* fix(ci): make image builds noninteractive
Both image builds fail in packer:
- arm64-rpi: dpkg halts on the interactive initramfs.conf conffile
prompt (Y/I/N/O/D/Z) during 'apt-get upgrade' kernel configuration,
then cascades: E: Sub-process /usr/bin/dpkg returned an error code (1)
- amd64: debconf falls back through Dialog/Readline/Teletype frontends
(no controlling tty) and the build later fails on
'E: Package netcat has no installation candidate' - the netcat
metapackage was removed in Debian trixie
Fixes:
- export DEBIAN_FRONTEND=noninteractive and install an apt.conf.d
dropin with Dpkg::Options --force-confdef/--force-confold so conffile
prompts resolve to the default action and keep the existing config
(build_joininbox.sh and the amd64 update.sh kernel upgrade)
- install netcat-openbsd when the netcat metapackage is unavailable
* feat(ci): skip code signature verification on PR builds, label images
PR CI builds pull head commits from forks which are not signed by the
maintainer keys, so the mandatory PGP verification in
build_joininbox.sh fails every PR image build:
# BUILD FAILED --> PGP verification not OK / signature(0) verify(0)
Behavior after this change:
- pull_request workflow runs pass the PR number through the packer
build chain (workflow -> build script -> packer var -> provisioner
env -> JOININBOX_PR_NUMBER)
- build_joininbox.sh skips the source signature verification when
JOININBOX_PR_NUMBER is set, prints a prominent warning, and labels
the image in /etc/joininbox-build-info as an UNVERIFIED test build
- the uploaded artifact name carries a -pr<N> suffix via BUILD_VERSION
- push-to-master and workflow_dispatch builds never set the variable,
so production images keep mandatory verification
* fix(ci): drop apt policy after build, warn on PR images in main menu
- Remove /etc/apt/apt.conf.d/90joininbox-noninteractive at the end of
build_joininbox.sh: the noninteractive dpkg conffile policy is a
build-time measure and must not ship in deployed images, where
interactive conffile handling is the default again
- Show '!!! UNVERIFIED PR BUILD #<N> - TESTING ONLY !!!' on top of the
main menu whenever /etc/joininbox-build-info is present, so a flashed
PR image cannot be mistaken for a production build
---------
Co-authored-by: autoblitzbot <autoblitzbot@users.noreply.github.com>
