Flatpak session (a.k.a. flatpak-based app fw) support.

doc/flatpak-support.rst

@@ -0,0 +1,95 @@
+Flatpak Support in IoT Reference OS Kit
+#######################################
+
+IoT Reference OS Kit supports installing and running applications packaged
+as `flatpaks <http://flatpak.org>`_.
+
+Flatpak in a Nutshell
+----------------------
+
+Flatpak is a framework for building, distributing, and managing applications.
+It conceptually splits the software stack into
+
+* a runtime: the core/common bits,
+* an SDK: bits necessary for building software for a runtime,
+* the applications themselves
+
+Flatpak decouples the life-cycle of the application from that of the
+underlying distro. By doing so it enables updating the distro and the
+(flatpak) applications independently from each other.
+
+Additionally flatpak provides application sandboxing out of the box and
+relies largely on `ostree <http://ostree.readthedocs.io>`_ for providing
+an infrastructure for application (binary) version control, distribution
+and deployment.
+
+For more information and details see the corresponding documentation of
+flatpak and ostree.
+
+Basic Flatpak Support
+---------------------
+
+Basic flatpak support includes recipes for flatpak and its runtime and
+buildtime dependencies as well as Yocto helper classes for building
+flatpak-enabled versions of images. It can be enabled by the *flatpak*
+distro feature. Since it has additional prerequisites, the easiest way
+to enable it is to include :file:`meta-flatpak/conf/distro/include/flatpak.inc`
+in your build configuration.
+
+Flatpak Image Variants
+----------------------
+
+When the *flatpak* distro feature is enabled ``meta-flatpak`` defines
+two flatpak-specific image variants:
+
+* *flatpak-runtime*: a flatpak-enabled image to be used on a target device
+* *flatpak-sdk*: a *flatpak SDK runtime* to be used on a (development) host
+
+The *flatpak-runtime* variant adds flatpak, ostree, etc., all the necessary
+runtime bits to run flatpak, to the image. With such an image on a target
+device you should be able to invoke flatpak to carry out the normal flatpak
+operations, including defining flatpak remotes, installing, uninstalling and
+running flatpak applications.
+
+The *flatpak-sdk* variant adds the compiler toolchain, developement packages
+debug symbols, version control software, etc., in short everything you might
+need to compile and turn your applications into flatpaks intended to be
+installed on the *flatpak-runtime* image variant.
+
+You can refer to these image variants by appending their name to that
+of the base image. For instance you can build both of these variants for
+*refkit-image-gateway* by running:
+
+```
+bitbake -c refkit-image-gateway-flatpak-runtime refkit-image-gateway-flatpak-sdk
+```
+
+Extra Flatpak-based Functionality - Flatpak Session
+---------------------------------------------------
+
+In addition to stock flatpak support, *meta-flatpak* provides support
+for running a set of flatpaks from a common remote using a dedicated
+user, monitoring the remote for updates and/or new applications and
+automatically installing and activating those.
+
+Support for this extra set of functionality is controlled by the
+*flatpak-session* distro feature. The easiest way to enable it is to
+include :file:`meta-flatpak/conf/distro/include/flatpak.inc` in your
+build configuration.
+
+See the comment section in :file:`meta-flatpak/classes/flatpak-config.bbclass`
+for more details about the necessary steps or configuration you need to go
+through to have a *flatpak session* set up for a remote on your device.
+
+Caveats
+-------
+
+In addition to the basic flatpak dependencies a *flatpak-runtime* variant
+also pulls into the image a systemd service which is used to activate a
+'fake' flatpak runtime. This is basically a few files and bind mounts that
+are used to emulate an flatpak-installed *flatpak runtime* for the image
+itself. If you don't want it in your image, you can exclude it by putting
+an appropriately crafted _remove for your image in your build configuration.
+Note however, that either this fake runtime or the real flatpak runtime for
+the image needs to be installed, otherwise you cannot install and run
+flatpaks compiled for your image.

meta-flatpak/classes/flatpak-config.bbclass

@@ -63,3 +63,31 @@ FLATPAK_BUILD  ?= "${DISTRO}/${FLATPAK_PN}/build/${BUILD_ID}"
 # This is the GPG key id of our repository signing key. If you set this to
 # empty, signing is disabled altogether.
 FLATPAK_GPGID ?= "refkit-signing@key"
+
+# We can pre-populate the image during build with a set of pre-declared
+# flatpak repositories and associated dedicated flatpak-session users.
+# These repositories will be monitored for flatpaks and any new or updated
+# flatpaks which are tagged for automatic installation will be pulled in
+# and started within the appropriate flatpak session.
+#
+# To declare such a remote/repository, you need to
+#   1) give the remote a unique name
+#   2) provide a remote URL and a GPG public key for signature checking
+#   3) associate a user with the remote
+#
+# The variable FLATPAK_APP_REPOS lists the names of the remotes to pre-
+# declare and put into the image. For every remote <r> you have to provide
+#
+#   1) the remote HTTP URL in ${TOPDIR}/conf/<r>.url
+#   2) the remote GPG signing public key in ${TOPDIR}/conf/<r>.key
+#   3) provide passwd- and group entries for the associated user in
+#        ${TOPDIR}/conf/flatpak-passwd and
+#        ${TOPDIR}/conf/flatpak-group
+#      The GECOS for the associated entry must be of the form
+#      'flatpak user for <r>', where <r> is the remote name. By
+#      convention the user's login ID is also <r>, but this is
+#      not strictly necessary.
+#
+# By default we do not have any pre-declared application repositories,
+# so FLATPAK_APP_REPOS defaults to empty.
+FLATPAK_APP_REPOS ?= ""

meta-flatpak/classes/flatpak-image-variants.bbclass

@@ -8,6 +8,8 @@ IMAGE_FEATURES[validitems] += " \
 
 FEATURE_PACKAGES_flatpak = " \
     packagegroup-flatpak \
+    ${@bb.utils.contains('DISTRO_FEATURES', 'flatpak-session', \
+           'packagegroup-flatpak-session', '', d)} \
 "
 
 #

meta-flatpak/conf/distro/include/flatpak-session.inc

@@ -0,0 +1,3 @@
+REFKIT_DEFAULT_DISTRO_FEATURES += " \
+    flatpak-session \
+"

meta-flatpak/conf/layer.conf

@@ -14,3 +14,12 @@ LAYERDEPENDS_flatpak-layer = "core openembedded-layer filesystems-layer"
 
 # Set a variable for easy access to the top directory of the flatpak layer.
 FLATPAK_LAYERDIR = '${@os.path.normpath("${LAYERDIR}")}'
+
+# Pick up our passwd and group fragments for users associated with
+# pre-declared remotes/repositories, if we have any.
+USERADD_UID_TABLES_append_refkit-config = " \
+    ${@ d.getVar('TOPDIR') + '/conf/flatpak-passwd' \
+            if d.getVar('FLATPAK_APP_REPOS') else ''}"
+USERADD_GID_TABLES_append_refkit-config = " \
+    ${@ d.getVar('TOPDIR') + '/conf/flatpak-group' \
+            if d.getVar('FLATPAK_APP_REPOS') else ''}"

meta-flatpak/recipes-core/packagegroups/packagegroup-flatpak-session.bb

@@ -0,0 +1,10 @@
+SUMMARY = "IoT Reference OS Kit Basic Flatpak Session/Application Support"
+LICENSE = "MIT"
+
+inherit packagegroup
+
+RDEPENDS_${PN} = "\
+    packagegroup-flatpak \
+    flatpak-utils \
+    flatpak-predefined-repos \
+"

meta-flatpak/recipes-flatpak/flatpak-predefined-repos/flatpak-predefined-repos.bb

@@ -0,0 +1,55 @@
+DESCRIPTION = "Repository/remo URLs and signing keys for pre-declared flatpak session/application repositories."
+HOMEPAGE = "http://127.0.0.1/"
+LICENSE = "BSD-3-Clause"
+
+LIC_FILES_CHKSUM = "file://LICENSE-BSD;md5=f9f435c1bd3a753365e799edf375fc42"
+
+SRC_URI = " \
+    git://git@github.com/klihub/flatpak-predefined-repos.git;protocol=https;branch=master \
+"
+
+SRCREV = "1181642d571d575783760247792c45635e6d3ebf"
+
+S = "${WORKDIR}/git"
+
+inherit autotools flatpak-config
+
+# For each repo named <r> we expect a <r>.url and <r>.key file (containing
+# the repo URL and the repo pubic GPG key), and passwd/group entries for
+# the associated users.
+#
+# Turn the space-separated repo name list into a comma-separated one and
+# pass it to configure.
+EXTRA_OECONF += " \
+    --with-repos=${@','.join(d.getVar('FLATPAK_APP_REPOS').split())} \
+"
+
+# Inherit useradd only if we have pre-declared repositories. Otherwise
+# useradd would bail out with a parse-time error when we don't set
+# USERADD_PARAM_${PN} when we don't have pre-declared repos to put into
+# the image.
+inherit ${@'useradd' if d.getVar('FLATPAK_APP_REPOS') else ''}
+
+# Ask for the creation of the users/groups associated with the pre-declared
+# remotes/repositories. Turn the space-separated list into a semi-colon-
+# separated one.
+USERADD_PACKAGES = "${PN}"
+USERADD_PARAM_${PN} = "${@';'.join(d.getVar('FLATPAK_APP_REPOS').split())}"
+
+FILES_${PN} = " \
+    ${sysconfdir}/flatpak-session/* \
+"
+
+do_configure_prepend () {
+    if [ -n "${FLATPAK_APP_REPOS}" ]; then
+        mkdir -p ${S}/repos
+
+        for _r in ${FLATPAK_APP_REPOS}; do
+            echo "Copying URL- and key-file for remote/repository $_r..."
+            cp ${TOPDIR}/conf/$_r.url ${S}/repos
+            cp ${TOPDIR}/conf/$_r.key ${S}/repos
+        done
+    else
+        echo "No predefined flatpak application remotes/repos."
+    fi
+}

meta-flatpak/recipes-flatpak/flatpak-utils/files/flatpak-utils/LICENSE-BSD

@@ -0,0 +1,26 @@
+Copyright (c) 2012, 2013, Intel Corporation
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+    * Redistributions of source code must retain the above copyright notice,
+      this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of Intel Corporation nor the names of its contributors
+      may be used to endorse or promote products derived from this software
+      without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

meta-flatpak/recipes-flatpak/flatpak-utils/files/flatpak-utils/Makefile.am

@@ -0,0 +1,6 @@
+SUBDIRS  = . src
+doc_DATA = AUTHORS ChangeLog NEWS README
+
+# cleanup
+clean-local:
+	rm -f *~

meta-flatpak/recipes-flatpak/flatpak-utils/files/flatpak-utils/README

@@ -0,0 +1,26 @@
+flatpak-utils is a collection of extra utilities for Intel IoT RefKit.
+
+Currently flatpak-utils contains two extra binaries for dealing with
+'flatpak sessions'. A 'flatpak session' is an automatically started
+login session which runs one or more flatpak applications from a single
+flatpak provide/remote. Each such remote has a dedicated user associated
+with it and the flatpak applications are run within the login session
+of that dedicated user.
+
+There is currently a single binary provided which can be run in three
+different modes:
+
+- systemd generator
+
+  A systemd generator used to generate a systemd service for each
+  configured flatpak session during system initialization.
+
+- session daemon
+
+  A daemon used to run within each flatpak session to start the
+  flatpaks for that session.
+
+- update daemon
+
+  A daemon used to monitor remotes, pull in available updates,
+  and restart any affected flatpak sessions.

meta-flatpak/recipes-flatpak/flatpak-utils/files/flatpak-utils/bootstrap

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+aclocal -I m4 && \
+    autoheader && \
+        libtoolize --copy --force && \
+            autoconf && \
+                automake --add-missing --copy
+
+status=$?
+
+if [ $status == 0 ]; then
+    if [ -n "$1" ]; then
+        [ "$1" == "configure" ] && shift || :
+        ./configure $*
+        status=$?
+    fi
+else
+    echo "Failed to bootstrap."
+fi
+
+exit $status