mirror of
https://github.com/openoms/joininbox.git
synced 2026-08-18 13:08:52 +02:00
4e5af9f1a3
Some checks are pending
* fix(ci): make image builds noninteractive Both image builds fail in packer: - arm64-rpi: dpkg halts on the interactive initramfs.conf conffile prompt (Y/I/N/O/D/Z) during 'apt-get upgrade' kernel configuration, then cascades: E: Sub-process /usr/bin/dpkg returned an error code (1) - amd64: debconf falls back through Dialog/Readline/Teletype frontends (no controlling tty) and the build later fails on 'E: Package netcat has no installation candidate' - the netcat metapackage was removed in Debian trixie Fixes: - export DEBIAN_FRONTEND=noninteractive and install an apt.conf.d dropin with Dpkg::Options --force-confdef/--force-confold so conffile prompts resolve to the default action and keep the existing config (build_joininbox.sh and the amd64 update.sh kernel upgrade) - install netcat-openbsd when the netcat metapackage is unavailable * feat(ci): skip code signature verification on PR builds, label images PR CI builds pull head commits from forks which are not signed by the maintainer keys, so the mandatory PGP verification in build_joininbox.sh fails every PR image build: # BUILD FAILED --> PGP verification not OK / signature(0) verify(0) Behavior after this change: - pull_request workflow runs pass the PR number through the packer build chain (workflow -> build script -> packer var -> provisioner env -> JOININBOX_PR_NUMBER) - build_joininbox.sh skips the source signature verification when JOININBOX_PR_NUMBER is set, prints a prominent warning, and labels the image in /etc/joininbox-build-info as an UNVERIFIED test build - the uploaded artifact name carries a -pr<N> suffix via BUILD_VERSION - push-to-master and workflow_dispatch builds never set the variable, so production images keep mandatory verification * fix(ci): drop apt policy after build, warn on PR images in main menu - Remove /etc/apt/apt.conf.d/90joininbox-noninteractive at the end of build_joininbox.sh: the noninteractive dpkg conffile policy is a build-time measure and must not ship in deployed images, where interactive conffile handling is the default again - Show '!!! UNVERIFIED PR BUILD #<N> - TESTING ONLY !!!' on top of the main menu whenever /etc/joininbox-build-info is present, so a flashed PR image cannot be mistaken for a production build --------- Co-authored-by: autoblitzbot <autoblitzbot@users.noreply.github.com>
11 lines
393 B
Bash
11 lines
393 B
Bash
#!/bin/sh -eux
|
|
|
|
echo 'Download the build_joininbox.sh script ...'
|
|
wget https://raw.githubusercontent.com/${github_user}/joininbox/${branch}/build_joininbox.sh
|
|
|
|
echo 'Build Joininbox ...'
|
|
sudo env JOININBOX_PR_NUMBER="${pr_number}" bash build_joininbox.sh "${github_user}" "${branch}" "commit"
|
|
|
|
echo 'Delete SSH keys (will be recreated on the first boot)'
|
|
sudo rm /etc/ssh/ssh_host_*
|
|
echo 'OK'
|