Add scripts and config to support signing UKIs in OBS

[bluca]

https://build.opensuse.org/package/show/home:bluca:branches:home:bluca:systemd/debian-image

[DaanDeMeyer]

Making the output directory available to build scripts is not an option, because we don't clean up the output directory when Format=none which causes a big mess if we make it available to build scripts.

Please use either the build directory or the source directories via BuildSources= to get stuff out of the build script.

[bluca]

Making the output directory available to build scripts is not an option, because we don't clean up the output directory when Format=none which causes a big mess if we make it available to build scripts.

Please use either the build directory or the source directories via BuildSources= to get stuff out of the build script.

But how? Everything in the build directory is lost after the build

[DaanDeMeyer]

But how? Everything in the build directory is lost after the build

Huh? Not at all, $BUILDDIR is persisted across builds. Just set BuildDirectory=<some-path> and it'll be created and persisted across builds. The annoying thing about BuildDirectory= for this use case is that we create a subdirectory in it, so you'll probably want to use BuildSources= instead.

[bluca]

The following files have no copyright information:
* mkosi/resources/mkosi-obs/mkosi.build
* mkosi/resources/mkosi-obs/mkosi.postoutput

wat

[bluca]

But how? Everything in the build directory is lost after the build

Huh? Not at all, $BUILDDIR is persisted across builds. Just set BuildDirectory=<some-path> and it'll be created and persisted across builds. The annoying thing about BuildDirectory= for this use case is that we create a subdirectory in it, so you'll probably want to use BuildSources= instead.

But I mean that whatever is in there is not then moved to the output directory, so the build finishes and there's nothing, it's all lost

[bluca]

SPDX

It's there

#!/bin/bash
# SPDX-License-Identifier: LGPL-2.1-or-later

[DaanDeMeyer]

But how? Everything in the build directory is lost after the build

Huh? Not at all, $BUILDDIR is persisted across builds. Just set BuildDirectory=<some-path> and it'll be created and persisted across builds. The annoying thing about BuildDirectory= for this use case is that we create a subdirectory in it, so you'll probably want to use BuildSources= instead.

But I mean that whatever is in there is not then moved to the output directory, so the build finishes and there's nothing, it's all lost

I mean that you make the output directory available to the build script via BuildSources=

[behrmann]

haven't checked this with actual data yet, but maybe the whole thing could be

Suggested change

	while read -r pol; do
	echo -n "$pol" | tr '[:lower:]' '[:upper:]' | basenc --base16 --decode >"hashes/pcrs/${f}/${pol}"
	done < <(jq -r 'to_entries[] | .value[].pol' <"${OUTPUTDIR}/${f%.efi}.pcrs")
	jq -r 'to_entries[] | .value[].pol | ascii_downcase' "${OUTPUTDIR}/${f%.efi}.pcrs" |
	basenc --base16 --decode >"hashes/pcrs/${f}/${pol}"

[bluca]

$pol is not defined in that case