.gitlab-ci/create-rootfs.sh

   1 #!/bin/bash
   2
   3 set -ex
   4
   5 apt-get -y install --no-install-recommends \
   6     ca-certificates \
   7     initramfs-tools \
   8     libpng16-16 \
   9     strace \
  10     libsensors5 \
  11     libexpat1 \
  12     libdrm2 \
  13     libdrm-nouveau2 \
  14     firmware-qcom-media \
  15     netcat-openbsd \
  16     wget \
  17     xz-utils
  18
  19 if [ -n "$INCLUDE_VK_CTS" ]; then
  20     apt-get install -y libvulkan1
  21 fi
  22
  23 passwd root -d
  24 chsh -s /bin/sh
  25
  26 cat > /init <<EOF
  27 #!/bin/sh
  28 export PS1=lava-shell:
  29 exec sh
  30 EOF
  31 chmod +x  /init
  32
  33 mkdir -p /lib/firmware/rtl_nic
  34 wget https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/rtl_nic/rtl8153a-3.fw -O /lib/firmware/rtl_nic/rtl8153a-3.fw
  35
  36 #######################################################################
  37 # Strip the image to a small minimal system without removing the debian
  38 # toolchain.
  39
  40 # xz compress firmware so it doesn't waste RAM at runtime.  Except db820c's
  41 # GPU firmware, due to using a precompiled kernel without compression support.
  42 find /lib/firmware -type f -print0 | \
  43     grep -vz a530 | \
  44     xargs -0r -P4 -n4 xz -T1 -C crc32
  45 ln -s /lib/firmware/qcom/a530* /lib/firmware/
  46
  47 # Copy timezone file and remove tzdata package
  48 rm -rf /etc/localtime
  49 cp /usr/share/zoneinfo/Etc/UTC /etc/localtime
  50
  51 UNNEEDED_PACKAGES="libfdisk1
  52                    tzdata
  53                    diffutils"
  54
  55 export DEBIAN_FRONTEND=noninteractive
  56
  57 # Removing unused packages
  58 for PACKAGE in ${UNNEEDED_PACKAGES}
  59 do
  60         echo ${PACKAGE}
  61         if ! apt-get remove --purge --yes "${PACKAGE}"
  62         then
  63                 echo "WARNING: ${PACKAGE} isn't installed"
  64         fi
  65 done
  66
  67 apt-get autoremove --yes || true
  68
  69 # Dropping logs
  70 rm -rf /var/log/*
  71
  72 # Dropping documentation, localization, i18n files, etc
  73 rm -rf /usr/share/doc/*
  74 rm -rf /usr/share/locale/*
  75 rm -rf /usr/share/man
  76 rm -rf /usr/share/i18n/*
  77 rm -rf /usr/share/info/*
  78 rm -rf /usr/share/lintian/*
  79 rm -rf /usr/share/common-licenses/*
  80 rm -rf /usr/share/mime/*
  81
  82 # Dropping reportbug scripts
  83 rm -rf /usr/share/bug
  84
  85 # Drop udev hwdb not required on a stripped system
  86 rm -rf /lib/udev/hwdb.bin /lib/udev/hwdb.d/*
  87
  88 # Drop all gconv conversions && binaries
  89 rm -rf usr/bin/iconv
  90 rm -rf usr/sbin/iconvconfig
  91 rm -rf usr/lib/*/gconv/
  92
  93 # Remove libusb database
  94 rm -rf usr/sbin/update-usbids
  95 rm -rf var/lib/usbutils/usb.ids
  96 rm -rf usr/share/misc/usb.ids
  97
  98 #######################################################################
  99 # Crush into a minimal production image to be deployed via some type of image
 100 # updating system.
 101 # IMPORTANT: The Debian system is not longer functional at this point,
 102 # for example, apt and dpkg will stop working
 103
 104 UNNEEDED_PACKAGES="apt libapt-pkg6.0 "\
 105 "ncurses-bin ncurses-base libncursesw6 libncurses6 "\
 106 "perl-base "\
 107 "debconf libdebconfclient0 "\
 108 "e2fsprogs e2fslibs libfdisk1 "\
 109 "insserv "\
 110 "udev "\
 111 "init-system-helpers "\
 112 "bash "\
 113 "cpio "\
 114 "xz-utils "\
 115 "passwd "\
 116 "libsemanage1 libsemanage-common "\
 117 "libsepol1 "\
 118 "gpgv "\
 119 "hostname "\
 120 "adduser "\
 121 "debian-archive-keyring "\
 122
 123 # Removing unneeded packages
 124 for PACKAGE in ${UNNEEDED_PACKAGES}
 125 do
 126         echo "Forcing removal of ${PACKAGE}"
 127         if ! dpkg --purge --force-remove-essential --force-depends "${PACKAGE}"
 128         then
 129                 echo "WARNING: ${PACKAGE} isn't installed"
 130         fi
 131 done
 132
 133 # Show what's left package-wise before dropping dpkg itself
 134 COLUMNS=300 dpkg-query -W --showformat='${Installed-Size;10}\t${Package}\n' | sort -k1,1n
 135
 136 # Drop dpkg
 137 dpkg --purge --force-remove-essential --force-depends  dpkg
 138
 139 # No apt or dpkg, no need for its configuration archives
 140 rm -rf etc/apt
 141 rm -rf etc/dpkg
 142
 143 # Drop directories not part of ostree
 144 # Note that /var needs to exist as ostree bind mounts the deployment /var over
 145 # it
 146 rm -rf var/* opt srv share
 147
 148 # ca-certificates are in /etc drop the source
 149 rm -rf usr/share/ca-certificates
 150
 151 # No bash, no need for completions
 152 rm -rf usr/share/bash-completion
 153
 154 # No zsh, no need for comletions
 155 rm -rf usr/share/zsh/vendor-completions
 156
 157 # drop gcc-6 python helpers
 158 rm -rf usr/share/gcc-6
 159
 160 # Drop sysvinit leftovers
 161 rm -rf etc/init.d
 162 rm -rf etc/rc[0-6S].d
 163
 164 # Drop upstart helpers
 165 rm -rf etc/init
 166
 167 # Various xtables helpers
 168 rm -rf usr/lib/xtables
 169
 170 # Drop all locales
 171 # TODO: only remaining locale is actually "C". Should we really remove it?
 172 rm -rf usr/lib/locale/*
 173
 174 # partition helpers
 175 rm -rf usr/sbin/*fdisk
 176
 177 # local compiler
 178 rm -rf usr/bin/localedef
 179
 180 # Systemd dns resolver
 181 find usr etc -name '*systemd-resolve*' -prune -exec rm -r {} \;
 182
 183 # Systemd network configuration
 184 find usr etc -name '*networkd*' -prune -exec rm -r {} \;
 185
 186 # systemd ntp client
 187 find usr etc -name '*timesyncd*' -prune -exec rm -r {} \;
 188
 189 # systemd hw database manager
 190 find usr etc -name '*systemd-hwdb*' -prune -exec rm -r {} \;
 191
 192 # No need for fuse
 193 find usr etc -name '*fuse*' -prune -exec rm -r {} \;
 194
 195 # lsb init function leftovers
 196 rm -rf usr/lib/lsb
 197
 198 # Only needed when adding libraries
 199 rm -rf usr/sbin/ldconfig*
 200
 201 # Games, unused
 202 rmdir usr/games
 203
 204 # Remove pam module to authenticate against a DB
 205 # plus libdb-5.3.so that is only used by this pam module
 206 rm -rf usr/lib/*/security/pam_userdb.so
 207 rm -rf usr/lib/*/libdb-5.3.so
 208
 209 # remove NSS support for nis, nisplus and hesiod
 210 rm -rf usr/lib/*/libnss_hesiod*
 211 rm -rf usr/lib/*/libnss_nis*