post about chroot for Replicant 6.0

1 files changed, 126 insertions, 0 deletions

diff --git a/content/debian-stretch-debootstrap-replicant.rst b/content/debian-stretch-debootstrap-replicant.rst
new file mode 100644
index 0000000..5d3f84a
--- /dev/null
+++ b/content/debian-stretch-debootstrap-replicant.rst
@@ -0,0 +1,126 @@
+:title: Setting up a Debian Stretch build environment for Replicant 6.0 using debootstrap
+:date: 2016-12-28 23:10
+:tags: debootstrap, toolchain, free software
+:category: General
+:author: Wolfgang Wiedmeyer
+:status: published
+:summary: Recently, I managed to to make `Replicant 6.0 <https://blog.replicant.us/2016/08/replicant-6-early-work-upstream-work-and-f-droid-issue/>`_ buildable on Debian Stretch. I'm still using Debian Jessie on my machines, so I set up a chroot with Stretch. I'll document all the necessary steps in the following to establish a Stretch build environment and build Replicant 6.0 inside it.
+
+Recently, I managed to to make `Replicant 6.0 <https://blog.replicant.us/2016/08/replicant-6-early-work-upstream-work-and-f-droid-issue/>`_ buildable on Debian Stretch. This makes it possible to use a lot of new Android-related packages in Debian. I'm still using Debian Jessie on my machines, so I set up a chroot with Stretch. I'll document all the necessary steps in the following to establish a Stretch build environment and build Replicant 6.0 inside it. This should work across many distros, although I only tested it on Debian Jessie. The only tool you'll need is a `debootstrap <https://wiki.debian.org/Debootstrap>`_ that contains the necessary scripts to set up a Debian Stretch chroot.
+
+Installing Debian Stretch in a chroot with debootstrap
+######################################################
+
+First install debootstrap. I recommend getting the latest version that is available for you, e.g. from `Jessie Backports <https://packages.debian.org/jessie-backports/debootstrap>`__. Then create a directory where you want the chroot to be.
+
+| `If you are using a kernel with grsecurity`:
+| `Grsecurity <https://grsecurity.net/>`_ does quite some hardening of chroots. Unfortunately, we need to disable a few of the configuration options to make debootstrap work. You will need to deactivate the following three in /etc/sysctl.d/grsec.conf:
+| ``kernel.grsecurity.chroot_deny_chmod``
+| ``kernel.grsecurity.chroot_caps``
+| ``kernel.grsecurity.chroot_deny_mount``
+| Depending on your configuration, a reboot might be necessary.
+|
+
+Then you can run debootstrap to set up a minimal Stretch install. The command needs to be run as root, while ``$YOUR_CHROOT_DIR`` is the absolute path to the directory you created for the chroot:
+
+.. code-block:: console
+
+   # debootstrap stretch $YOUR_CHROOT_DIR
+
+The proc filesystem needs to be mounted inside the chroot:
+
+.. code-block:: console
+
+   # mount proc $YOUR_CHROOT_DIR/proc/  -t proc
+
+Every time you enter the chroot to build Replicant 6.0, you will need to mount the proc filesystem. So I recommend adding a permanent entry in your ``/etc/fstab``::
+
+  proc $YOUR_CHROOT_DIR/proc proc defaults 0 0
+
+If you don't mount the proc filesystem, you will get very weird build errors and it might take some time until you figure out that it's because proc is not mounted. Trust me, I was already there.
+
+For initial setup, devpts also needs to be mounted:
+
+.. code-block:: console
+
+   # mount --bind /dev/pts $YOUR_CHROOT_DIR/dev/pts
+
+Then you can finally enter the chroot:
+
+.. code-block:: console
+
+   # chroot $YOUR_CHROOT_DIR
+
+Tell apt where it should get the source packages from:
+
+.. code-block:: console
+
+   # echo "deb-src http://deb.debian.org/debian stretch main" >> /etc/apt/sources.list
+
+Replacing ``deb.debian.org`` in your ``sources.list`` with a local mirror leads likely to a lot faster downloads and puts less load on the Debian servers. I'm in Germany so I have ``ftp.de.debian.org`` in my ``sources.list``.
+
+Then add the i386 architecture and update:
+
+.. code-block:: console
+
+   # dpkg --add-architecture i386
+   # apt-get update
+
+Before installing all the necessary build dependencies, locales needs to be configured correctly:
+
+.. code-block:: console
+
+   # apt-get install locales
+   # dpkg-reconfigure locales
+
+Then install all dependencies:
+
+.. code-block:: console
+
+   # apt-get build-dep gcc binutils llvm-defaults
+   # apt-get install gcc-arm-none-eabi cmake python-dev swig ant bc proguard maven-debian-helper libemma-java libasm4-java libguava-java libnb-platform18-java libnb-org-openide-util-java libandroidsdk-ddmlib-java libmaven-source-plugin-java libfreemarker-java libmaven-javadoc-plugin-java repo ca-cacert curl gawk libgmp3-dev libmpfr-dev libmpc-dev git-core gperf libncurses-dev squashfs-tools pngcrush zip zlib1g-dev lzma libc6-dev-i386 g++-multilib lib32z1-dev lib32readline-dev lib32ncurses5-dev zlib1g-dev:i386 xsltproc python-mako schedtool gradle dirmngr libandroidsdk-sdklib-java eclipse-jdt libgradle-android-plugin-java
+
+..
+   dpkg-reconfigure ca-certificates and enable cacert certs
+
+Add a user for building Replicant 6.0:
+
+.. code-block:: console
+
+   # adduser $YOUR_USER
+
+|
+| `If you are using a kernel with grsecurity`:
+| In case Trusted Path Execution (TPE) is enabled, you will have to recreate the group inside the chroot and add your user to it:
+| groupadd -r -g 64040 grsec-tpe
+| usermod -aG grsec-tpe $YOUR_USER
+|
+
+Switch to your user:
+
+.. code-block:: console
+
+   # su $YOUR_USER
+
+Create the directory where you want the Replicant 6.0 sources to be. And run all the needed commands to get the sources, build it for the Galaxy S3 and flash it to the device inside this directory:
+
+.. code-block:: console
+
+   $ repo init -u https://code.fossencdi.org/replicant_manifest.git -b replicant-6.0
+   $ repo sync
+   $ ./vendor/replicant/get-prebuilts # also checks the signature of the downloaded apk (see https://f-droid.org/wiki/page/Release_Channels_and_Signing_Keys)
+   $ ./vendor/replicant/build-toolchain
+   $ . build/envsetup.sh
+   $ lunch replicant_i9300-userdebug
+   $ make -j $(nproc) bacon
+   $ ./vendor/replicant/sign-build
+   $ heimdall flash --BOOT out/dist/recovery.img --RECOVERY out/dist/recovery.img # while in Downloading mode
+   $ adb sideload out/dist/replicant-6.0.zip # sideloading in recovery mode
+
+If you want to get the latest stuff, you can sync with the development branch:
+
+.. code-block:: console
+
+   $ repo init -u https://code.fossencdi.org/replicant_manifest.git -b replicant-6.0-dev
+
+But depending on the current development state, the resulting image may have some serious bugs or the build could be broken.