[isar-cip-core][PATCH 0/6] EFI Boot Guard 0.10, improvements for start-qemu, kernel update

[isar-cip-core][PATCH 0/6] EFI Boot Guard 0.10, improvements for start-qemu, kernel update

[Jan Kiszka]

See patches for details.

Jan

Jan Kiszka (6):
  ovmf-binaries: Disable sstate caching
  start-qemu: Use Debian's OVMF also for SWUpdate mode
  start-qemu: Update usage
  Add python3-shtab package
  efibootguard: Update to 0.10 release
  linux-cip: Update to 4.19.233-cip69 and 5.10.104-cip3

 kas/opt/ebg-secure-boot-snakeoil.yml          |  4 +--
 kas/opt/efibootguard.yml                      |  3 ++
 ...d_0.9-git+isar.bb => efibootguard_0.10.bb} | 16 ++++-----
 .../files/debian/efibootguard.install         |  3 ++
 .../ovmf-binaries/ovmf-binaries_0.1.bb        |  1 +
 ....231-cip68.bb => linux-cip_4.19.233-cip69} |  4 +--
 ...100-cip2.bb => linux-cip_5.10.104-cip3.bb} |  4 +--
 recipes-python/shtab/files/rules              | 21 +++++++++++
 recipes-python/shtab/python3-shtab_1.4.2.bb   | 35 +++++++++++++++++++
 start-qemu.sh                                 |  8 +++--
 10 files changed, 81 insertions(+), 18 deletions(-)
 rename recipes-bsp/efibootguard/{efibootguard_0.9-git+isar.bb => efibootguard_0.10.bb} (65%)
 mode change 100644 => 100755 recipes-bsp/efibootguard/files/debian/efibootguard.install
 rename recipes-kernel/linux/{linux-cip_4.19.231-cip68.bb => linux-cip_4.19.233-cip69} (60%)
 rename recipes-kernel/linux/{linux-cip_5.10.100-cip2.bb => linux-cip_5.10.104-cip3.bb} (60%)
 create mode 100755 recipes-python/shtab/files/rules
 create mode 100644 recipes-python/shtab/python3-shtab_1.4.2.bb

-- 
2.34.1

[isar-cip-core][PATCH 1/6] ovmf-binaries: Disable sstate caching

[Jan Kiszka]

From: Jan Kiszka <jan.kiszka@siemens.com>

Not compatible with the deployment process with uses content of the
buildchroot. In order to be present there, we need to run the build
unconditionally.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 recipes-devtools/ovmf-binaries/ovmf-binaries_0.1.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/recipes-devtools/ovmf-binaries/ovmf-binaries_0.1.bb b/recipes-devtools/ovmf-binaries/ovmf-binaries_0.1.bb
index 025b970..6524300 100644
--- a/recipes-devtools/ovmf-binaries/ovmf-binaries_0.1.bb
+++ b/recipes-devtools/ovmf-binaries/ovmf-binaries_0.1.bb
@@ -20,6 +20,7 @@ DEBIAN_BUILD_DEPENDS = "ovmf"
 TEMPLATE_FILES = "control.tmpl"
 TEMPLATE_VARS += "PN DEBIAN_DEPENDS MAINTAINER DESCRIPTION DPKG_ARCH DEBIAN_BUILD_DEPENDS"
 
+SSTATETASKS = ""
 
 do_extract_ovmf() {
     install -m 0755 -d ${DEPLOY_DIR_IMAGE}
-- 
2.34.1

[isar-cip-core][PATCH 2/6] start-qemu: Use Debian's OVMF also for SWUpdate mode

[Jan Kiszka]

From: Jan Kiszka <jan.kiszka@siemens.com>

Align the SWUpate case with secure boot, resolving the need to provide
some OVMF.fd locally.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 kas/opt/ebg-secure-boot-snakeoil.yml | 4 ++--
 kas/opt/efibootguard.yml             | 3 +++
 start-qemu.sh                        | 4 +++-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/kas/opt/ebg-secure-boot-snakeoil.yml b/kas/opt/ebg-secure-boot-snakeoil.yml
index 1f4d668..d404df5 100644
--- a/kas/opt/ebg-secure-boot-snakeoil.yml
+++ b/kas/opt/ebg-secure-boot-snakeoil.yml
@@ -28,8 +28,8 @@ local_conf_header:
     WKS_FILE = "${MACHINE}-efibootguard-secureboot.wks.in"
 
   secure-boot: |
-    # Add snakeoil and ovmf binaries for qemu
-    IMAGER_BUILD_DEPS += "ebg-secure-boot-snakeoil ovmf-binaries"
+    # Add snakeoil binaries for qemu
+    IMAGER_BUILD_DEPS += "ebg-secure-boot-snakeoil"
     IMAGER_INSTALL += "ebg-secure-boot-snakeoil"
 
   ovmf: |
diff --git a/kas/opt/efibootguard.yml b/kas/opt/efibootguard.yml
index f5f9169..9624584 100644
--- a/kas/opt/efibootguard.yml
+++ b/kas/opt/efibootguard.yml
@@ -27,3 +27,6 @@ local_conf_header:
     IMAGE_FSTYPES ?= "wic-img"
     WKS_FILE ?= "${MACHINE}-${SWUPDATE_BOOTLOADER}.wks"
 
+  ovmf-binaries: |
+    # Add ovmf binaries for qemu
+    IMAGER_BUILD_DEPS += "ovmf-binaries"
diff --git a/start-qemu.sh b/start-qemu.sh
index b623602..0431906 100755
--- a/start-qemu.sh
+++ b/start-qemu.sh
@@ -133,9 +133,11 @@ if [ -n "${SECURE_BOOT}" ]; then
 			${QEMU_COMMON_OPTIONS} "$@"
 
 elif [ -n "${SWUPDATE_BOOT}" ]; then
+		ovmf_code=${OVMF_CODE:-./build/tmp/deploy/images/qemu-amd64/OVMF/OVMF_CODE_4M.fd}
+
 		${QEMU_PATH}${QEMU} \
 			-drive file=${IMAGE_PREFIX}.wic.img,discard=unmap,if=none,id=disk,format=raw \
-			-bios OVMF.fd \
+			-drive if=pflash,format=raw,unit=0,readonly=on,file=${ovmf_code} \
 			${QEMU_COMMON_OPTIONS} "$@"
 
 else
-- 
2.34.1

[isar-cip-core][PATCH 3/6] start-qemu: Update usage

[Jan Kiszka]

From: Jan Kiszka <jan.kiszka@siemens.com>

Document also SWUPDATE_BOOT mode. Drop the hint to OVMF_* vars because
we use the images taken from the build by default now.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 start-qemu.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/start-qemu.sh b/start-qemu.sh
index 0431906..e986791 100755
--- a/start-qemu.sh
+++ b/start-qemu.sh
@@ -15,8 +15,8 @@ usage()
 	echo "Usage: $0 ARCHITECTURE [QEMU_OPTIONS]"
 	echo -e "\nSet QEMU_PATH environment variable to use a locally " \
 		"built QEMU version"
-	echo -e "\nSet SECURE_BOOT environment variable to boot a secure boot environment " \
-		"This environment also needs the variables OVMF_VARS and OVMF_CODE set"
+	echo -e "\nSet SWUPDATE_BOOT environment variable to boot swupdate image." \
+	echo -e "\nSet SECURE_BOOT environment variable to boot a secure boot environment."
 	exit 1
 }
 
-- 
2.34.1

[isar-cip-core][PATCH 4/6] Add python3-shtab package

[Jan Kiszka]

From: Jan Kiszka <jan.kiszka@siemens.com>

Will be needed for EFI Boot Guard 0.10.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 recipes-python/shtab/files/rules            | 21 +++++++++++++
 recipes-python/shtab/python3-shtab_1.4.2.bb | 35 +++++++++++++++++++++
 2 files changed, 56 insertions(+)
 create mode 100755 recipes-python/shtab/files/rules
 create mode 100644 recipes-python/shtab/python3-shtab_1.4.2.bb

diff --git a/recipes-python/shtab/files/rules b/recipes-python/shtab/files/rules
new file mode 100755
index 0000000..43ba686
--- /dev/null
+++ b/recipes-python/shtab/files/rules
@@ -0,0 +1,21 @@
+#!/usr/bin/make -f
+#
+# Copyright (c) Siemens AG, 2022
+#
+# Authors:
+#  Felix Moessbauer <felix.moessbauer@siemens.com>
+#
+# This file is subject to the terms and conditions of the MIT License.
+# See COPYING.MIT file in the top-level directory.
+#
+
+export DH_VERBOSE=1
+export PYBUILD_VERBOSE=1
+export PYBUILD_NAME=pasta
+
+ifneq ($(filter nocheck,$(DEB_BUILD_PROFILES)),)
+export PYBUILD_DISABLE=test
+endif
+
+%:
+	dh $@ --with python3 --buildsystem=pybuild
diff --git a/recipes-python/shtab/python3-shtab_1.4.2.bb b/recipes-python/shtab/python3-shtab_1.4.2.bb
new file mode 100644
index 0000000..d5bc465
--- /dev/null
+++ b/recipes-python/shtab/python3-shtab_1.4.2.bb
@@ -0,0 +1,35 @@
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2022
+#
+# Authors:
+#  Jan Kiszka <jan.kiszka@siemens.com>
+#
+# SPDX-License-Identifier: MIT
+#
+
+inherit dpkg
+
+SRC_URI = " \
+    https://github.com/iterative/shtab/archive/refs/tags/v1.4.2.tar.gz;downloadfilename=${PN}-${PV}.tar.gz \
+    file://rules \
+    "
+SRC_URI[sha256sum] = "5e6ef745c223ef1a01a2db491a8ec5c02c8291067328b17695c9a44f5b7d6fe6"
+
+S = "${WORKDIR}/shtab-${PV}"
+
+DEBIAN_BUILD_DEPENDS = " \
+    dh-python, \
+    python3-all, \
+    python3-setuptools, \
+    python3-setuptools-scm, \
+    python3-toml, \
+    "
+
+DEB_BUILD_PROFILES = "nocheck"
+
+do_prepare_build[cleandirs] += "${S}/debian"
+do_prepare_build() {
+    deb_debianize
+}
-- 
2.34.1

[isar-cip-core][PATCH v2 4/6] Add python3-shtab package

[Jan Kiszka]

From: Jan Kiszka <jan.kiszka@siemens.com>

Will be needed for EFI Boot Guard 0.10.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---

Changes in v2:
 - make compatible with buster

 ...001-Lower-requirements-on-setuptools.patch | 28 +++++++++++++++
 recipes-python/shtab/files/rules              | 21 +++++++++++
 recipes-python/shtab/python3-shtab_1.4.2.bb   | 35 +++++++++++++++++++
 3 files changed, 84 insertions(+)
 create mode 100644 recipes-python/shtab/files/0001-Lower-requirements-on-setuptools.patch
 create mode 100755 recipes-python/shtab/files/rules
 create mode 100644 recipes-python/shtab/python3-shtab_1.4.2.bb

diff --git a/recipes-python/shtab/files/0001-Lower-requirements-on-setuptools.patch b/recipes-python/shtab/files/0001-Lower-requirements-on-setuptools.patch
new file mode 100644
index 0000000..dccc2dd
--- /dev/null
+++ b/recipes-python/shtab/files/0001-Lower-requirements-on-setuptools.patch
@@ -0,0 +1,28 @@
+From d347695c4b173c94c4d8a678a67947de3ee5f186 Mon Sep 17 00:00:00 2001
+From: Jan Kiszka <jan.kiszka@siemens.com>
+Date: Mon, 14 Mar 2022 08:17:00 +0100
+Subject: [PATCH] Lower requirements on setuptools
+
+Allows to build against Debian buster.
+
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+---
+ setup.cfg | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/setup.cfg b/setup.cfg
+index 55eecd4..186aad6 100644
+--- a/setup.cfg
++++ b/setup.cfg
+@@ -66,7 +66,7 @@ classifiers=
+     Topic :: Terminals
+     Topic :: Utilities
+ [options]
+-setup_requires=setuptools>=42; setuptools_scm[toml]>=3.4
++setup_requires=setuptools>=40; setuptools_scm>=3.2
+ install_requires=
+     argparse; python_version < "2.7" or ("3.0" <= python_version and python_version < "3.2")
+ python_requires= >=2.7, !=3.0.*, !=3.1.*
+-- 
+2.34.1
+
diff --git a/recipes-python/shtab/files/rules b/recipes-python/shtab/files/rules
new file mode 100755
index 0000000..43ba686
--- /dev/null
+++ b/recipes-python/shtab/files/rules
@@ -0,0 +1,21 @@
+#!/usr/bin/make -f
+#
+# Copyright (c) Siemens AG, 2022
+#
+# Authors:
+#  Felix Moessbauer <felix.moessbauer@siemens.com>
+#
+# This file is subject to the terms and conditions of the MIT License.
+# See COPYING.MIT file in the top-level directory.
+#
+
+export DH_VERBOSE=1
+export PYBUILD_VERBOSE=1
+export PYBUILD_NAME=pasta
+
+ifneq ($(filter nocheck,$(DEB_BUILD_PROFILES)),)
+export PYBUILD_DISABLE=test
+endif
+
+%:
+	dh $@ --with python3 --buildsystem=pybuild
diff --git a/recipes-python/shtab/python3-shtab_1.4.2.bb b/recipes-python/shtab/python3-shtab_1.4.2.bb
new file mode 100644
index 0000000..eb5feda
--- /dev/null
+++ b/recipes-python/shtab/python3-shtab_1.4.2.bb
@@ -0,0 +1,35 @@
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2022
+#
+# Authors:
+#  Jan Kiszka <jan.kiszka@siemens.com>
+#
+# SPDX-License-Identifier: MIT
+#
+
+inherit dpkg
+
+SRC_URI = " \
+    https://github.com/iterative/shtab/archive/refs/tags/v1.4.2.tar.gz;downloadfilename=${PN}-${PV}.tar.gz \
+    file://0001-Lower-requirements-on-setuptools.patch \
+    file://rules \
+    "
+SRC_URI[sha256sum] = "5e6ef745c223ef1a01a2db491a8ec5c02c8291067328b17695c9a44f5b7d6fe6"
+
+S = "${WORKDIR}/shtab-${PV}"
+
+DEBIAN_BUILD_DEPENDS = " \
+    dh-python, \
+    python3-all, \
+    python3-setuptools, \
+    python3-setuptools-scm, \
+    "
+
+DEB_BUILD_PROFILES = "nocheck"
+
+do_prepare_build[cleandirs] += "${S}/debian"
+do_prepare_build() {
+    deb_debianize
+}
-- 
2.34.1

[isar-cip-core][PATCH 5/6] efibootguard: Update to 0.10 release

[Jan Kiszka]

From: Jan Kiszka <jan.kiszka@siemens.com>

This brings the locally fulfilled dependency on python3-shtab to provide
bash completion.

Switch to checksum-protected tarball download at this chance.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 ...uard_0.9-git+isar.bb => efibootguard_0.10.bb} | 16 +++++++---------
 .../files/debian/efibootguard.install            |  3 +++
 2 files changed, 10 insertions(+), 9 deletions(-)
 rename recipes-bsp/efibootguard/{efibootguard_0.9-git+isar.bb => efibootguard_0.10.bb} (65%)
 mode change 100644 => 100755 recipes-bsp/efibootguard/files/debian/efibootguard.install

diff --git a/recipes-bsp/efibootguard/efibootguard_0.9-git+isar.bb b/recipes-bsp/efibootguard/efibootguard_0.10.bb
similarity index 65%
rename from recipes-bsp/efibootguard/efibootguard_0.9-git+isar.bb
rename to recipes-bsp/efibootguard/efibootguard_0.10.bb
index 171d8d4..7d09c85 100644
--- a/recipes-bsp/efibootguard/efibootguard_0.9-git+isar.bb
+++ b/recipes-bsp/efibootguard/efibootguard_0.10.bb
@@ -16,18 +16,17 @@ LICENSE = "GPL-2.0"
 LIC_FILES_CHKSUM = "file://${LAYERDIR_isar}/licenses/COPYING.GPLv2;md5=751419260aa954499f7abaabaa882bbe"
 MAINTAINER = "Jan Kiszka <jan.kiszka@siemens.com>"
 
-SRC_URI = "git://github.com/siemens/efibootguard.git;branch=master;protocol=https \
-           file://debian \
-          "
-
-S = "${WORKDIR}/git"
-
-SRCREV = "c01324d0da202727eb0744c0f67a78f9c9b65c46"
+SRC_URI = " \
+    https://github.com/siemens/efibootguard/archive/refs/tags/v${PV}.tar.gz;downloadfilename=efitbootguard-v${PV}.tar.gz \
+    file://debian \
+    "
+SRC_URI[sha256sum] = "4d58574a0bb8f1e56056ab0bcc2487d37e49fa147dc991e719c2ec8e20f88dd3"
 
 PROVIDES = "${PN}"
 PROVIDES += "${PN}-dev"
 
-BUILD_DEB_DEPENDS = "gnu-efi,libpci-dev,check,pkg-config,libc6-dev-i386"
+DEPENDS = "python3-shtab"
+BUILD_DEB_DEPENDS = "dh-exec,gnu-efi,libpci-dev,check,pkg-config,libc6-dev-i386,python3-shtab"
 
 inherit dpkg
 
@@ -38,4 +37,3 @@ do_prepare_build() {
     cp -R ${WORKDIR}/debian ${S}
     deb_add_changelog
 }
-
diff --git a/recipes-bsp/efibootguard/files/debian/efibootguard.install b/recipes-bsp/efibootguard/files/debian/efibootguard.install
old mode 100644
new mode 100755
index 462fc1d..910e153
--- a/recipes-bsp/efibootguard/files/debian/efibootguard.install
+++ b/recipes-bsp/efibootguard/files/debian/efibootguard.install
@@ -1,3 +1,6 @@
+#!/usr/bin/dh-exec
 bg_setenv usr/bin
 bg_printenv usr/bin
 efibootguard*.efi usr/share/efibootguard
+completion/bash/bg_printenv.bash => usr/share/bash-completion/completions/bg_printenv
+completion/bash/bg_setenv.bash => usr/share/bash-completion/completions/bg_setenv
-- 
2.34.1

[isar-cip-core][PATCH 6/6] linux-cip: Update to 4.19.233-cip69 and 5.10.104-cip3

[Jan Kiszka]

From: Jan Kiszka <jan.kiszka@siemens.com>

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 .../{linux-cip_4.19.231-cip68.bb => linux-cip_4.19.233-cip69} | 4 ++--
 ...{linux-cip_5.10.100-cip2.bb => linux-cip_5.10.104-cip3.bb} | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)
 rename recipes-kernel/linux/{linux-cip_4.19.231-cip68.bb => linux-cip_4.19.233-cip69} (60%)
 rename recipes-kernel/linux/{linux-cip_5.10.100-cip2.bb => linux-cip_5.10.104-cip3.bb} (60%)

diff --git a/recipes-kernel/linux/linux-cip_4.19.231-cip68.bb b/recipes-kernel/linux/linux-cip_4.19.233-cip69
similarity index 60%
rename from recipes-kernel/linux/linux-cip_4.19.231-cip68.bb
rename to recipes-kernel/linux/linux-cip_4.19.233-cip69
index 91ef5f6..fcf621e 100644
--- a/recipes-kernel/linux/linux-cip_4.19.231-cip68.bb
+++ b/recipes-kernel/linux/linux-cip_4.19.233-cip69
@@ -1,7 +1,7 @@
 #
 # CIP Core, generic profile
 #
-# Copyright (c) Siemens AG, 2019 - 2021
+# Copyright (c) Siemens AG, 2019-2022
 #
 # Authors:
 #  Jan Kiszka <jan.kiszka@siemens.com>
@@ -13,4 +13,4 @@ require linux-cip-common.inc
 
 KERNEL_DEFCONFIG_VERSION ?= "4.19.y-cip"
 
-SRC_URI[sha256sum] = "f39146555dcee1e9f76c4b6e000e0d6f42d4a6a56d95d415ac1442b1f99d0465"
+SRC_URI[sha256sum] = "cfb579d34e8de9129312426bab3b955bf7ea542156ea4d69748577869abf18cd"
diff --git a/recipes-kernel/linux/linux-cip_5.10.100-cip2.bb b/recipes-kernel/linux/linux-cip_5.10.104-cip3.bb
similarity index 60%
rename from recipes-kernel/linux/linux-cip_5.10.100-cip2.bb
rename to recipes-kernel/linux/linux-cip_5.10.104-cip3.bb
index e2bb298..2c23c6f 100644
--- a/recipes-kernel/linux/linux-cip_5.10.100-cip2.bb
+++ b/recipes-kernel/linux/linux-cip_5.10.104-cip3.bb
@@ -1,7 +1,7 @@
 #
 # CIP Core, generic profile
 #
-# Copyright (c) Siemens AG, 2021
+# Copyright (c) Siemens AG, 2021-2022
 #
 # Authors:
 #  Jan Kiszka <jan.kiszka@siemens.com>
@@ -13,4 +13,4 @@ require linux-cip-common.inc
 
 KERNEL_DEFCONFIG_VERSION ?= "5.10.y-cip"
 
-SRC_URI[sha256sum] = "0fe532c7900299888160a740ed70c1daaa9536fe545bee4f754043e1e0a09c16"
+SRC_URI[sha256sum] = "7c2a9b0d7450f57909e4531b6c4fdc395c865140005596e0e87c9669047b3cb0"
-- 
2.34.1