mirrors/flatcar-scripts
1
0
Fork 0
mirror of https://github.com/flatcar/scripts.git synced 2025-08-06 20:47:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

Delay generating test update payload in official builds

Browse Source 
The update payload needs the kernel, which isn't signed during the image
job. Secure Boot is not currently enabled for update tests, but we may
as well do this properly. The production update upload is generated
manually at the end after everything has already been signed.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
This commit is contained in:
James Le Cuirot 2024-12-19 18:19:46 +00:00
parent bda73d4de3
commit aa70fc929f
No known key found for this signature in database
GPG Key ID: 1226415D00DD3137
3 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
build_image
View File

@ -177,7 +177,7 @@ if [[ "${PROD_IMAGE}" -eq 1 ]]; then
if [[ ${FLAGS_extract_update} -eq ${FLAGS_TRUE} ]]; then
extract_update "${FLATCAR_PRODUCTION_IMAGE_NAME}" "${DISK_LAYOUT}"
fi
if [[ ${FLAGS_generate_update} -eq ${FLAGS_TRUE} ]]; then
if [[ ${FLAGS_generate_update} -eq ${FLAGS_TRUE} && ${COREOS_OFFICIAL:-0} -ne 1 ]]; then
generate_update "${FLATCAR_PRODUCTION_IMAGE_NAME}" "${DISK_LAYOUT}"
fi
if [[ "${PROD_TAR}" -eq 1 ]]; then

3
ci-automation/sbsign_image.sh
View File

@ -91,7 +91,8 @@ function _sbsign_image_impl() {
--only_store_compressed
# Delete uncompressed generic image before signing and upload
rm "${images_local}/flatcar_production_image.bin"
# Also delete update image because it will be unchanged
rm "${images_local}"/flatcar_production_{image,update}.bin
create_digests "${SIGNER}" "${images_local}"/*
sign_artifacts "${SIGNER}" "${images_local}"/*
copy_to_buildcache "${images_remote}"/ "${images_local}"/*

5
sbsign_image
View File

@ -61,8 +61,11 @@ switch_to_strict_mode
# Create the output directory and temporary mount points.
mkdir -p "${BUILD_DIR}"
DISK_LAYOUT="${FLAGS_disk_layout:-base}"
fix_mtab
sbsign_prod_image "${FLATCAR_PRODUCTION_IMAGE_NAME}" "${FLAGS_disk_layout:-base}"
sbsign_prod_image "${FLATCAR_PRODUCTION_IMAGE_NAME}" "${DISK_LAYOUT}"
generate_update "${FLATCAR_PRODUCTION_IMAGE_NAME}" "${DISK_LAYOUT}"
echo "Done. ${FLATCAR_PRODUCTION_IMAGE_NAME} and associated files are now signed for Secure Boot in ${BUILD_DIR}."
command_completed