.gitlab-ci/create-rootfs.sh

   1 #!/bin/bash
   2
   3 set -ex
   4
   5 LLVM=libllvm8
   6
   7 # LLVMPipe on armhf is broken with LLVM 8
   8 if [ `dpkg --print-architecture` = "armhf" ]; then
   9         LLVM=libllvm7
  10 fi
  11
  12 apt-get -y install --no-install-recommends \
  13     initramfs-tools \
  14     libpng16-16 \
  15     strace \
  16     libsensors5 \
  17     libexpat1 \
  18     libdrm2 \
  19     libdrm-nouveau2 \
  20     $LLVM
  21 passwd root -d
  22 chsh -s /bin/sh
  23
  24 cat > /init <<EOF
  25 #!/bin/sh
  26 export PS1=lava-shell:
  27 exec sh
  28 EOF
  29 chmod +x  /init
  30
  31 #######################################################################
  32 # Strip the image to a small minimal system without removing the debian
  33 # toolchain.
  34
  35 # Copy timezone file and remove tzdata package
  36 rm -rf /etc/localtime
  37 cp /usr/share/zoneinfo/Etc/UTC /etc/localtime
  38
  39 UNNEEDED_PACKAGES="libfdisk1
  40                    tzdata
  41                    diffutils"
  42
  43 export DEBIAN_FRONTEND=noninteractive
  44
  45 # Removing unused packages
  46 for PACKAGE in ${UNNEEDED_PACKAGES}
  47 do
  48         echo ${PACKAGE}
  49         if ! apt-get remove --purge --yes "${PACKAGE}"
  50         then
  51                 echo "WARNING: ${PACKAGE} isn't installed"
  52         fi
  53 done
  54
  55 apt-get autoremove --yes || true
  56
  57 # Dropping logs
  58 rm -rf /var/log/*
  59
  60 # Dropping documentation, localization, i18n files, etc
  61 rm -rf /usr/share/doc/*
  62 rm -rf /usr/share/locale/*
  63 rm -rf /usr/share/man
  64 rm -rf /usr/share/i18n/*
  65 rm -rf /usr/share/info/*
  66 rm -rf /usr/share/lintian/*
  67 rm -rf /usr/share/common-licenses/*
  68 rm -rf /usr/share/mime/*
  69
  70 # Dropping reportbug scripts
  71 rm -rf /usr/share/bug
  72
  73 # Drop udev hwdb not required on a stripped system
  74 rm -rf /lib/udev/hwdb.bin /lib/udev/hwdb.d/*
  75
  76 # Drop all gconv conversions && binaries
  77 rm -rf usr/bin/iconv
  78 rm -rf usr/sbin/iconvconfig
  79 rm -rf usr/lib/*/gconv/
  80
  81 # Remove libusb database
  82 rm -rf usr/sbin/update-usbids
  83 rm -rf var/lib/usbutils/usb.ids
  84 rm -rf usr/share/misc/usb.ids
  85
  86 #######################################################################
  87 # Crush into a minimal production image to be deployed via some type of image
  88 # updating system.
  89 # IMPORTANT: The Debian system is not longer functional at this point,
  90 # for example, apt and dpkg will stop working
  91
  92 UNNEEDED_PACKAGES="apt libapt-pkg5.0 "\
  93 "ncurses-bin ncurses-base libncursesw5 libncurses5 "\
  94 "perl-base "\
  95 "debconf libdebconfclient0 "\
  96 "e2fsprogs e2fslibs libfdisk1 "\
  97 "insserv "\
  98 "udev "\
  99 "init-system-helpers "\
 100 "bash "\
 101 "cpio "\
 102 "passwd "\
 103 "libsemanage1 libsemanage-common "\
 104 "libsepol1 "\
 105 "gzip "\
 106 "gpgv "\
 107 "hostname "\
 108 "adduser "\
 109 "debian-archive-keyring "\
 110
 111 # Removing unneeded packages
 112 for PACKAGE in ${UNNEEDED_PACKAGES}
 113 do
 114         echo "Forcing removal of ${PACKAGE}"
 115         if ! dpkg --purge --force-remove-essential --force-depends "${PACKAGE}"
 116         then
 117                 echo "WARNING: ${PACKAGE} isn't installed"
 118         fi
 119 done
 120
 121 # Show what's left package-wise before dropping dpkg itself
 122 COLUMNS=300 dpkg-query -W --showformat='${Installed-Size;10}\t${Package}\n' | sort -k1,1n
 123
 124 # Drop dpkg
 125 dpkg --purge --force-remove-essential --force-depends  dpkg
 126
 127 # No apt or dpkg, no need for its configuration archives
 128 rm -rf etc/apt
 129 rm -rf etc/dpkg
 130
 131 # Drop directories not part of ostree
 132 # Note that /var needs to exist as ostree bind mounts the deployment /var over
 133 # it
 134 rm -rf var/* opt srv share
 135
 136 # ca-certificates are in /etc drop the source
 137 rm -rf usr/share/ca-certificates
 138
 139 # No bash, no need for completions
 140 rm -rf usr/share/bash-completion
 141
 142 # No zsh, no need for comletions
 143 rm -rf usr/share/zsh/vendor-completions
 144
 145 # drop gcc-6 python helpers
 146 rm -rf usr/share/gcc-6
 147
 148 # Drop sysvinit leftovers
 149 rm -rf etc/init.d
 150 rm -rf etc/rc[0-6S].d
 151
 152 # Drop upstart helpers
 153 rm -rf etc/init
 154
 155 # Various xtables helpers
 156 rm -rf usr/lib/xtables
 157
 158 # Drop all locales
 159 # TODO: only remaining locale is actually "C". Should we really remove it?
 160 rm -rf usr/lib/locale/*
 161
 162 # partition helpers
 163 rm usr/sbin/*fdisk
 164
 165 # local compiler
 166 rm usr/bin/localedef
 167
 168 # Systemd dns resolver
 169 find usr etc -name '*systemd-resolve*' -prune -exec rm -r {} \;
 170
 171 # Systemd network configuration
 172 find usr etc -name '*networkd*' -prune -exec rm -r {} \;
 173
 174 # systemd ntp client
 175 find usr etc -name '*timesyncd*' -prune -exec rm -r {} \;
 176
 177 # systemd hw database manager
 178 find usr etc -name '*systemd-hwdb*' -prune -exec rm -r {} \;
 179
 180 # No need for fuse
 181 find usr etc -name '*fuse*' -prune -exec rm -r {} \;
 182
 183 # lsb init function leftovers
 184 rm -rf usr/lib/lsb
 185
 186 # Only needed when adding libraries
 187 rm usr/sbin/ldconfig*
 188
 189 # Games, unused
 190 rmdir usr/games
 191
 192 # Remove pam module to authenticate against a DB
 193 # plus libdb-5.3.so that is only used by this pam module
 194 rm usr/lib/*/security/pam_userdb.so
 195 rm usr/lib/*/libdb-5.3.so
 196
 197 # remove NSS support for nis, nisplus and hesiod
 198 rm usr/lib/*/libnss_hesiod*
 199 rm usr/lib/*/libnss_nis*
 200
 201 rm bin/tar