Merge pull request #439 from CyberMind-FR/fix/436-build-scripts-stub-systemctl-handle-rasp

build scripts: stub systemctl + handle raspi-firmware /boot/firmware in qemu chroot
fix(rpi-usb): force graphical.target.wants symlink for kiosk (ref #436 )
2026-08-16 11:04:01 +00:00 · 2026-06-01 09:09:37 +02:00 · 2026-06-01 09:09:22 +02:00 · 2026-06-01 07:29:06 +02:00 · 2026-06-01 07:28:50 +02:00
1 changed files with 23 additions and 2 deletions
@@ -193,9 +193,18 @@ exit 101
 POLICY_RC_D
 chmod 0755 "${ROOTFS}/usr/sbin/policy-rc.d"

-# (3) tmpfs at /boot/firmware (raspi-firmware postinst needs mountpoint)
+# (3) tmpfs at /boot/firmware (raspi-firmware postinst needs mountpoint).
+# 512M: must fit kernel + initrd (~50-100M arm64) + dtbs + overlays + bootloader.
+# 64M was too small — v2.13.6 hit ENOSPC during initramfs-tools postinst.
 mkdir -p "${ROOTFS}/boot/firmware"
-mount -t tmpfs -o size=64M,mode=0755 tmpfs "${ROOTFS}/boot/firmware"
+mount -t tmpfs -o size=512M,mode=0755 tmpfs "${ROOTFS}/boot/firmware"
+
+# (4) /proc + /sys inside the chroot — raspi-firmware's update-initramfs hook
+# uses findmnt which reads /proc/mounts. Without these, postinst fails
+# silently with "findmnt: can't read /proc/mounts" before chmod/chown errors
+# show. Matches build-live-usb.sh's pattern (lines 277-278).
+mountpoint -q "${ROOTFS}/proc" || mount -t proc  proc  "${ROOTFS}/proc"
+mountpoint -q "${ROOTFS}/sys"  || mount -t sysfs sysfs "${ROOTFS}/sys"

 ok "Chroot safety net installed"

@@ -902,6 +911,14 @@ KIOSKSVC
    chroot "${ROOTFS}" systemctl enable secubox-kiosk.service \
        || err "systemctl enable secubox-kiosk.service failed"

+    # Belt-and-suspenders: `systemctl enable` under SYSTEMD_OFFLINE in a qemu
+    # chroot doesn't always materialise the WantedBy symlink (observed in
+    # v2.13.7). Create it explicitly so the next assertion passes regardless
+    # of whether systemctl's offline behaviour wrote the link itself.
+    install -d "${ROOTFS}/etc/systemd/system/graphical.target.wants"
+    ln -sf "/etc/systemd/system/secubox-kiosk.service" \
+           "${ROOTFS}/etc/systemd/system/graphical.target.wants/secubox-kiosk.service"
+
    # Build-time assertion (#433): verify EVERY kiosk artefact made it into
    # the rootfs before Step 7's rsync. If any of these is missing, the .img
    # would ship without kiosk despite the CI logging "Kiosk mode installed".
@@ -1182,6 +1199,10 @@ ok "Pi bootloader configured"
 # (which was Step 5.4's enable secubox-kiosk.service, already done by here).
 log "Removing chroot safety net (systemctl wrapper, policy-rc.d, /boot/firmware tmpfs)"

+# (4) umount /proc + /sys (chroot no longer needs them)
+umount -lf "${ROOTFS}/proc" 2>/dev/null || true
+umount -lf "${ROOTFS}/sys"  2>/dev/null || true
+
 # (3) umount tmpfs /boot/firmware (Step 7 mounts the real BOOT partition there)
 umount "${ROOTFS}/boot/firmware" 2>/dev/null || warn "tmpfs /boot/firmware was not mounted"
Author	SHA1	Message	Date
CyberMind	e2acd4cb88	Merge pull request #439 from CyberMind-FR/fix/436-build-scripts-stub-systemctl-handle-rasp build scripts: stub systemctl + handle raspi-firmware /boot/firmware in qemu chroot	2026-06-01 09:09:37 +02:00
gandalf	e4447e0a2a	fix(rpi-usb): force graphical.target.wants symlink for kiosk (ref #436 ) Follow-up to PR #438. v2.13.7 build progressed all the way to the build-time assertion, which then failed with: [WARN] secubox-kiosk.service not in graphical.target.wants/ [FAIL] Kiosk artefacts incomplete — refusing to publish a broken image Under SYSTEMD_OFFLINE=1 inside a qemu-arm64 chroot, `systemctl enable secubox-kiosk.service` returns 0 but doesn't always materialise the WantedBy symlink. Create it explicitly right after the enable call (belt-and-suspenders against any quirk of offline systemctl behaviour). This is the last piece: chroot safety net (PR #437), bigger tmpfs + /proc + /sys (PR #438), and now the WantedBy symlink. Expected v2.13.8: the assertion finally passes, Step 7 rsyncs, image ships. Chain: #423 → #433 (PR #435) → #436 (PRs #437, #438, this).	2026-06-01 09:09:22 +02:00
CyberMind	7d971bbb88	Merge pull request #438 from CyberMind-FR/fix/436-build-scripts-stub-systemctl-handle-rasp build scripts: stub systemctl + handle raspi-firmware /boot/firmware in qemu chroot	2026-06-01 07:29:06 +02:00
gandalf	ef9e9dc133	fix(rpi-usb): bump tmpfs /boot/firmware 64M→512M + bind /proc,/sys (ref #436 ) Follow-up to PR #437. v2.13.6 build hit two new failures inside the safety net : 1. ENOSPC on tmpfs /boot/firmware — 64M was too small. The raspi-firmware post-update.d hook copies kernel (~25M) + initrd (~30M arm64) + dtbs + overlays. Bumped to 512M to cover all firmware artefacts comfortably. 2. /proc + /sys not bind-mounted into the chroot — raspi-firmware's hook uses `findmnt /boot/firmware` which reads /proc/mounts. Without /proc mounted in the chroot it errored `findmnt: can't read /proc/mounts`. Now bound at safety-net install (matches the pattern build-live-usb.sh uses at lines 277-278) and unmounted at teardown. Both errors surface during the apt --fix-broken install OR the apt-get install kiosk stack, where postinsts trigger update-initramfs which runs the raspi-firmware hook. The systemctl wrapper + policy-rc.d parts of the safety net (PR #437) were already working — these two extras finish the job. Expected v2.13.7: kiosk install completes cleanly through to the build-time assertion, image rsyncs successfully. Refs: #423 → #433 → #436 (this and PR #437 close together).	2026-06-01 07:28:50 +02:00