diff --git a/README.md b/README.md index 2a3467f..f4fe3eb 100644 --- a/README.md +++ b/README.md @@ -1 +1,2 @@ -# red-hat-kiosk \ No newline at end of file +# A Kiosk based on Red Hat Device Edge and Microshift + diff --git a/application/Dockerfile b/application/Dockerfile index c75656c..3c35911 100644 --- a/application/Dockerfile +++ b/application/Dockerfile @@ -5,7 +5,7 @@ FROM python:3.8-slim WORKDIR /app # Copy the current directory contents into the container at /app -COPY . /app +COPY src /app # Install any needed packages specified in requirements.txt RUN pip install --trusted-host pypi.python.org Flask @@ -18,3 +18,4 @@ ENV NAME World # Run app.py when the container launches CMD ["python", "app.py"] + \ No newline at end of file diff --git a/application/README.md b/application/README.md new file mode 100644 index 0000000..9f46e7a --- /dev/null +++ b/application/README.md @@ -0,0 +1,32 @@ +# Sample kiosk application + +Build the container image. + +```sh +podman build -t localhost/kiosk-app:latest . +``` + +Run the container image. + +```sh +podman run -it --rm --name kiosk-app -p 5000:5000 localhost/kiosk-app:latest +``` + +Test it. + +```sh +curl -I http://localhost:5000/ +``` + +Login to the registry. + +```sh +podman login quay.io +``` + +Publish it to the registry. + +```sh +podman tag localhost/kiosk-app:latest quay.io/nmasse_itix/kiosk-app:latest +podman push quay.io/nmasse_itix/kiosk-app:latest +``` diff --git a/chrome_repackage/README.md b/chrome_repackage/README.md deleted file mode 100644 index 3775dce..0000000 --- a/chrome_repackage/README.md +++ /dev/null @@ -1,70 +0,0 @@ -# Google Chrome RPM Installation Guide - -This guide provides step-by-step instructions for downloading and rebuilding the Google Chrome RPM package on a RPM-based Linux distribution. - -## Prerequisites - -Before you proceed, ensure that you have the following prerequisites installed on your system: - -- `rpmrebuild`: A tool for rebuilding RPM packages. -- `rpmbuild`: The RPM Package Manager build tool. - -## Installation Steps - -1. **Download Google RPM** - - ```bash - # Replace with the actual download URL - wget /google-chrome-stable-119.0.6045.199-1.x86_64.rpm - ``` - -2. **Rebuild the RPM Package** - - ```bash - rpmrebuild -s google-chrome-stable.spec -p google-chrome-stable-119.0.6045.199-1.x86_64.rpm - ``` - -3. **Extract the Contents** - - ```bash - rpm2cpio google-chrome-stable-119.0.6045.199-1.x86_64.rpm | cpio -idmv - ``` - -4. **Move Google Chrome to the Desired Location** - - ```bash - mv opt/google usr/bin/ - ``` - -5. **Create Symbolic Links** - - ```bash - cd usr/bin/ - rm -f google-chrome-stable - ln -s google/chrome/google-chrome google-chrome-stable - ln -s google/chrome/google-chrome chrome - cd ../.. - ``` - -6. **Create RPM Build Directory** - - ```bash - mkdir -p $HOME/rpmbuild/BUILDROOT/google-chrome-stable-119.0.6045.199-1.x86_64 - ``` - -7. **Copy Files to RPM Build Directory** - - ```bash - for i in etc usr; do cp -r $i $HOME/rpmbuild/BUILDROOT/google-chrome-stable-119.0.6045.199-1.x86_64/; done - ``` - -8. **Build the RPM Package** - - ```bash - rpmbuild -bb google-chrome-stable.spec - ``` - -After completing these steps, you should have successfully downloaded, rebuilt, and repackaged the Google Chrome RPM for your system. The resulting RPM package will be available in the RPM build directory (`$HOME/rpmbuild/RPMS/x86_64/`). - -Note: Ensure that you replace `` with the actual download URL of the Google Chrome RPM. - diff --git a/chrome_repackage/google_chrome_repackage.spec b/chrome_repackage/google_chrome_repackage.spec deleted file mode 100644 index 18660c6..0000000 --- a/chrome_repackage/google_chrome_repackage.spec +++ /dev/null @@ -1,1555 +0,0 @@ -# rpmrebuild autogenerated specfile - -BuildRoot: /home/cloud-user/.tmp/rpmrebuild.469989/work/root -AutoProv: no -%undefine __find_provides -AutoReq: no -%undefine __find_requires -# Do not try autogenerate prereq/conflicts/obsoletes and check files -%undefine __check_files -%undefine __find_prereq -%undefine __find_conflicts -%undefine __find_obsoletes -# Be sure buildpolicy set to do nothing -%define __spec_install_post %{nil} -# Something that need for rpm-4.1 -%define _missing_doc_files_terminate_build 0 -#dummy -#dummy -#BUILDHOST: NSJAIL -#BUILDTIME: Mon Nov 27 16:02:46 2023 -#SOURCERPM: google-chrome-stable-119.0.6045.199-1.src.rpm - -#RPMVERSION: 4.14.1 - - - -#OS: linux -#SIZE: 334068301 -#ARCHIVESIZE: 334084684 -#ARCH: x86_64 -BuildArch: x86_64 -Name: google-chrome-stable -Version: 119.0.6045.199 -Release: 1 -License: Multiple, see https://chrome.google.com/ -Group: Applications/Internet -Summary: Google Chrome - - -URL: https://chrome.google.com/ -Vendor: Google LLC -Packager: Chrome Linux Team - - - - - -Prefix: /usr/bin -Provides: google-chrome = 119.0.6045.199 -Provides: google-chrome-stable = 119.0.6045.199-1 -Provides: google-chrome-stable(x86-64) = 119.0.6045.199-1 -Requires(pre): /bin/sh -Requires(post): /bin/sh -Requires(preun): /bin/sh -Requires(postun): /bin/sh -Requires(post): /usr/sbin/update-alternatives -Requires(preun): /usr/sbin/update-alternatives -Requires: ca-certificates -Requires: ld-linux-x86-64.so.2()(64bit) -Requires: ld-linux-x86-64.so.2(GLIBC_2.2.5)(64bit) -Requires: ld-linux-x86-64.so.2(GLIBC_2.3)(64bit) -Requires: libX11.so.6()(64bit) -Requires: libXcomposite.so.1()(64bit) -Requires: libXdamage.so.1()(64bit) -Requires: libXext.so.6()(64bit) -Requires: libXfixes.so.3()(64bit) -Requires: libXrandr.so.2()(64bit) -Requires: libasound.so.2()(64bit) -Requires: libasound.so.2(ALSA_0.9)(64bit) -Requires: libasound.so.2(ALSA_0.9.0rc4)(64bit) -Requires: libatk-1.0.so.0()(64bit) -Requires: libatk-bridge-2.0.so.0()(64bit) -Requires: libatspi.so.0()(64bit) -Requires: libc.so.6()(64bit) -Requires: libc.so.6(GLIBC_2.10)(64bit) -Requires: libc.so.6(GLIBC_2.11)(64bit) -Requires: libc.so.6(GLIBC_2.14)(64bit) -Requires: libc.so.6(GLIBC_2.15)(64bit) -Requires: libc.so.6(GLIBC_2.16)(64bit) -Requires: libc.so.6(GLIBC_2.17)(64bit) -Requires: libc.so.6(GLIBC_2.2.5)(64bit) -Requires: libc.so.6(GLIBC_2.3)(64bit) -Requires: libc.so.6(GLIBC_2.3.2)(64bit) -Requires: libc.so.6(GLIBC_2.3.3)(64bit) -Requires: libc.so.6(GLIBC_2.3.4)(64bit) -Requires: libc.so.6(GLIBC_2.4)(64bit) -Requires: libc.so.6(GLIBC_2.6)(64bit) -Requires: libc.so.6(GLIBC_2.7)(64bit) -Requires: libc.so.6(GLIBC_2.8)(64bit) -Requires: libc.so.6(GLIBC_2.9)(64bit) -Requires: libcairo.so.2()(64bit) -Requires: libcups.so.2()(64bit) -Requires: libcurl.so.4()(64bit) -Requires: libdbus-1.so.3()(64bit) -Requires: libdbus-1.so.3(LIBDBUS_1_3)(64bit) -Requires: libdl.so.2()(64bit) -Requires: libdl.so.2(GLIBC_2.2.5)(64bit) -Requires: libdrm.so.2()(64bit) -Requires: liberation-fonts -Requires: libexpat.so.1()(64bit) -Requires: libgbm.so.1()(64bit) -Requires: libgcc_s.so.1()(64bit) -Requires: libgcc_s.so.1(GCC_3.0)(64bit) -Requires: libgio-2.0.so.0()(64bit) -Requires: libglib-2.0.so.0()(64bit) -Requires: libgobject-2.0.so.0()(64bit) -Requires: libgtk-3.so.0()(64bit) -Requires: libm.so.6()(64bit) -Requires: libm.so.6(GLIBC_2.2.5)(64bit) -Requires: libnspr4.so()(64bit) -Requires: libnss3.so()(64bit) -Requires: libnss3.so(NSS_3.11)(64bit) -Requires: libnss3.so(NSS_3.12)(64bit) -Requires: libnss3.so(NSS_3.12.1)(64bit) -Requires: libnss3.so(NSS_3.12.4)(64bit) -Requires: libnss3.so(NSS_3.2)(64bit) -Requires: libnss3.so(NSS_3.22)(64bit) -Requires: libnss3.so(NSS_3.3)(64bit) -Requires: libnss3.so(NSS_3.30)(64bit) -Requires: libnss3.so(NSS_3.31)(64bit) -Requires: libnss3.so(NSS_3.39)(64bit) -Requires: libnss3.so(NSS_3.4)(64bit) -Requires: libnss3.so(NSS_3.5)(64bit) -Requires: libnss3.so(NSS_3.6)(64bit) -Requires: libnss3.so(NSS_3.7)(64bit) -Requires: libnss3.so(NSS_3.9.2)(64bit) -Requires: libnssutil3.so()(64bit) -Requires: libnssutil3.so(NSSUTIL_3.12.3)(64bit) -Requires: libpango-1.0.so.0()(64bit) -Requires: libpthread.so.0()(64bit) -Requires: libpthread.so.0(GLIBC_2.12)(64bit) -Requires: libpthread.so.0(GLIBC_2.2.5)(64bit) -Requires: libpthread.so.0(GLIBC_2.3.2)(64bit) -Requires: libpthread.so.0(GLIBC_2.3.3)(64bit) -Requires: libpthread.so.0(GLIBC_2.3.4)(64bit) -Requires: librt.so.1()(64bit) -Requires: librt.so.1(GLIBC_2.2.5)(64bit) -Requires: libsmime3.so()(64bit) -Requires: libsmime3.so(NSS_3.10)(64bit) -Requires: libsmime3.so(NSS_3.2)(64bit) -Requires: libvulkan.so.1()(64bit) -Requires: libxcb.so.1()(64bit) -Requires: libxkbcommon.so.0()(64bit) -Requires: libxkbcommon.so.0(V_0.5.0)(64bit) -#Requires: rpmlib(CompressedFileNames) <= 3.0.4-1 -#Requires: rpmlib(FileDigests) <= 4.6.0-1 -#Requires: rpmlib(PayloadFilesHavePrefix) <= 4.0-1 -#Requires: rpmlib(PayloadIsXz) <= 5.2-1 -Requires: rtld(GNU_HASH) -Requires: wget -Requires: xdg-utils - - - - - -%description -The web browser from Google - -Google Chrome is a browser that combines a minimal design with sophisticated technology to make the web faster, safer, and easier. -%files -%attr(0755, root, root) "/etc/cron.daily/google-chrome" -%dir %attr(0755, root, root) "/usr/bin/google/chrome" -%dir %attr(0755, root, root) "/usr/bin/google/chrome/MEIPreload" -%attr(0644, root, root) "/usr/bin/google/chrome/MEIPreload/manifest.json" -%attr(0644, root, root) "/usr/bin/google/chrome/MEIPreload/preloaded_data.pb" -%dir %attr(0755, root, root) "/usr/bin/google/chrome/WidevineCdm" -%attr(0644, root, root) "/usr/bin/google/chrome/WidevineCdm/LICENSE" -%dir %attr(0755, root, root) "/usr/bin/google/chrome/WidevineCdm/_platform_specific" -%dir %attr(0755, root, root) "/usr/bin/google/chrome/WidevineCdm/_platform_specific/linux_x64" -%attr(0755, root, root) "/usr/bin/google/chrome/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so" -%attr(0644, root, root) "/usr/bin/google/chrome/WidevineCdm/manifest.json" -%attr(0755, root, root) "/usr/bin/google/chrome/chrome" -%attr(0755, root, root) "/usr/bin/google/chrome/chrome-management-service" -%attr(4755, root, root) "/usr/bin/google/chrome/chrome-sandbox" -%attr(0644, root, root) "/usr/bin/google/chrome/chrome_100_percent.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/chrome_200_percent.pak" -%attr(0755, root, root) "/usr/bin/google/chrome/chrome_crashpad_handler" -%attr(0644, root, root) "/usr/bin/google/chrome/default-app-block" -%dir %attr(0755, root, root) "/usr/bin/google/chrome/default_apps" -%attr(0644, root, root) "/usr/bin/google/chrome/default_apps/external_extensions.json" -%attr(0755, root, root) "/usr/bin/google/chrome/google-chrome" -%attr(0644, root, root) "/usr/bin/google/chrome/icudtl.dat" -%attr(0755, root, root) "/usr/bin/google/chrome/libEGL.so" -%attr(0755, root, root) "/usr/bin/google/chrome/libGLESv2.so" -%attr(0755, root, root) "/usr/bin/google/chrome/liboptimization_guide_internal.so" -%attr(0755, root, root) "/usr/bin/google/chrome/libqt5_shim.so" -%attr(0755, root, root) "/usr/bin/google/chrome/libqt6_shim.so" -%attr(0755, root, root) "/usr/bin/google/chrome/libvk_swiftshader.so" -%attr(0755, root, root) "/usr/bin/google/chrome/libvulkan.so.1" -%dir %attr(0755, root, root) "/usr/bin/google/chrome/locales" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/af.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/am.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ar.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/bg.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/bn.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ca.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/cs.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/da.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/de.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/el.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/en-GB.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/en-US.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/es-419.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/es.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/et.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/fa.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/fi.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/fil.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/fr.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/gu.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/he.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/hi.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/hr.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/hu.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/id.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/it.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ja.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/kn.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ko.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/lt.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/lv.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ml.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/mr.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ms.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/nb.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/nl.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/pl.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/pt-BR.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/pt-PT.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ro.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ru.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/sk.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/sl.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/sr.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/sv.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/sw.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ta.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/te.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/th.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/tr.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/uk.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ur.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/vi.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/zh-CN.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/zh-TW.pak" -%attr(0755, root, root) "/usr/bin/google/chrome/nacl_helper" -%attr(0755, root, root) "/usr/bin/google/chrome/nacl_helper_bootstrap" -%attr(0644, root, root) "/usr/bin/google/chrome/nacl_irt_x86_64.nexe" -%attr(0644, root, root) "/usr/bin/google/chrome/product_logo_128.png" -%attr(0644, root, root) "/usr/bin/google/chrome/product_logo_16.png" -%attr(0644, root, root) "/usr/bin/google/chrome/product_logo_24.png" -%attr(0644, root, root) "/usr/bin/google/chrome/product_logo_256.png" -%attr(0644, root, root) "/usr/bin/google/chrome/product_logo_32.png" -%attr(0644, root, root) "/usr/bin/google/chrome/product_logo_32.xpm" -%attr(0644, root, root) "/usr/bin/google/chrome/product_logo_48.png" -%attr(0644, root, root) "/usr/bin/google/chrome/product_logo_64.png" -%attr(0644, root, root) "/usr/bin/google/chrome/resources.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/v8_context_snapshot.bin" -%attr(0644, root, root) "/usr/bin/google/chrome/vk_swiftshader_icd.json" -%attr(0755, root, root) "/usr/bin/google/chrome/xdg-mime" -%attr(0755, root, root) "/usr/bin/google/chrome/xdg-settings" -%ghost %attr(0755, root, root) %verify(not md5 size link mtime) "/usr/bin/google-chrome" -%attr(0777, root, root) "/usr/bin/google-chrome-stable" -%attr(0644, root, root) "/usr/share/appdata/google-chrome.appdata.xml" -%attr(0644, root, root) "/usr/share/applications/google-chrome.desktop" -%attr(0644, root, root) "/usr/share/gnome-control-center/default-apps/google-chrome.xml" -%doc %attr(0644, root, root) "/usr/share/man/man1/google-chrome-stable.1.gz" -%doc %attr(0777, root, root) "/usr/share/man/man1/google-chrome.1.gz" - - -%pre -p /bin/sh - -exit 0 - - - - -#------------------------------------------------------------------------------ -# Post install script -#------------------------------------------------------------------------------ - - -%post -p /bin/sh - -# System-wide package configuration. -DEFAULTS_FILE="/etc/default/google-chrome" - -# Add icons to the system icons -XDG_ICON_RESOURCE="`command -v xdg-icon-resource 2> /dev/null || true`" -if [ ! -x "$XDG_ICON_RESOURCE" ]; then - echo "Error: Could not find xdg-icon-resource" >&2 - exit 1 -fi -for icon in product_logo_32.png product_logo_48.png product_logo_256.png product_logo_128.png product_logo_16.png product_logo_64.png product_logo_24.png ; do - size="$(echo ${icon} | sed 's/[^0-9]//g')" - "$XDG_ICON_RESOURCE" install --size "${size}" "/usr/bin/google/chrome/${icon}" \ - "google-chrome" -done - -UPDATE_MENUS="`command -v update-menus 2> /dev/null || true`" -if [ -x "$UPDATE_MENUS" ]; then - update-menus -fi - -# Update cache of .desktop file MIME types. Non-fatal since it's just a cache. -update-desktop-database > /dev/null 2>&1 || true - -# Updates defaults.list file if present. -update_defaults_list() { - # $1: name of the .desktop file - - local DEFAULTS_LIST="/usr/share/applications/defaults.list" - - if [ ! -f "${DEFAULTS_LIST}" ]; then - return - fi - - # Split key-value pair out of MimeType= line from the .desktop file, - # then split semicolon-separated list of mime types (they should not contain - # spaces). - mime_types="$(grep MimeType= /usr/share/applications/${1} | - cut -d '=' -f 2- | - tr ';' ' ')" - for mime_type in ${mime_types}; do - if egrep -q "^${mime_type}=" "${DEFAULTS_LIST}"; then - if ! egrep -q "^${mime_type}=.*${1}" "${DEFAULTS_LIST}"; then - default_apps="$(grep ${mime_type}= "${DEFAULTS_LIST}" | - cut -d '=' -f 2-)" - egrep -v "^${mime_type}=" "${DEFAULTS_LIST}" > "${DEFAULTS_LIST}.new" - echo "${mime_type}=${default_apps};${1}" >> "${DEFAULTS_LIST}.new" - mv "${DEFAULTS_LIST}.new" "${DEFAULTS_LIST}" - fi - else - # If there's no mention of the mime type in the file, add it. - echo "${mime_type}=${1};" >> "${DEFAULTS_LIST}" - fi - done -} - -update_defaults_list "google-chrome.desktop" - -# This function uses sed to insert the contents of one file into another file, -# after the first line matching a given regular expression. If there is no -# matching line, then the file is unchanged. -insert_after_first_match() { - # $1: file to update - # $2: regular expression - # $3: file to insert - sed -i -e "1,/$2/ { - /$2/ r $3 - }" "$1" -} - -# If /usr/share/gnome-control-center/default-apps/gnome-default-applications.xml -# exists, it may need to be updated to add ourselves to the default applications -# list. If we find the file and it does not seem to contain our patch already -# (the patch is safe to leave even after uninstall), update it. -GNOME_DFL_APPS=/usr/share/gnome-control-center/default-apps/gnome-default-applications.xml -if [ -f "$GNOME_DFL_APPS" ]; then -# Conditionally insert the contents of the file "default-app-block" after the -# first "" line we find in gnome-default-applications.xml - fgrep -q "Google Chrome" "$GNOME_DFL_APPS" || insert_after_first_match \ - "$GNOME_DFL_APPS" \ - "^[ ]*[ ]*$" \ - "/usr/bin/google/chrome/default-app-block" -fi - -# This function performs the setup for the chrome management service process. -# It creates a new chromemgmt group, creates the signing key file, and updates -# permissions for both the signing key file and the binary. -chrome_management_service_setup() { - if [ ! -f "$DEFAULTS_FILE" ]; then - return - fi - - if ! grep -q "install_device_trust_key_management_command=true" \ - "$DEFAULTS_FILE"; then - return - fi - - getent group chromemgmt > /dev/null || groupadd chromemgmt - - chgrp chromemgmt "/usr/bin/google/chrome/chrome-management-service" - chmod 2755 "/usr/bin/google/chrome/chrome-management-service" - - mkdir -p "/etc/usr/bin/chrome/policies/enrollment" - SIGNING_KEY_FILE="/etc/usr/bin/chrome/policies/enrollment/DeviceTrustSigningKey" - if [ ! -e "$SIGNING_KEY_FILE" ]; then - touch "$SIGNING_KEY_FILE" - fi - - chgrp chromemgmt "$SIGNING_KEY_FILE" - chmod 664 "$SIGNING_KEY_FILE" -} - -chrome_management_service_setup - -# sources.list setting for google-chrome updates. -REPOCONFIG="https://dl.google.com/linux/chrome/rpm/stable" -REPOCONFIGREGEX="" - -# Install the repository signing key (see also: -# https://www.google.com/linuxrepositories/) -install_rpm_key() { - KEY_PACKAGE="gpg-pubkey-d38b4796-570c8cd3" - # Check to see if all keys already exists. - # Make sure all the most recent signing subkeys are installed. - NEED_KEYS=0 - - SUB_KEY_LIST=( - # 2017 signing subkey - "6494C6D6997C215E" - # 2019 signing subkey - "78BD65473CB3BD13" - # 2021 signing subkey - "4EB27DB2A3B88B8B" - # 2023 signing subkey - "E88979FB9B30ACF2" - ) - - for SUB_KEY in "${SUB_KEY_LIST[@]}"; do - rpm -q ${KEY_PACKAGE} --qf '%%{Pubkeys:armor}\n' | \ - gpg --with-colons - 2>/dev/null | \ - grep -q "$SUB_KEY" - if [ "$?" -ne "0" ]; then - NEED_KEYS=1 - fi - done - - if [ $NEED_KEYS -ne 1 ]; then - return - fi - - # Make sure no older version of the key is installed because it appears - # 'rpm --import' won't overwrite an existing key package. - rpm -q ${KEY_PACKAGE} >/dev/null 2>&1 - if [ "$?" -eq "0" ]; then - # Note, if this is run during the package install, it will fail because rpm - # can't recursively run rpm, but it should work when run later as part of - # the installed cron job (and probably nothing needs the new keys before - # then). - rpm -e --allmatches ${KEY_PACKAGE} >/dev/null 2>&1 || return - fi - - # RPM on Mandriva 2009 is dumb and does not understand "rpm --import -" - TMPKEY=$(mktemp /tmp/google.sig.XXXXXX) - if [ -n "$TMPKEY" ]; then - cat > "$TMPKEY" < /dev/null | sed 's/:\t/:/' | cut -d ':' -f 2-) - case $RELEASE in - "Fedora"|"Amazon"|"Mageia"|"OpenMandrivaLinux") - PACKAGEMANAGERS=(yum) - ;; - "SUSE LINUX"|"openSUSE") - PACKAGEMANAGERS=(zypp) - ;; - esac - fi - - if [ "$PACKAGEMANAGERS" ]; then - return - fi - - # Fallback methods that are probably unnecessary on modern systems. - if [ -f "/etc/fedora-release" ] || [ -f "/etc/redhat-release" ]; then - PACKAGEMANAGERS=(yum) - elif [ -f "/etc/system-release" ] && grep -Fq "Amazon Linux" "/etc/system-release"; then - PACKAGEMANAGERS=(yum) - elif [ -f "/etc/SuSE-release" ]; then - PACKAGEMANAGERS=(zypp) - fi -} - -DEFAULT_ARCH="x86_64" -YUM_REPO_FILE="/etc/yum.repos.d/google-chrome.repo" -ZYPPER_REPO_FILE="/etc/zypp/repos.d/google-chrome.repo" - -install_yum() { - install_rpm_key - - if [ ! "$REPOCONFIG" ]; then - return 0 - fi - - if [ -d "/etc/yum.repos.d" ]; then -cat > "$YUM_REPO_FILE" << REPOCONTENT -[google-chrome] -name=google-chrome -baseurl=$REPOCONFIG/$DEFAULT_ARCH -enabled=1 -gpgcheck=1 -gpgkey=https://dl.google.com/linux/linux_signing_key.pub -REPOCONTENT - fi -} - -install_zypp() { - if [ ! "$REPOCONFIG" ]; then - return 0 - fi - - # Ideally, we would run: zypper addrepo -t YUM -f \ - # "$REPOCONFIG/$DEFAULT_ARCH" "google-chrome" - # but that does not work when zypper is running. - if [ -d "/etc/zypp/repos.d" ]; then -cat > "$ZYPPER_REPO_FILE" << REPOCONTENT -[google-chrome] -name=google-chrome -enabled=1 -autorefresh=1 -baseurl=$REPOCONFIG/$DEFAULT_ARCH -gpgcheck=1 -gpgkey=https://dl.google.com/linux/linux_signing_key.pub -type=rpm-md -keeppackages=0 -REPOCONTENT - fi -} - -# Check if the automatic repository configuration is done, so we know when to -# stop trying. -verify_install() { - # It's probably enough to see that the repo configs have been created. If they - # aren't configured properly, update_bad_repo should catch that when it's run. - case $1 in - "yum") - [ -f "$YUM_REPO_FILE" ] - ;; - "zypp") - [ -f "$ZYPPER_REPO_FILE" ] - ;; - esac -} - -# Update the Google repository if it's not set correctly. -update_bad_repo() { - if [ ! "$REPOCONFIG" ]; then - return 0 - fi - - determine_rpm_package_manager - - for PACKAGEMANAGER in ${PACKAGEMANAGERS[*]} - do - case $PACKAGEMANAGER in - "yum") - update_repo_file "$YUM_REPO_FILE" - ;; - "zypp") - update_repo_file "$ZYPPER_REPO_FILE" - ;; - esac - done -} - -update_repo_file() { - REPO_FILE="$1" - - # Don't do anything if the file isn't there, since that probably means the - # user disabled it. - if [ ! -r "$REPO_FILE" ]; then - return 0 - fi - - # Check if the correct repository configuration is in there. - REPOMATCH=$(grep "^baseurl=$REPOCONFIG/$DEFAULT_ARCH" "$REPO_FILE" \ - 2>/dev/null) - # If it's there, nothing to do - if [ "$REPOMATCH" ]; then - return 0 - fi - - # Check if it's there but disabled by commenting out (as opposed to using the - # 'enabled' setting). - MATCH_DISABLED=$(grep "^[[:space:]]*#.*baseurl=$REPOCONFIG/$DEFAULT_ARCH" \ - "$REPO_FILE" 2>/dev/null) - if [ "$MATCH_DISABLED" ]; then - # It's OK for it to be disabled, as long as nothing bogus is enabled in its - # place. - ACTIVECONFIGS=$(grep "^baseurl=.*" "$REPO_FILE" 2>/dev/null) - if [ ! "$ACTIVECONFIGS" ]; then - return 0 - fi - fi - - # If we get here, the correct repository wasn't found, or something else is - # active, so fix it. This assumes there is a 'baseurl' setting, but if not, - # then that's just another way of disabling, so we won't try to add it. - sed -i -e "s,^baseurl=.*,baseurl=$REPOCONFIG/$DEFAULT_ARCH," "$REPO_FILE" -} - -# We only remove the repository configuration during a purge. Since RPM has -# no equivalent to dpkg --purge, the code below is actually never used. We -# keep it only for reference purposes, should we ever need it. -# -#remove_yum() { -# rm -f "$YUM_REPO_FILE" -#} -# -#remove_zypp() { -# # Ideally, we would run: zypper removerepo "google-chrome" -# # but that does not work when zypper is running. -# rm -f /etc/zypp/repos.d/google-chrome.repo -#} - -DEFAULT_ARCH="x86_64" - -get_lib_dir() { - if [ "$DEFAULT_ARCH" = "i386" ] || [ "$DEFAULT_ARCH" = "armhf" ] || \ - [ "$DEFAULT_ARCH" = "mipsel" ]; then - LIBDIR=lib - elif [ "$DEFAULT_ARCH" = "x86_64" ] || [ "$DEFAULT_ARCH" = "aarch64" ] || \ - [ "$DEFAULT_ARCH" = "mips64el" ]; then - LIBDIR=lib64 - else - echo Unknown CPU Architecture: "$DEFAULT_ARCH" - exit 1 - fi -} - -NSS_FILES="libnspr4.so.0d libplds4.so.0d libplc4.so.0d libssl3.so.1d \ - libnss3.so.1d libsmime3.so.1d libnssutil3.so.1d" - -add_nss_symlinks() { - get_lib_dir - for f in $NSS_FILES - do - target=$(echo $f | sed 's/\.[01]d$//') - if [ -f "/$LIBDIR/$target" ]; then - ln -snf "/$LIBDIR/$target" "/usr/bin/google/chrome/$f" - elif [ -f "/usr/$LIBDIR/$target" ]; then - ln -snf "/usr/$LIBDIR/$target" "/usr/bin/google/chrome/$f" - else - echo $f not found in "/$LIBDIR/$target" or "/usr/$LIBDIR/$target". - exit 1 - fi - done -} - -remove_nss_symlinks() { - for f in $NSS_FILES - do - rm -rf "/usr/bin/google/chrome/$f" - done -} - -remove_udev_symlinks() { - rm -rf "/usr/bin/google/chrome/libudev.so.0" -} - -remove_nss_symlinks -add_nss_symlinks - -remove_udev_symlinks - -if [ ! -e "$DEFAULTS_FILE" ]; then - echo 'repo_add_once="true"' > "$DEFAULTS_FILE" -fi - -. "$DEFAULTS_FILE" - -if [ "$repo_add_once" = "true" ]; then - determine_rpm_package_manager - - for PACKAGEMANAGER in ${PACKAGEMANAGERS[*]} - do - case $PACKAGEMANAGER in - "yum") - install_yum - ;; - "zypp") - install_zypp - ;; - esac - done -fi - -CHANNEL=stable -case $CHANNEL in - stable ) - PRIORITY=200 - ;; - beta ) - PRIORITY=150 - ;; - unstable ) - PRIORITY=120 - ;; - * ) - PRIORITY=0 - ;; -esac - -/usr/sbin/update-alternatives --install /usr/bin/google-chrome \ - google-chrome /usr/bin/google-chrome-stable $PRIORITY - -exit 0 - - -#------------------------------------------------------------------------------ -# Pre uninstallation script -#------------------------------------------------------------------------------ - - -%preun -p /bin/sh - -if [ "$1" -eq "0" ]; then - mode="uninstall" -elif [ "$1" -eq "1" ]; then - mode="upgrade" -fi - -# sources.list setting for google-chrome updates. -REPOCONFIG="https://dl.google.com/linux/chrome/rpm/stable" -REPOCONFIGREGEX="" - -# Install the repository signing key (see also: -# https://www.google.com/linuxrepositories/) -install_rpm_key() { - KEY_PACKAGE="gpg-pubkey-d38b4796-570c8cd3" - # Check to see if all keys already exists. - # Make sure all the most recent signing subkeys are installed. - NEED_KEYS=0 - - SUB_KEY_LIST=( - # 2017 signing subkey - "6494C6D6997C215E" - # 2019 signing subkey - "78BD65473CB3BD13" - # 2021 signing subkey - "4EB27DB2A3B88B8B" - # 2023 signing subkey - "E88979FB9B30ACF2" - ) - - for SUB_KEY in "${SUB_KEY_LIST[@]}"; do - rpm -q ${KEY_PACKAGE} --qf '%%{Pubkeys:armor}\n' | \ - gpg --with-colons - 2>/dev/null | \ - grep -q "$SUB_KEY" - if [ "$?" -ne "0" ]; then - NEED_KEYS=1 - fi - done - - if [ $NEED_KEYS -ne 1 ]; then - return - fi - - # Make sure no older version of the key is installed because it appears - # 'rpm --import' won't overwrite an existing key package. - rpm -q ${KEY_PACKAGE} >/dev/null 2>&1 - if [ "$?" -eq "0" ]; then - # Note, if this is run during the package install, it will fail because rpm - # can't recursively run rpm, but it should work when run later as part of - # the installed cron job (and probably nothing needs the new keys before - # then). - rpm -e --allmatches ${KEY_PACKAGE} >/dev/null 2>&1 || return - fi - - # RPM on Mandriva 2009 is dumb and does not understand "rpm --import -" - TMPKEY=$(mktemp /tmp/google.sig.XXXXXX) - if [ -n "$TMPKEY" ]; then - cat > "$TMPKEY" < /dev/null | sed 's/:\t/:/' | cut -d ':' -f 2-) - case $RELEASE in - "Fedora"|"Amazon"|"Mageia"|"OpenMandrivaLinux") - PACKAGEMANAGERS=(yum) - ;; - "SUSE LINUX"|"openSUSE") - PACKAGEMANAGERS=(zypp) - ;; - esac - fi - - if [ "$PACKAGEMANAGERS" ]; then - return - fi - - # Fallback methods that are probably unnecessary on modern systems. - if [ -f "/etc/fedora-release" ] || [ -f "/etc/redhat-release" ]; then - PACKAGEMANAGERS=(yum) - elif [ -f "/etc/system-release" ] && grep -Fq "Amazon Linux" "/etc/system-release"; then - PACKAGEMANAGERS=(yum) - elif [ -f "/etc/SuSE-release" ]; then - PACKAGEMANAGERS=(zypp) - fi -} - -DEFAULT_ARCH="x86_64" -YUM_REPO_FILE="/etc/yum.repos.d/google-chrome.repo" -ZYPPER_REPO_FILE="/etc/zypp/repos.d/google-chrome.repo" - -install_yum() { - install_rpm_key - - if [ ! "$REPOCONFIG" ]; then - return 0 - fi - - if [ -d "/etc/yum.repos.d" ]; then -cat > "$YUM_REPO_FILE" << REPOCONTENT -[google-chrome] -name=google-chrome -baseurl=$REPOCONFIG/$DEFAULT_ARCH -enabled=1 -gpgcheck=1 -gpgkey=https://dl.google.com/linux/linux_signing_key.pub -REPOCONTENT - fi -} - -install_zypp() { - if [ ! "$REPOCONFIG" ]; then - return 0 - fi - - # Ideally, we would run: zypper addrepo -t YUM -f \ - # "$REPOCONFIG/$DEFAULT_ARCH" "google-chrome" - # but that does not work when zypper is running. - if [ -d "/etc/zypp/repos.d" ]; then -cat > "$ZYPPER_REPO_FILE" << REPOCONTENT -[google-chrome] -name=google-chrome -enabled=1 -autorefresh=1 -baseurl=$REPOCONFIG/$DEFAULT_ARCH -gpgcheck=1 -gpgkey=https://dl.google.com/linux/linux_signing_key.pub -type=rpm-md -keeppackages=0 -REPOCONTENT - fi -} - -# Check if the automatic repository configuration is done, so we know when to -# stop trying. -verify_install() { - # It's probably enough to see that the repo configs have been created. If they - # aren't configured properly, update_bad_repo should catch that when it's run. - case $1 in - "yum") - [ -f "$YUM_REPO_FILE" ] - ;; - "zypp") - [ -f "$ZYPPER_REPO_FILE" ] - ;; - esac -} - -# Update the Google repository if it's not set correctly. -update_bad_repo() { - if [ ! "$REPOCONFIG" ]; then - return 0 - fi - - determine_rpm_package_manager - - for PACKAGEMANAGER in ${PACKAGEMANAGERS[*]} - do - case $PACKAGEMANAGER in - "yum") - update_repo_file "$YUM_REPO_FILE" - ;; - "zypp") - update_repo_file "$ZYPPER_REPO_FILE" - ;; - esac - done -} - -update_repo_file() { - REPO_FILE="$1" - - # Don't do anything if the file isn't there, since that probably means the - # user disabled it. - if [ ! -r "$REPO_FILE" ]; then - return 0 - fi - - # Check if the correct repository configuration is in there. - REPOMATCH=$(grep "^baseurl=$REPOCONFIG/$DEFAULT_ARCH" "$REPO_FILE" \ - 2>/dev/null) - # If it's there, nothing to do - if [ "$REPOMATCH" ]; then - return 0 - fi - - # Check if it's there but disabled by commenting out (as opposed to using the - # 'enabled' setting). - MATCH_DISABLED=$(grep "^[[:space:]]*#.*baseurl=$REPOCONFIG/$DEFAULT_ARCH" \ - "$REPO_FILE" 2>/dev/null) - if [ "$MATCH_DISABLED" ]; then - # It's OK for it to be disabled, as long as nothing bogus is enabled in its - # place. - ACTIVECONFIGS=$(grep "^baseurl=.*" "$REPO_FILE" 2>/dev/null) - if [ ! "$ACTIVECONFIGS" ]; then - return 0 - fi - fi - - # If we get here, the correct repository wasn't found, or something else is - # active, so fix it. This assumes there is a 'baseurl' setting, but if not, - # then that's just another way of disabling, so we won't try to add it. - sed -i -e "s,^baseurl=.*,baseurl=$REPOCONFIG/$DEFAULT_ARCH," "$REPO_FILE" -} - -# We only remove the repository configuration during a purge. Since RPM has -# no equivalent to dpkg --purge, the code below is actually never used. We -# keep it only for reference purposes, should we ever need it. -# -#remove_yum() { -# rm -f "$YUM_REPO_FILE" -#} -# -#remove_zypp() { -# # Ideally, we would run: zypper removerepo "google-chrome" -# # but that does not work when zypper is running. -# rm -f /etc/zypp/repos.d/google-chrome.repo -#} - -DEFAULT_ARCH="x86_64" - -get_lib_dir() { - if [ "$DEFAULT_ARCH" = "i386" ] || [ "$DEFAULT_ARCH" = "armhf" ] || \ - [ "$DEFAULT_ARCH" = "mipsel" ]; then - LIBDIR=lib - elif [ "$DEFAULT_ARCH" = "x86_64" ] || [ "$DEFAULT_ARCH" = "aarch64" ] || \ - [ "$DEFAULT_ARCH" = "mips64el" ]; then - LIBDIR=lib64 - else - echo Unknown CPU Architecture: "$DEFAULT_ARCH" - exit 1 - fi -} - -NSS_FILES="libnspr4.so.0d libplds4.so.0d libplc4.so.0d libssl3.so.1d \ - libnss3.so.1d libsmime3.so.1d libnssutil3.so.1d" - -add_nss_symlinks() { - get_lib_dir - for f in $NSS_FILES - do - target=$(echo $f | sed 's/\.[01]d$//') - if [ -f "/$LIBDIR/$target" ]; then - ln -snf "/$LIBDIR/$target" "/usr/bin/google/chrome/$f" - elif [ -f "/usr/$LIBDIR/$target" ]; then - ln -snf "/usr/$LIBDIR/$target" "/usr/bin/google/chrome/$f" - else - echo $f not found in "/$LIBDIR/$target" or "/usr/$LIBDIR/$target". - exit 1 - fi - done -} - -remove_nss_symlinks() { - for f in $NSS_FILES - do - rm -rf "/usr/bin/google/chrome/$f" - done -} - -remove_udev_symlinks() { - rm -rf "/usr/bin/google/chrome/libudev.so.0" -} - -# Only remove menu items and symlinks on uninstall. When upgrading, -# old_pkg's %%preun runs after new_pkg's %%post. -if [ "$mode" = "uninstall" ]; then -# Remove icons from the system icons -XDG_ICON_RESOURCE="`command -v xdg-icon-resource 2> /dev/null || true`" -if [ ! -x "$XDG_ICON_RESOURCE" ]; then - echo "Error: Could not find xdg-icon-resource" >&2 - exit 1 -fi -for icon in product_logo_32.png product_logo_48.png product_logo_256.png product_logo_128.png product_logo_16.png product_logo_64.png product_logo_24.png ; do - size="$(echo ${icon} | sed 's/[^0-9]//g')" - "$XDG_ICON_RESOURCE" uninstall --size "${size}" "google-chrome" -done - -UPDATE_MENUS="`command -v update-menus 2> /dev/null || true`" -if [ -x "$UPDATE_MENUS" ]; then - update-menus -fi - -# Update cache of .desktop file MIME types. Non-fatal since it's just a cache. -update-desktop-database > /dev/null 2>&1 || true - remove_nss_symlinks - remove_udev_symlinks - - /usr/sbin/update-alternatives --remove google-chrome \ - /usr/bin/google-chrome-stable -fi - -# On Debian we only remove when we purge. However, RPM has no equivalent to -# dpkg --purge, so this is all disabled. -# -#determine_rpm_package_manager -# -#for PACKAGEMANAGER in ${PACKAGEMANAGERS[*]} -#do -# case $PACKAGEMANAGER in -# "yum") -# remove_yum -# ;; -# "zypp") -# remove_zypp -# ;; -# esac -#done - -exit 0 - -#------------------------------------------------------------------------------ -# Post uninstallation script -#------------------------------------------------------------------------------ - -%postun -p /bin/sh - -exit 0 - -%changelog - diff --git a/documentation/INSTALL_RHEL9.md b/documentation/INSTALL_RHEL9.md new file mode 100644 index 0000000..13020a4 --- /dev/null +++ b/documentation/INSTALL_RHEL9.md @@ -0,0 +1,296 @@ +# Installation on RHEL 9 + +## Pre-requisites + +RHEL 9 pre-requisites : + +- RHEL 9 is installed +- The Red Hat repositories **baseos** and **appstream** are reachable + +Microshift pre-requisites : + +- RHEL 9.2 or 9.3 +- LVM volume group (VG) with unused space + +## Install Pre-requisites + +```sh +sudo subscription-manager register --username $RHN_LOGIN --auto-attach +sudo subscription-manager attach --pool=$RHN_POOL_ID +sudo dnf install -y osbuild-composer composer-cli cockpit-composer +sudo systemctl enable --now osbuild-composer.socket +sudo systemctl enable --now cockpit.socket +sudo systemctl restart osbuild-composer +sudo usermod -a -G weldr "$(id -un)" +``` + +Check that **os-composer** is working. + +``` +$ source /etc/bash_completion.d/composer-cli +$ composer-cli status show +API server status: + Database version: 0 + Database supported: true + Schema version: 0 + API version: 1 + Backend: osbuild-composer + Build: NEVRA:osbuild-composer-88.3-1.el9_3.x86_64 + +$ composer-cli sources list +appstream +baseos +``` + +## Clone this repository + +```sh +git clone https://github.com/nmasse-itix/red-hat-kiosk.git +cd red-hat-kiosk +export GIT_REPO_CLONE="$PWD" +``` + +## Create the container image + +Install podman and buildah. + +```sh +sudo dnf install -y podman buildah +``` + +Define the target image properties. + +```sh +REGISTRY="quay.io" +IMAGE_NAME="nmasse_itix/kiosk-app" +IMAGE_TAG="latest" +``` + +Build and push the image to the registry. + +```sh +cd "$GIT_REPO_CLONE/application" +podman build -t localhost/kiosk-app:latest . +podman login "$REGISTRY" +podman tag localhost/kiosk-app:latest "$REGISTRY/$IMAGE_NAME:$IMAGE_TAG" +podman push "$REGISTRY/$IMAGE_NAME:$IMAGE_TAG" +``` + +## Nginx configuration + +```sh +sudo dnf install -y nginx +sudo systemctl enable --now nginx.service +sudo firewall-cmd --permanent --add-port={80/tcp,443/tcp} +sudo firewall-cmd --reload +sudo mkdir -p /var/www +sudo restorecon -Rv /var/www +sudo sed -i.${EPOCHREALTIME:-bak} 's|/usr/share/nginx/html|/var/www|g' /etc/nginx/nginx.conf +sudo systemctl restart nginx.service +``` + +## Build the RPMS + +Pre-requisites + +```sh +sudo dnf install -y git rpm-build rpmdevtools +rm $HOME/rpmbuild +ln -sf "$GIT_REPO_CLONE/rpms" $HOME/rpmbuild +``` + +Build the `kiosk-config` RPM + +```sh +spectool -g -R $HOME/rpmbuild/SPECS/kiosk-config.spec +rpmbuild -ba $HOME/rpmbuild/SPECS/kiosk-config.spec +``` + +Build the `microshift-manifests` RPM + +```sh +spectool -g -R $HOME/rpmbuild/SPECS/microshift-manifests.spec +rpmbuild -ba $HOME/rpmbuild/SPECS/microshift-manifests.spec +``` + +Rebuild the Google Chrome RPM + +```sh +mkdir $HOME/rpmbuild/VENDOR +curl -s -Lo $HOME/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm https://dl.google.com/linux/direct/google-chrome-stable_current_x86_64.rpm +rpmrebuild -s $HOME/rpmbuild/SPECS/google-chrome-stable.spec -p $HOME/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm +RPM=$(rpm -q $HOME/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm) +mkdir -p $HOME/rpmbuild/BUILDROOT/$RPM/ +rpm2cpio $HOME/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm | cpio -idmv -D $HOME/rpmbuild/BUILDROOT/$RPM/ +( + set -Eeuo pipefail + cd $HOME/rpmbuild/BUILDROOT/$RPM/ + mv opt/google/ usr/bin/ + cd usr/bin/ + rm -f google-chrome-stable + ln -s google/chrome/google-chrome google-chrome-stable + ln -s google/chrome/google-chrome chrome +) || echo 'Repackaging failed!' +sed -i.${EPOCHREALTIME:-bak} 's|/opt/google|/usr/bin/google|g' $HOME/rpmbuild/SPECS/google-chrome-stable.spec +rpmbuild -bb $HOME/rpmbuild/SPECS/google-chrome-stable.spec +ls -l $HOME/rpmbuild/RPMS/x86_64/ +``` + +## Repository Creation + +Customize the desired location of the RPM repository: + +```sh +REPO_LOCATION="/opt/custom-rpms/" +``` + +Create the custom RPM repository: + +```sh +sudo dnf install -y createrepo +sudo mkdir -p "$REPO_LOCATION" +sudo cp $HOME/rpmbuild/RPMS/x86_64/* "$REPO_LOCATION" +sudo createrepo "$REPO_LOCATION" +sudo tee /etc/yum.repos.d/custom.repo < /var/lib/AccountsService/users/kiosk << 'EOF' -[User] -Session=gnome-kiosk-script -SystemAccount=false -EOF -#Add url environment variable -cat >> /home/kiosk/.bashrc << 'EOF' -export KIOSK_URL=http://`ip -br a | grep -oP 'br-ex\s+UNKNOWN\s+\K[0-9.]+'`:30000 -EOF +# Automatically create partitions required by hardware platform +# and add a separate /boot partition +reqpart --add-boot -#Configure the kiosk script to run firefox in kiosk mode and display our example URL -mkdir -p /home/kiosk/.local/bin/ -cat > /home/kiosk/.local/bin/gnome-kiosk-script << 'EOF' -#!/bin/sh -. ~/.bashrc -while true; do - /usr/bin/google/chrome/chrome --password-store=basic --no-default-browser-check --no-first-run --ash-no-nudges --disable-search-engine-choice-screen -kiosk ${KIOSK_URL} -done -EOF +# Create a PV, VG add LV for the system +part pv.01 --size=1 --grow --ondisk=vda +volgroup system pv.01 +logvol / --fstype="xfs" --size=1 --grow --name=root --vgname=system + +# Create a PV and VG for Microshift +part pv.02 --size=1 --grow --ondisk=vdb +volgroup data pv.02 + +## +## Alternative partitioning on only one disk +## +#zerombr +#clearpart --all --initlabel +#reqpart --add-boot +#part pv.01 --size=10G --ondisk=sda +#volgroup system pv.01 +#logvol / --fstype="xfs" --size=1 --grow --name=root --vgname=system +#part pv.02 --size=1 --grow --ondisk=sda +#volgroup data pv.02 + +## +## Network configuration +## -#Ensure the files are owned by our unprivileged user and the script is executable -chown -R 1001:1001 /home/kiosk -chmod 555 /home/kiosk/.local/bin/gnome-kiosk-script +# Configure the first network device +network --bootproto=dhcp --device=enp1s0 --noipv6 --activate -/etc/crio/openshift-pull-secret +# Configure hostname +network --hostname=kiosk.localdomain +## +## Ostree installation +## + +# Use this line if creating an Edge Installer ISO that includes a local ostree commit +ostreesetup --nogpg --osname=rhel --remote=edge --url=file:///run/install/repo/ostree/repo --ref=rhel/9/x86_64/edge + +# Use this to fetch from a remote URL +#ostreesetup --osname=rhel --url=http://192.168.0.116:30239/repo --ref=rhel/9/x86_64/edge --nogpg + +## +## Post install scripts +## +%post --log=/var/log/anaconda/post-install.log --erroronfail +# Add the pull secret to CRI-O and set root user-only read/write permissions cat > /etc/crio/openshift-pull-secret << 'EOF' - +__MICROSHIFT_PULL_SECRET__ EOF +chmod 600 /etc/crio/openshift-pull-secret - +# Configure the firewall with the mandatory rules for MicroShift +firewall-offline-cmd --zone=trusted --add-source=10.42.0.0/16 +firewall-offline-cmd --zone=trusted --add-source=169.254.169.1 %end diff --git a/imagebuilder/kiosk.toml b/imagebuilder/kiosk.toml index d6cb230..543359e 100644 --- a/imagebuilder/kiosk.toml +++ b/imagebuilder/kiosk.toml @@ -5,30 +5,15 @@ modules = [] groups = [] [[packages]] -name = "gdm" +name = "kiosk-config" version = "*" -[[packages]] -name = "gnome-kiosk" -version = "*" - -[[packages]] -name = "gnome-kiosk-script-session" -version = "*" - -[[packages]] -name = "firefox" -version = "*" - -#[[packages]] -#name = "google-chrome-stable-119.0.6045.199-1" -#version = "*" [[packages]] name = "cockpit" [[packages]] -name = "microshift" +name = "microshift-manifests" version = "*" [[packages]] @@ -40,7 +25,6 @@ hostname = "kiosk.local" [customizations.services] enabled = ["cockpit.socket", "sshd", "microshift"] -#disabled = ["postfix", "telnetd"] [customizations.timezone] timezone = "Europe/Paris" @@ -61,13 +45,12 @@ size = 1073741824 [[customizations.user]] name = "kiosk" description = "kiosk" -password = '$6$h272rrOc/h2NhKeZ$ubHaiFRAnZgPyjkf4ak.fZLmvmxdZa69qNsDIvWvAUs1ccBFFGMV/I4Uua8W3EAGxyQpmhaCNa671Ecyxh0kw.' +password = '__KIOSK_PASSWORD__' [[customizations.user]] name = "admin" description = "admin" -password = '$6$h272rrOc/h2NhKeZ$ubHaiFRAnZgPyjkf4ak.fZLmvmxdZa69qNsDIvWvAUs1ccBFFGMV/I4Uua8W3EAGxyQpmhaCNa671Ecyxh0kw.' -key = "" +key = "__ADMIN_SSH_PUBLIC_KEY__" home = "/home/admin/" shell = "/usr/bin/bash" groups = ["users", "wheel"] diff --git a/rpms/.gitignore b/rpms/.gitignore new file mode 100644 index 0000000..e3e448e --- /dev/null +++ b/rpms/.gitignore @@ -0,0 +1,4 @@ +RPMS +SRPMS +BUILD +BUILDROOT diff --git a/rpms/README.md b/rpms/README.md new file mode 100644 index 0000000..26e54ef --- /dev/null +++ b/rpms/README.md @@ -0,0 +1,42 @@ +# Kiosk Setup Configuration + +## Pre-requisites + +```sh +sudo dnf install -y git rpm-build rpmdevtools +cd rpms +rm $HOME/rpmbuild && ln -sf $PWD $HOME/rpmbuild +``` + +## Build the kiosk-config package + +```sh +spectool -g -R $HOME/rpmbuild/SPECS/kiosk-config.spec +rpmbuild -ba $HOME/rpmbuild/SPECS/kiosk-config.spec +``` + +The resulting package is in `$HOME/rpmbuild/RPMS/x86_64`. + +## Rebuild the Google Chrome RPM + +```sh +mkdir $HOME/rpmbuild/VENDOR +curl -s -Lo $HOME/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm https://dl.google.com/linux/direct/google-chrome-stable_current_x86_64.rpm +rpmrebuild -s $HOME/rpmbuild/SPECS/google-chrome-stable.spec -p $HOME/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm +RPM=$(rpm -q $HOME/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm) +mkdir -p $HOME/rpmbuild/BUILDROOT/$RPM/ +rpm2cpio $HOME/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm | cpio -idmv -D $HOME/rpmbuild/BUILDROOT/$RPM/ +( + set -Eeuo pipefail + cd $HOME/rpmbuild/BUILDROOT/$RPM/ + mv opt/google/ usr/bin/ + cd usr/bin/ + rm -f google-chrome-stable + ln -s google/chrome/google-chrome google-chrome-stable + ln -s google/chrome/google-chrome chrome +) || echo 'Repackaging failed!' +sed -i.${EPOCHREALTIME:-bak} 's|/opt/google|/usr/bin/google|g' $HOME/rpmbuild/SPECS/google-chrome-stable.spec +rpmbuild -bb $HOME/rpmbuild/SPECS/google-chrome-stable.spec +``` + +The resulting package is in `$HOME/rpmbuild/RPMS/x86_64`. diff --git a/rpms/SOURCES/com.redhat.Kiosk.SampleApp.desktop b/rpms/SOURCES/com.redhat.Kiosk.SampleApp.desktop new file mode 100644 index 0000000..0633e0f --- /dev/null +++ b/rpms/SOURCES/com.redhat.Kiosk.SampleApp.desktop @@ -0,0 +1,5 @@ +[Desktop Entry] +Name=Sample Application +Type=Application +Exec=redhat-kiosk-sampleapp +X-GNOME-HiddenUnderSystemd=true \ No newline at end of file diff --git a/rpms/SOURCES/com.redhat.Kiosk.SampleApp.service b/rpms/SOURCES/com.redhat.Kiosk.SampleApp.service new file mode 100644 index 0000000..dd337af --- /dev/null +++ b/rpms/SOURCES/com.redhat.Kiosk.SampleApp.service @@ -0,0 +1,9 @@ +[Unit] +Description=Sample Application (Kiosk mode) +BindsTo=gnome-session.target +After=gnome-session.target + +[Service] +ExecStart=/usr/bin/kiosk-app +Restart=always +SendSIGHUP=true \ No newline at end of file diff --git a/rpms/SOURCES/kiosk-app b/rpms/SOURCES/kiosk-app new file mode 100644 index 0000000..bf9b394 --- /dev/null +++ b/rpms/SOURCES/kiosk-app @@ -0,0 +1,10 @@ +#!/bin/sh + +set -Eeuo pipefail + +while ! curl -sf --connect-timeout 5 --expect100-timeout 5 "$KIOSK_URL"; do + echo "Waiting for the Kiosk APP to become available..." + sleep 10 +done + +exec /usr/bin/google/chrome/chrome --password-store=basic --no-default-browser-check --no-first-run --ash-no-nudges --disable-search-engine-choice-screen -kiosk "$KIOSK_URL" diff --git a/rpms/SOURCES/kiosk-environment b/rpms/SOURCES/kiosk-environment new file mode 100644 index 0000000..47ec70f --- /dev/null +++ b/rpms/SOURCES/kiosk-environment @@ -0,0 +1 @@ +export KIOSK_URL=http://10.43.191.230/ diff --git a/rpms/SOURCES/microshift-kustomization.yaml b/rpms/SOURCES/microshift-kustomization.yaml new file mode 100644 index 0000000..85755b4 --- /dev/null +++ b/rpms/SOURCES/microshift-kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- main-manifest.yaml diff --git a/rpms/SOURCES/microshift-main-manifest.yaml b/rpms/SOURCES/microshift-main-manifest.yaml new file mode 100644 index 0000000..31998f3 --- /dev/null +++ b/rpms/SOURCES/microshift-main-manifest.yaml @@ -0,0 +1,133 @@ +apiVersion: v1 +kind: Namespace +metadata: + labels: + kubernetes.io/metadata.name: kiosk-app + name: kiosk-app +spec: + finalizers: + - kubernetes +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: haproxy + namespace: kiosk-app +data: + haproxy.cfg: | + global + log stdout format raw local0 + maxconn 4000 + + defaults + mode http + log global + option dontlognull + option redispatch + retries 3 + timeout http-request 10s + timeout queue 1m + timeout connect 10s + timeout client 1m + timeout server 1m + timeout http-keep-alive 10s + timeout check 10s + maxconn 3000 + + frontend webserver + bind 0.0.0.0:8080 + acl main_service_failed nbsrv(appserver_main) le 0 + use_backend appserver_backup if main_service_failed + default_backend appserver_main + + backend appserver_main + http-request set-header Host ipinfo.io + balance roundrobin + # 34.117.186.192 is one of the IP Addresses serving the website "ipinfo.io" + server svc-main1 34.117.186.192:80 check + + backend appserver_backup + http-request set-header Host kiosk-app.kiosk-app.svc.cluster.local + balance roundrobin + server svc-backup1 kiosk-app:5000 check +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: haproxy + namespace: kiosk-app +spec: + replicas: 1 + selector: + matchLabels: + app: haproxy + template: + metadata: + labels: + app: haproxy + spec: + containers: + - name: haproxy + image: haproxy:latest + volumeMounts: + - name: config-volume + mountPath: /usr/local/etc/haproxy/haproxy.cfg + subPath: haproxy.cfg + ports: + - containerPort: 8080 + volumes: + - name: config-volume + configMap: + name: haproxy +--- +apiVersion: v1 +kind: Service +metadata: + name: haproxy + namespace: kiosk-app +spec: + type: ClusterIP + ipFamilies: + - IPv4 + ipFamilyPolicy: SingleStack + clusterIP: 10.43.191.230 + ports: + - port: 80 + protocol: TCP + targetPort: 8080 + selector: + app: haproxy +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: kiosk-app + namespace: kiosk-app +spec: + replicas: 1 + selector: + matchLabels: + app: kiosk-app + template: + metadata: + labels: + app: kiosk-app + spec: + containers: + - name: kiosk-app + image: quay.io/nmasse_itix/kiosk-app:latest + ports: + - containerPort: 5000 +--- +apiVersion: v1 +kind: Service +metadata: + name: kiosk-app + namespace: kiosk-app +spec: + type: ClusterIP + ports: + - port: 5000 + targetPort: 5000 + selector: + app: kiosk-app diff --git a/rpms/SOURCES/redhat-kiosk-sampleapp.desktop b/rpms/SOURCES/redhat-kiosk-sampleapp.desktop new file mode 100644 index 0000000..32dfb93 --- /dev/null +++ b/rpms/SOURCES/redhat-kiosk-sampleapp.desktop @@ -0,0 +1,8 @@ +[Desktop Entry] +Name=Sample Application (Kiosk mode) +Comment=This session logs you into a kiosk session showing a Sample Application +Exec=gnome-session --session redhat-kiosk-sampleapp +TryExec=gnome-session +Type=Application +DesktopNames=GNOME-Kiosk;GNOME; +X-GDM-SessionRegisters=true diff --git a/rpms/SOURCES/redhat-kiosk-sampleapp.session b/rpms/SOURCES/redhat-kiosk-sampleapp.session new file mode 100644 index 0000000..cc7ef99 --- /dev/null +++ b/rpms/SOURCES/redhat-kiosk-sampleapp.session @@ -0,0 +1,3 @@ +[GNOME Session] +Name=Kiosk +RequiredComponents=org.gnome.Kiosk;com.redhat.Kiosk.SampleApp; \ No newline at end of file diff --git a/rpms/SOURCES/session.conf b/rpms/SOURCES/session.conf new file mode 100644 index 0000000..4749d5a --- /dev/null +++ b/rpms/SOURCES/session.conf @@ -0,0 +1,3 @@ +[Unit] +Requires=org.gnome.Kiosk.target +Requires=com.redhat.Kiosk.SampleApp.service diff --git a/rpms/SOURCES/user-template b/rpms/SOURCES/user-template new file mode 100644 index 0000000..58b128a --- /dev/null +++ b/rpms/SOURCES/user-template @@ -0,0 +1,13 @@ +# This file contains defaults for new users. To edit, first +# copy it to /etc/accountsservice/user-templates and make changes +# there +[Template] +EnvironmentFiles=/etc/os-release; + +[com.redhat.AccountsServiceUser.System] +id='${ID}' +version-id='${VERSION_ID}' + +[User] +Session=redhat-kiosk-sampleapp +Icon=${HOME}/.face diff --git a/rpms/SPECS/kiosk-config.spec b/rpms/SPECS/kiosk-config.spec new file mode 100644 index 0000000..1e1ba10 --- /dev/null +++ b/rpms/SPECS/kiosk-config.spec @@ -0,0 +1,92 @@ +Name: kiosk-config +Version: 0.0.1 +Release: rh1 +Summary: Custom config to run a RHEL workstation as kiosk +License: BSD +Source0: user-template +Source1: kiosk-environment +Source2: com.redhat.Kiosk.SampleApp.desktop +Source3: redhat-kiosk-sampleapp.session +Source4: redhat-kiosk-sampleapp.desktop +Source5: com.redhat.Kiosk.SampleApp.service +Source6: session.conf +Source7: kiosk-app +Requires(pre): shadow-utils +Requires: gnome-kiosk +Requires: gdm +Requires: google-chrome-stable +Requires: accountsservice +Requires(post): crudini +Requires(preun): crudini +BuildRequires: systemd-rpm-macros +ExclusiveArch: x86_64 + +%description +Custom config to run a RHEL workstation as kiosk + +# Since we don't recompile from source, disable the build_id checking +%global _missing_build_ids_terminate_build 0 +%global _build_id_links none +%global debug_package %{nil} + +# We are evil, we have no changelog ! +%global source_date_epoch_from_changelog 0 + +%prep +cp %{S:0} user-template +cp %{S:1} kiosk-environment +cp %{S:2} com.redhat.Kiosk.SampleApp.desktop +cp %{S:3} redhat-kiosk-sampleapp.session +cp %{S:4} redhat-kiosk-sampleapp.desktop +cp %{S:5} com.redhat.Kiosk.SampleApp.service +cp %{S:6} session.conf +cp %{S:7} kiosk-app + +%build + +%install +install -m 0644 -D kiosk-environment %{buildroot}/etc/profile.d/kiosk.sh +install -m 0644 -D com.redhat.Kiosk.SampleApp.desktop %{buildroot}/usr/share/applications/com.redhat.Kiosk.SampleApp.desktop +install -m 0644 -D redhat-kiosk-sampleapp.session %{buildroot}/usr/share/gnome-session/sessions/redhat-kiosk-sampleapp.session +install -m 0644 -D redhat-kiosk-sampleapp.desktop %{buildroot}/usr/share/wayland-sessions/redhat-kiosk-sampleapp.desktop +install -m 0644 -D redhat-kiosk-sampleapp.desktop %{buildroot}/usr/share/xsessions/redhat-kiosk-sampleapp.desktop +install -m 0644 -D com.redhat.Kiosk.SampleApp.service %{buildroot}%{_userunitdir}/com.redhat.Kiosk.SampleApp.service +install -m 0755 -d %{buildroot}%{_userunitdir}/gnome-session@redhat-kiosk-sampleapp.target.d +install -m 0644 -D session.conf %{buildroot}%{_userunitdir}/gnome-session@redhat-kiosk-sampleapp.target.d/session.conf +install -m 0755 -d %{buildroot}/etc/accountsservice/user-templates/ +install -m 0644 -D user-template %{buildroot}/etc/accountsservice/user-templates/standard +install -m 0644 -D user-template %{buildroot}/etc/accountsservice/user-templates/administrator +install -m 0755 -D kiosk-app %{buildroot}/usr/bin/kiosk-app + +%files +%config(noreplace) %attr(0644, root, root) /etc/profile.d/kiosk.sh +%attr(0644, root, root) /usr/share/applications/com.redhat.Kiosk.SampleApp.desktop +%attr(0644, root, root) /usr/share/gnome-session/sessions/redhat-kiosk-sampleapp.session +%attr(0644, root, root) /usr/share/wayland-sessions/redhat-kiosk-sampleapp.desktop +%attr(0644, root, root) /usr/share/xsessions/redhat-kiosk-sampleapp.desktop +%attr(0644, root, root) %{_userunitdir}/com.redhat.Kiosk.SampleApp.service +%attr(0644, root, root) %{_userunitdir}/gnome-session@redhat-kiosk-sampleapp.target.d/session.conf +%config(noreplace) %attr(0644, root, root) /etc/accountsservice/user-templates/standard +%config(noreplace) %attr(0644, root, root) /etc/accountsservice/user-templates/administrator +%attr(0755, root, root) /usr/bin/kiosk-app + +%pre +getent group kiosk >/dev/null 2>&1 || groupadd kiosk +getent passwd kiosk >/dev/null 2>&1 || useradd -r -N -g kiosk -d /home/kiosk -m kiosk + +%post +%systemd_user_post com.redhat.Kiosk.SampleApp.service +crudini --set /etc/gdm/custom.conf daemon AutomaticLoginEnable True +crudini --set /etc/gdm/custom.conf daemon AutomaticLogin kiosk +systemctl set-default graphical.target + +%preun +%systemd_user_preun com.redhat.Kiosk.SampleApp.service +if [ "$1" == "0" ]; then # Uninstall + crudini --set /etc/gdm/custom.conf daemon AutomaticLoginEnable False +fi + +%postun +%systemd_user_postun com.redhat.Kiosk.SampleApp.service + +%changelog diff --git a/rpms/SPECS/microshift-manifests.spec b/rpms/SPECS/microshift-manifests.spec new file mode 100644 index 0000000..8cd34d5 --- /dev/null +++ b/rpms/SPECS/microshift-manifests.spec @@ -0,0 +1,36 @@ +Name: microshift-manifests +Version: 0.0.1 +Release: rh1 +Summary: Custom manifests for Microshift +License: BSD +Source0: microshift-kustomization.yaml +Source1: microshift-main-manifest.yaml +Requires: microshift + +%description +Custom manifests for Microshift + +# Since we don't recompile from source, disable the build_id checking +%global _missing_build_ids_terminate_build 0 +%global _build_id_links none +%global debug_package %{nil} + +# We are evil, we have no changelog ! +%global source_date_epoch_from_changelog 0 + +%prep +cp %{S:0} kustomization.yaml +cp %{S:1} main-manifest.yaml + +%build + +%install +install -m 0755 -d %{buildroot}/usr/lib/microshift/manifests.d/custom/ +install -m 0644 -D kustomization.yaml %{buildroot}/usr/lib/microshift/manifests.d/custom/kustomization.yaml +install -m 0644 -D main-manifest.yaml %{buildroot}/usr/lib/microshift/manifests.d/custom/main-manifest.yaml + +%files +%attr(0644, root, root) /usr/lib/microshift/manifests.d/custom/kustomization.yaml +%attr(0644, root, root) /usr/lib/microshift/manifests.d/custom/main-manifest.yaml + +%changelog