* [isar-cip-core][PATCH v1 0/2] Enable debian forky builds & tests @ 2026-07-27 14:11 Shivanand.Kunijadar 2026-07-27 14:11 ` [isar-cip-core][PATCH v1 1/2] Enable the support of Debian forky based builds Shivanand.Kunijadar 2026-07-27 14:11 ` [isar-cip-core][PATCH v1 2/2] Enable CI image build and test support for forky Shivanand.Kunijadar 0 siblings, 2 replies; 7+ messages in thread From: Shivanand.Kunijadar @ 2026-07-27 14:11 UTC (permalink / raw) To: cip-dev, jan.kiszka Cc: Shivanand Kunijadar, kumar.dinesh.h95, kazuhiro.hayashi.f74 From: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> This patch series adds the debian forky based image build & CI test support. NOTE: The base/security image builds are failing locally due to some dependency issues in package installation not because of recipe changes. I request you to create a scheduled pipeline similar to sid and add the CI variable CI_RUN_UNSTABLE_FORKY with some value. Shivanand Kunijadar (2): Enable the support of Debian forky based builds Enable CI image build and test support for forky .gitlab-ci.yml | 93 +++++++++++++++++++ Kconfig | 4 + conf/distro/cip-core-forky.conf | 13 +++ kas/opt/forky.yml | 15 +++ .../files/forky/PkKek-1-snakeoil.key | 30 ++++++ .../files/forky/PkKek-1-snakeoil.pem | 23 +++++ .../swupdate-certificates/files/forky | 1 + start-qemu.sh | 2 + 8 files changed, 181 insertions(+) create mode 100644 conf/distro/cip-core-forky.conf create mode 100644 kas/opt/forky.yml create mode 100644 recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key create mode 100644 recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem create mode 120000 recipes-devtools/swupdate-certificates/files/forky -- 2.39.5 ^ permalink raw reply [flat|nested] 7+ messages in thread
* [isar-cip-core][PATCH v1 1/2] Enable the support of Debian forky based builds 2026-07-27 14:11 [isar-cip-core][PATCH v1 0/2] Enable debian forky builds & tests Shivanand.Kunijadar @ 2026-07-27 14:11 ` Shivanand.Kunijadar 2026-07-27 17:04 ` Jan Kiszka 2026-07-27 14:11 ` [isar-cip-core][PATCH v1 2/2] Enable CI image build and test support for forky Shivanand.Kunijadar 1 sibling, 1 reply; 7+ messages in thread From: Shivanand.Kunijadar @ 2026-07-27 14:11 UTC (permalink / raw) To: cip-dev, jan.kiszka Cc: Shivanand Kunijadar, kumar.dinesh.h95, kazuhiro.hayashi.f74 From: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> The .key & .pem files are addded using below .deb package, https://snapshot.debian.org/file/d32d11a5aacbf5685b81e8176a27a6918e9b55fb/ovmf-generic_2025.11-5_all.deb Signed-off-by: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> --- Kconfig | 4 +++ conf/distro/cip-core-forky.conf | 13 ++++++++ kas/opt/forky.yml | 15 ++++++++++ .../files/forky/PkKek-1-snakeoil.key | 30 +++++++++++++++++++ .../files/forky/PkKek-1-snakeoil.pem | 23 ++++++++++++++ .../swupdate-certificates/files/forky | 1 + start-qemu.sh | 2 ++ 7 files changed, 88 insertions(+) create mode 100644 conf/distro/cip-core-forky.conf create mode 100644 kas/opt/forky.yml create mode 100644 recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key create mode 100644 recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem create mode 120000 recipes-devtools/swupdate-certificates/files/forky diff --git a/Kconfig b/Kconfig index 438234c..14cd677 100644 --- a/Kconfig +++ b/Kconfig @@ -241,6 +241,9 @@ config DEBIAN_TRIXIE config DEBIAN_SID bool "Sid (Unstable)" +config DEBIAN_FORKY + bool "forky (14)" + endchoice config KAS_INCLUDE_DEBIAN @@ -250,6 +253,7 @@ config KAS_INCLUDE_DEBIAN default "kas/opt/bookworm.yml" if DEBIAN_BOOKWORM default "kas/opt/trixie.yml" if DEBIAN_TRIXIE default "kas/opt/sid.yml" if DEBIAN_SID + default "kas/opt/forky.yml" if DEBIAN_FORKY comment "Image features" diff --git a/conf/distro/cip-core-forky.conf b/conf/distro/cip-core-forky.conf new file mode 100644 index 0000000..7a868ce --- /dev/null +++ b/conf/distro/cip-core-forky.conf @@ -0,0 +1,13 @@ +# +# CIP Core, generic profile +# +# Copyright (c) Toshiba Corporation, 2026 +# +# Authors: +# Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> +# +# SPDX-License-Identifier: MIT +# + +require conf/distro/debian-forky.conf +require cip-core-common.inc diff --git a/kas/opt/forky.yml b/kas/opt/forky.yml new file mode 100644 index 0000000..6c4fcdc --- /dev/null +++ b/kas/opt/forky.yml @@ -0,0 +1,15 @@ +# +# CIP Core, generic profile +# +# Copyright (c) Toshiba Corporation, 2026 +# +# Authors: +# Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> +# +# SPDX-License-Identifier: MIT +# + +header: + version: 14 + +distro: cip-core-forky diff --git a/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key new file mode 100644 index 0000000..dd7f492 --- /dev/null +++ b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key @@ -0,0 +1,30 @@ +-----BEGIN ENCRYPTED PRIVATE KEY----- +MIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIs4RXCLmGLJgCAggA +MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECHer6014IEhGBIIEyO8O2zL8CJwV +auQpWLJsMMWxu2aSh1WadX9+rg+O61mukuS4rQSH5shMQ2krZZKzyXx0q8+2AySD +EtDXwhLvep60gUxOoNqK1+l3AxSFfIGOY8NC6yW67VX+G09ajWpgHj3ox63VRW8v +6mA8TFWYbOIwB8J7ScF4NszVwyiUnW13oKi7svoBM3LYYG2IMvre+gOvyMGfM8uv +X3txcYqAjhRV6n7vGo9LRLIIRSPKzaJbm/W7nT38LRUJP8JMSQUOPKgeEwQvOTVZ ++1kd7WeaGZrjagTDM4yhBjpOmB3D8aeT6xkjBlUwuddPzbdi0N7GrU520RcJMjxt +JMyOgabHKUKmPTX4m0ZCKi2jSILi7/6fBF+TZDxpakLwAwpTzm6kXArXb6AYtTEX +GPihB4O69ZgEc90jp3EnZt7HtKZn1HTbPNQAlWgvESgJ7hWHnTlM5Obqnyb78tj5 +VdcOfTSQRYmw4Rh/lSUX0vQLhdmYSVLiMFFvT4IepXZgQ6McIdcvqoVrPgr0HoVz +5YILZdmbs80VcgYL853lMfQ84kRwUcw8jNyz7mBK7V7rE5QhaF5lunZ/R41ZRXRy +1ys1rNvLPvtOq/K51+A9U+h5lLM9LjeoOR+IUk2Vg4aIap+Z+lxbImH0gcJTrpem +ctA/2sBjLN7w811EjB/Tlu2awzbsKLpIDFVGHiGBI2zb41gtPd2RkijmiZab6nuM +ETg4ad3GscMoa++01oX/lrnVe386ECSjurmThb7I01eTNZrBlNsLyBeFzlEIEoBR +TqUXHLiDACxzL6U4vWzdnvVrCOW9fwvJJqChj7Wy822w2LXxVhOryNujBmZCmOht +mgDaJ15QiF+DACcX6VoBbm/462z+9Skxa0DqGwGzMOD5HldwvQSyZSykk/BzGFWP +rXfLYoMjN+dgA/yNfem64ayGsmoPUAjnsE4YasD58UVO0XwwtdMGJSOVmkdyWMcM +t+lN74kX/gmIvciK06N6prBfowgBEIJ6ev2dzlydSN8rGORmQ+OFzjP14rT0O+1Q +O48yR2ZZ9jl4YPUKSFJ3EUc/Qt9vO+chNiNYSy6TABGXur0WWiDvGURG9K5fWTqq +U2KydSRoYD5iF0caOgMZecNhZV+4CX927j3XuuKKx49qTAt3WMtmJ/UQFHMtQ833 +XDFWHpEKDImfHfyiB1f8bOmqYmPuE6Shup0UMJsMFel4QVJM0Jn9+wHw/0qqPiS3 +a769S/u9U2dfyZY5PfymY8UjFRMDtLaUoJSRaGp6RNc6LynuMMKdzho0GwvL3+m9 +xKLDbbks8hVdmtcxxDKiio+F0hp3yc/2PyA/VGAlARiGp7876WTCZox9Bwnf6lkS +k9eYLSabe/r3Ag1SbWEGpFk3VO37qCyfp2xTfrHXK1ZJlvFwj3FFSprUaMrV+81K +FCEcSozXpVsQ7e7d11A7S8rTbtp09Q/J2oxyR0A9lk/ia5Qd/xwbPl4QJcWK2Jar +K3yFK8VrUNib7CjI1kdB479KIllD8oK6druBkzwGzFxDtcl47RlfkqW96XSQT7x/ +h/YKSLcpMx9x9TJd2GDKj2t4oE9eGTBC0YbdH+HJNSrjEsWkjgY6Uw++S6VzKvQZ +DDsMJfxwcChc2zKRou+BFA== +-----END ENCRYPTED PRIVATE KEY----- diff --git a/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem new file mode 100644 index 0000000..7cd2487 --- /dev/null +++ b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem @@ -0,0 +1,23 @@ +-----BEGIN CERTIFICATE----- +MIID1zCCAr+gAwIBAgIUDMG7xGGEPj+ABvbflim0PNb/loowDQYJKoZIhvcNAQEL +BQAwejELMAkGA1UEBhMCVVMxETAPBgNVBAgMCENvbG9yYWRvMRUwEwYDVQQHDAxG +b3J0IENvbGxpbnMxETAPBgNVBAoMCFNuYWtlT2lsMS4wLAYDVQQDDCVTbmFrZU9p +bCBUZXN0IEtleSBmb3IgRUZJIFNlY3VyZSBCb290MCAXDTIzMDUxOTIzMTE0NVoY +DzIwNTMwNTE3MjMxMTQ1WjB6MQswCQYDVQQGEwJVUzERMA8GA1UECAwIQ29sb3Jh +ZG8xFTATBgNVBAcMDEZvcnQgQ29sbGluczERMA8GA1UECgwIU25ha2VPaWwxLjAs +BgNVBAMMJVNuYWtlT2lsIFRlc3QgS2V5IGZvciBFRkkgU2VjdXJlIEJvb3QwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIi65d6LmojD5S9q8vE/LI2HHQ +boiO5/1KrFVc6kpxD6XdkJwpBoItYIfSls9CPnzvNWOAxR3hIeBd1U/prAPPxvQ1 +wuDLMXfWkcGaYHfPnme/YluAjnpuLH1MQcumgOzj5xYBvZZk+RbytX/phH7FW4Tx ++L1oBYnsfh3BSE/NTtEEHV1nXAXpa/dvyefWMlrlbwjfM5362lZzM6yrJGcOcWEy +I66UYCIVO2Yhe/ZVF5B/tPGtd2oACz11xLeqLPM1WBjlekAG2Zi7UCPIvDCpdn5u +Vna2ZRQmJyDDdh0Ja2VMC19dkMd/5nOAI21O+FvYPOkBWYX8f4DzDyVQlmIFAgMB +AAGjUzBRMB0GA1UdDgQWBBRjuNXuXfh7mi8I3eTboeYGyFTa2zAfBgNVHSMEGDAW +gBRjuNXuXfh7mi8I3eTboeYGyFTa2zAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3 +DQEBCwUAA4IBAQBBxlfo6MxBN44mXBIhE/QUbJZ+bo/Vrqv2DIZqOlV5+Sk6KnK8 +X9Rz2IJwoqLjB6cW9yInk5P/QS45880K1fDT/lu5/2U64i3l1ZFK75qLDCn4/khF +birV2U6LBZpxLe3UvXk3xZMoUPzvT2rhrsf78G0pSmAnP8li8Co8F6hTjQzB8IgC +DpYVATCoWBH6GhudtjUp+CJSyGApdL+HKX6i6oD7vutvWYBf0Hx5r1NrqIv31Y4V +bhwvK5zajFamj/VYeVy7/roqD06hNF1ImhsuBOqoJlKu+cHMGN9DOJqjGup1T9aI +2dpEOK5vbKXFrox/yCLgXmUkdwZ3BK4lcxCq +-----END CERTIFICATE----- diff --git a/recipes-devtools/swupdate-certificates/files/forky b/recipes-devtools/swupdate-certificates/files/forky new file mode 120000 index 0000000..2719d00 --- /dev/null +++ b/recipes-devtools/swupdate-certificates/files/forky @@ -0,0 +1 @@ +../../secure-boot-secrets/files/forky \ No newline at end of file diff --git a/start-qemu.sh b/start-qemu.sh index d12fa23..0b783d6 100755 --- a/start-qemu.sh +++ b/start-qemu.sh @@ -47,6 +47,8 @@ if [ -z "${DISTRO_RELEASE}" ]; then DISTRO_RELEASE="trixie" elif grep -s -q "DEBIAN_SID: true" .config.yaml; then DISTRO_RELEASE="sid" + elif grep -s -q "DEBIAN_FORKY: true" .config.yaml; then + DISTRO_RELEASE="forky" else echo "No supported Debian release configured" exit 1 -- 2.39.5 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [isar-cip-core][PATCH v1 1/2] Enable the support of Debian forky based builds 2026-07-27 14:11 ` [isar-cip-core][PATCH v1 1/2] Enable the support of Debian forky based builds Shivanand.Kunijadar @ 2026-07-27 17:04 ` Jan Kiszka 2026-07-28 4:54 ` Kunijadar Shivanand 0 siblings, 1 reply; 7+ messages in thread From: Jan Kiszka @ 2026-07-27 17:04 UTC (permalink / raw) To: Shivanand.Kunijadar, cip-dev; +Cc: kumar.dinesh.h95, kazuhiro.hayashi.f74 On 27.07.26 16:11, Shivanand.Kunijadar@toshiba-tsip.com wrote: > From: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> > > The .key & .pem files are addded using below .deb package, > https://snapshot.debian.org/file/d32d11a5aacbf5685b81e8176a27a6918e9b55fb/ovmf-generic_2025.11-5_all.deb > > Signed-off-by: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> > --- > Kconfig | 4 +++ > conf/distro/cip-core-forky.conf | 13 ++++++++ > kas/opt/forky.yml | 15 ++++++++++ > .../files/forky/PkKek-1-snakeoil.key | 30 +++++++++++++++++++ > .../files/forky/PkKek-1-snakeoil.pem | 23 ++++++++++++++ So, current sid uses different keys that forky? Is that always the case? > .../swupdate-certificates/files/forky | 1 + > start-qemu.sh | 2 ++ > 7 files changed, 88 insertions(+) > create mode 100644 conf/distro/cip-core-forky.conf > create mode 100644 kas/opt/forky.yml > create mode 100644 recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key > create mode 100644 recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem > create mode 120000 recipes-devtools/swupdate-certificates/files/forky > > diff --git a/Kconfig b/Kconfig > index 438234c..14cd677 100644 > --- a/Kconfig > +++ b/Kconfig > @@ -241,6 +241,9 @@ config DEBIAN_TRIXIE > config DEBIAN_SID > bool "Sid (Unstable)" > > +config DEBIAN_FORKY > + bool "forky (14)" > + Let's sort forky before sid. > endchoice > > config KAS_INCLUDE_DEBIAN > @@ -250,6 +253,7 @@ config KAS_INCLUDE_DEBIAN > default "kas/opt/bookworm.yml" if DEBIAN_BOOKWORM > default "kas/opt/trixie.yml" if DEBIAN_TRIXIE > default "kas/opt/sid.yml" if DEBIAN_SID > + default "kas/opt/forky.yml" if DEBIAN_FORKY > Here as well. > comment "Image features" > > diff --git a/conf/distro/cip-core-forky.conf b/conf/distro/cip-core-forky.conf > new file mode 100644 > index 0000000..7a868ce > --- /dev/null > +++ b/conf/distro/cip-core-forky.conf > @@ -0,0 +1,13 @@ > +# > +# CIP Core, generic profile > +# > +# Copyright (c) Toshiba Corporation, 2026 > +# > +# Authors: > +# Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> > +# > +# SPDX-License-Identifier: MIT > +# > + > +require conf/distro/debian-forky.conf > +require cip-core-common.inc > diff --git a/kas/opt/forky.yml b/kas/opt/forky.yml > new file mode 100644 > index 0000000..6c4fcdc > --- /dev/null > +++ b/kas/opt/forky.yml > @@ -0,0 +1,15 @@ > +# > +# CIP Core, generic profile > +# > +# Copyright (c) Toshiba Corporation, 2026 > +# > +# Authors: > +# Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> > +# > +# SPDX-License-Identifier: MIT > +# > + > +header: > + version: 14 > + > +distro: cip-core-forky > diff --git a/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key > new file mode 100644 > index 0000000..dd7f492 > --- /dev/null > +++ b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key > @@ -0,0 +1,30 @@ > +-----BEGIN ENCRYPTED PRIVATE KEY----- > +MIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIs4RXCLmGLJgCAggA > +MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECHer6014IEhGBIIEyO8O2zL8CJwV > +auQpWLJsMMWxu2aSh1WadX9+rg+O61mukuS4rQSH5shMQ2krZZKzyXx0q8+2AySD > +EtDXwhLvep60gUxOoNqK1+l3AxSFfIGOY8NC6yW67VX+G09ajWpgHj3ox63VRW8v > +6mA8TFWYbOIwB8J7ScF4NszVwyiUnW13oKi7svoBM3LYYG2IMvre+gOvyMGfM8uv > +X3txcYqAjhRV6n7vGo9LRLIIRSPKzaJbm/W7nT38LRUJP8JMSQUOPKgeEwQvOTVZ > ++1kd7WeaGZrjagTDM4yhBjpOmB3D8aeT6xkjBlUwuddPzbdi0N7GrU520RcJMjxt > +JMyOgabHKUKmPTX4m0ZCKi2jSILi7/6fBF+TZDxpakLwAwpTzm6kXArXb6AYtTEX > +GPihB4O69ZgEc90jp3EnZt7HtKZn1HTbPNQAlWgvESgJ7hWHnTlM5Obqnyb78tj5 > +VdcOfTSQRYmw4Rh/lSUX0vQLhdmYSVLiMFFvT4IepXZgQ6McIdcvqoVrPgr0HoVz > +5YILZdmbs80VcgYL853lMfQ84kRwUcw8jNyz7mBK7V7rE5QhaF5lunZ/R41ZRXRy > +1ys1rNvLPvtOq/K51+A9U+h5lLM9LjeoOR+IUk2Vg4aIap+Z+lxbImH0gcJTrpem > +ctA/2sBjLN7w811EjB/Tlu2awzbsKLpIDFVGHiGBI2zb41gtPd2RkijmiZab6nuM > +ETg4ad3GscMoa++01oX/lrnVe386ECSjurmThb7I01eTNZrBlNsLyBeFzlEIEoBR > +TqUXHLiDACxzL6U4vWzdnvVrCOW9fwvJJqChj7Wy822w2LXxVhOryNujBmZCmOht > +mgDaJ15QiF+DACcX6VoBbm/462z+9Skxa0DqGwGzMOD5HldwvQSyZSykk/BzGFWP > +rXfLYoMjN+dgA/yNfem64ayGsmoPUAjnsE4YasD58UVO0XwwtdMGJSOVmkdyWMcM > +t+lN74kX/gmIvciK06N6prBfowgBEIJ6ev2dzlydSN8rGORmQ+OFzjP14rT0O+1Q > +O48yR2ZZ9jl4YPUKSFJ3EUc/Qt9vO+chNiNYSy6TABGXur0WWiDvGURG9K5fWTqq > +U2KydSRoYD5iF0caOgMZecNhZV+4CX927j3XuuKKx49qTAt3WMtmJ/UQFHMtQ833 > +XDFWHpEKDImfHfyiB1f8bOmqYmPuE6Shup0UMJsMFel4QVJM0Jn9+wHw/0qqPiS3 > +a769S/u9U2dfyZY5PfymY8UjFRMDtLaUoJSRaGp6RNc6LynuMMKdzho0GwvL3+m9 > +xKLDbbks8hVdmtcxxDKiio+F0hp3yc/2PyA/VGAlARiGp7876WTCZox9Bwnf6lkS > +k9eYLSabe/r3Ag1SbWEGpFk3VO37qCyfp2xTfrHXK1ZJlvFwj3FFSprUaMrV+81K > +FCEcSozXpVsQ7e7d11A7S8rTbtp09Q/J2oxyR0A9lk/ia5Qd/xwbPl4QJcWK2Jar > +K3yFK8VrUNib7CjI1kdB479KIllD8oK6druBkzwGzFxDtcl47RlfkqW96XSQT7x/ > +h/YKSLcpMx9x9TJd2GDKj2t4oE9eGTBC0YbdH+HJNSrjEsWkjgY6Uw++S6VzKvQZ > +DDsMJfxwcChc2zKRou+BFA== > +-----END ENCRYPTED PRIVATE KEY----- > diff --git a/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem > new file mode 100644 > index 0000000..7cd2487 > --- /dev/null > +++ b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem > @@ -0,0 +1,23 @@ > +-----BEGIN CERTIFICATE----- > +MIID1zCCAr+gAwIBAgIUDMG7xGGEPj+ABvbflim0PNb/loowDQYJKoZIhvcNAQEL > +BQAwejELMAkGA1UEBhMCVVMxETAPBgNVBAgMCENvbG9yYWRvMRUwEwYDVQQHDAxG > +b3J0IENvbGxpbnMxETAPBgNVBAoMCFNuYWtlT2lsMS4wLAYDVQQDDCVTbmFrZU9p > +bCBUZXN0IEtleSBmb3IgRUZJIFNlY3VyZSBCb290MCAXDTIzMDUxOTIzMTE0NVoY > +DzIwNTMwNTE3MjMxMTQ1WjB6MQswCQYDVQQGEwJVUzERMA8GA1UECAwIQ29sb3Jh > +ZG8xFTATBgNVBAcMDEZvcnQgQ29sbGluczERMA8GA1UECgwIU25ha2VPaWwxLjAs > +BgNVBAMMJVNuYWtlT2lsIFRlc3QgS2V5IGZvciBFRkkgU2VjdXJlIEJvb3QwggEi > +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIi65d6LmojD5S9q8vE/LI2HHQ > +boiO5/1KrFVc6kpxD6XdkJwpBoItYIfSls9CPnzvNWOAxR3hIeBd1U/prAPPxvQ1 > +wuDLMXfWkcGaYHfPnme/YluAjnpuLH1MQcumgOzj5xYBvZZk+RbytX/phH7FW4Tx > ++L1oBYnsfh3BSE/NTtEEHV1nXAXpa/dvyefWMlrlbwjfM5362lZzM6yrJGcOcWEy > +I66UYCIVO2Yhe/ZVF5B/tPGtd2oACz11xLeqLPM1WBjlekAG2Zi7UCPIvDCpdn5u > +Vna2ZRQmJyDDdh0Ja2VMC19dkMd/5nOAI21O+FvYPOkBWYX8f4DzDyVQlmIFAgMB > +AAGjUzBRMB0GA1UdDgQWBBRjuNXuXfh7mi8I3eTboeYGyFTa2zAfBgNVHSMEGDAW > +gBRjuNXuXfh7mi8I3eTboeYGyFTa2zAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3 > +DQEBCwUAA4IBAQBBxlfo6MxBN44mXBIhE/QUbJZ+bo/Vrqv2DIZqOlV5+Sk6KnK8 > +X9Rz2IJwoqLjB6cW9yInk5P/QS45880K1fDT/lu5/2U64i3l1ZFK75qLDCn4/khF > +birV2U6LBZpxLe3UvXk3xZMoUPzvT2rhrsf78G0pSmAnP8li8Co8F6hTjQzB8IgC > +DpYVATCoWBH6GhudtjUp+CJSyGApdL+HKX6i6oD7vutvWYBf0Hx5r1NrqIv31Y4V > +bhwvK5zajFamj/VYeVy7/roqD06hNF1ImhsuBOqoJlKu+cHMGN9DOJqjGup1T9aI > +2dpEOK5vbKXFrox/yCLgXmUkdwZ3BK4lcxCq > +-----END CERTIFICATE----- > diff --git a/recipes-devtools/swupdate-certificates/files/forky b/recipes-devtools/swupdate-certificates/files/forky > new file mode 120000 > index 0000000..2719d00 > --- /dev/null > +++ b/recipes-devtools/swupdate-certificates/files/forky > @@ -0,0 +1 @@ > +../../secure-boot-secrets/files/forky > \ No newline at end of file > diff --git a/start-qemu.sh b/start-qemu.sh > index d12fa23..0b783d6 100755 > --- a/start-qemu.sh > +++ b/start-qemu.sh > @@ -47,6 +47,8 @@ if [ -z "${DISTRO_RELEASE}" ]; then > DISTRO_RELEASE="trixie" > elif grep -s -q "DEBIAN_SID: true" .config.yaml; then > DISTRO_RELEASE="sid" > + elif grep -s -q "DEBIAN_FORKY: true" .config.yaml; then > + DISTRO_RELEASE="forky" ..and here. > else > echo "No supported Debian release configured" > exit 1 Jan -- Siemens AG, Foundational Technologies Linux Expert Center ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [isar-cip-core][PATCH v1 1/2] Enable the support of Debian forky based builds 2026-07-27 17:04 ` Jan Kiszka @ 2026-07-28 4:54 ` Kunijadar Shivanand 0 siblings, 0 replies; 7+ messages in thread From: Kunijadar Shivanand @ 2026-07-28 4:54 UTC (permalink / raw) To: cip-dev [-- Attachment #1: Type: text/plain, Size: 8250 bytes --] On Mon, Jul 27, 2026 at 10:05 AM, Jan Kiszka wrote: > > On 27.07.26 16:11, Shivanand.Kunijadar@toshiba-tsip.com wrote: > >> From: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> >> >> The .key & .pem files are addded using below .deb package, >> https://snapshot.debian.org/file/d32d11a5aacbf5685b81e8176a27a6918e9b55fb/ovmf-generic_2025.11-5_all.deb >> >> >> Signed-off-by: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> >> --- >> Kconfig | 4 +++ >> conf/distro/cip-core-forky.conf | 13 ++++++++ >> kas/opt/forky.yml | 15 ++++++++++ >> .../files/forky/PkKek-1-snakeoil.key | 30 +++++++++++++++++++ >> .../files/forky/PkKek-1-snakeoil.pem | 23 ++++++++++++++ > > So, current sid uses different keys that forky? Is that always the case? The ovmf package version in both forky & sid are same now[1], so the keys should be same. I'll send a separate patch to create symlink to forky for sid keys. please note the sid keys were added long back and pointing to trixie. [1] https://packages.debian.org/sid/ovmf-generic > > >> .../swupdate-certificates/files/forky | 1 + >> start-qemu.sh | 2 ++ >> 7 files changed, 88 insertions(+) >> create mode 100644 conf/distro/cip-core-forky.conf >> create mode 100644 kas/opt/forky.yml >> create mode 100644 >> recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key >> create mode 100644 >> recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem >> create mode 120000 recipes-devtools/swupdate-certificates/files/forky >> >> diff --git a/Kconfig b/Kconfig >> index 438234c..14cd677 100644 >> --- a/Kconfig >> +++ b/Kconfig >> @@ -241,6 +241,9 @@ config DEBIAN_TRIXIE >> config DEBIAN_SID >> bool "Sid (Unstable)" >> >> +config DEBIAN_FORKY >> + bool "forky (14)" >> + > > Let's sort forky before sid. Ok, sure. > > >> endchoice >> >> config KAS_INCLUDE_DEBIAN >> @@ -250,6 +253,7 @@ config KAS_INCLUDE_DEBIAN >> default "kas/opt/bookworm.yml" if DEBIAN_BOOKWORM >> default "kas/opt/trixie.yml" if DEBIAN_TRIXIE >> default "kas/opt/sid.yml" if DEBIAN_SID >> + default "kas/opt/forky.yml" if DEBIAN_FORKY > > Here as well. Ok. > > >> comment "Image features" >> >> diff --git a/conf/distro/cip-core-forky.conf >> b/conf/distro/cip-core-forky.conf >> new file mode 100644 >> index 0000000..7a868ce >> --- /dev/null >> +++ b/conf/distro/cip-core-forky.conf >> @@ -0,0 +1,13 @@ >> +# >> +# CIP Core, generic profile >> +# >> +# Copyright (c) Toshiba Corporation, 2026 >> +# >> +# Authors: >> +# Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> >> +# >> +# SPDX-License-Identifier: MIT >> +# >> + >> +require conf/distro/debian-forky.conf >> +require cip-core-common.inc >> diff --git a/kas/opt/forky.yml b/kas/opt/forky.yml >> new file mode 100644 >> index 0000000..6c4fcdc >> --- /dev/null >> +++ b/kas/opt/forky.yml >> @@ -0,0 +1,15 @@ >> +# >> +# CIP Core, generic profile >> +# >> +# Copyright (c) Toshiba Corporation, 2026 >> +# >> +# Authors: >> +# Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> >> +# >> +# SPDX-License-Identifier: MIT >> +# >> + >> +header: >> + version: 14 >> + >> +distro: cip-core-forky >> diff --git >> a/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key >> b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key >> new file mode 100644 >> index 0000000..dd7f492 >> --- /dev/null >> +++ >> b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.key >> @@ -0,0 +1,30 @@ >> +-----BEGIN ENCRYPTED PRIVATE KEY----- >> +MIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIs4RXCLmGLJgCAggA >> +MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECHer6014IEhGBIIEyO8O2zL8CJwV >> +auQpWLJsMMWxu2aSh1WadX9+rg+O61mukuS4rQSH5shMQ2krZZKzyXx0q8+2AySD >> +EtDXwhLvep60gUxOoNqK1+l3AxSFfIGOY8NC6yW67VX+G09ajWpgHj3ox63VRW8v >> +6mA8TFWYbOIwB8J7ScF4NszVwyiUnW13oKi7svoBM3LYYG2IMvre+gOvyMGfM8uv >> +X3txcYqAjhRV6n7vGo9LRLIIRSPKzaJbm/W7nT38LRUJP8JMSQUOPKgeEwQvOTVZ >> ++1kd7WeaGZrjagTDM4yhBjpOmB3D8aeT6xkjBlUwuddPzbdi0N7GrU520RcJMjxt >> +JMyOgabHKUKmPTX4m0ZCKi2jSILi7/6fBF+TZDxpakLwAwpTzm6kXArXb6AYtTEX >> +GPihB4O69ZgEc90jp3EnZt7HtKZn1HTbPNQAlWgvESgJ7hWHnTlM5Obqnyb78tj5 >> +VdcOfTSQRYmw4Rh/lSUX0vQLhdmYSVLiMFFvT4IepXZgQ6McIdcvqoVrPgr0HoVz >> +5YILZdmbs80VcgYL853lMfQ84kRwUcw8jNyz7mBK7V7rE5QhaF5lunZ/R41ZRXRy >> +1ys1rNvLPvtOq/K51+A9U+h5lLM9LjeoOR+IUk2Vg4aIap+Z+lxbImH0gcJTrpem >> +ctA/2sBjLN7w811EjB/Tlu2awzbsKLpIDFVGHiGBI2zb41gtPd2RkijmiZab6nuM >> +ETg4ad3GscMoa++01oX/lrnVe386ECSjurmThb7I01eTNZrBlNsLyBeFzlEIEoBR >> +TqUXHLiDACxzL6U4vWzdnvVrCOW9fwvJJqChj7Wy822w2LXxVhOryNujBmZCmOht >> +mgDaJ15QiF+DACcX6VoBbm/462z+9Skxa0DqGwGzMOD5HldwvQSyZSykk/BzGFWP >> +rXfLYoMjN+dgA/yNfem64ayGsmoPUAjnsE4YasD58UVO0XwwtdMGJSOVmkdyWMcM >> +t+lN74kX/gmIvciK06N6prBfowgBEIJ6ev2dzlydSN8rGORmQ+OFzjP14rT0O+1Q >> +O48yR2ZZ9jl4YPUKSFJ3EUc/Qt9vO+chNiNYSy6TABGXur0WWiDvGURG9K5fWTqq >> +U2KydSRoYD5iF0caOgMZecNhZV+4CX927j3XuuKKx49qTAt3WMtmJ/UQFHMtQ833 >> +XDFWHpEKDImfHfyiB1f8bOmqYmPuE6Shup0UMJsMFel4QVJM0Jn9+wHw/0qqPiS3 >> +a769S/u9U2dfyZY5PfymY8UjFRMDtLaUoJSRaGp6RNc6LynuMMKdzho0GwvL3+m9 >> +xKLDbbks8hVdmtcxxDKiio+F0hp3yc/2PyA/VGAlARiGp7876WTCZox9Bwnf6lkS >> +k9eYLSabe/r3Ag1SbWEGpFk3VO37qCyfp2xTfrHXK1ZJlvFwj3FFSprUaMrV+81K >> +FCEcSozXpVsQ7e7d11A7S8rTbtp09Q/J2oxyR0A9lk/ia5Qd/xwbPl4QJcWK2Jar >> +K3yFK8VrUNib7CjI1kdB479KIllD8oK6druBkzwGzFxDtcl47RlfkqW96XSQT7x/ >> +h/YKSLcpMx9x9TJd2GDKj2t4oE9eGTBC0YbdH+HJNSrjEsWkjgY6Uw++S6VzKvQZ >> +DDsMJfxwcChc2zKRou+BFA== >> +-----END ENCRYPTED PRIVATE KEY----- >> diff --git >> a/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem >> b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem >> new file mode 100644 >> index 0000000..7cd2487 >> --- /dev/null >> +++ >> b/recipes-devtools/secure-boot-secrets/files/forky/PkKek-1-snakeoil.pem >> @@ -0,0 +1,23 @@ >> +-----BEGIN CERTIFICATE----- >> +MIID1zCCAr+gAwIBAgIUDMG7xGGEPj+ABvbflim0PNb/loowDQYJKoZIhvcNAQEL >> +BQAwejELMAkGA1UEBhMCVVMxETAPBgNVBAgMCENvbG9yYWRvMRUwEwYDVQQHDAxG >> +b3J0IENvbGxpbnMxETAPBgNVBAoMCFNuYWtlT2lsMS4wLAYDVQQDDCVTbmFrZU9p >> +bCBUZXN0IEtleSBmb3IgRUZJIFNlY3VyZSBCb290MCAXDTIzMDUxOTIzMTE0NVoY >> +DzIwNTMwNTE3MjMxMTQ1WjB6MQswCQYDVQQGEwJVUzERMA8GA1UECAwIQ29sb3Jh >> +ZG8xFTATBgNVBAcMDEZvcnQgQ29sbGluczERMA8GA1UECgwIU25ha2VPaWwxLjAs >> +BgNVBAMMJVNuYWtlT2lsIFRlc3QgS2V5IGZvciBFRkkgU2VjdXJlIEJvb3QwggEi >> +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIi65d6LmojD5S9q8vE/LI2HHQ >> +boiO5/1KrFVc6kpxD6XdkJwpBoItYIfSls9CPnzvNWOAxR3hIeBd1U/prAPPxvQ1 >> +wuDLMXfWkcGaYHfPnme/YluAjnpuLH1MQcumgOzj5xYBvZZk+RbytX/phH7FW4Tx >> ++L1oBYnsfh3BSE/NTtEEHV1nXAXpa/dvyefWMlrlbwjfM5362lZzM6yrJGcOcWEy >> +I66UYCIVO2Yhe/ZVF5B/tPGtd2oACz11xLeqLPM1WBjlekAG2Zi7UCPIvDCpdn5u >> +Vna2ZRQmJyDDdh0Ja2VMC19dkMd/5nOAI21O+FvYPOkBWYX8f4DzDyVQlmIFAgMB >> +AAGjUzBRMB0GA1UdDgQWBBRjuNXuXfh7mi8I3eTboeYGyFTa2zAfBgNVHSMEGDAW >> +gBRjuNXuXfh7mi8I3eTboeYGyFTa2zAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3 >> +DQEBCwUAA4IBAQBBxlfo6MxBN44mXBIhE/QUbJZ+bo/Vrqv2DIZqOlV5+Sk6KnK8 >> +X9Rz2IJwoqLjB6cW9yInk5P/QS45880K1fDT/lu5/2U64i3l1ZFK75qLDCn4/khF >> +birV2U6LBZpxLe3UvXk3xZMoUPzvT2rhrsf78G0pSmAnP8li8Co8F6hTjQzB8IgC >> +DpYVATCoWBH6GhudtjUp+CJSyGApdL+HKX6i6oD7vutvWYBf0Hx5r1NrqIv31Y4V >> +bhwvK5zajFamj/VYeVy7/roqD06hNF1ImhsuBOqoJlKu+cHMGN9DOJqjGup1T9aI >> +2dpEOK5vbKXFrox/yCLgXmUkdwZ3BK4lcxCq >> +-----END CERTIFICATE----- >> diff --git a/recipes-devtools/swupdate-certificates/files/forky >> b/recipes-devtools/swupdate-certificates/files/forky >> new file mode 120000 >> index 0000000..2719d00 >> --- /dev/null >> +++ b/recipes-devtools/swupdate-certificates/files/forky >> @@ -0,0 +1 @@ >> +../../secure-boot-secrets/files/forky >> \ No newline at end of file >> diff --git a/start-qemu.sh b/start-qemu.sh >> index d12fa23..0b783d6 100755 >> --- a/start-qemu.sh >> +++ b/start-qemu.sh >> @@ -47,6 +47,8 @@ if [ -z "${DISTRO_RELEASE}" ]; then >> DISTRO_RELEASE="trixie" >> elif grep -s -q "DEBIAN_SID: true" .config.yaml; then >> DISTRO_RELEASE="sid" >> + elif grep -s -q "DEBIAN_FORKY: true" .config.yaml; then >> + DISTRO_RELEASE="forky" > > ..and here. Ok. Thanks & Regards Shivanand K [-- Attachment #2: Type: text/html, Size: 8888 bytes --] ^ permalink raw reply [flat|nested] 7+ messages in thread
* [isar-cip-core][PATCH v1 2/2] Enable CI image build and test support for forky 2026-07-27 14:11 [isar-cip-core][PATCH v1 0/2] Enable debian forky builds & tests Shivanand.Kunijadar 2026-07-27 14:11 ` [isar-cip-core][PATCH v1 1/2] Enable the support of Debian forky based builds Shivanand.Kunijadar @ 2026-07-27 14:11 ` Shivanand.Kunijadar 2026-07-27 17:10 ` Jan Kiszka 1 sibling, 1 reply; 7+ messages in thread From: Shivanand.Kunijadar @ 2026-07-27 14:11 UTC (permalink / raw) To: cip-dev, jan.kiszka Cc: Shivanand Kunijadar, kumar.dinesh.h95, kazuhiro.hayashi.f74 From: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> Keep these jobs as scheduled and can be scheduled to run every week just to monitor and fix if there are any issues. Also set allow_failure:true for these jobs as forky is not officially released and there will always be some build & test issues. Signed-off-by: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> --- .gitlab-ci.yml | 93 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 93 insertions(+) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index b53def4..977ae01 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -64,6 +64,7 @@ default: - if [ "${release}" = "bookworm" ]; then base_yaml="${base_yaml}:kas/opt/bookworm.yml"; fi - if [ "${release}" = "trixie" ]; then base_yaml="${base_yaml}:kas/opt/trixie.yml"; fi - if [ "${release}" = "sid" ]; then base_yaml="${base_yaml}:kas/opt/sid.yml"; fi + - if [ "${release}" = "forky" ]; then base_yaml="${base_yaml}:kas/opt/forky.yml"; fi - if [ "${encrypt}" = "enable" ]; then base_yaml="${base_yaml}:kas/opt/encrypt-data.yml"; fi - if [ "${factory_reset}" = "enable" ]; then base_yaml="${base_yaml}:kas/opt/factory-reset.yml"; fi - if [ "${watchdog}" = "disable" ]; then base_yaml="${base_yaml}:kas/opt/disable-watchdog.yml"; fi @@ -399,6 +400,57 @@ build:qemu-arm-base-sid: separate_home_partition: enable deploy: enable +# forky image builds +.build_base_forky: + extends: + - .build_base + rules: + - if: $CI_COMMIT_TAG + when: never + - if: '$CI_PIPELINE_SOURCE == "schedule" && $CI_RUN_UNSTABLE_FORKY' + - if: $CI_COMMIT_BRANCH != "master" + when: never + allow_failure: true + +build:qemu-amd64-base-forky: + extends: + - .build_base_forky + variables: + target: qemu-amd64 + use_rt: disable + release: forky + extension: security + security_test: enable + build_updates: enable + separate_home_partition: enable + deploy: enable + +build:qemu-arm64-base-forky: + extends: + - .build_base_forky + variables: + target: qemu-arm64 + use_rt: disable + release: forky + extension: security + security_test: enable + build_updates: enable + separate_home_partition: enable + deploy: enable + +build:qemu-arm-base-forky: + extends: + - .build_base_forky + variables: + target: qemu-arm + extension: security + security_test: enable + use_rt: disable + release: forky + build_updates: enable + separate_home_partition: enable + deploy: enable + .test-cip-core: stage: test image: $CI_REGISTRY_IMAGE/lavacli @@ -764,6 +816,47 @@ test:qemu-arm-IEC-sid: test_function: IEC iec_test_timeout: 40 +# Tests for forky images +.test-cip-core-forky: + extends: + - .test-cip-core + rules: + - if: $CI_COMMIT_TAG + when: never + - if: '$CI_PIPELINE_SOURCE == "schedule" && $CI_RUN_UNSTABLE_FORKY' + - if: $CI_COMMIT_BRANCH != "master" + when: never + allow_failure: true + +test:qemu-amd64-IEC-forky: + extends: + - .test-cip-core-forky + variables: + target: qemu-amd64 + release: forky + test_function: IEC + iec_test_timeout: 40 + +test:qemu-arm64-IEC-forky: + extends: + - .test-cip-core-forky + needs: ["build:qemu-arm64-base-forky"] + variables: + target: qemu-arm64 + release: forky + test_function: IEC + iec_test_timeout: 40 + +test:qemu-arm-IEC-forky: + extends: + - .test-cip-core-forky + needs: ["build:qemu-arm-base-forky"] + variables: + target: qemu-arm + release: forky + test_function: IEC + iec_test_timeout: 40 + cve-checks: stage: cve-check needs: [] -- 2.39.5 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [isar-cip-core][PATCH v1 2/2] Enable CI image build and test support for forky 2026-07-27 14:11 ` [isar-cip-core][PATCH v1 2/2] Enable CI image build and test support for forky Shivanand.Kunijadar @ 2026-07-27 17:10 ` Jan Kiszka 2026-07-28 5:47 ` Kunijadar Shivanand 0 siblings, 1 reply; 7+ messages in thread From: Jan Kiszka @ 2026-07-27 17:10 UTC (permalink / raw) To: Shivanand.Kunijadar, cip-dev; +Cc: kumar.dinesh.h95, kazuhiro.hayashi.f74 On 27.07.26 16:11, Shivanand.Kunijadar@toshiba-tsip.com wrote: > From: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> > > Keep these jobs as scheduled and can be scheduled to run every week > just to monitor and fix if there are any issues. > Also set allow_failure:true for these jobs as forky is not officially > released and there will always be some build & test issues. > > Signed-off-by: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> > --- > .gitlab-ci.yml | 93 ++++++++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 93 insertions(+) > > diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml > index b53def4..977ae01 100644 > --- a/.gitlab-ci.yml > +++ b/.gitlab-ci.yml > @@ -64,6 +64,7 @@ default: > - if [ "${release}" = "bookworm" ]; then base_yaml="${base_yaml}:kas/opt/bookworm.yml"; fi > - if [ "${release}" = "trixie" ]; then base_yaml="${base_yaml}:kas/opt/trixie.yml"; fi > - if [ "${release}" = "sid" ]; then base_yaml="${base_yaml}:kas/opt/sid.yml"; fi > + - if [ "${release}" = "forky" ]; then base_yaml="${base_yaml}:kas/opt/forky.yml"; fi ordering > - if [ "${encrypt}" = "enable" ]; then base_yaml="${base_yaml}:kas/opt/encrypt-data.yml"; fi > - if [ "${factory_reset}" = "enable" ]; then base_yaml="${base_yaml}:kas/opt/factory-reset.yml"; fi > - if [ "${watchdog}" = "disable" ]; then base_yaml="${base_yaml}:kas/opt/disable-watchdog.yml"; fi > @@ -399,6 +400,57 @@ build:qemu-arm-base-sid: > separate_home_partition: enable > deploy: enable > > +# forky image builds > +.build_base_forky: > + extends: > + - .build_base > + rules: > + - if: $CI_COMMIT_TAG > + when: never > + - if: '$CI_PIPELINE_SOURCE == "schedule" && $CI_RUN_UNSTABLE_FORKY' We should handle forky and sid identical for now, thus should likely use generic CI_RUN_UNSTABLE for both. Forky can then be moved out of this mode somewhere next year and become another regular test target in the pipeline, sid will always remain there. > + - if: $CI_COMMIT_BRANCH != "master" > + when: never > + allow_failure: true > + > +build:qemu-amd64-base-forky: > + extends: > + - .build_base_forky > + variables: > + target: qemu-amd64 > + use_rt: disable > + release: forky > + extension: security > + security_test: enable > + build_updates: enable > + separate_home_partition: enable > + deploy: enable > + > +build:qemu-arm64-base-forky: > + extends: > + - .build_base_forky > + variables: > + target: qemu-arm64 > + use_rt: disable > + release: forky > + extension: security > + security_test: enable > + build_updates: enable > + separate_home_partition: enable > + deploy: enable > + > +build:qemu-arm-base-forky: > + extends: > + - .build_base_forky > + variables: > + target: qemu-arm > + extension: security > + security_test: enable > + use_rt: disable > + release: forky > + build_updates: enable > + separate_home_partition: enable > + deploy: enable > + > .test-cip-core: > stage: test > image: $CI_REGISTRY_IMAGE/lavacli > @@ -764,6 +816,47 @@ test:qemu-arm-IEC-sid: > test_function: IEC > iec_test_timeout: 40 > > +# Tests for forky images > +.test-cip-core-forky: > + extends: > + - .test-cip-core > + rules: > + - if: $CI_COMMIT_TAG > + when: never > + - if: '$CI_PIPELINE_SOURCE == "schedule" && $CI_RUN_UNSTABLE_FORKY' > + - if: $CI_COMMIT_BRANCH != "master" > + when: never > + allow_failure: true > + > +test:qemu-amd64-IEC-forky: > + extends: > + - .test-cip-core-forky > + variables: > + target: qemu-amd64 > + release: forky > + test_function: IEC > + iec_test_timeout: 40 > + > +test:qemu-arm64-IEC-forky: > + extends: > + - .test-cip-core-forky > + needs: ["build:qemu-arm64-base-forky"] > + variables: > + target: qemu-arm64 > + release: forky > + test_function: IEC > + iec_test_timeout: 40 > + > +test:qemu-arm-IEC-forky: > + extends: > + - .test-cip-core-forky > + needs: ["build:qemu-arm-base-forky"] > + variables: > + target: qemu-arm > + release: forky > + test_function: IEC > + iec_test_timeout: 40 > + > cve-checks: > stage: cve-check > needs: [] I'm still wondering what the added value of testing sid for us is. I would rather consider to invest our CI time into running more tests with forky, like some more SWUpdate checks and/or reproducibility. Jan -- Siemens AG, Foundational Technologies Linux Expert Center ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [isar-cip-core][PATCH v1 2/2] Enable CI image build and test support for forky 2026-07-27 17:10 ` Jan Kiszka @ 2026-07-28 5:47 ` Kunijadar Shivanand 0 siblings, 0 replies; 7+ messages in thread From: Kunijadar Shivanand @ 2026-07-28 5:47 UTC (permalink / raw) To: cip-dev [-- Attachment #1: Type: text/plain, Size: 5248 bytes --] On Mon, Jul 27, 2026 at 10:10 AM, Jan Kiszka wrote: > > On 27.07.26 16:11, Shivanand.Kunijadar@toshiba-tsip.com wrote: > >> From: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> >> >> Keep these jobs as scheduled and can be scheduled to run every week >> just to monitor and fix if there are any issues. >> Also set allow_failure:true for these jobs as forky is not officially >> released and there will always be some build & test issues. >> >> Signed-off-by: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com> >> --- >> .gitlab-ci.yml | 93 ++++++++++++++++++++++++++++++++++++++++++++++++++ >> 1 file changed, 93 insertions(+) >> >> diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml >> index b53def4..977ae01 100644 >> --- a/.gitlab-ci.yml >> +++ b/.gitlab-ci.yml >> @@ -64,6 +64,7 @@ default: >> - if [ "${release}" = "bookworm" ]; then >> base_yaml="${base_yaml}:kas/opt/bookworm.yml"; fi >> - if [ "${release}" = "trixie" ]; then >> base_yaml="${base_yaml}:kas/opt/trixie.yml"; fi >> - if [ "${release}" = "sid" ]; then >> base_yaml="${base_yaml}:kas/opt/sid.yml"; fi >> + - if [ "${release}" = "forky" ]; then >> base_yaml="${base_yaml}:kas/opt/forky.yml"; fi > > ordering Thanks, I'll fix it. > > >> - if [ "${encrypt}" = "enable" ]; then >> base_yaml="${base_yaml}:kas/opt/encrypt-data.yml"; fi >> - if [ "${factory_reset}" = "enable" ]; then >> base_yaml="${base_yaml}:kas/opt/factory-reset.yml"; fi >> - if [ "${watchdog}" = "disable" ]; then >> base_yaml="${base_yaml}:kas/opt/disable-watchdog.yml"; fi >> @@ -399,6 +400,57 @@ build:qemu-arm-base-sid: >> separate_home_partition: enable >> deploy: enable >> >> +# forky image builds >> +.build_base_forky: >> + extends: >> + - .build_base >> + rules: >> + - if: $CI_COMMIT_TAG >> + when: never >> + - if: '$CI_PIPELINE_SOURCE == "schedule" && $CI_RUN_UNSTABLE_FORKY' > > We should handle forky and sid identical for now, thus should likely use > generic CI_RUN_UNSTABLE for both. Forky can then be moved out of this > mode somewhere next year and become another regular test target in the > pipeline, sid will always remain there. Sure, will change it to CI_RUN_UNSTABLE for both forky & sid. > > >> + - if: $CI_COMMIT_BRANCH != "master" >> + when: never >> + allow_failure: true >> + >> +build:qemu-amd64-base-forky: >> + extends: >> + - .build_base_forky >> + variables: >> + target: qemu-amd64 >> + use_rt: disable >> + release: forky >> + extension: security >> + security_test: enable >> + build_updates: enable >> + separate_home_partition: enable >> + deploy: enable >> + >> +build:qemu-arm64-base-forky: >> + extends: >> + - .build_base_forky >> + variables: >> + target: qemu-arm64 >> + use_rt: disable >> + release: forky >> + extension: security >> + security_test: enable >> + build_updates: enable >> + separate_home_partition: enable >> + deploy: enable >> + >> +build:qemu-arm-base-forky: >> + extends: >> + - .build_base_forky >> + variables: >> + target: qemu-arm >> + extension: security >> + security_test: enable >> + use_rt: disable >> + release: forky >> + build_updates: enable >> + separate_home_partition: enable >> + deploy: enable >> + >> .test-cip-core: >> stage: test >> image: $CI_REGISTRY_IMAGE/lavacli >> @@ -764,6 +816,47 @@ test:qemu-arm-IEC-sid: >> test_function: IEC >> iec_test_timeout: 40 >> >> +# Tests for forky images >> +.test-cip-core-forky: >> + extends: >> + - .test-cip-core >> + rules: >> + - if: $CI_COMMIT_TAG >> + when: never >> + - if: '$CI_PIPELINE_SOURCE == "schedule" && $CI_RUN_UNSTABLE_FORKY' >> + - if: $CI_COMMIT_BRANCH != "master" >> + when: never >> + allow_failure: true >> + >> +test:qemu-amd64-IEC-forky: >> + extends: >> + - .test-cip-core-forky >> + variables: >> + target: qemu-amd64 >> + release: forky >> + test_function: IEC >> + iec_test_timeout: 40 >> + >> +test:qemu-arm64-IEC-forky: >> + extends: >> + - .test-cip-core-forky >> + needs: ["build:qemu-arm64-base-forky"] >> + variables: >> + target: qemu-arm64 >> + release: forky >> + test_function: IEC >> + iec_test_timeout: 40 >> + >> +test:qemu-arm-IEC-forky: >> + extends: >> + - .test-cip-core-forky >> + needs: ["build:qemu-arm-base-forky"] >> + variables: >> + target: qemu-arm >> + release: forky >> + test_function: IEC >> + iec_test_timeout: 40 >> + >> cve-checks: >> stage: cve-check >> needs: [] > > I'm still wondering what the added value of testing sid for us is. I > would rather consider to invest our CI time into running more tests with > forky, like some more SWUpdate checks and/or reproducibility. Understood, we can add more tests like SWUpdate, secure boot and RB builds for forky. I will include them in v2 patch. considering the value of testing for sid, - The latest updates/fixes to any package will appear in sid before forky. As a community we can test early and report issues and also contribute to Debian to fix the issues if required. please note we have only minimal tests for sid now and also running it weekly. if required we can still remove the sid testing from CI, kindly let me know. Thanks & Regards Shivanand K [-- Attachment #2: Type: text/html, Size: 5720 bytes --] ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-07-28 5:47 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-07-27 14:11 [isar-cip-core][PATCH v1 0/2] Enable debian forky builds & tests Shivanand.Kunijadar 2026-07-27 14:11 ` [isar-cip-core][PATCH v1 1/2] Enable the support of Debian forky based builds Shivanand.Kunijadar 2026-07-27 17:04 ` Jan Kiszka 2026-07-28 4:54 ` Kunijadar Shivanand 2026-07-27 14:11 ` [isar-cip-core][PATCH v1 2/2] Enable CI image build and test support for forky Shivanand.Kunijadar 2026-07-27 17:10 ` Jan Kiszka 2026-07-28 5:47 ` Kunijadar Shivanand
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox