfQ84kRwUcw8jNyz7mBK7V7rE5QhaF5lunZ/R41ZRXRy
> +1ys1rNvLPvtOq/K51+A9U+h5lLM9LjeoOR+IUk2Vg4aIap+Z+lxbImH0gcJTrpem
> +ctA/2sBjLN7w811EjB/Tlu2awzbsKLpIDFVGHiGBI2zb41gtPd2RkijmiZab6nuM
> +ETg4ad3GscMoa++01oX/lrnVe386ECSjurmThb7I01eTNZrBlNsLyBeFzlEIEoBR
> +TqUXHLiDACxzL6U4vWzdnvVrCOW9fwvJJqChj7Wy822w2LXxVhOryNujBmZCmOht
> +mgDaJ15QiF+DACcX6VoBbm/462z+9Skxa0DqGwGzMOD5HldwvQSyZSykk/BzGFWP
> +rXfLYoMjN+dgA/yNfem64ayGsmoPUAjnsE4YasD58UVO0XwwtdMGJSOVmkdyWMcM
> +t+lN74kX/gmIvciK06N6prBfowgBEIJ6ev2dzlydSN8rGORmQ+OFzjP14rT0O+1Q
> +O48yR2ZZ9jl4YPUKSFJ3EUc/Qt9vO+chNiNYSy6TABGXur0WWiDvGURG9K5fWTqq
> +U2KydSRoYD5iF0caOgMZecNhZV+4CX927j3XuuKKx49qTAt3WMtmJ/UQFHMtQ833
> +XDFWHpEKDImfHfyiB1f8bOmqYmPuE6Shup0UMJsMFel4QVJM0Jn9+wHw/0qqPiS3
> +a769S/u9U2dfyZY5PfymY8UjFRMDtLaUoJSRaGp6RNc6LynuMMKdzho0GwvL3+m9
> +xKLDbbks8hVdmtcxxDKiio+F0hp3yc/2PyA/VGAlARiGp7876WTCZox9Bwnf6lkS
> +k9eYLSabe/r3Ag1SbWEGpFk3VO37qCyfp2xTfrHXK1ZJlvFwj3FFSprUaMrV+81K
> +FCEcSozXpVsQ7e7d11A7S8rTbtp09Q/J2oxyR0A9lk/ia5Qd/xwbPl4QJcWK2Jar
> +K3yFK8VrUNib7CjI1kdB479KIllD8oK6druBkzwGzFxDtcl47RlfkqW96XSQT7x/
> +h/YKSLcpMx9x9TJd2GDKj2t4oE9eGTBC0YbdH+HJNSrjEsWkjgY6Uw++S6VzKvQZ
> +DDsMJfxwcChc2zKRou+BFA==
> +-----END ENCRYPTED PRIVATE KEY-----
> diff --git a/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem
> new file mode 100644
> index 0000000..7cd2487
> --- /dev/null
> +++ b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem
> @@ -0,0 +1,23 @@
> +-----BEGIN CERTIFICATE-----
> +MIID1zCCAr+gAwIBAgIUDMG7xGGEPj+ABvbflim0PNb/loowDQYJKoZIhvcNAQEL
> +BQAwejELMAkGA1UEBhMCVVMxETAPBgNVBAgMCENvbG9yYWRvMRUwEwYDVQQHDAxG
> +b3J0IENvbGxpbnMxETAPBgNVBAoMCFNuYWtlT2lsMS4wLAYDVQQDDCVTbmFrZU9p
> +bCBUZXN0IEtleSBmb3IgRUZJIFNlY3VyZSBCb290MCAXDTIzMDUxOTIzMTE0NVoY
> +DzIwNTMwNTE3MjMxMTQ1WjB6MQswCQYDVQQGEwJVUzERMA8GA1UECAwIQ29sb3Jh
> +ZG8xFTATBgNVBAcMDEZvcnQgQ29sbGluczERMA8GA1UECgwIU25ha2VPaWwxLjAs
> +BgNVBAMMJVNuYWtlT2lsIFRlc3QgS2V5IGZvciBFRkkgU2VjdXJlIEJvb3QwggEi
> +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIi65d6LmojD5S9q8vE/LI2HHQ
> +boiO5/1KrFVc6kpxD6XdkJwpBoItYIfSls9CPnzvNWOAxR3hIeBd1U/prAPPxvQ1
> +wuDLMXfWkcGaYHfPnme/YluAjnpuLH1MQcumgOzj5xYBvZZk+RbytX/phH7FW4Tx
> ++L1oBYnsfh3BSE/NTtEEHV1nXAXpa/dvyefWMlrlbwjfM5362lZzM6yrJGcOcWEy
> +I66UYCIVO2Yhe/ZVF5B/tPGtd2oACz11xLeqLPM1WBjlekAG2Zi7UCPIvDCpdn5u
> +Vna2ZRQmJyDDdh0Ja2VMC19dkMd/5nOAI21O+FvYPOkBWYX8f4DzDyVQlmIFAgMB
> +AAGjUzBRMB0GA1UdDgQWBBRjuNXuXfh7mi8I3eTboeYGyFTa2zAfBgNVHSMEGDAW
> +gBRjuNXuXfh7mi8I3eTboeYGyFTa2zAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
> +DQEBCwUAA4IBAQBBxlfo6MxBN44mXBIhE/QUbJZ+bo/Vrqv2DIZqOlV5+Sk6KnK8
> +X9Rz2IJwoqLjB6cW9yInk5P/QS45880K1fDT/lu5/2U64i3l1ZFK75qLDCn4/khF
> +birV2U6LBZpxLe3UvXk3xZMoUPzvT2rhrsf78G0pSmAnP8li8Co8F6hTjQzB8IgC
> +DpYVATCoWBH6GhudtjUp+CJSyGApdL+HKX6i6oD7vutvWYBf0Hx5r1NrqIv31Y4V
> +bhwvK5zajFamj/VYeVy7/roqD06hNF1ImhsuBOqoJlKu+cHMGN9DOJqjGup1T9aI
> +2dpEOK5vbKXFrox/yCLgXmUkdwZ3BK4lcxCq
> +-----END CERTIFICATE-----
> diff --git a/recipes-devtools/swupdate-certificates/files/forky b/recipes-devtools/swupdate-certificates/files/forky
> new file mode 120000
> index 0000000..2719d00
> --- /dev/null
> +++ b/recipes-devtools/swupdate-certificates/files/forky
> @@ -0,0 +1 @@
> +../../secure-boot-secrets/files/forky
> \ No newline at end of file
> diff --git a/start-qemu.sh b/start-qemu.sh
> index d12fa23..0b783d6 100755
> --- a/start-qemu.sh
> +++ b/start-qemu.sh
> @@ -47,6 +47,8 @@ if [ -z "${DISTRO_RELEASE}" ]; then
>  		DISTRO_RELEASE="trixie"
>  	elif grep -s -q "DEBIAN_SID: true" .config.yaml; then
>  		DISTRO_RELEASE="sid"
> +	elif grep -s -q "DEBIAN_FORKY: true" .config.yaml; then
> +		DISTRO_RELEASE="forky"

..and here.

>  	else
>  		echo "No supported Debian release configured"
>  		exit 1

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

Re: [isar-cip-core][PATCH v1 2/2] Enable CI image build and test support for forky

[Jan Kiszka]

On 27.07.26 16:11, Shivanand.Kunijadar@toshiba-tsip.com wrote:
> From: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
> 
> Keep these jobs as scheduled and can be scheduled to run every week
> just to monitor and fix if there are any issues.
> Also set allow_failure:true for these jobs as forky is not officially
> released and there will always be some build & test issues.
> 
> Signed-off-by: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
> ---
>  .gitlab-ci.yml | 93 ++++++++++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 93 insertions(+)
> 
> diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
> index b53def4..977ae01 100644
> --- a/.gitlab-ci.yml
> +++ b/.gitlab-ci.yml
> @@ -64,6 +64,7 @@ default:
>      - if [ "${release}" = "bookworm" ]; then base_yaml="${base_yaml}:kas/opt/bookworm.yml"; fi
>      - if [ "${release}" = "trixie" ]; then base_yaml="${base_yaml}:kas/opt/trixie.yml"; fi
>      - if [ "${release}" = "sid" ]; then base_yaml="${base_yaml}:kas/opt/sid.yml"; fi
> +    - if [ "${release}" = "forky" ]; then base_yaml="${base_yaml}:kas/opt/forky.yml"; fi

ordering

>      - if [ "${encrypt}" = "enable" ]; then base_yaml="${base_yaml}:kas/opt/encrypt-data.yml"; fi
>      - if [ "${factory_reset}" = "enable" ]; then base_yaml="${base_yaml}:kas/opt/factory-reset.yml"; fi
>      - if [ "${watchdog}" = "disable" ]; then base_yaml="${base_yaml}:kas/opt/disable-watchdog.yml"; fi
> @@ -399,6 +400,57 @@ build:qemu-arm-base-sid:
>      separate_home_partition: enable
>      deploy: enable
>  
> +# forky image builds
> +.build_base_forky:
> +  extends:
> +    - .build_base
> +  rules:
> +    - if: $CI_COMMIT_TAG
> +      when: never
> +    - if: '$CI_PIPELINE_SOURCE == "schedule" && $CI_RUN_UNSTABLE_FORKY'

We should handle forky and sid identical for now, thus should likely use
generic CI_RUN_UNSTABLE for both. Forky can then be moved out of this
mode somewhere next year and become another regular test target in the
pipeline, sid will always remain there.

> +    - if: $CI_COMMIT_BRANCH != "master"
> +      when: never
> +  allow_failure: true
> +
> +build:qemu-amd64-base-forky:
> +  extends:
> +    - .build_base_forky
> +  variables:
> +    target: qemu-amd64
> +    use_rt: disable
> +    release: forky
> +    extension: security
> +    security_test: enable
> +    build_updates: enable
> +    separate_home_partition: enable
> +    deploy: enable
> +
> +build:qemu-arm64-base-forky:
> +  extends:
> +    - .build_base_forky
> +  variables:
> +    target: qemu-arm64
> +    use_rt: disable
> +    release: forky
> +    extension: security
> +    security_test: enable
> +    build_updates: enable
> +    separate_home_partition: enable
> +    deploy: enable
> +
> +build:qemu-arm-base-forky:
> +  extends:
> +    - .build_base_forky
> +  variables:
> +    target: qemu-arm
> +    extension: security
> +    security_test: enable
> +    use_rt: disable
> +    release: forky
> +    build_updates: enable
> +    separate_home_partition: enable
> +    deploy: enable
> +
>  .test-cip-core:
>    stage: test
>    image: $CI_REGISTRY_IMAGE/lavacli
> @@ -764,6 +816,47 @@ test:qemu-arm-IEC-sid:
>      test_function: IEC
>      iec_test_timeout: 40
>  
> +# Tests for forky images
> +.test-cip-core-forky:
> +  extends:
> +    - .test-cip-core
> +  rules:
> +    - if: $CI_COMMIT_TAG
> +      when: never
> +    - if: '$CI_PIPELINE_SOURCE == "schedule" && $CI_RUN_UNSTABLE_FORKY'
> +    - if: $CI_COMMIT_BRANCH != "master"
> +      when: never
> +  allow_failure: true
> +
> +test:qemu-amd64-IEC-forky:
> +  extends:
> +   - .test-cip-core-forky
> +  variables:
> +    target: qemu-amd64
> +    release: forky
> +    test_function: IEC
> +    iec_test_timeout: 40
> +
> +test:qemu-arm64-IEC-forky:
> +  extends:
> +   - .test-cip-core-forky
> +  needs: ["build:qemu-arm64-base-forky"]
> +  variables:
> +    target: qemu-arm64
> +    release: forky
> +    test_function: IEC
> +    iec_test_timeout: 40
> +
> +test:qemu-arm-IEC-forky:
> +  extends:
> +   - .test-cip-core-forky
> +  needs: ["build:qemu-arm-base-forky"]
> +  variables:
> +    target: qemu-arm
> +    release: forky
> +    test_function: IEC
> +    iec_test_timeout: 40
> +
>  cve-checks:
>    stage: cve-check
>    needs: []

I'm still wondering what the added value of testing sid for us is. I
would rather consider to invest our CI time into running more tests with
forky, like some more SWUpdate checks and/or reproducibility.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

Re: [isar-cip-core][PATCH v1 1/2] Enable the support of Debian forky based builds

[Kunijadar Shivanand]

[-- Attachment #1: Type: text/plain, Size: 8250 bytes --]

On Mon, Jul 27, 2026 at 10:05 AM, Jan Kiszka wrote:

> 
> On 27.07.26 16:11, Shivanand.Kunijadar@toshiba-tsip.com wrote:
> 
>> From: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
>> 
>> The .key & .pem files are addded using below .deb package,
>> https://snapshot.debian.org/file/d32d11a5aacbf5685b81e8176a27a6918e9b55fb/ovmf-generic_2025.11-5_all.deb
>> 
>> 
>> Signed-off-by: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
>> ---
>> Kconfig | 4 +++
>> conf/distro/cip-core-forky.conf | 13 ++++++++
>> kas/opt/forky.yml | 15 ++++++++++
>> .../files/forky/PkKek-1-snakeoil.key | 30 +++++++++++++++++++
>> .../files/forky/PkKek-1-snakeoil.pem | 23 ++++++++++++++
> 
> So, current sid uses different keys that forky? Is that always the case?

The ovmf package version in both forky & sid are same now[1], so the keys should be same.
I'll send a separate patch to create symlink to forky for sid keys. please note the sid keys were added long back and pointing to trixie.

[1] https://packages.debian.org/sid/ovmf-generic

> 
> 
>> .../swupdate-certificates/files/forky | 1 +
>> start-qemu.sh | 2 ++
>> 7 files changed, 88 insertions(+)
>> create mode 100644 conf/distro/cip-core-forky.conf
>> create mode 100644 kas/opt/forky.yml
>> create mode 100644
>> recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key
>> create mode 100644
>> recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem
>> create mode 120000 recipes-devtools/swupdate-certificates/files/forky
>> 
>> diff --git a/Kconfig b/Kconfig
>> index 438234c..14cd677 100644
>> --- a/Kconfig
>> +++ b/Kconfig
>> @@ -241,6 +241,9 @@ config DEBIAN_TRIXIE
>> config DEBIAN_SID
>> bool "Sid (Unstable)"
>> 
>> +config DEBIAN_FORKY
>> + bool "forky (14)"
>> +
> 
> Let's sort forky before sid.

Ok, sure.

> 
> 
>> endchoice
>> 
>> config KAS_INCLUDE_DEBIAN
>> @@ -250,6 +253,7 @@ config KAS_INCLUDE_DEBIAN
>> default "kas/opt/bookworm.yml" if DEBIAN_BOOKWORM
>> default "kas/opt/trixie.yml" if DEBIAN_TRIXIE
>> default "kas/opt/sid.yml" if DEBIAN_SID
>> + default "kas/opt/forky.yml" if DEBIAN_FORKY
> 
> Here as well.

Ok.

> 
> 
>> comment "Image features"
>> 
>> diff --git a/conf/distro/cip-core-forky.conf
>> b/conf/distro/cip-core-forky.conf
>> new file mode 100644
>> index 0000000..7a868ce
>> --- /dev/null
>> +++ b/conf/distro/cip-core-forky.conf
>> @@ -0,0 +1,13 @@
>> +#
>> +# CIP Core, generic profile
>> +#
>> +# Copyright (c) Toshiba Corporation, 2026
>> +#
>> +# Authors:
>> +# Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
>> +#
>> +# SPDX-License-Identifier: MIT
>> +#
>> +
>> +require conf/distro/debian-forky.conf
>> +require cip-core-common.inc
>> diff --git a/kas/opt/forky.yml b/kas/opt/forky.yml
>> new file mode 100644
>> index 0000000..6c4fcdc
>> --- /dev/null
>> +++ b/kas/opt/forky.yml
>> @@ -0,0 +1,15 @@
>> +#
>> +# CIP Core, generic profile
>> +#
>> +# Copyright (c) Toshiba Corporation, 2026
>> +#
>> +# Authors:
>> +# Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
>> +#
>> +# SPDX-License-Identifier: MIT
>> +#
>> +
>> +header:
>> + version: 14
>> +
>> +distro: cip-core-forky
>> diff --git
>> a/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key
>> b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key
>> new file mode 100644
>> index 0000000..dd7f492
>> --- /dev/null
>> +++
>> b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key
>> @@ -0,0 +1,30 @@
>> +-----BEGIN ENCRYPTED PRIVATE KEY-----
>> +MIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIs4RXCLmGLJgCAggA
>> +MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECHer6014IEhGBIIEyO8O2zL8CJwV
>> +auQpWLJsMMWxu2aSh1WadX9+rg+O61mukuS4rQSH5shMQ2krZZKzyXx0q8+2AySD
>> +EtDXwhLvep60gUxOoNqK1+l3AxSFfIGOY8NC6yW67VX+G09ajWpgHj3ox63VRW8v
>> +6mA8TFWYbOIwB8J7ScF4NszVwyiUnW13oKi7svoBM3LYYG2IMvre+gOvyMGfM8uv
>> +X3txcYqAjhRV6n7vGo9LRLIIRSPKzaJbm/W7nT38LRUJP8JMSQUOPKgeEwQvOTVZ
>> ++1kd7WeaGZrjagTDM4yhBjpOmB3D8aeT6xkjBlUwuddPzbdi0N7GrU520RcJMjxt
>> +JMyOgabHKUKmPTX4m0ZCKi2jSILi7/6fBF+TZDxpakLwAwpTzm6kXArXb6AYtTEX
>> +GPihB4O69ZgEc90jp3EnZt7HtKZn1HTbPNQAlWgvESgJ7hWHnTlM5Obqnyb78tj5
>> +VdcOfTSQRYmw4Rh/lSUX0vQLhdmYSVLiMFFvT4IepXZgQ6McIdcvqoVrPgr0HoVz
>> +5YILZdmbs80VcgYL853lMfQ84kRwUcw8jNyz7mBK7V7rE5QhaF5lunZ/R41ZRXRy
>> +1ys1rNvLPvtOq/K51+A9U+h5lLM9LjeoOR+IUk2Vg4aIap+Z+lxbImH0gcJTrpem
>> +ctA/2sBjLN7w811EjB/Tlu2awzbsKLpIDFVGHiGBI2zb41gtPd2RkijmiZab6nuM
>> +ETg4ad3GscMoa++01oX/lrnVe386ECSjurmThb7I01eTNZrBlNsLyBeFzlEIEoBR
>> +TqUXHLiDACxzL6U4vWzdnvVrCOW9fwvJJqChj7Wy822w2LXxVhOryNujBmZCmOht
>> +mgDaJ15QiF+DACcX6VoBbm/462z+9Skxa0DqGwGzMOD5HldwvQSyZSykk/BzGFWP
>> +rXfLYoMjN+dgA/yNfem64ayGsmoPUAjnsE4YasD58UVO0XwwtdMGJSOVmkdyWMcM
>> +t+lN74kX/gmIvciK06N6prBfowgBEIJ6ev2dzlydSN8rGORmQ+OFzjP14rT0O+1Q
>> +O48yR2ZZ9jl4YPUKSFJ3EUc/Qt9vO+chNiNYSy6TABGXur0WWiDvGURG9K5fWTqq
>> +U2KydSRoYD5iF0caOgMZecNhZV+4CX927j3XuuKKx49qTAt3WMtmJ/UQFHMtQ833
>> +XDFWHpEKDImfHfyiB1f8bOmqYmPuE6Shup0UMJsMFel4QVJM0Jn9+wHw/0qqPiS3
>> +a769S/u9U2dfyZY5PfymY8UjFRMDtLaUoJSRaGp6RNc6LynuMMKdzho0GwvL3+m9
>> +xKLDbbks8hVdmtcxxDKiio+F0hp3yc/2PyA/VGAlARiGp7876WTCZox9Bwnf6lkS
>> +k9eYLSabe/r3Ag1SbWEGpFk3VO37qCyfp2xTfrHXK1ZJlvFwj3FFSprUaMrV+81K
>> +FCEcSozXpVsQ7e7d11A7S8rTbtp09Q/J2oxyR0A9lk/ia5Qd/xwbPl4QJcWK2Jar
>> +K3yFK8VrUNib7CjI1kdB479KIllD8oK6druBkzwGzFxDtcl47RlfkqW96XSQT7x/
>> +h/YKSLcpMx9x9TJd2GDKj2t4oE9eGTBC0YbdH+HJNSrjEsWkjgY6Uw++S6VzKvQZ
>> +DDsMJfxwcChc2zKRou+BFA==
>> +-----END ENCRYPTED PRIVATE KEY-----
>> diff --git
>> a/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem
>> b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem
>> new file mode 100644
>> index 0000000..7cd2487
>> --- /dev/null
>> +++
>> b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem
>> @@ -0,0 +1,23 @@
>> +-----BEGIN CERTIFICATE-----
>> +MIID1zCCAr+gAwIBAgIUDMG7xGGEPj+ABvbflim0PNb/loowDQYJKoZIhvcNAQEL
>> +BQAwejELMAkGA1UEBhMCVVMxETAPBgNVBAgMCENvbG9yYWRvMRUwEwYDVQQHDAxG
>> +b3J0IENvbGxpbnMxETAPBgNVBAoMCFNuYWtlT2lsMS4wLAYDVQQDDCVTbmFrZU9p
>> +bCBUZXN0IEtleSBmb3IgRUZJIFNlY3VyZSBCb290MCAXDTIzMDUxOTIzMTE0NVoY
>> +DzIwNTMwNTE3MjMxMTQ1WjB6MQswCQYDVQQGEwJVUzERMA8GA1UECAwIQ29sb3Jh
>> +ZG8xFTATBgNVBAcMDEZvcnQgQ29sbGluczERMA8GA1UECgwIU25ha2VPaWwxLjAs
>> +BgNVBAMMJVNuYWtlT2lsIFRlc3QgS2V5IGZvciBFRkkgU2VjdXJlIEJvb3QwggEi
>> +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIi65d6LmojD5S9q8vE/LI2HHQ
>> +boiO5/1KrFVc6kpxD6XdkJwpBoItYIfSls9CPnzvNWOAxR3hIeBd1U/prAPPxvQ1
>> +wuDLMXfWkcGaYHfPnme/YluAjnpuLH1MQcumgOzj5xYBvZZk+RbytX/phH7FW4Tx
>> ++L1oBYnsfh3BSE/NTtEEHV1nXAXpa/dvyefWMlrlbwjfM5362lZzM6yrJGcOcWEy
>> +I66UYCIVO2Yhe/ZVF5B/tPGtd2oACz11xLeqLPM1WBjlekAG2Zi7UCPIvDCpdn5u
>> +Vna2ZRQmJyDDdh0Ja2VMC19dkMd/5nOAI21O+FvYPOkBWYX8f4DzDyVQlmIFAgMB
>> +AAGjUzBRMB0GA1UdDgQWBBRjuNXuXfh7mi8I3eTboeYGyFTa2zAfBgNVHSMEGDAW
>> +gBRjuNXuXfh7mi8I3eTboeYGyFTa2zAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
>> +DQEBCwUAA4IBAQBBxlfo6MxBN44mXBIhE/QUbJZ+bo/Vrqv2DIZqOlV5+Sk6KnK8
>> +X9Rz2IJwoqLjB6cW9yInk5P/QS45880K1fDT/lu5/2U64i3l1ZFK75qLDCn4/khF
>> +birV2U6LBZpxLe3UvXk3xZMoUPzvT2rhrsf78G0pSmAnP8li8Co8F6hTjQzB8IgC
>> +DpYVATCoWBH6GhudtjUp+CJSyGApdL+HKX6i6oD7vutvWYBf0Hx5r1NrqIv31Y4V
>> +bhwvK5zajFamj/VYeVy7/roqD06hNF1ImhsuBOqoJlKu+cHMGN9DOJqjGup1T9aI
>> +2dpEOK5vbKXFrox/yCLgXmUkdwZ3BK4lcxCq
>> +-----END CERTIFICATE-----
>> diff --git a/recipes-devtools/swupdate-certificates/files/forky
>> b/recipes-devtools/swupdate-certificates/files/forky
>> new file mode 120000
>> index 0000000..2719d00
>> --- /dev/null
>> +++ b/recipes-devtools/swupdate-certificates/files/forky
>> @@ -0,0 +1 @@
>> +../../secure-boot-secrets/files/forky
>> \ No newline at end of file
>> diff --git a/start-qemu.sh b/start-qemu.sh
>> index d12fa23..0b783d6 100755
>> --- a/start-qemu.sh
>> +++ b/start-qemu.sh
>> @@ -47,6 +47,8 @@ if [ -z "${DISTRO_RELEASE}" ]; then
>> DISTRO_RELEASE="trixie"
>> elif grep -s -q "DEBIAN_SID: true" .config.yaml; then
>> DISTRO_RELEASE="sid"
>> + elif grep -s -q "DEBIAN_FORKY: true" .config.yaml; then
>> + DISTRO_RELEASE="forky"
> 
> ..and here.

Ok.

Thanks & Regards
Shivanand K

[-- Attachment #2: Type: text/html, Size: 8888 bytes --]

Re: [isar-cip-core][PATCH v1 2/2] Enable CI image build and test support for forky

[Kunijadar Shivanand]

[-- Attachment #1: Type: text/plain, Size: 5248 bytes --]

On Mon, Jul 27, 2026 at 10:10 AM, Jan Kiszka wrote:

> 
> On 27.07.26 16:11, Shivanand.Kunijadar@toshiba-tsip.com wrote:
> 
>> From: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
>> 
>> Keep these jobs as scheduled and can be scheduled to run every week
>> just to monitor and fix if there are any issues.
>> Also set allow_failure:true for these jobs as forky is not officially
>> released and there will always be some build & test issues.
>> 
>> Signed-off-by: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
>> ---
>> .gitlab-ci.yml | 93 ++++++++++++++++++++++++++++++++++++++++++++++++++
>> 1 file changed, 93 insertions(+)
>> 
>> diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
>> index b53def4..977ae01 100644
>> --- a/.gitlab-ci.yml
>> +++ b/.gitlab-ci.yml
>> @@ -64,6 +64,7 @@ default:
>> - if [ "${release}" = "bookworm" ]; then
>> base_yaml="${base_yaml}:kas/opt/bookworm.yml"; fi
>> - if [ "${release}" = "trixie" ]; then
>> base_yaml="${base_yaml}:kas/opt/trixie.yml"; fi
>> - if [ "${release}" = "sid" ]; then
>> base_yaml="${base_yaml}:kas/opt/sid.yml"; fi
>> + - if [ "${release}" = "forky" ]; then
>> base_yaml="${base_yaml}:kas/opt/forky.yml"; fi
> 
> ordering

Thanks, I'll fix it.

> 
> 
>> - if [ "${encrypt}" = "enable" ]; then
>> base_yaml="${base_yaml}:kas/opt/encrypt-data.yml"; fi
>> - if [ "${factory_reset}" = "enable" ]; then
>> base_yaml="${base_yaml}:kas/opt/factory-reset.yml"; fi
>> - if [ "${watchdog}" = "disable" ]; then
>> base_yaml="${base_yaml}:kas/opt/disable-watchdog.yml"; fi
>> @@ -399,6 +400,57 @@ build:qemu-arm-base-sid:
>> separate_home_partition: enable
>> deploy: enable
>> 
>> +# forky image builds
>> +.build_base_forky:
>> + extends:
>> + - .build_base
>> + rules:
>> + - if: $CI_COMMIT_TAG
>> + when: never
>> + - if: '$CI_PIPELINE_SOURCE == "schedule" && $CI_RUN_UNSTABLE_FORKY'
> 
> We should handle forky and sid identical for now, thus should likely use
> generic CI_RUN_UNSTABLE for both. Forky can then be moved out of this
> mode somewhere next year and become another regular test target in the
> pipeline, sid will always remain there.

Sure, will change it to CI_RUN_UNSTABLE for both forky & sid.

> 
> 
>> + - if: $CI_COMMIT_BRANCH != "master"
>> + when: never
>> + allow_failure: true
>> +
>> +build:qemu-amd64-base-forky:
>> + extends:
>> + - .build_base_forky
>> + variables:
>> + target: qemu-amd64
>> + use_rt: disable
>> + release: forky
>> + extension: security
>> + security_test: enable
>> + build_updates: enable
>> + separate_home_partition: enable
>> + deploy: enable
>> +
>> +build:qemu-arm64-base-forky:
>> + extends:
>> + - .build_base_forky
>> + variables:
>> + target: qemu-arm64
>> + use_rt: disable
>> + release: forky
>> + extension: security
>> + security_test: enable
>> + build_updates: enable
>> + separate_home_partition: enable
>> + deploy: enable
>> +
>> +build:qemu-arm-base-forky:
>> + extends:
>> + - .build_base_forky
>> + variables:
>> + target: qemu-arm
>> + extension: security
>> + security_test: enable
>> + use_rt: disable
>> + release: forky
>> + build_updates: enable
>> + separate_home_partition: enable
>> + deploy: enable
>> +
>> .test-cip-core:
>> stage: test
>> image: $CI_REGISTRY_IMAGE/lavacli
>> @@ -764,6 +816,47 @@ test:qemu-arm-IEC-sid:
>> test_function: IEC
>> iec_test_timeout: 40
>> 
>> +# Tests for forky images
>> +.test-cip-core-forky:
>> + extends:
>> + - .test-cip-core
>> + rules:
>> + - if: $CI_COMMIT_TAG
>> + when: never
>> + - if: '$CI_PIPELINE_SOURCE == "schedule" && $CI_RUN_UNSTABLE_FORKY'
>> + - if: $CI_COMMIT_BRANCH != "master"
>> + when: never
>> + allow_failure: true
>> +
>> +test:qemu-amd64-IEC-forky:
>> + extends:
>> + - .test-cip-core-forky
>> + variables:
>> + target: qemu-amd64
>> + release: forky
>> + test_function: IEC
>> + iec_test_timeout: 40
>> +
>> +test:qemu-arm64-IEC-forky:
>> + extends:
>> + - .test-cip-core-forky
>> + needs: ["build:qemu-arm64-base-forky"]
>> + variables:
>> + target: qemu-arm64
>> + release: forky
>> + test_function: IEC
>> + iec_test_timeout: 40
>> +
>> +test:qemu-arm-IEC-forky:
>> + extends:
>> + - .test-cip-core-forky
>> + needs: ["build:qemu-arm-base-forky"]
>> + variables:
>> + target: qemu-arm
>> + release: forky
>> + test_function: IEC
>> + iec_test_timeout: 40
>> +
>> cve-checks:
>> stage: cve-check
>> needs: []
> 
> I'm still wondering what the added value of testing sid for us is. I
> would rather consider to invest our CI time into running more tests with
> forky, like some more SWUpdate checks and/or reproducibility.

Understood, we can add more tests like SWUpdate, secure boot and RB builds for forky. I will include them in v2 patch.

considering the value of testing for sid,
- The latest updates/fixes to any package will appear in sid before forky. As a community we can test early and report issues and also contribute to Debian to fix the issues if required.

please note we have only minimal tests for sid now and also running it weekly. if required we can still remove the sid testing from CI, kindly let me know.

Thanks & Regards
Shivanand K

[-- Attachment #2: Type: text/html, Size: 5720 bytes --]