##// END OF EJS Templates
Merge branch 'master' into RPI3B
Unknown -
r253:cf37cb89e24a Fusion
parent child
Show More
@@ -0,0 +1,12
1 [Match]
2 Name=wlan0
3
4 [Network]
5 DHCP=no
6 Address=
7 Gateway=
8 DNS=
9 DNS=
10 Domains=
11 NTP=
12 NTP=
@@ -1,458 +1,458
1 # rpi23-gen-image
1 # rpi23-gen-image
2 ## Introduction
2 ## Introduction
3 `rpi23-gen-image.sh` is an advanced Debian Linux bootstrapping shell script for generating Debian OS images for Raspberry Pi 2 (RPi2) and Raspberry Pi 3 (RPi3) computers. The script at this time supports the bootstrapping of the Debian (armhf) releases `jessie`, `stretch` and `buster`. Raspberry Pi 3 images are generated for 32-bit mode only. Raspberry Pi 3 64-bit images can be generated using custom configuration parameters (```templates/rpi3-stretch-arm64-4.11.y```).
3 `rpi23-gen-image.sh` is an advanced Debian Linux bootstrapping shell script for generating Debian OS images for Raspberry Pi 2 (RPi2) and Raspberry Pi 3 (RPi3) computers. The script at this time supports the bootstrapping of the Debian (armhf) releases `jessie`, `stretch` and `buster`. Raspberry Pi 3 images are generated for 32-bit mode only. Raspberry Pi 3 64-bit images can be generated using custom configuration parameters (```templates/rpi3-stretch-arm64-4.11.y```).
4
4
5 ## Build dependencies
5 ## Build dependencies
6 The following list of Debian packages must be installed on the build system because they are essentially required for the bootstrapping process. The script will check if all required packages are installed and missing packages will be installed automatically if confirmed by the user.
6 The following list of Debian packages must be installed on the build system because they are essentially required for the bootstrapping process. The script will check if all required packages are installed and missing packages will be installed automatically if confirmed by the user.
7
7
8 ```debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo```
8 ```debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo```
9
9
10 It is recommended to configure the `rpi23-gen-image.sh` script to build and install the latest Raspberry Pi Linux kernel. For the RPi3 this is mandatory. Kernel compilation and linking will be performed on the build system using an ARM (armhf) cross-compiler toolchain.
10 It is recommended to configure the `rpi23-gen-image.sh` script to build and install the latest Raspberry Pi Linux kernel. For the RPi3 this is mandatory. Kernel compilation and linking will be performed on the build system using an ARM (armhf) cross-compiler toolchain.
11
11
12 The script has been tested using the default `crossbuild-essential-armhf` toolchain meta package on Debian Linux `jessie` and `stretch` build systems. Please check the [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains) for further information.
12 The script has been tested using the default `crossbuild-essential-armhf` toolchain meta package on Debian Linux `jessie` and `stretch` build systems. Please check the [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains) for further information.
13
13
14 If a Debian Linux `jessie` build system is used it will be required to add the [Debian Cross-toolchains repository](http://emdebian.org/tools/debian/) first:
14 If a Debian Linux `jessie` build system is used it will be required to add the [Debian Cross-toolchains repository](http://emdebian.org/tools/debian/) first:
15
15
16 ```
16 ```
17 echo "deb http://emdebian.org/tools/debian/ jessie main" > /etc/apt/sources.list.d/crosstools.list
17 echo "deb http://emdebian.org/tools/debian/ jessie main" > /etc/apt/sources.list.d/crosstools.list
18 sudo -u nobody wget -O - http://emdebian.org/tools/debian/emdebian-toolchain-archive.key | apt-key add -
18 sudo -u nobody wget -O - http://emdebian.org/tools/debian/emdebian-toolchain-archive.key | apt-key add -
19 dpkg --add-architecture armhf
19 dpkg --add-architecture armhf
20 apt-get update
20 apt-get update
21 ```
21 ```
22
22
23 ## Command-line parameters
23 ## Command-line parameters
24 The script accepts certain command-line parameters to enable or disable specific OS features, services and configuration settings. These parameters are passed to the `rpi23-gen-image.sh` script via (simple) shell-variables. Unlike environment shell-variables (simple) shell-variables are defined at the beginning of the command-line call of the `rpi23-gen-image.sh` script.
24 The script accepts certain command-line parameters to enable or disable specific OS features, services and configuration settings. These parameters are passed to the `rpi23-gen-image.sh` script via (simple) shell-variables. Unlike environment shell-variables (simple) shell-variables are defined at the beginning of the command-line call of the `rpi23-gen-image.sh` script.
25
25
26 ##### Command-line examples:
26 ##### Command-line examples:
27 ```shell
27 ```shell
28 ENABLE_UBOOT=true ./rpi23-gen-image.sh
28 ENABLE_UBOOT=true ./rpi23-gen-image.sh
29 ENABLE_CONSOLE=false ENABLE_IPV6=false ./rpi23-gen-image.sh
29 ENABLE_CONSOLE=false ENABLE_IPV6=false ./rpi23-gen-image.sh
30 ENABLE_WM=xfce4 ENABLE_FBTURBO=true ENABLE_MINBASE=true ./rpi23-gen-image.sh
30 ENABLE_WM=xfce4 ENABLE_FBTURBO=true ENABLE_MINBASE=true ./rpi23-gen-image.sh
31 ENABLE_HARDNET=true ENABLE_IPTABLES=true /rpi23-gen-image.sh
31 ENABLE_HARDNET=true ENABLE_IPTABLES=true /rpi23-gen-image.sh
32 APT_SERVER=ftp.de.debian.org APT_PROXY="http://127.0.0.1:3142/" ./rpi23-gen-image.sh
32 APT_SERVER=ftp.de.debian.org APT_PROXY="http://127.0.0.1:3142/" ./rpi23-gen-image.sh
33 ENABLE_MINBASE=true ./rpi23-gen-image.sh
33 ENABLE_MINBASE=true ./rpi23-gen-image.sh
34 BUILD_KERNEL=true ENABLE_MINBASE=true ENABLE_IPV6=false ./rpi23-gen-image.sh
34 BUILD_KERNEL=true ENABLE_MINBASE=true ENABLE_IPV6=false ./rpi23-gen-image.sh
35 BUILD_KERNEL=true KERNELSRC_DIR=/tmp/linux ./rpi23-gen-image.sh
35 BUILD_KERNEL=true KERNELSRC_DIR=/tmp/linux ./rpi23-gen-image.sh
36 ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
36 ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
37 ENABLE_CRYPTFS=true CRYPTFS_PASSWORD=changeme EXPANDROOT=false ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
37 ENABLE_CRYPTFS=true CRYPTFS_PASSWORD=changeme EXPANDROOT=false ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
38 RELEASE=stretch BUILD_KERNEL=true ./rpi23-gen-image.sh
38 RELEASE=stretch BUILD_KERNEL=true ./rpi23-gen-image.sh
39 RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
39 RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
40 RELEASE=stretch RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
40 RELEASE=stretch RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
41 ```
41 ```
42
42
43 ## Configuration template files
43 ## Configuration template files
44 To avoid long lists of command-line parameters and to help to store the favourite parameter configurations the `rpi23-gen-image.sh` script supports so called configuration template files (`CONFIG_TEMPLATE`=template). These are simple text files located in the `./templates` directory that contain the list of configuration parameters that will be used. New configuration template files can be added to the `./templates` directory.
44 To avoid long lists of command-line parameters and to help to store the favourite parameter configurations the `rpi23-gen-image.sh` script supports so called configuration template files (`CONFIG_TEMPLATE`=template). These are simple text files located in the `./templates` directory that contain the list of configuration parameters that will be used. New configuration template files can be added to the `./templates` directory.
45
45
46 ##### Command-line examples:
46 ##### Command-line examples:
47 ```shell
47 ```shell
48 CONFIG_TEMPLATE=rpi3stretch ./rpi23-gen-image.sh
48 CONFIG_TEMPLATE=rpi3stretch ./rpi23-gen-image.sh
49 CONFIG_TEMPLATE=rpi2stretch ./rpi23-gen-image.sh
49 CONFIG_TEMPLATE=rpi2stretch ./rpi23-gen-image.sh
50 ```
50 ```
51
51
52 ## Supported parameters and settings
52 ## Supported parameters and settings
53 #### APT settings:
53 #### APT settings:
54 ##### `APT_SERVER`="ftp.debian.org"
54 ##### `APT_SERVER`="ftp.debian.org"
55 Set Debian packages server address. Choose a server from the list of Debian worldwide [mirror sites](https://www.debian.org/mirror/list). Using a nearby server will probably speed-up all required downloads within the bootstrapping process.
55 Set Debian packages server address. Choose a server from the list of Debian worldwide [mirror sites](https://www.debian.org/mirror/list). Using a nearby server will probably speed-up all required downloads within the bootstrapping process.
56
56
57 ##### `APT_PROXY`=""
57 ##### `APT_PROXY`=""
58 Set Proxy server address. Using a local Proxy-Cache like `apt-cacher-ng` will speed-up the bootstrapping process because all required Debian packages will only be downloaded from the Debian mirror site once.
58 Set Proxy server address. Using a local Proxy-Cache like `apt-cacher-ng` will speed-up the bootstrapping process because all required Debian packages will only be downloaded from the Debian mirror site once.
59
59
60 ##### `APT_INCLUDES`=""
60 ##### `APT_INCLUDES`=""
61 A comma separated list of additional packages to be installed by debootstrap during bootstrapping.
61 A comma separated list of additional packages to be installed by debootstrap during bootstrapping.
62
62
63 ##### `APT_INCLUDES_LATE`=""
63 ##### `APT_INCLUDES_LATE`=""
64 A comma separated list of additional packages to be installed by apt after bootstrapping and after APT sources are set up. This is useful for packages with pre-depends, which debootstrap do not handle well.
64 A comma separated list of additional packages to be installed by apt after bootstrapping and after APT sources are set up. This is useful for packages with pre-depends, which debootstrap do not handle well.
65
65
66 ---
66 ---
67
67
68 #### General system settings:
68 #### General system settings:
69 ##### `RPI_MODEL`=2
69 ##### `RPI_MODEL`=2
70 Specifiy the target Raspberry Pi hardware model. The script at this time supports the Raspberry Pi models `2` and `3`. `BUILD_KERNEL`=true will automatically be set if the Raspberry Pi model `3` is used.
70 Specifiy the target Raspberry Pi hardware model. The script at this time supports the Raspberry Pi models `2`,`3` and `3B`. `BUILD_KERNEL`=true will automatically be set if the Raspberry Pi model `3` or `3B` is used.
71
71
72 ##### `RELEASE`="jessie"
72 ##### `RELEASE`="jessie"
73 Set the desired Debian release name. The script at this time supports the bootstrapping of the Debian releases "jessie", "stretch" and "buster". `BUILD_KERNEL`=true will automatically be set if the Debian releases `stretch` or `buster` are used.
73 Set the desired Debian release name. The script at this time supports the bootstrapping of the Debian releases "jessie", "stretch" and "buster". `BUILD_KERNEL`=true will automatically be set if the Debian releases `stretch` or `buster` are used.
74
74
75 ##### `RELEASE_ARCH`="armhf"
75 ##### `RELEASE_ARCH`="armhf"
76 Set the desired Debian release architecture.
76 Set the desired Debian release architecture.
77
77
78 ##### `HOSTNAME`="rpi$RPI_MODEL-$RELEASE"
78 ##### `HOSTNAME`="rpi$RPI_MODEL-$RELEASE"
79 Set system host name. It's recommended that the host name is unique in the corresponding subnet.
79 Set system host name. It's recommended that the host name is unique in the corresponding subnet.
80
80
81 ##### `PASSWORD`="raspberry"
81 ##### `PASSWORD`="raspberry"
82 Set system `root` password. It's **STRONGLY** recommended that you choose a custom password.
82 Set system `root` password. It's **STRONGLY** recommended that you choose a custom password.
83
83
84 ##### `USER_PASSWORD`="raspberry"
84 ##### `USER_PASSWORD`="raspberry"
85 Set password for the created non-root user `USER_NAME`=pi. Ignored if `ENABLE_USER`=false. It's **STRONGLY** recommended that you choose a custom password.
85 Set password for the created non-root user `USER_NAME`=pi. Ignored if `ENABLE_USER`=false. It's **STRONGLY** recommended that you choose a custom password.
86
86
87 ##### `DEFLOCAL`="en_US.UTF-8"
87 ##### `DEFLOCAL`="en_US.UTF-8"
88 Set default system locale. This setting can also be changed inside the running OS using the `dpkg-reconfigure locales` command. Please note that on using this parameter the script will automatically install the required packages `locales`, `keyboard-configuration` and `console-setup`.
88 Set default system locale. This setting can also be changed inside the running OS using the `dpkg-reconfigure locales` command. Please note that on using this parameter the script will automatically install the required packages `locales`, `keyboard-configuration` and `console-setup`.
89
89
90 ##### `TIMEZONE`="Europe/Berlin"
90 ##### `TIMEZONE`="Europe/Berlin"
91 Set default system timezone. All available timezones can be found in the `/usr/share/zoneinfo/` directory. This setting can also be changed inside the running OS using the `dpkg-reconfigure tzdata` command.
91 Set default system timezone. All available timezones can be found in the `/usr/share/zoneinfo/` directory. This setting can also be changed inside the running OS using the `dpkg-reconfigure tzdata` command.
92
92
93 ##### `EXPANDROOT`=true
93 ##### `EXPANDROOT`=true
94 Expand the root partition and filesystem automatically on first boot.
94 Expand the root partition and filesystem automatically on first boot.
95
95
96 ---
96 ---
97
97
98 #### Keyboard settings:
98 #### Keyboard settings:
99 These options are used to configure keyboard layout in `/etc/default/keyboard` for console and Xorg. These settings can also be changed inside the running OS using the `dpkg-reconfigure keyboard-configuration` command.
99 These options are used to configure keyboard layout in `/etc/default/keyboard` for console and Xorg. These settings can also be changed inside the running OS using the `dpkg-reconfigure keyboard-configuration` command.
100
100
101 ##### `XKB_MODEL`=""
101 ##### `XKB_MODEL`=""
102 Set the name of the model of your keyboard type.
102 Set the name of the model of your keyboard type.
103
103
104 ##### `XKB_LAYOUT`=""
104 ##### `XKB_LAYOUT`=""
105 Set the supported keyboard layout(s).
105 Set the supported keyboard layout(s).
106
106
107 ##### `XKB_VARIANT`=""
107 ##### `XKB_VARIANT`=""
108 Set the supported variant(s) of the keyboard layout(s).
108 Set the supported variant(s) of the keyboard layout(s).
109
109
110 ##### `XKB_OPTIONS`=""
110 ##### `XKB_OPTIONS`=""
111 Set extra xkb configuration options.
111 Set extra xkb configuration options.
112
112
113 ---
113 ---
114
114
115 #### Networking settings (DHCP):
115 #### Networking settings (DHCP):
116 This parameter is used to set up networking auto configuration in `/etc/systemd/network/eth.network`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.`
116 This parameter is used to set up networking auto configuration in `/etc/systemd/network/eth.network`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.`
117
117
118 ##### `ENABLE_DHCP`=true
118 ##### `ENABLE_DHCP`=true
119 Set the system to use DHCP. This requires an DHCP server.
119 Set the system to use DHCP. This requires an DHCP server.
120
120
121 ---
121 ---
122
122
123 #### Networking settings (static):
123 #### Networking settings (static):
124 These parameters are used to set up a static networking configuration in `/etc/systemd/network/eth.network`. The following static networking parameters are only supported if `ENABLE_DHCP` was set to `false`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.
124 These parameters are used to set up a static networking configuration in `/etc/systemd/network/eth.network`. The following static networking parameters are only supported if `ENABLE_DHCP` was set to `false`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.
125
125
126 ##### `NET_ADDRESS`=""
126 ##### `NET_ADDRESS`=""
127 Set a static IPv4 or IPv6 address and its prefix, separated by "/", eg. "192.169.0.3/24".
127 Set a static IPv4 or IPv6 address and its prefix, separated by "/", eg. "192.169.0.3/24".
128
128
129 ##### `NET_GATEWAY`=""
129 ##### `NET_GATEWAY`=""
130 Set the IP address for the default gateway.
130 Set the IP address for the default gateway.
131
131
132 ##### `NET_DNS_1`=""
132 ##### `NET_DNS_1`=""
133 Set the IP address for the first DNS server.
133 Set the IP address for the first DNS server.
134
134
135 ##### `NET_DNS_2`=""
135 ##### `NET_DNS_2`=""
136 Set the IP address for the second DNS server.
136 Set the IP address for the second DNS server.
137
137
138 ##### `NET_DNS_DOMAINS`=""
138 ##### `NET_DNS_DOMAINS`=""
139 Set the default DNS search domains to use for non fully qualified host names.
139 Set the default DNS search domains to use for non fully qualified host names.
140
140
141 ##### `NET_NTP_1`=""
141 ##### `NET_NTP_1`=""
142 Set the IP address for the first NTP server.
142 Set the IP address for the first NTP server.
143
143
144 ##### `NET_NTP_2`=""
144 ##### `NET_NTP_2`=""
145 Set the IP address for the second NTP server.
145 Set the IP address for the second NTP server.
146
146
147 ---
147 ---
148
148
149 #### Basic system features:
149 #### Basic system features:
150 ##### `ENABLE_CONSOLE`=true
150 ##### `ENABLE_CONSOLE`=true
151 Enable serial console interface. Recommended if no monitor or keyboard is connected to the RPi2/3. In case of problems fe. if the network (auto) configuration failed - the serial console can be used to access the system.
151 Enable serial console interface. Recommended if no monitor or keyboard is connected to the RPi2/3. In case of problems fe. if the network (auto) configuration failed - the serial console can be used to access the system.
152
152
153 ##### `ENABLE_I2C`=false
153 ##### `ENABLE_I2C`=false
154 Enable I2C interface on the RPi2/3. Please check the [RPi2/3 pinout diagrams](http://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
154 Enable I2C interface on the RPi2/3. Please check the [RPi2/3 pinout diagrams](http://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
155
155
156 ##### `ENABLE_SPI`=false
156 ##### `ENABLE_SPI`=false
157 Enable SPI interface on the RPi2/3. Please check the [RPi2/3 pinout diagrams](http://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
157 Enable SPI interface on the RPi2/3. Please check the [RPi2/3 pinout diagrams](http://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
158
158
159 ##### `ENABLE_IPV6`=true
159 ##### `ENABLE_IPV6`=true
160 Enable IPv6 support. The network interface configuration is managed via systemd-networkd.
160 Enable IPv6 support. The network interface configuration is managed via systemd-networkd.
161
161
162 ##### `ENABLE_SSHD`=true
162 ##### `ENABLE_SSHD`=true
163 Install and enable OpenSSH service. The default configuration of the service doesn't allow `root` to login. Please use the user `pi` instead and `su -` or `sudo` to execute commands as root.
163 Install and enable OpenSSH service. The default configuration of the service doesn't allow `root` to login. Please use the user `pi` instead and `su -` or `sudo` to execute commands as root.
164
164
165 ##### `ENABLE_NONFREE`=false
165 ##### `ENABLE_NONFREE`=false
166 Allow the installation of non-free Debian packages that do not comply with the DFSG. This is required to install closed-source firmware binary blobs.
166 Allow the installation of non-free Debian packages that do not comply with the DFSG. This is required to install closed-source firmware binary blobs.
167
167
168 ##### `ENABLE_WIRELESS`=false
168 ##### `ENABLE_WIRELESS`=false
169 Download and install the [closed-source firmware binary blob](https://github.com/RPi-Distro/firmware-nonfree/tree/master/brcm80211/brcm) that is required to run the internal wireless interface of the Raspberry Pi model `3`. This parameter is ignored if the specified `RPI_MODEL` is not `3`.
169 Download and install the [closed-source firmware binary blob](https://github.com/RPi-Distro/firmware-nonfree/tree/master/brcm80211/brcm) that is required to run the internal wireless interface of the Raspberry Pi model `3`. This parameter is ignored if the specified `RPI_MODEL` is not `3`.
170
170
171 ##### `ENABLE_RSYSLOG`=true
171 ##### `ENABLE_RSYSLOG`=true
172 If set to false, disable and uninstall rsyslog (so logs will be available only
172 If set to false, disable and uninstall rsyslog (so logs will be available only
173 in journal files)
173 in journal files)
174
174
175 ##### `ENABLE_SOUND`=true
175 ##### `ENABLE_SOUND`=true
176 Enable sound hardware and install Advanced Linux Sound Architecture.
176 Enable sound hardware and install Advanced Linux Sound Architecture.
177
177
178 ##### `ENABLE_HWRANDOM`=true
178 ##### `ENABLE_HWRANDOM`=true
179 Enable Hardware Random Number Generator. Strong random numbers are important for most network based communications that use encryption. It's recommended to be enabled.
179 Enable Hardware Random Number Generator. Strong random numbers are important for most network based communications that use encryption. It's recommended to be enabled.
180
180
181 ##### `ENABLE_MINGPU`=false
181 ##### `ENABLE_MINGPU`=false
182 Minimize the amount of shared memory reserved for the GPU. It doesn't seem to be possible to fully disable the GPU.
182 Minimize the amount of shared memory reserved for the GPU. It doesn't seem to be possible to fully disable the GPU.
183
183
184 ##### `ENABLE_DBUS`=true
184 ##### `ENABLE_DBUS`=true
185 Install and enable D-Bus message bus. Please note that systemd should work without D-bus but it's recommended to be enabled.
185 Install and enable D-Bus message bus. Please note that systemd should work without D-bus but it's recommended to be enabled.
186
186
187 ##### `ENABLE_XORG`=false
187 ##### `ENABLE_XORG`=false
188 Install Xorg open-source X Window System.
188 Install Xorg open-source X Window System.
189
189
190 ##### `ENABLE_WM`=""
190 ##### `ENABLE_WM`=""
191 Install a user defined window manager for the X Window System. To make sure all X related package dependencies are getting installed `ENABLE_XORG` will automatically get enabled if `ENABLE_WM` is used. The `rpi23-gen-image.sh` script has been tested with the following list of window managers: `blackbox`, `openbox`, `fluxbox`, `jwm`, `dwm`, `xfce4`, `awesome`.
191 Install a user defined window manager for the X Window System. To make sure all X related package dependencies are getting installed `ENABLE_XORG` will automatically get enabled if `ENABLE_WM` is used. The `rpi23-gen-image.sh` script has been tested with the following list of window managers: `blackbox`, `openbox`, `fluxbox`, `jwm`, `dwm`, `xfce4`, `awesome`.
192
192
193 ---
193 ---
194
194
195 #### Advanced system features:
195 #### Advanced system features:
196 ##### `ENABLE_MINBASE`=false
196 ##### `ENABLE_MINBASE`=false
197 Use debootstrap script variant `minbase` which only includes essential packages and apt. This will reduce the disk usage by about 65 MB.
197 Use debootstrap script variant `minbase` which only includes essential packages and apt. This will reduce the disk usage by about 65 MB.
198
198
199 ##### `ENABLE_REDUCE`=false
199 ##### `ENABLE_REDUCE`=false
200 Reduce the disk space usage by deleting packages and files. See `REDUCE_*` parameters for detailed information.
200 Reduce the disk space usage by deleting packages and files. See `REDUCE_*` parameters for detailed information.
201
201
202 ##### `ENABLE_UBOOT`=false
202 ##### `ENABLE_UBOOT`=false
203 Replace the default RPi2/3 second stage bootloader (bootcode.bin) with [U-Boot bootloader](http://git.denx.de/?p=u-boot.git;a=summary). U-Boot can boot images via the network using the BOOTP/TFTP protocol.
203 Replace the default RPi2/3 second stage bootloader (bootcode.bin) with [U-Boot bootloader](http://git.denx.de/?p=u-boot.git;a=summary). U-Boot can boot images via the network using the BOOTP/TFTP protocol.
204
204
205 ##### `UBOOTSRC_DIR`=""
205 ##### `UBOOTSRC_DIR`=""
206 Path to a directory (`u-boot`) of [U-Boot bootloader sources](http://git.denx.de/?p=u-boot.git;a=summary) that will be copied, configured, build and installed inside the chroot.
206 Path to a directory (`u-boot`) of [U-Boot bootloader sources](http://git.denx.de/?p=u-boot.git;a=summary) that will be copied, configured, build and installed inside the chroot.
207
207
208 ##### `ENABLE_FBTURBO`=false
208 ##### `ENABLE_FBTURBO`=false
209 Install and enable the [hardware accelerated Xorg video driver](https://github.com/ssvb/xf86-video-fbturbo) `fbturbo`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling.
209 Install and enable the [hardware accelerated Xorg video driver](https://github.com/ssvb/xf86-video-fbturbo) `fbturbo`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling.
210
210
211 ##### `FBTURBOSRC_DIR`=""
211 ##### `FBTURBOSRC_DIR`=""
212 Path to a directory (`xf86-video-fbturbo`) of [hardware accelerated Xorg video driver sources](https://github.com/ssvb/xf86-video-fbturbo) that will be copied, configured, build and installed inside the chroot.
212 Path to a directory (`xf86-video-fbturbo`) of [hardware accelerated Xorg video driver sources](https://github.com/ssvb/xf86-video-fbturbo) that will be copied, configured, build and installed inside the chroot.
213
213
214 ##### `ENABLE_IPTABLES`=false
214 ##### `ENABLE_IPTABLES`=false
215 Enable iptables IPv4/IPv6 firewall. Simplified ruleset: Allow all outgoing connections. Block all incoming connections except to OpenSSH service.
215 Enable iptables IPv4/IPv6 firewall. Simplified ruleset: Allow all outgoing connections. Block all incoming connections except to OpenSSH service.
216
216
217 ##### `ENABLE_USER`=true
217 ##### `ENABLE_USER`=true
218 Create non-root user with password `USER_PASSWORD`=raspberry. Unless overridden with `USER_NAME`=user, username will be `pi`.
218 Create non-root user with password `USER_PASSWORD`=raspberry. Unless overridden with `USER_NAME`=user, username will be `pi`.
219
219
220 ##### `USER_NAME`=pi
220 ##### `USER_NAME`=pi
221 Non-root user to create. Ignored if `ENABLE_USER`=false
221 Non-root user to create. Ignored if `ENABLE_USER`=false
222
222
223 ##### `ENABLE_ROOT`=false
223 ##### `ENABLE_ROOT`=false
224 Set root user password so root login will be enabled
224 Set root user password so root login will be enabled
225
225
226 ##### `ENABLE_HARDNET`=false
226 ##### `ENABLE_HARDNET`=false
227 Enable IPv4/IPv6 network stack hardening settings.
227 Enable IPv4/IPv6 network stack hardening settings.
228
228
229 ##### `ENABLE_SPLITFS`=false
229 ##### `ENABLE_SPLITFS`=false
230 Enable having root partition on an USB drive by creating two image files: one for the `/boot/firmware` mount point, and another for `/`.
230 Enable having root partition on an USB drive by creating two image files: one for the `/boot/firmware` mount point, and another for `/`.
231
231
232 ##### `CHROOT_SCRIPTS`=""
232 ##### `CHROOT_SCRIPTS`=""
233 Path to a directory with scripts that should be run in the chroot before the image is finally built. Every executable file in this directory is run in lexicographical order.
233 Path to a directory with scripts that should be run in the chroot before the image is finally built. Every executable file in this directory is run in lexicographical order.
234
234
235 ##### `ENABLE_INITRAMFS`=false
235 ##### `ENABLE_INITRAMFS`=false
236 Create an initramfs that that will be loaded during the Linux startup process. `ENABLE_INITRAMFS` will automatically get enabled if `ENABLE_CRYPTFS`=true. This parameter will be ignored if `BUILD_KERNEL`=false.
236 Create an initramfs that that will be loaded during the Linux startup process. `ENABLE_INITRAMFS` will automatically get enabled if `ENABLE_CRYPTFS`=true. This parameter will be ignored if `BUILD_KERNEL`=false.
237
237
238 ##### `ENABLE_IFNAMES`=true
238 ##### `ENABLE_IFNAMES`=true
239 Enable automatic assignment of predictable, stable network interface names for all local Ethernet, WLAN interfaces. This might create complex and long interface names. This parameter is only supported if the Debian releases `stretch` or `buster` are used.
239 Enable automatic assignment of predictable, stable network interface names for all local Ethernet, WLAN interfaces. This might create complex and long interface names. This parameter is only supported if the Debian releases `stretch` or `buster` are used.
240
240
241 ##### `DISABLE_UNDERVOLT_WARNINGS`=
241 ##### `DISABLE_UNDERVOLT_WARNINGS`=
242 Disable RPi2/3 under-voltage warnings and overlays. Setting the parameter to `1` will disable the warning overlay. Setting it to `2` will additionally allow RPi2/3 turbo mode when low-voltage is present.
242 Disable RPi2/3 under-voltage warnings and overlays. Setting the parameter to `1` will disable the warning overlay. Setting it to `2` will additionally allow RPi2/3 turbo mode when low-voltage is present.
243
243
244 ---
244 ---
245
245
246 #### SSH settings:
246 #### SSH settings:
247 ##### `SSH_ENABLE_ROOT`=false
247 ##### `SSH_ENABLE_ROOT`=false
248 Enable password root login via SSH. This may be a security risk with default password, use only in trusted environments. `ENABLE_ROOT` must be set to `true`.
248 Enable password root login via SSH. This may be a security risk with default password, use only in trusted environments. `ENABLE_ROOT` must be set to `true`.
249
249
250 ##### `SSH_DISABLE_PASSWORD_AUTH`=false
250 ##### `SSH_DISABLE_PASSWORD_AUTH`=false
251 Disable password based SSH authentication. Only public key based SSH (v2) authentication will be supported.
251 Disable password based SSH authentication. Only public key based SSH (v2) authentication will be supported.
252
252
253 ##### `SSH_LIMIT_USERS`=false
253 ##### `SSH_LIMIT_USERS`=false
254 Limit the users that are allowed to login via SSH. Only allow user `USER_NAME`=pi and root if `SSH_ENABLE_ROOT`=true to login. This parameter will be ignored if `dropbear` SSH is used (`REDUCE_SSHD`=true).
254 Limit the users that are allowed to login via SSH. Only allow user `USER_NAME`=pi and root if `SSH_ENABLE_ROOT`=true to login. This parameter will be ignored if `dropbear` SSH is used (`REDUCE_SSHD`=true).
255
255
256 ##### `SSH_ROOT_PUB_KEY`=""
256 ##### `SSH_ROOT_PUB_KEY`=""
257 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `root`. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported. `ENABLE_ROOT` **and** `SSH_ENABLE_ROOT` must be set to `true`.
257 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `root`. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported. `ENABLE_ROOT` **and** `SSH_ENABLE_ROOT` must be set to `true`.
258
258
259 ##### `SSH_USER_PUB_KEY`=""
259 ##### `SSH_USER_PUB_KEY`=""
260 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `USER_NAME`=pi. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported.
260 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `USER_NAME`=pi. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported.
261
261
262 ---
262 ---
263
263
264 #### Kernel compilation:
264 #### Kernel compilation:
265 ##### `BUILD_KERNEL`=false
265 ##### `BUILD_KERNEL`=false
266 Build and install the latest RPi2/3 Linux kernel. Currently only the default RPi2/3 kernel configuration is used. `BUILD_KERNEL`=true will automatically be set if the Raspberry Pi model `3` is used.
266 Build and install the latest RPi2/3 Linux kernel. Currently only the default RPi2/3 kernel configuration is used. `BUILD_KERNEL`=true will automatically be set if the Raspberry Pi model `3` is used.
267
267
268 ##### `CROSS_COMPILE`="arm-linux-gnueabihf-"
268 ##### `CROSS_COMPILE`="arm-linux-gnueabihf-"
269 This sets the cross compile enviornment for the compiler.
269 This sets the cross compile enviornment for the compiler.
270
270
271 ##### `KERNEL_ARCH`="arm"
271 ##### `KERNEL_ARCH`="arm"
272 This sets the kernel architecture for the compiler.
272 This sets the kernel architecture for the compiler.
273
273
274 ##### `KERNEL_IMAGE`="kernel7.img"
274 ##### `KERNEL_IMAGE`="kernel7.img"
275 Name of the image file in the boot partition. If not set, `KERNEL_IMAGE` will be set to "kernel8.img" automatically if building for arm64.
275 Name of the image file in the boot partition. If not set, `KERNEL_IMAGE` will be set to "kernel8.img" automatically if building for arm64.
276
276
277 ##### `KERNEL_BRANCH`=""
277 ##### `KERNEL_BRANCH`=""
278 Name of the requested branch from the GIT location for the RPi Kernel. Default is using the current default branch from the GIT site.
278 Name of the requested branch from the GIT location for the RPi Kernel. Default is using the current default branch from the GIT site.
279
279
280 ##### `QEMU_BINARY`="/usr/bin/qemu-arm-static"
280 ##### `QEMU_BINARY`="/usr/bin/qemu-arm-static"
281 Sets the QEMU enviornment for the Debian archive. If not set, `QEMU_BINARY` will be set to "/usr/bin/qemu-aarch64-static" automatically if building for arm64.
281 Sets the QEMU enviornment for the Debian archive. If not set, `QEMU_BINARY` will be set to "/usr/bin/qemu-aarch64-static" automatically if building for arm64.
282
282
283 ##### `KERNEL_DEFCONFIG`="bcm2709_defconfig"
283 ##### `KERNEL_DEFCONFIG`="bcm2709_defconfig"
284 Sets the default config for kernel compiling. If not set, `KERNEL_DEFCONFIG` will be set to "bcmrpi3\_defconfig" automatically if building for arm64.
284 Sets the default config for kernel compiling. If not set, `KERNEL_DEFCONFIG` will be set to "bcmrpi3\_defconfig" automatically if building for arm64.
285
285
286 ##### `KERNEL_REDUCE`=false
286 ##### `KERNEL_REDUCE`=false
287 Reduce the size of the generated kernel by removing unwanted device, network and filesystem drivers (experimental).
287 Reduce the size of the generated kernel by removing unwanted device, network and filesystem drivers (experimental).
288
288
289 ##### `KERNEL_THREADS`=1
289 ##### `KERNEL_THREADS`=1
290 Number of parallel kernel building threads. If the parameter is left untouched the script will automatically determine the number of CPU cores to set the number of parallel threads to speed the kernel compilation.
290 Number of parallel kernel building threads. If the parameter is left untouched the script will automatically determine the number of CPU cores to set the number of parallel threads to speed the kernel compilation.
291
291
292 ##### `KERNEL_HEADERS`=true
292 ##### `KERNEL_HEADERS`=true
293 Install kernel headers with built kernel.
293 Install kernel headers with built kernel.
294
294
295 ##### `KERNEL_MENUCONFIG`=false
295 ##### `KERNEL_MENUCONFIG`=false
296 Start `make menuconfig` interactive menu-driven kernel configuration. The script will continue after `make menuconfig` was terminated.
296 Start `make menuconfig` interactive menu-driven kernel configuration. The script will continue after `make menuconfig` was terminated.
297
297
298 ##### `KERNEL_OLDDEFCONFIG`=false
298 ##### `KERNEL_OLDDEFCONFIG`=false
299 Run `make olddefconfig` to automatically set all new kernel configuration options to their recommended default values.
299 Run `make olddefconfig` to automatically set all new kernel configuration options to their recommended default values.
300
300
301 ##### `KERNEL_CCACHE`=false
301 ##### `KERNEL_CCACHE`=false
302 Compile the kernel using ccache. This speeds up kernel recompilation by caching previous compilations and detecting when the same compilation is being done again.
302 Compile the kernel using ccache. This speeds up kernel recompilation by caching previous compilations and detecting when the same compilation is being done again.
303
303
304 ##### `KERNEL_REMOVESRC`=true
304 ##### `KERNEL_REMOVESRC`=true
305 Remove all kernel sources from the generated OS image after it was built and installed.
305 Remove all kernel sources from the generated OS image after it was built and installed.
306
306
307 ##### `KERNELSRC_DIR`=""
307 ##### `KERNELSRC_DIR`=""
308 Path to a directory (`linux`) of [RaspberryPi Linux kernel sources](https://github.com/raspberrypi/linux) that will be copied, configured, build and installed inside the chroot.
308 Path to a directory (`linux`) of [RaspberryPi Linux kernel sources](https://github.com/raspberrypi/linux) that will be copied, configured, build and installed inside the chroot.
309
309
310 ##### `KERNELSRC_CLEAN`=false
310 ##### `KERNELSRC_CLEAN`=false
311 Clean the existing kernel sources directory `KERNELSRC_DIR` (using `make mrproper`) after it was copied to the chroot and before the compilation of the kernel has started. This parameter will be ignored if no `KERNELSRC_DIR` was specified or if `KERNELSRC_PREBUILT`=true.
311 Clean the existing kernel sources directory `KERNELSRC_DIR` (using `make mrproper`) after it was copied to the chroot and before the compilation of the kernel has started. This parameter will be ignored if no `KERNELSRC_DIR` was specified or if `KERNELSRC_PREBUILT`=true.
312
312
313 ##### `KERNELSRC_CONFIG`=true
313 ##### `KERNELSRC_CONFIG`=true
314 Run `make bcm2709_defconfig` (and optional `make menuconfig`) to configure the kernel sources before building. This parameter is automatically set to `true` if no existing kernel sources directory was specified using `KERNELSRC_DIR`. This parameter is ignored if `KERNELSRC_PREBUILT`=true.
314 Run `make bcm2709_defconfig` (and optional `make menuconfig`) to configure the kernel sources before building. This parameter is automatically set to `true` if no existing kernel sources directory was specified using `KERNELSRC_DIR`. This parameter is ignored if `KERNELSRC_PREBUILT`=true.
315
315
316 ##### `KERNELSRC_USRCONFIG`=""
316 ##### `KERNELSRC_USRCONFIG`=""
317 Copy own config file to kernel `.config`. If `KERNEL_MENUCONFIG`=true then running after copy.
317 Copy own config file to kernel `.config`. If `KERNEL_MENUCONFIG`=true then running after copy.
318
318
319 ##### `KERNELSRC_PREBUILT`=false
319 ##### `KERNELSRC_PREBUILT`=false
320 With this parameter set to true the script expects the existing kernel sources directory to be already successfully cross-compiled. The parameters `KERNELSRC_CLEAN`, `KERNELSRC_CONFIG`, `KERNELSRC_USRCONFIG` and `KERNEL_MENUCONFIG` are ignored and no kernel compilation tasks are performed.
320 With this parameter set to true the script expects the existing kernel sources directory to be already successfully cross-compiled. The parameters `KERNELSRC_CLEAN`, `KERNELSRC_CONFIG`, `KERNELSRC_USRCONFIG` and `KERNEL_MENUCONFIG` are ignored and no kernel compilation tasks are performed.
321
321
322 ##### `RPI_FIRMWARE_DIR`=""
322 ##### `RPI_FIRMWARE_DIR`=""
323 The directory (`firmware`) containing a local copy of the firmware from the [RaspberryPi firmware project](https://github.com/raspberrypi/firmware). Default is to download the latest firmware directly from the project.
323 The directory (`firmware`) containing a local copy of the firmware from the [RaspberryPi firmware project](https://github.com/raspberrypi/firmware). Default is to download the latest firmware directly from the project.
324
324
325 ---
325 ---
326
326
327 #### Reduce disk usage:
327 #### Reduce disk usage:
328 The following list of parameters is ignored if `ENABLE_REDUCE`=false.
328 The following list of parameters is ignored if `ENABLE_REDUCE`=false.
329
329
330 ##### `REDUCE_APT`=true
330 ##### `REDUCE_APT`=true
331 Configure APT to use compressed package repository lists and no package caching files.
331 Configure APT to use compressed package repository lists and no package caching files.
332
332
333 ##### `REDUCE_DOC`=true
333 ##### `REDUCE_DOC`=true
334 Remove all doc files (harsh). Configure APT to not include doc files on future `apt-get` package installations.
334 Remove all doc files (harsh). Configure APT to not include doc files on future `apt-get` package installations.
335
335
336 ##### `REDUCE_MAN`=true
336 ##### `REDUCE_MAN`=true
337 Remove all man pages and info files (harsh). Configure APT to not include man pages on future `apt-get` package installations.
337 Remove all man pages and info files (harsh). Configure APT to not include man pages on future `apt-get` package installations.
338
338
339 ##### `REDUCE_VIM`=false
339 ##### `REDUCE_VIM`=false
340 Replace `vim-tiny` package by `levee` a tiny vim clone.
340 Replace `vim-tiny` package by `levee` a tiny vim clone.
341
341
342 ##### `REDUCE_BASH`=false
342 ##### `REDUCE_BASH`=false
343 Remove `bash` package and switch to `dash` shell (experimental).
343 Remove `bash` package and switch to `dash` shell (experimental).
344
344
345 ##### `REDUCE_HWDB`=true
345 ##### `REDUCE_HWDB`=true
346 Remove PCI related hwdb files (experimental).
346 Remove PCI related hwdb files (experimental).
347
347
348 ##### `REDUCE_SSHD`=true
348 ##### `REDUCE_SSHD`=true
349 Replace `openssh-server` with `dropbear`.
349 Replace `openssh-server` with `dropbear`.
350
350
351 ##### `REDUCE_LOCALE`=true
351 ##### `REDUCE_LOCALE`=true
352 Remove all `locale` translation files.
352 Remove all `locale` translation files.
353
353
354 ---
354 ---
355
355
356 #### Encrypted root partition:
356 #### Encrypted root partition:
357 ##### `ENABLE_CRYPTFS`=false
357 ##### `ENABLE_CRYPTFS`=false
358 Enable full system encryption with dm-crypt. Setup a fully LUKS encrypted root partition (aes-xts-plain64:sha512) and generate required initramfs. The /boot directory will not be encrypted. This parameter will be ignored if `BUILD_KERNEL`=false. `ENABLE_CRYPTFS` is experimental. SSH-to-initramfs is currently not supported but will be soon - feel free to help.
358 Enable full system encryption with dm-crypt. Setup a fully LUKS encrypted root partition (aes-xts-plain64:sha512) and generate required initramfs. The /boot directory will not be encrypted. This parameter will be ignored if `BUILD_KERNEL`=false. `ENABLE_CRYPTFS` is experimental. SSH-to-initramfs is currently not supported but will be soon - feel free to help.
359
359
360 ##### `CRYPTFS_PASSWORD`=""
360 ##### `CRYPTFS_PASSWORD`=""
361 Set password of the encrypted root partition. This parameter is mandatory if `ENABLE_CRYPTFS`=true.
361 Set password of the encrypted root partition. This parameter is mandatory if `ENABLE_CRYPTFS`=true.
362
362
363 ##### `CRYPTFS_MAPPING`="secure"
363 ##### `CRYPTFS_MAPPING`="secure"
364 Set name of dm-crypt managed device-mapper mapping.
364 Set name of dm-crypt managed device-mapper mapping.
365
365
366 ##### `CRYPTFS_CIPHER`="aes-xts-plain64:sha512"
366 ##### `CRYPTFS_CIPHER`="aes-xts-plain64:sha512"
367 Set cipher specification string. `aes-xts*` ciphers are strongly recommended.
367 Set cipher specification string. `aes-xts*` ciphers are strongly recommended.
368
368
369 ##### `CRYPTFS_XTSKEYSIZE`=512
369 ##### `CRYPTFS_XTSKEYSIZE`=512
370 Sets key size in bits. The argument has to be a multiple of 8.
370 Sets key size in bits. The argument has to be a multiple of 8.
371
371
372 ---
372 ---
373
373
374 #### Build settings:
374 #### Build settings:
375 ##### `BASEDIR`=$(pwd)/images/${RELEASE}
375 ##### `BASEDIR`=$(pwd)/images/${RELEASE}
376 Set a path to a working directory used by the script to generate an image.
376 Set a path to a working directory used by the script to generate an image.
377
377
378 ##### `IMAGE_NAME`=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}
378 ##### `IMAGE_NAME`=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}
379 Set a filename for the output file(s). Note: the script will create $IMAGE_NAME.img if `ENABLE_SPLITFS`=false or $IMAGE_NAME-frmw.img and $IMAGE_NAME-root.img if `ENABLE_SPLITFS`=true. Note 2: If the KERNEL_BRANCH is not set, the word "CURRENT" is used.
379 Set a filename for the output file(s). Note: the script will create $IMAGE_NAME.img if `ENABLE_SPLITFS`=false or $IMAGE_NAME-frmw.img and $IMAGE_NAME-root.img if `ENABLE_SPLITFS`=true. Note 2: If the KERNEL_BRANCH is not set, the word "CURRENT" is used.
380
380
381 ## Understanding the script
381 ## Understanding the script
382 The functions of this script that are required for the different stages of the bootstrapping are split up into single files located inside the `bootstrap.d` directory. During the bootstrapping every script in this directory gets executed in lexicographical order:
382 The functions of this script that are required for the different stages of the bootstrapping are split up into single files located inside the `bootstrap.d` directory. During the bootstrapping every script in this directory gets executed in lexicographical order:
383
383
384 | Script | Description |
384 | Script | Description |
385 | --- | --- |
385 | --- | --- |
386 | `10-bootstrap.sh` | Debootstrap basic system |
386 | `10-bootstrap.sh` | Debootstrap basic system |
387 | `11-apt.sh` | Setup APT repositories |
387 | `11-apt.sh` | Setup APT repositories |
388 | `12-locale.sh` | Setup Locales and keyboard settings |
388 | `12-locale.sh` | Setup Locales and keyboard settings |
389 | `13-kernel.sh` | Build and install RPi2/3 Kernel |
389 | `13-kernel.sh` | Build and install RPi2/3 Kernel |
390 | `14-fstab.sh` | Setup fstab and initramfs |
390 | `14-fstab.sh` | Setup fstab and initramfs |
391 | `15-rpi-config.sh` | Setup RPi2/3 config and cmdline |
391 | `15-rpi-config.sh` | Setup RPi2/3 config and cmdline |
392 | `20-networking.sh` | Setup Networking |
392 | `20-networking.sh` | Setup Networking |
393 | `21-firewall.sh` | Setup Firewall |
393 | `21-firewall.sh` | Setup Firewall |
394 | `30-security.sh` | Setup Users and Security settings |
394 | `30-security.sh` | Setup Users and Security settings |
395 | `31-logging.sh` | Setup Logging |
395 | `31-logging.sh` | Setup Logging |
396 | `32-sshd.sh` | Setup SSH and public keys |
396 | `32-sshd.sh` | Setup SSH and public keys |
397 | `41-uboot.sh` | Build and Setup U-Boot |
397 | `41-uboot.sh` | Build and Setup U-Boot |
398 | `42-fbturbo.sh` | Build and Setup fbturbo Xorg driver |
398 | `42-fbturbo.sh` | Build and Setup fbturbo Xorg driver |
399 | `50-firstboot.sh` | First boot actions |
399 | `50-firstboot.sh` | First boot actions |
400 | `99-reduce.sh` | Reduce the disk space usage |
400 | `99-reduce.sh` | Reduce the disk space usage |
401
401
402 All the required configuration files that will be copied to the generated OS image are located inside the `files` directory. It is not recommended to modify these configuration files manually.
402 All the required configuration files that will be copied to the generated OS image are located inside the `files` directory. It is not recommended to modify these configuration files manually.
403
403
404 | Directory | Description |
404 | Directory | Description |
405 | --- | --- |
405 | --- | --- |
406 | `apt` | APT management configuration files |
406 | `apt` | APT management configuration files |
407 | `boot` | Boot and RPi2/3 configuration files |
407 | `boot` | Boot and RPi2/3 configuration files |
408 | `dpkg` | Package Manager configuration |
408 | `dpkg` | Package Manager configuration |
409 | `etc` | Configuration files and rc scripts |
409 | `etc` | Configuration files and rc scripts |
410 | `firstboot` | Scripts that get executed on first boot |
410 | `firstboot` | Scripts that get executed on first boot |
411 | `initramfs` | Initramfs scripts |
411 | `initramfs` | Initramfs scripts |
412 | `iptables` | Firewall configuration files |
412 | `iptables` | Firewall configuration files |
413 | `locales` | Locales configuration |
413 | `locales` | Locales configuration |
414 | `modules` | Kernel Modules configuration |
414 | `modules` | Kernel Modules configuration |
415 | `mount` | Fstab configuration |
415 | `mount` | Fstab configuration |
416 | `network` | Networking configuration files |
416 | `network` | Networking configuration files |
417 | `sysctl.d` | Swapping and Network Hardening configuration |
417 | `sysctl.d` | Swapping and Network Hardening configuration |
418 | `xorg` | fbturbo Xorg driver configuration |
418 | `xorg` | fbturbo Xorg driver configuration |
419
419
420 ## Custom packages and scripts
420 ## Custom packages and scripts
421 Debian custom packages, i.e. those not in the debian repositories, can be installed by placing them in the `packages` directory. They are installed immediately after packages from the repositories are installed. Any dependencies listed in the custom packages will be downloaded automatically from the repositories. Do not list these custom packages in `APT_INCLUDES`.
421 Debian custom packages, i.e. those not in the debian repositories, can be installed by placing them in the `packages` directory. They are installed immediately after packages from the repositories are installed. Any dependencies listed in the custom packages will be downloaded automatically from the repositories. Do not list these custom packages in `APT_INCLUDES`.
422
422
423 Scripts in the custom.d directory will be executed after all other installation is complete but before the image is created.
423 Scripts in the custom.d directory will be executed after all other installation is complete but before the image is created.
424
424
425 ## Logging of the bootstrapping process
425 ## Logging of the bootstrapping process
426 All information related to the bootstrapping process and the commands executed by the `rpi23-gen-image.sh` script can easily be saved into a logfile. The common shell command `script` can be used for this purpose:
426 All information related to the bootstrapping process and the commands executed by the `rpi23-gen-image.sh` script can easily be saved into a logfile. The common shell command `script` can be used for this purpose:
427
427
428 ```shell
428 ```shell
429 script -c 'APT_SERVER=ftp.de.debian.org ./rpi23-gen-image.sh' ./build.log
429 script -c 'APT_SERVER=ftp.de.debian.org ./rpi23-gen-image.sh' ./build.log
430 ```
430 ```
431
431
432 ## Flashing the image file
432 ## Flashing the image file
433 After the image file was successfully created by the `rpi23-gen-image.sh` script it can be copied to the microSD card that will be used by the RPi2/3 computer. This can be performed by using the tools `bmaptool` or `dd`. Using `bmaptool` will probably speed-up the copy process because `bmaptool` copies more wisely than `dd`.
433 After the image file was successfully created by the `rpi23-gen-image.sh` script it can be copied to the microSD card that will be used by the RPi2/3 computer. This can be performed by using the tools `bmaptool` or `dd`. Using `bmaptool` will probably speed-up the copy process because `bmaptool` copies more wisely than `dd`.
434
434
435 ##### Flashing examples:
435 ##### Flashing examples:
436 ```shell
436 ```shell
437 bmaptool copy ./images/jessie/2017-01-23-rpi3-jessie.img /dev/mmcblk0
437 bmaptool copy ./images/jessie/2017-01-23-rpi3-jessie.img /dev/mmcblk0
438 dd bs=4M if=./images/jessie/2017-01-23-rpi3-jessie.img of=/dev/mmcblk0
438 dd bs=4M if=./images/jessie/2017-01-23-rpi3-jessie.img of=/dev/mmcblk0
439 ```
439 ```
440 If you have set `ENABLE_SPLITFS`, copy the `-frmw` image on the microSD card, then the `-root` one on the USB drive:
440 If you have set `ENABLE_SPLITFS`, copy the `-frmw` image on the microSD card, then the `-root` one on the USB drive:
441 ```shell
441 ```shell
442 bmaptool copy ./images/jessie/2017-01-23-rpi3-jessie-frmw.img /dev/mmcblk0
442 bmaptool copy ./images/jessie/2017-01-23-rpi3-jessie-frmw.img /dev/mmcblk0
443 bmaptool copy ./images/jessie/2017-01-23-rpi3-jessie-root.img /dev/sdc
443 bmaptool copy ./images/jessie/2017-01-23-rpi3-jessie-root.img /dev/sdc
444 ```
444 ```
445 ## Weekly image builds
445 ## Weekly image builds
446 The image files are provided by JRWR'S I/O PORT and are built once a Sunday at midnight UTC!
446 The image files are provided by JRWR'S I/O PORT and are built once a Sunday at midnight UTC!
447 * [Debian Stretch Raspberry Pi2/3 Weekly Image Builds](https://jrwr.io/doku.php?id=projects:debianpi)
447 * [Debian Stretch Raspberry Pi2/3 Weekly Image Builds](https://jrwr.io/doku.php?id=projects:debianpi)
448
448
449 ## External links and references
449 ## External links and references
450 * [Debian worldwide mirror sites](https://www.debian.org/mirror/list)
450 * [Debian worldwide mirror sites](https://www.debian.org/mirror/list)
451 * [Debian Raspberry Pi 2 Wiki](https://wiki.debian.org/RaspberryPi2)
451 * [Debian Raspberry Pi 2 Wiki](https://wiki.debian.org/RaspberryPi2)
452 * [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains)
452 * [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains)
453 * [Official Raspberry Pi Firmware on github](https://github.com/raspberrypi/firmware)
453 * [Official Raspberry Pi Firmware on github](https://github.com/raspberrypi/firmware)
454 * [Official Raspberry Pi Kernel on github](https://github.com/raspberrypi/linux)
454 * [Official Raspberry Pi Kernel on github](https://github.com/raspberrypi/linux)
455 * [U-BOOT git repository](http://git.denx.de/?p=u-boot.git;a=summary)
455 * [U-BOOT git repository](http://git.denx.de/?p=u-boot.git;a=summary)
456 * [Xorg DDX driver fbturbo](https://github.com/ssvb/xf86-video-fbturbo)
456 * [Xorg DDX driver fbturbo](https://github.com/ssvb/xf86-video-fbturbo)
457 * [RPi3 Wireless interface firmware](https://github.com/RPi-Distro/firmware-nonfree/tree/master/brcm80211/brcm)
457 * [RPi3 Wireless interface firmware](https://github.com/RPi-Distro/firmware-nonfree/tree/master/brcm80211/brcm)
458 * [Collabora RPi2 Kernel precompiled](https://repositories.collabora.co.uk/debian/)
458 * [Collabora RPi2 Kernel precompiled](https://repositories.collabora.co.uk/debian/)
@@ -1,107 +1,134
1 #
1 #
2 # Setup Networking
2 # Setup Networking
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 # Install and setup hostname
8 # Install and setup hostname
9 install_readonly files/network/hostname "${ETC_DIR}/hostname"
9 install_readonly files/network/hostname "${ETC_DIR}/hostname"
10 sed -i "s/^rpi2-jessie/${HOSTNAME}/" "${ETC_DIR}/hostname"
10 sed -i "s/^rpi2-jessie/${HOSTNAME}/" "${ETC_DIR}/hostname"
11
11
12 # Install and setup hosts
12 # Install and setup hosts
13 install_readonly files/network/hosts "${ETC_DIR}/hosts"
13 install_readonly files/network/hosts "${ETC_DIR}/hosts"
14 sed -i "s/rpi2-jessie/${HOSTNAME}/" "${ETC_DIR}/hosts"
14 sed -i "s/rpi2-jessie/${HOSTNAME}/" "${ETC_DIR}/hosts"
15
15
16 # Setup hostname entry with static IP
16 # Setup hostname entry with static IP
17 if [ "$NET_ADDRESS" != "" ] ; then
17 if [ "$NET_ADDRESS" != "" ] ; then
18 NET_IP=$(echo "${NET_ADDRESS}" | cut -f 1 -d'/')
18 NET_IP=$(echo "${NET_ADDRESS}" | cut -f 1 -d'/')
19 sed -i "s/^127.0.1.1/${NET_IP}/" "${ETC_DIR}/hosts"
19 sed -i "s/^127.0.1.1/${NET_IP}/" "${ETC_DIR}/hosts"
20 fi
20 fi
21
21
22 # Remove IPv6 hosts
22 # Remove IPv6 hosts
23 if [ "$ENABLE_IPV6" = false ] ; then
23 if [ "$ENABLE_IPV6" = false ] ; then
24 sed -i -e "/::[1-9]/d" -e "/^$/d" "${ETC_DIR}/hosts"
24 sed -i -e "/::[1-9]/d" -e "/^$/d" "${ETC_DIR}/hosts"
25 fi
25 fi
26
26
27 # Install hint about network configuration
27 # Install hint about network configuration
28 install_readonly files/network/interfaces "${ETC_DIR}/network/interfaces"
28 install_readonly files/network/interfaces "${ETC_DIR}/network/interfaces"
29
29
30 # Install configuration for interface eth0
30 # Install configuration for interface eth0
31 install_readonly files/network/eth.network "${ETC_DIR}/systemd/network/eth.network"
31 install_readonly files/network/eth.network "${ETC_DIR}/systemd/network/eth.network"
32
32
33 # Install configuration for interface wl*
34 install_readonly files/network/wlan.network "${ETC_DIR}/systemd/network/wlan.network"
35
36 #always with dhcp since wpa_supplicant integration is missing
37 sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/wlan.network"
38
33 if [ "$ENABLE_DHCP" = true ] ; then
39 if [ "$ENABLE_DHCP" = true ] ; then
34 # Enable DHCP configuration for interface eth0
40 # Enable DHCP configuration for interface eth0
35 sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/eth.network"
41 sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/eth.network"
36
42
37 # Set DHCP configuration to IPv4 only
43 # Set DHCP configuration to IPv4 only
38 if [ "$ENABLE_IPV6" = false ] ; then
44 if [ "$ENABLE_IPV6" = false ] ; then
39 sed -i "s/DHCP=.*/DHCP=v4/" "${ETC_DIR}/systemd/network/eth.network"
45 sed -i "s/DHCP=.*/DHCP=v4/" "${ETC_DIR}/systemd/network/eth.network"
40 fi
46 fi
41
47
42 else # ENABLE_DHCP=false
48 else # ENABLE_DHCP=false
43 # Set static network configuration for interface eth0
49 # Set static network configuration for interface eth0
44 sed -i\
50 sed -i\
45 -e "s|DHCP=.*|DHCP=no|"\
51 -e "s|DHCP=.*|DHCP=no|"\
46 -e "s|Address=\$|Address=${NET_ADDRESS}|"\
52 -e "s|Address=\$|Address=${NET_ADDRESS}|"\
47 -e "s|Gateway=\$|Gateway=${NET_GATEWAY}|"\
53 -e "s|Gateway=\$|Gateway=${NET_GATEWAY}|"\
48 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_DNS_1}|"\
54 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_DNS_1}|"\
49 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_DNS_2}|"\
55 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_DNS_2}|"\
50 -e "s|Domains=\$|Domains=${NET_DNS_DOMAINS}|"\
56 -e "s|Domains=\$|Domains=${NET_DNS_DOMAINS}|"\
51 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_NTP_1}|"\
57 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_NTP_1}|"\
52 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_NTP_2}|"\
58 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_NTP_2}|"\
53 "${ETC_DIR}/systemd/network/eth.network"
59 "${ETC_DIR}/systemd/network/eth.network"
54 fi
60 fi
55
61
56 # Remove empty settings from network configuration
62 # Remove empty settings from network configuration
57 sed -i "/.*=\$/d" "${ETC_DIR}/systemd/network/eth.network"
63 sed -i "/.*=\$/d" "${ETC_DIR}/systemd/network/eth.network"
64 # Remove empty settings from wlan configuration
65 sed -i "/.*=\$/d" "${ETC_DIR}/systemd/network/wlan.network"
58
66
59 # Move systemd network configuration if required by Debian release
67 # Move systemd network configuration if required by Debian release
60 if [ "$RELEASE" = "stretch" ] || [ "$RELEASE" = "buster" ] ; then
68 if [ "$RELEASE" = "stretch" ] || [ "$RELEASE" = "buster" ] ; then
61 mv -v "${ETC_DIR}/systemd/network/eth.network" "${LIB_DIR}/systemd/network/10-eth.network"
69 mv -v "${ETC_DIR}/systemd/network/eth.network" "${LIB_DIR}/systemd/network/10-eth.network"
70 if [ "$ENABLE_WIRELESS" = true ] ; then
71 mv -v "${ETC_DIR}/systemd/network/wlan.network" "${LIB_DIR}/systemd/network/11-wlan.network"
72 fi
62 rm -fr "${ETC_DIR}/systemd/network"
73 rm -fr "${ETC_DIR}/systemd/network"
63 fi
74 fi
64
75
65 # Enable systemd-networkd service
76 # Enable systemd-networkd service
66 chroot_exec systemctl enable systemd-networkd
77 chroot_exec systemctl enable systemd-networkd
67
78
68 # Install host.conf resolver configuration
79 # Install host.conf resolver configuration
69 install_readonly files/network/host.conf "${ETC_DIR}/host.conf"
80 install_readonly files/network/host.conf "${ETC_DIR}/host.conf"
70
81
71 # Enable network stack hardening
82 # Enable network stack hardening
72 if [ "$ENABLE_HARDNET" = true ] ; then
83 if [ "$ENABLE_HARDNET" = true ] ; then
73 # Install sysctl.d configuration files
84 # Install sysctl.d configuration files
74 install_readonly files/sysctl.d/82-rpi-net-hardening.conf "${ETC_DIR}/sysctl.d/82-rpi-net-hardening.conf"
85 install_readonly files/sysctl.d/82-rpi-net-hardening.conf "${ETC_DIR}/sysctl.d/82-rpi-net-hardening.conf"
75
86
76 # Setup resolver warnings about spoofed addresses
87 # Setup resolver warnings about spoofed addresses
77 sed -i "s/^# spoof warn/spoof warn/" "${ETC_DIR}/host.conf"
88 sed -i "s/^# spoof warn/spoof warn/" "${ETC_DIR}/host.conf"
78 fi
89 fi
79
90
80 # Enable time sync
91 # Enable time sync
81 if [ "NET_NTP_1" != "" ] ; then
92 if [ "NET_NTP_1" != "" ] ; then
82 chroot_exec systemctl enable systemd-timesyncd.service
93 chroot_exec systemctl enable systemd-timesyncd.service
83 fi
94 fi
84
95
85 # Download the firmware binary blob required to use the RPi3 wireless interface
96 # Download the firmware binary blob required to use the RPi3 wireless interface
86 if [ "$ENABLE_WIRELESS" = true ] ; then
97 if [ "$ENABLE_WIRELESS" = true ] ; then
87 if [ ! -d ${WLAN_FIRMWARE_DIR} ] ; then
98 if [ ! -d ${WLAN_FIRMWARE_DIR} ] ; then
88 mkdir -p ${WLAN_FIRMWARE_DIR}
99 mkdir -p ${WLAN_FIRMWARE_DIR}
89 fi
100 fi
90
101
91 # Create temporary directory for firmware binary blob
102 # Create temporary directory for firmware binary blob
92 temp_dir=$(as_nobody mktemp -d)
103 temp_dir=$(as_nobody mktemp -d)
93
104
94 # Fetch firmware binary blob
105 # Fetch firmware binary blob for RPI3B+
106 if [ "$RPI_MODEL" = 3B ] ; then
107 as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.bin" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.bin"
108 as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.txt" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.txt"
109 as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.clm_blob" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.clm_blob"
110 else
111 # Fetch firmware binary blob for RPI3
95 as_nobody wget -q -O "${temp_dir}/brcmfmac43430-sdio.bin" "${WLAN_FIRMWARE_URL}/brcmfmac43430-sdio.bin"
112 as_nobody wget -q -O "${temp_dir}/brcmfmac43430-sdio.bin" "${WLAN_FIRMWARE_URL}/brcmfmac43430-sdio.bin"
96 as_nobody wget -q -O "${temp_dir}/brcmfmac43430-sdio.txt" "${WLAN_FIRMWARE_URL}/brcmfmac43430-sdio.txt"
113 as_nobody wget -q -O "${temp_dir}/brcmfmac43430-sdio.txt" "${WLAN_FIRMWARE_URL}/brcmfmac43430-sdio.txt"
97
114 fi
115
98 # Move downloaded firmware binary blob
116 # Move downloaded firmware binary blob
117 if [ "$RPI_MODEL" = 3B ] ; then
118 mv "${temp_dir}/brcmfmac43455-sdio."* "${WLAN_FIRMWARE_DIR}/"
119 else
99 mv "${temp_dir}/brcmfmac43430-sdio."* "${WLAN_FIRMWARE_DIR}/"
120 mv "${temp_dir}/brcmfmac43430-sdio."* "${WLAN_FIRMWARE_DIR}/"
100
121 fi
122
101 # Remove temporary directory for firmware binary blob
123 # Remove temporary directory for firmware binary blob
102 rm -fr "${temp_dir}"
124 rm -fr "${temp_dir}"
103
125
104 # Set permissions of the firmware binary blob
126 # Set permissions of the firmware binary blob
127 if [ "$RPI_MODEL" = 3B ] ; then
128 chown root:root "${WLAN_FIRMWARE_DIR}/brcmfmac43455-sdio."*
129 chmod 600 "${WLAN_FIRMWARE_DIR}/brcmfmac43455-sdio."*
130 else
105 chown root:root "${WLAN_FIRMWARE_DIR}/brcmfmac43430-sdio."*
131 chown root:root "${WLAN_FIRMWARE_DIR}/brcmfmac43430-sdio."*
106 chmod 600 "${WLAN_FIRMWARE_DIR}/brcmfmac43430-sdio."*
132 chmod 600 "${WLAN_FIRMWARE_DIR}/brcmfmac43430-sdio."*
133 fi
107 fi
134 fi
@@ -1,665 +1,663
1 #!/bin/sh
1 #!/bin/sh
2
2
3 ########################################################################
3 ########################################################################
4 # rpi23-gen-image.sh 2015-2017
4 # rpi23-gen-image.sh 2015-2017
5 #
5 #
6 # Advanced Debian "jessie", "stretch" and "buster" bootstrap script for RPi2/3
6 # Advanced Debian "jessie", "stretch" and "buster" bootstrap script for RPi2/3
7 #
7 #
8 # This program is free software; you can redistribute it and/or
8 # This program is free software; you can redistribute it and/or
9 # modify it under the terms of the GNU General Public License
9 # modify it under the terms of the GNU General Public License
10 # as published by the Free Software Foundation; either version 2
10 # as published by the Free Software Foundation; either version 2
11 # of the License, or (at your option) any later version.
11 # of the License, or (at your option) any later version.
12 #
12 #
13 # Copyright (C) 2015 Jan Wagner <mail@jwagner.eu>
13 # Copyright (C) 2015 Jan Wagner <mail@jwagner.eu>
14 #
14 #
15 # Big thanks for patches and enhancements by 20+ github contributors!
15 # Big thanks for patches and enhancements by 20+ github contributors!
16 ########################################################################
16 ########################################################################
17
17
18 # Are we running as root?
18 # Are we running as root?
19 if [ "$(id -u)" -ne "0" ] ; then
19 if [ "$(id -u)" -ne "0" ] ; then
20 echo "error: this script must be executed with root privileges!"
20 echo "error: this script must be executed with root privileges!"
21 exit 1
21 exit 1
22 fi
22 fi
23
23
24 # Check if ./functions.sh script exists
24 # Check if ./functions.sh script exists
25 if [ ! -r "./functions.sh" ] ; then
25 if [ ! -r "./functions.sh" ] ; then
26 echo "error: './functions.sh' required script not found!"
26 echo "error: './functions.sh' required script not found!"
27 exit 1
27 exit 1
28 fi
28 fi
29
29
30 # Load utility functions
30 # Load utility functions
31 . ./functions.sh
31 . ./functions.sh
32
32
33 # Load parameters from configuration template file
33 # Load parameters from configuration template file
34 if [ ! -z "$CONFIG_TEMPLATE" ] ; then
34 if [ ! -z "$CONFIG_TEMPLATE" ] ; then
35 use_template
35 use_template
36 fi
36 fi
37
37
38 # Introduce settings
38 # Introduce settings
39 set -e
39 set -e
40 echo -n -e "\n#\n# RPi2/3 Bootstrap Settings\n#\n"
40 echo -n -e "\n#\n# RPi2/3 Bootstrap Settings\n#\n"
41 set -x
41 set -x
42
42
43 # Raspberry Pi model configuration
43 # Raspberry Pi model configuration
44 RPI_MODEL=${RPI_MODEL:=2}
44 RPI_MODEL=${RPI_MODEL:=2}
45 RPI2_DTB_FILE=${RPI2_DTB_FILE:=bcm2709-rpi-2-b.dtb}
45 RPI2_DTB_FILE=${RPI2_DTB_FILE:=bcm2709-rpi-2-b.dtb}
46 RPI2_UBOOT_CONFIG=${RPI2_UBOOT_CONFIG:=rpi_2_defconfig}
46 RPI2_UBOOT_CONFIG=${RPI2_UBOOT_CONFIG:=rpi_2_defconfig}
47 RPI3_DTB_FILE=${RPI3_DTB_FILE:=bcm2710-rpi-3-b.dtb}
47 RPI3_DTB_FILE=${RPI3_DTB_FILE:=bcm2710-rpi-3-b.dtb}
48 RPI3_UBOOT_CONFIG=${RPI3_UBOOT_CONFIG:=rpi_3_32b_defconfig}
48 RPI3_UBOOT_CONFIG=${RPI3_UBOOT_CONFIG:=rpi_3_32b_defconfig}
49 RPI3B_DTB_FILE=${RPI3B_DTB_FILE:=bcm2710-rpi-3-b-plus.dtb}
50 RPI3B_UBOOT_CONFIG=${RPI3_UBOOT_CONFIG:=rpi_3_32b_defconfig}
49
51
50 # Debian release
52 # Debian release
51 RELEASE=${RELEASE:=jessie}
53 RELEASE=${RELEASE:=jessie}
52 KERNEL_ARCH=${KERNEL_ARCH:=arm}
54 KERNEL_ARCH=${KERNEL_ARCH:=arm}
53 RELEASE_ARCH=${RELEASE_ARCH:=armhf}
55 RELEASE_ARCH=${RELEASE_ARCH:=armhf}
54 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabihf-}
56 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabihf-}
55 COLLABORA_KERNEL=${COLLABORA_KERNEL:=3.18.0-trunk-rpi2}
57 COLLABORA_KERNEL=${COLLABORA_KERNEL:=3.18.0-trunk-rpi2}
56 if [ "$KERNEL_ARCH" = "arm64" ] ; then
58 if [ "$KERNEL_ARCH" = "arm64" ] ; then
57 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi3_defconfig}
59 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi3_defconfig}
58 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel8.img}
60 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel8.img}
59 else
61 else
60 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2709_defconfig}
62 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2709_defconfig}
61 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel7.img}
63 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel7.img}
62 fi
64 fi
63 if [ "$RELEASE_ARCH" = "arm64" ] ; then
65 if [ "$RELEASE_ARCH" = "arm64" ] ; then
64 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-aarch64-static}
66 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-aarch64-static}
65 else
67 else
66 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-arm-static}
68 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-arm-static}
67 fi
69 fi
68 KERNEL_BRANCH=${KERNEL_BRANCH:=""}
70 KERNEL_BRANCH=${KERNEL_BRANCH:=""}
69
71
70 # URLs
72 # URLs
71 KERNEL_URL=${KERNEL_URL:=https://github.com/raspberrypi/linux}
73 KERNEL_URL=${KERNEL_URL:=https://github.com/raspberrypi/linux}
72 FIRMWARE_URL=${FIRMWARE_URL:=https://github.com/raspberrypi/firmware/raw/master/boot}
74 FIRMWARE_URL=${FIRMWARE_URL:=https://github.com/raspberrypi/firmware/raw/master/boot}
73 WLAN_FIRMWARE_URL=${WLAN_FIRMWARE_URL:=https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm}
75 WLAN_FIRMWARE_URL=${WLAN_FIRMWARE_URL:=https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm}
74 COLLABORA_URL=${COLLABORA_URL:=https://repositories.collabora.co.uk/debian}
76 COLLABORA_URL=${COLLABORA_URL:=https://repositories.collabora.co.uk/debian}
75 FBTURBO_URL=${FBTURBO_URL:=https://github.com/ssvb/xf86-video-fbturbo.git}
77 FBTURBO_URL=${FBTURBO_URL:=https://github.com/ssvb/xf86-video-fbturbo.git}
76 UBOOT_URL=${UBOOT_URL:=git://git.denx.de/u-boot.git}
78 UBOOT_URL=${UBOOT_URL:=git://git.denx.de/u-boot.git}
77
79
78 # Build directories
80 # Build directories
79 BASEDIR=${BASEDIR:=$(pwd)/images/${RELEASE}}
81 BASEDIR=${BASEDIR:=$(pwd)/images/${RELEASE}}
80 BUILDDIR="${BASEDIR}/build"
82 BUILDDIR="${BASEDIR}/build"
81
83
82 # Prepare date string for default image file name
84 # Prepare date string for default image file name
83 DATE="$(date +%Y-%m-%d)"
85 DATE="$(date +%Y-%m-%d)"
84 if [ -z "$KERNEL_BRANCH" ] ; then
86 if [ -z "$KERNEL_BRANCH" ] ; then
85 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
87 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
86 else
88 else
87 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
89 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
88 fi
90 fi
89
91
90 # Chroot directories
92 # Chroot directories
91 R="${BUILDDIR}/chroot"
93 R="${BUILDDIR}/chroot"
92 ETC_DIR="${R}/etc"
94 ETC_DIR="${R}/etc"
93 LIB_DIR="${R}/lib"
95 LIB_DIR="${R}/lib"
94 BOOT_DIR="${R}/boot/firmware"
96 BOOT_DIR="${R}/boot/firmware"
95 KERNEL_DIR="${R}/usr/src/linux"
97 KERNEL_DIR="${R}/usr/src/linux"
96 WLAN_FIRMWARE_DIR="${R}/lib/firmware/brcm"
98 WLAN_FIRMWARE_DIR="${R}/lib/firmware/brcm"
97
99
98 # Firmware directory: Blank if download from github
100 # Firmware directory: Blank if download from github
99 RPI_FIRMWARE_DIR=${RPI_FIRMWARE_DIR:=""}
101 RPI_FIRMWARE_DIR=${RPI_FIRMWARE_DIR:=""}
100
102
101 # General settings
103 # General settings
102 HOSTNAME=${HOSTNAME:=rpi${RPI_MODEL}-${RELEASE}}
104 HOSTNAME=${HOSTNAME:=rpi${RPI_MODEL}-${RELEASE}}
103 PASSWORD=${PASSWORD:=raspberry}
105 PASSWORD=${PASSWORD:=raspberry}
104 USER_PASSWORD=${USER_PASSWORD:=raspberry}
106 USER_PASSWORD=${USER_PASSWORD:=raspberry}
105 DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}
107 DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}
106 TIMEZONE=${TIMEZONE:="Europe/Berlin"}
108 TIMEZONE=${TIMEZONE:="Europe/Berlin"}
107 EXPANDROOT=${EXPANDROOT:=true}
109 EXPANDROOT=${EXPANDROOT:=true}
108
110
109 # Keyboard settings
111 # Keyboard settings
110 XKB_MODEL=${XKB_MODEL:=""}
112 XKB_MODEL=${XKB_MODEL:=""}
111 XKB_LAYOUT=${XKB_LAYOUT:=""}
113 XKB_LAYOUT=${XKB_LAYOUT:=""}
112 XKB_VARIANT=${XKB_VARIANT:=""}
114 XKB_VARIANT=${XKB_VARIANT:=""}
113 XKB_OPTIONS=${XKB_OPTIONS:=""}
115 XKB_OPTIONS=${XKB_OPTIONS:=""}
114
116
115 # Network settings (DHCP)
117 # Network settings (DHCP)
116 ENABLE_DHCP=${ENABLE_DHCP:=true}
118 ENABLE_DHCP=${ENABLE_DHCP:=true}
117
119
118 # Network settings (static)
120 # Network settings (static)
119 NET_ADDRESS=${NET_ADDRESS:=""}
121 NET_ADDRESS=${NET_ADDRESS:=""}
120 NET_GATEWAY=${NET_GATEWAY:=""}
122 NET_GATEWAY=${NET_GATEWAY:=""}
121 NET_DNS_1=${NET_DNS_1:=""}
123 NET_DNS_1=${NET_DNS_1:=""}
122 NET_DNS_2=${NET_DNS_2:=""}
124 NET_DNS_2=${NET_DNS_2:=""}
123 NET_DNS_DOMAINS=${NET_DNS_DOMAINS:=""}
125 NET_DNS_DOMAINS=${NET_DNS_DOMAINS:=""}
124 NET_NTP_1=${NET_NTP_1:=""}
126 NET_NTP_1=${NET_NTP_1:=""}
125 NET_NTP_2=${NET_NTP_2:=""}
127 NET_NTP_2=${NET_NTP_2:=""}
126
128
127 # APT settings
129 # APT settings
128 APT_PROXY=${APT_PROXY:=""}
130 APT_PROXY=${APT_PROXY:=""}
129 APT_SERVER=${APT_SERVER:="ftp.debian.org"}
131 APT_SERVER=${APT_SERVER:="ftp.debian.org"}
130
132
131 # Feature settings
133 # Feature settings
132 ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}
134 ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}
133 ENABLE_I2C=${ENABLE_I2C:=false}
135 ENABLE_I2C=${ENABLE_I2C:=false}
134 ENABLE_SPI=${ENABLE_SPI:=false}
136 ENABLE_SPI=${ENABLE_SPI:=false}
135 ENABLE_IPV6=${ENABLE_IPV6:=true}
137 ENABLE_IPV6=${ENABLE_IPV6:=true}
136 ENABLE_SSHD=${ENABLE_SSHD:=true}
138 ENABLE_SSHD=${ENABLE_SSHD:=true}
137 ENABLE_NONFREE=${ENABLE_NONFREE:=false}
139 ENABLE_NONFREE=${ENABLE_NONFREE:=false}
138 ENABLE_WIRELESS=${ENABLE_WIRELESS:=false}
140 ENABLE_WIRELESS=${ENABLE_WIRELESS:=false}
139 ENABLE_SOUND=${ENABLE_SOUND:=true}
141 ENABLE_SOUND=${ENABLE_SOUND:=true}
140 ENABLE_DBUS=${ENABLE_DBUS:=true}
142 ENABLE_DBUS=${ENABLE_DBUS:=true}
141 ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}
143 ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}
142 ENABLE_MINGPU=${ENABLE_MINGPU:=false}
144 ENABLE_MINGPU=${ENABLE_MINGPU:=false}
143 ENABLE_XORG=${ENABLE_XORG:=false}
145 ENABLE_XORG=${ENABLE_XORG:=false}
144 ENABLE_WM=${ENABLE_WM:=""}
146 ENABLE_WM=${ENABLE_WM:=""}
145 ENABLE_RSYSLOG=${ENABLE_RSYSLOG:=true}
147 ENABLE_RSYSLOG=${ENABLE_RSYSLOG:=true}
146 ENABLE_USER=${ENABLE_USER:=true}
148 ENABLE_USER=${ENABLE_USER:=true}
147 USER_NAME=${USER_NAME:="pi"}
149 USER_NAME=${USER_NAME:="pi"}
148 ENABLE_ROOT=${ENABLE_ROOT:=false}
150 ENABLE_ROOT=${ENABLE_ROOT:=false}
149
151
150 # SSH settings
152 # SSH settings
151 SSH_ENABLE_ROOT=${SSH_ENABLE_ROOT:=false}
153 SSH_ENABLE_ROOT=${SSH_ENABLE_ROOT:=false}
152 SSH_DISABLE_PASSWORD_AUTH=${SSH_DISABLE_PASSWORD_AUTH:=false}
154 SSH_DISABLE_PASSWORD_AUTH=${SSH_DISABLE_PASSWORD_AUTH:=false}
153 SSH_LIMIT_USERS=${SSH_LIMIT_USERS:=false}
155 SSH_LIMIT_USERS=${SSH_LIMIT_USERS:=false}
154 SSH_ROOT_PUB_KEY=${SSH_ROOT_PUB_KEY:=""}
156 SSH_ROOT_PUB_KEY=${SSH_ROOT_PUB_KEY:=""}
155 SSH_USER_PUB_KEY=${SSH_USER_PUB_KEY:=""}
157 SSH_USER_PUB_KEY=${SSH_USER_PUB_KEY:=""}
156
158
157 # Advanced settings
159 # Advanced settings
158 ENABLE_MINBASE=${ENABLE_MINBASE:=false}
160 ENABLE_MINBASE=${ENABLE_MINBASE:=false}
159 ENABLE_REDUCE=${ENABLE_REDUCE:=false}
161 ENABLE_REDUCE=${ENABLE_REDUCE:=false}
160 ENABLE_UBOOT=${ENABLE_UBOOT:=false}
162 ENABLE_UBOOT=${ENABLE_UBOOT:=false}
161 UBOOTSRC_DIR=${UBOOTSRC_DIR:=""}
163 UBOOTSRC_DIR=${UBOOTSRC_DIR:=""}
162 ENABLE_FBTURBO=${ENABLE_FBTURBO:=false}
164 ENABLE_FBTURBO=${ENABLE_FBTURBO:=false}
163 FBTURBOSRC_DIR=${FBTURBOSRC_DIR:=""}
165 FBTURBOSRC_DIR=${FBTURBOSRC_DIR:=""}
164 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
166 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
165 ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
167 ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
166 ENABLE_SPLITFS=${ENABLE_SPLITFS:=false}
168 ENABLE_SPLITFS=${ENABLE_SPLITFS:=false}
167 ENABLE_INITRAMFS=${ENABLE_INITRAMFS:=false}
169 ENABLE_INITRAMFS=${ENABLE_INITRAMFS:=false}
168 ENABLE_IFNAMES=${ENABLE_IFNAMES:=true}
170 ENABLE_IFNAMES=${ENABLE_IFNAMES:=true}
169 DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS:=}
171 DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS:=}
170
172
171 # Kernel compilation settings
173 # Kernel compilation settings
172 BUILD_KERNEL=${BUILD_KERNEL:=false}
174 BUILD_KERNEL=${BUILD_KERNEL:=false}
173 KERNEL_REDUCE=${KERNEL_REDUCE:=false}
175 KERNEL_REDUCE=${KERNEL_REDUCE:=false}
174 KERNEL_THREADS=${KERNEL_THREADS:=1}
176 KERNEL_THREADS=${KERNEL_THREADS:=1}
175 KERNEL_HEADERS=${KERNEL_HEADERS:=true}
177 KERNEL_HEADERS=${KERNEL_HEADERS:=true}
176 KERNEL_MENUCONFIG=${KERNEL_MENUCONFIG:=false}
178 KERNEL_MENUCONFIG=${KERNEL_MENUCONFIG:=false}
177 KERNEL_REMOVESRC=${KERNEL_REMOVESRC:=true}
179 KERNEL_REMOVESRC=${KERNEL_REMOVESRC:=true}
178 KERNEL_OLDDEFCONFIG=${KERNEL_OLDDEFCONFIG:=false}
180 KERNEL_OLDDEFCONFIG=${KERNEL_OLDDEFCONFIG:=false}
179 KERNEL_CCACHE=${KERNEL_CCACHE:=false}
181 KERNEL_CCACHE=${KERNEL_CCACHE:=false}
180
182
181 if [ "$KERNEL_ARCH" = "arm64" ] ; then
183 if [ "$KERNEL_ARCH" = "arm64" ] ; then
182 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="Image"}
184 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="Image"}
183 else
185 else
184 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="zImage"}
186 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="zImage"}
185 fi
187 fi
186
188
187 # Kernel compilation from source directory settings
189 # Kernel compilation from source directory settings
188 KERNELSRC_DIR=${KERNELSRC_DIR:=""}
190 KERNELSRC_DIR=${KERNELSRC_DIR:=""}
189 KERNELSRC_CLEAN=${KERNELSRC_CLEAN:=false}
191 KERNELSRC_CLEAN=${KERNELSRC_CLEAN:=false}
190 KERNELSRC_CONFIG=${KERNELSRC_CONFIG:=true}
192 KERNELSRC_CONFIG=${KERNELSRC_CONFIG:=true}
191 KERNELSRC_PREBUILT=${KERNELSRC_PREBUILT:=false}
193 KERNELSRC_PREBUILT=${KERNELSRC_PREBUILT:=false}
192
194
193 # Reduce disk usage settings
195 # Reduce disk usage settings
194 REDUCE_APT=${REDUCE_APT:=true}
196 REDUCE_APT=${REDUCE_APT:=true}
195 REDUCE_DOC=${REDUCE_DOC:=true}
197 REDUCE_DOC=${REDUCE_DOC:=true}
196 REDUCE_MAN=${REDUCE_MAN:=true}
198 REDUCE_MAN=${REDUCE_MAN:=true}
197 REDUCE_VIM=${REDUCE_VIM:=false}
199 REDUCE_VIM=${REDUCE_VIM:=false}
198 REDUCE_BASH=${REDUCE_BASH:=false}
200 REDUCE_BASH=${REDUCE_BASH:=false}
199 REDUCE_HWDB=${REDUCE_HWDB:=true}
201 REDUCE_HWDB=${REDUCE_HWDB:=true}
200 REDUCE_SSHD=${REDUCE_SSHD:=true}
202 REDUCE_SSHD=${REDUCE_SSHD:=true}
201 REDUCE_LOCALE=${REDUCE_LOCALE:=true}
203 REDUCE_LOCALE=${REDUCE_LOCALE:=true}
202
204
203 # Encrypted filesystem settings
205 # Encrypted filesystem settings
204 ENABLE_CRYPTFS=${ENABLE_CRYPTFS:=false}
206 ENABLE_CRYPTFS=${ENABLE_CRYPTFS:=false}
205 CRYPTFS_PASSWORD=${CRYPTFS_PASSWORD:=""}
207 CRYPTFS_PASSWORD=${CRYPTFS_PASSWORD:=""}
206 CRYPTFS_MAPPING=${CRYPTFS_MAPPING:="secure"}
208 CRYPTFS_MAPPING=${CRYPTFS_MAPPING:="secure"}
207 CRYPTFS_CIPHER=${CRYPTFS_CIPHER:="aes-xts-plain64:sha512"}
209 CRYPTFS_CIPHER=${CRYPTFS_CIPHER:="aes-xts-plain64:sha512"}
208 CRYPTFS_XTSKEYSIZE=${CRYPTFS_XTSKEYSIZE:=512}
210 CRYPTFS_XTSKEYSIZE=${CRYPTFS_XTSKEYSIZE:=512}
209
211
210 # Stop the Crypto Wars
211 DISABLE_FBI=${DISABLE_FBI:=false}
212
213 # Chroot scripts directory
212 # Chroot scripts directory
214 CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""}
213 CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""}
215
214
216 # Packages required in the chroot build environment
215 # Packages required in the chroot build environment
217 APT_INCLUDES=${APT_INCLUDES:=""}
216 APT_INCLUDES=${APT_INCLUDES:=""}
218 APT_INCLUDES="${APT_INCLUDES},apt-transport-https,apt-utils,ca-certificates,debian-archive-keyring,dialog,sudo,systemd,sysvinit-utils"
217 APT_INCLUDES="${APT_INCLUDES},apt-transport-https,apt-utils,ca-certificates,debian-archive-keyring,dialog,sudo,systemd,sysvinit-utils"
219
218
220 # Packages required for bootstrapping
219 # Packages required for bootstrapping
221 REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo"
220 REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo"
222 MISSING_PACKAGES=""
221 MISSING_PACKAGES=""
223
222
224 # Packages installed for c/c++ build environment in chroot (keep empty)
223 # Packages installed for c/c++ build environment in chroot (keep empty)
225 COMPILER_PACKAGES=""
224 COMPILER_PACKAGES=""
226
225
227 set +x
226 set +x
228
227
229 # Set Raspberry Pi model specific configuration
228 # Set Raspberry Pi model specific configuration
230 if [ "$RPI_MODEL" = 2 ] ; then
229 if [ "$RPI_MODEL" = 2 ] ; then
231 DTB_FILE=${RPI2_DTB_FILE}
230 DTB_FILE=${RPI2_DTB_FILE}
232 UBOOT_CONFIG=${RPI2_UBOOT_CONFIG}
231 UBOOT_CONFIG=${RPI2_UBOOT_CONFIG}
233 elif [ "$RPI_MODEL" = 3 ] ; then
232 elif [ "$RPI_MODEL" = 3 ] ; then
234 DTB_FILE=${RPI3_DTB_FILE}
233 DTB_FILE=${RPI3_DTB_FILE}
235 UBOOT_CONFIG=${RPI3_UBOOT_CONFIG}
234 UBOOT_CONFIG=${RPI3_UBOOT_CONFIG}
236 BUILD_KERNEL=true
235 BUILD_KERNEL=true
236 elif [ "$RPI_MODEL" = 3B ] ; then
237 DTB_FILE=${RPI3B_DTB_FILE}
238 UBOOT_CONFIG=${RPI3B_UBOOT_CONFIG}
239 BUILD_KERNEL=true
237 else
240 else
238 echo "error: Raspberry Pi model ${RPI_MODEL} is not supported!"
241 echo "error: Raspberry Pi model ${RPI_MODEL} is not supported!"
239 exit 1
242 exit 1
240 fi
243 fi
241
244
242 # Check if the internal wireless interface is supported by the RPi model
245 # Check if the internal wireless interface is supported by the RPi model
243 if [ "$ENABLE_WIRELESS" = true ] && [ "$RPI_MODEL" != 3 ] ; then
246 if [ "$ENABLE_WIRELESS" = true ] && [ "$RPI_MODEL" = 2 ]; then
244 echo "error: The selected Raspberry Pi model has no internal wireless interface"
247 echo "error: The selected Raspberry Pi model has no internal wireless interface"
245 exit 1
248 exit 1
246 fi
249 fi
247
250
248 # Check if DISABLE_UNDERVOLT_WARNINGS parameter value is supported
251 # Check if DISABLE_UNDERVOLT_WARNINGS parameter value is supported
249 if [ ! -z "$DISABLE_UNDERVOLT_WARNINGS" ] ; then
252 if [ ! -z "$DISABLE_UNDERVOLT_WARNINGS" ] ; then
250 if [ "$DISABLE_UNDERVOLT_WARNINGS" != 1 ] && [ "$DISABLE_UNDERVOLT_WARNINGS" != 2 ] ; then
253 if [ "$DISABLE_UNDERVOLT_WARNINGS" != 1 ] && [ "$DISABLE_UNDERVOLT_WARNINGS" != 2 ] ; then
251 echo "error: DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS} is not supported"
254 echo "error: DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS} is not supported"
252 exit 1
255 exit 1
253 fi
256 fi
254 fi
257 fi
255
258
256 # Build RPi2/3 Linux kernel if required by Debian release
259 # Build RPi2/3 Linux kernel if required by Debian release
257 if [ "$RELEASE" = "stretch" ] || [ "$RELEASE" = "buster" ] ; then
260 if [ "$RELEASE" = "stretch" ] || [ "$RELEASE" = "buster" ] ; then
258 BUILD_KERNEL=true
261 BUILD_KERNEL=true
259 fi
262 fi
260
263
261 # Add packages required for kernel cross compilation
264 # Add packages required for kernel cross compilation
262 if [ "$BUILD_KERNEL" = true ] ; then
265 if [ "$BUILD_KERNEL" = true ] ; then
263 if [ "$KERNEL_ARCH" = "arm" ] ; then
266 if [ "$KERNEL_ARCH" = "arm" ] ; then
264 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armhf"
267 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armhf"
265 else
268 else
266 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-arm64"
269 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-arm64"
267 fi
270 fi
268 fi
271 fi
269
272
270 # Add libncurses5 to enable kernel menuconfig
273 # Add libncurses5 to enable kernel menuconfig
271 if [ "$KERNEL_MENUCONFIG" = true ] ; then
274 if [ "$KERNEL_MENUCONFIG" = true ] ; then
272 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libncurses5-dev"
275 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libncurses5-dev"
273 fi
276 fi
274
277
275 # Add ccache compiler cache for (faster) kernel cross (re)compilation
278 # Add ccache compiler cache for (faster) kernel cross (re)compilation
276 if [ "$KERNEL_CCACHE" = true ] ; then
279 if [ "$KERNEL_CCACHE" = true ] ; then
277 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} ccache"
280 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} ccache"
278 fi
281 fi
279
282
280 # Stop the Crypto Wars
281 if [ "$DISABLE_FBI" = true ] ; then
282 ENABLE_CRYPTFS=true
283 fi
284
285 # Add cryptsetup package to enable filesystem encryption
283 # Add cryptsetup package to enable filesystem encryption
286 if [ "$ENABLE_CRYPTFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
284 if [ "$ENABLE_CRYPTFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
287 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cryptsetup"
285 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cryptsetup"
288 APT_INCLUDES="${APT_INCLUDES},cryptsetup"
286 APT_INCLUDES="${APT_INCLUDES},cryptsetup,console-setup"
289
287
290 if [ -z "$CRYPTFS_PASSWORD" ] ; then
288 if [ -z "$CRYPTFS_PASSWORD" ] ; then
291 echo "error: no password defined (CRYPTFS_PASSWORD)!"
289 echo "error: no password defined (CRYPTFS_PASSWORD)!"
292 exit 1
290 exit 1
293 fi
291 fi
294 ENABLE_INITRAMFS=true
292 ENABLE_INITRAMFS=true
295 fi
293 fi
296
294
297 # Add initramfs generation tools
295 # Add initramfs generation tools
298 if [ "$ENABLE_INITRAMFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
296 if [ "$ENABLE_INITRAMFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
299 APT_INCLUDES="${APT_INCLUDES},initramfs-tools"
297 APT_INCLUDES="${APT_INCLUDES},initramfs-tools"
300 fi
298 fi
301
299
302 # Add device-tree-compiler required for building the U-Boot bootloader
300 # Add device-tree-compiler required for building the U-Boot bootloader
303 if [ "$ENABLE_UBOOT" = true ] ; then
301 if [ "$ENABLE_UBOOT" = true ] ; then
304 APT_INCLUDES="${APT_INCLUDES},device-tree-compiler"
302 APT_INCLUDES="${APT_INCLUDES},device-tree-compiler"
305 fi
303 fi
306
304
307 # Check if root SSH (v2) public key file exists
305 # Check if root SSH (v2) public key file exists
308 if [ ! -z "$SSH_ROOT_PUB_KEY" ] ; then
306 if [ ! -z "$SSH_ROOT_PUB_KEY" ] ; then
309 if [ ! -f "$SSH_ROOT_PUB_KEY" ] ; then
307 if [ ! -f "$SSH_ROOT_PUB_KEY" ] ; then
310 echo "error: '$SSH_ROOT_PUB_KEY' specified SSH public key file not found (SSH_ROOT_PUB_KEY)!"
308 echo "error: '$SSH_ROOT_PUB_KEY' specified SSH public key file not found (SSH_ROOT_PUB_KEY)!"
311 exit 1
309 exit 1
312 fi
310 fi
313 fi
311 fi
314
312
315 # Check if $USER_NAME SSH (v2) public key file exists
313 # Check if $USER_NAME SSH (v2) public key file exists
316 if [ ! -z "$SSH_USER_PUB_KEY" ] ; then
314 if [ ! -z "$SSH_USER_PUB_KEY" ] ; then
317 if [ ! -f "$SSH_USER_PUB_KEY" ] ; then
315 if [ ! -f "$SSH_USER_PUB_KEY" ] ; then
318 echo "error: '$SSH_USER_PUB_KEY' specified SSH public key file not found (SSH_USER_PUB_KEY)!"
316 echo "error: '$SSH_USER_PUB_KEY' specified SSH public key file not found (SSH_USER_PUB_KEY)!"
319 exit 1
317 exit 1
320 fi
318 fi
321 fi
319 fi
322
320
323 # Check if all required packages are installed on the build system
321 # Check if all required packages are installed on the build system
324 for package in $REQUIRED_PACKAGES ; do
322 for package in $REQUIRED_PACKAGES ; do
325 if [ "`dpkg-query -W -f='${Status}' $package`" != "install ok installed" ] ; then
323 if [ "`dpkg-query -W -f='${Status}' $package`" != "install ok installed" ] ; then
326 MISSING_PACKAGES="${MISSING_PACKAGES} $package"
324 MISSING_PACKAGES="${MISSING_PACKAGES} $package"
327 fi
325 fi
328 done
326 done
329
327
330 # If there are missing packages ask confirmation for install, or exit
328 # If there are missing packages ask confirmation for install, or exit
331 if [ -n "$MISSING_PACKAGES" ] ; then
329 if [ -n "$MISSING_PACKAGES" ] ; then
332 echo "the following packages needed by this script are not installed:"
330 echo "the following packages needed by this script are not installed:"
333 echo "$MISSING_PACKAGES"
331 echo "$MISSING_PACKAGES"
334
332
335 echo -n "\ndo you want to install the missing packages right now? [y/n] "
333 echo -n "\ndo you want to install the missing packages right now? [y/n] "
336 read confirm
334 read confirm
337 [ "$confirm" != "y" ] && exit 1
335 [ "$confirm" != "y" ] && exit 1
338
336
339 # Make sure all missing required packages are installed
337 # Make sure all missing required packages are installed
340 apt-get -qq -y install ${MISSING_PACKAGES}
338 apt-get -qq -y install ${MISSING_PACKAGES}
341 fi
339 fi
342
340
343 # Check if ./bootstrap.d directory exists
341 # Check if ./bootstrap.d directory exists
344 if [ ! -d "./bootstrap.d/" ] ; then
342 if [ ! -d "./bootstrap.d/" ] ; then
345 echo "error: './bootstrap.d' required directory not found!"
343 echo "error: './bootstrap.d' required directory not found!"
346 exit 1
344 exit 1
347 fi
345 fi
348
346
349 # Check if ./files directory exists
347 # Check if ./files directory exists
350 if [ ! -d "./files/" ] ; then
348 if [ ! -d "./files/" ] ; then
351 echo "error: './files' required directory not found!"
349 echo "error: './files' required directory not found!"
352 exit 1
350 exit 1
353 fi
351 fi
354
352
355 # Check if specified KERNELSRC_DIR directory exists
353 # Check if specified KERNELSRC_DIR directory exists
356 if [ -n "$KERNELSRC_DIR" ] && [ ! -d "$KERNELSRC_DIR" ] ; then
354 if [ -n "$KERNELSRC_DIR" ] && [ ! -d "$KERNELSRC_DIR" ] ; then
357 echo "error: '${KERNELSRC_DIR}' specified directory not found (KERNELSRC_DIR)!"
355 echo "error: '${KERNELSRC_DIR}' specified directory not found (KERNELSRC_DIR)!"
358 exit 1
356 exit 1
359 fi
357 fi
360
358
361 # Check if specified UBOOTSRC_DIR directory exists
359 # Check if specified UBOOTSRC_DIR directory exists
362 if [ -n "$UBOOTSRC_DIR" ] && [ ! -d "$UBOOTSRC_DIR" ] ; then
360 if [ -n "$UBOOTSRC_DIR" ] && [ ! -d "$UBOOTSRC_DIR" ] ; then
363 echo "error: '${UBOOTSRC_DIR}' specified directory not found (UBOOTSRC_DIR)!"
361 echo "error: '${UBOOTSRC_DIR}' specified directory not found (UBOOTSRC_DIR)!"
364 exit 1
362 exit 1
365 fi
363 fi
366
364
367 # Check if specified FBTURBOSRC_DIR directory exists
365 # Check if specified FBTURBOSRC_DIR directory exists
368 if [ -n "$FBTURBOSRC_DIR" ] && [ ! -d "$FBTURBOSRC_DIR" ] ; then
366 if [ -n "$FBTURBOSRC_DIR" ] && [ ! -d "$FBTURBOSRC_DIR" ] ; then
369 echo "error: '${FBTURBOSRC_DIR}' specified directory not found (FBTURBOSRC_DIR)!"
367 echo "error: '${FBTURBOSRC_DIR}' specified directory not found (FBTURBOSRC_DIR)!"
370 exit 1
368 exit 1
371 fi
369 fi
372
370
373 # Check if specified CHROOT_SCRIPTS directory exists
371 # Check if specified CHROOT_SCRIPTS directory exists
374 if [ -n "$CHROOT_SCRIPTS" ] && [ ! -d "$CHROOT_SCRIPTS" ] ; then
372 if [ -n "$CHROOT_SCRIPTS" ] && [ ! -d "$CHROOT_SCRIPTS" ] ; then
375 echo "error: ${CHROOT_SCRIPTS} specified directory not found (CHROOT_SCRIPTS)!"
373 echo "error: ${CHROOT_SCRIPTS} specified directory not found (CHROOT_SCRIPTS)!"
376 exit 1
374 exit 1
377 fi
375 fi
378
376
379 # Check if specified device mapping already exists (will be used by cryptsetup)
377 # Check if specified device mapping already exists (will be used by cryptsetup)
380 if [ -r "/dev/mapping/${CRYPTFS_MAPPING}" ] ; then
378 if [ -r "/dev/mapping/${CRYPTFS_MAPPING}" ] ; then
381 echo "error: mapping /dev/mapping/${CRYPTFS_MAPPING} already exists, not proceeding"
379 echo "error: mapping /dev/mapping/${CRYPTFS_MAPPING} already exists, not proceeding"
382 exit 1
380 exit 1
383 fi
381 fi
384
382
385 # Don't clobber an old build
383 # Don't clobber an old build
386 if [ -e "$BUILDDIR" ] ; then
384 if [ -e "$BUILDDIR" ] ; then
387 echo "error: directory ${BUILDDIR} already exists, not proceeding"
385 echo "error: directory ${BUILDDIR} already exists, not proceeding"
388 exit 1
386 exit 1
389 fi
387 fi
390
388
391 # Setup chroot directory
389 # Setup chroot directory
392 mkdir -p "${R}"
390 mkdir -p "${R}"
393
391
394 # Check if build directory has enough of free disk space >512MB
392 # Check if build directory has enough of free disk space >512MB
395 if [ "$(df --output=avail ${BUILDDIR} | sed "1d")" -le "524288" ] ; then
393 if [ "$(df --output=avail ${BUILDDIR} | sed "1d")" -le "524288" ] ; then
396 echo "error: ${BUILDDIR} not enough space left to generate the output image!"
394 echo "error: ${BUILDDIR} not enough space left to generate the output image!"
397 exit 1
395 exit 1
398 fi
396 fi
399
397
400 set -x
398 set -x
401
399
402 # Call "cleanup" function on various signals and errors
400 # Call "cleanup" function on various signals and errors
403 trap cleanup 0 1 2 3 6
401 trap cleanup 0 1 2 3 6
404
402
405 # Add required packages for the minbase installation
403 # Add required packages for the minbase installation
406 if [ "$ENABLE_MINBASE" = true ] ; then
404 if [ "$ENABLE_MINBASE" = true ] ; then
407 APT_INCLUDES="${APT_INCLUDES},vim-tiny,netbase,net-tools,ifupdown"
405 APT_INCLUDES="${APT_INCLUDES},vim-tiny,netbase,net-tools,ifupdown"
408 fi
406 fi
409
407
410 # Add required locales packages
408 # Add required locales packages
411 if [ "$DEFLOCAL" != "en_US.UTF-8" ] ; then
409 if [ "$DEFLOCAL" != "en_US.UTF-8" ] ; then
412 APT_INCLUDES="${APT_INCLUDES},locales,keyboard-configuration,console-setup"
410 APT_INCLUDES="${APT_INCLUDES},locales,keyboard-configuration,console-setup"
413 fi
411 fi
414
412
415 # Add parted package, required to get partprobe utility
413 # Add parted package, required to get partprobe utility
416 if [ "$EXPANDROOT" = true ] ; then
414 if [ "$EXPANDROOT" = true ] ; then
417 APT_INCLUDES="${APT_INCLUDES},parted"
415 APT_INCLUDES="${APT_INCLUDES},parted"
418 fi
416 fi
419
417
420 # Add dbus package, recommended if using systemd
418 # Add dbus package, recommended if using systemd
421 if [ "$ENABLE_DBUS" = true ] ; then
419 if [ "$ENABLE_DBUS" = true ] ; then
422 APT_INCLUDES="${APT_INCLUDES},dbus"
420 APT_INCLUDES="${APT_INCLUDES},dbus"
423 fi
421 fi
424
422
425 # Add iptables IPv4/IPv6 package
423 # Add iptables IPv4/IPv6 package
426 if [ "$ENABLE_IPTABLES" = true ] ; then
424 if [ "$ENABLE_IPTABLES" = true ] ; then
427 APT_INCLUDES="${APT_INCLUDES},iptables"
425 APT_INCLUDES="${APT_INCLUDES},iptables"
428 fi
426 fi
429
427
430 # Add openssh server package
428 # Add openssh server package
431 if [ "$ENABLE_SSHD" = true ] ; then
429 if [ "$ENABLE_SSHD" = true ] ; then
432 APT_INCLUDES="${APT_INCLUDES},openssh-server"
430 APT_INCLUDES="${APT_INCLUDES},openssh-server"
433 fi
431 fi
434
432
435 # Add alsa-utils package
433 # Add alsa-utils package
436 if [ "$ENABLE_SOUND" = true ] ; then
434 if [ "$ENABLE_SOUND" = true ] ; then
437 APT_INCLUDES="${APT_INCLUDES},alsa-utils"
435 APT_INCLUDES="${APT_INCLUDES},alsa-utils"
438 fi
436 fi
439
437
440 # Add rng-tools package
438 # Add rng-tools package
441 if [ "$ENABLE_HWRANDOM" = true ] ; then
439 if [ "$ENABLE_HWRANDOM" = true ] ; then
442 APT_INCLUDES="${APT_INCLUDES},rng-tools"
440 APT_INCLUDES="${APT_INCLUDES},rng-tools"
443 fi
441 fi
444
442
445 # Add fbturbo video driver
443 # Add fbturbo video driver
446 if [ "$ENABLE_FBTURBO" = true ] ; then
444 if [ "$ENABLE_FBTURBO" = true ] ; then
447 # Enable xorg package dependencies
445 # Enable xorg package dependencies
448 ENABLE_XORG=true
446 ENABLE_XORG=true
449 fi
447 fi
450
448
451 # Add user defined window manager package
449 # Add user defined window manager package
452 if [ -n "$ENABLE_WM" ] ; then
450 if [ -n "$ENABLE_WM" ] ; then
453 APT_INCLUDES="${APT_INCLUDES},${ENABLE_WM}"
451 APT_INCLUDES="${APT_INCLUDES},${ENABLE_WM}"
454
452
455 # Enable xorg package dependencies
453 # Enable xorg package dependencies
456 ENABLE_XORG=true
454 ENABLE_XORG=true
457 fi
455 fi
458
456
459 # Add xorg package
457 # Add xorg package
460 if [ "$ENABLE_XORG" = true ] ; then
458 if [ "$ENABLE_XORG" = true ] ; then
461 APT_INCLUDES="${APT_INCLUDES},xorg,dbus-x11"
459 APT_INCLUDES="${APT_INCLUDES},xorg,dbus-x11"
462 fi
460 fi
463
461
464 # Replace selected packages with smaller clones
462 # Replace selected packages with smaller clones
465 if [ "$ENABLE_REDUCE" = true ] ; then
463 if [ "$ENABLE_REDUCE" = true ] ; then
466 # Add levee package instead of vim-tiny
464 # Add levee package instead of vim-tiny
467 if [ "$REDUCE_VIM" = true ] ; then
465 if [ "$REDUCE_VIM" = true ] ; then
468 APT_INCLUDES="$(echo ${APT_INCLUDES} | sed "s/vim-tiny/levee/")"
466 APT_INCLUDES="$(echo ${APT_INCLUDES} | sed "s/vim-tiny/levee/")"
469 fi
467 fi
470
468
471 # Add dropbear package instead of openssh-server
469 # Add dropbear package instead of openssh-server
472 if [ "$REDUCE_SSHD" = true ] ; then
470 if [ "$REDUCE_SSHD" = true ] ; then
473 APT_INCLUDES="$(echo ${APT_INCLUDES} | sed "s/openssh-server/dropbear/")"
471 APT_INCLUDES="$(echo ${APT_INCLUDES} | sed "s/openssh-server/dropbear/")"
474 fi
472 fi
475 fi
473 fi
476
474
477 if [ "$RELEASE" != "jessie" ] ; then
475 if [ "$RELEASE" != "jessie" ] ; then
478 APT_INCLUDES="${APT_INCLUDES},libnss-systemd"
476 APT_INCLUDES="${APT_INCLUDES},libnss-systemd"
479 fi
477 fi
480
478
481 # Configure kernel sources if no KERNELSRC_DIR
479 # Configure kernel sources if no KERNELSRC_DIR
482 if [ "$BUILD_KERNEL" = true ] && [ -z "$KERNELSRC_DIR" ] ; then
480 if [ "$BUILD_KERNEL" = true ] && [ -z "$KERNELSRC_DIR" ] ; then
483 KERNELSRC_CONFIG=true
481 KERNELSRC_CONFIG=true
484 fi
482 fi
485
483
486 # Configure reduced kernel
484 # Configure reduced kernel
487 if [ "$KERNEL_REDUCE" = true ] ; then
485 if [ "$KERNEL_REDUCE" = true ] ; then
488 KERNELSRC_CONFIG=false
486 KERNELSRC_CONFIG=false
489 fi
487 fi
490
488
491 # Execute bootstrap scripts
489 # Execute bootstrap scripts
492 for SCRIPT in bootstrap.d/*.sh; do
490 for SCRIPT in bootstrap.d/*.sh; do
493 head -n 3 "$SCRIPT"
491 head -n 3 "$SCRIPT"
494 . "$SCRIPT"
492 . "$SCRIPT"
495 done
493 done
496
494
497 ## Execute custom bootstrap scripts
495 ## Execute custom bootstrap scripts
498 if [ -d "custom.d" ] ; then
496 if [ -d "custom.d" ] ; then
499 for SCRIPT in custom.d/*.sh; do
497 for SCRIPT in custom.d/*.sh; do
500 . "$SCRIPT"
498 . "$SCRIPT"
501 done
499 done
502 fi
500 fi
503
501
504 # Execute custom scripts inside the chroot
502 # Execute custom scripts inside the chroot
505 if [ -n "$CHROOT_SCRIPTS" ] && [ -d "$CHROOT_SCRIPTS" ] ; then
503 if [ -n "$CHROOT_SCRIPTS" ] && [ -d "$CHROOT_SCRIPTS" ] ; then
506 cp -r "${CHROOT_SCRIPTS}" "${R}/chroot_scripts"
504 cp -r "${CHROOT_SCRIPTS}" "${R}/chroot_scripts"
507 chroot_exec /bin/bash -x <<'EOF'
505 chroot_exec /bin/bash -x <<'EOF'
508 for SCRIPT in /chroot_scripts/* ; do
506 for SCRIPT in /chroot_scripts/* ; do
509 if [ -f $SCRIPT -a -x $SCRIPT ] ; then
507 if [ -f $SCRIPT -a -x $SCRIPT ] ; then
510 $SCRIPT
508 $SCRIPT
511 fi
509 fi
512 done
510 done
513 EOF
511 EOF
514 rm -rf "${R}/chroot_scripts"
512 rm -rf "${R}/chroot_scripts"
515 fi
513 fi
516
514
517 # Remove c/c++ build environment from the chroot
515 # Remove c/c++ build environment from the chroot
518 chroot_remove_cc
516 chroot_remove_cc
519
517
520 # Remove apt-utils
518 # Remove apt-utils
521 if [ "$RELEASE" = "jessie" ] ; then
519 if [ "$RELEASE" = "jessie" ] ; then
522 chroot_exec apt-get purge -qq -y --force-yes apt-utils
520 chroot_exec apt-get purge -qq -y --force-yes apt-utils
523 fi
521 fi
524
522
525 # Generate required machine-id
523 # Generate required machine-id
526 MACHINE_ID=$(dbus-uuidgen)
524 MACHINE_ID=$(dbus-uuidgen)
527 echo -n "${MACHINE_ID}" > "${R}/var/lib/dbus/machine-id"
525 echo -n "${MACHINE_ID}" > "${R}/var/lib/dbus/machine-id"
528 echo -n "${MACHINE_ID}" > "${ETC_DIR}/machine-id"
526 echo -n "${MACHINE_ID}" > "${ETC_DIR}/machine-id"
529
527
530 # APT Cleanup
528 # APT Cleanup
531 chroot_exec apt-get -y clean
529 chroot_exec apt-get -y clean
532 chroot_exec apt-get -y autoclean
530 chroot_exec apt-get -y autoclean
533 chroot_exec apt-get -y autoremove
531 chroot_exec apt-get -y autoremove
534
532
535 # Unmount mounted filesystems
533 # Unmount mounted filesystems
536 umount -l "${R}/proc"
534 umount -l "${R}/proc"
537 umount -l "${R}/sys"
535 umount -l "${R}/sys"
538
536
539 # Clean up directories
537 # Clean up directories
540 rm -rf "${R}/run/*"
538 rm -rf "${R}/run/*"
541 rm -rf "${R}/tmp/*"
539 rm -rf "${R}/tmp/*"
542
540
543 # Clean up files
541 # Clean up files
544 rm -f "${ETC_DIR}/ssh/ssh_host_*"
542 rm -f "${ETC_DIR}/ssh/ssh_host_*"
545 rm -f "${ETC_DIR}/dropbear/dropbear_*"
543 rm -f "${ETC_DIR}/dropbear/dropbear_*"
546 rm -f "${ETC_DIR}/apt/sources.list.save"
544 rm -f "${ETC_DIR}/apt/sources.list.save"
547 rm -f "${ETC_DIR}/resolvconf/resolv.conf.d/original"
545 rm -f "${ETC_DIR}/resolvconf/resolv.conf.d/original"
548 rm -f "${ETC_DIR}/*-"
546 rm -f "${ETC_DIR}/*-"
549 rm -f "${ETC_DIR}/apt/apt.conf.d/10proxy"
547 rm -f "${ETC_DIR}/apt/apt.conf.d/10proxy"
550 rm -f "${ETC_DIR}/resolv.conf"
548 rm -f "${ETC_DIR}/resolv.conf"
551 rm -f "${R}/root/.bash_history"
549 rm -f "${R}/root/.bash_history"
552 rm -f "${R}/var/lib/urandom/random-seed"
550 rm -f "${R}/var/lib/urandom/random-seed"
553 rm -f "${R}/initrd.img"
551 rm -f "${R}/initrd.img"
554 rm -f "${R}/vmlinuz"
552 rm -f "${R}/vmlinuz"
555 rm -f "${R}${QEMU_BINARY}"
553 rm -f "${R}${QEMU_BINARY}"
556
554
557 # Calculate size of the chroot directory in KB
555 # Calculate size of the chroot directory in KB
558 CHROOT_SIZE=$(expr `du -s "${R}" | awk '{ print $1 }'`)
556 CHROOT_SIZE=$(expr `du -s "${R}" | awk '{ print $1 }'`)
559
557
560 # Calculate the amount of needed 512 Byte sectors
558 # Calculate the amount of needed 512 Byte sectors
561 TABLE_SECTORS=$(expr 1 \* 1024 \* 1024 \/ 512)
559 TABLE_SECTORS=$(expr 1 \* 1024 \* 1024 \/ 512)
562 FRMW_SECTORS=$(expr 64 \* 1024 \* 1024 \/ 512)
560 FRMW_SECTORS=$(expr 64 \* 1024 \* 1024 \/ 512)
563 ROOT_OFFSET=$(expr ${TABLE_SECTORS} + ${FRMW_SECTORS})
561 ROOT_OFFSET=$(expr ${TABLE_SECTORS} + ${FRMW_SECTORS})
564
562
565 # The root partition is EXT4
563 # The root partition is EXT4
566 # This means more space than the actual used space of the chroot is used.
564 # This means more space than the actual used space of the chroot is used.
567 # As overhead for journaling and reserved blocks 35% are added.
565 # As overhead for journaling and reserved blocks 35% are added.
568 ROOT_SECTORS=$(expr $(expr ${CHROOT_SIZE} + ${CHROOT_SIZE} \/ 100 \* 35) \* 1024 \/ 512)
566 ROOT_SECTORS=$(expr $(expr ${CHROOT_SIZE} + ${CHROOT_SIZE} \/ 100 \* 35) \* 1024 \/ 512)
569
567
570 # Calculate required image size in 512 Byte sectors
568 # Calculate required image size in 512 Byte sectors
571 IMAGE_SECTORS=$(expr ${TABLE_SECTORS} + ${FRMW_SECTORS} + ${ROOT_SECTORS})
569 IMAGE_SECTORS=$(expr ${TABLE_SECTORS} + ${FRMW_SECTORS} + ${ROOT_SECTORS})
572
570
573 # Prepare image file
571 # Prepare image file
574 if [ "$ENABLE_SPLITFS" = true ] ; then
572 if [ "$ENABLE_SPLITFS" = true ] ; then
575 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count=${TABLE_SECTORS}
573 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count=${TABLE_SECTORS}
576 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count=0 seek=${FRMW_SECTORS}
574 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count=0 seek=${FRMW_SECTORS}
577 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count=${TABLE_SECTORS}
575 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count=${TABLE_SECTORS}
578 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count=0 seek=${ROOT_SECTORS}
576 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count=0 seek=${ROOT_SECTORS}
579
577
580 # Write firmware/boot partition tables
578 # Write firmware/boot partition tables
581 sfdisk -q -L -uS -f "$IMAGE_NAME-frmw.img" 2> /dev/null <<EOM
579 sfdisk -q -L -uS -f "$IMAGE_NAME-frmw.img" 2> /dev/null <<EOM
582 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
580 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
583 EOM
581 EOM
584
582
585 # Write root partition table
583 # Write root partition table
586 sfdisk -q -L -uS -f "$IMAGE_NAME-root.img" 2> /dev/null <<EOM
584 sfdisk -q -L -uS -f "$IMAGE_NAME-root.img" 2> /dev/null <<EOM
587 ${TABLE_SECTORS},${ROOT_SECTORS},83
585 ${TABLE_SECTORS},${ROOT_SECTORS},83
588 EOM
586 EOM
589
587
590 # Setup temporary loop devices
588 # Setup temporary loop devices
591 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $IMAGE_NAME-frmw.img)"
589 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $IMAGE_NAME-frmw.img)"
592 ROOT_LOOP="$(losetup -o 1M -f --show $IMAGE_NAME-root.img)"
590 ROOT_LOOP="$(losetup -o 1M -f --show $IMAGE_NAME-root.img)"
593 else # ENABLE_SPLITFS=false
591 else # ENABLE_SPLITFS=false
594 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count=${TABLE_SECTORS}
592 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count=${TABLE_SECTORS}
595 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count=0 seek=${IMAGE_SECTORS}
593 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count=0 seek=${IMAGE_SECTORS}
596
594
597 # Write partition table
595 # Write partition table
598 sfdisk -q -L -uS -f "$IMAGE_NAME.img" 2> /dev/null <<EOM
596 sfdisk -q -L -uS -f "$IMAGE_NAME.img" 2> /dev/null <<EOM
599 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
597 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
600 ${ROOT_OFFSET},${ROOT_SECTORS},83
598 ${ROOT_OFFSET},${ROOT_SECTORS},83
601 EOM
599 EOM
602
600
603 # Setup temporary loop devices
601 # Setup temporary loop devices
604 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $IMAGE_NAME.img)"
602 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $IMAGE_NAME.img)"
605 ROOT_LOOP="$(losetup -o 65M -f --show $IMAGE_NAME.img)"
603 ROOT_LOOP="$(losetup -o 65M -f --show $IMAGE_NAME.img)"
606 fi
604 fi
607
605
608 if [ "$ENABLE_CRYPTFS" = true ] ; then
606 if [ "$ENABLE_CRYPTFS" = true ] ; then
609 # Create dummy ext4 fs
607 # Create dummy ext4 fs
610 mkfs.ext4 "$ROOT_LOOP"
608 mkfs.ext4 "$ROOT_LOOP"
611
609
612 # Setup password keyfile
610 # Setup password keyfile
613 touch .password
611 touch .password
614 chmod 600 .password
612 chmod 600 .password
615 echo -n ${CRYPTFS_PASSWORD} > .password
613 echo -n ${CRYPTFS_PASSWORD} > .password
616
614
617 # Initialize encrypted partition
615 # Initialize encrypted partition
618 echo "YES" | cryptsetup luksFormat "${ROOT_LOOP}" -c "${CRYPTFS_CIPHER}" -s "${CRYPTFS_XTSKEYSIZE}" .password
616 echo "YES" | cryptsetup luksFormat "${ROOT_LOOP}" -c "${CRYPTFS_CIPHER}" -s "${CRYPTFS_XTSKEYSIZE}" .password
619
617
620 # Open encrypted partition and setup mapping
618 # Open encrypted partition and setup mapping
621 cryptsetup luksOpen "${ROOT_LOOP}" -d .password "${CRYPTFS_MAPPING}"
619 cryptsetup luksOpen "${ROOT_LOOP}" -d .password "${CRYPTFS_MAPPING}"
622
620
623 # Secure delete password keyfile
621 # Secure delete password keyfile
624 shred -zu .password
622 shred -zu .password
625
623
626 # Update temporary loop device
624 # Update temporary loop device
627 ROOT_LOOP="/dev/mapper/${CRYPTFS_MAPPING}"
625 ROOT_LOOP="/dev/mapper/${CRYPTFS_MAPPING}"
628
626
629 # Wipe encrypted partition (encryption cipher is used for randomness)
627 # Wipe encrypted partition (encryption cipher is used for randomness)
630 dd if=/dev/zero of="${ROOT_LOOP}" bs=512 count=$(blockdev --getsz "${ROOT_LOOP}")
628 dd if=/dev/zero of="${ROOT_LOOP}" bs=512 count=$(blockdev --getsz "${ROOT_LOOP}")
631 fi
629 fi
632
630
633 # Build filesystems
631 # Build filesystems
634 mkfs.vfat "$FRMW_LOOP"
632 mkfs.vfat "$FRMW_LOOP"
635 mkfs.ext4 "$ROOT_LOOP"
633 mkfs.ext4 "$ROOT_LOOP"
636
634
637 # Mount the temporary loop devices
635 # Mount the temporary loop devices
638 mkdir -p "$BUILDDIR/mount"
636 mkdir -p "$BUILDDIR/mount"
639 mount "$ROOT_LOOP" "$BUILDDIR/mount"
637 mount "$ROOT_LOOP" "$BUILDDIR/mount"
640
638
641 mkdir -p "$BUILDDIR/mount/boot/firmware"
639 mkdir -p "$BUILDDIR/mount/boot/firmware"
642 mount "$FRMW_LOOP" "$BUILDDIR/mount/boot/firmware"
640 mount "$FRMW_LOOP" "$BUILDDIR/mount/boot/firmware"
643
641
644 # Copy all files from the chroot to the loop device mount point directory
642 # Copy all files from the chroot to the loop device mount point directory
645 rsync -a "${R}/" "$BUILDDIR/mount/"
643 rsync -a "${R}/" "$BUILDDIR/mount/"
646
644
647 # Unmount all temporary loop devices and mount points
645 # Unmount all temporary loop devices and mount points
648 cleanup
646 cleanup
649
647
650 # Create block map file(s) of image(s)
648 # Create block map file(s) of image(s)
651 if [ "$ENABLE_SPLITFS" = true ] ; then
649 if [ "$ENABLE_SPLITFS" = true ] ; then
652 # Create block map files for "bmaptool"
650 # Create block map files for "bmaptool"
653 bmaptool create -o "$IMAGE_NAME-frmw.bmap" "$IMAGE_NAME-frmw.img"
651 bmaptool create -o "$IMAGE_NAME-frmw.bmap" "$IMAGE_NAME-frmw.img"
654 bmaptool create -o "$IMAGE_NAME-root.bmap" "$IMAGE_NAME-root.img"
652 bmaptool create -o "$IMAGE_NAME-root.bmap" "$IMAGE_NAME-root.img"
655
653
656 # Image was successfully created
654 # Image was successfully created
657 echo "$IMAGE_NAME-frmw.img ($(expr \( ${TABLE_SECTORS} + ${FRMW_SECTORS} \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
655 echo "$IMAGE_NAME-frmw.img ($(expr \( ${TABLE_SECTORS} + ${FRMW_SECTORS} \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
658 echo "$IMAGE_NAME-root.img ($(expr \( ${TABLE_SECTORS} + ${ROOT_SECTORS} \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
656 echo "$IMAGE_NAME-root.img ($(expr \( ${TABLE_SECTORS} + ${ROOT_SECTORS} \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
659 else
657 else
660 # Create block map file for "bmaptool"
658 # Create block map file for "bmaptool"
661 bmaptool create -o "$IMAGE_NAME.bmap" "$IMAGE_NAME.img"
659 bmaptool create -o "$IMAGE_NAME.bmap" "$IMAGE_NAME.img"
662
660
663 # Image was successfully created
661 # Image was successfully created
664 echo "$IMAGE_NAME.img ($(expr \( ${TABLE_SECTORS} + ${FRMW_SECTORS} + ${ROOT_SECTORS} \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
662 echo "$IMAGE_NAME.img ($(expr \( ${TABLE_SECTORS} + ${FRMW_SECTORS} + ${ROOT_SECTORS} \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
665 fi
663 fi
General Comments 0
Vous devez vous connecter pour laisser un commentaire. Se connecter maintenant