29 files changed, 446 insertions, 375 deletions

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..4b22e20
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,98 @@
+stages:
+  - docker
+  - checkout
+  - test
+
+variables:
+  BITBAKE_IMAGE: ${CI_REGISTRY_IMAGE}:ci-${CI_COMMIT_REF_SLUG}-bitbake
+  BITBAKE_CHECKOUT_IMAGE: ${CI_REGISTRY_IMAGE}:ci-${CI_COMMIT_REF_SLUG}-checkout
+
+include:
+  - local: "scripts/ci/gitlab/docker.yml"
+  - local: "scripts/ci/gitlab/checkout.yml"
+  - local: "scripts/ci/gitlab/tests.yml"
+
+Docker setup:
+  extends: .bb_docker_local
+
+  stage: docker
+  variables:
+    BITBKAE_IMAGE_MASTER: ${CI_REGISTRY_IMAGE}:ci-master-bitbake
+    BITBAKE_CHECKOUT_IMAGE_MASTER: ${CI_REGISTRY_IMAGE}:ci-master-checkout
+  except:
+    - pushes
+
+Checkout:
+  extends: .bb_checkout
+
+  stage: checkout
+  variables:
+    MANIFEST: master
+    CURRENT_PROJECT: meta-updater
+  except:
+    - pushes
+
+Build core-image-minimal:
+  extends: .bitbake
+
+  stage: test
+  variables:
+    TEST_BUILD_DIR: 'build-core-image-minimal'
+    BITBAKE_TARGETS: 'core-image-minimal'
+  artifacts:
+    name: "core-image-minimal_$CI_COMMIT_REF_SLUG"
+    paths:
+      - $TEST_BUILD_DIR/tmp/deploy/images/*/core-image-minimal*
+  except:
+    - pushes
+
+Oe-selftest qemux86_64:
+  extends: .oe-selftest
+
+  stage: test
+  variables:
+    TEST_BUILD_DIR: 'build-oe-qemux86_64'
+    OE_SELFTESTS: 'updater_native updater_qemux86_64'
+  except:
+    - pushes
+
+# Not run by default, triggered on nightlies
+
+Oe-selftest minnowboard:
+  extends: .oe-selftest
+
+  stage: test
+  variables:
+    TEST_BUILD_DIR: 'build-oe-minnowboard'
+    OE_SELFTESTS: 'updater_minnowboard'
+  except:
+    - pushes
+  only:
+    variables:
+      - $OE_MINNOWBOARD
+
+Oe-selftest rpi:
+  extends: .oe-selftest
+
+  stage: test
+  variables:
+    TEST_BUILD_DIR: 'build-oe-rpi'
+    OE_SELFTESTS: 'updater_raspberrypi'
+  except:
+    - pushes
+  only:
+    variables:
+      - $OE_RPI
+
+Ptest qemux86_64:
+  extends: .oe-selftest
+
+  stage: test
+  variables:
+    TEST_BUILD_DIR: 'build-oe-qemux86_64-ptest'
+    OE_SELFTESTS: 'updater_qemux86_64_ptest'
+  except:
+    - pushes
+  only:
+    variables:
+      - $OE_PTEST
diff --git a/README.adoc b/README.adoc
index 1f9d863..b047f91 100644
--- a/README.adoc
+++ b/README.adoc
@@ -104,7 +104,7 @@ Your images will also need network connectivity to be able to reach an actual OT
 * `SOTA_DEPLOY_CREDENTIALS` - when set to '1' (default value), deploys credentials to the built image. Override it in `local.conf` to built a generic image that can be provisioned manually after the build.
 * `SOTA_CLIENT_PROV` - which provisioning method to use. Valid options are `aktualizr-shared-prov`, `aktualizr-device-prov`, and `aktualizr-device-prov-hsm`. For more information on these provisioning methods, see the https://docs.ota.here.com/client-config/client-provisioning-methods.html[OTA Connect documentation]. The default is `aktualizr-shared-prov`. This can also be set to an empty string to avoid using a provisioning recipe.
 * `SOTA_CLIENT_FEATURES` - extensions to aktualizr. The only valid options are `hsm` (to build with HSM support) and `secondary-network` (to set up a simulated 'in-vehicle' network with support for a primary node with a DHCP server and a secondary node with a DHCP client).
-* `SOTA_SECONDARY_CONFIG_DIR` - a directory containing JSON configuration files for virtual secondaries on the host. These will be installed into `/etc/sota/ecus` on the device and automatically provided to aktualizr.
+* `SOTA_SECONDARY_CONFIG` - a file containing JSON configuration for secondaries. It will be installed into `/etc/sota/ecus` on the device and automatically provided to aktualizr. See link:https://github.com/advancedtelematic/aktualizr/blob/master/docs/posix-secondaries-bitbaking.adoc[here] for more details.
 * `SOTA_HARDWARE_ID` - a custom hardware ID that will be written to the aktualizr config. Defaults to MACHINE if not set.
 * `SOTA_MAIN_DTB` - base device tree to use with the kernel. Used together with FIT images. You can change it, and the device tree will also be changed after the update.
 * `SOTA_DT_OVERLAYS` - whitespace-separated list of used device tree overlays for FIT image. This list is OSTree-updateable as well.
diff --git a/classes/image_types_ostree.bbclass b/classes/image_types_ostree.bbclass
index b1c53ff..a9a8174 100644
--- a/classes/image_types_ostree.bbclass
+++ b/classes/image_types_ostree.bbclass
@@ -7,6 +7,8 @@ OSTREE_COMMIT_SUBJECT ??= "Commit-id: ${IMAGE_NAME}"
 OSTREE_COMMIT_BODY ??= ""
 OSTREE_UPDATE_SUMMARY ??= "0"
 OSTREE_DEPLOY_DEVICETREE ??= "0"
+OSTREE_BRANCHNAME ?= "${SOTA_HARDWARE_ID}"
+GARAGE_TARGET_NAME ?= "${OSTREE_BRANCHNAME}"
 
 BUILD_OSTREE_TARBALL ??= "1"
 
@@ -254,6 +256,12 @@ IMAGE_CMD_garagesign () {
                                     ${target_url} \
                                     --sha256 ${ostree_target_hash} \
                                     --hardwareids ${SOTA_HARDWARE_ID}
+            if [ -n "${GARAGE_CUSTOMIZE_TARGET}" ]; then
+                bbplain "Running command(${GARAGE_CUSTOMIZE_TARGET}) to customize target"
+                ${GARAGE_CUSTOMIZE_TARGET} \
+                    ${GARAGE_SIGN_REPO}/tufrepo/roles/unsigned/targets.json \
+                    ${GARAGE_TARGET_NAME}-${target_version}
+            fi
             garage-sign targets sign --repo tufrepo \
                                      --home-dir ${GARAGE_SIGN_REPO} \
                                      --key-name=targets
diff --git a/classes/sota.bbclass b/classes/sota.bbclass
index bf27b6d..1a9d68b 100644
--- a/classes/sota.bbclass
+++ b/classes/sota.bbclass
@@ -39,7 +39,6 @@ INITRAMFS_FSTYPES ?= "${@oe.utils.ifelse(d.getVar('OSTREE_BOOTLOADER') == 'u-boo
 
 # Please redefine OSTREE_REPO in order to have a persistent OSTree repo
 export OSTREE_REPO ?= "${DEPLOY_DIR_IMAGE}/ostree_repo"
-export OSTREE_BRANCHNAME ?= "${SOTA_HARDWARE_ID}"
 export OSTREE_OSNAME ?= "poky"
 export OSTREE_BOOTLOADER ??= 'u-boot'
 export OSTREE_BOOT_PARTITION ??= "/boot"
@@ -48,9 +47,9 @@ INITRAMFS_IMAGE ?= "initramfs-ostree-image"
 
 GARAGE_SIGN_REPO ?= "${DEPLOY_DIR_IMAGE}/garage_sign_repo"
 GARAGE_SIGN_KEYNAME ?= "garage-key"
-GARAGE_TARGET_NAME ?= "${OSTREE_BRANCHNAME}"
 GARAGE_TARGET_VERSION ?= ""
 GARAGE_TARGET_URL ?= ""
+GARAGE_CUSTOMIZE_TARGET ?= ""
 
 SOTA_MACHINE ??="none"
 SOTA_MACHINE_rpi ?= "raspberrypi"
@@ -61,6 +60,6 @@ SOTA_MACHINE_qemux86-64 ?= "qemux86-64"
 SOTA_MACHINE_am335x-evm ?= "am335x-evm-wifi"
 
 SOTA_OVERRIDES_BLACKLIST = "ostree ota"
-SOTA_REQUIRED_VARIABLES = "OSTREE_REPO OSTREE_BRANCHNAME OSTREE_OSNAME OSTREE_BOOTLOADER OSTREE_BOOT_PARTITION GARAGE_SIGN_REPO GARAGE_TARGET_NAME"
+SOTA_REQUIRED_VARIABLES = "OSTREE_REPO OSTREE_OSNAME OSTREE_BOOTLOADER OSTREE_BOOT_PARTITION GARAGE_SIGN_REPO"
 
 inherit sota_sanity sota_${SOTA_MACHINE} image_repo_manifest
diff --git a/lib/oeqa/selftest/cases/testutils.py b/lib/oeqa/selftest/cases/testutils.py
index f8b1904..8d618a6 100644
--- a/lib/oeqa/selftest/cases/testutils.py
+++ b/lib/oeqa/selftest/cases/testutils.py
@@ -1,4 +1,5 @@
 import os
+import oe.path
 import logging
 import re
 import subprocess
@@ -33,6 +34,7 @@ def qemu_boot_image(imagename, **kwargs):
     args.dir = 'tmp/deploy/images'
     args.efi = kwargs.get('efi', False)
     args.machine = kwargs.get('machine', None)
+    args.mem = kwargs.get('mem', '128M')
     qemu_use_kvm = get_bb_var("QEMU_USE_KVM")
     if qemu_use_kvm and \
             (qemu_use_kvm == 'True' and 'x86' in args.machine or
@@ -60,7 +62,7 @@ def qemu_bake_image(imagename):
     bitbake(imagename)
 
 
-def qemu_send_command(port, command, timeout=60):
+def qemu_send_command(port, command, timeout=120):
     command = ['ssh -q -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no root@localhost -p ' +
                str(port) + ' "' + command + '"']
     s2 = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
@@ -68,24 +70,30 @@ def qemu_send_command(port, command, timeout=60):
     return stdout, stderr, s2.returncode
 
 
+def metadir():
+    # Assume the directory layout for finding other layers. We could also
+    # make assumptions by using 'show-layers', but either way, if the
+    # layers we need aren't where we expect them, we are out of luck.
+    path = os.path.abspath(os.path.dirname(__file__))
+    metadir = path + "/../../../../../"
+
+    return metadir
+
+
 def akt_native_run(testInst, cmd, **kwargs):
     # run a command supplied by aktualizr-native and checks that:
     # - the executable exists
     # - the command runs without error
-    # NOTE: the base test class must have built aktualizr-native (in
-    # setUpClass, for example)
-    bb_vars = get_bb_vars(['SYSROOT_DESTDIR', 'base_prefix', 'libdir', 'bindir'],
-                          'aktualizr-native')
-    sysroot = bb_vars['SYSROOT_DESTDIR'] + bb_vars['base_prefix']
-    sysrootbin = bb_vars['SYSROOT_DESTDIR'] + bb_vars['bindir']
-    libdir = bb_vars['libdir']
-
-    program, *_ = cmd.split(' ')
-    p = '{}/{}'.format(sysrootbin, program)
-    testInst.assertTrue(os.path.isfile(p), msg="No {} found ({})".format(program, p))
-    env = dict(os.environ)
-    env['LD_LIBRARY_PATH'] = libdir
-    result = runCmd(cmd, env=env, native_sysroot=sysroot, ignore_status=True, **kwargs)
+    #
+    # Requirements in base test class (setUpClass for example):
+    #   bitbake aktualizr-native
+    #   bitbake build-sysroots -c build_native_sysroot
+    #
+    # (technique found in poky/meta/lib/oeqa/selftest/cases/package.py)
+    bb_vars = get_bb_vars(['STAGING_DIR', 'BUILD_ARCH'])
+    sysroot = oe.path.join(bb_vars['STAGING_DIR'], bb_vars['BUILD_ARCH'])
+
+    result = runCmd(cmd, native_sysroot=sysroot, ignore_status=True, **kwargs)
     testInst.assertEqual(result.status, 0, "Status not equal to 0. output: %s" % result.output)
 
 
diff --git a/lib/oeqa/selftest/cases/updater_minnowboard.py b/lib/oeqa/selftest/cases/updater_minnowboard.py
index 267445b..f4da360 100644
--- a/lib/oeqa/selftest/cases/updater_minnowboard.py
+++ b/lib/oeqa/selftest/cases/updater_minnowboard.py
@@ -1,9 +1,8 @@
-import os
 import re
 
 from oeqa.selftest.case import OESelftestTestCase
 from oeqa.utils.commands import runCmd, get_bb_var
-from testutils import qemu_launch, qemu_send_command, qemu_terminate, verifyProvisioned
+from testutils import metadir, qemu_launch, qemu_send_command, qemu_terminate, verifyProvisioned
 
 
 class MinnowTests(OESelftestTestCase):
@@ -12,25 +11,20 @@ class MinnowTests(OESelftestTestCase):
         layer_intel = "meta-intel"
         layer_minnow = "meta-updater-minnowboard"
         result = runCmd('bitbake-layers show-layers')
-        # Assume the directory layout for finding other layers. We could also
-        # make assumptions by using 'show-layers', but either way, if the
-        # layers we need aren't where we expect them, we are out of luck.
-        path = os.path.abspath(os.path.dirname(__file__))
-        metadir = path + "/../../../../../"
         if re.search(layer_intel, result.output) is None:
-            self.meta_intel = metadir + layer_intel
+            self.meta_intel = metadir() + layer_intel
             runCmd('bitbake-layers add-layer "%s"' % self.meta_intel)
         else:
             self.meta_intel = None
         if re.search(layer_minnow, result.output) is None:
-            self.meta_minnow = metadir + layer_minnow
+            self.meta_minnow = metadir() + layer_minnow
             runCmd('bitbake-layers add-layer "%s"' % self.meta_minnow)
         else:
             self.meta_minnow = None
         self.append_config('MACHINE = "intel-corei7-64"')
         self.append_config('OSTREE_BOOTLOADER = "grub"')
         self.append_config('SOTA_CLIENT_PROV = " aktualizr-shared-prov "')
-        self.qemu, self.s = qemu_launch(efi=True, machine='intel-corei7-64')
+        self.qemu, self.s = qemu_launch(efi=True, machine='intel-corei7-64', mem='512M')
 
     def tearDownLocal(self):
         qemu_terminate(self.s)
diff --git a/lib/oeqa/selftest/cases/updater_native.py b/lib/oeqa/selftest/cases/updater_native.py
index 1fc9cb8..d2bf341 100644
--- a/lib/oeqa/selftest/cases/updater_native.py
+++ b/lib/oeqa/selftest/cases/updater_native.py
@@ -14,6 +14,7 @@ class SotaToolsTests(OESelftestTestCase):
         logger = logging.getLogger("selftest")
         logger.info('Running bitbake to build aktualizr-native tools')
         bitbake('aktualizr-native')
+        bitbake('build-sysroots -c build_native_sysroot')
 
     def test_push_help(self):
         akt_native_run(self, 'garage-push --help')
diff --git a/lib/oeqa/selftest/cases/updater_qemux86_64.py b/lib/oeqa/selftest/cases/updater_qemux86_64.py
index 7223e9e..2b4726c 100644
--- a/lib/oeqa/selftest/cases/updater_qemux86_64.py
+++ b/lib/oeqa/selftest/cases/updater_qemux86_64.py
@@ -2,6 +2,7 @@
 import os
 import logging
 import re
+import subprocess
 import unittest
 from time import sleep
 from uuid import uuid4
@@ -9,7 +10,8 @@ from uuid import uuid4
 from oeqa.selftest.case import OESelftestTestCase
 from oeqa.utils.commands import runCmd, bitbake, get_bb_var, get_bb_vars
 from testutils import qemu_launch, qemu_send_command, qemu_terminate, \
-    akt_native_run, verifyNotProvisioned, verifyProvisioned, qemu_bake_image, qemu_boot_image
+    metadir, akt_native_run, verifyNotProvisioned, verifyProvisioned, \
+    qemu_bake_image, qemu_boot_image
 
 
 class GeneralTests(OESelftestTestCase):
@@ -17,6 +19,9 @@ class GeneralTests(OESelftestTestCase):
         logger = logging.getLogger("selftest")
         logger.info('Running bitbake to build core-image-minimal')
         self.append_config('SOTA_CLIENT_PROV = "aktualizr-shared-prov"')
+
+        # note: this also tests ostreepush/garagesign/garagecheck which are
+        # omitted from other test cases
         bitbake('core-image-minimal')
         credentials = get_bb_var('SOTA_PACKED_CREDENTIALS')
         # skip the test if the variable SOTA_PACKED_CREDENTIALS is not set
@@ -39,20 +44,18 @@ class AktualizrToolsTests(OESelftestTestCase):
         super(AktualizrToolsTests, cls).setUpClass()
         logger = logging.getLogger("selftest")
         logger.info('Running bitbake to build aktualizr-native tools')
-        bitbake('aktualizr-native')
+        bitbake('aktualizr-native aktualizr-device-prov')
+        bitbake('build-sysroots -c build_native_sysroot')
 
     def test_cert_provider_help(self):
         akt_native_run(self, 'aktualizr-cert-provider --help')
 
     def test_cert_provider_local_output(self):
-        logger = logging.getLogger("selftest")
-        logger.info('Running bitbake to build aktualizr-device-prov')
-        bitbake('aktualizr-device-prov')
         bb_vars = get_bb_vars(['SOTA_PACKED_CREDENTIALS', 'T'], 'aktualizr-native')
         creds = bb_vars['SOTA_PACKED_CREDENTIALS']
         temp_dir = bb_vars['T']
-        bb_vars_prov = get_bb_vars(['STAGING_DIR_HOST', 'libdir'], 'aktualizr-device-prov')
-        config = bb_vars_prov['STAGING_DIR_HOST'] + bb_vars_prov['libdir'] + '/sota/sota-device-cred.toml'
+        bb_vars_prov = get_bb_vars(['WORKDIR', 'libdir'], 'aktualizr-device-prov')
+        config = bb_vars_prov['WORKDIR'] + '/sysroot-destdir' + bb_vars_prov['libdir'] + '/sota/conf.d/20-sota-device-cred.toml'
 
         akt_native_run(self, 'aktualizr-cert-provider -c {creds} -r -l {temp} -g {config}'
                        .format(creds=creds, temp=temp_dir, config=config))
@@ -75,17 +78,13 @@ class SharedCredProvTests(OESelftestTestCase):
         layer = "meta-updater-qemux86-64"
         result = runCmd('bitbake-layers show-layers')
         if re.search(layer, result.output) is None:
-            # Assume the directory layout for finding other layers. We could also
-            # make assumptions by using 'show-layers', but either way, if the
-            # layers we need aren't where we expect them, we are out of luck.
-            path = os.path.abspath(os.path.dirname(__file__))
-            metadir = path + "/../../../../../"
-            self.meta_qemu = metadir + layer
+            self.meta_qemu = metadir() + layer
             runCmd('bitbake-layers add-layer "%s"' % self.meta_qemu)
         else:
             self.meta_qemu = None
         self.append_config('MACHINE = "qemux86-64"')
         self.append_config('SOTA_CLIENT_PROV = " aktualizr-shared-prov "')
+        self.append_config('IMAGE_FSTYPES_remove = "ostreepush garagesign garagecheck"')
         self.qemu, self.s = qemu_launch(machine='qemux86-64')
 
     def tearDownLocal(self):
@@ -117,18 +116,14 @@ class ManualControlTests(OESelftestTestCase):
         layer = "meta-updater-qemux86-64"
         result = runCmd('bitbake-layers show-layers')
         if re.search(layer, result.output) is None:
-            # Assume the directory layout for finding other layers. We could also
-            # make assumptions by using 'show-layers', but either way, if the
-            # layers we need aren't where we expect them, we are out of like.
-            path = os.path.abspath(os.path.dirname(__file__))
-            metadir = path + "/../../../../../"
-            self.meta_qemu = metadir + layer
+            self.meta_qemu = metadir() + layer
             runCmd('bitbake-layers add-layer "%s"' % self.meta_qemu)
         else:
             self.meta_qemu = None
         self.append_config('MACHINE = "qemux86-64"')
         self.append_config('SOTA_CLIENT_PROV = " aktualizr-shared-prov "')
         self.append_config('SYSTEMD_AUTO_ENABLE_aktualizr = "disable"')
+        self.append_config('IMAGE_FSTYPES_remove = "ostreepush garagesign garagecheck"')
         self.qemu, self.s = qemu_launch(machine='qemux86-64')
 
     def tearDownLocal(self):
@@ -161,20 +156,16 @@ class DeviceCredProvTests(OESelftestTestCase):
         layer = "meta-updater-qemux86-64"
         result = runCmd('bitbake-layers show-layers')
         if re.search(layer, result.output) is None:
-            # Assume the directory layout for finding other layers. We could also
-            # make assumptions by using 'show-layers', but either way, if the
-            # layers we need aren't where we expect them, we are out of luck.
-            path = os.path.abspath(os.path.dirname(__file__))
-            metadir = path + "/../../../../../"
-            self.meta_qemu = metadir + layer
+            self.meta_qemu = metadir() + layer
             runCmd('bitbake-layers add-layer "%s"' % self.meta_qemu)
         else:
             self.meta_qemu = None
         self.append_config('MACHINE = "qemux86-64"')
         self.append_config('SOTA_CLIENT_PROV = " aktualizr-device-prov "')
         self.append_config('SOTA_DEPLOY_CREDENTIALS = "0"')
-        runCmd('bitbake -c cleanall aktualizr aktualizr-device-prov')
+        self.append_config('IMAGE_FSTYPES_remove = "ostreepush garagesign garagecheck"')
         self.qemu, self.s = qemu_launch(machine='qemux86-64')
+        bitbake('build-sysroots -c build_native_sysroot')
 
     def tearDownLocal(self):
         qemu_terminate(self.s)
@@ -201,8 +192,8 @@ class DeviceCredProvTests(OESelftestTestCase):
         # Run aktualizr-cert-provider.
         bb_vars = get_bb_vars(['SOTA_PACKED_CREDENTIALS'], 'aktualizr-native')
         creds = bb_vars['SOTA_PACKED_CREDENTIALS']
-        bb_vars_prov = get_bb_vars(['STAGING_DIR_HOST', 'libdir'], 'aktualizr-device-prov')
-        config = bb_vars_prov['STAGING_DIR_HOST'] + bb_vars_prov['libdir'] + '/sota/sota-device-cred.toml'
+        bb_vars_prov = get_bb_vars(['WORKDIR', 'libdir'], 'aktualizr-device-prov')
+        config = bb_vars_prov['WORKDIR'] + '/sysroot-destdir' + bb_vars_prov['libdir'] + '/sota/conf.d/20-sota-device-cred.toml'
 
         print('Provisining at root@localhost:%d' % self.qemu.ssh_port)
         akt_native_run(self, 'aktualizr-cert-provider -c {creds} -t root@localhost -p {port} -s -u -r -g {config}'
@@ -217,12 +208,7 @@ class DeviceCredProvHsmTests(OESelftestTestCase):
         layer = "meta-updater-qemux86-64"
         result = runCmd('bitbake-layers show-layers')
         if re.search(layer, result.output) is None:
-            # Assume the directory layout for finding other layers. We could also
-            # make assumptions by using 'show-layers', but either way, if the
-            # layers we need aren't where we expect them, we are out of luck.
-            path = os.path.abspath(os.path.dirname(__file__))
-            metadir = path + "/../../../../../"
-            self.meta_qemu = metadir + layer
+            self.meta_qemu = metadir() + layer
             runCmd('bitbake-layers add-layer "%s"' % self.meta_qemu)
         else:
             self.meta_qemu = None
@@ -231,8 +217,9 @@ class DeviceCredProvHsmTests(OESelftestTestCase):
         self.append_config('SOTA_DEPLOY_CREDENTIALS = "0"')
         self.append_config('SOTA_CLIENT_FEATURES = "hsm"')
         self.append_config('IMAGE_INSTALL_append = " softhsm-testtoken"')
-        runCmd('bitbake -c cleanall aktualizr aktualizr-device-prov-hsm')
+        self.append_config('IMAGE_FSTYPES_remove = "ostreepush garagesign garagecheck"')
         self.qemu, self.s = qemu_launch(machine='qemux86-64')
+        bitbake('build-sysroots -c build_native_sysroot')
 
     def tearDownLocal(self):
         qemu_terminate(self.s)
@@ -269,25 +256,24 @@ class DeviceCredProvHsmTests(OESelftestTestCase):
         # Run aktualizr-cert-provider.
         bb_vars = get_bb_vars(['SOTA_PACKED_CREDENTIALS'], 'aktualizr-native')
         creds = bb_vars['SOTA_PACKED_CREDENTIALS']
-        bb_vars_prov = get_bb_vars(['STAGING_DIR_HOST', 'libdir'], 'aktualizr-device-prov-hsm')
-        config = bb_vars_prov['STAGING_DIR_HOST'] + bb_vars_prov['libdir'] + '/sota/sota-device-cred-hsm.toml'
+        bb_vars_prov = get_bb_vars(['WORKDIR', 'libdir'], 'aktualizr-device-prov-hsm')
+        config = bb_vars_prov['WORKDIR'] + '/sysroot-destdir' + bb_vars_prov['libdir'] + '/sota/conf.d/20-sota-device-cred-hsm.toml'
 
         akt_native_run(self, 'aktualizr-cert-provider -c {creds} -t root@localhost -p {port} -r -s -u -g {config}'
                        .format(creds=creds, port=self.qemu.ssh_port, config=config))
 
         # Verify that HSM is able to initialize.
-        ran_ok = False
         for delay in [5, 5, 5, 5, 10]:
             sleep(delay)
             p11_out, p11_err, p11_ret = self.qemu_command(pkcs11_command)
             hsm_out, hsm_err, hsm_ret = self.qemu_command(softhsm2_command)
-            if p11_ret == 0 and hsm_ret == 0 and hsm_err == b'':
-                ran_ok = True
+            if (p11_ret == 0 and hsm_ret == 0 and hsm_err == b'' and
+                    b'X.509 cert' in p11_out and b'present token' in p11_err):
                 break
-        self.assertTrue(ran_ok, 'pkcs11-tool or softhsm2-tool failed: ' + p11_err.decode() +
-                        p11_out.decode() + hsm_err.decode() + hsm_out.decode())
-        self.assertIn(b'present token', p11_err, 'pkcs11-tool failed: ' + p11_err.decode() + p11_out.decode())
-        self.assertIn(b'X.509 cert', p11_out, 'pkcs11-tool failed: ' + p11_err.decode() + p11_out.decode())
+        else:
+            self.fail('pkcs11-tool or softhsm2-tool failed: ' + p11_err.decode() +
+                      p11_out.decode() + hsm_err.decode() + hsm_out.decode())
+
         self.assertIn(b'Initialized:      yes', hsm_out, 'softhsm2-tool failed: ' +
                       hsm_err.decode() + hsm_out.decode())
         self.assertIn(b'User PIN init.:   yes', hsm_out, 'softhsm2-tool failed: ' +
@@ -328,8 +314,8 @@ class IpSecondaryTests(OESelftestTestCase):
             self.configure()
             qemu_bake_image(self.imagename)
 
-        def send_command(self, cmd):
-            stdout, stderr, retcode = qemu_send_command(self.qemu.ssh_port, cmd, timeout=60)
+        def send_command(self, cmd, timeout=60):
+            stdout, stderr, retcode = qemu_send_command(self.qemu.ssh_port, cmd, timeout=timeout)
             return str(stdout), str(stderr), retcode
 
         def __enter__(self):
@@ -344,7 +330,7 @@ class IpSecondaryTests(OESelftestTestCase):
         def wait_till_sshable(self):
             # qemu_send_command tries to ssh into the qemu VM and blocks until it gets there or timeout happens
             # so it helps us to block q control flow until the VM is booted and a target binary/daemon is running there
-            self.stdout, self.stderr, self.retcode = self.send_command(self.binaryname + ' --help')
+            self.stdout, self.stderr, self.retcode = self.send_command(self.binaryname + ' --help', timeout=300)
 
         def was_successfully_booted(self):
             return self.retcode == 0
@@ -399,16 +385,12 @@ class IpSecondaryTests(OESelftestTestCase):
         layer = "meta-updater-qemux86-64"
         result = runCmd('bitbake-layers show-layers')
         if re.search(layer, result.output) is None:
-            # Assume the directory layout for finding other layers. We could also
-            # make assumptions by using 'show-layers', but either way, if the
-            # layers we need aren't where we expect them, we are out of luck.
-            path = os.path.abspath(os.path.dirname(__file__))
-            metadir = path + "/../../../../../"
-            self.meta_qemu = metadir + layer
+            self.meta_qemu = metadir() + layer
             runCmd('bitbake-layers add-layer "%s"' % self.meta_qemu)
         else:
             self.meta_qemu = None
 
+        self.append_config('IMAGE_FSTYPES_remove = "ostreepush garagesign garagecheck"')
         self.primary = IpSecondaryTests.Primary(self)
         self.secondary = IpSecondaryTests.Secondary(self)
 
@@ -446,17 +428,13 @@ class ResourceControlTests(OESelftestTestCase):
         layer = "meta-updater-qemux86-64"
         result = runCmd('bitbake-layers show-layers')
         if re.search(layer, result.output) is None:
-            # Assume the directory layout for finding other layers. We could also
-            # make assumptions by using 'show-layers', but either way, if the
-            # layers we need aren't where we expect them, we are out of luck.
-            path = os.path.abspath(os.path.dirname(__file__))
-            metadir = path + "/../../../../../"
-            self.meta_qemu = metadir + layer
+            self.meta_qemu = metadir() + layer
             runCmd('bitbake-layers add-layer "%s"' % self.meta_qemu)
         else:
             self.meta_qemu = None
         self.append_config('MACHINE = "qemux86-64"')
         self.append_config('SOTA_CLIENT_PROV = " aktualizr-shared-prov "')
+        self.append_config('IMAGE_FSTYPES_remove = "ostreepush garagesign garagecheck"')
         self.append_config('IMAGE_INSTALL_append += " aktualizr-resource-control "')
         self.append_config('RESOURCE_CPU_WEIGHT_pn-aktualizr = "1000"')
         self.append_config('RESOURCE_MEMORY_HIGH_pn-aktualizr = "50M"')
@@ -476,10 +454,13 @@ class ResourceControlTests(OESelftestTestCase):
         ran_ok = False
         for delay in [5, 5, 5, 5]:
             sleep(delay)
-            stdout, stderr, retcode = self.qemu_command('systemctl --no-pager show aktualizr')
-            if retcode == 0 and b'ExecMainStatus=9' in stdout:
-                ran_ok = True
-                break
+            try:
+                stdout, stderr, retcode = self.qemu_command('systemctl --no-pager show aktualizr')
+                if retcode == 0 and b'ExecMainStatus=9' in stdout:
+                    ran_ok = True
+                    break
+            except subprocess.TimeoutExpired:
+                pass
         self.assertTrue(ran_ok, 'Aktualizr was not killed')
 
         self.assertIn(b'CPUWeight=1000', stdout, 'CPUWeight was not set correctly')
diff --git a/lib/oeqa/selftest/cases/updater_qemux86_64_ptest.py b/lib/oeqa/selftest/cases/updater_qemux86_64_ptest.py
index 0f0f491..d20a9f0 100644
--- a/lib/oeqa/selftest/cases/updater_qemux86_64_ptest.py
+++ b/lib/oeqa/selftest/cases/updater_qemux86_64_ptest.py
@@ -1,10 +1,9 @@
 # pylint: disable=C0111,C0325
-import os
 import re
 
 from oeqa.selftest.case import OESelftestTestCase
 from oeqa.utils.commands import runCmd
-from testutils import qemu_launch, qemu_send_command, qemu_terminate
+from testutils import metadir, qemu_launch, qemu_send_command, qemu_terminate
 
 
 class PtestTests(OESelftestTestCase):
@@ -13,12 +12,7 @@ class PtestTests(OESelftestTestCase):
         layer = "meta-updater-qemux86-64"
         result = runCmd('bitbake-layers show-layers')
         if re.search(layer, result.output) is None:
-            # Assume the directory layout for finding other layers. We could also
-            # make assumptions by using 'show-layers', but either way, if the
-            # layers we need aren't where we expect them, we are out of like.
-            path = os.path.abspath(os.path.dirname(__file__))
-            metadir = path + "/../../../../../"
-            self.meta_qemu = metadir + layer
+            self.meta_qemu = metadir() + layer
             runCmd('bitbake-layers add-layer "%s"' % self.meta_qemu)
         else:
             self.meta_qemu = None
@@ -26,7 +20,8 @@ class PtestTests(OESelftestTestCase):
         self.append_config('SYSTEMD_AUTO_ENABLE_aktualizr = "disable"')
         self.append_config('PTEST_ENABLED_pn-aktualizr = "1"')
         self.append_config('IMAGE_INSTALL_append += "aktualizr-ptest ptest-runner "')
-        self.qemu, self.s = qemu_launch(machine='qemux86-64')
+        self.append_config('IMAGE_FSTYPES_remove = "ostreepush garagesign garagecheck"')
+        self.qemu, self.s = qemu_launch(machine='qemux86-64', mem="768M")
 
     def tearDownLocal(self):
         qemu_terminate(self.s)
@@ -46,7 +41,7 @@ class PtestTests(OESelftestTestCase):
         if has_failure:
             print("Full test suite log:")
             stdout, _, _ = self.qemu_command('cat /tmp/aktualizr-ptest.log || cat /tmp/aktualizr-ptest.log.tmp', timeout=None)
-            print(stdout.decode())
+            print(stdout.decode(errors='replace'))
 
         self.assertEqual(retcode, 0)
         self.assertFalse(has_failure)
diff --git a/lib/oeqa/selftest/cases/updater_raspberrypi.py b/lib/oeqa/selftest/cases/updater_raspberrypi.py
index e976100..8efc941 100644
--- a/lib/oeqa/selftest/cases/updater_raspberrypi.py
+++ b/lib/oeqa/selftest/cases/updater_raspberrypi.py
@@ -7,6 +7,8 @@ import unittest
 from oeqa.selftest.case import OESelftestTestCase
 from oeqa.utils.commands import runCmd, bitbake, get_bb_var
 
+from testutils import metadir
+
 
 class RpiTests(OESelftestTestCase):
 
@@ -16,18 +18,13 @@ class RpiTests(OESelftestTestCase):
         layer_rpi = "meta-raspberrypi"
         layer_upd_rpi = "meta-updater-raspberrypi"
         result = runCmd('bitbake-layers show-layers')
-        # Assume the directory layout for finding other layers. We could also
-        # make assumptions by using 'show-layers', but either way, if the
-        # layers we need aren't where we expect them, we are out of luck.
-        path = os.path.abspath(os.path.dirname(__file__))
-        metadir = path + "/../../../../../"
         if re.search(layer_rpi, result.output) is None:
-            self.meta_rpi = metadir + layer_rpi
+            self.meta_rpi = metadir() + layer_rpi
             runCmd('bitbake-layers add-layer "%s"' % self.meta_rpi)
         else:
             self.meta_rpi = None
         if re.search(layer_upd_rpi, result.output) is None:
-            self.meta_upd_rpi = metadir + layer_upd_rpi
+            self.meta_upd_rpi = metadir() + layer_upd_rpi
             runCmd('bitbake-layers add-layer "%s"' % self.meta_upd_rpi)
         else:
             self.meta_upd_rpi = None
diff --git a/recipes-sota/aktualizr/aktualizr_git.bb b/recipes-sota/aktualizr/aktualizr_git.bb
index 75d5bd9..e9efa35 100644
--- a/recipes-sota/aktualizr/aktualizr_git.bb
+++ b/recipes-sota/aktualizr/aktualizr_git.bb
@@ -6,11 +6,11 @@ LICENSE = "MPL-2.0"
 LIC_FILES_CHKSUM = "file://${S}/LICENSE;md5=9741c346eef56131163e13b9db1241b3"
 
 DEPENDS = "boost curl openssl libarchive libsodium sqlite3 asn1c-native"
-DEPENDS_append = "${@bb.utils.contains('PTEST_ENABLED', '1', ' coreutils-native ostree-native aktualizr-native ', '', d)}"
+DEPENDS_append = "${@bb.utils.contains('PTEST_ENABLED', '1', ' coreutils-native net-tools-native ostree-native aktualizr-native ', '', d)}"
 RDEPENDS_${PN}_class-target = "aktualizr-configs lshw"
 RDEPENDS_${PN}-host-tools = "aktualizr aktualizr-repo aktualizr-cert-provider ${@bb.utils.contains('PACKAGECONFIG', 'sota-tools', 'garage-deploy garage-push', '', d)}"
 
-RDEPENDS_${PN}-ptest += "bash cmake curl python3-misc python3-modules openssl-bin sqlite3 valgrind"
+RDEPENDS_${PN}-ptest += "bash cmake curl net-tools python3-misc python3-modules openssl-bin sqlite3 valgrind"
 
 PV = "1.0+git${SRCPV}"
 PR = "7"
@@ -31,7 +31,7 @@ SRC_URI = " \
 SRC_URI[md5sum] = "e104ccd4f32e52571a5fc0e5042db050"
 SRC_URI[sha256sum] = "c590be1a57523bfe097af82279eda5c97cf40ae47fb27162cf33c469702c8a9b"
 
-SRCREV = "fce5854ff10e7efd52d69bbaf68dc2af990d5746"
+SRCREV = "17c3713fb3085fe5459ac0e8244a2047d55cb7ec"
 BRANCH ?= "master"
 
 S = "${WORKDIR}/git"
@@ -106,16 +106,6 @@ do_install_append () {
         printf "[provision]\nprimary_ecu_hardware_id = ${SOTA_HARDWARE_ID}\n" > ${D}${libdir}/sota/conf.d/40-hardware-id.toml
     fi
 
-    if [ -n "${SOTA_SECONDARY_CONFIG_DIR}" ]; then
-        if [ -d "${SOTA_SECONDARY_CONFIG_DIR}" ]; then
-            install -m 0700 -d ${D}${sysconfdir}/sota/ecus
-            install -m 0644 "${SOTA_SECONDARY_CONFIG_DIR}"/* ${D}${sysconfdir}/sota/ecus/
-            printf "[uptane]\nsecondary_configs_dir = /etc/sota/ecus/\n" > ${D}${libdir}/sota/conf.d/30-secondary-configs-dir.toml
-        else
-            bbwarn "SOTA_SECONDARY_CONFIG_DIR is set to an invalid directory (${SOTA_SECONDARY_CONFIG_DIR})"
-        fi
-    fi
-
     install -m 0755 -d ${D}${systemd_unitdir}/system
     aktualizr_service=${@bb.utils.contains('SOTA_CLIENT_FEATURES', 'serialcan', '${WORKDIR}/aktualizr-serialcan.service', '${WORKDIR}/aktualizr.service', d)}
     install -m 0644 ${aktualizr_service} ${D}${systemd_unitdir}/system/aktualizr.service
diff --git a/recipes-support/libp11/libp11_git.bb b/recipes-support/libp11/libp11_git.bb
deleted file mode 100644
index bedcdc8..0000000
--- a/recipes-support/libp11/libp11_git.bb
+++ /dev/null
@@ -1,40 +0,0 @@
-SUMMARY = "Library for using PKCS"
-DESCRIPTION = "\
-Libp11 is a library implementing a small layer on top of PKCS \
-make using PKCS"
-HOMEPAGE = "http://www.opensc-project.org/libp11"
-SECTION = "Development/Libraries"
-LICENSE = "LGPLv2+"
-LIC_FILES_CHKSUM = "file://COPYING;md5=fad9b3332be894bab9bc501572864b29"
-DEPENDS = "libtool openssl"
-RDEPENDS_${PN} += " opensc"
-
-SRC_URI = "git://github.com/OpenSC/libp11.git"
-SRCREV = "57ca68ff67efa08e3be1f26dec6d23bf5bb977f2"
-
-PV = "0.4.9+git${SRCPV}"
-
-S = "${WORKDIR}/git"
-
-inherit autotools pkgconfig
-
-# Currently, Makefile dependencies are incorrectly defined which causes build errors
-# if the number of jobs is high
-# See https://github.com/OpenSC/libp11/issues/94
-PARALLEL_MAKE = ""
-EXTRA_OECONF = "--disable-static"
-
-do_install_append () {
-    rm -rf ${D}${libdir}/*.la
-    rm -rf ${D}${docdir}/${BPN}
-}
-
-FILES_${PN} = "${libdir}/engines*/pkcs11.so \
-               ${libdir}/engines*/libpkcs11${SOLIBS} \
-               ${libdir}/libp11${SOLIBS}"
-
-FILES_${PN}-dev = " \
-                   ${libdir}/engines*/libpkcs11${SOLIBSDEV} \
-                   ${libdir}/libp11${SOLIBSDEV} \
-                   ${libdir}/pkgconfig/libp11.pc \
-                   /usr/include"
diff --git a/recipes-support/softhsm-testtoken/softhsm-testtoken.bb b/recipes-support/softhsm-testtoken/softhsm-testtoken.bb
index 58b521c..68514b2 100644
--- a/recipes-support/softhsm-testtoken/softhsm-testtoken.bb
+++ b/recipes-support/softhsm-testtoken/softhsm-testtoken.bb
@@ -4,7 +4,7 @@ LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda
 
 inherit systemd
 
-RDEPENDS_${PN} = "softhsm libp11 openssl-bin"
+RDEPENDS_${PN} = "softhsm libp11 opensc openssl-bin"
 DEPENDS_append = "${@bb.utils.contains('DISTRO_FEATURES', 'systemd', ' systemd', '', d)}"
 
 
diff --git a/scripts/ci/Dockerfile.bitbake b/scripts/ci/Dockerfile.bitbake
index c91f94c..51eaa57 100644
--- a/scripts/ci/Dockerfile.bitbake
+++ b/scripts/ci/Dockerfile.bitbake
@@ -1,15 +1,17 @@
-FROM debian:stable
+FROM debian:stretch
 LABEL Description="Image for bitbaking"
 
-RUN sed -i 's#deb http://deb.debian.org/debian stable main#deb http://deb.debian.org/debian stable main contrib#g' /etc/apt/sources.list
-RUN sed -i 's#deb http://deb.debian.org/debian stable-updates main#deb http://deb.debian.org/debian stable-updates main contrib#g' /etc/apt/sources.list
-RUN apt-get update -q && apt-get install -qy \
+RUN sed -i 's#deb http://deb.debian.org/debian stretch main#deb http://deb.debian.org/debian stretch main contrib#g' /etc/apt/sources.list
+RUN sed -i 's#deb http://deb.debian.org/debian stretch-updates main#deb http://deb.debian.org/debian stretch-updates main contrib#g' /etc/apt/sources.list
+RUN apt-get update -q && apt-get install --no-install-suggests --no-install-recommends -qy \
+     awscli \
      build-essential \
      bzip2 \
      chrpath \
      cpio \
      default-jre \
      diffstat \
+     file \
      gawk \
      gcc-multilib \
      git-core \
@@ -17,26 +19,40 @@ RUN apt-get update -q && apt-get install -qy \
      iproute \
      libpython-dev \
      libsdl1.2-dev \
+     libvirt-clients \
+     libvirt-daemon-system \
      locales \
      ovmf \
+     openssh-client \
      procps \
      python \
      python3 \
      python3-pexpect \
-     qemu \
+     qemu-kvm \
      socat \
+     sudo \
      texinfo \
      unzip \
      wget \
      xterm \
      xz-utils
 
-ARG uid=1000
-ARG gid=1000
+ARG uid=4321
+ARG gid=4321
 RUN groupadd -g $gid bitbake
-RUN useradd -m -u $uid -g $gid bitbake
+RUN useradd -m -u $uid -g $gid -s /bin/bash bitbake
 
 RUN echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen
 ENV LC_ALL="en_US.UTF-8"
 ENV LANG="en_US.UTF-8"
 ENV LANGUAGE="en_US.UTF-8"
+
+# script to mirror kvm group id with host
+RUN echo "bitbake ALL=NOPASSWD: /usr/local/bin/setup_kvm.sh" >> /etc/sudoers
+COPY ./docker/setup_kvm.sh /usr/local/bin/setup_kvm.sh
+
+# other ci scripts
+RUN mkdir /scripts
+COPY configure.sh build.sh oe-selftest.sh /scripts/
+
+USER "bitbake"
diff --git a/scripts/ci/Dockerfile.checkout b/scripts/ci/Dockerfile.checkout
new file mode 100644
index 0000000..5210c6b
--- /dev/null
+++ b/scripts/ci/Dockerfile.checkout
@@ -0,0 +1,13 @@
+FROM debian:stretch-slim
+LABEL Description="Image for checking out updater-repo"
+
+RUN sed -i 's#deb http://deb.debian.org/debian stretch main#deb http://deb.debian.org/debian stretch main contrib#g' /etc/apt/sources.list
+RUN sed -i 's#deb http://deb.debian.org/debian stretch-updates main#deb http://deb.debian.org/debian stretch-updates main contrib#g' /etc/apt/sources.list
+RUN apt-get update -q && apt-get install -qy \
+    git \
+    repo \
+    xmlstarlet
+
+# checkout script
+RUN mkdir /scripts
+COPY checkout-oe.sh /scripts/
diff --git a/scripts/ci/Jenkinsfile.bleeding b/scripts/ci/Jenkinsfile.bleeding
deleted file mode 100644
index 6d340fd..0000000
--- a/scripts/ci/Jenkinsfile.bleeding
+++ /dev/null
@@ -1,87 +0,0 @@
-// This CI setup checks out aktualizr, meta-updater and updater-repo and builds
-// master branches whenever a change is pushed to any of these
-
-// define these for docker image creation
-node {
-  // might cause some problems:
-  // https://stackoverflow.com/questions/44805076/setting-build-args-for-dockerfile-agent-using-a-jenkins-declarative-pipeline
-  JENKINS_UID = sh(returnStdout: true, script: 'id -u').trim()
-  JENKINS_GID = sh(returnStdout: true, script: 'id -g').trim()
-}
-
-pipeline {
-  agent any
-  environment {
-    TEST_AKTUALIZR_REMOTE = 'aktualizr'
-    TEST_AKTUALIZR_DIR = 'aktualizr'
-    TEST_AKTUALIZR_BRANCH = 'master'
-    TEST_BITBAKE_COMMON_DIR = "/opt/jenkins/bitbake-common"
-  }
-  stages {
-    stage('checkout') {
-      steps {
-
-        checkout([$class: 'GitSCM',
-            userRemoteConfigs: [
-              [url: 'https://github.com/advancedtelematic/aktualizr', name: 'aktualizr']
-            ],
-            branches: [[name: 'refs/heads/master']],
-            extensions: [
-              [$class: 'DisableRemotePoll'],
-              [$class: 'PruneStaleBranch'],
-              [$class: 'RelativeTargetDirectory',
-                relativeTargetDir: 'aktualizr'
-              ]
-            ],
-        ])
-
-        checkout([$class: 'RepoScm',
-            manifestRepositoryUrl: 'https://github.com/advancedtelematic/updater-repo',
-            manifestBranch: null,
-            manifestFile: 'master.xml',
-            manifestGroup: null,
-            mirrorDir: null,
-            jobs: 0,
-            depth: 0,
-            localManifest: null,
-            destinationDir: 'updater-repo',
-            repoUrl: null,
-            currentBranch: false,
-            resetFirst: true,
-            quiet: false,
-            trace: false,
-            showAllChanges: false,
-        ])
-
-        // ignore bitbake build directories in docker
-        sh 'echo \'build*\' > .dockerignore'
-
-        // override meta-updater commit with currently tested branch
-        sh '''
-           META_UPDATER_COMMIT=$(git rev-parse HEAD)
-           cd updater-repo/meta-updater
-           git checkout $META_UPDATER_COMMIT
-           '''
-      }
-    }
-    stage('build-core-image-minimal') {
-      agent {
-        dockerfile {
-          filename 'scripts/ci/Dockerfile.bitbake'
-          args '-v /opt/jenkins/bitbake-common:/opt/jenkins/bitbake-common'
-          additionalBuildArgs "--build-arg uid=${JENKINS_UID} --build-arg gid=${JENKINS_GID}"
-          reuseNode true
-        }
-      }
-      environment {
-        TEST_AKTUALIZR_CREDENTIALS = credentials('garage-credentials')
-      }
-      steps {
-        sh 'scripts/ci/configure.sh'
-
-        sh 'scripts/ci/build.sh core-image-minimal'
-      }
-    }
-  }
-}
-// vim: set ft=groovy tabstop=2 shiftwidth=2 expandtab:
diff --git a/scripts/ci/Jenkinsfile.bleeding-selftest b/scripts/ci/Jenkinsfile.bleeding-selftest
deleted file mode 100644
index 8c2d1de..0000000
--- a/scripts/ci/Jenkinsfile.bleeding-selftest
+++ /dev/null
@@ -1,91 +0,0 @@
-// This CI setup checks out aktualizr, meta-updater and updater-repo and builds
-// master branches whenever a change is pushed to any of these
-
-// define these for docker image creation
-node {
-  // might cause some problems:
-  // https://stackoverflow.com/questions/44805076/setting-build-args-for-dockerfile-agent-using-a-jenkins-declarative-pipeline
-  JENKINS_UID = sh(returnStdout: true, script: 'id -u').trim()
-  JENKINS_GID = sh(returnStdout: true, script: 'id -g').trim()
-}
-
-pipeline {
-  agent { 
-    node { label 'bitbake' } 
-        }
-  environment {
-    TEST_AKTUALIZR_REMOTE = 'aktualizr'
-    TEST_AKTUALIZR_DIR = 'aktualizr'
-    TEST_AKTUALIZR_BRANCH = 'master'
-    TEST_BITBAKE_COMMON_DIR = "/opt/jenkins/bitbake-common"
-  }
-  stages {
-    stage('checkout') {
-      steps {
-
-        checkout([$class: 'GitSCM',
-            userRemoteConfigs: [
-              [url: 'https://github.com/advancedtelematic/aktualizr', name: 'aktualizr']
-            ],
-            branches: [[name: 'refs/heads/master']],
-            extensions: [
-              [$class: 'DisableRemotePoll'],
-              [$class: 'PruneStaleBranch'],
-              [$class: 'RelativeTargetDirectory',
-                relativeTargetDir: 'aktualizr'
-              ]
-            ],
-        ])
-
-        checkout([$class: 'RepoScm',
-            manifestRepositoryUrl: 'https://github.com/advancedtelematic/updater-repo',
-            manifestBranch: null,
-            manifestFile: 'master.xml',
-            manifestGroup: null,
-            mirrorDir: null,
-            jobs: 0,
-            depth: 0,
-            localManifest: null,
-            destinationDir: 'updater-repo',
-            repoUrl: null,
-            currentBranch: false,
-            resetFirst: true,
-            quiet: false,
-            trace: false,
-            showAllChanges: false,
-        ])
-
-        // ignore bitbake build directories in docker
-        sh 'echo \'build*\' > .dockerignore'
-
-        // override meta-updater commit with currently tested branch
-        sh '''
-           META_UPDATER_COMMIT=$(git rev-parse HEAD)
-           cd updater-repo/meta-updater
-           git checkout $META_UPDATER_COMMIT
-           '''
-      }
-    }
-    stage('build-core-image-minimal+oe-selftest') {
-      agent {
-        dockerfile {
-          filename 'scripts/ci/Dockerfile.bitbake'
-          args '-v /opt/jenkins/bitbake-common:/opt/jenkins/bitbake-common'
-          additionalBuildArgs "--build-arg uid=${JENKINS_UID} --build-arg gid=${JENKINS_GID}"
-          reuseNode true
-        }
-      }
-      environment {
-        TEST_AKTUALIZR_CREDENTIALS = credentials('garage-credentials')
-      }
-      steps {
-        sh 'scripts/ci/configure.sh'
-
-        sh 'scripts/ci/build.sh core-image-minimal'
-
-        sh 'scripts/ci/oe-selftest.sh'
-      }
-    }
-  }
-}
-// vim: set ft=groovy tabstop=2 shiftwidth=2 expandtab:
diff --git a/scripts/ci/README.adoc b/scripts/ci/README.adoc
deleted file mode 100644
index 222982b..0000000
--- a/scripts/ci/README.adoc
+++ /dev/null
@@ -1,14 +0,0 @@
-= Jenkins setup for running meta-updater CI
-
-As bitbake is quite resource-hungry, there are some special steps that are
-needed to run Jenkins CI tasks:
-
-- docker should be installed and the `jenkins` unix user should belong to
-  the `docker` group
-- `/opt/jenkins` should exist and have `jenkins:jenkins` permissions, it
-  will be mapped as a volume on the same location in the docker build
-  container
-
-Note that for nodes running Jenkins slaves as a docker container, the
-`/opt/jenkins` directory must exist on the host system as well, with
-permissions matching the user and groupd ids in Jenkins' docker
diff --git a/scripts/ci/build.sh b/scripts/ci/build.sh
index 6235428..9fbae98 100755
--- a/scripts/ci/build.sh
+++ b/scripts/ci/build.sh
@@ -12,7 +12,10 @@ IMAGE_NAME=${1:-core-image-minimal}
 (
 set +euo pipefail
 set +x
+METADIR=$(realpath "$TEST_REPO_DIR")
+export METADIR
 . "${TEST_REPO_DIR}/meta-updater/scripts/envsetup.sh" "${TEST_MACHINE}" "${TEST_BUILD_DIR}"
 
+set -x
 bitbake "${IMAGE_NAME}"
 )
diff --git a/scripts/ci/checkout-oe.sh b/scripts/ci/checkout-oe.sh
new file mode 100755
index 0000000..fdc0e48
--- /dev/null
+++ b/scripts/ci/checkout-oe.sh
@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+set -x
+
+REMOTE_SOURCE=${REMOTE_SOURCE:-https://github.com/advancedtelematic}
+MANIFEST=${MANIFEST:-master}
+CURRENT_PROJECT=${CURRENT_PROJECT:-}
+
+# list of projects to pin to one version in the format:
+# "project:rev;project2:rev2..."
+PIN_LIST=${PIN_LIST:-}
+
+#CURRENT_REV=$(git rev-parse HEAD)
+LOCAL_REPO=$PWD
+
+mkdir -p updater-repo
+
+cd updater-repo
+
+if [ -d .repo/manifests ]; then
+    git -C .repo/manifests reset --hard
+fi
+
+repo init -m "${MANIFEST}.xml" -u "$REMOTE_SOURCE/updater-repo"
+
+# patch manifest:
+# - add a new "ats" remote that points to "$REMOTE_SOURCE"
+# - change projects that contain "advancedtelematic" to use the ats remote
+MANIFEST_FILE=".repo/manifests/${MANIFEST}.xml"
+xmlstarlet ed --omit-decl -L \
+    -s "/manifest" -t elem -n "remote" -v "" \
+    -i "/manifest/remote[last()]" -t attr -n "name" -v "ats" \
+    -i "/manifest/remote[last()]" -t attr -n "fetch" -v "$REMOTE_SOURCE" \
+    -d "/manifest/project[contains(@name, 'advancedtelematic')]/@remote" \
+    -i "/manifest/project[contains(@name, 'advancedtelematic')]" -t attr -n "remote" -v "ats" \
+    "$MANIFEST_FILE"
+
+# hack: sed on `advancedtelematic/` names, to remove this unwanted prefix
+sed -i 's#name="advancedtelematic/#name="#g' "$MANIFEST_FILE"
+
+# pin projects from the list
+(
+IFS=";"
+for pin in $PIN_LIST; do
+    IFS=":"
+    read -r project rev <<< "$pin"
+    xmlstarlet ed --omit-decl -L \
+        -d "/manifest/project[@name=\"$project\"]/@revision" \
+        -i "/manifest/project[@name=\"$project\"]/@revision" -t attr -n "revision" -v "$rev" \
+        -i "/manifest/project[@name=\"$project\"]" -t attr -n "revision" -v "$rev" \
+        "$MANIFEST_FILE"
+    IFS=";"
+done
+)
+
+# Remove the current project from the manifest if we have it checked out
+if [ -n "$CURRENT_PROJECT" ]; then
+    xmlstarlet ed --omit-decl -L \
+        -d "/manifest/project[@name=\"$CURRENT_PROJECT\"]" \
+        "$MANIFEST_FILE"
+fi
+
+repo manifest
+
+repo forall -c 'git reset --hard ; git clean -fdx'
+
+repo sync -d --force-sync
+
+if [ -n "$CURRENT_PROJECT" ]; then
+    rm -f "$CURRENT_PROJECT"
+    ln -s "$LOCAL_REPO" "$CURRENT_PROJECT"
+fi
+
+repo manifest -r
diff --git a/scripts/ci/configure.sh b/scripts/ci/configure.sh
index 960a0cc..67563ed 100755
--- a/scripts/ci/configure.sh
+++ b/scripts/ci/configure.sh
@@ -8,9 +8,13 @@ TEST_BUILD_DIR=${TEST_BUILD_DIR:-build}
 TEST_REPO_DIR=${TEST_REPO_DIR:-updater-repo}
 TEST_BITBAKE_COMMON_DIR=${TEST_BITBAKE_COMMON_DIR:-}
 
-TEST_AKTUALIZR_DIR=${TEST_AKTUALIZR_DIR:-.}
-TEST_AKTUALIZR_BRANCH=${TEST_AKTUALIZR_BRANCH:-master}
-TEST_AKTUALIZR_REV=${TEST_AKTUALIZR_REV:-$(GIT_DIR="$TEST_AKTUALIZR_DIR/.git" git rev-parse "$TEST_AKTUALIZR_REMOTE/$TEST_AKTUALIZR_BRANCH")}
+TEST_AKTUALIZR_REMOTE=${TEST_AKTUALIZR_REMOTE:-}
+if [ -n "$TEST_AKTUALIZR_REMOTE" ]; then
+    TEST_AKTUALIZR_DIR=${TEST_AKTUALIZR_DIR:-.}
+    TEST_AKTUALIZR_BRANCH=${TEST_AKTUALIZR_BRANCH:-master}
+    TEST_AKTUALIZR_REV=${TEST_AKTUALIZR_REV:-$(GIT_DIR="$TEST_AKTUALIZR_DIR/.git" git rev-parse "$TEST_AKTUALIZR_REMOTE/$TEST_AKTUALIZR_BRANCH")}
+fi
+
 TEST_AKTUALIZR_CREDENTIALS=${TEST_AKTUALIZR_CREDENTIALS:-}
 
 # move existing conf directory to backup, before generating a new one
@@ -21,6 +25,8 @@ mv "$TEST_BUILD_DIR/conf" "$TEST_BUILD_DIR/conf.old" || true
 set +euo pipefail
 set +x
 echo ">> Running envsetup.sh"
+METADIR=$(realpath "$TEST_REPO_DIR")
+export METADIR
 . "$TEST_REPO_DIR/meta-updater/scripts/envsetup.sh" "$TEST_MACHINE" "$TEST_BUILD_DIR"
 )
 
@@ -31,19 +37,19 @@ SITE_CONF="$TEST_BUILD_DIR/conf/site.conf"
 echo ">> Set common bitbake config options"
 cat << EOF > "$SITE_CONF"
 SANITY_TESTED_DISTROS = ""
-SSTATE_MIRRORS ?= "file://.* https://bitbake-cache.atsgarage.com/PATH;downloadfilename=PATH"
 IMAGE_FEATURES += "ssh-server-openssh"
 
 EOF
 
-echo ">> Set aktualizr branch in bitbake's config"
-cat << EOF >> "$SITE_CONF"
+if [ -n "$TEST_AKTUALIZR_REMOTE" ]; then
+    echo ">> Set aktualizr branch in bitbake's config"
+    cat << EOF >> "$SITE_CONF"
 SRCREV_pn-aktualizr = "$TEST_AKTUALIZR_REV"
 SRCREV_pn-aktualizr-native = "\${SRCREV_pn-aktualizr}"
 BRANCH_pn-aktualizr = "$TEST_AKTUALIZR_BRANCH"
 BRANCH_pn-aktualizr-native = "\${BRANCH_pn-aktualizr}"
-
 EOF
+fi
 
 if [[ -n $TEST_AKTUALIZR_CREDENTIALS ]]; then
     echo ">> Set aktualizr credentials"
@@ -63,3 +69,6 @@ SSTATE_DIR = "$SSTATE_DIR"
 DL_DIR = "$DL_DIR"
 EOF
 fi
+
+echo -e ">> Final configuration (site.conf):\n"
+cat "$SITE_CONF"
diff --git a/scripts/ci/docker/setup_kvm.sh b/scripts/ci/docker/setup_kvm.sh
new file mode 100755
index 0000000..1ffbbf5
--- /dev/null
+++ b/scripts/ci/docker/setup_kvm.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+# This script makes the gid of the 'kvm' group to match the group
+# owner of '/dev/kvm'
+#
+# These two are not guaranteed to match when a docker image starts
+# with access to '/dev/kvm' that comes from the host
+
+set -euo pipefail
+
+kvm_gid=$(stat -c "%g" /dev/kvm)
+groupmod -g "$kvm_gid" kvm
+usermod -a -G kvm bitbake
+ln -s /bin/true /usr/bin/kvm-ok
diff --git a/scripts/ci/gitlab/checkout.yml b/scripts/ci/gitlab/checkout.yml
new file mode 100644
index 0000000..28c9177
--- /dev/null
+++ b/scripts/ci/gitlab/checkout.yml
@@ -0,0 +1,16 @@
+.bb_checkout:
+  # parameters:
+  #   - MANIFEST
+  #   - REMOTE_SOURCE
+  #   - CURRENT_PROJECT (will be symlinked instead of pulled)
+
+  image: $BITBAKE_CHECKOUT_IMAGE
+  cache:
+    paths:
+      - updater-repo
+  artifacts:
+    expire_in: "1 day"
+    paths:
+      - updater-repo
+  script:
+    - /scripts/checkout-oe.sh
diff --git a/scripts/ci/gitlab/docker.yml b/scripts/ci/gitlab/docker.yml
new file mode 100644
index 0000000..5b81d77
--- /dev/null
+++ b/scripts/ci/gitlab/docker.yml
@@ -0,0 +1,37 @@
+.bb_docker_local:
+  # intended to be run on meta-updater's master branch which contains the
+  # reference docker files
+  # parameters:
+  #   - BITBAKE_IMAGE
+  #   - BITBAKE_CHECKOUT_IMAGE
+  #   - BITBKAE_IMAGE_MASTER
+  #   - BITBAKE_CHECKOUT_IMAGE_MASTER
+  image: docker:18
+  stage: docker
+  services:
+    - docker:18-dind
+  before_script:
+    - docker login -u gitlab-ci-token -p "$CI_JOB_TOKEN" "$CI_REGISTRY"
+  script:
+    - docker pull "$BITBAKE_IMAGE" || docker pull "$BITBKAE_IMAGE_MASTER" || true
+    - docker build --pull --cache-from "$BITBKAE_IMAGE_MASTER" --cache-from "$BITBAKE_IMAGE" -f ./scripts/ci/Dockerfile.bitbake -t "$BITBAKE_IMAGE" ./scripts/ci
+    - docker push "$BITBAKE_IMAGE"
+
+    - docker pull "$BITBAKE_CHECKOUT_IMAGE" || docker pull "$BITBAKE_CHECKOUT_IMAGE_MASTER" || true
+    - docker build --pull --cache-from "$BITBAKE_CHECKOUT_IMAGE_MASTER" --cache-from "$BITBAKE_CHECKOUT_IMAGE" -f ./scripts/ci/Dockerfile.checkout -t "$BITBAKE_CHECKOUT_IMAGE" ./scripts/ci
+    - docker push "$BITBAKE_CHECKOUT_IMAGE"
+
+.bb_docker_remote:
+  # intended to be run on other branches and repos: just pulls the last master image
+  # parameters:
+  #   - BITBAKE_IMAGE
+  #   - BITBAKE_CHECKOUT_IMAGE
+  image: docker:18
+  stage: docker
+  services:
+    - docker:18-dind
+  before_script:
+    - docker login -u gitlab-ci-token -p "$CI_JOB_TOKEN" "$CI_REGISTRY"
+  script:
+    - docker pull "$BITBAKE_IMAGE"
+    - docker pull "$BITBAKE_CHECKOUT_IMAGE"
diff --git a/scripts/ci/gitlab/tests.yml b/scripts/ci/gitlab/tests.yml
new file mode 100644
index 0000000..4bd5844
--- /dev/null
+++ b/scripts/ci/gitlab/tests.yml
@@ -0,0 +1,36 @@
+.bitbake:
+  # parameters:
+  #   - TEST_BUILD_DIR
+  #   - TEST_MACHINE (defaults to qemux86-64)
+  #   - BITBAKE_TARGETS
+  image: $BITBAKE_IMAGE
+  dependencies:
+    - Checkout
+  tags:
+    - bitbake
+  script:
+    - /scripts/configure.sh
+    - /scripts/build.sh $BITBAKE_TARGETS
+
+.oe-selftest:
+  # parameters:
+  #   - TEST_BUILD_DIR
+  #   - TEST_MACHINE (defaults to qemux86-64)
+  #   - OE_SELFTESTS
+  image: $BITBAKE_IMAGE
+  dependencies:
+    - Checkout
+  tags:
+    - bitbake
+  variables:
+    TEST_AKTUALIZR_CREDENTIALS: $CI_PROJECT_DIR/credentials.zip
+  before_script:
+    - aws s3 cp s3://ota-gitlab-ci/hereotaconnect_prod.zip credentials.zip
+    - sudo /usr/local/bin/setup_kvm.sh
+  script:
+    - |
+      # sg is needed after adding bitbake to the kvm group (see setup_kvm.sh)
+      sg kvm << EOS
+      /scripts/configure.sh
+      /scripts/oe-selftest.sh $OE_SELFTESTS
+      EOS
diff --git a/scripts/ci/oe-selftest.sh b/scripts/ci/oe-selftest.sh
index 3124cce..178e7c1 100755
--- a/scripts/ci/oe-selftest.sh
+++ b/scripts/ci/oe-selftest.sh
@@ -12,7 +12,15 @@ TEST_REPO_DIR=${TEST_REPO_DIR:-updater-repo}
 (
 set +euo pipefail
 set +x
+METADIR=$(realpath "$TEST_REPO_DIR")
+export METADIR
 . "${TEST_REPO_DIR}/meta-updater/scripts/envsetup.sh" "${TEST_MACHINE}" "${TEST_BUILD_DIR}"
 
-oe-selftest -r updater
+set -x
+
+# work poky around bug on sumo and thud
+# see https://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=d3a94e5b9b3c107cf54d5639071cc6609c002f67
+mkdir -p "tmp/log"
+
+oe-selftest -r "$@"
 )
diff --git a/scripts/envsetup.sh b/scripts/envsetup.sh
index 6103cf6..5827bc2 100755
--- a/scripts/envsetup.sh
+++ b/scripts/envsetup.sh
@@ -21,7 +21,7 @@ if [[ $SOURCED -ne 1 ]]; then
   exit 1
 fi
 
-METADIR="${SOURCEDIR}/../.."
+METADIR=${METADIR:-${SOURCEDIR}/../..}
 
 if [[ ! -f "${BUILDDIR}/conf/local.conf" ]]; then
   source "$METADIR/poky/oe-init-build-env" "$BUILDDIR"
diff --git a/scripts/qemucommand.py b/scripts/qemucommand.py
index 1049d7c..3045b45 100644
--- a/scripts/qemucommand.py
+++ b/scripts/qemucommand.py
@@ -2,7 +2,7 @@ from os.path import exists, join, realpath, abspath
 from os import listdir
 import random
 import socket
-from subprocess import check_output, CalledProcessError
+from subprocess import check_output
 
 EXTENSIONS = {
     'intel-corei7-64': 'wic',
@@ -68,6 +68,10 @@ class QemuCommand(object):
             self.mac_address = random_mac()
         self.serial_port = find_local_port(8990)
         self.ssh_port = find_local_port(2222)
+        if args.mem:
+            self.mem = args.mem
+        else:
+            self.mem = "1G"
         if args.kvm is None:
             # Autodetect KVM using 'kvm-ok'
             try:
@@ -95,7 +99,7 @@ class QemuCommand(object):
             cmdline += ["-drive", "file=%s,if=ide,format=raw,snapshot=on" % self.image]
         cmdline += [
             "-serial", "tcp:127.0.0.1:%d,server,nowait" % self.serial_port,
-            "-m", "1G",
+            "-m", self.mem,
             "-usb",
             "-object", "rng-random,id=rng0,filename=/dev/urandom",
             "-device", "virtio-rng-pci,rng=rng0",
@@ -131,4 +135,3 @@ class QemuCommand(object):
             "-f", "qcow2",
             self.overlay]
         return cmdline
-
diff --git a/scripts/run-qemu-ota b/scripts/run-qemu-ota
index b2f55e9..de63297 100755
--- a/scripts/run-qemu-ota
+++ b/scripts/run-qemu-ota
@@ -26,6 +26,7 @@ def main():
                            dest='kvm', action='store_true', default=None)
     kvm_group.add_argument('--no-kvm', help='Disable KVM in QEMU',
                            dest='kvm', action='store_false')
+    parser.add_argument('--mem', default=None, help="Amount of memory the machine boots with")
     parser.add_argument('--no-gui', help='Disable GUI', action='store_true')
     parser.add_argument('--gdb', help='Export gdbserver port 2159 from the image', action='store_true')
     parser.add_argument('--pcap', default=None, help='Dump all network traffic')