RE: [PATCH v3 08/10] meta-isar: Remove qemuamd64-sb settings from multiconfig

["MOESSBAUER, Felix" <felix.moessbauer@siemens.com>]

> Subject: Re: [PATCH v3 08/10] meta-isar: Remove qemuamd64-sb settings
> from multiconfig
> 
> 15/06/2023 08:07, 'Jan Kiszka' via isar-users wrote:
> > On 12.06.23 09:12, Uladzimir Bely wrote:
> >> From: Anton Mikanovich <amikan@ilbers.de>
> >>
> >> Machine-related configuration should be done in machine config, so
> >> move it from multiconfig.
> >>
> >> Signed-off-by: Anton Mikanovich <amikan@ilbers.de>
> >> Signed-off-by: Uladzimir Bely <ubely@ilbers.de>
> >> ---
> >>   meta-isar/conf/machine/qemuamd64-sb.conf              |  9 +++++++++
> >>   meta-isar/conf/multiconfig/qemuamd64-sb-bullseye.conf | 10 +---------
> >>   2 files changed, 10 insertions(+), 9 deletions(-)
> >>
> >> diff --git a/meta-isar/conf/machine/qemuamd64-sb.conf
> >> b/meta-isar/conf/machine/qemuamd64-sb.conf
> >> index c581ab39..419db3b2 100644
> >> --- a/meta-isar/conf/machine/qemuamd64-sb.conf
> >> +++ b/meta-isar/conf/machine/qemuamd64-sb.conf
> >> @@ -9,6 +9,15 @@ IMAGE_FSTYPES ?= "wic"
> >>   WKS_FILE ?= "sdimage-efi-sb-debian"
> >>   IMAGER_INSTALL += "${GRUB_DEBIAN_SB_CHAIN}"
> >>
> >> +# include public keys
> >> +IMAGE_INSTALL += "sb-mok-public"
> >> +# include signed example module
> >> +IMAGE_INSTALL += "example-module-signed-${KERNEL_NAME}"
> >> +
> >> +# add MOK utilities to insert MOK into EFI IMAGER_INSTALL +=
> >> +"${GRUB_DEBIAN_SB_MOK}"
> >> +IMAGE_PREINSTALL += "mokutil"
> >> +
> >>   IMAGE_INSTALL += "sshd-regen-keys"
> >>
> >>   QEMU_ARCH ?= "x86_64"
> >> diff --git a/meta-isar/conf/multiconfig/qemuamd64-sb-bullseye.conf
> >> b/meta-isar/conf/multiconfig/qemuamd64-sb-bullseye.conf
> >> index 19a105eb..85ce3a65 100644
> >> --- a/meta-isar/conf/multiconfig/qemuamd64-sb-bullseye.conf
> >> +++ b/meta-isar/conf/multiconfig/qemuamd64-sb-bullseye.conf
> >> @@ -1,12 +1,4 @@
> >>   # This software is a part of ISAR.
> >> +
> >>   MACHINE ?= "qemuamd64-sb"
> >>   DISTRO ?= "debian-bullseye"
> >> -
> >> -# include public keys
> >> -IMAGE_INSTALL += "sb-mok-public"
> >> -# include signed example module
> >> -IMAGE_INSTALL += "example-module-signed-${KERNEL_NAME}"
> >> -
> >> -# add MOK utilities to insert MOK into EFI -IMAGER_INSTALL +=
> >> "${GRUB_DEBIAN_SB_MOK}"
> >> -IMAGE_PREINSTALL += "mokutil"
> > This is an anti-pattern when you want to allow reusing the machine
> > configs outside of Isar testing scenarios, see also [1].
> >
> > Jan
> >
> > [1]
> > https://groups.google.com/d/msgid/isar-
> users/b37eca8a55e91777ec3fdb54c
> > 989326b54c0253f.1685895669.git.jan.kiszka%40siemens.com
> >
> Hello Jan, one of the main ideas here was to cleanup all the multiconfigs to
> enable building images with local.conf machine+distro values only.
> But qemuamd64-sb-bullseye is really special target currently. If we move
> those options to isar-image-ci recipe the target will be unusable without meta-
> test layer. All other targets are buildable even without meta-test which allows
> this new layer to be optional.

In my opinion, the example can be moved to the CI layer. In case users want to create SB enabled images with the Debian toolchain, they can simply set the WKS file accordingly and add the GRUB_DEBIAN_SB_MOK.
With the IMAGE_INSTALL / PREINSTALL lines, the target it hardly usable directly.

Best regards,
Felix