Files
Classroom_Desktop/tools/build-release.sh
T
ekklesiaandClaude Opus 5 a3dba6e8fb feat: provision Chrome and DVD codecs without a manual step
A fresh classroom needed two things installed by hand on every box:
Google Chrome, which is not in Debian, and the DVD codecs, which Debian
cannot ship. Both now happen on their own.

ekklesia-classroom-provision.service runs after every boot and does the
work that needs the network and the apt lock, neither of which a package
postinst can have. Each step returns immediately if it is already done,
so a provisioned machine costs nothing and a machine that was offline
the first time gets another go at the next boot. Nothing there is
allowed to fail the boot: a classroom with no DVD codecs is still a
working classroom, and it says so in the log rather than silently.

The postinst enables the service but deliberately does not start it.
Every OTA update reboots the moment the install finishes, and an apt run
killed by that reboot would leave dpkg half-configured.

Chrome comes from Google's own repository rather than a one-off .deb, so
it keeps getting security updates. Google's package migrates whatever we
write into a deb822 file of its own, so the repository is looked for
across every source file instead of only the one we would write;
otherwise a machine that had Chrome removed would end up with two copies
of the same repository.

The DVD codec helper previously assumed deb822 sources and did nothing
on a machine using a classic /etc/apt/sources.list, which is what the
hardware actually runs. It now handles both formats, and only ever adds
a missing component to an existing Debian entry — so it cannot produce a
duplicate repository or a duplicate component however many times it
runs, and third-party repositories like Chrome's are never touched. It
also answers libdvd-pkg's debconf questions, so nothing blocks on a
prompt in a service with no terminal.

Tested against fixture APT trees for classic sources.list, deb822
.sources, contrib already enabled, repeated runs, third-party
repositories and the awkward real lines: bracketed options, indentation,
trailing comments and flat repositories.

Co-Authored-By: Claude Opus 5 <[email protected]>
2026-09-04 21:33:44 -05:00

212 lines
5.7 KiB
Bash
Executable File

#!/bin/bash
set -euo pipefail
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT"
if [[ $# -ne 1 ]]; then
echo "Usage: $0 VERSION"
exit 1
fi
VERSION="$1"
if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
echo "Invalid version: $VERSION"
echo "Expected MAJOR.MINOR.PATCH, for example 0.1.6"
exit 1
fi
STAGE="$ROOT/packaging/root"
OUTPUT="$ROOT/dist/ekklesia-classroom_${VERSION}_amd64.deb"
# Syntax check everything the package ships, by shebang, so this cannot
# drift out of date as classroom commands are added.
echo "Validating sources"
for script in "$ROOT/packaging/debian/postinst" "$ROOT"/scripts/* "$ROOT"/tests/*; do
[[ -f "$script" ]] || continue
case "$(head -n 1 "$script")" in
*python3*)
python3 -m py_compile "$script"
;;
*bash*|*bin/sh*)
bash -n "$script"
;;
esac
done
for module in "$ROOT"/lib/*.py; do
[[ -f "$module" ]] || continue
python3 -m py_compile "$module"
done
for policy in "$ROOT"/config/chrome/policies/*/*.json; do
[[ -f "$policy" ]] || continue
python3 -c 'import json, sys; json.load(open(sys.argv[1]))' "$policy"
done
find "$ROOT/scripts" "$ROOT/lib" \
-name '__pycache__' -type d -prune -exec rm -rf {} + 2>/dev/null || true
for test in "$ROOT"/tests/test-*.sh; do
[[ -x "$test" ]] || continue
echo "Running $(basename "$test")"
"$test" > /dev/null || {
echo "Tests failed. Run it directly to see why:"
echo " $test"
exit 1
}
done
echo "Building Ekklesia Classroom ${VERSION}"
# Always construct the package from clean canonical sources.
rm -rf "$STAGE"
mkdir -p "$STAGE/DEBIAN" "$ROOT/dist"
# Debian package metadata.
sed \
"s/^Version: @VERSION@$/Version: ${VERSION}/" \
"$ROOT/packaging/debian/control.template" \
> "$STAGE/DEBIAN/control"
install -m755 \
"$ROOT/packaging/debian/postinst" \
"$STAGE/DEBIAN/postinst"
# Classroom UI configuration.
install -Dm644 \
"$ROOT/config/sway/config" \
"$STAGE/etc/ekklesia-classroom/sway/config"
install -Dm644 \
"$ROOT/config/waybar/config.jsonc" \
"$STAGE/etc/ekklesia-classroom/waybar/config.jsonc"
install -Dm644 \
"$ROOT/config/waybar/style.css" \
"$STAGE/etc/ekklesia-classroom/waybar/style.css"
# Classroom commands.
install -Dm755 \
"$ROOT/scripts/classroom-browser" \
"$STAGE/usr/local/bin/classroom-browser"
install -Dm755 \
"$ROOT/scripts/classroom-window" \
"$STAGE/usr/local/bin/classroom-window"
install -Dm755 \
"$ROOT/scripts/classroom-dvd" \
"$STAGE/usr/local/bin/classroom-dvd"
install -Dm755 \
"$ROOT/scripts/classroom-dvd-css-setup" \
"$STAGE/usr/local/bin/classroom-dvd-css-setup"
install -Dm755 \
"$ROOT/scripts/classroom-notify-test" \
"$STAGE/usr/local/bin/classroom-notify-test"
install -Dm755 \
"$ROOT/scripts/classroom-notifications" \
"$STAGE/usr/local/bin/classroom-notifications"
install -Dm755 \
"$ROOT/scripts/classroom-chrome-setup" \
"$STAGE/usr/local/bin/classroom-chrome-setup"
install -Dm755 \
"$ROOT/scripts/classroom-provision" \
"$STAGE/usr/local/bin/classroom-provision"
# Shared helpers imported by the classroom commands.
install -Dm644 \
"$ROOT/lib/classroom_config.py" \
"$STAGE/usr/local/lib/ekklesia-classroom/classroom_config.py"
install -Dm644 \
"$ROOT/lib/classroom_optical.py" \
"$STAGE/usr/local/lib/ekklesia-classroom/classroom_optical.py"
install -Dm644 \
"$ROOT/config/wallpapers/classroom-default.png" \
"$STAGE/usr/share/backgrounds/ekklesia/classroom-default.png"
install -Dm755 \
"$ROOT/scripts/classroom-dock" \
"$STAGE/usr/local/bin/classroom-dock"
# Stylesheet and notification templates. Both carry measurement tokens
# that are resolved from UI_SCALE when the session starts.
install -Dm644 \
"$ROOT/config/dock/style.css.in" \
"$STAGE/etc/ekklesia-classroom/dock/style.css.in"
install -Dm644 \
"$ROOT/config/mako/config.in" \
"$STAGE/etc/ekklesia-classroom/mako/config.in"
# Chrome enterprise policy: suppress first-run and sign-in nags, and pin
# Home to Wonder Ink. Nothing here restricts where teachers can browse.
install -Dm644 \
"$ROOT/config/chrome/policies/managed/ekklesia-classroom.json" \
"$STAGE/etc/opt/chrome/policies/managed/ekklesia-classroom.json"
install -Dm644 \
"$ROOT/config/chrome/policies/recommended/ekklesia-classroom.json" \
"$STAGE/etc/opt/chrome/policies/recommended/ekklesia-classroom.json"
install -Dm755 \
"$ROOT/scripts/ekklesia-classroom-update" \
"$STAGE/usr/local/bin/ekklesia-classroom-update"
# System configuration.
install -Dm644 \
"$ROOT/systemd/autologin/autologin.conf" \
"$STAGE/etc/systemd/system/[email protected]/autologin.conf"
install -Dm644 \
"$ROOT/systemd/updater/ekklesia-classroom-update.service" \
"$STAGE/etc/systemd/system/ekklesia-classroom-update.service"
install -Dm644 \
"$ROOT/systemd/updater/ekklesia-classroom-update.timer" \
"$STAGE/etc/systemd/system/ekklesia-classroom-update.timer"
install -Dm644 \
"$ROOT/systemd/provision/ekklesia-classroom-provision.service" \
"$STAGE/etc/systemd/system/ekklesia-classroom-provision.service"
install -Dm644 \
"$ROOT/config/icons/dvd.svg" \
"$STAGE/etc/ekklesia-classroom/icons/dvd.svg"
install -Dm644 \
"$ROOT/config/icons/live.svg" \
"$STAGE/etc/ekklesia-classroom/icons/live.svg"
install -Dm644 \
"$ROOT/config/icons/live-off.svg" \
"$STAGE/etc/ekklesia-classroom/icons/live-off.svg"
install -Dm644 \
"$ROOT/config/icons/browser.svg" \
"$STAGE/etc/ekklesia-classroom/icons/browser.svg"
printf '%s\n' "$VERSION" > "$ROOT/VERSION"
dpkg-deb \
--root-owner-group \
--build "$STAGE" "$OUTPUT"
echo
echo "Built:"
echo "$OUTPUT"
sha256sum "$OUTPUT"