.gitlab-ci/create-rootfs.sh

   1 #!/bin/bash
   2
   3 set -ex
   4
   5 apt-get -y install --no-install-recommends \
   6     initramfs-tools \
   7     libpng16-16 \
   8     strace \
   9     libsensors5 \
  10     libexpat1 \
  11     libdrm2 \
  12     libdrm-nouveau2 \
  13     firmware-qcom-media \
  14     wget \
  15     xz-utils
  16 passwd root -d
  17 chsh -s /bin/sh
  18
  19 cat > /init <<EOF
  20 #!/bin/sh
  21 export PS1=lava-shell:
  22 exec sh
  23 EOF
  24 chmod +x  /init
  25
  26 mkdir -p /lib/firmware/rtl_nic
  27 wget https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/rtl_nic/rtl8153a-3.fw -O /lib/firmware/rtl_nic/rtl8153a-3.fw
  28
  29 #######################################################################
  30 # Strip the image to a small minimal system without removing the debian
  31 # toolchain.
  32
  33 # xz compress firmware so it doesn't waste RAM at runtime.
  34 find /lib/firmware -type f -print0 | xargs -0r -P4 -n4 xz -T1 -C crc32
  35
  36 # Copy timezone file and remove tzdata package
  37 rm -rf /etc/localtime
  38 cp /usr/share/zoneinfo/Etc/UTC /etc/localtime
  39
  40 UNNEEDED_PACKAGES="libfdisk1
  41                    tzdata
  42                    diffutils"
  43
  44 export DEBIAN_FRONTEND=noninteractive
  45
  46 # Removing unused packages
  47 for PACKAGE in ${UNNEEDED_PACKAGES}
  48 do
  49         echo ${PACKAGE}
  50         if ! apt-get remove --purge --yes "${PACKAGE}"
  51         then
  52                 echo "WARNING: ${PACKAGE} isn't installed"
  53         fi
  54 done
  55
  56 apt-get autoremove --yes || true
  57
  58 # Dropping logs
  59 rm -rf /var/log/*
  60
  61 # Dropping documentation, localization, i18n files, etc
  62 rm -rf /usr/share/doc/*
  63 rm -rf /usr/share/locale/*
  64 rm -rf /usr/share/man
  65 rm -rf /usr/share/i18n/*
  66 rm -rf /usr/share/info/*
  67 rm -rf /usr/share/lintian/*
  68 rm -rf /usr/share/common-licenses/*
  69 rm -rf /usr/share/mime/*
  70
  71 # Dropping reportbug scripts
  72 rm -rf /usr/share/bug
  73
  74 # Drop udev hwdb not required on a stripped system
  75 rm -rf /lib/udev/hwdb.bin /lib/udev/hwdb.d/*
  76
  77 # Drop all gconv conversions && binaries
  78 rm -rf usr/bin/iconv
  79 rm -rf usr/sbin/iconvconfig
  80 rm -rf usr/lib/*/gconv/
  81
  82 # Remove libusb database
  83 rm -rf usr/sbin/update-usbids
  84 rm -rf var/lib/usbutils/usb.ids
  85 rm -rf usr/share/misc/usb.ids
  86
  87 #######################################################################
  88 # Crush into a minimal production image to be deployed via some type of image
  89 # updating system.
  90 # IMPORTANT: The Debian system is not longer functional at this point,
  91 # for example, apt and dpkg will stop working
  92
  93 UNNEEDED_PACKAGES="apt libapt-pkg5.0 "\
  94 "ncurses-bin ncurses-base libncursesw5 libncurses5 "\
  95 "perl-base "\
  96 "debconf libdebconfclient0 "\
  97 "e2fsprogs e2fslibs libfdisk1 "\
  98 "insserv "\
  99 "udev "\
 100 "init-system-helpers "\
 101 "bash "\
 102 "cpio "\
 103 "xz-utils "\
 104 "passwd "\
 105 "libsemanage1 libsemanage-common "\
 106 "libsepol1 "\
 107 "gpgv "\
 108 "hostname "\
 109 "adduser "\
 110 "debian-archive-keyring "\
 111
 112 # Removing unneeded packages
 113 for PACKAGE in ${UNNEEDED_PACKAGES}
 114 do
 115         echo "Forcing removal of ${PACKAGE}"
 116         if ! dpkg --purge --force-remove-essential --force-depends "${PACKAGE}"
 117         then
 118                 echo "WARNING: ${PACKAGE} isn't installed"
 119         fi
 120 done
 121
 122 # Show what's left package-wise before dropping dpkg itself
 123 COLUMNS=300 dpkg-query -W --showformat='${Installed-Size;10}\t${Package}\n' | sort -k1,1n
 124
 125 # Drop dpkg
 126 dpkg --purge --force-remove-essential --force-depends  dpkg
 127
 128 # No apt or dpkg, no need for its configuration archives
 129 rm -rf etc/apt
 130 rm -rf etc/dpkg
 131
 132 # Drop directories not part of ostree
 133 # Note that /var needs to exist as ostree bind mounts the deployment /var over
 134 # it
 135 rm -rf var/* opt srv share
 136
 137 # ca-certificates are in /etc drop the source
 138 rm -rf usr/share/ca-certificates
 139
 140 # No bash, no need for completions
 141 rm -rf usr/share/bash-completion
 142
 143 # No zsh, no need for comletions
 144 rm -rf usr/share/zsh/vendor-completions
 145
 146 # drop gcc-6 python helpers
 147 rm -rf usr/share/gcc-6
 148
 149 # Drop sysvinit leftovers
 150 rm -rf etc/init.d
 151 rm -rf etc/rc[0-6S].d
 152
 153 # Drop upstart helpers
 154 rm -rf etc/init
 155
 156 # Various xtables helpers
 157 rm -rf usr/lib/xtables
 158
 159 # Drop all locales
 160 # TODO: only remaining locale is actually "C". Should we really remove it?
 161 rm -rf usr/lib/locale/*
 162
 163 # partition helpers
 164 rm usr/sbin/*fdisk
 165
 166 # local compiler
 167 rm usr/bin/localedef
 168
 169 # Systemd dns resolver
 170 find usr etc -name '*systemd-resolve*' -prune -exec rm -r {} \;
 171
 172 # Systemd network configuration
 173 find usr etc -name '*networkd*' -prune -exec rm -r {} \;
 174
 175 # systemd ntp client
 176 find usr etc -name '*timesyncd*' -prune -exec rm -r {} \;
 177
 178 # systemd hw database manager
 179 find usr etc -name '*systemd-hwdb*' -prune -exec rm -r {} \;
 180
 181 # No need for fuse
 182 find usr etc -name '*fuse*' -prune -exec rm -r {} \;
 183
 184 # lsb init function leftovers
 185 rm -rf usr/lib/lsb
 186
 187 # Only needed when adding libraries
 188 rm usr/sbin/ldconfig*
 189
 190 # Games, unused
 191 rmdir usr/games
 192
 193 # Remove pam module to authenticate against a DB
 194 # plus libdb-5.3.so that is only used by this pam module
 195 rm usr/lib/*/security/pam_userdb.so
 196 rm usr/lib/*/libdb-5.3.so
 197
 198 # remove NSS support for nis, nisplus and hesiod
 199 rm usr/lib/*/libnss_hesiod*
 200 rm usr/lib/*/libnss_nis*