Add a way to exclude named firmware packages from media

So we can control which packages are included - see
tasks/$codename/firmware-exclude

Makefile

@@ -170,7 +170,7 @@ ifneq ($(ARCHES),source)
 		$(BASEDIR)/tools/generate_di+k_list
 ifeq ($(FORCE_FIRMWARE),1)
 	# Generate firmware task file using the contents of the archive
-	$(Q)$(BASEDIR)/tools/generate_firmware_task "$(ARCHES)" $(TASKDIR)/firmware
+	$(Q)$(BASEDIR)/tools/generate_firmware_task "$(ARCHES)" $(TASKDIR)/exclude-firmware $(TASKDIR)/firmware
 endif
 ifeq ($(DEBIAN_EDU),1)
 	# Generate Debian Edu task file containing (almost) all of Debian Edu's packages

debian/changelog

@@ -3,6 +3,9 @@ debian-cd (3.2.2) UNRELEASED; urgency=medium
   [ Steve McIntyre ]
   * Start development for trixie
   * Remove old config and data for jessie and stretch
+  * Add a way to exclude named firmware packages from media, so we can
+    control which packages are included - see
+    tasks/$codename/firmware-exclude
 
  -- Steve McIntyre <93sam@debian.org>  Mon, 12 Jun 2023 08:36:50 +0100
 

tasks/bookworm/exclude-firmware

@@ -0,0 +1,26 @@
+/* 
+ * List the n-f-f packages that we do *not* want to include on media.
+ * Parsed using cpp, so C-style comments will work here.
+ */
+
+/* Always exclude these packages: only useful with non-free drivers
+   that we can't and won't ship */
+firmware-nvidia-gsp
+firmware-nvidia-tesla-gsp
+
+/* If we don't have an arm* architecture, exclude these */
+#if !defined(ARCHarm64) && !defined(ARCHarmel) && !defined(ARCHarmhf)
+arm-trusted-firmware-tools
+crust-firmware
+firmware-qcom-soc
+firmware-samsung
+raspi-firmware
+#endif
+
+/* If we don't have an x86 architecture, exclude these */
+#if !defined(ARCHamd64) && !defined(ARCHi386)
+amd64-microcode
+firmware-intel-sound
+firmware-sof-signed
+intel-microcode
+#endif

tasks/trixie/exclude-firmware

@@ -0,0 +1,26 @@
+/* 
+ * List the n-f-f packages that we do *not* want to include on media.
+ * Parsed using cpp, so C-style comments will work here.
+ */
+
+/* Always exclude these packages: only useful with non-free drivers
+   that we can't and won't ship */
+firmware-nvidia-gsp
+firmware-nvidia-tesla-gsp
+
+/* If we don't have an arm* architecture, exclude these */
+#if !defined(ARCHarm64) && !defined(ARCHarmel) && !defined(ARCHarmhf)
+arm-trusted-firmware-tools
+crust-firmware
+firmware-qcom-soc
+firmware-samsung
+raspi-firmware
+#endif
+
+/* If we don't have an x86 architecture, exclude these */
+#if !defined(ARCHamd64) && !defined(ARCHi386)
+amd64-microcode
+firmware-intel-sound
+firmware-sof-signed
+intel-microcode
+#endif

tools/generate_firmware_task

@@ -16,14 +16,17 @@
 #
 
 use strict;
+use File::Basename;
 
-my ($mirror, $codename, $archlist, $outfile, $localdebs, $backports);
+my ($mirror, $codename, $archlist, $excludelist, $outfile, $localdebs, $backports);
 my $date;
+my $tasksdir;
 my (@pkgfiles, @bp_pkgfiles);
 my ($pkg, $filename, $arch);
 my %seen;
 my @components;
-
+my $cpp_command;
+my %excluded;
 
 sub contains_firmware($$) {
     my $count = 0;
@@ -54,6 +57,12 @@ sub check_packages($$@) {
 		next;
 	    }
 
+	    # Don't include packages that we're told to exclude
+	    if ($excluded{$pkg}) {
+		print STDERR "  Ignoring $pkg\n";
+		next;
+	    }
+
 	    if (!exists $seen{$filename}) {
 		$seen{$filename} = 1;
 		if (contains_firmware($mirror, $filename)) {
@@ -106,13 +115,18 @@ $mirror = $ENV{'MIRROR'};
 $localdebs = $ENV{'LOCALDEBS'};
 $backports = $ENV{'BACKPORTS'};
 $archlist = shift;
+$excludelist = shift;
 $outfile = shift;
 
 if (!defined($codename) || !defined($mirror) ||
+    !defined($excludelist) ||
     !defined($archlist) || !defined($outfile)) {
     die "Error in arguments\n";
 }
 
+$tasksdir = dirname($outfile);
+$cpp_command = "cpp -traditional -undef -P -C -Wall -nostdinc -I$tasksdir";
+
 foreach $arch (split(' ', $archlist)) {
     for my $component (@components) {
 	if (defined($backports)) {
@@ -122,6 +136,7 @@ foreach $arch (split(' ', $archlist)) {
 	push @pkgfiles, "$mirror/dists/$codename/$component/binary-$arch/Packages.gz";
 	push @pkgfiles, "$mirror/dists/$codename/$component/binary-$arch/Packages.xz";
     }
+    $cpp_command .= " -DARCH$arch";
 }
 
 if (defined($localdebs)) {
@@ -137,6 +152,15 @@ if (defined($localdebs)) {
     }
 }
 
+# Build the hash of excluded packages
+open (EXLIST, "$cpp_command $excludelist |") or
+    die "Can't parse exclude list: $!\n";
+while (defined (my $exc = <EXLIST>)) {
+    chomp $exc;
+    $excluded{$exc} = 1;
+}
+close EXLIST;
+
 # This special filename is an crude but easy way to distinguish the historical
 # caller (top-level Makefile) from tools/make-firmware-image which should use
 # the same logic, but is interested in the Filename for interesting firmware

tools/make-firmware-image

@@ -47,7 +47,7 @@ fi
 
 # This tool requires environment variables (exported earlier) and two parameters; the second one has
 # a special value for us to use. Deduplication should happen there, but uniquify to make sure:
-$BASEDIR/tools/generate_firmware_task '*' --list-filenames-and-indices | sort -u | while read FILE INDICES; do
+$BASEDIR/tools/generate_firmware_task '*' /dev/null --list-filenames-and-indices | sort -u | while read FILE INDICES; do
 	cp ${MIRROR}/$FILE $TMPDIR/firmware
 
 	# Adding metadata for bullseye might be helpful but disruptive, be careful: