Call garage-push directly with zip file instead of sending unzipped contents.

Warn if older credential environment variables are set. They are now
ignored since the credentials aren't unpacked during building.

4 files changed, 22 insertions, 50 deletions

diff --git a/classes/image_types_ostree.bbclass b/classes/image_types_ostree.bbclass
index ac7cb60..d01cb9f 100644
--- a/classes/image_types_ostree.bbclass
+++ b/classes/image_types_ostree.bbclass
@@ -17,36 +17,6 @@ OSTREE_KERNEL ??= "${KERNEL_IMAGETYPE}"
 
 export SYSTEMD_USED = "${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', '', d)}"
 
-python () {
-    if d.getVar("SOTA_PACKED_CREDENTIALS", True):
-        if d.getVar("SOTA_AUTOPROVISION_CREDENTIALS", True):
-            bb.warn("SOTA_AUTOPROVISION_CREDENTIALS are overriden by those in SOTA_PACKED_CREDENTIALS")
-        if d.getVar("SOTA_AUTOPROVISION_URL", True):
-            bb.warn("SOTA_AUTOPROVISION_URL is overriden by the one in SOTA_PACKED_CREDENTIALS")
-
-        if d.getVar("SOTA_AUTOPROVISION_URL_FILE", True):
-            bb.warn("SOTA_AUTOPROVISION_URL_FILE is overriden by the one in SOTA_PACKED_CREDENTIALS")
-
-        if d.getVar("OSTREE_PUSH_CREDENTIALS", True):
-            bb.warn("OSTREE_PUSH_CREDENTIALS are overriden by those in SOTA_PACKED_CREDENTIALS")
-
-        d.setVar("SOTA_AUTOPROVISION_CREDENTIALS", "%s/sota_credentials/autoprov_credentials.p12" % d.getVar("DEPLOY_DIR_IMAGE", True))
-        d.setVar("SOTA_AUTOPROVISION_URL_FILE", "%s/sota_credentials/autoprov.url" % d.getVar("DEPLOY_DIR_IMAGE", True))
-        d.setVar("OSTREE_PUSH_CREDENTIALS", "%s/sota_credentials/treehub.json" % d.getVar("DEPLOY_DIR_IMAGE", True))
-}
-
-IMAGE_DEPENDS_ostreecredunpack = "unzip-native:do_populate_sysroot"
-
-IMAGE_CMD_ostreecredunpack () {
-        if [ ${SOTA_PACKED_CREDENTIALS} ]; then
-                rm -rf ${DEPLOY_DIR_IMAGE}/sota_credentials
-
-                unzip ${SOTA_PACKED_CREDENTIALS} -d ${DEPLOY_DIR_IMAGE}/sota_credentials
-        fi
-}
-
-IMAGE_TYPEDEP_ostree = "ostreecredunpack"
-
 IMAGE_CMD_ostree () {
         if [ -z "$OSTREE_REPO" ]; then
                 bbfatal "OSTREE_REPO should be set in your local.conf"
@@ -145,21 +115,24 @@ IMAGE_CMD_ostree () {
                 ln -sf var/roothome root
         fi
 
-        # deploy SOTA credentials
         mkdir -p var/sota
 
         if [ -n "${SOTA_AUTOPROVISION_CREDENTIALS}" ]; then
-                EXPDATE=`openssl pkcs12 -in ${SOTA_AUTOPROVISION_CREDENTIALS} -password "pass:" -nodes 2>/dev/null | openssl x509 -noout -enddate | cut -f2 -d "="`
-
-                if [ `date +%s` -ge `date -d "${EXPDATE}" +%s` ]; then
-                        bberror "Certificate ${SOTA_AUTOPROVISION_CREDENTIALS} has expired on ${EXPDATE}"
-                fi
+        bbwarn "SOTA_AUTOPROVISION_CREDENTIALS are ignored. Please use SOTA_PACKED_CREDENTIALS"
+    fi
+        if [ -n "${SOTA_AUTOPROVISION_URL}" ]; then
+        bbwarn "SOTA_AUTOPROVISION_URL is ignored. Please use SOTA_PACKED_CREDENTIALS"
+    fi
+        if [ -n "${SOTA_AUTOPROVISION_URL_FILE}" ]; then
+        bbwarn "SOTA_AUTOPROVISION_URL_FILE is ignored. Please use SOTA_PACKED_CREDENTIALS"
+    fi
+        if [ -n "${OSTREE_PUSH_CREDENTIALS}" ]; then
+        bbwarn "OSTREE_PUSH_CREDENTIALS is ignored. Please use SOTA_PACKED_CREDENTIALS"
+    fi
 
-                cp ${SOTA_AUTOPROVISION_CREDENTIALS} var/sota/sota_provisioning_credentials.p12
-                if [ -n "${SOTA_AUTOPROVISION_URL_FILE}" ]; then
-                        export SOTA_AUTOPROVISION_URL=`cat ${SOTA_AUTOPROVISION_URL_FILE}`
-                fi
-                echo "SOTA_GATEWAY_URI=${SOTA_AUTOPROVISION_URL}" > var/sota/sota_provisioning_url.env
+        # deploy SOTA credentials
+        if [ -n "${SOTA_PACKED_CREDENTIALS}" ]; then
+                cp ${SOTA_PACKED_CREDENTIALS} var/sota/sota_provisioning_credentials.zip
         fi
 
         if [ -n "${SOTA_SECONDARY_ECUS}" ]; then
@@ -207,10 +180,10 @@ IMAGE_CMD_ostree () {
 IMAGE_TYPEDEP_ostreepush = "ostree"
 IMAGE_DEPENDS_ostreepush = "sota-tools-native:do_populate_sysroot"
 IMAGE_CMD_ostreepush () {
-        if [ -n "${OSTREE_PUSH_CREDENTIALS}" ]; then
+        if [ -n "${SOTA_PACKED_CREDENTIALS}" ]; then
                 garage-push --repo=${OSTREE_REPO} \
                             --ref=${OSTREE_BRANCHNAME} \
-                            --credentials=${OSTREE_PUSH_CREDENTIALS} \
+                            --credentials=${SOTA_PACKED_CREDENTIALS} \
                             --cacert=${STAGING_ETCDIR_NATIVE}/ssl/certs/ca-certificates.crt
         fi
 }
diff --git a/recipes-sota/aktualizr/aktualizr_git.bb b/recipes-sota/aktualizr/aktualizr_git.bb
index 359c9fb..8bc580d 100644
--- a/recipes-sota/aktualizr/aktualizr_git.bb
+++ b/recipes-sota/aktualizr/aktualizr_git.bb
@@ -13,8 +13,9 @@ SRC_URI = " \
   file://aktualizr-autoprovision.service \
   file://sota_autoprov.toml \
   "
-SRCREV = "c24f1fc9b600113cf9f2d3d7215e406cbbb70ac4"
+SRCREV = "1004efa3f86cef90c012b34620992b5762b741e3"
 PV = "1.0+git${SRCPV}"
+PR = "6"
 
 S = "${WORKDIR}/git"
 SYSTEMD_SERVICE_${PN} = "aktualizr.service"
@@ -23,11 +24,10 @@ inherit cmake systemd
 
 EXTRA_OECMAKE = "-DWARNING_AS_ERROR=OFF -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTS=OFF -DBUILD_OSTREE=ON -DAKTUALIZR_VERSION=${PV}"
 
-export SOTA_AUTOPROVISION_CREDENTIALS
 export SOTA_PACKED_CREDENTIALS
 
 do_install_append() {
-    if [ -n "${SOTA_AUTOPROVISION_CREDENTIALS}" -o -n "${SOTA_PACKED_CREDENTIALS}" ]; then
+    if [ -n "${SOTA_PACKED_CREDENTIALS}" ]; then
       install -d ${D}/${systemd_unitdir}/system
       install -m 0644 ${WORKDIR}/aktualizr-autoprovision.service ${D}/${systemd_unitdir}/system/aktualizr.service
       install -d ${D}/usr/lib/sota
diff --git a/recipes-sota/aktualizr/files/aktualizr-autoprovision.service b/recipes-sota/aktualizr/files/aktualizr-autoprovision.service
index fd0ab09..4a595f0 100644
--- a/recipes-sota/aktualizr/files/aktualizr-autoprovision.service
+++ b/recipes-sota/aktualizr/files/aktualizr-autoprovision.service
@@ -7,8 +7,7 @@ Requires=network-online.target
 [Service]
 RestartSec=10
 Restart=always
-EnvironmentFile=/var/sota/sota_provisioning_url.env
-ExecStart=/usr/bin/aktualizr --disable-keyid-validation --tls-server ${SOTA_GATEWAY_URI} --config /usr/lib/sota/sota.toml
+ExecStart=/usr/bin/aktualizr --disable-keyid-validation --config /usr/lib/sota/sota.toml
 
 [Install]
 WantedBy=multi-user.target
diff --git a/recipes-sota/aktualizr/files/sota_autoprov.toml b/recipes-sota/aktualizr/files/sota_autoprov.toml
index 8799553..9d4ce3b 100644
--- a/recipes-sota/aktualizr/files/sota_autoprov.toml
+++ b/recipes-sota/aktualizr/files/sota_autoprov.toml
@@ -1,9 +1,9 @@
 [device]
 packages_dir = "/tmp/packages_dir"
-certificates_directory = "/var/sota"
 system_info = "system_info.sh"
 
 [tls]
+certificates_directory = "/var/sota/"
 ca_file = "root.crt"
 client_certificate = "client.pem"
 pkey_file = "pkey.pem"
@@ -14,5 +14,5 @@ private_key_path = "ecukey.der"
 public_key_path = "ecukey.pub"
 
 [provision]
-p12_path = "sota_provisioning_credentials.p12"
+provision_path = "/var/sota/sota_provisioning_credentials.zip"