Automount[1] the boot partition to  minimize vfat partition corruption risks.

This mounts the partition on demand and unmounts after use.

[1] https://www.freedesktop.org/software/systemd/man/latest/systemd.automount.html#

Signed-off-by: Vanessa Maegima <[email protected]>
(cherry picked from commit 52eadde)
Signed-off-by: Jose Quaresma <[email protected]>

Drop unneeded variable assigments as they don't make sense (the variable
is assigned to its value).

Signed-off-by: Igor Opaniuk <[email protected]>
(cherry picked from commit 14b1840)
Signed-off-by: Jose Quaresma <[email protected]>

Store stable boot firmware version in "fiovb.bootfirmware_version",
and use "bootfirmware_version" only as a temporary storage
for a target boot firmware version

Signed-off-by: Igor Opaniuk <[email protected]>
(cherry picked from commit 47083a3)
Signed-off-by: Jose Quaresma <[email protected]>

Signed-off-by: Jose Quaresma <[email protected]>
(cherry picked from commit fbcf51d)
Signed-off-by: Jose Quaresma <[email protected]>

Signed-off-by: Jose Quaresma <[email protected]>
(cherry picked from commit eb7b3a2)
Signed-off-by: Jose Quaresma <[email protected]>

Signed-off-by: Jose Quaresma <[email protected]>
(cherry picked from commit f92130d)
Signed-off-by: Jose Quaresma <[email protected]>

This allows us to reduce maintenance and testing effort.
If necessary, it can be added at the customer's factory.

Signed-off-by: Jose Quaresma <[email protected]>
(cherry picked from commit 73ab71f)
Signed-off-by: Jose Quaresma <[email protected]>

Generate a specular file (unlock) to the provisioning one.

Signed-off-by: Jorge Ramirez-Ortiz <[email protected]>
(cherry picked from commit 026661d)
Signed-off-by: Jose Quaresma <[email protected]>

Use efivar to access uefi variables in a standard way.

Signed-off-by: Jorge Ramirez-Ortiz <[email protected]>
(cherry picked from commit 352caf1)
Signed-off-by: Jose Quaresma <[email protected]>

Add support for a CI encrypted rootfs USB installer.

Signed-off-by: Jorge Ramirez-Ortiz <[email protected]>
(cherry picked from commit 2445ef2)
Signed-off-by: Jose Quaresma <[email protected]>

Using efivar --print-decimal returns an integer.

Fixes: 352caf1 ("base: initramfs-framework: refactor access to UEFI variables")
Fixes: 2445ef2 ("base: init-install-efi: installer: support encrypted rootfs")

Signed-off-by: Jorge Ramirez-Ortiz <[email protected]>
(cherry picked from commit 604223e)
Signed-off-by: Jose Quaresma <[email protected]>

Fix the current implementation where the passphrase is not being
propagated. Users can now request their own passphrases for CI luks
encryption.

Signed-off-by: Jorge Ramirez-Ortiz <[email protected]>
(cherry picked from commit 1c4ae75)
Signed-off-by: Jose Quaresma <[email protected]>

Systemd-boot will display its menu by alphabetically iterating the
different configuration files.

This commit makes sure that the secure boot menus (provision/revocation)
are displayed next to each other for a more structured screen.

Signed-off-by: Jorge Ramirez-Ortiz <[email protected]>
(cherry picked from commit 3d03807)
Signed-off-by: Jose Quaresma <[email protected]>

The UEFI key revocation tool requires the user to provide the keys that
need to be revoked.

If the keys are not provided, the userspace tools built by this recipe
will still be deployed.

Signed-off-by: Jorge Ramirez-Ortiz <[email protected]>
(cherry picked from commit fcd7286)
Signed-off-by: Jose Quaresma <[email protected]>

Instead of raising a Python exception, we can verify that all required
keys are present and provide a helpful error message if any are missing.

Signed-off-by: Jorge Ramirez-Ortiz <[email protected]>
Signed-off-by: Jose Quaresma <[email protected]>
(cherry picked from commit a135ad2)
Signed-off-by: Jose Quaresma <[email protected]>

On the first boot, systemd-boot 250.4 defaults to the last element on
the display list.

Make the OSTree deployment the last (alphabetically sorted)

Signed-off-by: Jorge Ramirez-Ortiz <[email protected]>
(cherry picked from commit 129b261)
Signed-off-by: Jose Quaresma <[email protected]>

Fix the path to the combo (tfa+fip) image ('s/arm-trusted-firmware/fip/g').

Fixes: 5413f74 ("bsp: tf-a-fio-st: create combo images for eval board")
Signed-off-by: Igor Opaniuk <[email protected]>
(cherry picked from commit d6b9d3f)
Signed-off-by: Jose Quaresma <[email protected]>