Shellcheck ci

.github/workflows/distribution-version.py

@@ -0,0 +1,93 @@
+import os
+import re
+
+import bb.tinfoil
+import git
+
+# TODO: add minor version numbers once we have them
+RE_VERSION_TAG = "v(?P<year>[0-9][0-9])\.(?P<month>[0-9][0-9])"
+RE_VERSION_BB = "(?P<year>[0-9][0-9])\.(?P<month>[0-9][0-9])(?P<dev>$|\+dev)"
+
+
+def bb_variables(names):
+    ret = dict()
+
+    with bb.tinfoil.Tinfoil(tracking=True, setup_logging=True) as tinfoil:
+        tinfoil.prepare(quiet=2, config_only=True)
+        d = tinfoil.config_data
+
+        for name in names:
+            ret[name] = d.getVar(name)
+
+    return ret
+
+
+def git_prev_tag():
+    repo = git.Repo()
+
+    # e.g. 'v23.11'
+    tag = repo.git.describe(tags=True, abbrev=0)
+
+    # e.g. 'v23.11-40-ga4a1'
+    commit_description = repo.git.describe(tags=True)
+
+    # The description matches the tag if there are no commits since the
+    # last tag.
+    commit_is_tagged = tag == commit_description
+
+    return (tag, commit_is_tagged)
+
+
+def check_version(distro_version):
+    prev_tag, commit_is_tagged = git_prev_tag()
+
+    print(f"Checking tag {prev_tag} against version {distro_version}")
+
+    version_tag = re.fullmatch(RE_VERSION_TAG, prev_tag)
+    version_tag_numeric = int(version_tag["year"]) * 100 + int(version_tag["month"])
+
+    version_bb = re.fullmatch(RE_VERSION_BB, distro_version)
+    version_bb_numeric = int(version_bb["year"]) * 100 + int(version_bb["month"])
+
+    if commit_is_tagged:
+        # The version in a tagged commit must match the version in the tag's name.
+        assert version_bb["dev"] == ""
+        assert version_tag_numeric == version_bb_numeric
+
+    elif version_bb["dev"] == "":
+        # Release candidates already have the next release version set,
+        # but it must be newer than any tag in the current commit's history.
+        assert version_bb_numeric > version_tag_numeric
+
+    else:
+        # Non release candidate versions should have the previous tagged
+        # version number plus the +dev suffix set.
+        assert version_bb_numeric == version_tag_numeric
+
+
+def check_codename(codename):
+    base_ref = os.environ.get("GITHUB_BASE_REF")
+    ref = os.environ.get("GITHUB_REF_NAME")
+    ref_type = os.environ.get("GITHUB_REF_TYPE")
+
+    if base_ref:
+        print(f"Checking codename {codename} against pull request into {base_ref}")
+        assert codename == f"tacos-{base_ref}"
+    elif ref and ref_type == "branch":
+        print(f"Checking codename {codename} against branch {ref}")
+        assert codename == f"tacos-{ref}"
+    elif ref_type == "tag":
+        print("Running for a tag. Skipping codename check")
+    else:
+        print("Running outside of GitHub CI. Skipping codename check")
+
+
+def main():
+    variables = bb_variables(("DISTRO_VERSION", "DISTRO_CODENAME"))
+
+    check_version(variables["DISTRO_VERSION"])
+    check_codename(variables["DISTRO_CODENAME"])
+
+
+if __name__ == "__main__":
+    main()

.github/workflows/distribution-version.yaml

@@ -0,0 +1,24 @@
+name: distribution version
+
+on:
+  create: # tags and branches
+  pull_request:
+  push:
+jobs:
+  check:
+    name: consistency check
+    runs-on: ubuntu-latest
+    if: github.repository == 'linux-automation/meta-lxatac'
+    steps:
+      - name: Install required packages
+        run: |
+          sudo apt-get install diffstat chrpath python3-git
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          submodules: recursive
+      - name: Check version number and codename
+        run: |
+          source oe-init-build-env && cd -
+          python3 .github/workflows/distribution-version.py

.github/workflows/shellcheck.yaml

@@ -0,0 +1,17 @@
+name: shellcheck
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/shellcheck.yml'
+      - '**.sh'
+
+jobs:
+  shellcheck:
+    name: shellcheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - run: sudo apt update
+      - run: sudo apt install shellcheck
+      - run: shellcheck --exclude=SC1091 --color=always --enable=all $(find meta-lxatac-bsp meta-lxatac-software -name "*.sh")

.gitmodules

@@ -5,24 +5,24 @@
 [submodule "meta-oe"]
 	path = meta-oe
 	url = https://github.com/openembedded/meta-openembedded.git
-	branch = mickledore
+	branch = nanbield
 [submodule "meta-rauc"]
 	path = meta-rauc
 	url = https://github.com/rauc/meta-rauc.git
-	branch = mickledore
+	branch = nanbield
 [submodule "meta-labgrid"]
 	path = meta-labgrid
 	url = https://github.com/labgrid-project/meta-labgrid.git
 	branch = master
 [submodule "meta-virtualization"]
 	path = meta-virtualization
 	url = https://github.com/lgirdk/meta-virtualization.git
-	branch = mickledore
+	branch = nanbield
 [submodule "poky"]
 	path = poky
 	url = https://git.yoctoproject.org/poky
-	branch = mickledore
+	branch = nanbield
 [submodule "meta-selinux"]
 	path = meta-selinux
 	url = https://git.yoctoproject.org/meta-selinux
-	branch = mickledore
+	branch = nanbield

README.md

@@ -27,6 +27,18 @@ bundle on your TAC:
 
 If that does not work you may want to [re-install via USB](#installing-images-via-usb).
 
+If you've made changes to your TACs configuration that you want to preserve,
+which are not covered by the default update migration logic,
+you can add a list of additional files to migrate to the
+`/etc/rauc/migrate.d`:
+
+    root@lxatac-00010:~ cat /etc/rauc/migrate.d/git_config.conf
+    /etc/gitconfig
+    /home/root/.gitconfig
+
+If that is not enough customization for you then read on to learn
+how to build fully-custom images for your LXA TAC.
+
 Building the image as-is
 ------------------------
 

meta-lxatac-bsp/conf/layer.conf

@@ -10,7 +10,7 @@ BBFILE_COLLECTIONS += "lxatac-bsp"
 BBFILE_PATTERN_lxatac-bsp = "^${LAYERDIR}/"
 BBFILE_PRIORITY_lxatac-bsp = "11"
 
-LAYERSERIES_COMPAT_lxatac-bsp = "mickledore"
+LAYERSERIES_COMPAT_lxatac-bsp = "nanbield"
 
 RAUC_KEY_FILE ?= "${LAYERDIR}/recipes-core/rauc/files/devel.key.pem"
 RAUC_CERT_FILE ?= "${LAYERDIR}/recipes-core/rauc/files/devel.cert.pem"

meta-lxatac-bsp/conf/machine/lxatac.conf

@@ -44,6 +44,5 @@ MACHINE_FEATURES = "serial ext2 rtc usbhost usbgadget"
 SOC_FAMILY = "stm32mp1"
 
 RAUC_BUNDLE_COMPATIBLE = "Linux Automation GmbH - LXA TAC"
-RAUC_USE_DEVEL_VERSION = "1"
 
 DISTRO_FEATURES:append = " rauc virtualization ipv6 security seccomp alsa polkit"

meta-lxatac-bsp/recipes-bsp/barebox/files/lxatac/env/init/20_splash.sh

@@ -2,4 +2,6 @@
 
 # Turn the LCD on with a splash screen
 splash /env/data/splash.png
+
+# shellcheck disable=SC2276
 fb0.enable=1

meta-lxatac-bsp/recipes-core/images/emmc-image/lxatac/genimage.config

@@ -37,7 +37,7 @@ image @IMAGE@img {
     }
 
     partition root-a {
-        image = "lxatac-core-image-base-lxatac.ext4"
+        image = "lxatac-core-image-base-lxatac.rootfs.ext4"
         partition-type-uuid = "69dad710-2ce4-4e3c-b16c-21a1d49abed3"
         partition-uuid = "e82e6873-62cc-46fb-90f0-3e936743fa62"
         offset = 2M

meta-lxatac-bsp/recipes-core/lxatac-factory-data/files/lxatac-factory-data.sh

@@ -15,9 +15,10 @@ mkdir -p "${DST_LINK_FILE_BASE}"
 # (The transient hostname is passed via systemd.hostname= commandline)
 # --------------------------------------------------------------------
 
-if [ ! -e /etc/hostname ]
+if [[ ! -e /etc/hostname ]]
 then
-    hostnamectl --static hostname $(hostnamectl --transient hostname)
+    hostname="$(hostnamectl --transient hostname)"
+    hostnamectl --static hostname "${hostname}"
 fi
 
 # Read Factory Data passed to us by barebox via the devicetree
@@ -29,9 +30,9 @@ SERIAL=$(tr -d '\000' < "${SRC_BASEBOARD_BASE}/serial-number")
 mapfile -t MAC_ADDRESSES < <(
     for ADDR_FILE in "${SRC_BASEBOARD_BASE}/ethernet-address/address-"*
     do
-        tr -d '\000' < "${ADDR_FILE}"
+        tr -d '\000' < "${ADDR_FILE}" || true
         echo
-    done | sort
+    done | sort || true
 )
 
 MAC_BRIDGE=${MAC_ADDRESSES[0]}

meta-lxatac-bsp/recipes-core/lxatac-led-setup/files/lxatac-led-setup.sh

@@ -17,7 +17,7 @@ USB_HOST2="tac:green:usbh2"
 USB_HOST3="tac:green:usbh3"
 
 # RGB Status LED
-if [ -e "${BASE}/${STATUS}/trigger" ]
+if [[ -e "${BASE}/${STATUS}/trigger" ]]
 then
     # Light up in a nice yellow, as the "okay green" is a bit overused by
     # the other LEDs.
@@ -28,7 +28,7 @@ else
 fi
 
 # CAN Interface activity
-if [ -e "${BASE}/${IOBUS}/trigger" ]
+if [[ -e "${BASE}/${IOBUS}/trigger" ]]
 then
     echo netdev > "${BASE}/${IOBUS}/trigger"
     echo can0_iobus > "${BASE}/${IOBUS}/device_name"
@@ -39,7 +39,7 @@ else
     echo "Not setting up IOBus Trigger"
 fi
 
-if [ -e "${BASE}/${CAN}/trigger" ]
+if [[ -e "${BASE}/${CAN}/trigger" ]]
 then
     echo netdev > "${BASE}/${CAN}/trigger"
     echo can1 > "${BASE}/${CAN}/device_name"
@@ -51,7 +51,7 @@ else
 fi
 
 # DUT UART activity
-if [ -e "${BASE}/${UART_RX}/trigger" ]
+if [[ -e "${BASE}/${UART_RX}/trigger" ]]
 then
     echo tty > "${BASE}/${UART_RX}/trigger"
     echo ttySTM1 > "${BASE}/${UART_RX}/ttyname"
@@ -61,7 +61,7 @@ else
     echo "Not setting up UART RX Trigger"
 fi
 
-if [ -e "${BASE}/${UART_TX}/trigger" ]
+if [[ -e "${BASE}/${UART_TX}/trigger" ]]
 then
     echo tty > "${BASE}/${UART_TX}/trigger"
     echo ttySTM1 > "${BASE}/${UART_TX}/ttyname"
@@ -72,23 +72,23 @@ else
 fi
 
 # USB Host ports
-if [ -e "${BASE}/${USB_HOST1}/trigger" ]
+if [[ -e "${BASE}/${USB_HOST1}/trigger" ]]
 then
     echo usbport > "${BASE}/${USB_HOST1}/trigger"
     echo 1 > "${BASE}/${USB_HOST1}/ports/1-1-port1"
 else
     echo "Not setting up USB Host 1 Trigger"
 fi
 
-if [ -e "${BASE}/${USB_HOST2}/trigger" ]
+if [[ -e "${BASE}/${USB_HOST2}/trigger" ]]
 then
     echo usbport > "${BASE}/${USB_HOST2}/trigger"
     echo 1 > "${BASE}/${USB_HOST2}/ports/1-1-port2"
 else
     echo "Not setting up USB Host 2 Trigger"
 fi
 
-if [ -e "${BASE}/${USB_HOST3}/trigger" ]
+if [[ -e "${BASE}/${USB_HOST3}/trigger" ]]
 then
     echo usbport > "${BASE}/${USB_HOST3}/trigger"
     echo 1 > "${BASE}/${USB_HOST3}/ports/1-1-port3"

meta-lxatac-bsp/recipes-core/rauc/files/0001-src-nbd-initialize-info_headers-to-NULL.patch

@@ -0,0 +1,38 @@
+From 967d32571e226d15c345b2d8cec932a651716f4b Mon Sep 17 00:00:00 2001
+From: Enrico Jorns <[email protected]>
+Date: Thu, 18 Jan 2024 16:49:46 +0100
+Subject: [PATCH] src/nbd: initialize info_headers to NULL
+
+When g_variant_dict_lookup() does not find the given key, it does not
+modify the values of the arguments provided.
+
+This results in info_headers being undefined and can cause the
+rauc-nbd-server to crash, which will result in a broken request on
+client side that lets RAUC terminate hard with:
+
+(rauc:769): rauc-nbd-ERROR **: 15:40:30.553: failed to recv nbd config reply header
+
+The behavior of g_variant_dict_lookup() has also recently been clarified
+in the glib documentation:
+https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3334
+
+Upstream-Status: Submitted [https://github.com/rauc/rauc/pull/1332]
+
+Signed-off-by: Enrico Jorns <[email protected]>
+---
+ src/nbd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/nbd.c b/src/nbd.c
+index 41c43b3..018022e 100644
+--- a/src/nbd.c
++++ b/src/nbd.c
+@@ -562,7 +562,7 @@ static void start_configure(struct RaucNBDContext *ctx, struct RaucNBDTransfer *
+
+ 	/* only read from the client on the first try */
+ 	if (!ctx->url) {
+-		GStrv info_headers; /* array of strings such as 'Foo: bar' */
++		GStrv info_headers = NULL; /* array of strings such as 'Foo: bar' */
+
+ 		res = r_read_exact(ctx->sock, (guint8*)data, xfer->request.len, NULL);
+ 		g_assert_true(res);

meta-lxatac-bsp/recipes-core/rauc/files/rauc-disable-cert.sh

@@ -4,22 +4,22 @@ set -euo pipefail
 
 ENABLED_DIR="/etc/rauc/certificates-enabled"
 
-if [ "$#" -ne 1 ]; then
+if [[ "$#" -ne 1 ]]; then
     echo "Usage: $0 cert.pem"
     echo "Enabled certificates:"
-    ls --hide "*.0" "$ENABLED_DIR"
+    ls --hide "*.0" "${ENABLED_DIR}"
     exit 1
 fi
 
-if [ ! -L "$ENABLED_DIR/$1" ]; then
+if [[ ! -L "${ENABLED_DIR}/$1" ]]; then
     echo "The certificate to deactivate must be stored in:"
-    echo "$ENABLED_DIR"
+    echo "${ENABLED_DIR}"
     exit 1
 fi
 
-rm "$ENABLED_DIR/$1"
+rm "${ENABLED_DIR}/$1"
 
-openssl rehash "$ENABLED_DIR"
+openssl rehash "${ENABLED_DIR}"
 
 # Ask the tacd to update the list of channels
 curl -X PUT -d "true" "http://localhost/v1/tac/update/channels/reload"