deps: PR opencomputeproject#1129 (toolchain: Debian 13 / GCC 14 / crosstool-NG 1.28 / uClibc-ng 1.0.54 + secure-boot)

Squashed content of PR opencomputeproject#1129, pulled in as a dependency.

Signed-off-by: Brad House <bhouse@nexthop.ai>

Author: bhouse-nexthop

.github/onie-build/Dockerfile

@@ -1,16 +1,16 @@
 # ONIE build environment for CI.
 #
-# Debian 11 is required: onie/build-config/Makefile still pulls in
-# python2-era tooling (python-all-dev) that is unavailable on newer
-# Debian releases.
+# Debian 13 (trixie) host for the modernized toolchain.  Required because
+# kernel 6.18's objtool needs a newer host libelf than Debian 11 ships
+# (0.183 fails with "elf_update: invalid section alignment"), and
+# crosstool-NG 1.28 / GCC 14 align with the trixie host toolchain.  (The
+# old crosstool-NG 1.24 / GCC 8.3 toolchain could NOT build on trixie.)
 #
 # This image builds the generic kvm_x86_64 target with secure boot
-# enabled.  It includes the secure-boot key-generation and EFI signing
-# tooling (gnupg2, efitools, sbsigntool), the NSS command-line tools the
-# shim signing step shells out to (libnss3-tools: pk12util/certutil), and
-# the build dependencies for the pesign that ONIE compiles from source
-# (NSS/NSPR dev packages).
-FROM debian:11
+# enabled.  It includes the secure-boot tooling needed to exercise the SB
+# build path -- pesign, efitools, sbsigntool and gnupg2 (for key
+# generation and EFI signing).
+FROM debian:13
 WORKDIR /onie
 
 # Tolerate transient Debian mirror hiccups (connection resets mid-fetch).
@@ -24,7 +24,7 @@ RUN apt-get update && apt-get install -y \
     autopoint \
     bc \
     bison \
-    bsdmainutils \
+    bsdextrautils \
     build-essential \
     coreutils \
     cpio \
@@ -43,19 +43,15 @@ RUN apt-get update && apt-get install -y \
     libelf-dev \
     libexpat1 \
     libexpat1-dev \
-    libncurses5 \
-    libncurses5-dev \
-    libnspr4-dev \
-    libnss3-dev \
-    libnss3-tools \
+    libncurses-dev \
     libpopt-dev \
     libssl-dev \
     libtool \
     libtool-bin \
     locales \
     mtools \
+    pesign \
     pkgconf \
-    python-all-dev \
     python3-all-dev \
     python3-sphinx \
     python3-venv \

.github/workflows/build-onie.yml

@@ -12,6 +12,17 @@ name: Build ONIE (kvm_x86_64)
 # filtering would risk skipping validation on build-affecting changes.
 on:
   workflow_dispatch:
+    inputs:
+      oce_scope:
+        description: >-
+          OCE compliance test scope: "default" (a fast representative
+          subset, also what push/PR runs) or "full" (the entire OCE
+          installer+updater sweep, tests 3-121 -- slow, many VM boots).
+        type: choice
+        default: default
+        options:
+          - default
+          - full
   push:
   pull_request:
 
@@ -29,6 +40,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      # The GCC 14 / Debian 13 toolchain build plus the full image (restored
+      # x-tools cache + every package + kernel + recovery ISO) exceeds the
+      # ~14 GB free on a stock ubuntu-latest runner.  Reclaim ~25 GB of
+      # preinstalled toolchains we do not use so the build has headroom.
+      - name: Free up runner disk space
+        run: |
+          echo "Disk before cleanup:"; df -h /
+          sudo rm -rf /usr/local/lib/android /opt/hostedtoolcache /usr/share/dotnet \
+                      /usr/local/.ghcup /usr/share/swift /usr/local/share/powershell \
+                      /usr/local/lib/node_modules || true
+          echo "Disk after cleanup:"; df -h /
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
@@ -300,3 +323,63 @@ jobs:
           name: onie-install-serial-log
           path: onie-install-*.log
           retention-days: 7
+
+  # Run ONIE's own OCE (ONIE Compliance Environment, contrib/oce) compliance
+  # suite against the image.  Where install-test hands ONIE the installer URL
+  # directly (install_url=), OCE exercises the REAL OCP discovery path: it
+  # stands up isc-dhcp-server advertising the ONIE VIVSO vendor option (DHCP
+  # option 125) plus an nginx HTTP server, and ONIE must DHCP, read the VIVSO
+  # installer URL, and fetch+install the image itself.  OCE needs L2 to the DUT
+  # (it validates the DUT shares the host interface's subnet), so the VM is on a
+  # tap interface rather than user-mode SLIRP.  contrib/oce is python3 (it was
+  # ported in the python2-to-3 PR this is stacked on).  See
+  # emulation/ci-oce-test.sh.
+  oce-test:
+    name: OCE compliance kvm_x86_64
+    # Chained after install-test (not parallel) so only one VM-heavy job runs
+    # at a time, keeping CI resource use low.
+    needs: install-test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Enable KVM (grant /dev/kvm access)
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
+            | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+      - name: Install QEMU + OCE service backends + python deps
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            qemu-system-x86 qemu-utils isc-dhcp-server nginx-light tftpd-hpa \
+            dnsmasq dosfstools python3-venv
+          python3 -m venv /tmp/oce-venv
+          /tmp/oce-venv/bin/pip install --quiet jinja2 netifaces psutil
+      - name: Download install-test images
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: onie-kvm-install-images
+          path: build/images
+      - name: Run OCE compliance test (full install/update via OCP discovery)
+        run: |
+          # On push/PR (no dispatch input) run the fast "default" subset; a
+          # human can manually dispatch this workflow with oce_scope=full to
+          # run the entire OCE installer+updater sweep.
+          SCOPE="${{ inputs.oce_scope }}"
+          [ -z "$SCOPE" ] && SCOPE=default
+          OCE_PYTHON=/tmp/oce-venv/bin/python SERIAL_PREFIX="$PWD/onie-oce" \
+            emulation/ci-oce-test.sh \
+              build/images/kvm_x86_64-r0.vmlinuz \
+              build/images/kvm_x86_64-r0.initrd \
+              build/images/demo-installer-x86_64-kvm_x86_64-r0.bin \
+              build/images/onie-updater-x86_64-kvm_x86_64-r0 \
+              "$SCOPE"
+      - name: Upload OCE serial logs
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: onie-oce-serial-log
+          path: onie-oce-*.log
+          retention-days: 7

.github/workflows/git-stats-test.yml

@@ -0,0 +1,58 @@
+name: git-stats (gitdm)
+
+# Validate the contrib/git-stats tooling.  gitdm is no longer vendored in the
+# tree: onie-git-stats auto-installs a pinned python3 gitdm on first run, and
+# honors $GITDM to use a pre-existing install instead.  This check exercises
+# both paths end-to-end (a report is actually generated), so the change can be
+# trusted without manual testing.  Scoped to contrib/git-stats (and this
+# workflow file) since nothing else affects it.
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - 'contrib/git-stats/**'
+      - '.github/workflows/git-stats-test.yml'
+  pull_request:
+    paths:
+      - 'contrib/git-stats/**'
+      - '.github/workflows/git-stats-test.yml'
+
+# Cancel an in-progress run when a newer commit is pushed to the same ref.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  git-stats:
+    name: onie-git-stats
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          # onie-git-stats runs "git log <range>"; fetch enough history for it.
+          fetch-depth: 50
+
+      - name: Auto-install path (clone a python3 gitdm, generate a report)
+        working-directory: contrib/git-stats
+        run: |
+          set -eu
+          ./onie-git-stats HEAD~10..HEAD ci
+          test -d .gitdm                    # auto-install actually happened
+          test -s /tmp/ci-results.txt       # non-empty text report
+          test -s /tmp/ci-results.html      # non-empty html report
+          grep -q "Processed" /tmp/ci-results.txt
+          echo "auto-install path OK"
+
+      - name: Override path ($GITDM bypasses the auto-install)
+        working-directory: contrib/git-stats
+        run: |
+          set -eu
+          # Reuse the gitdm cloned above as a "pre-existing" install, drop the
+          # auto-install cache, and confirm the override does NOT re-clone it.
+          mv .gitdm "$RUNNER_TEMP/gitdm"
+          GITDM="$RUNNER_TEMP/gitdm/gitdm" ./onie-git-stats HEAD~10..HEAD ci2
+          test ! -e .gitdm                  # override must skip the clone
+          test -s /tmp/ci2-results.txt
+          grep -q "Processed" /tmp/ci2-results.txt
+          echo "override path OK"

build-config/Makefile

@@ -358,8 +358,6 @@ SECURE_GRUB ?= no
 
 ifeq ($(SECURE_BOOT_ENABLE),yes)
   SHIM_ENABLE = yes
-  PESIGN_ENABLE = yes
-  GNU_EFI_ENABLE = yes
   OPENSSL_ENABLE = yes
   MOKUTIL_ENABLE = yes
   KEYUTILS_ENABLE = yes
@@ -374,9 +372,6 @@ ifeq ($(XTOOLS_ENABLE),yes)
   include make/xtools.make
 endif
 include make/sysroot.make
-ifeq ($(GNU_EFI_ENABLE),yes)
-  include make/gnu-efi.make
-endif
 include make/kernel.make
 ifeq ($(UBOOT_ENABLE),yes)
   include make/u-boot.make
@@ -398,6 +393,8 @@ ifeq ($(GPT_ENABLE),yes)
   include make/gptfdisk.make
 endif
 ifeq ($(LVM2_ENABLE),yes)
+  # lvm2 >= 2.03 requires libaio for its bcache I/O engine.
+  include make/libaio.make
   include make/lvm2.make
 endif
 ifeq ($(PARTED_ENABLE),yes)
@@ -420,6 +417,8 @@ ifeq ($(DMIDECODE_ENABLE),yes)
   include make/dmidecode.make
 endif
 ifeq ($(ETHTOOL_ENABLE),yes)
+  # ethtool's netlink interface needs libmnl.
+  include make/libmnl.make
   include make/ethtool.make
 endif
 ifeq ($(MTREE_ENABLE),yes)
@@ -441,9 +440,6 @@ endif
 ifeq ($(IPMITOOL_ENABLE),yes)
   include make/ipmitool.make
 endif
-ifeq ($(PESIGN_ENABLE),yes)
-  include make/pesign.make
-endif
 ifeq ($(OPENSSL_ENABLE),yes)
   include make/openssl.make
 endif
@@ -515,13 +511,11 @@ ifeq ($(FIRMWARE_UPDATE_ENABLE),yes)
   include make/firmware-update.make
 endif
 
-# Pre Debian 11 environments just had /usr/bin/python
-# Now the environment distinguishes between python2 and python3
-# If 'python' is not present, default to python2
-ifeq (, $(shell which python ))
-  export PYTHON=python2
-endif
-
+# Some sub-package build scripts (notably grub's autogen.sh) invoke the
+# interpreter as "${PYTHON:-python}".  A bare "python" no longer exists on
+# modern systems now that python2 is gone, so point $(PYTHON) at python3.
+# (grub's build scripts -- gentpl.py, import_gcry.py -- are python3-safe.)
+export PYTHON ?= python3
 
 #-------------------------------------------------------------------------------
 #
@@ -594,11 +588,11 @@ machine-prefix:
 # The onie/build-config/scripts/onie-build-targets.json file lists
 #  platforms and known working build environments.
 DEBIAN_BUILD_HOST_PACKAGES	= build-essential stgit u-boot-tools util-linux \
-				  gperf device-tree-compiler python-all-dev xorriso \
+				  gperf device-tree-compiler python3-all-dev xorriso \
 				  autoconf automake bison flex texinfo libtool libtool-bin \
 				  gawk libncurses5 libncurses5-dev bc \
 				  dosfstools mtools pkg-config git wget help2man libexpat1 \
-				  libexpat1-dev fakeroot python-sphinx rst2pdf \
+				  libexpat1-dev fakeroot python3-sphinx rst2pdf \
 				  libefivar-dev libnss3-tools libnss3-dev libpopt-dev \
 				  libssl-dev sbsigntool uuid-runtime uuid-dev cpio \
 				  bsdmainutils unzip