.gitlab-ci/create-rootfs.sh

   1 #!/bin/bash
   2
   3 set -ex
   4
   5 apt-get -y install --no-install-recommends \
   6     ca-certificates \
   7     initramfs-tools \
   8     libpng16-16 \
   9     strace \
  10     libsensors5 \
  11     libexpat1 \
  12     libdrm2 \
  13     libdrm-nouveau2 \
  14     libx11-6 \
  15     libx11-xcb1 \
  16     firmware-qcom-media \
  17     netcat-openbsd \
  18     python3 \
  19     libpython3.7 \
  20     python3-pil \
  21     python3-pytest \
  22     python3-requests \
  23     python3-yaml \
  24     wget \
  25     xz-utils
  26
  27 if [ -n "$INCLUDE_VK_CTS" ]; then
  28     apt-get install -y libvulkan1
  29 fi
  30
  31 passwd root -d
  32 chsh -s /bin/sh
  33
  34 cat > /init <<EOF
  35 #!/bin/sh
  36 export PS1=lava-shell:
  37 exec sh
  38 EOF
  39 chmod +x  /init
  40
  41 mkdir -p /lib/firmware/rtl_nic
  42 wget https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/rtl_nic/rtl8153a-3.fw -O /lib/firmware/rtl_nic/rtl8153a-3.fw
  43
  44 #######################################################################
  45 # Strip the image to a small minimal system without removing the debian
  46 # toolchain.
  47
  48 # xz compress firmware so it doesn't waste RAM at runtime.  Except db820c's
  49 # GPU firmware, due to using a precompiled kernel without compression support.
  50 find /lib/firmware -type f -print0 | \
  51     grep -vz a530 | \
  52     xargs -0r -P4 -n4 xz -T1 -C crc32
  53 ln -s /lib/firmware/qcom/a530* /lib/firmware/
  54
  55 # Copy timezone file and remove tzdata package
  56 rm -rf /etc/localtime
  57 cp /usr/share/zoneinfo/Etc/UTC /etc/localtime
  58
  59 UNNEEDED_PACKAGES="libfdisk1
  60                    tzdata
  61                    diffutils"
  62
  63 export DEBIAN_FRONTEND=noninteractive
  64
  65 # Removing unused packages
  66 for PACKAGE in ${UNNEEDED_PACKAGES}
  67 do
  68         echo ${PACKAGE}
  69         if ! apt-get remove --purge --yes "${PACKAGE}"
  70         then
  71                 echo "WARNING: ${PACKAGE} isn't installed"
  72         fi
  73 done
  74
  75 apt-get autoremove --yes || true
  76
  77 # Dropping logs
  78 rm -rf /var/log/*
  79
  80 # Dropping documentation, localization, i18n files, etc
  81 rm -rf /usr/share/doc/*
  82 rm -rf /usr/share/locale/*
  83 rm -rf /usr/share/X11/locale/*
  84 rm -rf /usr/share/man
  85 rm -rf /usr/share/i18n/*
  86 rm -rf /usr/share/info/*
  87 rm -rf /usr/share/lintian/*
  88 rm -rf /usr/share/common-licenses/*
  89 rm -rf /usr/share/mime/*
  90
  91 # Dropping reportbug scripts
  92 rm -rf /usr/share/bug
  93
  94 # Drop udev hwdb not required on a stripped system
  95 rm -rf /lib/udev/hwdb.bin /lib/udev/hwdb.d/*
  96
  97 # Drop all gconv conversions && binaries
  98 rm -rf usr/bin/iconv
  99 rm -rf usr/sbin/iconvconfig
 100 rm -rf usr/lib/*/gconv/
 101
 102 # Remove libusb database
 103 rm -rf usr/sbin/update-usbids
 104 rm -rf var/lib/usbutils/usb.ids
 105 rm -rf usr/share/misc/usb.ids
 106
 107 #######################################################################
 108 # Crush into a minimal production image to be deployed via some type of image
 109 # updating system.
 110 # IMPORTANT: The Debian system is not longer functional at this point,
 111 # for example, apt and dpkg will stop working
 112
 113 UNNEEDED_PACKAGES="apt libapt-pkg6.0 "\
 114 "ncurses-bin ncurses-base libncursesw6 libncurses6 "\
 115 "perl-base "\
 116 "debconf libdebconfclient0 "\
 117 "e2fsprogs e2fslibs libfdisk1 "\
 118 "insserv "\
 119 "udev "\
 120 "init-system-helpers "\
 121 "bash "\
 122 "cpio "\
 123 "xz-utils "\
 124 "passwd "\
 125 "libsemanage1 libsemanage-common "\
 126 "libsepol1 "\
 127 "gzip "\
 128 "gpgv "\
 129 "hostname "\
 130 "adduser "\
 131 "debian-archive-keyring "\
 132 "libegl1-mesa-dev "\
 133 "libegl-mesa0 "\
 134 "libgl1-mesa-dev "\
 135 "libgl1-mesa-dri "\
 136 "libglapi-mesa "\
 137 "libgles2-mesa-dev "\
 138 "libglx-mesa0 "\
 139 "mesa-common-dev "\
 140 "libz3-4 "\
 141
 142 # Removing unneeded packages
 143 for PACKAGE in ${UNNEEDED_PACKAGES}
 144 do
 145         echo "Forcing removal of ${PACKAGE}"
 146         if ! dpkg --purge --force-remove-essential --force-depends "${PACKAGE}"
 147         then
 148                 echo "WARNING: ${PACKAGE} isn't installed"
 149         fi
 150 done
 151
 152 # Show what's left package-wise before dropping dpkg itself
 153 COLUMNS=300 dpkg-query -W --showformat='${Installed-Size;10}\t${Package}\n' | sort -k1,1n
 154
 155 # Drop dpkg
 156 dpkg --purge --force-remove-essential --force-depends  dpkg
 157
 158 # No apt or dpkg, no need for its configuration archives
 159 rm -rf etc/apt
 160 rm -rf etc/dpkg
 161
 162 # Drop directories not part of ostree
 163 # Note that /var needs to exist as ostree bind mounts the deployment /var over
 164 # it
 165 rm -rf var/* opt srv share
 166
 167 # ca-certificates are in /etc drop the source
 168 rm -rf usr/share/ca-certificates
 169
 170 # No bash, no need for completions
 171 rm -rf usr/share/bash-completion
 172
 173 # No zsh, no need for comletions
 174 rm -rf usr/share/zsh/vendor-completions
 175
 176 # drop gcc-6 python helpers
 177 rm -rf usr/share/gcc-6
 178
 179 # Drop sysvinit leftovers
 180 rm -rf etc/init.d
 181 rm -rf etc/rc[0-6S].d
 182
 183 # Drop upstart helpers
 184 rm -rf etc/init
 185
 186 # Various xtables helpers
 187 rm -rf usr/lib/xtables
 188
 189 # Drop all locales
 190 # TODO: only remaining locale is actually "C". Should we really remove it?
 191 rm -rf usr/lib/locale/*
 192
 193 # partition helpers
 194 rm -rf usr/sbin/*fdisk
 195
 196 # local compiler
 197 rm -rf usr/bin/localedef
 198
 199 # Systemd dns resolver
 200 find usr etc -name '*systemd-resolve*' -prune -exec rm -r {} \;
 201
 202 # Systemd network configuration
 203 find usr etc -name '*networkd*' -prune -exec rm -r {} \;
 204
 205 # systemd ntp client
 206 find usr etc -name '*timesyncd*' -prune -exec rm -r {} \;
 207
 208 # systemd hw database manager
 209 find usr etc -name '*systemd-hwdb*' -prune -exec rm -r {} \;
 210
 211 # No need for fuse
 212 find usr etc -name '*fuse*' -prune -exec rm -r {} \;
 213
 214 # lsb init function leftovers
 215 rm -rf usr/lib/lsb
 216
 217 # Only needed when adding libraries
 218 rm -rf usr/sbin/ldconfig*
 219
 220 # Games, unused
 221 rmdir usr/games
 222
 223 # Remove pam module to authenticate against a DB
 224 # plus libdb-5.3.so that is only used by this pam module
 225 rm -rf usr/lib/*/security/pam_userdb.so
 226 rm -rf usr/lib/*/libdb-5.3.so
 227
 228 # remove NSS support for nis, nisplus and hesiod
 229 rm -rf usr/lib/*/libnss_hesiod*
 230 rm -rf usr/lib/*/libnss_nis*