| Message ID | c6ab307ddf903298d2fe23ad93b1e6a251ecc6b1.1730977077.git.jan.kiszka@siemens.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | Enable early Debian trixie support, drop sid | expand |
On 11/7/24 11:57, Jan Kiszka wrote: > From: Jan Kiszka <jan.kiszka@siemens.com> > > Under the assumption that future versions of Debian will deliver us the > needed versions of SWUpdate, this eases to opt-in for self-building. > Do we need some additional logic for SWU_SIGNED = 0? As swupdate from trixie requires signed updates? Quirin > Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> > --- > recipes-core/images/swupdate.inc | 10 +++++++--- > 1 file changed, 7 insertions(+), 3 deletions(-) > > diff --git a/recipes-core/images/swupdate.inc b/recipes-core/images/swupdate.inc > index 96994b5c..b1cad439 100644 > --- a/recipes-core/images/swupdate.inc > +++ b/recipes-core/images/swupdate.inc > @@ -17,9 +17,13 @@ SWU_HW_COMPAT ?= "cip-core-1.0" > IMAGER_BUILD_DEPS:swu += "${@'swupdate-signer' if bb.utils.to_boolean(d.getVar('SWU_SIGNED')) else ''}" > IMAGER_INSTALL:swu += "${@'swupdate-signer' if bb.utils.to_boolean(d.getVar('SWU_SIGNED')) else ''}" > IMAGE_INSTALL += "${@'swupdate-certificates' if bb.utils.to_boolean(d.getVar('SWU_SIGNED')) else ''}" > -IMAGE_INSTALL += " swupdate" > > -IMAGE_INSTALL:remove:sid = "swupdate" > -IMAGE_PREINSTALL:append:sid = " swupdate" > +SWUPDATE_SELFBUILT ?= "0" > +SWUPDATE_SELFBUILT:buster = "1" > +SWUPDATE_SELFBUILT:bullseye = "1" > +SWUPDATE_SELFBUILT:bookworm = "1" > + > +IMAGE_INSTALL:append = "${@' swupdate' if bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) else ''}" > +IMAGE_PREINSTALL:append = "${@'' if bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) else ' swupdate'}" > > IMAGE_INSTALL += " swupdate-handler-roundrobin"
On 07.11.24 12:30, Quirin Gylstorff wrote: > > > On 11/7/24 11:57, Jan Kiszka wrote: >> From: Jan Kiszka <jan.kiszka@siemens.com> >> >> Under the assumption that future versions of Debian will deliver us the >> needed versions of SWUpdate, this eases to opt-in for self-building. >> > Do we need some additional logic for SWU_SIGNED = 0? As swupdate from > trixie requires signed updates? You mean we must enforce SWU_SIGNED = 1 from trixie onward? Jan > >> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> >> --- >> recipes-core/images/swupdate.inc | 10 +++++++--- >> 1 file changed, 7 insertions(+), 3 deletions(-) >> >> diff --git a/recipes-core/images/swupdate.inc b/recipes-core/images/ >> swupdate.inc >> index 96994b5c..b1cad439 100644 >> --- a/recipes-core/images/swupdate.inc >> +++ b/recipes-core/images/swupdate.inc >> @@ -17,9 +17,13 @@ SWU_HW_COMPAT ?= "cip-core-1.0" >> IMAGER_BUILD_DEPS:swu += "${@'swupdate-signer' if >> bb.utils.to_boolean(d.getVar('SWU_SIGNED')) else ''}" >> IMAGER_INSTALL:swu += "${@'swupdate-signer' if >> bb.utils.to_boolean(d.getVar('SWU_SIGNED')) else ''}" >> IMAGE_INSTALL += "${@'swupdate-certificates' if >> bb.utils.to_boolean(d.getVar('SWU_SIGNED')) else ''}" >> -IMAGE_INSTALL += " swupdate" >> -IMAGE_INSTALL:remove:sid = "swupdate" >> -IMAGE_PREINSTALL:append:sid = " swupdate" >> +SWUPDATE_SELFBUILT ?= "0" >> +SWUPDATE_SELFBUILT:buster = "1" >> +SWUPDATE_SELFBUILT:bullseye = "1" >> +SWUPDATE_SELFBUILT:bookworm = "1" >> + >> +IMAGE_INSTALL:append = "${@' swupdate' if >> bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) else ''}" >> +IMAGE_PREINSTALL:append = "${@'' if >> bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) else ' swupdate'}" >> IMAGE_INSTALL += " swupdate-handler-roundrobin" >
On 07.11.24 13:11, Jan Kiszka wrote: > On 07.11.24 12:30, Quirin Gylstorff wrote: >> >> >> On 11/7/24 11:57, Jan Kiszka wrote: >>> From: Jan Kiszka <jan.kiszka@siemens.com> >>> >>> Under the assumption that future versions of Debian will deliver us the >>> needed versions of SWUpdate, this eases to opt-in for self-building. >>> >> Do we need some additional logic for SWU_SIGNED = 0? As swupdate from >> trixie requires signed updates? > > You mean we must enforce SWU_SIGNED = 1 from trixie onward? > ... or do you rather mean we should switch back to self-building if someone selected SWU_SIGNED = 0? The latter comes with the risk that self-building for >= trixie could quickly become untested and start to silently break. Jan
On 11/7/24 13:17, Jan Kiszka wrote: > On 07.11.24 13:11, Jan Kiszka wrote: >> On 07.11.24 12:30, Quirin Gylstorff wrote: >>> >>> >>> On 11/7/24 11:57, Jan Kiszka wrote: >>>> From: Jan Kiszka <jan.kiszka@siemens.com> >>>> >>>> Under the assumption that future versions of Debian will deliver us the >>>> needed versions of SWUpdate, this eases to opt-in for self-building. >>>> >>> Do we need some additional logic for SWU_SIGNED = 0? As swupdate from >>> trixie requires signed updates? >> >> You mean we must enforce SWU_SIGNED = 1 from trixie onward? >> > > ... or do you rather mean we should switch back to self-building if > someone selected SWU_SIGNED = 0? The latter comes with the risk that > self-building for >= trixie could quickly become untested and start to > silently break. I think documenting it would be enough as SWU_SIGNED = 1 is already the default. If you want to deactivate signing you would need to set SWU_SIGNED = 0 and activate self-building. Quirin > > Jan >
On 07.11.24 13:33, Quirin Gylstorff wrote: > > > On 11/7/24 13:17, Jan Kiszka wrote: >> On 07.11.24 13:11, Jan Kiszka wrote: >>> On 07.11.24 12:30, Quirin Gylstorff wrote: >>>> >>>> >>>> On 11/7/24 11:57, Jan Kiszka wrote: >>>>> From: Jan Kiszka <jan.kiszka@siemens.com> >>>>> >>>>> Under the assumption that future versions of Debian will deliver us >>>>> the >>>>> needed versions of SWUpdate, this eases to opt-in for self-building. >>>>> >>>> Do we need some additional logic for SWU_SIGNED = 0? As swupdate from >>>> trixie requires signed updates? >>> >>> You mean we must enforce SWU_SIGNED = 1 from trixie onward? >>> >> >> ... or do you rather mean we should switch back to self-building if >> someone selected SWU_SIGNED = 0? The latter comes with the risk that >> self-building for >= trixie could quickly become untested and start to >> silently break. > I think documenting it would be enough as SWU_SIGNED = 1 is already the > default. If you want to deactivate signing you would need to set > SWU_SIGNED = 0 and activate self-building. But what should be documented? These are just the technical steps. If those are not part of any test set, things will eventually break - in the best case already when trying to build. I'm rather inclined to deny self-building on >bookworm until we have a concrete need and cover that via testing as well. Jan
On 11/7/24 13:53, Jan Kiszka wrote: > On 07.11.24 13:33, Quirin Gylstorff wrote: >> >> >> On 11/7/24 13:17, Jan Kiszka wrote: >>> On 07.11.24 13:11, Jan Kiszka wrote: >>>> On 07.11.24 12:30, Quirin Gylstorff wrote: >>>>> >>>>> >>>>> On 11/7/24 11:57, Jan Kiszka wrote: >>>>>> From: Jan Kiszka <jan.kiszka@siemens.com> >>>>>> >>>>>> Under the assumption that future versions of Debian will deliver us >>>>>> the >>>>>> needed versions of SWUpdate, this eases to opt-in for self-building. >>>>>> >>>>> Do we need some additional logic for SWU_SIGNED = 0? As swupdate from >>>>> trixie requires signed updates? >>>> >>>> You mean we must enforce SWU_SIGNED = 1 from trixie onward? >>>> >>> >>> ... or do you rather mean we should switch back to self-building if >>> someone selected SWU_SIGNED = 0? The latter comes with the risk that >>> self-building for >= trixie could quickly become untested and start to >>> silently break. >> I think documenting it would be enough as SWU_SIGNED = 1 is already the >> default. If you want to deactivate signing you would need to set >> SWU_SIGNED = 0 and activate self-building. > > But what should be documented? These are just the technical steps. If > those are not part of any test set, things will eventually break - in > the best case already when trying to build. > > I'm rather inclined to deny self-building on >bookworm until we have a > concrete need and cover that via testing as well. I concur with deactivating the self-building >bookworm. Quirin > > Jan >
diff --git a/recipes-core/images/swupdate.inc b/recipes-core/images/swupdate.inc index 96994b5c..b1cad439 100644 --- a/recipes-core/images/swupdate.inc +++ b/recipes-core/images/swupdate.inc @@ -17,9 +17,13 @@ SWU_HW_COMPAT ?= "cip-core-1.0" IMAGER_BUILD_DEPS:swu += "${@'swupdate-signer' if bb.utils.to_boolean(d.getVar('SWU_SIGNED')) else ''}" IMAGER_INSTALL:swu += "${@'swupdate-signer' if bb.utils.to_boolean(d.getVar('SWU_SIGNED')) else ''}" IMAGE_INSTALL += "${@'swupdate-certificates' if bb.utils.to_boolean(d.getVar('SWU_SIGNED')) else ''}" -IMAGE_INSTALL += " swupdate" -IMAGE_INSTALL:remove:sid = "swupdate" -IMAGE_PREINSTALL:append:sid = " swupdate" +SWUPDATE_SELFBUILT ?= "0" +SWUPDATE_SELFBUILT:buster = "1" +SWUPDATE_SELFBUILT:bullseye = "1" +SWUPDATE_SELFBUILT:bookworm = "1" + +IMAGE_INSTALL:append = "${@' swupdate' if bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) else ''}" +IMAGE_PREINSTALL:append = "${@'' if bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) else ' swupdate'}" IMAGE_INSTALL += " swupdate-handler-roundrobin"