2020-06-15 18:04:50 +00:00
|
|
|
NAME := airgap
|
|
|
|
IMAGE := local/$(NAME):latest
|
2022-12-24 05:15:00 +00:00
|
|
|
ARCH := x86_64
|
|
|
|
TARGET := $(ARCH)
|
|
|
|
USER := $(shell id -u):$(shell id -g)
|
|
|
|
CPUS := $(shell docker run -it debian nproc)
|
2020-07-17 02:15:03 +00:00
|
|
|
GIT_REF := $(shell git log -1 --format=%H config)
|
|
|
|
GIT_AUTHOR := $(shell git log -1 --format=%an config)
|
|
|
|
GIT_KEY := $(shell git log -1 --format=%GP config)
|
2020-12-16 10:02:55 +00:00
|
|
|
GIT_EPOCH := $(shell git log -1 --format=%at config)
|
|
|
|
GIT_DATETIME := \
|
|
|
|
$(shell git log -1 --format=%cd --date=format:'%Y-%m-%d %H:%M:%S' config)
|
2020-07-17 02:15:03 +00:00
|
|
|
ifeq ($(strip $(shell git status --porcelain 2>/dev/null)),)
|
|
|
|
GIT_STATE=clean
|
|
|
|
else
|
|
|
|
GIT_STATE=dirty
|
|
|
|
endif
|
2022-12-24 05:15:00 +00:00
|
|
|
VERSION := $(shell TZ=UTC0 git show --quiet --date='format-local:%Y%m%dT%H%M%SZ' --format="%cd")
|
|
|
|
RELEASE_DIR := release/$(VERSION)
|
|
|
|
CONFIG_DIR := config
|
|
|
|
BR2_EXTERNAL := $(CONFIG_DIR)/buildroot
|
|
|
|
HEADS_EXTERNAL := $(CONFIG_DIR)/heads
|
|
|
|
CACHE_DIR := build
|
|
|
|
SRC_DIR := src
|
|
|
|
OUT_DIR := out
|
2020-06-15 08:08:20 +00:00
|
|
|
docker = docker
|
2022-12-24 05:15:00 +00:00
|
|
|
executables = $(docker) git patch
|
|
|
|
|
|
|
|
include $(PWD)/config/config.env
|
2020-06-15 08:08:20 +00:00
|
|
|
|
2022-12-24 23:56:16 +00:00
|
|
|
## Use env vars from existing release if present
|
|
|
|
ifneq (,$(wildcard $(RELEASE_DIR)/release.env))
|
|
|
|
include $(RELEASE_DIR)/release.env
|
|
|
|
export
|
|
|
|
endif
|
2020-06-15 08:08:20 +00:00
|
|
|
|
2022-12-24 23:56:16 +00:00
|
|
|
.DEFAULT_GOAL := out/manifest.txt
|
2020-06-15 08:08:20 +00:00
|
|
|
|
2022-12-24 23:56:16 +00:00
|
|
|
## Primary Targets
|
2020-07-19 08:31:10 +00:00
|
|
|
|
2020-06-15 08:08:20 +00:00
|
|
|
.PHONY: fetch
|
2022-12-24 05:15:00 +00:00
|
|
|
fetch: $(CACHE_DIR)/toolchain.tar
|
2020-06-15 08:08:20 +00:00
|
|
|
mkdir -p build release
|
2022-12-24 05:15:00 +00:00
|
|
|
$(call toolchain,$(USER),"fetch")
|
2020-06-15 08:08:20 +00:00
|
|
|
|
|
|
|
.PHONY: clean
|
2022-12-24 05:15:00 +00:00
|
|
|
clean: $(CACHE_DIR)/toolchain.tar
|
|
|
|
$(call toolchain,$(USER),"clean")
|
2020-06-15 08:08:20 +00:00
|
|
|
|
2020-07-19 08:31:10 +00:00
|
|
|
.PHONY: mrproper
|
|
|
|
mrproper:
|
2020-07-24 10:07:39 +00:00
|
|
|
docker image rm -f $(IMAGE)
|
2022-12-25 10:12:11 +00:00
|
|
|
rm -rf $(CACHE_DIR) $(OUT_DIR)
|
2020-07-19 08:31:10 +00:00
|
|
|
|
2020-07-24 10:07:39 +00:00
|
|
|
## Release Targets
|
|
|
|
|
2022-12-24 23:56:16 +00:00
|
|
|
.PHONY: release
|
2022-12-31 00:57:44 +00:00
|
|
|
release: | \
|
|
|
|
$(OUT_DIR)/release.env \
|
|
|
|
$(OUT_DIR)/airgap.iso \
|
|
|
|
$(OUT_DIR)/manifest.txt
|
2022-12-25 02:07:53 +00:00
|
|
|
mkdir -p $(RELEASE_DIR)
|
2022-12-25 10:10:29 +00:00
|
|
|
cp out/release.env $(RELEASE_DIR)/release.env
|
|
|
|
cp out/airgap.iso $(RELEASE_DIR)/airgap.iso
|
|
|
|
cp out/manifest.txt $(RELEASE_DIR)/manifest.txt
|
2020-07-24 10:07:39 +00:00
|
|
|
|
2022-12-24 23:56:16 +00:00
|
|
|
.PHONY: attest
|
2022-12-25 02:07:53 +00:00
|
|
|
attest:
|
2022-12-26 09:22:00 +00:00
|
|
|
rm -rf $(CACHE_DIR) $(OUT_DIR)
|
|
|
|
$(MAKE) $(OUT_DIR)/manifest.txt
|
|
|
|
diff -q $(OUT_DIR)/manifest.txt release/$(VERSION)/manifest.txt;
|
2020-07-24 10:07:39 +00:00
|
|
|
|
|
|
|
.PHONY: sign
|
2022-12-26 09:22:00 +00:00
|
|
|
sign:
|
2020-07-26 00:53:15 +00:00
|
|
|
set -e; \
|
2022-12-24 23:56:16 +00:00
|
|
|
git config --get user.signingkey 2>&1 >/dev/null || { \
|
|
|
|
echo "Error: git user.signingkey is not defined"; \
|
|
|
|
exit 1; \
|
|
|
|
}; \
|
|
|
|
fingerprint=$$(\
|
|
|
|
git config --get user.signingkey \
|
|
|
|
| sed 's/.*\([A-Z0-9]\{16\}\).*/\1/g' \
|
|
|
|
); \
|
|
|
|
gpg --armor \
|
|
|
|
--detach-sig \
|
|
|
|
--output $(RELEASE_DIR)/manifest.$${fingerprint}.asc \
|
|
|
|
$(RELEASE_DIR)/manifest.txt
|
|
|
|
|
|
|
|
.PHONY: verify
|
2022-12-26 09:22:00 +00:00
|
|
|
verify: | $(RELEASE_DIR)/manifest.txt
|
2022-12-24 23:56:16 +00:00
|
|
|
set -e; \
|
|
|
|
for file in $(RELEASE_DIR)/manifest.*.asc; do \
|
|
|
|
echo "\nVerifying: $${file}\n"; \
|
|
|
|
gpg --verify $${file} $(RELEASE_DIR)/manifest.txt; \
|
|
|
|
done;
|
|
|
|
|
2022-12-25 02:07:53 +00:00
|
|
|
.PHONY: audit
|
|
|
|
audit: $(CACHE_DIR)/toolchain.tar
|
|
|
|
mkdir -p $(CACHE_DIR)/audit
|
|
|
|
$(call toolchain,$(USER),"audit")
|
|
|
|
|
2022-12-24 23:56:16 +00:00
|
|
|
$(RELEASE_DIR):
|
|
|
|
mkdir -p $(RELEASE_DIR)
|
|
|
|
|
|
|
|
$(RELEASE_DIR)/release.env: \
|
|
|
|
$(RELEASE_DIR) \
|
|
|
|
$(OUT_DIR)/release.env
|
2022-12-25 02:07:53 +00:00
|
|
|
cp $(OUT_DIR)/release.env $(RELEASE_DIR)/release.env
|
2022-12-24 23:56:16 +00:00
|
|
|
|
|
|
|
$(RELEASE_DIR)/airgap.iso: \
|
|
|
|
$(RELEASE_DIR) \
|
|
|
|
$(OUT_DIR)/airgap.iso
|
2022-12-25 02:07:53 +00:00
|
|
|
cp $(OUT_DIR)/airgap.iso $(RELEASE_DIR)/airgap.iso
|
2022-12-24 23:56:16 +00:00
|
|
|
|
|
|
|
$(RELEASE_DIR)/manifest.txt: \
|
|
|
|
$(RELEASE_DIR) \
|
|
|
|
$(OUT_DIR)/manifest.txt
|
2022-12-25 02:07:53 +00:00
|
|
|
cp $(OUT_DIR)/manifest.txt $(RELEASE_DIR)/manifest.txt
|
2020-07-24 10:07:39 +00:00
|
|
|
|
2020-06-15 08:08:20 +00:00
|
|
|
## Development Targets
|
|
|
|
|
|
|
|
.PHONY: menuconfig
|
2022-12-24 05:15:00 +00:00
|
|
|
menuconfig: $(CACHE_DIR)/toolchain.tar
|
|
|
|
$(call toolchain,$(USER),"menuconfig")
|
|
|
|
cp $(CACHE_DIR)/buildroot/.config \
|
|
|
|
"config/buildroot/configs/airgap_$(TARGET)_defconfig"
|
2020-06-15 08:08:20 +00:00
|
|
|
|
2020-10-15 23:26:28 +00:00
|
|
|
.PHONY: linux-menuconfig
|
2022-12-24 05:15:00 +00:00
|
|
|
linux-menuconfig: $(CACHE_DIR)/toolchain.tar
|
|
|
|
$(call toolchain,$(USER),"linux-menuconfig")
|
2020-07-15 01:35:16 +00:00
|
|
|
|
2020-06-15 08:08:20 +00:00
|
|
|
.PHONY: vm
|
2022-12-24 05:15:00 +00:00
|
|
|
vm: $(CACHE_DIR)/toolchain.tar
|
|
|
|
$(call toolchain,$(USER),"vm")
|
2020-06-15 08:08:20 +00:00
|
|
|
|
2022-12-24 05:15:00 +00:00
|
|
|
# Launch a shell inside the toolchain container
|
|
|
|
.PHONY: toolchain-shell
|
|
|
|
toolchain-shell: $(CACHE_DIR)/toolchain.tar
|
|
|
|
$(call toolchain,$(USER),"bash --norc")
|
|
|
|
|
|
|
|
# Pin all packages in toolchain container to latest versions
|
|
|
|
.PHONY: toolchain-update
|
|
|
|
toolchain-update:
|
2020-10-08 01:24:58 +00:00
|
|
|
docker run \
|
2020-06-15 08:08:20 +00:00
|
|
|
--rm \
|
2022-12-24 05:15:00 +00:00
|
|
|
--env LOCAL_USER=$(USER) \
|
|
|
|
--platform=linux/$(ARCH) \
|
|
|
|
--volume $(PWD)/$(CONFIG_DIR):/config \
|
|
|
|
--volume $(PWD)/$(SRC_DIR)/toolchain/scripts:/usr/local/bin \
|
|
|
|
--env ARCH=$(ARCH) \
|
|
|
|
--interactive \
|
|
|
|
--tty \
|
|
|
|
debian@sha256:$(DEBIAN_HASH) \
|
|
|
|
bash -c /usr/local/bin/packages-update
|
|
|
|
|
|
|
|
## Real targets
|
|
|
|
|
|
|
|
$(CACHE_DIR)/toolchain.tar:
|
|
|
|
mkdir -p $(CACHE_DIR)
|
|
|
|
DOCKER_BUILDKIT=1 \
|
|
|
|
docker build \
|
|
|
|
--tag $(IMAGE) \
|
|
|
|
--build-arg DEBIAN_HASH=$(DEBIAN_HASH) \
|
|
|
|
--build-arg CONFIG_DIR=$(CONFIG_DIR) \
|
|
|
|
--build-arg SCRIPTS_DIR=$(SRC_DIR)/toolchain/scripts \
|
|
|
|
--platform=linux/$(ARCH) \
|
|
|
|
-f $(SRC_DIR)/toolchain/Dockerfile \
|
|
|
|
.
|
|
|
|
docker save "$(IMAGE)" -o "$@"
|
|
|
|
|
|
|
|
$(CACHE_DIR)/buildroot: $(CACHE_DIR)/toolchain.tar
|
|
|
|
$(call git_clone,buildroot,$(BUILDROOT_REPO),$(BUILDROOT_REF))
|
|
|
|
|
|
|
|
$(CACHE_DIR)/heads: $(CACHE_DIR)/toolchain.tar
|
|
|
|
$(call git_clone,heads,$(HEADS_REPO),$(HEADS_REF))
|
|
|
|
|
2022-12-24 23:56:16 +00:00
|
|
|
$(OUT_DIR):
|
|
|
|
mkdir -p $(OUT_DIR)
|
|
|
|
|
|
|
|
$(OUT_DIR)/release.env: $(OUT_DIR)
|
|
|
|
echo 'VERSION=$(VERSION)' > $(OUT_DIR)/release.env
|
|
|
|
echo 'GIT_REF=$(GIT_REF)' >> $(OUT_DIR)/release.env
|
|
|
|
echo 'GIT_AUTHOR=$(GIT_AUTHOR)' >> $(OUT_DIR)/release.env
|
|
|
|
echo 'GIT_KEY=$(GIT_KEY)' >> $(OUT_DIR)/release.env
|
|
|
|
echo 'GIT_DATETIME=$(GIT_DATETIME)' >> $(OUT_DIR)/release.env
|
|
|
|
|
|
|
|
$(OUT_DIR)/airgap.iso: \
|
|
|
|
$(CACHE_DIR)/buildroot \
|
|
|
|
$(OUT_DIR)/release.env
|
2022-12-24 05:15:00 +00:00
|
|
|
$(call apply_patches,buildroot,$(BR2_EXTERNAL)/patches)
|
|
|
|
$(call toolchain,$(USER)," \
|
|
|
|
cd buildroot; \
|
|
|
|
make "airgap_$(TARGET)_defconfig"; \
|
|
|
|
unset FAKETIME; \
|
2022-12-31 00:57:44 +00:00
|
|
|
make source; \
|
2022-12-24 05:15:00 +00:00
|
|
|
make; \
|
|
|
|
")
|
|
|
|
mkdir -p $(OUT_DIR)
|
|
|
|
cp $(CACHE_DIR)/buildroot/output/images/rootfs.iso9660 \
|
|
|
|
$(OUT_DIR)/airgap.iso
|
2020-06-15 08:08:20 +00:00
|
|
|
|
2022-12-24 23:56:16 +00:00
|
|
|
$(OUT_DIR)/manifest.txt: \
|
|
|
|
$(OUT_DIR)/airgap.iso \
|
|
|
|
$(OUT_DIR)/release.env
|
|
|
|
cd $(OUT_DIR); \
|
|
|
|
openssl sha256 -r release.env > manifest.txt; \
|
|
|
|
openssl sha256 -r airgap.iso >> manifest.txt;
|
|
|
|
|
2020-06-15 08:08:20 +00:00
|
|
|
## Make Helpers
|
|
|
|
|
|
|
|
check_executables := $(foreach exec,$(executables),\$(if \
|
|
|
|
$(shell which $(exec)),some string,$(error "No $(exec) in PATH")))
|
|
|
|
|
2022-12-24 05:15:00 +00:00
|
|
|
define git_clone
|
|
|
|
[ -d $(CACHE_DIR)/$(1) ] || git clone $(2) $(CACHE_DIR)/$(1)
|
|
|
|
git -C $(CACHE_DIR)/$(1) checkout $(3)
|
|
|
|
git -C $(CACHE_DIR)/$(1) rev-parse --verify HEAD | grep -q $(3) || { \
|
|
|
|
echo 'Error: Git ref/branch collision.'; exit 1; \
|
|
|
|
};
|
|
|
|
endef
|
|
|
|
|
|
|
|
define apply_patches
|
|
|
|
[ -d $(2) ] && $(call toolchain,$(USER)," \
|
|
|
|
cd $(1); \
|
|
|
|
git restore .; \
|
|
|
|
find /$(2) -type f -iname '*.patch' -print0 \
|
|
|
|
| xargs -t -0 -n 1 patch -p1 --no-backup-if-mismatch -i ; \
|
|
|
|
")
|
|
|
|
endef
|
|
|
|
|
|
|
|
define toolchain
|
|
|
|
docker load -i $(CACHE_DIR)/toolchain.tar
|
|
|
|
docker run \
|
2020-06-15 08:08:20 +00:00
|
|
|
--rm \
|
|
|
|
--tty \
|
|
|
|
--interactive \
|
2022-12-24 05:15:00 +00:00
|
|
|
--user=$(1) \
|
|
|
|
--platform=linux/$(ARCH) \
|
|
|
|
--volume $(PWD)/config:/config \
|
|
|
|
--volume $(PWD)/$(KEY_DIR):/keys \
|
|
|
|
--volume $(PWD)/$(SRC_DIR):/src \
|
|
|
|
--volume $(PWD)/$(CACHE_DIR):/home/build \
|
|
|
|
--volume $(PWD)/scripts:/usr/local/bin \
|
|
|
|
--cpus $(CPUS) \
|
|
|
|
--workdir /home/build \
|
|
|
|
--env HOME=/home/build \
|
|
|
|
--env PS1="$(NAME)-toolchain" \
|
|
|
|
--env GNUPGHOME=/cache/.gnupg \
|
|
|
|
--env ARCH=$(ARCH) \
|
|
|
|
--env TARGET="$(ARCH)" \
|
2020-07-17 02:15:03 +00:00
|
|
|
--env GIT_REF="$(GIT_REF)" \
|
|
|
|
--env GIT_AUTHOR="$(GIT_AUTHOR)" \
|
|
|
|
--env GIT_KEY="$(GIT_KEY)" \
|
2022-12-24 05:15:00 +00:00
|
|
|
--env GIT_DATETIME="$(GIT_DATETIME)" \
|
|
|
|
--env GIT_EPOCH="$(GIT_EPOCH)" \
|
|
|
|
--env KBUILD_BUILD_USER=$(KBUILD_BUILD_USER) \
|
|
|
|
--env KBUILD_BUILD_HOST=$(KBUILD_BUILD_HOST) \
|
|
|
|
--env KBUILD_BUILD_VERSION=$(KBUILD_BUILD_VERSION) \
|
|
|
|
--env KBUILD_BUILD_TIMESTAMP=$(KBUILD_BUILD_TIMESTAMP) \
|
|
|
|
--env KCONFIG_NOTIMESTAMP=$(KCONFIG_NOTIMESTAMP) \
|
|
|
|
--env SOURCE_DATE_EPOCH=$(SOURCE_DATE_EPOCH) \
|
|
|
|
--env FAKETIME_FMT=$(FAKETIME_FMT) \
|
|
|
|
--env FAKETIME=$(FAKETIME) \
|
|
|
|
--env BR2_EXTERNAL="/$(BR2_EXTERNAL)" \
|
|
|
|
--env HEADS_EXTERNAL="/$(HEADS_EXTERNAL)" \
|
2020-10-15 23:26:28 +00:00
|
|
|
--env UID="$(shell id -u)" \
|
|
|
|
--env GID="$(shell id -g)" \
|
2022-12-24 05:15:00 +00:00
|
|
|
$(IMAGE) \
|
|
|
|
bash -c $(2)
|
|
|
|
endef
|