server/project.conf at main · projectbluefin/server · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
name: bluefin-server

# Required BuildStream version
min-version: 2.5

# Subdirectory where elements are stored
element-path: elements

(@):
  - freedesktop-sdk.bst:include/runtime.yml
  - include/aliases.yml

options:
  arch:
    type: arch
    description: Machine architecture
    variable: arch
    values:
      - aarch64
      - x86_64
  # Transitional (projectbluefin/server#327): the netboot UKI's command line
  # carries systemd.set_credential=bluefin.ignition.allow-unsigned:1, so a
  # network-booted node applies an unsigned bluefin-node.ign (a 404 for
  # bluefin-node.ign.gpg). Set the default to False once Booty signs node
  # configs; the cut-over criteria are in docs/skills/booty-integration.md.
  # One build can override it: BST_FLAGS="-o ignition_allow_unsigned False".
  ignition_allow_unsigned:
    type: bool
    description: Netboot UKI accepts an unsigned bluefin-node.ign
    default: True
  # Groundwork for enrollment-free Secure Boot: the netboot and installer
  # ESPs boot shim (bluefin-server/shim.bst, the image DB certificate as its
  # vendor certificate) as EFI/BOOT/BOOT<ARCH>.EFI, with MokManager next to
  # it, and shim chain-loads the DB-signed systemd-boot. Off by default, so
  # the default build is unchanged. Until Microsoft signs this shim
  # (shim-review) it boots only where the Bluefin keys are enrolled; the
  # installed-disk layout is not wired yet (docs/skills/ddi-installer.md,
  # "Shim path"). One build can turn it on: BST_FLAGS="-o shim True".
  shim:
    type: bool
    description: ESPs boot shim, which chain-loads systemd-boot
    default: False

sandbox:
  build-arch: "%{arch}"

variables:
  # Installer axis (FSDK): must match the point release pinned in
  # elements/freedesktop-sdk.bst. Enforced by
  # .github/scripts/check-release-version.py.
  installer-version: "26.08.2"

# Pull-only: read from the shared GNOME + Bluefin BuildStream CAS caches.
artifacts:
  - url: https://gbm.gnome.org:11003
    connection-config:
      keepalive-time: 180
      retry-limit: 5
      retry-delay: 500
      request-timeout: 180
  - url: https://cache.projectbluefin.io:11001
    connection-config:
      keepalive-time: 180
      retry-limit: 5
      retry-delay: 500
      request-timeout: 180

source-caches:
  - url: https://gbm.gnome.org:11003
    connection-config:
      keepalive-time: 180
      retry-limit: 5
      retry-delay: 500
      request-timeout: 180
  - url: https://cache.projectbluefin.io:11001
    connection-config:
      keepalive-time: 180
      retry-limit: 5
      retry-delay: 500
      request-timeout: 180

# Host /usr and the independently packaged Brew machine never share a rootfs.
junctions:
  duplicates:
    freedesktop-sdk:
      - freedesktop-sdk.bst
      - fsdk-containers.bst:freedesktop-sdk.bst

plugins:
  - origin: junction
    junction: plugins/buildstream-plugins-community.bst
    elements:
      - collect_manifest
    sources:
      - git_repo
      - patch_queue
      - cargo2
  - origin: junction
    junction: freedesktop-sdk.bst
    elements:
      - collect_initial_scripts

sources:
  git_repo:
    config:
      ref-format: git-describe