mirror of
https://github.com/BetterCorp/BetterFrame.git
synced 2026-05-26 22:26:33 +00:00
59 lines
1.9 KiB
Bash
Executable file
59 lines
1.9 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Build a signed RAUC .raucb bundle from pre-extracted slot images.
|
|
#
|
|
# The repartition-image.sh script (run earlier in CI) already extracts
|
|
# rootfs.ext4 + bootfs.vfat from the pi-gen output, so this script just
|
|
# stages them with a rendered manifest + runs `rauc bundle`.
|
|
#
|
|
# Usage:
|
|
# build-bundle.sh <rootfs.ext4> <bootfs.vfat> <out.raucb> \
|
|
# <version> <git_sha> <signing_cert.pem> <signing_key.pem>
|
|
set -euo pipefail
|
|
|
|
ROOTFS_IN="${1:?rootfs.ext4 path required}"
|
|
BOOTFS_IN="${2:?bootfs.vfat path required}"
|
|
OUT_RAUCB="${3:?output .raucb path required}"
|
|
VERSION="${4:?version required}"
|
|
GIT_SHA="${5:?git sha required}"
|
|
SIGNING_CERT="${6:?signing cert path required}"
|
|
SIGNING_KEY="${7:?signing key path required}"
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
MANIFEST_IN="${SCRIPT_DIR}/manifest.raucm.in"
|
|
|
|
WORK_DIR="$(mktemp -d)"
|
|
trap 'rm -rf "$WORK_DIR"' EXIT
|
|
|
|
STAGE="${WORK_DIR}/bundle"
|
|
mkdir -p "$STAGE"
|
|
|
|
cp "$ROOTFS_IN" "${STAGE}/rootfs.ext4"
|
|
cp "$BOOTFS_IN" "${STAGE}/bootfs.vfat"
|
|
|
|
echo "==> Rendering manifest"
|
|
sed -e "s|@VERSION@|${VERSION}|g" \
|
|
-e "s|@GIT_SHA@|${GIT_SHA}|g" \
|
|
"$MANIFEST_IN" > "${STAGE}/manifest.raucm"
|
|
|
|
ls -la "$STAGE"
|
|
cat "${STAGE}/manifest.raucm"
|
|
|
|
echo "==> Building RAUC bundle"
|
|
rm -f "$OUT_RAUCB"
|
|
rauc bundle \
|
|
--cert="$SIGNING_CERT" \
|
|
--key="$SIGNING_KEY" \
|
|
"$STAGE" "$OUT_RAUCB"
|
|
|
|
echo "==> Verifying bundle"
|
|
# Keyring must be the CA cert that issued the signing cert, not the signing
|
|
# cert itself. CA cert lives in the repo; fall back to signing cert if the
|
|
# repo path isn't available (still validates structure, just not chain).
|
|
CA_CERT="${SCRIPT_DIR}/ca-cert.pem"
|
|
if [ ! -f "$CA_CERT" ]; then CA_CERT="$SIGNING_CERT"; fi
|
|
rauc info --keyring="$CA_CERT" "$OUT_RAUCB" || {
|
|
echo "WARNING: rauc info verify failed (bundle may still be valid — kiosk verifies at install time)"
|
|
}
|
|
|
|
echo
|
|
echo "==> Bundle: $(ls -la "$OUT_RAUCB")"
|