eib_image

#!/bin/bash -ex
# -*- mode: Shell-script; sh-basic-offset: 2; indent-tabs-mode: nil -*-
. "${EIB_BASELIB}"

# We do all fs preparation on the host disk, before then copying it into
# an image, in preparation for later development where the image will be sized
# dynamically based on how much data it includes.

mutable_deployment() {
  if [ -n "${OSTREE_DEPLOYMENT}" ]; then
    "${EIB_HELPERSDIR}"/mutable-path "${OSTREE_DEPLOYMENT}"
  fi
}

kill_procs() {
  if [ -n "${OSTREE_DEPLOYMENT}" ]; then
    "${EIB_HELPERSDIR}"/kill-chroot-procs "${OSTREE_DEPLOYMENT}"
  fi
}

cleanup_devices() {
  if [ -n "${img_loop}" ]; then
    eib_partx_delete "${img_loop}"
    eib_delete_loop "${img_loop}"
  fi
  unset img_loop

  if [ -n "${sdboot_esp_img_loop}" ]; then
    eib_delete_loop "${sdboot_esp_img_loop}"
  fi
  unset sdboot_esp_img_loop
}

cleanup() {
  mutable_deployment || :
  kill_procs || :
  eib_umount_all || :
  cleanup_devices || :
}
trap cleanup EXIT

recreate_dir "${EIB_OSTREE_CHECKOUT}"
REPOPATH=${EIB_OSTREE_CHECKOUT}/ostree/repo
BOOT=${EIB_OSTREE_CHECKOUT}/boot

ostree admin init-fs "${EIB_OSTREE_CHECKOUT}"
ostree admin --sysroot="${EIB_OSTREE_CHECKOUT}" os-init ${EIB_OSTREE_OS}
ostree --repo="${REPOPATH}" remote add ${EIB_OSTREE_REMOTE} \
  ${EIB_OSTREE_DEPLOY_URL} ${EIB_OSTREE_REF_DEPLOY}
ostree --repo="${REPOPATH}" pull-local --disable-fsync \
  --remote=${EIB_OSTREE_REMOTE} ${EIB_OSTREE_REPODIR} ${EIB_OSTREE_REF_DEPLOY}

# Pull the repo metadata ref so USB updates are possible without going online
ostree --repo="${REPOPATH}" pull ${EIB_OSTREE_REMOTE} ostree-metadata

# Basic bootloader setup
if [[ "${EIB_ARCH}" == "arm64" ]]; then
  mkdir -p "${BOOT}"/loader.0
  ln -s loader.0 "${BOOT}"/loader
  # Empty uEnv.txt otherwise ostree gets upset
  > "${BOOT}"/loader/uEnv.txt
  ln -s loader/uEnv.txt "${BOOT}"/uEnv.txt
  ostree --repo="${REPOPATH}" config set sysroot.bootloader uboot
else
  # Assume grub for all other architectures
  mkdir -p "${BOOT}"/grub

  # Configure the ostree bootloader to none so it only makes BLS entries
  # and doesn't try to update grub.cfg.
  ostree --repo="${REPOPATH}" config set sysroot.bootloader none
fi

# 62MB seems to be arbitrarily chosen to minimize the impact of the ESP
# on non-EFI and low storage (small EMMC) devices.
esp_size=62
if [[ "${EIB_IMAGE_SDBOOT}" = "true" ]]; then
  sdboot_esp_img="${EIB_TMPDIR}/${EIB_OUTVERSION}_sdboot.img"
  # https://systemd.io/BOOT_LOADER_SPECIFICATION/ suggests 500MB is a
  # "suitable" size for an ESP.
  # We'll be using the increase in space to store kernel+initramfs
  # for an active and potentially a rollback copy.
  esp_size=500
  rm -f "${sdboot_esp_img}"
  truncate -s ${esp_size}M "${sdboot_esp_img}"
  mkfs.vfat "${sdboot_esp_img}" -n EFI
  sdboot_esp_img_loop=$(losetup -f --show "${sdboot_esp_img}")
  # Currently our ostree + sd-boot implementation creates fake
  # symlinks on vfat. We need the vfat ESP to be mounted at
  # deploy time to ensure these fake symlinks are created.
  eib_mount ${sdboot_esp_img_loop} "${BOOT}"

  # We set the OSTREE_DEPLOY_PAYG env var to alert ostree to the
  # fact that we're deploying a PAYG image.
  export OSTREE_DEPLOY_PAYG=1
fi

kargs=(--karg=rw --karg=splash \
    --karg=plymouth.ignore-serial-consoles --karg=quiet --karg=loglevel=0)
ostree admin --sysroot="${EIB_OSTREE_CHECKOUT}" deploy \
  --os=${EIB_OSTREE_OS} "${kargs[@]}" \
  ${EIB_OSTREE_REMOTE}:${EIB_OSTREE_REF_DEPLOY}

# Set the repo add-remotes-config-dir option to false. This prevents
# ostree remotes from being added in /etc/ostree/remotes.d, which breaks
# flatpak due to the way it manages remotes. This can probably be
# removed later when ostree has a coherent way to modify existing
# remotes and all our ostree users are using it.
#
# https://phabricator.endlessm.com/T19077
ostree --repo="${REPOPATH}" config set core.add-remotes-config-dir false

# Set the OS remote collection ID if it's enabled and the remote has a
# collection ID
if [ "${EIB_OSTREE_ENABLE_P2P_UPDATES}" = true ]; then
  collection_id=$("${EIB_HELPERSDIR}"/fetch-remote-collection-id \
                  "${REPOPATH}" "${EIB_OSTREE_REMOTE}")
  if [ -n "$collection_id" ]; then
    # Set the value directly in the configuration since ostree doesn't
    # have a good method to modify a remote
    ostree --repo="${REPOPATH}" config set \
           "remote \"${EIB_OSTREE_REMOTE}\".collection-id" \
           "${collection_id}"

    # Ostree uses signed per-repo and per-commit metadata rather than
    # summary signatures when collection IDs are used
    ostree --repo="${REPOPATH}" config set \
           "remote \"${EIB_OSTREE_REMOTE}\".gpg-verify-summary" \
           "false"
  fi
fi

# There's no current symlink anymore, so query the deployment status.
# This will be the second parameter on the first line.
export OSTREE_CURRENT_DEPLOYMENT=$(ostree admin \
  --sysroot="${EIB_OSTREE_CHECKOUT}" status | awk '{print $2; exit}')
export OSTREE_DEPLOYMENT="${EIB_OSTREE_CHECKOUT}"/ostree/deploy/${EIB_OSTREE_OS}/deploy/${OSTREE_CURRENT_DEPLOYMENT}
export OSTREE_VAR="${EIB_OSTREE_CHECKOUT}"/ostree/deploy/${EIB_OSTREE_OS}/var

treeinfo="${EIB_TMPDIR}"/ostree.txt
echo "Branch ${EIB_OSTREE_REF}" > ${treeinfo}
ostree --repo="${EIB_OSTREE_CHECKOUT}"/ostree/repo show \
  ${EIB_OSTREE_REF_DEPLOY} >> ${treeinfo}

if [[ "${EIB_IMAGE_SDBOOT}" = "true" ]]; then
  eib_umount "${BOOT}"
  eib_delete_loop "${sdboot_esp_img_loop}"
  unset sdboot_esp_img_loop
fi

run_hooks content "${OSTREE_DEPLOYMENT}"

create_image() {
  local outfile=$1

  # Create images according to data size with additional free space. The
  # extra free space is used for 2 reasons:
  #
  # 1. The du estimate tends to be low compared to the space actually
  #    used by the copy.
  # 2. We want to boot without a totally full disk even though the
  #    partitions and file systems are expanded on first boot.
  #
  # The free space is the minimum of 5% of calculated size or 1GB,
  # rounded down to the nearest 512-byte sector.
  local img_size=$(du --block-size=1 -s "${EIB_OSTREE_CHECKOUT}")
  img_size=${img_size%$'\t'*}
  local extra_size=$((img_size * 5 / 100))
  local min_extra_size=$((2 ** 30))
  (( extra_size < min_extra_size )) && extra_size=${min_extra_size}
  (( img_size += extra_size ))
  (( img_size -= img_size % 512 ))

  if [[ "${EIB_IMAGE_MAX_SIZE}" ]] && (( img_size > EIB_IMAGE_MAX_SIZE )); then
    echo "ERROR: $1 image size ${img_size} exceeds ${EIB_IMAGE_MAX_SIZE}" >&2
    return 1
  fi

  echo "Creating $1 image with size ${img_size}"

  local img="${EIB_TMPDIR}/${EIB_OUTVERSION}.img"
  rm -f "${img}"
  truncate -s ${img_size} "${img}"

  (
    if [ "${EIB_PLATFORM}" == "pinebookpro" ]; then
        # Rockchip's boot partition starts at 32768
        # http://opensource.rock-chips.com/wiki_Partitions#Default_storage_map
        echo -n "start=32768, "
    else
        # Empty space up to 1mb (for GPT, and for uboot on ARM)
        echo -n "start=2048, "
    fi

    case "${EIB_ARCH}" in
      i386|amd64)
        # EFI system partition
        echo "size=${esp_size}MiB, type=C12A7328-F81F-11D2-BA4B-00A0C93EC93B"
        if [[ "${EIB_IMAGE_SDBOOT}" != "true" ]]; then
          # GRUB BIOS BOOT partition
          echo "size=1MiB, type=21686148-6449-6E6F-744E-656564454649"
        fi
        ;;
    esac

    # Raspberry Pi's GPU starts the boot process by loading bootloader blobs
    # from the first partition which must be VFAT.
    if [ "${EIB_PLATFORM:0:3}" == "rpi" ]; then
        # BOOT Partition using EFI System type for RPi firmware
        echo "size=512MiB, type=C12A7328-F81F-11D2-BA4B-00A0C93EC93B"
    fi

    if [ "${EIB_IMAGE_PARTITION_TABLE}" == "dos" ]; then
      part_type="83"
    else
      # Partition Type GUIDs
      # https://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/
      case "${EIB_ARCH}" in
        i386|amd64)
          # Root Partition (x86-64)
          part_type="4F68BCE3-E8CD-4DB1-96E7-FBCAF984B709"
          ;;
        arm64)
          # Root Partition (64-bit ARM)
          part_type="b921b045-1df0-41c3-af44-4c6f280d3fae"
          ;;
        *)
          echo "Unrecognized architecture ${EIB_ARCH}" >&2
          return 1
          ;;
      esac
    fi

    rootfs_attrs=()

    if [[ "${EIB_IMAGE_ROOTFS_RESIZE}" == "true" ]]; then
      # Remaining space is root fs, with special the special 55 attr as a
      # marker indicating the partition should be resized later
      # attrs=... is unused for DOS partition table so it's safe to leave it here
      rootfs_attrs+=("GUID:55")
    fi

    if [[ "${EIB_PLATFORM:0:3}" == "rpi" ]]; then
      # Make u-boot find the bootable partition which is rootfs for Raspberry Pi
      rootfs_attrs+=("LegacyBIOSBootable")
    fi

    # We need to escape attrs= otherwise sfdisk complains when passing an empty string
    echo "type=${part_type}, attrs=\"$(echo ${rootfs_attrs[@]} | tr ' ' ',')\""

  ) | sfdisk --force --label "${EIB_IMAGE_PARTITION_TABLE}" "${img}"

  if [ "${EIB_IMAGE_PARTITION_TABLE}" == "dos" ] && [ "${EIB_IMAGE_ROOTFS_RESIZE}" == "true" ]; then
    # With the latest 'sfdisk' we are not allowed anymore to create a 0B partition
    # Bypass this limitation directly hacking into the MBR to set the marker
    printf "\xdd" | dd of=${img} bs=1 count=1 seek=498 conv=notrunc
  fi

  img_loop=$(losetup -f --show "${img}")
  eib_partx_scan "${img_loop}"

  ROOT="${EIB_TMPDIR}"/mnt
  DEPLOY="${ROOT}"/ostree/deploy/${EIB_OSTREE_OS}/deploy/${OSTREE_CURRENT_DEPLOYMENT}

  case "${EIB_ARCH}" in
    i386|amd64)
      if [[ "${EIB_IMAGE_SDBOOT}" == "true" ]]; then
        esp_loop=${img_loop}p1
        root_loop=${img_loop}p2
      else
        esp_loop=${img_loop}p1
        bios_boot_loop=${img_loop}p2
        root_loop=${img_loop}p3
      fi
      ext4_opts="dir_index,^huge_file"
      ESP="${ROOT}"/boot/efi
      if [[ "${EIB_IMAGE_SDBOOT}" = "true" ]]; then
        dd conv=notrunc if="${sdboot_esp_img}" of="${esp_loop}" bs=1M
      else
        mkfs.vfat "${esp_loop}" -n EFI
      fi
      ;;
    *)
      # On ARM disable 64bit ext4 option
      ext4_opts="dir_index,^huge_file,^64bit"
      if [ "${EIB_PLATFORM:0:3}" == "rpi" ]; then
        boot_loop=${img_loop}p1
        root_loop=${img_loop}p2
      else
        root_loop=${img_loop}p1
      fi
      ;;
  esac

  mke2fs -t ext4 -O ${ext4_opts} -m1 -L ostree -T default ${root_loop}
  mkdir -p "${ROOT}"
  eib_mount ${root_loop} "${ROOT}"

  if [ -n "$ESP" ]; then
      mkdir -p "${ESP}"
      eib_mount ${esp_loop} "${ESP}"
  fi

  # Copy all the files, preserving attributes, timestamps, hardlinks, etc.
  #
  # --no-inc-recursive makes rsync scan the whole tree to find hardlinks before
  # copying, and its use in combination with -H is documented to do what we
  # want.
  rsync -aHAX --no-inc-recursive "${EIB_OSTREE_CHECKOUT}/" "${ROOT}/"

  eib_write_version_xattr "${ROOT}"

  # Report on the free space
  df --block-size=1 "${ROOT}"

  # Make the deployment root mutable and delete the checkout since it's
  # no longer needed after this. Unset checkout derived variables so we
  # don't try to operate on them later (e.g., making a non-existent
  # OSTREE_DEPLOYMENT mutable at exit).
  mutable_deployment
  rm -rf "${EIB_OSTREE_CHECKOUT}"
  unset OSTREE_DEPLOYMENT OSTREE_VAR

  # Begin the images manifest fragment
  img_manifest="${EIB_MANIFESTDIR}"/images
  cat > "${img_manifest}" <<EOF
{
  "images": {
EOF

  # Install bootloader
  case "${EIB_ARCH}" in
    arm64)
      # Make a boot script for u-boot
      mkimage -T script -C none -n "Endless OS arm64 boot script" -d \
        "${EIB_DATADIR}"/arm64/boot.src \
        "${ROOT}"/boot/boot.scr

      case "${EIB_PLATFORM}" in
        rpi4)
          mkfs.vfat ${boot_loop}

          # Copy Raspberry Pi's bootloader & device tree blobs
          # https://phabricator.endlessm.com/T27942#760094
          mkdir ${EIB_TMPDIR}/rpiboot
          eib_mount ${boot_loop} ${EIB_TMPDIR}/rpiboot

          cp ${EIB_DATADIR}/rpi-common/* ${EIB_TMPDIR}/rpiboot/

          eval $(grep "^fdtdir=" ${ROOT}/boot/uEnv.txt)
          FDTDIR="${ROOT}/${fdtfit}"
          cp ${FDTDIR}/broadcom/bcm2711-rpi-4*.dtb ${EIB_TMPDIR}/rpiboot/
          cp -r ${FDTDIR}/overlays ${EIB_TMPDIR}/rpiboot/

          # Copy Raspberry Pi's u-boot
          local UBOOT_PATH="${DEPLOY}"/usr/lib/u-boot/rpi_arm64
          cp ${UBOOT_PATH}/u-boot.bin ${EIB_TMPDIR}/rpiboot/kernel8.img
          eib_umount ${EIB_TMPDIR}/rpiboot
	  ;;
        pinebookpro)
          # U-Boot TPL for ddr init and SPL for trust(ATF/OP-TEE) load and run into next stage
          # http://opensource.rock-chips.com/wiki_Boot_option#Boot_flow
          local UBOOT_PATH="${DEPLOY}"/usr/lib/u-boot/pinebook-pro-rk3399
          dd conv=notrunc if="${UBOOT_PATH}"/idbloader.img of=${img} bs=512 seek=64
          dd conv=notrunc if="${UBOOT_PATH}"/u-boot.itb of=${img} bs=512 seek=16384
          ;;
        *)
          echo "Unrecognized arm64 platform ${EIB_PLATFORM}" >&2
          return 1
          ;;
      esac
      ;;
    i386|amd64)
      if [[ "${EIB_IMAGE_SDBOOT}" == "true" ]]; then
        # PAYG uses systemd-boot, install only that
        mkdir -p "${ESP}/EFI/BOOT/"
        cp -r "${DEPLOY}/usr/lib/systemd/boot/efi/systemd-bootx64.efi" "${ESP}/EFI/BOOT/BOOTX64.efi"
      else
        # MBR bootloader install
        > "${DEPLOY}"/img
        mount --bind "${img}" "${DEPLOY}"/img
        mount --bind "${ROOT}"/boot "${DEPLOY}"/boot
        mount --bind /dev "${DEPLOY}"/dev
        mount --bind /proc "${DEPLOY}"/proc
        mount --bind /sys "${DEPLOY}"/sys

        # Install the real MBR bootloader
        chroot "${DEPLOY}" /usr/sbin/grub-install \
                     --modules="ext2 part_msdos part_gpt search" \
                     --directory=/usr/lib/grub/i386-pc \
                     --config=/usr/lib/grub/conf/grub_embedded_bios.cfg \
                     /img

        # Copy grub.cfg
        cp "${DEPLOY}/usr/lib/grub/conf/grub.cfg" "${DEPLOY}/boot/grub/grub.cfg"

        if [ "$EIB_IMAGE_BOOT_ZIP" == "true" ]; then
          local boot_zip_dir=${EIB_TMPDIR}/boot_zip
          mkdir "${boot_zip_dir}"

          # Generate GRUB standalone images and eosldr
          "${EIB_HELPERSDIR}"/create-grub-images "${DEPLOY}" "${boot_zip_dir}"

          # Capture second-stage config and modules
          cp -a "${DEPLOY}/boot/grub" "${boot_zip_dir}"
        fi

        "${EIB_HELPERSDIR}"/kill-chroot-procs "${DEPLOY}"
        umount "${DEPLOY}"/{boot,dev,img,proc,sys}
        rm -f "${DEPLOY}"/img

        # Standard endless system - grub, shim, all that kind of thing
        cp -r "${DEPLOY}"/usr/lib/efi_binaries/EFI "${ESP}"
      fi

      if [ "$EIB_IMAGE_BOOT_ZIP" == "true" ]; then
        # Capture EFI GRUB for both live+installer and dual-boot image boots.
        #
        # From 3.6.x onwards, our ESP has the following layout:
        #
        # EFI/
        #   endless/
        #     grubx64.efi
        #     shimx64.efi
        #     BOOTX64.CSV
        #     mmx64.efi
        #   BOOT/
        #     BOOTX64.EFI  - identical to shimx64.efi
        #     fbx64.efi
        #     mmx64.efi
        #
        # However, the installer for Windows, eos-write-live-image from
        # eos-meta, and helpers/create-iso in this repository all expect the
        # following layout in boot.zip:
        #
        # EFI/
        #   BOOT/
        #     BOOTX64.EFI
        #     grubx64.efi
        #     mmx64.efi
        #
        # For dual-boot installs, we copy the entire contents of EFI/BOOT to
        # EFI/Endless on the ESP, and creates a boot entry for
        # EFI/Endless/bootx64.efi. For ISOs and live USBs, we just copy the
        # whole of EFI from boot.zip to the ESP. So for backwards-compatibility
        # in the dual-boot case, and simplicity in the ISO/live case, we
        # arrange for EFI/ to have the right structure:
        mkdir -p "${boot_zip_dir}/EFI/BOOT"
        cp "${DEPLOY}"/usr/lib/efi_binaries/EFI/endless/shimx64.efi "${boot_zip_dir}/EFI/BOOT/BOOTX64.EFI"
        cp \
          "${DEPLOY}"/usr/lib/efi_binaries/EFI/endless/mmx64.efi \
          "${DEPLOY}"/usr/lib/efi_binaries/EFI/endless/grubx64.efi \
          "${boot_zip_dir}/EFI/BOOT"

        # In case we want to use the additional files in a future release of
        # the installer, we include just those files in a different directory.
        # (In the past we created "EFI2" with the full contents of the ESP but
        # triplicating Shim and duplicating the 64-bit GRUB added 50% to the
        # boot.zip size, and this directory was never actually used.)
        mkdir -p "${boot_zip_dir}/EFI3/BOOT" "${boot_zip_dir}/EFI3/endless"
        cp "${DEPLOY}"/usr/lib/efi_binaries/EFI/endless/fbx64.efi "${boot_zip_dir}/EFI3/BOOT"
        cp "${DEPLOY}"/usr/lib/efi_binaries/EFI/endless/bootx64.csv "${boot_zip_dir}/EFI3/endless/BOOTX64.CSV"

        # Bundle all GRUB versions up for distribution
        local boot_zip="$(eib_outfile boot.zip)"
        (cd "${boot_zip_dir}" && zip "${boot_zip}" -r *)
        rm -r "${boot_zip_dir}"
        sign_file "${boot_zip}" &
        checksum_file "${boot_zip}" &

        # Generate manifest information
        local boot_zip_name=$(basename "${boot_zip}")
        local boot_zip_size=$(stat -c "%s" "${boot_zip}")
        local boot_zip_signature="${boot_zip_name}.asc"
        local boot_zip_checksum="${boot_zip_name}.sha256"
        cat >> "${img_manifest}" <<EOF
    "boot": {
      "file": "${boot_zip_name}",
      "compressed_size": ${boot_zip_size},
      "compression_type": "zip",
      "signature": "${boot_zip_signature}",
      "checksum": "${boot_zip_checksum}"
    },
EOF
      elif [[ "${EIB_IMAGE_SDBOOT}" == "true" ]]; then
        # We're building a PAYG image, so do nothing and move on instead
        # of polluting the ESP with non-PAYG binaries.
        :
      else
        # No boot.zip means this is eosinstaller, not an installable image.
        # Since this will only be used on removable media, it should not
        # include fallback, which alters the system's BootOrder. In effect,
        # we are recreating the layout in boot.zip/EFI, only on the real ESP.
        rm "${ESP}/EFI/BOOT/fbx64.efi"
        mv \
          "${ESP}/EFI/endless/mmx64.efi" \
          "${ESP}/EFI/endless/grubx64.efi" \
          "${ESP}/EFI/BOOT/"
        rm -r "${ESP}/EFI/endless"
      fi
      ;;
    *)
      echo "Unrecognized architecture ${EIB_ARCH}" >&2
      return 1
      ;;
  esac

  eib_fix_boot_checksum "${img_loop}" "${DEPLOY}"

  # Read OS version from ostree deployment before we unmount it
  local version=$(. ${DEPLOY}/etc/os-release && echo ${VERSION})

  # Restore the immutable attribute on the deployment root lost via cp.
  # Note that errors are not ignored here as we require the deployment
  # root to be immutable.
  chattr +i "${DEPLOY}"

  # Cleanup mounts
  eib_umount_all

  # Check the image for errors
  e2fsck -f -p "${root_loop}"

  # Cleanup devices
  cleanup_devices

  # Sign and checksum uncompressed image (used when installing from a
  # live image)
  local img_asc="$(eib_outfile img.asc)"
  local img_csum="$(eib_outfile img.sha256)"
  local img_csum_tgt="${EIB_OUTVERSION}.img"
  sign_file "${img}" "${img_asc}" &
  checksum_file "${img}" "${img_csum}" "${img_csum_tgt}" &

  # Publish uncompressed file size.
  local img_extracted_size=$(stat -c "%s" "${img}")
  echo "${img_extracted_size}" > "${outfile}.size"

  # Compress image file.
  eib_compress_image "${img}" "${outfile}"

  # Sign and checksum compressed image (used to verify download)
  sign_file ${outfile} &
  checksum_file ${outfile} &

  # Copy ostree and config info to the output directory.
  cp "${EIB_TMPDIR}"/ostree.txt "$(eib_outfile ostree.txt)"
  cp "${EIB_TMPDIR}"/config.ini "$(eib_outfile config.ini)"

  # Create ISO if required. This requires the uncompressed image,
  # boot.zip and their associated checksums and signatures.
  if [[ "${EIB_IMAGE_ISO}" = "true" && "$EIB_IMAGE_BOOT_ZIP" = "true" ]]; then
    # Make sure the uncompressed checksums and signatures have
    # completed. In theory we could `wait` only for the checksums and
    # signatures and allow compressing the image and signing it to
    # happen in parallel with creating the ISO.
    wait

    "${EIB_HELPERSDIR}"/create-iso "${version}" "$(eib_outfile iso)" \
      "${img}" "${boot_zip}" "${img_csum}" "${boot_zip}.sha256" "${img_asc}" \
      "${boot_zip}.asc"
  fi

  # Create VM image if required
  if [[ "${EIB_IMAGE_VM_IMAGE}" = "true" && "${EIB_ARCH}" == "amd64" ]]; then
    "${EIB_HELPERSDIR}"/create-vm-image "$(eib_outfile ovf.zip)" "${img}"
  fi

  # Create qcow2 image if required.
  if [ "${EIB_IMAGE_QCOW2}" = true ]; then
    local qcow2

    # Convert the raw image to qcow2 with compression (-c). This uses
    # zlib, but it would be better to use zstd with -o
    # compression_type=zstd. zstd support was added as an option in QEMU
    # 5.1 in 2020, but we'd want to make sure zstd support was included
    # in any distros/flatpaks we cared about.
    qcow2=$(eib_outfile qcow2)
    qemu-img convert -c -f raw -O qcow2 "${img}" "${qcow2}"

    # Since the format is copy-on-write, we can grow it as much as we
    # want without increasing the download size. Add 10 GiB.
    qemu-img resize -f qcow2 "${qcow2}" +10G

    stat -c "%s" "${qcow2}" > "${qcow2}.size"
    sign_file "${qcow2}" &
    checksum_file "${qcow2}" &
  fi

  # Await signing and checksumming subprocesses
  wait

  # Remove uncompressed image
  rm -f "${img}"

  # Finish image manifest info
  local img_name=$(basename "${outfile}")
  local img_compressed_size=$(stat -c "%s" "${outfile}")
  local img_signature="${img_name}.asc"
  local img_checksum="${img_name}.sha256"
  cat >> "${img_manifest}" <<EOF
    "full": {
      "file": "${img_name}",
      "extracted_size": ${img_extracted_size},
      "compressed_size": ${img_compressed_size},
      "compression_type": "${EIB_IMAGE_COMPRESSION}",
      "signature": "${img_signature}",
      "checksum": "${img_checksum}"
    }
  }
}
EOF
}

echo "Create image for personality ${EIB_PERSONALITY}"

# Mount the deployment directory over itself so / is a real mount in the
# chroot. This is needed for bubblewrap, which wants to mark the / mount
# as a slave.
eib_mount --bind "${OSTREE_DEPLOYMENT}" "${OSTREE_DEPLOYMENT}"

# Mark the hook root mount private. This has 2 benefits:
#
# 1. Any mounts placed under it will not leak out to the parent mount.
#    That keeps aliased mounts from showing up elsewhere in the system.
#
# 2. Bubblewrap uses pivot_root, which requires that the old root is not
#    a shared mount.
mount --make-private "${OSTREE_DEPLOYMENT}"

# Finally, pivot_root also requires that the parent of the old root is
# not a shared mount. Bind mount the hook root over itself again so the
# parent is the above private mount.
#
# See https://github.com/projectatomic/bubblewrap/issues/135.
eib_mount --bind "${OSTREE_DEPLOYMENT}" "${OSTREE_DEPLOYMENT}"

# Mount kernel filesystems into deployment for image hooks
eib_mount -t sysfs sysfs "${OSTREE_DEPLOYMENT}"/sys
eib_mount -t proc proc "${OSTREE_DEPLOYMENT}"/proc
eib_mount --bind /dev "${OSTREE_DEPLOYMENT}"/dev
eib_mount --bind /dev/pts "${OSTREE_DEPLOYMENT}"/dev/pts

# Mount a tmpfs at /tmp so that hooks can use it without persisting to
# the image
eib_mount -t tmpfs tmpfs "${OSTREE_DEPLOYMENT}"/tmp

# Bind mount OS /var over deployment's /var for image hooks
eib_mount --bind "${OSTREE_VAR}" "${OSTREE_DEPLOYMENT}"/var

# Bind mount the checkout over deployment's /sysroot, so the ostree repo
# is available for image hooks
eib_mount --bind "${EIB_OSTREE_CHECKOUT}" "${OSTREE_DEPLOYMENT}"/sysroot

# Bind mount the cache and source directories into the deployment so
# chroot hooks can access them
export EIB_CACHEDIR_CHROOT=/tmp/eos-image-builder
export EIB_SRCDIR_CHROOT=${EIB_CACHEDIR_CHROOT}/src
mkdir -p "${OSTREE_DEPLOYMENT}${EIB_CACHEDIR_CHROOT}" \
      "${OSTREE_DEPLOYMENT}${EIB_SRCDIR_CHROOT}"
eib_mount --bind "${EIB_CACHEDIR}" \
          "${OSTREE_DEPLOYMENT}${EIB_CACHEDIR_CHROOT}"
eib_mount --bind "${EIB_SRCDIR}" \
          "${OSTREE_DEPLOYMENT}${EIB_SRCDIR_CHROOT}"

# Copy in the host's /etc/resolv.conf so the one from the ostree (if it
# exists) is not used and DNS can be resolved.
cp -f /etc/resolv.conf "${OSTREE_DEPLOYMENT}"/etc/resolv.conf

# /usr/local is a symlink to /var/local in the ostree, but /var/local
# doesn't exist yet since it's created from systemd-tmpfiles at runtime.
# Create it now so that hooks can populate /usr/local.
if [ -L "${OSTREE_DEPLOYMENT}"/usr/local ]; then
  usr_local_link=$(readlink "${OSTREE_DEPLOYMENT}"/usr/local)
  if [ "${usr_local_link::1}" = / ]; then
    # Absolute path, prepend the deployment root
    usr_local_target="${OSTREE_DEPLOYMENT}${usr_local_link}"
  else
    # Relative path, prepend the deployment's /usr
    usr_local_target="${OSTREE_DEPLOYMENT}/usr/${usr_local_link}"
  fi

  mkdir -p "${usr_local_target}"
fi

recreate_dir "${EIB_OUTDIR}"
run_hooks image "${OSTREE_DEPLOYMENT}"
"${EIB_HELPERSDIR}"/kill-chroot-procs "${OSTREE_DEPLOYMENT}"
eib_umount_all

# Clear the cache and source mount variables in case they're used
# somewhere else
unset EIB_CACHEDIR_CHROOT EIB_SRCDIR_CHROOT

# Delete the resolv.conf copy so it's not shipped
rm -f "${OSTREE_DEPLOYMENT}"/etc/resolv.conf

create_image "$(eib_outfile img.${EIB_IMAGE_COMPRESSION})"