Ilker ManapandClaude Opus 5.5
c494c7b226
On the Secure Boot lab VM, GRUB's "exit" back to the firmware did not reach the disk: OVMF went on to its other network boot options and stopped in its own boot menu. The local-disk entry now finds the installed OS's signed loader on the EFI partition (shimx64.efi under EFI/debian, ubuntu, rocky, almalinux, redhat, centos; shim.efi for SUSE; else EFI/BOOT/BOOTX64.EFI) and chainloads it, as MAAS does. build-image.sh writes SHA256SUMS next to the image (the old one was stale after a rebuild; bootstrap.sh --image-url checks it). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
132 lines
3.6 KiB
Bash
132 lines
3.6 KiB
Bash
#!/bin/bash
|
|
# Build the Debian 13 commissioning live image with live-build.
|
|
# Run as root on pxe-server. Output: $OUT/{vmlinuz,initrd.img,filesystem.squashfs}
|
|
set -euo pipefail
|
|
SRC=$(cd "$(dirname "$0")" && pwd)
|
|
BUILD=${BUILD:-/srv/rollcall/build}
|
|
OUT=${OUT:-/srv/rollcall/image}
|
|
MIRROR=${MIRROR:-http://deb.debian.org/debian}
|
|
AUTHKEYS=${AUTHKEYS:-/home/ilker/.ssh/authorized_keys}
|
|
|
|
mkdir -p "$BUILD" "$OUT"
|
|
cd "$BUILD"
|
|
if [ -d config ]; then lb clean --purge >/dev/null 2>&1 || true; rm -rf config; fi
|
|
|
|
lb config \
|
|
--distribution trixie --architectures amd64 \
|
|
--archive-areas "main contrib non-free non-free-firmware" \
|
|
--mirror-bootstrap "$MIRROR" --mirror-binary "$MIRROR" \
|
|
--binary-images iso-hybrid --bootloaders syslinux \
|
|
--debian-installer none --memtest none \
|
|
--firmware-chroot true --firmware-binary false \
|
|
--apt-recommends false \
|
|
--bootappend-live "boot=live components quiet" \
|
|
--linux-flavours amd64 \
|
|
--iso-volume "rollcall" --iso-application "rollcall commissioning image" \
|
|
--cache-packages true --cache-indices false
|
|
|
|
# Package set: hardware discovery + BMC + IB + firmware + debugging
|
|
cat > config/package-lists/rollcall.list.chroot <<'EOF'
|
|
linux-image-amd64
|
|
live-boot
|
|
live-config
|
|
live-config-systemd
|
|
systemd-sysv
|
|
systemd-timesyncd
|
|
busybox
|
|
kmod
|
|
pciutils
|
|
usbutils
|
|
dmidecode
|
|
util-linux
|
|
lshw
|
|
ethtool
|
|
iproute2
|
|
isc-dhcp-client
|
|
nvme-cli
|
|
smartmontools
|
|
hdparm
|
|
sg3-utils
|
|
lsscsi
|
|
ipmitool
|
|
freeipmi-tools
|
|
rdma-core
|
|
ibverbs-utils
|
|
infiniband-diags
|
|
mstflint
|
|
lldpd
|
|
python3
|
|
curl
|
|
wget
|
|
ca-certificates
|
|
openssh-server
|
|
openssh-client
|
|
less
|
|
vim-tiny
|
|
procps
|
|
pv
|
|
jq
|
|
mdadm
|
|
lvm2
|
|
efibootmgr
|
|
zstd
|
|
gdisk
|
|
parted
|
|
xfsprogs
|
|
e2fsprogs
|
|
btrfs-progs
|
|
dosfstools
|
|
bash
|
|
firmware-linux
|
|
firmware-linux-nonfree
|
|
firmware-misc-nonfree
|
|
firmware-bnx2
|
|
firmware-bnx2x
|
|
firmware-qlogic
|
|
firmware-realtek
|
|
firmware-cavium
|
|
firmware-netronome
|
|
amd64-microcode
|
|
intel-microcode
|
|
EOF
|
|
|
|
# Files baked into the rootfs
|
|
mkdir -p config/includes.chroot/usr/local/bin config/includes.chroot/etc/systemd/system \
|
|
config/includes.chroot/root/.ssh config/includes.chroot/etc/modules-load.d \
|
|
config/hooks/live
|
|
install -m 0755 "$SRC/rollcall-agent.py" config/includes.chroot/usr/local/bin/rollcall-agent.py
|
|
install -m 0755 "$SRC/rollcall-deploy.py" config/includes.chroot/usr/local/bin/rollcall-deploy.py
|
|
install -m 0644 "$SRC/rollcall-agent.service" config/includes.chroot/etc/systemd/system/rollcall-agent.service
|
|
printf 'ipmi_msghandler\nipmi_devintf\nipmi_si\nipmi_ssif\n' > config/includes.chroot/etc/modules-load.d/ipmi.conf
|
|
if [ -r "$AUTHKEYS" ]; then
|
|
install -m 0600 "$AUTHKEYS" config/includes.chroot/root/.ssh/authorized_keys
|
|
chmod 0700 config/includes.chroot/root/.ssh
|
|
fi
|
|
|
|
cat > config/hooks/live/0100-rollcall.hook.chroot <<'EOF'
|
|
#!/bin/sh
|
|
set -e
|
|
systemctl enable rollcall-agent.service
|
|
systemctl enable lldpd.service
|
|
systemctl enable ssh.service
|
|
# allow root login with key only
|
|
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
|
|
# lldpd: speak LLDP + CDP so switch ports are discovered quickly
|
|
printf 'configure lldp tx-interval 5\n' > /etc/lldpd.d/rollcall.conf
|
|
echo rollcall > /etc/hostname
|
|
EOF
|
|
chmod +x config/hooks/live/0100-rollcall.hook.chroot
|
|
|
|
echo "=== lb build started $(date)"
|
|
lb build 2>&1 | tee "$BUILD/build.log" | grep -E "^P:|^E:|error" || true
|
|
|
|
for f in vmlinuz initrd.img filesystem.squashfs; do
|
|
src=$(ls binary/live/$f* 2>/dev/null | head -1)
|
|
[ -n "$src" ] || { echo "missing $f in binary/live" >&2; exit 1; }
|
|
install -m 0644 "$src" "$OUT/$f"
|
|
done
|
|
# checked by bootstrap.sh --image-url when another region copies this one
|
|
(cd "$OUT" && sha256sum vmlinuz initrd.img filesystem.squashfs > SHA256SUMS)
|
|
ls -la "$OUT"
|
|
echo "=== done $(date)"
|