From e06b33125a8b0321c933e3c2c0a17714f68042fa Mon Sep 17 00:00:00 2001 From: Simon Beaudoin Date: Mon, 29 Jun 2026 11:50:29 -0700 Subject: [PATCH 1/2] add debusine source wiring for trixie Add Debusine signing key material and a trixie qli.sources file. Switch the trixie Debian Dockerfile to seed qli sources instead of qsc-deb-releases. Signed-off-by: Simon Beaudoin --- Dockerfiles/Dockerfile.debian.trixie | 10 +++++----- Dockerfiles/keyrings/debusine.asc | 9 +++++++++ Dockerfiles/sources/trixie/qli.sources | 7 +++++++ Dockerfiles/sources/trixie/qsc-deb-releases.sources | 9 --------- 4 files changed, 21 insertions(+), 14 deletions(-) create mode 100644 Dockerfiles/keyrings/debusine.asc create mode 100644 Dockerfiles/sources/trixie/qli.sources delete mode 100644 Dockerfiles/sources/trixie/qsc-deb-releases.sources diff --git a/Dockerfiles/Dockerfile.debian.trixie b/Dockerfiles/Dockerfile.debian.trixie index c055a7e..8488c7c 100644 --- a/Dockerfiles/Dockerfile.debian.trixie +++ b/Dockerfiles/Dockerfile.debian.trixie @@ -1,4 +1,4 @@ -# Use an official Ubuntu base image +# Use an official Debian base image FROM debian:trixie LABEL org.opencontainers.image.source=https://github.com/qualcomm-linux/docker-pkg-build @@ -14,7 +14,7 @@ RUN apt-get update && \ COPY extra-packages.txt /tmp/extra-packages.txt COPY keyrings/ /tmp/keyrings/ -COPY sources/trixie/qsc-deb-releases.sources /tmp/qsc-deb-releases.sources +COPY sources/trixie/qli.sources /tmp/qli.sources RUN EXTRA_PACKAGES=$(tr -s '[:space:]' ',' < /tmp/extra-packages.txt) && \ sbuild-createchroot --include="$EXTRA_PACKAGES" \ @@ -24,11 +24,11 @@ RUN EXTRA_PACKAGES=$(tr -s '[:space:]' ',' < /tmp/extra-packages.txt) && \ /srv/chroot/trixie \ http://deb.debian.org/debian && \ mkdir -p /srv/chroot/trixie/etc/apt/keyrings && \ - cp /tmp/keyrings/qsc-deb-releases.asc /srv/chroot/trixie/etc/apt/keyrings/ && \ - cp /tmp/qsc-deb-releases.sources /srv/chroot/trixie/etc/apt/sources.list.d/ + cp /tmp/keyrings/*.asc /srv/chroot/trixie/etc/apt/keyrings/ && \ + cp /tmp/qli.sources /srv/chroot/trixie/etc/apt/sources.list.d/ # Set working directory WORKDIR /workspace # Default command -CMD [ "bash" ] \ No newline at end of file +CMD [ "bash" ] diff --git a/Dockerfiles/keyrings/debusine.asc b/Dockerfiles/keyrings/debusine.asc new file mode 100644 index 0000000..e60ad87 --- /dev/null +++ b/Dockerfiles/keyrings/debusine.asc @@ -0,0 +1,9 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mDMEag8p/xYJKwYBBAHaRw8BAQdAdB6JSNF1OXxnsTgp4VTUekW52BM7e6ZQVRsq +QT5QDaS0JEFyY2hpdmUgc2lnbmluZyBrZXkgZm9yIHF1YWxjb21tL3FsaYiQBBMW +CgA4FiEEOwuFfyf8aPE5SQakb8qSvoHfw8IFAmoPKf8CGwMFCwkIBwIGFQoJCAsC +BBYCAwECHgECF4AACgkQb8qSvoHfw8Lz1gEA9XocADbvqUgZQc0LceThn7vMI98d +kTJoiInuulQ6rEUBANo+GOKILH71VRnZ5jWtsu7IlVk7oUMlTtC0eE5tcBwB +=bX6V +-----END PGP PUBLIC KEY BLOCK----- diff --git a/Dockerfiles/sources/trixie/qli.sources b/Dockerfiles/sources/trixie/qli.sources new file mode 100644 index 0000000..690e7da --- /dev/null +++ b/Dockerfiles/sources/trixie/qli.sources @@ -0,0 +1,7 @@ +# Qualcomm Linux repository +Types: deb +URIs: https://deb.debusine.qualcomm.com/qualcomm/qli +Suites: trixie +Components: main contrib non-free-firmware non-free +Signed-By: /etc/apt/keyrings/debusine.asc +Enabled: yes diff --git a/Dockerfiles/sources/trixie/qsc-deb-releases.sources b/Dockerfiles/sources/trixie/qsc-deb-releases.sources deleted file mode 100644 index 337e51d..0000000 --- a/Dockerfiles/sources/trixie/qsc-deb-releases.sources +++ /dev/null @@ -1,9 +0,0 @@ -# QArtifactory qsc-deb-releases repository -# NB: publishing Sources indices for deb-src isn't supported by Artifactory, -# but sources are published with other packages files -Types: deb -URIs: https://qartifactory-edge.qualcomm.com/artifactory/qsc-deb-releases -Suites: trixie -Components: main -Signed-By: /etc/apt/keyrings/qsc-deb-releases.asc -Enabled: yes From c88d8f109bef0d37a49ded189a1a3c9ec4cdce95 Mon Sep 17 00:00:00 2001 From: Simon Beaudoin Date: Mon, 29 Jun 2026 11:50:41 -0700 Subject: [PATCH 2/2] drop qsc apt repo from debian suites Remove sid qsc-deb-releases defaults from Debian builder inputs. Document the Ubuntu qsc vs Debian trixie qli source split and sid behavior in AGENTS.md and README.md. Signed-off-by: Simon Beaudoin --- AGENTS.md | 11 +++++++---- Dockerfiles/Dockerfile.debian.sid | 7 +++---- Dockerfiles/sources/sid/qsc-deb-releases.sources | 9 --------- README.md | 4 +++- docker_deb_build.py | 2 +- 5 files changed, 14 insertions(+), 19 deletions(-) delete mode 100644 Dockerfiles/sources/sid/qsc-deb-releases.sources diff --git a/AGENTS.md b/AGENTS.md index 15163e3..078c187 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -18,8 +18,10 @@ Dockerfiles/ extra-packages.txt # Packages installed inside the build chroot keyrings/ qsc-deb-releases.asc # Qualcomm APT repo PGP public key + debusine.asc # Qualcomm Debusine qli repo PGP public key sources/ - /qsc-deb-releases.sources # Pre-configured Qualcomm APT source entry per distro + /qsc-deb-releases.sources # QArtifactory source entry + /qli.sources # Debusine qli source entry ``` ## Supported Distros @@ -41,9 +43,10 @@ Dockerfiles/ with a plain one that lacks Qualcomm APT sources. - **CA certificates in chroot**: The chroot tarball must include `ca-certificates` and `openssl` so that HTTPS APT repositories work inside the chroot at build time. -- **Qualcomm APT key**: All chroots have the Qualcomm PGP key pre-installed at - `/etc/apt/keyrings/qsc-deb-releases.asc` and a matching `.sources` file so that packages from - `qartifactory-edge.qualcomm.com` are available without `trusted=yes` or `--extra-repo`. +- **Qualcomm APT sources**: + - Ubuntu chroots include `qsc-deb-releases.sources` from `qartifactory-edge.qualcomm.com`. + - Debian `trixie` chroots include `qli.sources` from `deb.debusine.qualcomm.com`. + - `sid` includes no default Qualcomm source and relies on caller-provided `--extra-repo` when needed. ## Common Commands diff --git a/Dockerfiles/Dockerfile.debian.sid b/Dockerfiles/Dockerfile.debian.sid index bc8e111..99ffdad 100644 --- a/Dockerfiles/Dockerfile.debian.sid +++ b/Dockerfiles/Dockerfile.debian.sid @@ -27,14 +27,13 @@ RUN apt-get update && \ COPY extra-packages.txt /tmp/extra-packages.txt COPY keyrings/ /tmp/keyrings/ -COPY sources/sid/qsc-deb-releases.sources /tmp/qsc-deb-releases.sources # sbuild's unshare backend looks for a pre-built tarball at # /root/.cache/sbuild/-.tar — create it with mmdebstrap # so builds don't regenerate it every time, and include ca-certificates # so HTTPS extra-repositories work. -# The customize-hook installs the Qualcomm APT signing key so that callers can -# use signed-by=/etc/apt/keyrings/qsc-deb-releases.asc instead of trusted=yes. +# The customize-hook installs available Qualcomm APT signing keys so callers +# can pass signed-by extra repositories when needed. RUN EXTRA_PACKAGES=$(tr -s '[:space:]' ',' < /tmp/extra-packages.txt) && \ mkdir -p /root/.cache/sbuild && \ mmdebstrap --variant=buildd \ @@ -43,7 +42,7 @@ RUN EXTRA_PACKAGES=$(tr -s '[:space:]' ',' < /tmp/extra-packages.txt) && \ --skip=output/mknod \ --format=tar \ --components=main,contrib,non-free,non-free-firmware \ - --customize-hook='mkdir -p "$1/etc/apt/keyrings" && cp /tmp/keyrings/qsc-deb-releases.asc "$1/etc/apt/keyrings/" && mkdir -p "$1/etc/apt/sources.list.d" && cp /tmp/qsc-deb-releases.sources "$1/etc/apt/sources.list.d/"' \ + --customize-hook='mkdir -p "$1/etc/apt/keyrings" && cp /tmp/keyrings/*.asc "$1/etc/apt/keyrings/"' \ sid \ /root/.cache/sbuild/sid-arm64.tar diff --git a/Dockerfiles/sources/sid/qsc-deb-releases.sources b/Dockerfiles/sources/sid/qsc-deb-releases.sources deleted file mode 100644 index 4fda7bf..0000000 --- a/Dockerfiles/sources/sid/qsc-deb-releases.sources +++ /dev/null @@ -1,9 +0,0 @@ -# QArtifactory qsc-deb-releases repository -# NB: publishing Sources indices for deb-src isn't supported by Artifactory, -# but sources are published with other packages files -Types: deb -URIs: https://qartifactory-edge.qualcomm.com/artifactory/qsc-deb-releases -Suites: sid -Components: main -Signed-By: /etc/apt/keyrings/qsc-deb-releases.asc -Enabled: yes diff --git a/README.md b/README.md index c14b20b..ae45164 100644 --- a/README.md +++ b/README.md @@ -136,7 +136,9 @@ docker_deb_build.py \ ### Docker Images To add a new suite, copy an existing suite Dockerfile in `Dockerfiles/` and adapt it for the new release. -Also add the suite-specific Qualcomm source file under `Dockerfiles/sources//qsc-deb-releases.sources`. +Also add any suite-specific Qualcomm source files under `Dockerfiles/sources//`: +- Ubuntu suites use `qsc-deb-releases.sources` +- Debian `trixie` uses `qli.sources` The last step is to ensure the new image is also pushed to GHCR as part of the `.github/workflows/qcom-container-build-and-upload.yml` workflow by adding a new line in the diff --git a/docker_deb_build.py b/docker_deb_build.py index 81f8427..373a2b5 100755 --- a/docker_deb_build.py +++ b/docker_deb_build.py @@ -26,7 +26,7 @@ from color_logger import logger # Docker image name template -# suite_name: 'noble', 'questing', 'sid' +# suite_name: 'noble', 'questing', 'trixie', 'sid' # Example: ghcr.io/qualcomm-linux/pkg-builder:noble DOCKER_IMAGE_NAME_FMT = "ghcr.io/qualcomm-linux/pkg-builder:{suite_name}"