7 files changed, 68 insertions, 201 deletions

diff --git a/classes/image_types_ostree.bbclass b/classes/image_types_ostree.bbclass
index 1f8e195..172f2c8 100644
--- a/classes/image_types_ostree.bbclass
+++ b/classes/image_types_ostree.bbclass
@@ -5,6 +5,7 @@ inherit image
 IMAGE_DEPENDS_ostree = "ostree-native:do_populate_sysroot \
                         openssl-native:do_populate_sysroot \
                         coreutils-native:do_populate_sysroot \
+                        unzip-native:do_populate_sysroot \
                         virtual/kernel:do_deploy \
                         ${OSTREE_INITRAMFS_IMAGE}:do_image_complete"
 
@@ -104,6 +105,7 @@ IMAGE_CMD_ostree () {
     if [ -d root ] && [ ! -L root ]; then
         if [ "$(ls -A root)" ]; then
             bberror "Data in /root directory is not preserved by OSTree."
+            exit 1
         fi
 
         if [ -n "$SYSTEMD_USED" ]; then
@@ -159,7 +161,7 @@ IMAGE_CMD_ostree () {
 }
 
 IMAGE_TYPEDEP_ostreepush = "ostree"
-IMAGE_DEPENDS_ostreepush = "aktualizr-native:do_populate_sysroot"
+IMAGE_DEPENDS_ostreepush = "aktualizr-native:do_populate_sysroot ca-certificates-native:do_populate_sysroot "
 IMAGE_CMD_ostreepush () {
     # Print warnings if credetials are not set or if the file has not been found.
     if [ -n "${SOTA_PACKED_CREDENTIALS}" ]; then
@@ -176,4 +178,58 @@ IMAGE_CMD_ostreepush () {
     fi
 }
 
+IMAGE_TYPEDEP_garagesign = "ostreepush"
+IMAGE_DEPENDS_garagesign = "garage-sign-native:do_populate_sysroot"
+IMAGE_CMD_garagesign () {
+    if [ -n "${SOTA_PACKED_CREDENTIALS}" ]; then
+        # if credentials are issued by a server that doesn't support offline signing, exit silently
+        unzip -p ${SOTA_PACKED_CREDENTIALS} root.json targets.pub targets.sec 2>&1 >/dev/null || exit 0
+
+        java_version=$( java -version 2>&1 | awk -F '"' '/version/ {print $2}' )
+        if [ "${java_version}" = "" ]; then
+            bberror "Java is required for synchronization with update backend, but is not installed on the host machine"
+            exit 1
+        elif [ "${java_version}" \< "1.8" ]; then
+            bberror "Java version >= 8 is required for synchronization with update backend"
+            exit 1
+        fi
+
+        if [ ! -d "${GARAGE_SIGN_REPO}" ]; then
+            garage-sign init --repo ${GARAGE_SIGN_REPO} --home-dir ${GARAGE_SIGN_REPO} --credentials ${SOTA_PACKED_CREDENTIALS}
+        fi
+
+        if [ -n "${GARAGE_SIGN_REPOSERVER}" ]; then
+            reposerver_args="--reposerver ${GARAGE_SIGN_REPOSERVER}"
+        else
+            reposerver_args=""
+        fi
+
+        ostree_target_hash=$(cat ${OSTREE_REPO}/refs/heads/${OSTREE_BRANCHNAME})
+
+        # Push may fail due to race condition when multiple build machines try to push simultaneously
+        #   in which case targets.json should be pulled again and the whole procedure repeated
+        push_success=0
+        for push_retries in $( seq 3 ); do
+            garage-sign targets pull --repo ${GARAGE_SIGN_REPO} --home-dir ${GARAGE_SIGN_REPO} ${reposerver_args}
+            garage-sign targets add --repo ${GARAGE_SIGN_REPO} --home-dir ${GARAGE_SIGN_REPO} --name ${OSTREE_BRANCHNAME} --format OSTREE --version ${OSTREE_BRANCHNAME} --length 0 --url "https://example.com/" --sha256 ${ostree_target_hash} --hardwareids ${MACHINE}
+            garage-sign targets sign --repo ${GARAGE_SIGN_REPO} --home-dir ${GARAGE_SIGN_REPO} --key-name=targets
+            errcode=0
+            garage-sign targets push --repo ${GARAGE_SIGN_REPO} --home-dir ${GARAGE_SIGN_REPO} ${reposerver_args} || errcode=$?
+            if [ "$errcode" -eq "0" ]; then
+                push_success=1
+                break
+            else
+                bbwarn "Push to garage repository has failed, retrying"
+            fi
+        done
+
+        if [ "$push_success" -ne "1" ]; then
+            bberror "Couldn't push to garage repository"
+            exit 1
+        fi
+    else
+        bbwarn "SOTA_PACKED_CREDENTIALS not set. Please add SOTA_PACKED_CREDENTIALS."
+    fi
+}
+
 # vim:set ts=4 sw=4 sts=4 expandtab:
diff --git a/classes/sdcard_image-rpi-ota.bbclass b/classes/sdcard_image-rpi-ota.bbclass
deleted file mode 100644
index 9c859fe..0000000
--- a/classes/sdcard_image-rpi-ota.bbclass
+++ /dev/null
@@ -1,190 +0,0 @@
-inherit image_types
-inherit linux-raspberrypi-base
-
-#
-# Create an image that can by written onto a SD card using dd.
-#
-# The disk layout used is:
-#
-#    0                      -> IMAGE_ROOTFS_ALIGNMENT         - reserved for other data
-#    IMAGE_ROOTFS_ALIGNMENT -> BOOT_SPACE                     - bootloader and kernel
-#    BOOT_SPACE             -> SDIMG_OTA_SIZE                 - rootfs
-#
-
-#                                                     Default Free space = 1.3x
-#                                                     Use IMAGE_OVERHEAD_FACTOR to add more space
-#                                                     <--------->
-#            4MiB              40MiB           SDIMG_OTA_ROOTFS
-# <-----------------------> <----------> <---------------------->
-#  ------------------------ ------------ ------------------------
-# | IMAGE_ROOTFS_ALIGNMENT | BOOT_SPACE | OTAROOT_SIZE           |
-#  ------------------------ ------------ ------------------------
-# ^                        ^            ^                        ^
-# |                        |            |                        |
-# 0                      4MiB     4MiB + 40MiB       4MiB + 40Mib + SDIMG_OTA_ROOTFS
-
-# This image depends on the rootfs image
-IMAGE_TYPEDEP_rpi-sdimg-ota = "${SDIMG_OTA_ROOTFS_TYPE}"
-
-# Set kernel and boot loader
-IMAGE_BOOTLOADER ?= "bcm2835-bootfiles"
-
-# Set initramfs extension
-KERNEL_INITRAMFS ?= ""
-
-# Kernel image name
-SDIMG_OTA_KERNELIMAGE_raspberrypi  ?= "kernel.img"
-SDIMG_OTA_KERNELIMAGE_raspberrypi2 ?= "kernel7.img"
-SDIMG_OTA_KERNELIMAGE_raspberrypi3 ?= "kernel7.img"
-
-# Boot partition volume id
-BOOTDD_VOLUME_ID ?= "${MACHINE}"
-
-# Boot partition size [in KiB] (will be rounded up to IMAGE_ROOTFS_ALIGNMENT)
-BOOT_SPACE ?= "40960"
-
-# Set alignment to 4MB [in KiB]
-IMAGE_ROOTFS_ALIGNMENT = "4096"
-
-# Use an uncompressed ext3 by default as rootfs
-SDIMG_OTA_ROOTFS_TYPE ?= "otaimg"
-SDIMG_OTA_ROOTFS = "${DEPLOY_DIR_IMAGE}/${IMAGE_LINK_NAME}.${SDIMG_OTA_ROOTFS_TYPE}"
-
-IMAGE_DEPENDS_rpi-sdimg-ota = " \
-                        parted-native \
-                        mtools-native \
-                        dosfstools-native \
-                        virtual/kernel:do_deploy \
-                        ${IMAGE_BOOTLOADER} \
-                        u-boot \
-                        "
-IMAGE_TYPEDEP_rpi-sdimg-ota = "otaimg"
-
-# SD card image name
-SDIMG_OTA = "${IMGDEPLOYDIR}/${IMAGE_NAME}.rootfs.rpi-sdimg-ota"
-
-# Compression method to apply to SDIMG_OTA after it has been created. Supported
-# compression formats are "gzip", "bzip2" or "xz". The original .rpi-sdimg-ota file
-# is kept and a new compressed file is created if one of these compression
-# formats is chosen. If SDIMG_OTA_COMPRESSION is set to any other value it is
-# silently ignored.
-#SDIMG_OTA_COMPRESSION ?= ""
-
-# Additional files and/or directories to be copied into the vfat partition from the IMAGE_ROOTFS.
-FATPAYLOAD ?= ""
-
-IMAGE_CMD_rpi-sdimg-ota () {
-
-        # Align partitions
-        OTAROOT_SIZE=`du -Lb ${SDIMG_OTA_ROOTFS} | cut -f1`
-        OTAROOT_SIZE=$(expr ${OTAROOT_SIZE} / 1024 + 1)
-        BOOT_SPACE_ALIGNED=$(expr ${BOOT_SPACE} + ${IMAGE_ROOTFS_ALIGNMENT} - 1)
-        BOOT_SPACE_ALIGNED=$(expr ${BOOT_SPACE_ALIGNED} - ${BOOT_SPACE_ALIGNED} % ${IMAGE_ROOTFS_ALIGNMENT})
-        SDIMG_OTA_SIZE=$(expr ${IMAGE_ROOTFS_ALIGNMENT} + ${BOOT_SPACE_ALIGNED} + $OTAROOT_SIZE)
-
-        echo "Creating filesystem with Boot partition ${BOOT_SPACE_ALIGNED} KiB and RootFS $OTAROOT_SIZE KiB"
-
-        # Check if we are building with device tree support
-        DTS="${@get_dts(d, None)}"
-
-        # Initialize sdcard image file
-        dd if=/dev/zero of=${SDIMG_OTA} bs=1024 count=0 seek=${SDIMG_OTA_SIZE}
-
-        # Create partition table
-        parted -s ${SDIMG_OTA} mklabel msdos
-        # Create boot partition and mark it as bootable
-        parted -s ${SDIMG_OTA} unit KiB mkpart primary fat32 ${IMAGE_ROOTFS_ALIGNMENT} $(expr ${BOOT_SPACE_ALIGNED} \+ ${IMAGE_ROOTFS_ALIGNMENT})
-        parted -s ${SDIMG_OTA} set 1 boot on
-        # Create rootfs partition to the end of disk
-        parted -s ${SDIMG_OTA} -- unit KiB mkpart primary ext2 $(expr ${BOOT_SPACE_ALIGNED} \+ ${IMAGE_ROOTFS_ALIGNMENT}) -1s
-        parted ${SDIMG_OTA} print
-
-        # Create a vfat image with boot files
-        BOOT_BLOCKS=$(LC_ALL=C parted -s ${SDIMG_OTA} unit b print | awk '/ 1 / { print substr($4, 1, length($4 -1)) / 512 /2 }')
-        rm -f ${WORKDIR}/boot.img
-        mkfs.vfat -n "${BOOTDD_VOLUME_ID}" -S 512 -C ${WORKDIR}/boot.img $BOOT_BLOCKS
-        sync
-
-        mcopy -i ${WORKDIR}/boot.img -s ${DEPLOY_DIR_IMAGE}/bcm2835-bootfiles/* ::/
-        
-        if test -n "${DTS}"; then
-                # Device Tree Overlays are assumed to be suffixed by '-overlay.dtb' string and will be put in a dedicated folder
-                DT_OVERLAYS="${@split_overlays(d, 0)}"
-                DT_ROOT="${@split_overlays(d, 1)}"
-
-                # Copy board device trees to root folder
-                for DTB in ${DT_ROOT}; do
-                        DTB_BASE_NAME=`basename ${DTB} .dtb`
-
-                        mcopy -i ${WORKDIR}/boot.img -s ${DEPLOY_DIR_IMAGE}/${KERNEL_IMAGETYPE}-${DTB_BASE_NAME}.dtb ::${DTB_BASE_NAME}.dtb
-                done
-
-                # Copy device tree overlays to dedicated folder
-                mmd -i ${WORKDIR}/boot.img overlays
-                for DTB in ${DT_OVERLAYS}; do
-                        DTB_EXT=${DTB##*.}
-                        DTB_BASE_NAME=`basename ${DTB} ."${DTB_EXT}"`
-
-                        mcopy -i ${WORKDIR}/boot.img -s ${DEPLOY_DIR_IMAGE}/${KERNEL_IMAGETYPE}-${DTB_BASE_NAME}.${DTB_EXT} ::overlays/${DTB_BASE_NAME}.${DTB_EXT}
-                done
-        fi
-
-        case "${KERNEL_IMAGETYPE}" in
-        "uImage")
-                mcopy -i ${WORKDIR}/boot.img -s ${DEPLOY_DIR_IMAGE}/u-boot.bin ::${SDIMG_OTA_KERNELIMAGE}
-                ;;
-        *)
-                bbfatal "Kernel uImage is required for OTA image. Please set KERNEL_IMAGETYPE to \"uImage\""
-                ;;
-        esac
-
-        if [ -n ${FATPAYLOAD} ] ; then
-                echo "Copying payload into VFAT"
-                for entry in ${FATPAYLOAD} ; do
-                                # add the || true to stop aborting on vfat issues like not supporting .~lock files
-                                mcopy -i ${WORKDIR}/boot.img -s -v ${IMAGE_ROOTFS}$entry :: || true
-                done
-        fi
-
-        # Add stamp file
-        echo "${IMAGE_NAME}" > ${WORKDIR}/image-version-info
-        mcopy -i ${WORKDIR}/boot.img -v ${WORKDIR}//image-version-info ::
-
-        # Burn Partitions
-        sync
-        dd if=${WORKDIR}/boot.img of=${SDIMG_OTA} conv=notrunc seek=1 bs=$(expr ${IMAGE_ROOTFS_ALIGNMENT} \* 1024) && sync && sync
-        # If SDIMG_OTA_ROOTFS_TYPE is a .xz file use xzcat
-        if echo "${SDIMG_OTA_ROOTFS_TYPE}" | egrep -q "*\.xz"
-        then
-                xzcat ${SDIMG_OTA_ROOTFS} | dd of=${SDIMG_OTA} conv=notrunc seek=1 bs=$(expr 1024 \* ${BOOT_SPACE_ALIGNED} + ${IMAGE_ROOTFS_ALIGNMENT} \* 1024) && sync && sync
-        else
-                dd if=${SDIMG_OTA_ROOTFS} of=${SDIMG_OTA} conv=notrunc seek=1 bs=$(expr 1024 \* ${BOOT_SPACE_ALIGNED} + ${IMAGE_ROOTFS_ALIGNMENT} \* 1024) && sync && sync
-        fi
-
-        # Optionally apply compression
-        case "${SDIMG_OTA_COMPRESSION}" in
-        "gzip")
-                gzip -k9 "${SDIMG_OTA}"
-                ;;
-        "bzip2")
-                bzip2 -k9 "${SDIMG_OTA}"
-                ;;
-        "xz")
-                xz -k "${SDIMG_OTA}"
-                ;;
-        esac
-}
-
-ROOTFS_POSTPROCESS_COMMAND += " rpi_generate_sysctl_config ; "
-
-rpi_generate_sysctl_config() {
-        # systemd sysctl config
-        test -d ${IMAGE_ROOTFS}${sysconfdir}/sysctl.d && \
-                echo "vm.min_free_kbytes = 8192" > ${IMAGE_ROOTFS}${sysconfdir}/sysctl.d/rpi-vm.conf
-
-        # sysv sysctl config
-        IMAGE_SYSCTL_CONF="${IMAGE_ROOTFS}${sysconfdir}/sysctl.conf"
-        test -e ${IMAGE_ROOTFS}${sysconfdir}/sysctl.conf && \
-                sed -e "/vm.min_free_kbytes/d" -i ${IMAGE_SYSCTL_CONF}
-        echo "" >> ${IMAGE_SYSCTL_CONF} && echo "vm.min_free_kbytes = 8192" >> ${IMAGE_SYSCTL_CONF}
-}
diff --git a/classes/sota.bbclass b/classes/sota.bbclass
index 1865356..f5a42c1 100644
--- a/classes/sota.bbclass
+++ b/classes/sota.bbclass
@@ -5,11 +5,13 @@ python __anonymous() {
 
 OVERRIDES .= "${@bb.utils.contains('DISTRO_FEATURES', 'sota', ':sota', '', d)}"
 
+HOSTTOOLS_NONFATAL += "java"
+
 SOTA_CLIENT ??= "aktualizr"
 SOTA_CLIENT_PROV ??= "aktualizr-auto-prov"
 IMAGE_INSTALL_append_sota = " ostree os-release ${SOTA_CLIENT} ${SOTA_CLIENT_PROV}"
 IMAGE_CLASSES += " image_types_ostree image_types_ota"
-IMAGE_FSTYPES += "${@bb.utils.contains('DISTRO_FEATURES', 'sota', 'ostreepush otaimg wic', ' ', d)}"
+IMAGE_FSTYPES += "${@bb.utils.contains('DISTRO_FEATURES', 'sota', 'ostreepush garagesign otaimg wic', ' ', d)}"
 
 PACKAGECONFIG_append_pn-curl = "${@bb.utils.contains('SOTA_CLIENT_FEATURES', 'hsm', " ssl", " ", d)}"
 PACKAGECONFIG_remove_pn-curl = "${@bb.utils.contains('SOTA_CLIENT_FEATURES', 'hsm', " gnutls", " ", d)}"
@@ -25,6 +27,11 @@ OSTREE_BRANCHNAME ?= "${MACHINE}"
 OSTREE_OSNAME ?= "poky"
 OSTREE_INITRAMFS_IMAGE ?= "initramfs-ostree-image"
 
+
+GARAGE_SIGN_REPO ?= "${DEPLOY_DIR_IMAGE}/garage_sign_repo"
+GARAGE_SIGN_KEYNAME ?= "garage-key"
+GARAGE_TARGET_NAME ?= "${OSTREE_BRANCHNAME}"
+
 SOTA_MACHINE ??="none"
 SOTA_MACHINE_raspberrypi2 ?= "raspberrypi"
 SOTA_MACHINE_raspberrypi3 ?= "raspberrypi"
diff --git a/classes/sota_am335x-evm-wifi.bbclass b/classes/sota_am335x-evm-wifi.bbclass
index 821e8fb..adefb47 100644
--- a/classes/sota_am335x-evm-wifi.bbclass
+++ b/classes/sota_am335x-evm-wifi.bbclass
@@ -1,5 +1,3 @@
-IMAGE_CLASSES += "image_types_uboot"
-
 KERNEL_IMAGETYPE_sota = "uImage"
 
 OSTREE_BOOTLOADER ?= "u-boot"
diff --git a/classes/sota_m3ulcb.bbclass b/classes/sota_m3ulcb.bbclass
index 21d04ba..6b63af4 100644
--- a/classes/sota_m3ulcb.bbclass
+++ b/classes/sota_m3ulcb.bbclass
@@ -2,7 +2,6 @@
 OSTREE_KERNEL = "Image"
 
 EXTRA_IMAGEDEPENDS_append_sota = " m3ulcb-ota-bootfiles"
-IMAGE_CLASSES_append_sota = " image_types_uboot "
 IMAGE_BOOT_FILES_sota += "m3ulcb-ota-bootfiles/*"
 
 OSTREE_BOOTLOADER ?= "u-boot"
diff --git a/classes/sota_porter.bbclass b/classes/sota_porter.bbclass
index a8f5ba1..75ae579 100644
--- a/classes/sota_porter.bbclass
+++ b/classes/sota_porter.bbclass
@@ -2,7 +2,6 @@
 OSTREE_KERNEL = "uImage+dtb"
 
 EXTRA_IMAGEDEPENDS_append_sota = " porter-bootfiles"
-IMAGE_CLASSES_append_sota = " image_types_uboot "
 IMAGE_BOOT_FILES_sota += "porter-bootfiles/*"
 
 OSTREE_BOOTLOADER ?= "u-boot"
diff --git a/classes/sota_raspberrypi.bbclass b/classes/sota_raspberrypi.bbclass
index cc6b666..51d07b2 100644
--- a/classes/sota_raspberrypi.bbclass
+++ b/classes/sota_raspberrypi.bbclass
@@ -1,11 +1,9 @@
-IMAGE_CLASSES += "${@bb.utils.contains('DISTRO_FEATURES', 'sota', 'image_types_uboot sdcard_image-rpi-ota', '', d)}"
-IMAGE_FSTYPES += "${@bb.utils.contains('DISTRO_FEATURES', 'sota', 'rpi-sdimg-ota.xz', 'rpi-sdimg.xz', d)}"
-
-IMAGE_FSTYPES_remove = "${@bb.utils.contains('DISTRO_FEATURES', 'sota', 'wic rpi-sdimg rpi-sdimg.xz', '', d)}"
-
 KERNEL_IMAGETYPE_sota = "uImage"
 PREFERRED_PROVIDER_virtual/bootloader_sota ?= "u-boot"
 UBOOT_MACHINE_raspberrypi2_sota ?= "rpi_2_defconfig"
 UBOOT_MACHINE_raspberrypi3_sota ?= "rpi_3_32b_defconfig"
 
 OSTREE_BOOTLOADER ?= "u-boot"
+
+# OSTree puts its own boot.scr to bcm2835-bootfiles
+IMAGE_BOOT_FILES_remove_sota += "boot.scr"