livecd-rootfs

Commit Graph

Author	SHA1	Message	Date
John Chittum	6d5b0fefc2	feat(ubuntu-cpc): sbom generation everywhere patch create_manifest to produce an sbom when called by an ubuntu-cpc project. Patch all the ubuntu-cpc hooks and series files to include the newly generated manifests, filelists, and sboms. Generates a number of new artifacts in the builds. the snap utilized, cpc-sbom, is an open source repo and a provided via a hidden snap. there is no intention of publisizing the snap or how we generate sboms, however partners require the ability to audit if required. defensively checks if the snap is already installed, in the case of multiple hooks being called in a single build (thus sharing a build host), and only if called in an ubuntu-cpc project. (cherry picked from commit 7c7b7df89dc96169db1f255d6bba901ebb63a43c)	5 months ago
Joshua Powers	ef950f5214	amd64: always install grub-pc with shim-signed shim-signed depends on grub-efi-amd64-signed, which in turn has alternative depends on either `grub-efi-amd64 \| grub-pc`. However to support booting with either via shim&signed-grub and BIOS, the choice must be made to install grub-pc, not grub-efi-amd64. This makes images consistent with Ubuntu Deskop, Live Server, buildd bootable images; all of which already do install grub-pc and shim-signed. Additionally, this will ensure that autoremove is run after installing anything in the CPC build hooks. This is done to avoid shipping images that include packages that are autoremovable. This will clean-up as packages are installed and detect any breakage at build time. LP: #1901906	4 years ago
Tobias Koch	cbd4eb5717	Use series files with dependency handling to generate hook symlinks dynamically This patch currently only applies to the "ubuntu-cpc" project. More and more logic has been going into the hook scripts to decide under which conditions they should run or not. As we are moving to parallelized builds of image sets, this will get even more complicated. Base hooks will have to know which image sets they belong to and modification of the dependency chain between scripts will become more complicated and prone to errors, as the number of image sets grows. This patch introduces explicit ordering and dependency handling for scripts through the use of `series` files and an explicit syntax for dependency specification.	6 years ago

Author

SHA1

Message

Date

John Chittum

6d5b0fefc2

feat(ubuntu-cpc): sbom generation everywhere

patch create_manifest to produce an sbom when called by an ubuntu-cpc
project. Patch all the ubuntu-cpc hooks and series files to include the
newly generated manifests, filelists, and sboms. Generates a number of
new artifacts in the builds. the snap utilized, cpc-sbom, is an open
source repo and a provided via a hidden snap. there is no intention of
publisizing the snap or how we generate sboms, however partners require
the ability to audit if required.

defensively checks if the snap is already installed, in the case of
multiple hooks being called in a single build (thus sharing a build
host), and only if called in an ubuntu-cpc project.

(cherry picked from commit 7c7b7df89dc96169db1f255d6bba901ebb63a43c)

Joshua Powers

ef950f5214

amd64: always install grub-pc with shim-signed

shim-signed depends on grub-efi-amd64-signed, which in turn has
alternative depends on either `grub-efi-amd64 | grub-pc`. However to
support booting with either via shim&signed-grub and BIOS, the choice
must be made to install grub-pc, not grub-efi-amd64.

This makes images consistent with Ubuntu Deskop, Live Server, buildd
bootable images; all of which already do install grub-pc and
shim-signed.

Additionally, this will ensure that autoremove is run after installing
anything in the CPC build hooks. This is done to avoid shipping images
that include packages that are autoremovable. This will clean-up as
packages are installed and detect any breakage at build time.

LP: #1901906

Tobias Koch

cbd4eb5717

Use series files with dependency handling to generate hook symlinks dynamically

This patch currently only applies to the "ubuntu-cpc" project.
          
More and more logic has been going into the hook scripts to decide under which conditions they should run or not. As we are moving to parallelized builds of image sets, this will get even more complicated. Base hooks will have to know which image sets they belong to and modification of the dependency chain between scripts will become more complicated and prone to errors, as the number of image sets grows.
            
This patch introduces explicit ordering and dependency handling for scripts through the use of `series` files and an explicit syntax for dependency specification.

3 Commits (ubuntu/focal)