%global build_rust_version 1.99.0
%global neo_kernel_release 7.2.11-1.fluxneo.unified
%global debug_package %{nil}
%global __brp_strip %{nil}
%global __brp_strip_static_archive %{nil}
%global __brp_strip_comment_note %{nil}
%{!?neo_kernel_release:%global neo_kernel_release 7.2.11-1.fluxneo.unified}
Name: flux-neo-boot
Version: 0.2
Release: 4.fluxneo%{?dist}
Summary: Source-built Flux Neo m1n1 and U-Boot
License: GPL-2.0-only AND GPL-2.0-or-later AND MIT AND BSD-2-Clause AND BSD-3-Clause
ExclusiveArch: aarch64
Source0: m1n1.tar
Source1: m1n1-vendor.tar
Source2: cargo-config.toml
Source3: uboot.tar
Source4: update-m1n1.conf
Source5: sources.json
%{!?build_rust_version:%global build_rust_version 1.99.0}
BuildRequires: rust = %{build_rust_version}
BuildRequires: rust-src = %{build_rust_version}
BuildRequires: clang llvm lld make gcc bison flex openssl-devel python3 python3-setuptools swig dtc cargo
BuildRequires: gnutls-devel
Requires: kernel-uname-r = %{neo_kernel_release}
Requires: asahi-scripts
%description
Pinned Flux m1n1 and U-Boot, composed by Fedora update-m1n1 with the matching
kernel package's J700 DTB. Stage 1 authorization remains an installer operation.
%prep
%setup -q -n m1n1
%setup -q -T -D -n m1n1 -a 1 -a 3
mkdir -p .cargo
cp %{SOURCE2} .cargo/config.toml
%build
export CARGO_NET_OFFLINE=true
export M1N1_VERSION_TAG=$(python3 -c 'import json; print("flux-" + json.load(open("%{SOURCE5}"))["sources"]["m1n1"]["commit"])')
make %{?_smp_mflags} USE_CLANG=1 ARCH=aarch64-linux-gnu BUILDSTD=1 RELEASE=1 CHAINLOADING=1
cp build/m1n1.bin stage1.bin
cp build/m1n1.macho stage1.macho
make clean
make %{?_smp_mflags} USE_CLANG=1 ARCH=aarch64-linux-gnu BUILDSTD=1 RELEASE=1 CHAINLOADING=1
make -C uboot O=out apple_m1_defconfig
# This package ships the target bootloader, not host FIT signing tools.
# OpenSSL 4 removed ENGINE; target FIT verification stays configured as upstream.
uboot/scripts/config --file uboot/out/.config --disable TOOLS_KWBIMAGE --disable TOOLS_LIBCRYPTO
make -C uboot O=out olddefconfig
grep -qx '# CONFIG_TOOLS_LIBCRYPTO is not set' uboot/out/.config
make -C uboot O=out %{?_smp_mflags} all
%install
install -Dm644 build/m1n1.bin %{buildroot}/usr/lib/flux-neo-boot/m1n1.bin
install -m644 stage1.bin stage1.macho %{buildroot}/usr/lib/flux-neo-boot/
install -m644 uboot/out/u-boot-nodtb.bin %{buildroot}/usr/lib/flux-neo-boot/
install -m644 %{SOURCE4} %{buildroot}/usr/lib/flux-neo-boot/update-m1n1.conf
install -Dm644 %{SOURCE5} %{buildroot}%{_datadir}/flux/sources/boot.json
%posttrans
mkdir -p /etc/sysconfig
if ! grep -Fqx '. /usr/lib/flux-neo-boot/update-m1n1.conf' /etc/sysconfig/update-m1n1 2>/dev/null; then
    printf '\n. /usr/lib/flux-neo-boot/update-m1n1.conf\n' >> /etc/sysconfig/update-m1n1
fi
if test -r /proc/device-tree/compatible && \
   tr '\000' '\n' < /proc/device-tree/compatible | grep -qx apple,j700; then
    /usr/bin/update-m1n1
fi
%files
%license LICENSE.GPL2 LICENSE.MIT 3rdparty_licenses/ uboot/Licenses/
/usr/lib/flux-neo-boot/
%{_datadir}/flux/sources/boot.json