.gitlab-ci/create-rootfs.sh

   1 #!/bin/bash
   2
   3 set -ex
   4
   5 apt-get -y install --no-install-recommends \
   6     initramfs-tools \
   7     libpng16-16 \
   8     strace \
   9     libsensors5 \
  10     libexpat1 \
  11     libdrm2 \
  12     libdrm-nouveau2 \
  13 passwd root -d
  14 chsh -s /bin/sh
  15
  16 cat > /init <<EOF
  17 #!/bin/sh
  18 export PS1=lava-shell:
  19 exec sh
  20 EOF
  21 chmod +x  /init
  22
  23 #######################################################################
  24 # Strip the image to a small minimal system without removing the debian
  25 # toolchain.
  26
  27 # Copy timezone file and remove tzdata package
  28 rm -rf /etc/localtime
  29 cp /usr/share/zoneinfo/Etc/UTC /etc/localtime
  30
  31 UNNEEDED_PACKAGES="libfdisk1
  32                    tzdata
  33                    diffutils"
  34
  35 export DEBIAN_FRONTEND=noninteractive
  36
  37 # Removing unused packages
  38 for PACKAGE in ${UNNEEDED_PACKAGES}
  39 do
  40         echo ${PACKAGE}
  41         if ! apt-get remove --purge --yes "${PACKAGE}"
  42         then
  43                 echo "WARNING: ${PACKAGE} isn't installed"
  44         fi
  45 done
  46
  47 apt-get autoremove --yes || true
  48
  49 # Dropping logs
  50 rm -rf /var/log/*
  51
  52 # Dropping documentation, localization, i18n files, etc
  53 rm -rf /usr/share/doc/*
  54 rm -rf /usr/share/locale/*
  55 rm -rf /usr/share/man
  56 rm -rf /usr/share/i18n/*
  57 rm -rf /usr/share/info/*
  58 rm -rf /usr/share/lintian/*
  59 rm -rf /usr/share/common-licenses/*
  60 rm -rf /usr/share/mime/*
  61
  62 # Dropping reportbug scripts
  63 rm -rf /usr/share/bug
  64
  65 # Drop udev hwdb not required on a stripped system
  66 rm -rf /lib/udev/hwdb.bin /lib/udev/hwdb.d/*
  67
  68 # Drop all gconv conversions && binaries
  69 rm -rf usr/bin/iconv
  70 rm -rf usr/sbin/iconvconfig
  71 rm -rf usr/lib/*/gconv/
  72
  73 # Remove libusb database
  74 rm -rf usr/sbin/update-usbids
  75 rm -rf var/lib/usbutils/usb.ids
  76 rm -rf usr/share/misc/usb.ids
  77
  78 #######################################################################
  79 # Crush into a minimal production image to be deployed via some type of image
  80 # updating system.
  81 # IMPORTANT: The Debian system is not longer functional at this point,
  82 # for example, apt and dpkg will stop working
  83
  84 UNNEEDED_PACKAGES="apt libapt-pkg5.0 "\
  85 "ncurses-bin ncurses-base libncursesw5 libncurses5 "\
  86 "perl-base "\
  87 "debconf libdebconfclient0 "\
  88 "e2fsprogs e2fslibs libfdisk1 "\
  89 "insserv "\
  90 "udev "\
  91 "init-system-helpers "\
  92 "bash "\
  93 "cpio "\
  94 "passwd "\
  95 "libsemanage1 libsemanage-common "\
  96 "libsepol1 "\
  97 "gzip "\
  98 "gpgv "\
  99 "hostname "\
 100 "adduser "\
 101 "debian-archive-keyring "\
 102
 103 # Removing unneeded packages
 104 for PACKAGE in ${UNNEEDED_PACKAGES}
 105 do
 106         echo "Forcing removal of ${PACKAGE}"
 107         if ! dpkg --purge --force-remove-essential --force-depends "${PACKAGE}"
 108         then
 109                 echo "WARNING: ${PACKAGE} isn't installed"
 110         fi
 111 done
 112
 113 # Show what's left package-wise before dropping dpkg itself
 114 COLUMNS=300 dpkg-query -W --showformat='${Installed-Size;10}\t${Package}\n' | sort -k1,1n
 115
 116 # Drop dpkg
 117 dpkg --purge --force-remove-essential --force-depends  dpkg
 118
 119 # No apt or dpkg, no need for its configuration archives
 120 rm -rf etc/apt
 121 rm -rf etc/dpkg
 122
 123 # Drop directories not part of ostree
 124 # Note that /var needs to exist as ostree bind mounts the deployment /var over
 125 # it
 126 rm -rf var/* opt srv share
 127
 128 # ca-certificates are in /etc drop the source
 129 rm -rf usr/share/ca-certificates
 130
 131 # No bash, no need for completions
 132 rm -rf usr/share/bash-completion
 133
 134 # No zsh, no need for comletions
 135 rm -rf usr/share/zsh/vendor-completions
 136
 137 # drop gcc-6 python helpers
 138 rm -rf usr/share/gcc-6
 139
 140 # Drop sysvinit leftovers
 141 rm -rf etc/init.d
 142 rm -rf etc/rc[0-6S].d
 143
 144 # Drop upstart helpers
 145 rm -rf etc/init
 146
 147 # Various xtables helpers
 148 rm -rf usr/lib/xtables
 149
 150 # Drop all locales
 151 # TODO: only remaining locale is actually "C". Should we really remove it?
 152 rm -rf usr/lib/locale/*
 153
 154 # partition helpers
 155 rm usr/sbin/*fdisk
 156
 157 # local compiler
 158 rm usr/bin/localedef
 159
 160 # Systemd dns resolver
 161 find usr etc -name '*systemd-resolve*' -prune -exec rm -r {} \;
 162
 163 # Systemd network configuration
 164 find usr etc -name '*networkd*' -prune -exec rm -r {} \;
 165
 166 # systemd ntp client
 167 find usr etc -name '*timesyncd*' -prune -exec rm -r {} \;
 168
 169 # systemd hw database manager
 170 find usr etc -name '*systemd-hwdb*' -prune -exec rm -r {} \;
 171
 172 # No need for fuse
 173 find usr etc -name '*fuse*' -prune -exec rm -r {} \;
 174
 175 # lsb init function leftovers
 176 rm -rf usr/lib/lsb
 177
 178 # Only needed when adding libraries
 179 rm usr/sbin/ldconfig*
 180
 181 # Games, unused
 182 rmdir usr/games
 183
 184 # Remove pam module to authenticate against a DB
 185 # plus libdb-5.3.so that is only used by this pam module
 186 rm usr/lib/*/security/pam_userdb.so
 187 rm usr/lib/*/libdb-5.3.so
 188
 189 # remove NSS support for nis, nisplus and hesiod
 190 rm usr/lib/*/libnss_hesiod*
 191 rm usr/lib/*/libnss_nis*
 192
 193 rm bin/tar