.gitlab-ci/create-rootfs.sh

   1 #!/bin/bash
   2
   3 set -ex
   4
   5 if [ $DEBIAN_ARCH = arm64 ]; then
   6     ARCH_PACKAGES="firmware-qcom-media"
   7 elif [ $DEBIAN_ARCH = amd64 ]; then
   8     # Upstream LLVM package repository
   9     apt-get -y install --no-install-recommends gnupg ca-certificates
  10     apt-key add /llvm-snapshot.gpg.key
  11     echo "deb https://apt.llvm.org/buster/ llvm-toolchain-buster-9 main" >/etc/apt/sources.list.d/llvm9.list
  12     apt-get update
  13
  14     ARCH_PACKAGES="libelf1
  15                    libllvm9
  16                    libxcb-dri2-0
  17                    libxcb-dri3-0
  18                    libxcb-present0
  19                    libxcb-sync1
  20                    libxcb-xfixes0
  21                    libxshmfence1
  22                    firmware-amd-graphics
  23                   "
  24 fi
  25
  26 apt-get -y install --no-install-recommends \
  27     ca-certificates \
  28     curl \
  29     initramfs-tools \
  30     libpng16-16 \
  31     strace \
  32     libsensors5 \
  33     libexpat1 \
  34     libx11-6 \
  35     libx11-xcb1 \
  36     $ARCH_PACKAGES \
  37     netcat-openbsd \
  38     python3 \
  39     libpython3.7 \
  40     python3-pil \
  41     python3-pytest \
  42     python3-requests \
  43     python3-yaml \
  44     wget \
  45     xz-utils
  46
  47 if [ -n "$INCLUDE_VK_CTS" ]; then
  48     apt-get install -y libvulkan1
  49 fi
  50
  51 passwd root -d
  52 chsh -s /bin/sh
  53
  54 cat > /init <<EOF
  55 #!/bin/sh
  56 export PS1=lava-shell:
  57 exec sh
  58 EOF
  59 chmod +x  /init
  60
  61 mkdir -p /lib/firmware/rtl_nic
  62 wget https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/rtl_nic/rtl8153a-3.fw -O /lib/firmware/rtl_nic/rtl8153a-3.fw
  63
  64 #######################################################################
  65 # Strip the image to a small minimal system without removing the debian
  66 # toolchain.
  67
  68 # xz compress firmware so it doesn't waste RAM at runtime.  Except db820c's
  69 # GPU firmware, due to using a precompiled kernel without compression support.
  70 find /lib/firmware -type f -print0 | \
  71     grep -vz a530 | \
  72     xargs -0r -P4 -n4 xz -T1 -C crc32
  73 ln -s /lib/firmware/qcom/a530* /lib/firmware/
  74
  75 # Copy timezone file and remove tzdata package
  76 rm -rf /etc/localtime
  77 cp /usr/share/zoneinfo/Etc/UTC /etc/localtime
  78
  79 UNNEEDED_PACKAGES="libfdisk1
  80                    tzdata
  81                    diffutils
  82                    gnupg"
  83
  84 export DEBIAN_FRONTEND=noninteractive
  85
  86 # Removing unused packages
  87 for PACKAGE in ${UNNEEDED_PACKAGES}
  88 do
  89         echo ${PACKAGE}
  90         if ! apt-get remove --purge --yes "${PACKAGE}"
  91         then
  92                 echo "WARNING: ${PACKAGE} isn't installed"
  93         fi
  94 done
  95
  96 apt-get autoremove --yes || true
  97
  98 # Dropping logs
  99 rm -rf /var/log/*
 100
 101 # Dropping documentation, localization, i18n files, etc
 102 rm -rf /usr/share/doc/*
 103 rm -rf /usr/share/locale/*
 104 rm -rf /usr/share/X11/locale/*
 105 rm -rf /usr/share/man
 106 rm -rf /usr/share/i18n/*
 107 rm -rf /usr/share/info/*
 108 rm -rf /usr/share/lintian/*
 109 rm -rf /usr/share/common-licenses/*
 110 rm -rf /usr/share/mime/*
 111
 112 # Dropping reportbug scripts
 113 rm -rf /usr/share/bug
 114
 115 # Drop udev hwdb not required on a stripped system
 116 rm -rf /lib/udev/hwdb.bin /lib/udev/hwdb.d/*
 117
 118 # Drop all gconv conversions && binaries
 119 rm -rf usr/bin/iconv
 120 rm -rf usr/sbin/iconvconfig
 121 rm -rf usr/lib/*/gconv/
 122
 123 # Remove libusb database
 124 rm -rf usr/sbin/update-usbids
 125 rm -rf var/lib/usbutils/usb.ids
 126 rm -rf usr/share/misc/usb.ids
 127
 128 #######################################################################
 129 # Crush into a minimal production image to be deployed via some type of image
 130 # updating system.
 131 # IMPORTANT: The Debian system is not longer functional at this point,
 132 # for example, apt and dpkg will stop working
 133
 134 UNNEEDED_PACKAGES="apt libapt-pkg6.0 "\
 135 "ncurses-bin ncurses-base libncursesw6 libncurses6 "\
 136 "perl-base "\
 137 "debconf libdebconfclient0 "\
 138 "e2fsprogs e2fslibs libfdisk1 "\
 139 "insserv "\
 140 "udev "\
 141 "init-system-helpers "\
 142 "bash "\
 143 "cpio "\
 144 "xz-utils "\
 145 "passwd "\
 146 "libsemanage1 libsemanage-common "\
 147 "libsepol1 "\
 148 "gpgv "\
 149 "hostname "\
 150 "adduser "\
 151 "debian-archive-keyring "\
 152 "libegl1-mesa-dev "\
 153 "libegl-mesa0 "\
 154 "libgl1-mesa-dev "\
 155 "libgl1-mesa-dri "\
 156 "libglapi-mesa "\
 157 "libgles2-mesa-dev "\
 158 "libglx-mesa0 "\
 159 "mesa-common-dev "\
 160 "libz3-4 "\
 161
 162 # Removing unneeded packages
 163 for PACKAGE in ${UNNEEDED_PACKAGES}
 164 do
 165         echo "Forcing removal of ${PACKAGE}"
 166         if ! dpkg --purge --force-remove-essential --force-depends "${PACKAGE}"
 167         then
 168                 echo "WARNING: ${PACKAGE} isn't installed"
 169         fi
 170 done
 171
 172 # Show what's left package-wise before dropping dpkg itself
 173 COLUMNS=300 dpkg-query -W --showformat='${Installed-Size;10}\t${Package}\n' | sort -k1,1n
 174
 175 # Drop dpkg
 176 dpkg --purge --force-remove-essential --force-depends  dpkg
 177
 178 # No apt or dpkg, no need for its configuration archives
 179 rm -rf etc/apt
 180 rm -rf etc/dpkg
 181
 182 # Drop directories not part of ostree
 183 # Note that /var needs to exist as ostree bind mounts the deployment /var over
 184 # it
 185 rm -rf var/* opt srv share
 186
 187 # ca-certificates are in /etc drop the source
 188 rm -rf usr/share/ca-certificates
 189
 190 # No bash, no need for completions
 191 rm -rf usr/share/bash-completion
 192
 193 # No zsh, no need for comletions
 194 rm -rf usr/share/zsh/vendor-completions
 195
 196 # drop gcc-6 python helpers
 197 rm -rf usr/share/gcc-6
 198
 199 # Drop sysvinit leftovers
 200 rm -rf etc/init.d
 201 rm -rf etc/rc[0-6S].d
 202
 203 # Drop upstart helpers
 204 rm -rf etc/init
 205
 206 # Various xtables helpers
 207 rm -rf usr/lib/xtables
 208
 209 # Drop all locales
 210 # TODO: only remaining locale is actually "C". Should we really remove it?
 211 rm -rf usr/lib/locale/*
 212
 213 # partition helpers
 214 rm -rf usr/sbin/*fdisk
 215
 216 # local compiler
 217 rm -rf usr/bin/localedef
 218
 219 # Systemd dns resolver
 220 find usr etc -name '*systemd-resolve*' -prune -exec rm -r {} \;
 221
 222 # Systemd network configuration
 223 find usr etc -name '*networkd*' -prune -exec rm -r {} \;
 224
 225 # systemd ntp client
 226 find usr etc -name '*timesyncd*' -prune -exec rm -r {} \;
 227
 228 # systemd hw database manager
 229 find usr etc -name '*systemd-hwdb*' -prune -exec rm -r {} \;
 230
 231 # No need for fuse
 232 find usr etc -name '*fuse*' -prune -exec rm -r {} \;
 233
 234 # lsb init function leftovers
 235 rm -rf usr/lib/lsb
 236
 237 # Only needed when adding libraries
 238 rm -rf usr/sbin/ldconfig*
 239
 240 # Games, unused
 241 rmdir usr/games
 242
 243 # Remove pam module to authenticate against a DB
 244 # plus libdb-5.3.so that is only used by this pam module
 245 rm -rf usr/lib/*/security/pam_userdb.so
 246 rm -rf usr/lib/*/libdb-5.3.so
 247
 248 # remove NSS support for nis, nisplus and hesiod
 249 rm -rf usr/lib/*/libnss_hesiod*
 250 rm -rf usr/lib/*/libnss_nis*