[isar-cip-core,10/9] swupdate: Perform checks for supported configurations

Commit Message

Jan Kiszka Nov. 7, 2024, 5:31 p.m. UTC

From: Jan Kiszka <[e-mail]>

The upcoming trixie release is currently containing everything we need
from SWUpdate, so we are retiring the self-building option from that
release on - until someone comes up with a valid use case to restore it.
This happens to avoid exposing a configuration that is technically
selectable but became silently broken due to being effectively unused.

The Debian package enforces SWU signing. Therefore warn if a user
configures this out while using the upstream package.

Signed-off-by: Jan Kiszka <[e-mail]>
---
 recipes-core/images/swupdate.inc | 11 +++++++++++
 1 file changed, 11 insertions(+)

Patch

diff --git a/recipes-core/images/swupdate.inc b/recipes-core/images/swupdate.inc
index b1cad439..81c33658 100644
--- a/recipes-core/images/swupdate.inc
+++ b/recipes-core/images/swupdate.inc
@@ -23,6 +23,17 @@  SWUPDATE_SELFBUILT:buster = "1"
 SWUPDATE_SELFBUILT:bullseye = "1"
 SWUPDATE_SELFBUILT:bookworm = "1"
 
+python() {
+    base_distro = d.getVar('BASE_DISTRO_CODENAME')
+    if base_distro not in ['buster', 'bullseye', 'bookworm'] and \
+       bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')):
+        bb.fatal(f'Self-built SWUpdate not supported for {base_distro}')
+
+    if not bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) and \
+       not bb.utils.to_boolean(d.getVar('SWU_SIGNED')):
+        bb.fatal('SWUpdate from Debian requires signed SWUs')
+}
+
 IMAGE_INSTALL:append = "${@' swupdate' if bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) else ''}"
 IMAGE_PREINSTALL:append = "${@'' if bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) else ' swupdate'}"