.gitlab-ci/create-rootfs.sh

   1 #!/bin/bash
   2
   3 set -ex
   4
   5 apt-get -y install --no-install-recommends \
   6     initramfs-tools \
   7     libpng16-16 \
   8     strace \
   9     libsensors5 \
  10     libexpat1 \
  11     libdrm2 \
  12     libdrm-nouveau2 \
  13     firmware-qcom-media \
  14     firmware-realtek \
  15     wget \
  16     xz-utils
  17 passwd root -d
  18 chsh -s /bin/sh
  19
  20 cat > /init <<EOF
  21 #!/bin/sh
  22 export PS1=lava-shell:
  23 exec sh
  24 EOF
  25 chmod +x  /init
  26
  27 #######################################################################
  28 # Strip the image to a small minimal system without removing the debian
  29 # toolchain.
  30
  31 # xz compress firmware so it doesn't waste RAM at runtime.
  32 find /lib/firmware -type f -print0 | xargs -0r -P4 -n4 xz -T1 -C crc32
  33
  34 # Copy timezone file and remove tzdata package
  35 rm -rf /etc/localtime
  36 cp /usr/share/zoneinfo/Etc/UTC /etc/localtime
  37
  38 UNNEEDED_PACKAGES="libfdisk1
  39                    tzdata
  40                    diffutils"
  41
  42 export DEBIAN_FRONTEND=noninteractive
  43
  44 # Removing unused packages
  45 for PACKAGE in ${UNNEEDED_PACKAGES}
  46 do
  47         echo ${PACKAGE}
  48         if ! apt-get remove --purge --yes "${PACKAGE}"
  49         then
  50                 echo "WARNING: ${PACKAGE} isn't installed"
  51         fi
  52 done
  53
  54 apt-get autoremove --yes || true
  55
  56 # Dropping logs
  57 rm -rf /var/log/*
  58
  59 # Dropping documentation, localization, i18n files, etc
  60 rm -rf /usr/share/doc/*
  61 rm -rf /usr/share/locale/*
  62 rm -rf /usr/share/man
  63 rm -rf /usr/share/i18n/*
  64 rm -rf /usr/share/info/*
  65 rm -rf /usr/share/lintian/*
  66 rm -rf /usr/share/common-licenses/*
  67 rm -rf /usr/share/mime/*
  68
  69 # Dropping reportbug scripts
  70 rm -rf /usr/share/bug
  71
  72 # Drop udev hwdb not required on a stripped system
  73 rm -rf /lib/udev/hwdb.bin /lib/udev/hwdb.d/*
  74
  75 # Drop all gconv conversions && binaries
  76 rm -rf usr/bin/iconv
  77 rm -rf usr/sbin/iconvconfig
  78 rm -rf usr/lib/*/gconv/
  79
  80 # Remove libusb database
  81 rm -rf usr/sbin/update-usbids
  82 rm -rf var/lib/usbutils/usb.ids
  83 rm -rf usr/share/misc/usb.ids
  84
  85 #######################################################################
  86 # Crush into a minimal production image to be deployed via some type of image
  87 # updating system.
  88 # IMPORTANT: The Debian system is not longer functional at this point,
  89 # for example, apt and dpkg will stop working
  90
  91 UNNEEDED_PACKAGES="apt libapt-pkg5.0 "\
  92 "ncurses-bin ncurses-base libncursesw5 libncurses5 "\
  93 "perl-base "\
  94 "debconf libdebconfclient0 "\
  95 "e2fsprogs e2fslibs libfdisk1 "\
  96 "insserv "\
  97 "udev "\
  98 "init-system-helpers "\
  99 "bash "\
 100 "cpio "\
 101 "xz-utils "\
 102 "passwd "\
 103 "libsemanage1 libsemanage-common "\
 104 "libsepol1 "\
 105 "gpgv "\
 106 "hostname "\
 107 "adduser "\
 108 "debian-archive-keyring "\
 109
 110 # Removing unneeded packages
 111 for PACKAGE in ${UNNEEDED_PACKAGES}
 112 do
 113         echo "Forcing removal of ${PACKAGE}"
 114         if ! dpkg --purge --force-remove-essential --force-depends "${PACKAGE}"
 115         then
 116                 echo "WARNING: ${PACKAGE} isn't installed"
 117         fi
 118 done
 119
 120 # Show what's left package-wise before dropping dpkg itself
 121 COLUMNS=300 dpkg-query -W --showformat='${Installed-Size;10}\t${Package}\n' | sort -k1,1n
 122
 123 # Drop dpkg
 124 dpkg --purge --force-remove-essential --force-depends  dpkg
 125
 126 # No apt or dpkg, no need for its configuration archives
 127 rm -rf etc/apt
 128 rm -rf etc/dpkg
 129
 130 # Drop directories not part of ostree
 131 # Note that /var needs to exist as ostree bind mounts the deployment /var over
 132 # it
 133 rm -rf var/* opt srv share
 134
 135 # ca-certificates are in /etc drop the source
 136 rm -rf usr/share/ca-certificates
 137
 138 # No bash, no need for completions
 139 rm -rf usr/share/bash-completion
 140
 141 # No zsh, no need for comletions
 142 rm -rf usr/share/zsh/vendor-completions
 143
 144 # drop gcc-6 python helpers
 145 rm -rf usr/share/gcc-6
 146
 147 # Drop sysvinit leftovers
 148 rm -rf etc/init.d
 149 rm -rf etc/rc[0-6S].d
 150
 151 # Drop upstart helpers
 152 rm -rf etc/init
 153
 154 # Various xtables helpers
 155 rm -rf usr/lib/xtables
 156
 157 # Drop all locales
 158 # TODO: only remaining locale is actually "C". Should we really remove it?
 159 rm -rf usr/lib/locale/*
 160
 161 # partition helpers
 162 rm usr/sbin/*fdisk
 163
 164 # local compiler
 165 rm usr/bin/localedef
 166
 167 # Systemd dns resolver
 168 find usr etc -name '*systemd-resolve*' -prune -exec rm -r {} \;
 169
 170 # Systemd network configuration
 171 find usr etc -name '*networkd*' -prune -exec rm -r {} \;
 172
 173 # systemd ntp client
 174 find usr etc -name '*timesyncd*' -prune -exec rm -r {} \;
 175
 176 # systemd hw database manager
 177 find usr etc -name '*systemd-hwdb*' -prune -exec rm -r {} \;
 178
 179 # No need for fuse
 180 find usr etc -name '*fuse*' -prune -exec rm -r {} \;
 181
 182 # lsb init function leftovers
 183 rm -rf usr/lib/lsb
 184
 185 # Only needed when adding libraries
 186 rm usr/sbin/ldconfig*
 187
 188 # Games, unused
 189 rmdir usr/games
 190
 191 # Remove pam module to authenticate against a DB
 192 # plus libdb-5.3.so that is only used by this pam module
 193 rm usr/lib/*/security/pam_userdb.so
 194 rm usr/lib/*/libdb-5.3.so
 195
 196 # remove NSS support for nis, nisplus and hesiod
 197 rm usr/lib/*/libnss_hesiod*
 198 rm usr/lib/*/libnss_nis*