feat: Added rebasing to a signed image (#153)

ublue-os · Apr 27, 2024 · 03db412 · 03db412
1 parent 38a0a95
commit 03db412
Showing 1 changed file with 27 additions and 19 deletions.
diff --git a/examples/ucore-autorebase.butane b/examples/ucore-autorebase.butane
@@ -10,33 +10,41 @@ storage:
   directories:
     - path: /etc/ucore-autorebase
       mode: 0754
-  files:
-    - path: /etc/ucore-autorebase/ucore-autorebase.sh
-      contents:
-        inline: |
-          #!/usr/bin/bash
-          echo "Rebasing to uCore OCI in 5 seconds"
-          sleep 5
-          rpm-ostree rebase ostree-unverified-registry:ghcr.io/ublue-os/ucore:stable \
-            && touch /etc/ucore-autorebase/.complete \
-            && systemctl disable ucore-autorebase.service \
-            && systemctl reboot
-      mode: 0754
 systemd:
   units:
-    - name: ucore-autorebase.service
+    - name: ucore-unsigned-autorebase.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=uCore autorebase to unsigned OCI and reboot
+        ConditionPathExists=!/etc/ucore-autorebase/unverified
+        ConditionPathExists=!/etc/ucore-autorebase/signed
+        After=network-online.target
+        Wants=network-online.target
+        [Service]
+        Type=oneshot
+        StandardOutput=journal+console
+        ExecStart=/usr/bin/rpm-ostree rebase --bypass-driver ostree-unverified-registry:ghcr.io/ublue-os/ucore:stable
+        ExecStart=/usr/bin/touch /etc/ucore-autorebase/unverified
+        ExecStart=/usr/bin/systemctl disable ucore-unsigned-autorebase.service
+        ExecStart=/usr/bin/systemctl reboot
+        [Install]
+        WantedBy=multi-user.target
+    - name: ucore-signed-autorebase.service
       enabled: true
       contents: |
         [Unit]
-        Description=uCore autorebase to OCI and reboot
-        ConditionPathExists=!/etc/ucore-autorebase/.complete
-        ConditionFileIsExecutable=/etc/ucore-autorebase/ucore-autorebase.sh
+        Description=uCore autorebase to signed OCI and reboot
+        ConditionPathExists=/etc/ucore-autorebase/unverified
+        ConditionPathExists=!/etc/ucore-autorebase/verified
         After=network-online.target
         Wants=network-online.target
         [Service]
         Type=oneshot
         StandardOutput=journal+console
-        RemainAfterExit=yes
-        ExecStart=/etc/ucore-autorebase/ucore-autorebase.sh
+        ExecStart=/usr/bin/rpm-ostree rebase --bypass-driver ostree-image-signed:docker://ghcr.io/ublue-os/ucore:stable
+        ExecStart=/usr/bin/touch /etc/ucore-autorebase/signed
+        ExecStart=/usr/bin/systemctl disable ucore-signed-autorebase.service
+        ExecStart=/usr/bin/systemctl reboot
         [Install]
-        WantedBy=multi-user.target
+        WantedBy=multi-user.target