From 356d1903ebe2da4a35beee38cd04dcde733fe199 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20Mass=C3=A9?= Date: Thu, 22 Feb 2024 23:34:07 +0100 Subject: [PATCH] work in progress --- chrome_repackage/README.md | 70 - chrome_repackage/google_chrome_repackage.spec | 1555 ----------------- documentation/INSTALL_RHEL9.md | 106 +- documentation/LOCAL_DEV.md | 44 +- imagebuilder/kiosk.ks | 33 - imagebuilder/kiosk.toml | 19 +- rpms/.gitignore | 4 + rpms/README.md | 42 + .../com.redhat.Kiosk.SampleApp.desktop | 5 + .../com.redhat.Kiosk.SampleApp.service | 9 + rpms/SOURCES/kiosk-environment | 1 + rpms/SOURCES/redhat-kiosk-sampleapp.desktop | 8 + rpms/SOURCES/redhat-kiosk-sampleapp.session | 3 + rpms/SOURCES/session.conf | 3 + rpms/SOURCES/user-template | 13 + rpms/SPECS/kiosk-config.spec | 88 + 16 files changed, 284 insertions(+), 1719 deletions(-) delete mode 100644 chrome_repackage/README.md delete mode 100644 chrome_repackage/google_chrome_repackage.spec create mode 100644 rpms/.gitignore create mode 100644 rpms/README.md create mode 100644 rpms/SOURCES/com.redhat.Kiosk.SampleApp.desktop create mode 100644 rpms/SOURCES/com.redhat.Kiosk.SampleApp.service create mode 100644 rpms/SOURCES/kiosk-environment create mode 100644 rpms/SOURCES/redhat-kiosk-sampleapp.desktop create mode 100644 rpms/SOURCES/redhat-kiosk-sampleapp.session create mode 100644 rpms/SOURCES/session.conf create mode 100644 rpms/SOURCES/user-template create mode 100644 rpms/SPECS/kiosk-config.spec diff --git a/chrome_repackage/README.md b/chrome_repackage/README.md deleted file mode 100644 index 3775dce..0000000 --- a/chrome_repackage/README.md +++ /dev/null @@ -1,70 +0,0 @@ -# Google Chrome RPM Installation Guide - -This guide provides step-by-step instructions for downloading and rebuilding the Google Chrome RPM package on a RPM-based Linux distribution. - -## Prerequisites - -Before you proceed, ensure that you have the following prerequisites installed on your system: - -- `rpmrebuild`: A tool for rebuilding RPM packages. -- `rpmbuild`: The RPM Package Manager build tool. - -## Installation Steps - -1. **Download Google RPM** - - ```bash - # Replace with the actual download URL - wget /google-chrome-stable-119.0.6045.199-1.x86_64.rpm - ``` - -2. **Rebuild the RPM Package** - - ```bash - rpmrebuild -s google-chrome-stable.spec -p google-chrome-stable-119.0.6045.199-1.x86_64.rpm - ``` - -3. **Extract the Contents** - - ```bash - rpm2cpio google-chrome-stable-119.0.6045.199-1.x86_64.rpm | cpio -idmv - ``` - -4. **Move Google Chrome to the Desired Location** - - ```bash - mv opt/google usr/bin/ - ``` - -5. **Create Symbolic Links** - - ```bash - cd usr/bin/ - rm -f google-chrome-stable - ln -s google/chrome/google-chrome google-chrome-stable - ln -s google/chrome/google-chrome chrome - cd ../.. - ``` - -6. **Create RPM Build Directory** - - ```bash - mkdir -p $HOME/rpmbuild/BUILDROOT/google-chrome-stable-119.0.6045.199-1.x86_64 - ``` - -7. **Copy Files to RPM Build Directory** - - ```bash - for i in etc usr; do cp -r $i $HOME/rpmbuild/BUILDROOT/google-chrome-stable-119.0.6045.199-1.x86_64/; done - ``` - -8. **Build the RPM Package** - - ```bash - rpmbuild -bb google-chrome-stable.spec - ``` - -After completing these steps, you should have successfully downloaded, rebuilt, and repackaged the Google Chrome RPM for your system. The resulting RPM package will be available in the RPM build directory (`$HOME/rpmbuild/RPMS/x86_64/`). - -Note: Ensure that you replace `` with the actual download URL of the Google Chrome RPM. - diff --git a/chrome_repackage/google_chrome_repackage.spec b/chrome_repackage/google_chrome_repackage.spec deleted file mode 100644 index 18660c6..0000000 --- a/chrome_repackage/google_chrome_repackage.spec +++ /dev/null @@ -1,1555 +0,0 @@ -# rpmrebuild autogenerated specfile - -BuildRoot: /home/cloud-user/.tmp/rpmrebuild.469989/work/root -AutoProv: no -%undefine __find_provides -AutoReq: no -%undefine __find_requires -# Do not try autogenerate prereq/conflicts/obsoletes and check files -%undefine __check_files -%undefine __find_prereq -%undefine __find_conflicts -%undefine __find_obsoletes -# Be sure buildpolicy set to do nothing -%define __spec_install_post %{nil} -# Something that need for rpm-4.1 -%define _missing_doc_files_terminate_build 0 -#dummy -#dummy -#BUILDHOST: NSJAIL -#BUILDTIME: Mon Nov 27 16:02:46 2023 -#SOURCERPM: google-chrome-stable-119.0.6045.199-1.src.rpm - -#RPMVERSION: 4.14.1 - - - -#OS: linux -#SIZE: 334068301 -#ARCHIVESIZE: 334084684 -#ARCH: x86_64 -BuildArch: x86_64 -Name: google-chrome-stable -Version: 119.0.6045.199 -Release: 1 -License: Multiple, see https://chrome.google.com/ -Group: Applications/Internet -Summary: Google Chrome - - -URL: https://chrome.google.com/ -Vendor: Google LLC -Packager: Chrome Linux Team - - - - - -Prefix: /usr/bin -Provides: google-chrome = 119.0.6045.199 -Provides: google-chrome-stable = 119.0.6045.199-1 -Provides: google-chrome-stable(x86-64) = 119.0.6045.199-1 -Requires(pre): /bin/sh -Requires(post): /bin/sh -Requires(preun): /bin/sh -Requires(postun): /bin/sh -Requires(post): /usr/sbin/update-alternatives -Requires(preun): /usr/sbin/update-alternatives -Requires: ca-certificates -Requires: ld-linux-x86-64.so.2()(64bit) -Requires: ld-linux-x86-64.so.2(GLIBC_2.2.5)(64bit) -Requires: ld-linux-x86-64.so.2(GLIBC_2.3)(64bit) -Requires: libX11.so.6()(64bit) -Requires: libXcomposite.so.1()(64bit) -Requires: libXdamage.so.1()(64bit) -Requires: libXext.so.6()(64bit) -Requires: libXfixes.so.3()(64bit) -Requires: libXrandr.so.2()(64bit) -Requires: libasound.so.2()(64bit) -Requires: libasound.so.2(ALSA_0.9)(64bit) -Requires: libasound.so.2(ALSA_0.9.0rc4)(64bit) -Requires: libatk-1.0.so.0()(64bit) -Requires: libatk-bridge-2.0.so.0()(64bit) -Requires: libatspi.so.0()(64bit) -Requires: libc.so.6()(64bit) -Requires: libc.so.6(GLIBC_2.10)(64bit) -Requires: libc.so.6(GLIBC_2.11)(64bit) -Requires: libc.so.6(GLIBC_2.14)(64bit) -Requires: libc.so.6(GLIBC_2.15)(64bit) -Requires: libc.so.6(GLIBC_2.16)(64bit) -Requires: libc.so.6(GLIBC_2.17)(64bit) -Requires: libc.so.6(GLIBC_2.2.5)(64bit) -Requires: libc.so.6(GLIBC_2.3)(64bit) -Requires: libc.so.6(GLIBC_2.3.2)(64bit) -Requires: libc.so.6(GLIBC_2.3.3)(64bit) -Requires: libc.so.6(GLIBC_2.3.4)(64bit) -Requires: libc.so.6(GLIBC_2.4)(64bit) -Requires: libc.so.6(GLIBC_2.6)(64bit) -Requires: libc.so.6(GLIBC_2.7)(64bit) -Requires: libc.so.6(GLIBC_2.8)(64bit) -Requires: libc.so.6(GLIBC_2.9)(64bit) -Requires: libcairo.so.2()(64bit) -Requires: libcups.so.2()(64bit) -Requires: libcurl.so.4()(64bit) -Requires: libdbus-1.so.3()(64bit) -Requires: libdbus-1.so.3(LIBDBUS_1_3)(64bit) -Requires: libdl.so.2()(64bit) -Requires: libdl.so.2(GLIBC_2.2.5)(64bit) -Requires: libdrm.so.2()(64bit) -Requires: liberation-fonts -Requires: libexpat.so.1()(64bit) -Requires: libgbm.so.1()(64bit) -Requires: libgcc_s.so.1()(64bit) -Requires: libgcc_s.so.1(GCC_3.0)(64bit) -Requires: libgio-2.0.so.0()(64bit) -Requires: libglib-2.0.so.0()(64bit) -Requires: libgobject-2.0.so.0()(64bit) -Requires: libgtk-3.so.0()(64bit) -Requires: libm.so.6()(64bit) -Requires: libm.so.6(GLIBC_2.2.5)(64bit) -Requires: libnspr4.so()(64bit) -Requires: libnss3.so()(64bit) -Requires: libnss3.so(NSS_3.11)(64bit) -Requires: libnss3.so(NSS_3.12)(64bit) -Requires: libnss3.so(NSS_3.12.1)(64bit) -Requires: libnss3.so(NSS_3.12.4)(64bit) -Requires: libnss3.so(NSS_3.2)(64bit) -Requires: libnss3.so(NSS_3.22)(64bit) -Requires: libnss3.so(NSS_3.3)(64bit) -Requires: libnss3.so(NSS_3.30)(64bit) -Requires: libnss3.so(NSS_3.31)(64bit) -Requires: libnss3.so(NSS_3.39)(64bit) -Requires: libnss3.so(NSS_3.4)(64bit) -Requires: libnss3.so(NSS_3.5)(64bit) -Requires: libnss3.so(NSS_3.6)(64bit) -Requires: libnss3.so(NSS_3.7)(64bit) -Requires: libnss3.so(NSS_3.9.2)(64bit) -Requires: libnssutil3.so()(64bit) -Requires: libnssutil3.so(NSSUTIL_3.12.3)(64bit) -Requires: libpango-1.0.so.0()(64bit) -Requires: libpthread.so.0()(64bit) -Requires: libpthread.so.0(GLIBC_2.12)(64bit) -Requires: libpthread.so.0(GLIBC_2.2.5)(64bit) -Requires: libpthread.so.0(GLIBC_2.3.2)(64bit) -Requires: libpthread.so.0(GLIBC_2.3.3)(64bit) -Requires: libpthread.so.0(GLIBC_2.3.4)(64bit) -Requires: librt.so.1()(64bit) -Requires: librt.so.1(GLIBC_2.2.5)(64bit) -Requires: libsmime3.so()(64bit) -Requires: libsmime3.so(NSS_3.10)(64bit) -Requires: libsmime3.so(NSS_3.2)(64bit) -Requires: libvulkan.so.1()(64bit) -Requires: libxcb.so.1()(64bit) -Requires: libxkbcommon.so.0()(64bit) -Requires: libxkbcommon.so.0(V_0.5.0)(64bit) -#Requires: rpmlib(CompressedFileNames) <= 3.0.4-1 -#Requires: rpmlib(FileDigests) <= 4.6.0-1 -#Requires: rpmlib(PayloadFilesHavePrefix) <= 4.0-1 -#Requires: rpmlib(PayloadIsXz) <= 5.2-1 -Requires: rtld(GNU_HASH) -Requires: wget -Requires: xdg-utils - - - - - -%description -The web browser from Google - -Google Chrome is a browser that combines a minimal design with sophisticated technology to make the web faster, safer, and easier. -%files -%attr(0755, root, root) "/etc/cron.daily/google-chrome" -%dir %attr(0755, root, root) "/usr/bin/google/chrome" -%dir %attr(0755, root, root) "/usr/bin/google/chrome/MEIPreload" -%attr(0644, root, root) "/usr/bin/google/chrome/MEIPreload/manifest.json" -%attr(0644, root, root) "/usr/bin/google/chrome/MEIPreload/preloaded_data.pb" -%dir %attr(0755, root, root) "/usr/bin/google/chrome/WidevineCdm" -%attr(0644, root, root) "/usr/bin/google/chrome/WidevineCdm/LICENSE" -%dir %attr(0755, root, root) "/usr/bin/google/chrome/WidevineCdm/_platform_specific" -%dir %attr(0755, root, root) "/usr/bin/google/chrome/WidevineCdm/_platform_specific/linux_x64" -%attr(0755, root, root) "/usr/bin/google/chrome/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so" -%attr(0644, root, root) "/usr/bin/google/chrome/WidevineCdm/manifest.json" -%attr(0755, root, root) "/usr/bin/google/chrome/chrome" -%attr(0755, root, root) "/usr/bin/google/chrome/chrome-management-service" -%attr(4755, root, root) "/usr/bin/google/chrome/chrome-sandbox" -%attr(0644, root, root) "/usr/bin/google/chrome/chrome_100_percent.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/chrome_200_percent.pak" -%attr(0755, root, root) "/usr/bin/google/chrome/chrome_crashpad_handler" -%attr(0644, root, root) "/usr/bin/google/chrome/default-app-block" -%dir %attr(0755, root, root) "/usr/bin/google/chrome/default_apps" -%attr(0644, root, root) "/usr/bin/google/chrome/default_apps/external_extensions.json" -%attr(0755, root, root) "/usr/bin/google/chrome/google-chrome" -%attr(0644, root, root) "/usr/bin/google/chrome/icudtl.dat" -%attr(0755, root, root) "/usr/bin/google/chrome/libEGL.so" -%attr(0755, root, root) "/usr/bin/google/chrome/libGLESv2.so" -%attr(0755, root, root) "/usr/bin/google/chrome/liboptimization_guide_internal.so" -%attr(0755, root, root) "/usr/bin/google/chrome/libqt5_shim.so" -%attr(0755, root, root) "/usr/bin/google/chrome/libqt6_shim.so" -%attr(0755, root, root) "/usr/bin/google/chrome/libvk_swiftshader.so" -%attr(0755, root, root) "/usr/bin/google/chrome/libvulkan.so.1" -%dir %attr(0755, root, root) "/usr/bin/google/chrome/locales" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/af.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/am.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ar.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/bg.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/bn.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ca.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/cs.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/da.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/de.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/el.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/en-GB.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/en-US.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/es-419.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/es.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/et.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/fa.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/fi.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/fil.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/fr.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/gu.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/he.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/hi.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/hr.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/hu.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/id.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/it.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ja.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/kn.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ko.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/lt.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/lv.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ml.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/mr.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ms.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/nb.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/nl.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/pl.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/pt-BR.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/pt-PT.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ro.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ru.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/sk.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/sl.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/sr.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/sv.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/sw.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ta.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/te.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/th.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/tr.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/uk.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/ur.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/vi.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/zh-CN.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/locales/zh-TW.pak" -%attr(0755, root, root) "/usr/bin/google/chrome/nacl_helper" -%attr(0755, root, root) "/usr/bin/google/chrome/nacl_helper_bootstrap" -%attr(0644, root, root) "/usr/bin/google/chrome/nacl_irt_x86_64.nexe" -%attr(0644, root, root) "/usr/bin/google/chrome/product_logo_128.png" -%attr(0644, root, root) "/usr/bin/google/chrome/product_logo_16.png" -%attr(0644, root, root) "/usr/bin/google/chrome/product_logo_24.png" -%attr(0644, root, root) "/usr/bin/google/chrome/product_logo_256.png" -%attr(0644, root, root) "/usr/bin/google/chrome/product_logo_32.png" -%attr(0644, root, root) "/usr/bin/google/chrome/product_logo_32.xpm" -%attr(0644, root, root) "/usr/bin/google/chrome/product_logo_48.png" -%attr(0644, root, root) "/usr/bin/google/chrome/product_logo_64.png" -%attr(0644, root, root) "/usr/bin/google/chrome/resources.pak" -%attr(0644, root, root) "/usr/bin/google/chrome/v8_context_snapshot.bin" -%attr(0644, root, root) "/usr/bin/google/chrome/vk_swiftshader_icd.json" -%attr(0755, root, root) "/usr/bin/google/chrome/xdg-mime" -%attr(0755, root, root) "/usr/bin/google/chrome/xdg-settings" -%ghost %attr(0755, root, root) %verify(not md5 size link mtime) "/usr/bin/google-chrome" -%attr(0777, root, root) "/usr/bin/google-chrome-stable" -%attr(0644, root, root) "/usr/share/appdata/google-chrome.appdata.xml" -%attr(0644, root, root) "/usr/share/applications/google-chrome.desktop" -%attr(0644, root, root) "/usr/share/gnome-control-center/default-apps/google-chrome.xml" -%doc %attr(0644, root, root) "/usr/share/man/man1/google-chrome-stable.1.gz" -%doc %attr(0777, root, root) "/usr/share/man/man1/google-chrome.1.gz" - - -%pre -p /bin/sh - -exit 0 - - - - -#------------------------------------------------------------------------------ -# Post install script -#------------------------------------------------------------------------------ - - -%post -p /bin/sh - -# System-wide package configuration. -DEFAULTS_FILE="/etc/default/google-chrome" - -# Add icons to the system icons -XDG_ICON_RESOURCE="`command -v xdg-icon-resource 2> /dev/null || true`" -if [ ! -x "$XDG_ICON_RESOURCE" ]; then - echo "Error: Could not find xdg-icon-resource" >&2 - exit 1 -fi -for icon in product_logo_32.png product_logo_48.png product_logo_256.png product_logo_128.png product_logo_16.png product_logo_64.png product_logo_24.png ; do - size="$(echo ${icon} | sed 's/[^0-9]//g')" - "$XDG_ICON_RESOURCE" install --size "${size}" "/usr/bin/google/chrome/${icon}" \ - "google-chrome" -done - -UPDATE_MENUS="`command -v update-menus 2> /dev/null || true`" -if [ -x "$UPDATE_MENUS" ]; then - update-menus -fi - -# Update cache of .desktop file MIME types. Non-fatal since it's just a cache. -update-desktop-database > /dev/null 2>&1 || true - -# Updates defaults.list file if present. -update_defaults_list() { - # $1: name of the .desktop file - - local DEFAULTS_LIST="/usr/share/applications/defaults.list" - - if [ ! -f "${DEFAULTS_LIST}" ]; then - return - fi - - # Split key-value pair out of MimeType= line from the .desktop file, - # then split semicolon-separated list of mime types (they should not contain - # spaces). - mime_types="$(grep MimeType= /usr/share/applications/${1} | - cut -d '=' -f 2- | - tr ';' ' ')" - for mime_type in ${mime_types}; do - if egrep -q "^${mime_type}=" "${DEFAULTS_LIST}"; then - if ! egrep -q "^${mime_type}=.*${1}" "${DEFAULTS_LIST}"; then - default_apps="$(grep ${mime_type}= "${DEFAULTS_LIST}" | - cut -d '=' -f 2-)" - egrep -v "^${mime_type}=" "${DEFAULTS_LIST}" > "${DEFAULTS_LIST}.new" - echo "${mime_type}=${default_apps};${1}" >> "${DEFAULTS_LIST}.new" - mv "${DEFAULTS_LIST}.new" "${DEFAULTS_LIST}" - fi - else - # If there's no mention of the mime type in the file, add it. - echo "${mime_type}=${1};" >> "${DEFAULTS_LIST}" - fi - done -} - -update_defaults_list "google-chrome.desktop" - -# This function uses sed to insert the contents of one file into another file, -# after the first line matching a given regular expression. If there is no -# matching line, then the file is unchanged. -insert_after_first_match() { - # $1: file to update - # $2: regular expression - # $3: file to insert - sed -i -e "1,/$2/ { - /$2/ r $3 - }" "$1" -} - -# If /usr/share/gnome-control-center/default-apps/gnome-default-applications.xml -# exists, it may need to be updated to add ourselves to the default applications -# list. If we find the file and it does not seem to contain our patch already -# (the patch is safe to leave even after uninstall), update it. -GNOME_DFL_APPS=/usr/share/gnome-control-center/default-apps/gnome-default-applications.xml -if [ -f "$GNOME_DFL_APPS" ]; then -# Conditionally insert the contents of the file "default-app-block" after the -# first "" line we find in gnome-default-applications.xml - fgrep -q "Google Chrome" "$GNOME_DFL_APPS" || insert_after_first_match \ - "$GNOME_DFL_APPS" \ - "^[ ]*[ ]*$" \ - "/usr/bin/google/chrome/default-app-block" -fi - -# This function performs the setup for the chrome management service process. -# It creates a new chromemgmt group, creates the signing key file, and updates -# permissions for both the signing key file and the binary. -chrome_management_service_setup() { - if [ ! -f "$DEFAULTS_FILE" ]; then - return - fi - - if ! grep -q "install_device_trust_key_management_command=true" \ - "$DEFAULTS_FILE"; then - return - fi - - getent group chromemgmt > /dev/null || groupadd chromemgmt - - chgrp chromemgmt "/usr/bin/google/chrome/chrome-management-service" - chmod 2755 "/usr/bin/google/chrome/chrome-management-service" - - mkdir -p "/etc/usr/bin/chrome/policies/enrollment" - SIGNING_KEY_FILE="/etc/usr/bin/chrome/policies/enrollment/DeviceTrustSigningKey" - if [ ! -e "$SIGNING_KEY_FILE" ]; then - touch "$SIGNING_KEY_FILE" - fi - - chgrp chromemgmt "$SIGNING_KEY_FILE" - chmod 664 "$SIGNING_KEY_FILE" -} - -chrome_management_service_setup - -# sources.list setting for google-chrome updates. -REPOCONFIG="https://dl.google.com/linux/chrome/rpm/stable" -REPOCONFIGREGEX="" - -# Install the repository signing key (see also: -# https://www.google.com/linuxrepositories/) -install_rpm_key() { - KEY_PACKAGE="gpg-pubkey-d38b4796-570c8cd3" - # Check to see if all keys already exists. - # Make sure all the most recent signing subkeys are installed. - NEED_KEYS=0 - - SUB_KEY_LIST=( - # 2017 signing subkey - "6494C6D6997C215E" - # 2019 signing subkey - "78BD65473CB3BD13" - # 2021 signing subkey - "4EB27DB2A3B88B8B" - # 2023 signing subkey - "E88979FB9B30ACF2" - ) - - for SUB_KEY in "${SUB_KEY_LIST[@]}"; do - rpm -q ${KEY_PACKAGE} --qf '%%{Pubkeys:armor}\n' | \ - gpg --with-colons - 2>/dev/null | \ - grep -q "$SUB_KEY" - if [ "$?" -ne "0" ]; then - NEED_KEYS=1 - fi - done - - if [ $NEED_KEYS -ne 1 ]; then - return - fi - - # Make sure no older version of the key is installed because it appears - # 'rpm --import' won't overwrite an existing key package. - rpm -q ${KEY_PACKAGE} >/dev/null 2>&1 - if [ "$?" -eq "0" ]; then - # Note, if this is run during the package install, it will fail because rpm - # can't recursively run rpm, but it should work when run later as part of - # the installed cron job (and probably nothing needs the new keys before - # then). - rpm -e --allmatches ${KEY_PACKAGE} >/dev/null 2>&1 || return - fi - - # RPM on Mandriva 2009 is dumb and does not understand "rpm --import -" - TMPKEY=$(mktemp /tmp/google.sig.XXXXXX) - if [ -n "$TMPKEY" ]; then - cat > "$TMPKEY" < /dev/null | sed 's/:\t/:/' | cut -d ':' -f 2-) - case $RELEASE in - "Fedora"|"Amazon"|"Mageia"|"OpenMandrivaLinux") - PACKAGEMANAGERS=(yum) - ;; - "SUSE LINUX"|"openSUSE") - PACKAGEMANAGERS=(zypp) - ;; - esac - fi - - if [ "$PACKAGEMANAGERS" ]; then - return - fi - - # Fallback methods that are probably unnecessary on modern systems. - if [ -f "/etc/fedora-release" ] || [ -f "/etc/redhat-release" ]; then - PACKAGEMANAGERS=(yum) - elif [ -f "/etc/system-release" ] && grep -Fq "Amazon Linux" "/etc/system-release"; then - PACKAGEMANAGERS=(yum) - elif [ -f "/etc/SuSE-release" ]; then - PACKAGEMANAGERS=(zypp) - fi -} - -DEFAULT_ARCH="x86_64" -YUM_REPO_FILE="/etc/yum.repos.d/google-chrome.repo" -ZYPPER_REPO_FILE="/etc/zypp/repos.d/google-chrome.repo" - -install_yum() { - install_rpm_key - - if [ ! "$REPOCONFIG" ]; then - return 0 - fi - - if [ -d "/etc/yum.repos.d" ]; then -cat > "$YUM_REPO_FILE" << REPOCONTENT -[google-chrome] -name=google-chrome -baseurl=$REPOCONFIG/$DEFAULT_ARCH -enabled=1 -gpgcheck=1 -gpgkey=https://dl.google.com/linux/linux_signing_key.pub -REPOCONTENT - fi -} - -install_zypp() { - if [ ! "$REPOCONFIG" ]; then - return 0 - fi - - # Ideally, we would run: zypper addrepo -t YUM -f \ - # "$REPOCONFIG/$DEFAULT_ARCH" "google-chrome" - # but that does not work when zypper is running. - if [ -d "/etc/zypp/repos.d" ]; then -cat > "$ZYPPER_REPO_FILE" << REPOCONTENT -[google-chrome] -name=google-chrome -enabled=1 -autorefresh=1 -baseurl=$REPOCONFIG/$DEFAULT_ARCH -gpgcheck=1 -gpgkey=https://dl.google.com/linux/linux_signing_key.pub -type=rpm-md -keeppackages=0 -REPOCONTENT - fi -} - -# Check if the automatic repository configuration is done, so we know when to -# stop trying. -verify_install() { - # It's probably enough to see that the repo configs have been created. If they - # aren't configured properly, update_bad_repo should catch that when it's run. - case $1 in - "yum") - [ -f "$YUM_REPO_FILE" ] - ;; - "zypp") - [ -f "$ZYPPER_REPO_FILE" ] - ;; - esac -} - -# Update the Google repository if it's not set correctly. -update_bad_repo() { - if [ ! "$REPOCONFIG" ]; then - return 0 - fi - - determine_rpm_package_manager - - for PACKAGEMANAGER in ${PACKAGEMANAGERS[*]} - do - case $PACKAGEMANAGER in - "yum") - update_repo_file "$YUM_REPO_FILE" - ;; - "zypp") - update_repo_file "$ZYPPER_REPO_FILE" - ;; - esac - done -} - -update_repo_file() { - REPO_FILE="$1" - - # Don't do anything if the file isn't there, since that probably means the - # user disabled it. - if [ ! -r "$REPO_FILE" ]; then - return 0 - fi - - # Check if the correct repository configuration is in there. - REPOMATCH=$(grep "^baseurl=$REPOCONFIG/$DEFAULT_ARCH" "$REPO_FILE" \ - 2>/dev/null) - # If it's there, nothing to do - if [ "$REPOMATCH" ]; then - return 0 - fi - - # Check if it's there but disabled by commenting out (as opposed to using the - # 'enabled' setting). - MATCH_DISABLED=$(grep "^[[:space:]]*#.*baseurl=$REPOCONFIG/$DEFAULT_ARCH" \ - "$REPO_FILE" 2>/dev/null) - if [ "$MATCH_DISABLED" ]; then - # It's OK for it to be disabled, as long as nothing bogus is enabled in its - # place. - ACTIVECONFIGS=$(grep "^baseurl=.*" "$REPO_FILE" 2>/dev/null) - if [ ! "$ACTIVECONFIGS" ]; then - return 0 - fi - fi - - # If we get here, the correct repository wasn't found, or something else is - # active, so fix it. This assumes there is a 'baseurl' setting, but if not, - # then that's just another way of disabling, so we won't try to add it. - sed -i -e "s,^baseurl=.*,baseurl=$REPOCONFIG/$DEFAULT_ARCH," "$REPO_FILE" -} - -# We only remove the repository configuration during a purge. Since RPM has -# no equivalent to dpkg --purge, the code below is actually never used. We -# keep it only for reference purposes, should we ever need it. -# -#remove_yum() { -# rm -f "$YUM_REPO_FILE" -#} -# -#remove_zypp() { -# # Ideally, we would run: zypper removerepo "google-chrome" -# # but that does not work when zypper is running. -# rm -f /etc/zypp/repos.d/google-chrome.repo -#} - -DEFAULT_ARCH="x86_64" - -get_lib_dir() { - if [ "$DEFAULT_ARCH" = "i386" ] || [ "$DEFAULT_ARCH" = "armhf" ] || \ - [ "$DEFAULT_ARCH" = "mipsel" ]; then - LIBDIR=lib - elif [ "$DEFAULT_ARCH" = "x86_64" ] || [ "$DEFAULT_ARCH" = "aarch64" ] || \ - [ "$DEFAULT_ARCH" = "mips64el" ]; then - LIBDIR=lib64 - else - echo Unknown CPU Architecture: "$DEFAULT_ARCH" - exit 1 - fi -} - -NSS_FILES="libnspr4.so.0d libplds4.so.0d libplc4.so.0d libssl3.so.1d \ - libnss3.so.1d libsmime3.so.1d libnssutil3.so.1d" - -add_nss_symlinks() { - get_lib_dir - for f in $NSS_FILES - do - target=$(echo $f | sed 's/\.[01]d$//') - if [ -f "/$LIBDIR/$target" ]; then - ln -snf "/$LIBDIR/$target" "/usr/bin/google/chrome/$f" - elif [ -f "/usr/$LIBDIR/$target" ]; then - ln -snf "/usr/$LIBDIR/$target" "/usr/bin/google/chrome/$f" - else - echo $f not found in "/$LIBDIR/$target" or "/usr/$LIBDIR/$target". - exit 1 - fi - done -} - -remove_nss_symlinks() { - for f in $NSS_FILES - do - rm -rf "/usr/bin/google/chrome/$f" - done -} - -remove_udev_symlinks() { - rm -rf "/usr/bin/google/chrome/libudev.so.0" -} - -remove_nss_symlinks -add_nss_symlinks - -remove_udev_symlinks - -if [ ! -e "$DEFAULTS_FILE" ]; then - echo 'repo_add_once="true"' > "$DEFAULTS_FILE" -fi - -. "$DEFAULTS_FILE" - -if [ "$repo_add_once" = "true" ]; then - determine_rpm_package_manager - - for PACKAGEMANAGER in ${PACKAGEMANAGERS[*]} - do - case $PACKAGEMANAGER in - "yum") - install_yum - ;; - "zypp") - install_zypp - ;; - esac - done -fi - -CHANNEL=stable -case $CHANNEL in - stable ) - PRIORITY=200 - ;; - beta ) - PRIORITY=150 - ;; - unstable ) - PRIORITY=120 - ;; - * ) - PRIORITY=0 - ;; -esac - -/usr/sbin/update-alternatives --install /usr/bin/google-chrome \ - google-chrome /usr/bin/google-chrome-stable $PRIORITY - -exit 0 - - -#------------------------------------------------------------------------------ -# Pre uninstallation script -#------------------------------------------------------------------------------ - - -%preun -p /bin/sh - -if [ "$1" -eq "0" ]; then - mode="uninstall" -elif [ "$1" -eq "1" ]; then - mode="upgrade" -fi - -# sources.list setting for google-chrome updates. -REPOCONFIG="https://dl.google.com/linux/chrome/rpm/stable" -REPOCONFIGREGEX="" - -# Install the repository signing key (see also: -# https://www.google.com/linuxrepositories/) -install_rpm_key() { - KEY_PACKAGE="gpg-pubkey-d38b4796-570c8cd3" - # Check to see if all keys already exists. - # Make sure all the most recent signing subkeys are installed. - NEED_KEYS=0 - - SUB_KEY_LIST=( - # 2017 signing subkey - "6494C6D6997C215E" - # 2019 signing subkey - "78BD65473CB3BD13" - # 2021 signing subkey - "4EB27DB2A3B88B8B" - # 2023 signing subkey - "E88979FB9B30ACF2" - ) - - for SUB_KEY in "${SUB_KEY_LIST[@]}"; do - rpm -q ${KEY_PACKAGE} --qf '%%{Pubkeys:armor}\n' | \ - gpg --with-colons - 2>/dev/null | \ - grep -q "$SUB_KEY" - if [ "$?" -ne "0" ]; then - NEED_KEYS=1 - fi - done - - if [ $NEED_KEYS -ne 1 ]; then - return - fi - - # Make sure no older version of the key is installed because it appears - # 'rpm --import' won't overwrite an existing key package. - rpm -q ${KEY_PACKAGE} >/dev/null 2>&1 - if [ "$?" -eq "0" ]; then - # Note, if this is run during the package install, it will fail because rpm - # can't recursively run rpm, but it should work when run later as part of - # the installed cron job (and probably nothing needs the new keys before - # then). - rpm -e --allmatches ${KEY_PACKAGE} >/dev/null 2>&1 || return - fi - - # RPM on Mandriva 2009 is dumb and does not understand "rpm --import -" - TMPKEY=$(mktemp /tmp/google.sig.XXXXXX) - if [ -n "$TMPKEY" ]; then - cat > "$TMPKEY" < /dev/null | sed 's/:\t/:/' | cut -d ':' -f 2-) - case $RELEASE in - "Fedora"|"Amazon"|"Mageia"|"OpenMandrivaLinux") - PACKAGEMANAGERS=(yum) - ;; - "SUSE LINUX"|"openSUSE") - PACKAGEMANAGERS=(zypp) - ;; - esac - fi - - if [ "$PACKAGEMANAGERS" ]; then - return - fi - - # Fallback methods that are probably unnecessary on modern systems. - if [ -f "/etc/fedora-release" ] || [ -f "/etc/redhat-release" ]; then - PACKAGEMANAGERS=(yum) - elif [ -f "/etc/system-release" ] && grep -Fq "Amazon Linux" "/etc/system-release"; then - PACKAGEMANAGERS=(yum) - elif [ -f "/etc/SuSE-release" ]; then - PACKAGEMANAGERS=(zypp) - fi -} - -DEFAULT_ARCH="x86_64" -YUM_REPO_FILE="/etc/yum.repos.d/google-chrome.repo" -ZYPPER_REPO_FILE="/etc/zypp/repos.d/google-chrome.repo" - -install_yum() { - install_rpm_key - - if [ ! "$REPOCONFIG" ]; then - return 0 - fi - - if [ -d "/etc/yum.repos.d" ]; then -cat > "$YUM_REPO_FILE" << REPOCONTENT -[google-chrome] -name=google-chrome -baseurl=$REPOCONFIG/$DEFAULT_ARCH -enabled=1 -gpgcheck=1 -gpgkey=https://dl.google.com/linux/linux_signing_key.pub -REPOCONTENT - fi -} - -install_zypp() { - if [ ! "$REPOCONFIG" ]; then - return 0 - fi - - # Ideally, we would run: zypper addrepo -t YUM -f \ - # "$REPOCONFIG/$DEFAULT_ARCH" "google-chrome" - # but that does not work when zypper is running. - if [ -d "/etc/zypp/repos.d" ]; then -cat > "$ZYPPER_REPO_FILE" << REPOCONTENT -[google-chrome] -name=google-chrome -enabled=1 -autorefresh=1 -baseurl=$REPOCONFIG/$DEFAULT_ARCH -gpgcheck=1 -gpgkey=https://dl.google.com/linux/linux_signing_key.pub -type=rpm-md -keeppackages=0 -REPOCONTENT - fi -} - -# Check if the automatic repository configuration is done, so we know when to -# stop trying. -verify_install() { - # It's probably enough to see that the repo configs have been created. If they - # aren't configured properly, update_bad_repo should catch that when it's run. - case $1 in - "yum") - [ -f "$YUM_REPO_FILE" ] - ;; - "zypp") - [ -f "$ZYPPER_REPO_FILE" ] - ;; - esac -} - -# Update the Google repository if it's not set correctly. -update_bad_repo() { - if [ ! "$REPOCONFIG" ]; then - return 0 - fi - - determine_rpm_package_manager - - for PACKAGEMANAGER in ${PACKAGEMANAGERS[*]} - do - case $PACKAGEMANAGER in - "yum") - update_repo_file "$YUM_REPO_FILE" - ;; - "zypp") - update_repo_file "$ZYPPER_REPO_FILE" - ;; - esac - done -} - -update_repo_file() { - REPO_FILE="$1" - - # Don't do anything if the file isn't there, since that probably means the - # user disabled it. - if [ ! -r "$REPO_FILE" ]; then - return 0 - fi - - # Check if the correct repository configuration is in there. - REPOMATCH=$(grep "^baseurl=$REPOCONFIG/$DEFAULT_ARCH" "$REPO_FILE" \ - 2>/dev/null) - # If it's there, nothing to do - if [ "$REPOMATCH" ]; then - return 0 - fi - - # Check if it's there but disabled by commenting out (as opposed to using the - # 'enabled' setting). - MATCH_DISABLED=$(grep "^[[:space:]]*#.*baseurl=$REPOCONFIG/$DEFAULT_ARCH" \ - "$REPO_FILE" 2>/dev/null) - if [ "$MATCH_DISABLED" ]; then - # It's OK for it to be disabled, as long as nothing bogus is enabled in its - # place. - ACTIVECONFIGS=$(grep "^baseurl=.*" "$REPO_FILE" 2>/dev/null) - if [ ! "$ACTIVECONFIGS" ]; then - return 0 - fi - fi - - # If we get here, the correct repository wasn't found, or something else is - # active, so fix it. This assumes there is a 'baseurl' setting, but if not, - # then that's just another way of disabling, so we won't try to add it. - sed -i -e "s,^baseurl=.*,baseurl=$REPOCONFIG/$DEFAULT_ARCH," "$REPO_FILE" -} - -# We only remove the repository configuration during a purge. Since RPM has -# no equivalent to dpkg --purge, the code below is actually never used. We -# keep it only for reference purposes, should we ever need it. -# -#remove_yum() { -# rm -f "$YUM_REPO_FILE" -#} -# -#remove_zypp() { -# # Ideally, we would run: zypper removerepo "google-chrome" -# # but that does not work when zypper is running. -# rm -f /etc/zypp/repos.d/google-chrome.repo -#} - -DEFAULT_ARCH="x86_64" - -get_lib_dir() { - if [ "$DEFAULT_ARCH" = "i386" ] || [ "$DEFAULT_ARCH" = "armhf" ] || \ - [ "$DEFAULT_ARCH" = "mipsel" ]; then - LIBDIR=lib - elif [ "$DEFAULT_ARCH" = "x86_64" ] || [ "$DEFAULT_ARCH" = "aarch64" ] || \ - [ "$DEFAULT_ARCH" = "mips64el" ]; then - LIBDIR=lib64 - else - echo Unknown CPU Architecture: "$DEFAULT_ARCH" - exit 1 - fi -} - -NSS_FILES="libnspr4.so.0d libplds4.so.0d libplc4.so.0d libssl3.so.1d \ - libnss3.so.1d libsmime3.so.1d libnssutil3.so.1d" - -add_nss_symlinks() { - get_lib_dir - for f in $NSS_FILES - do - target=$(echo $f | sed 's/\.[01]d$//') - if [ -f "/$LIBDIR/$target" ]; then - ln -snf "/$LIBDIR/$target" "/usr/bin/google/chrome/$f" - elif [ -f "/usr/$LIBDIR/$target" ]; then - ln -snf "/usr/$LIBDIR/$target" "/usr/bin/google/chrome/$f" - else - echo $f not found in "/$LIBDIR/$target" or "/usr/$LIBDIR/$target". - exit 1 - fi - done -} - -remove_nss_symlinks() { - for f in $NSS_FILES - do - rm -rf "/usr/bin/google/chrome/$f" - done -} - -remove_udev_symlinks() { - rm -rf "/usr/bin/google/chrome/libudev.so.0" -} - -# Only remove menu items and symlinks on uninstall. When upgrading, -# old_pkg's %%preun runs after new_pkg's %%post. -if [ "$mode" = "uninstall" ]; then -# Remove icons from the system icons -XDG_ICON_RESOURCE="`command -v xdg-icon-resource 2> /dev/null || true`" -if [ ! -x "$XDG_ICON_RESOURCE" ]; then - echo "Error: Could not find xdg-icon-resource" >&2 - exit 1 -fi -for icon in product_logo_32.png product_logo_48.png product_logo_256.png product_logo_128.png product_logo_16.png product_logo_64.png product_logo_24.png ; do - size="$(echo ${icon} | sed 's/[^0-9]//g')" - "$XDG_ICON_RESOURCE" uninstall --size "${size}" "google-chrome" -done - -UPDATE_MENUS="`command -v update-menus 2> /dev/null || true`" -if [ -x "$UPDATE_MENUS" ]; then - update-menus -fi - -# Update cache of .desktop file MIME types. Non-fatal since it's just a cache. -update-desktop-database > /dev/null 2>&1 || true - remove_nss_symlinks - remove_udev_symlinks - - /usr/sbin/update-alternatives --remove google-chrome \ - /usr/bin/google-chrome-stable -fi - -# On Debian we only remove when we purge. However, RPM has no equivalent to -# dpkg --purge, so this is all disabled. -# -#determine_rpm_package_manager -# -#for PACKAGEMANAGER in ${PACKAGEMANAGERS[*]} -#do -# case $PACKAGEMANAGER in -# "yum") -# remove_yum -# ;; -# "zypp") -# remove_zypp -# ;; -# esac -#done - -exit 0 - -#------------------------------------------------------------------------------ -# Post uninstallation script -#------------------------------------------------------------------------------ - -%postun -p /bin/sh - -exit 0 - -%changelog - diff --git a/documentation/INSTALL_RHEL9.md b/documentation/INSTALL_RHEL9.md index b83eaee..b503115 100644 --- a/documentation/INSTALL_RHEL9.md +++ b/documentation/INSTALL_RHEL9.md @@ -59,31 +59,47 @@ sudo firewall-cmd --permanent --add-port={80/tcp,443/tcp} sudo firewall-cmd --reload sudo mkdir -p /var/www sudo restorecon -Rv /var/www -sudo sed -i.bak 's|/usr/share/nginx/html|/var/www|g' /etc/nginx/nginx.conf +sudo sed -i.${EPOCHREALTIME:-bak} 's|/usr/share/nginx/html|/var/www|g' /etc/nginx/nginx.conf sudo systemctl restart nginx.service ``` -## Rebuild of Google Chrome +## Build the RPMS + +Pre-requisites + +```sh +sudo dnf install -y git rpm-build rpmdevtools +rm $HOME/rpmbuild +ln -sf "$GIT_REPO_CLONE/rpms" $HOME/rpmbuild +``` + +Build the Kiosk Configuration RPM + +```sh +spectool -g -R $HOME/rpmbuild/SPECS/kiosk-config.spec +rpmbuild -ba $HOME/rpmbuild/SPECS/kiosk-config.spec +``` + +Rebuild the Google Chrome RPM ```sh -sudo dnf install -y git rpm-build -sudo dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm -sudo dnf install -y rpmrebuild -cd "$GIT_REPO_CLONE/chrome_repackage" -curl -s -Lo google-chrome-stable_current_x86_64.rpm https://dl.google.com/linux/direct/google-chrome-stable_current_x86_64.rpm -rpmrebuild -s google-chrome-stable.spec -p google-chrome-stable_current_x86_64.rpm -rpm2cpio google-chrome-stable_current_x86_64.rpm | cpio -idmv -mv opt/google/ usr/bin/ -cd usr/bin/ -rm -f google-chrome-stable -ln -s google/chrome/google-chrome google-chrome-stable -ln -s google/chrome/google-chrome chrome -cd ../.. -RPM=$(rpm -q google-chrome-stable_current_x86_64.rpm) +mkdir $HOME/rpmbuild/VENDOR +curl -s -Lo $HOME/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm https://dl.google.com/linux/direct/google-chrome-stable_current_x86_64.rpm +rpmrebuild -s $HOME/rpmbuild/SPECS/google-chrome-stable.spec -p $HOME/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm +RPM=$(rpm -q $HOME/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm) mkdir -p $HOME/rpmbuild/BUILDROOT/$RPM/ -for i in etc usr; do cp -r $i $HOME/rpmbuild/BUILDROOT/$RPM/; done -sed -i.bak 's|/opt/google|/usr/bin/google|g' google-chrome-stable.spec -rpmbuild -bb google-chrome-stable.spec +rpm2cpio $HOME/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm | cpio -idmv -D $HOME/rpmbuild/BUILDROOT/$RPM/ +( + set -Eeuo pipefail + cd $HOME/rpmbuild/BUILDROOT/$RPM/ + mv opt/google/ usr/bin/ + cd usr/bin/ + rm -f google-chrome-stable + ln -s google/chrome/google-chrome google-chrome-stable + ln -s google/chrome/google-chrome chrome +) || echo 'Repackaging failed!' +sed -i.${EPOCHREALTIME:-bak} 's|/opt/google|/usr/bin/google|g' $HOME/rpmbuild/SPECS/google-chrome-stable.spec +rpmbuild -bb $HOME/rpmbuild/SPECS/google-chrome-stable.spec ls -l $HOME/rpmbuild/RPMS/x86_64/ ``` @@ -109,18 +125,25 @@ baseurl = file://$REPO_LOCATION enabled = 1 gpgcheck = 0 EOF -sudo dnf info google-chrome-stable +``` + +Verify all packages are present. + +```sh +sudo dnf clean all +sudo dnf info kiosk-config google-chrome-stable ``` ## Blueprint preparation Customize the **kiosk** and **admin** user password if desired. +Set the **admin** user SSH public key (if it's not you). ```sh -KIOSK_PASSWORD="$(openssl rand -base64 9)" -echo "Kiosk password is '$KIOSK_PASSWORD'" ADMIN_PASSWORD="$(openssl rand -base64 9)" echo "Admin password is '$ADMIN_PASSWORD'" +ADMIN_SSH_PUBLIC_KEY="$(ssh-add -L | head -n 1)" +echo "Admin SSH public key: $ADMIN_SSH_PUBLIC_KEY" ``` Prepare the os-builder blueprint. @@ -130,13 +153,9 @@ sudo subscription-manager repos --enable rhocp-4.14-for-rhel-9-$(uname -m)-rpms sudo dnf info microshift sudo dnf install -y mkpasswd podman cd "$GIT_REPO_CLONE/imagebuilder" -KIOSK_PASSWORD_HASH="$(mkpasswd -m bcrypt "$KIOSK_PASSWORD")" ADMIN_PASSWORD_HASH="$(mkpasswd -m bcrypt "$ADMIN_PASSWORD")" -sed -i.orig1 "s|__KIOSK_PASSWORD__|$KIOSK_PASSWORD_HASH|" kiosk.toml -sed -i.orig2 "s|__ADMIN_PASSWORD__|$ADMIN_PASSWORD_HASH|" kiosk.toml -ADMIN_SSH_PUBLIC_KEY="$(ssh-add -L | head -n 1)" -echo "Admin SSH public key: $ADMIN_SSH_PUBLIC_KEY" -sed -i.orig3 "s|__ADMIN_SSH_PUBLIC_KEY__|$ADMIN_SSH_PUBLIC_KEY|" kiosk.toml +sed -i.${EPOCHREALTIME:-bak} "s|__ADMIN_PASSWORD__|$ADMIN_PASSWORD_HASH|" kiosk.toml +sed -i.${EPOCHREALTIME:-bak} "s|__ADMIN_SSH_PUBLIC_KEY__|$ADMIN_SSH_PUBLIC_KEY|" kiosk.toml composer-cli sources add /dev/fd/0 < /var/lib/AccountsService/users/kiosk << 'EOF' -[User] -Session=gnome-kiosk-script -SystemAccount=false -EOF - -# Add url environment variable -cat >> /home/kiosk/.bashrc << 'EOF' -export KIOSK_URL=http://`ip -br a | grep -oP 'br-ex\s+UNKNOWN\s+\K[0-9.]+'`:30000 -EOF - -# Configure the kiosk script to run firefox in kiosk mode and display our example URL -mkdir -p /home/kiosk/.local/bin/ -cat > /home/kiosk/.local/bin/gnome-kiosk-script << 'EOF' -#!/bin/sh -. ~/.bashrc -while true; do - /usr/bin/google/chrome/chrome --password-store=basic --no-default-browser-check --no-first-run --ash-no-nudges --disable-search-engine-choice-screen -kiosk ${KIOSK_URL} -done -EOF - -# Ensure the files are owned by our unprivileged user and the script is executable -chown -R 1001:1001 /home/kiosk -chmod 555 /home/kiosk/.local/bin/gnome-kiosk-script - # Add the pull secret to CRI-O and set root user-only read/write permissions cat > /etc/crio/openshift-pull-secret << 'EOF' __MICROSHIFT_PULL_SECRET__ diff --git a/imagebuilder/kiosk.toml b/imagebuilder/kiosk.toml index 290de74..675f2b2 100644 --- a/imagebuilder/kiosk.toml +++ b/imagebuilder/kiosk.toml @@ -5,23 +5,7 @@ modules = [] groups = [] [[packages]] -name = "gdm" -version = "*" - -[[packages]] -name = "gnome-kiosk" -version = "*" - -[[packages]] -name = "gnome-kiosk-script-session" -version = "*" - -[[packages]] -name = "firefox" -version = "*" - -[[packages]] -name = "google-chrome-stable" +name = "kiosk-config" version = "*" [[packages]] @@ -40,7 +24,6 @@ hostname = "kiosk.local" [customizations.services] enabled = ["cockpit.socket", "sshd", "microshift"] -#disabled = ["postfix", "telnetd"] [customizations.timezone] timezone = "Europe/Paris" diff --git a/rpms/.gitignore b/rpms/.gitignore new file mode 100644 index 0000000..e3e448e --- /dev/null +++ b/rpms/.gitignore @@ -0,0 +1,4 @@ +RPMS +SRPMS +BUILD +BUILDROOT diff --git a/rpms/README.md b/rpms/README.md new file mode 100644 index 0000000..26e54ef --- /dev/null +++ b/rpms/README.md @@ -0,0 +1,42 @@ +# Kiosk Setup Configuration + +## Pre-requisites + +```sh +sudo dnf install -y git rpm-build rpmdevtools +cd rpms +rm $HOME/rpmbuild && ln -sf $PWD $HOME/rpmbuild +``` + +## Build the kiosk-config package + +```sh +spectool -g -R $HOME/rpmbuild/SPECS/kiosk-config.spec +rpmbuild -ba $HOME/rpmbuild/SPECS/kiosk-config.spec +``` + +The resulting package is in `$HOME/rpmbuild/RPMS/x86_64`. + +## Rebuild the Google Chrome RPM + +```sh +mkdir $HOME/rpmbuild/VENDOR +curl -s -Lo $HOME/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm https://dl.google.com/linux/direct/google-chrome-stable_current_x86_64.rpm +rpmrebuild -s $HOME/rpmbuild/SPECS/google-chrome-stable.spec -p $HOME/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm +RPM=$(rpm -q $HOME/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm) +mkdir -p $HOME/rpmbuild/BUILDROOT/$RPM/ +rpm2cpio $HOME/rpmbuild/VENDOR/google-chrome-stable_current_x86_64.rpm | cpio -idmv -D $HOME/rpmbuild/BUILDROOT/$RPM/ +( + set -Eeuo pipefail + cd $HOME/rpmbuild/BUILDROOT/$RPM/ + mv opt/google/ usr/bin/ + cd usr/bin/ + rm -f google-chrome-stable + ln -s google/chrome/google-chrome google-chrome-stable + ln -s google/chrome/google-chrome chrome +) || echo 'Repackaging failed!' +sed -i.${EPOCHREALTIME:-bak} 's|/opt/google|/usr/bin/google|g' $HOME/rpmbuild/SPECS/google-chrome-stable.spec +rpmbuild -bb $HOME/rpmbuild/SPECS/google-chrome-stable.spec +``` + +The resulting package is in `$HOME/rpmbuild/RPMS/x86_64`. diff --git a/rpms/SOURCES/com.redhat.Kiosk.SampleApp.desktop b/rpms/SOURCES/com.redhat.Kiosk.SampleApp.desktop new file mode 100644 index 0000000..0633e0f --- /dev/null +++ b/rpms/SOURCES/com.redhat.Kiosk.SampleApp.desktop @@ -0,0 +1,5 @@ +[Desktop Entry] +Name=Sample Application +Type=Application +Exec=redhat-kiosk-sampleapp +X-GNOME-HiddenUnderSystemd=true \ No newline at end of file diff --git a/rpms/SOURCES/com.redhat.Kiosk.SampleApp.service b/rpms/SOURCES/com.redhat.Kiosk.SampleApp.service new file mode 100644 index 0000000..7094c8b --- /dev/null +++ b/rpms/SOURCES/com.redhat.Kiosk.SampleApp.service @@ -0,0 +1,9 @@ +[Unit] +Description=Sample Application (Kiosk mode) +BindsTo=gnome-session.target +After=gnome-session.target + +[Service] +ExecStart=/usr/bin/google/chrome/chrome --password-store=basic --no-default-browser-check --no-first-run --ash-no-nudges --disable-search-engine-choice-screen -kiosk +Restart=always +SendSIGHUP=true \ No newline at end of file diff --git a/rpms/SOURCES/kiosk-environment b/rpms/SOURCES/kiosk-environment new file mode 100644 index 0000000..8e65e8b --- /dev/null +++ b/rpms/SOURCES/kiosk-environment @@ -0,0 +1 @@ +export KIOSK_URL=http://`ip -br a | grep -oP 'br-ex\s+UNKNOWN\s+\K[0-9.]+'`:30000 diff --git a/rpms/SOURCES/redhat-kiosk-sampleapp.desktop b/rpms/SOURCES/redhat-kiosk-sampleapp.desktop new file mode 100644 index 0000000..32dfb93 --- /dev/null +++ b/rpms/SOURCES/redhat-kiosk-sampleapp.desktop @@ -0,0 +1,8 @@ +[Desktop Entry] +Name=Sample Application (Kiosk mode) +Comment=This session logs you into a kiosk session showing a Sample Application +Exec=gnome-session --session redhat-kiosk-sampleapp +TryExec=gnome-session +Type=Application +DesktopNames=GNOME-Kiosk;GNOME; +X-GDM-SessionRegisters=true diff --git a/rpms/SOURCES/redhat-kiosk-sampleapp.session b/rpms/SOURCES/redhat-kiosk-sampleapp.session new file mode 100644 index 0000000..cc7ef99 --- /dev/null +++ b/rpms/SOURCES/redhat-kiosk-sampleapp.session @@ -0,0 +1,3 @@ +[GNOME Session] +Name=Kiosk +RequiredComponents=org.gnome.Kiosk;com.redhat.Kiosk.SampleApp; \ No newline at end of file diff --git a/rpms/SOURCES/session.conf b/rpms/SOURCES/session.conf new file mode 100644 index 0000000..4749d5a --- /dev/null +++ b/rpms/SOURCES/session.conf @@ -0,0 +1,3 @@ +[Unit] +Requires=org.gnome.Kiosk.target +Requires=com.redhat.Kiosk.SampleApp.service diff --git a/rpms/SOURCES/user-template b/rpms/SOURCES/user-template new file mode 100644 index 0000000..d36c8e9 --- /dev/null +++ b/rpms/SOURCES/user-template @@ -0,0 +1,13 @@ +# This file contains defaults for new users. To edit, first +# copy it to /etc/accountsservice/user-templates and make changes +# there +[Template] +EnvironmentFiles=/etc/os-release; + +[com.redhat.AccountsServiceUser.System] +id='${ID}' +version-id='${VERSION_ID}' + +[User] +Session=gnome +Icon=${HOME}/.face diff --git a/rpms/SPECS/kiosk-config.spec b/rpms/SPECS/kiosk-config.spec new file mode 100644 index 0000000..6c14ed9 --- /dev/null +++ b/rpms/SPECS/kiosk-config.spec @@ -0,0 +1,88 @@ +Name: kiosk-config +Version: 0.0.1 +Release: rh1 +Summary: Custom config to run a RHEL workstation as kiosk +License: BSD +Source0: user-template +Source1: kiosk-environment +Source2: com.redhat.Kiosk.SampleApp.desktop +Source3: redhat-kiosk-sampleapp.session +Source4: redhat-kiosk-sampleapp.desktop +Source5: com.redhat.Kiosk.SampleApp.service +Source6: session.conf +Requires(pre): shadow-utils +Requires: gnome-kiosk +Requires: gdm +Requires: google-chrome-stable +Requires: accountsservice +Requires(post): crudini +Requires(preun): crudini +BuildRequires: systemd-rpm-macros +ExclusiveArch: x86_64 + +%description +Custom config to run a RHEL workstation as kiosk + +# Since we don't recompile from source, disable the build_id checking +%global _missing_build_ids_terminate_build 0 +%global _build_id_links none +%global debug_package %{nil} + +# We are evil, we have no changelog ! +%global source_date_epoch_from_changelog 0 + +%prep +cp %{S:0} user-template +cp %{S:1} kiosk-environment +cp %{S:2} com.redhat.Kiosk.SampleApp.desktop +cp %{S:3} redhat-kiosk-sampleapp.session +cp %{S:4} redhat-kiosk-sampleapp.desktop +cp %{S:5} com.redhat.Kiosk.SampleApp.service +cp %{S:6} session.conf + +%build + +%install +install -m 0644 -D kiosk-environment %{buildroot}/etc/profile.d/kiosk.sh +install -m 0644 -D com.redhat.Kiosk.SampleApp.desktop %{buildroot}/usr/share/applications/com.redhat.Kiosk.SampleApp.desktop +install -m 0644 -D redhat-kiosk-sampleapp.session %{buildroot}/usr/share/gnome-session/sessions/redhat-kiosk-sampleapp.session +install -m 0644 -D redhat-kiosk-sampleapp.desktop %{buildroot}/usr/share/wayland-sessions/redhat-kiosk-sampleapp.desktop +install -m 0644 -D redhat-kiosk-sampleapp.desktop %{buildroot}/usr/share/xsessions/redhat-kiosk-sampleapp.desktop +install -m 0644 -D com.redhat.Kiosk.SampleApp.service %{buildroot}%{_userunitdir}/com.redhat.Kiosk.SampleApp.service +install -m 0755 -d %{buildroot}%{_userunitdir}/gnome-session@redhat-kiosk-sampleapp.target.d +install -m 0644 -D session.conf %{buildroot}%{_userunitdir}/gnome-session@redhat-kiosk-sampleapp.target.d/session.conf +install -m 0755 -d %{buildroot}/etc/accountsservice/user-templates/ +install -m 0644 -D user-template %{buildroot}/etc/accountsservice/user-templates/standard +install -m 0644 -D user-template %{buildroot}/etc/accountsservice/user-templates/administrator + +%files +%config(noreplace) %attr(0644, root, root) /etc/profile.d/kiosk.sh +%attr(0644, root, root) /usr/share/applications/com.redhat.Kiosk.SampleApp.desktop +%attr(0644, root, root) /usr/share/gnome-session/sessions/redhat-kiosk-sampleapp.session +%attr(0644, root, root) /usr/share/wayland-sessions/redhat-kiosk-sampleapp.desktop +%attr(0644, root, root) /usr/share/xsessions/redhat-kiosk-sampleapp.desktop +%attr(0644, root, root) %{_userunitdir}/com.redhat.Kiosk.SampleApp.service +%attr(0644, root, root) %{_userunitdir}/gnome-session@redhat-kiosk-sampleapp.target.d/session.conf +%config(noreplace) %attr(0644, root, root) /etc/accountsservice/user-templates/standard +%config(noreplace) %attr(0644, root, root) /etc/accountsservice/user-templates/administrator + +%pre +getent group kiosk >/dev/null 2>&1 || groupadd kiosk +getent passwd kiosk >/dev/null 2>&1 || useradd -N -g kiosk -d /home/kiosk -m kiosk + +%post +%systemd_user_post com.redhat.Kiosk.SampleApp.service +crudini --set /etc/gdm/custom.conf daemon AutomaticLoginEnable True +crudini --set /etc/gdm/custom.conf daemon AutomaticLogin kiosk +systemctl set-default graphical.target + +%preun +%systemd_user_preun com.redhat.Kiosk.SampleApp.service +if [ "$1" == "0" ]; then # Uninstall + crudini --set /etc/gdm/custom.conf daemon AutomaticLoginEnable False +fi + +%postun +%systemd_user_postun com.redhat.Kiosk.SampleApp.service + +%changelog