From dd98c57bc716a53055666776343f9de0430c4b01 Mon Sep 17 00:00:00 2001
From: Tobias Waldekranz <tobias@waldekranz.com>
Date: Tue, 11 Nov 2025 23:39:39 +0100
Subject: [PATCH] board/common: Move RAUC bundle creation to separate make
 target

---
 board/common/Config.in                        | 25 +----------
 board/common/image/image-itb-rauc/Config.in   | 27 ++++++++++++
 board/common/image/image-itb-rauc/generate.sh | 35 +++++++++++++++
 .../image-itb-rauc/hooks.sh}                  |  0
 .../image/image-itb-rauc/image-itb-rauc.mk    | 10 +++++
 board/common/mkrauc.sh                        | 43 -------------------
 board/common/post-image.sh                    |  9 ----
 7 files changed, 73 insertions(+), 76 deletions(-)
 create mode 100644 board/common/image/image-itb-rauc/Config.in
 create mode 100755 board/common/image/image-itb-rauc/generate.sh
 rename board/common/{rauc-hooks.sh => image/image-itb-rauc/hooks.sh} (100%)
 create mode 100644 board/common/image/image-itb-rauc/image-itb-rauc.mk
 delete mode 100755 board/common/mkrauc.sh

diff --git a/board/common/Config.in b/board/common/Config.in
index 5ce1e8e8..60904edd 100644
--- a/board/common/Config.in
+++ b/board/common/Config.in
@@ -1,38 +1,15 @@
 menu "Images"
 
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rootfs/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rauc/Config.in"
 
 endmenu
 
-menuconfig SIGN_ENABLED
-	bool "Image Signing"
-	default y
-
-choice
-	prompt "Signing key source"
-	depends on SIGN_ENABLED
-	default SIGN_SRC_DIR
-
-config SIGN_SRC_DIR
-	bool "Directory"
-
-config SIGN_SRC_PKCS11
-	bool "PKCS#11 URL"
-
-endchoice
-
-config SIGN_KEY
-	string "Signing key"
-	depends on SIGN_ENABLED
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development"  if SIGN_SRC_DIR
-
 menuconfig TRUSTED_KEYS
 	bool "Trusted keys for image"
-	depends on SIGN_ENABLED
 	help
 	 Keys that will be accepted for this image
 
-
 config TRUSTED_KEYS_DEVELOPMENT
 	bool "Development key"
 	depends on TRUSTED_KEYS
diff --git a/board/common/image/image-itb-rauc/Config.in b/board/common/image/image-itb-rauc/Config.in
new file mode 100644
index 00000000..27f7017d
--- /dev/null
+++ b/board/common/image/image-itb-rauc/Config.in
@@ -0,0 +1,27 @@
+menuconfig IMAGE_ITB_RAUC
+	bool "RAUC upgrade bundle (ITB)"
+	select IMAGE_ITB_ROOTFS
+	select BR2_PACKAGE_HOST_RAUC
+	help
+	  Create RAUC upgrade bundle, for targets using ITB images,
+	  that can be used to upgrade a running system to this version
+	  of Infix.
+
+config IMAGE_ITB_RAUC_KEY
+	string "signing key"
+	depends on IMAGE_ITB_RAUC
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
+	help
+	  Path to the private key, in PKCS#8 format, used to sign
+	  the RAUC bundle; or a PKCS#11 URI.
+
+config IMAGE_ITB_RAUC_CERT
+	string "signing certificate"
+	depends on IMAGE_ITB_RAUC
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
+	help
+	  Path to the X509 certificate which will be associated with
+	  the bundle signature.
+
+	  NOTE: This cert MUST be included in the trust store of the
+	        system on which this bundle is to be installed.
diff --git a/board/common/image/image-itb-rauc/generate.sh b/board/common/image/image-itb-rauc/generate.sh
new file mode 100755
index 00000000..8552402c
--- /dev/null
+++ b/board/common/image/image-itb-rauc/generate.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+
+set -e
+
+squash="${BINARIES_DIR}"/rootfs.squashfs
+itbh="${BINARIES_DIR}"/rootfs.itbh
+pkg="${BINARIES_DIR}"/"${ARTIFACT}.pkg"
+
+cp -f "${PKGDIR}"/hooks.sh "${WORKDIR}"/hooks.sh
+
+# RAUC internally uses the file extension to find a suitable install
+# handler, hence the name must be .img
+cp -f "${squash}" "${WORKDIR}"/rootfs.img
+cp -f "${itbh}"   "${WORKDIR}"/rootfs.itbh
+
+cat >"${WORKDIR}"/manifest.raucm <<EOF
+[update]
+compatible=${COMPATIBLE}
+version=${VERSION}
+
+[bundle]
+format=verity
+
+[hooks]
+filename=hooks.sh
+
+[image.rootfs]
+filename=rootfs.img
+hooks=post-install
+EOF
+
+rauc --cert="${CERT}" --key="${KEY}" \
+     bundle "${WORKDIR}" "${pkg}.next"
+
+mv "${pkg}.next" "${pkg}"
diff --git a/board/common/rauc-hooks.sh b/board/common/image/image-itb-rauc/hooks.sh
similarity index 100%
rename from board/common/rauc-hooks.sh
rename to board/common/image/image-itb-rauc/hooks.sh
diff --git a/board/common/image/image-itb-rauc/image-itb-rauc.mk b/board/common/image/image-itb-rauc/image-itb-rauc.mk
new file mode 100644
index 00000000..25f6b537
--- /dev/null
+++ b/board/common/image/image-itb-rauc/image-itb-rauc.mk
@@ -0,0 +1,10 @@
+################################################################################
+#
+# image-itb-rauc
+#
+################################################################################
+
+IMAGE_ITB_RAUC_DEPENDENCIES := host-rauc image-itb-rootfs
+IMAGE_ITB_RAUC_CONFIG_VARS := KEY CERT
+
+$(eval $(ix-image))
diff --git a/board/common/mkrauc.sh b/board/common/mkrauc.sh
deleted file mode 100755
index 6cb30c28..00000000
--- a/board/common/mkrauc.sh
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/bin/sh
-
-set -e
-
-name=$1
-compat=$2
-sign=$3
-
-crt=$(ls $sign/*.crt)
-key=$(ls $sign/*.key)
-
-common=$(dirname "$(readlink -f "$0")")
-
-work=$BUILD_DIR/mkrauc
-mkdir -p "$work"
-
-cp -f "$common/rauc-hooks.sh" "$work/hooks.sh"
-
-# RAUC internally uses the file extension to find a suitable install
-# handler, hence the name must be .img
-cp -f "$BINARIES_DIR/rootfs.squashfs" "$work/rootfs.img"
-cp -f "$BINARIES_DIR/rootfs.itbh"     "$work/rootfs.itbh"
-
-cat >"$work/manifest.raucm" <<EOF
-[update]
-compatible=${compat}
-version=${INFIX_VERSION}
-
-[bundle]
-format=verity
-
-[hooks]
-filename=hooks.sh
-
-[image.rootfs]
-filename=rootfs.img
-hooks=post-install
-EOF
-
-rm -f "$BINARIES_DIR/$name.pkg"
-
-rauc --cert="$crt" --key="$key" \
-     bundle "$work" "$BINARIES_DIR/$name.pkg"
diff --git a/board/common/post-image.sh b/board/common/post-image.sh
index 00b84fcc..69983242 100755
--- a/board/common/post-image.sh
+++ b/board/common/post-image.sh
@@ -33,15 +33,6 @@ ver()
     fi
 }
 
-load_cfg SIGN_ENABLED
-if [ "$SIGN_ENABLED" = "y" ]; then
-    load_cfg BR2_ARCH
-    load_cfg SIGN_KEY
-
-    ixmsg "Creating RAUC Update Bundle"
-    $common/mkrauc.sh "$NAME$(ver)" $INFIX_COMPATIBLE $SIGN_KEY
-fi
-
 load_cfg DISK_IMAGE
 if [ "$DISK_IMAGE" = "y" ]; then
     ixmsg "Creating Disk Image"