shrinkwrap-tool 2026.2.1__py3-none-any.whl

shrinkwrap/config/test/cca.yaml

@@ -0,0 +1,47 @@
+# Copyright (c) 2025, Arm Limited.
+# SPDX-License-Identifier: MIT
+
+%YAML 1.2
+---
+description: >-
+  Add an initscript to buildroot to automatically execute tests.
+  The test launches a guest and checks that it is running in a Realm.
+
+build:
+  buildroot:
+    prebuild:
+      - mkdir -p ${param:builddir}/overlay/etc/init.d
+      - |
+        echo -e "#!/bin/sh
+        case \$$1 in
+            start|stop|restart|reload)
+                if [ -e /dev/kvm ]; then
+                    # Host
+                    # On failure, exit this script and wait for the test timeout
+                    gen-run-vmm.sh --kvmtool || exit 1
+                else
+                    # Guest
+
+                    # TODO: When buildroot is built on an arm64 system,
+                    # cca-workload-attestation is missing and as a result this
+                    # exits immediately and does not shut down the guest. I
+                    # think this is due to GO dependencies not being available.
+                    # More investigation is required. But for now, instead of
+                    # disabling the whole test, execute the attestation part
+                    # conditionally. This at least gives us coverage of booting
+                    # the guest on all platforms.
+                    if command -v cca-workload-attestation >/dev/null 2>&1; then
+                        if command -v cca-realm-initial-measurement >/dev/null 2>&1; then
+                            cca-workload-attestation report | grep cca-realm-initial-measurement || exit 1
+                        fi
+                    fi
+                fi
+                poweroff -f
+                ;;
+            *)
+                echo Usage \$$0 {start|stop|restart|reload}
+                exit 1
+                ;;
+        esac" > ${param:builddir}/overlay/etc/init.d/S50test
+      - chmod +x ${param:builddir}/overlay/etc/init.d/S50test
+      - ${param:sourcedir}/utils/config --file ${param:builddir}/.config --set-val BR2_ROOTFS_OVERLAY \"${param:builddir}/overlay\"

shrinkwrap/config/tfa-base.yaml

@@ -0,0 +1,45 @@
+# Copyright (c) 2022, Arm Limited.
+# SPDX-License-Identifier: MIT
+
+%YAML 1.2
+---
+description: >-
+  Trusted Firmware for A-class CPUs. This provides a baseline configuration that
+  can be customized by higher layers.
+
+build:
+  tfa:
+    repo:
+      remote: https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git
+      revision: v2.14.0
+
+    toolchain: aarch64-none-elf-
+
+    params:
+      PLAT: fvp
+      DEBUG: 0
+      LOG_LEVEL: 40
+      ARM_DISABLE_TRUSTED_WDOG: 1
+      FVP_HW_CONFIG_DTS: fdts/fvp-base-gicv3-psci-1t.dts
+
+    prebuild:
+      # tfa does not notice when parameters are changed and can therefore end up
+      # with stale compilation units. Let's work around that by saving the
+      # parameters and comparing to the last run. If they have changed, force a
+      # clean. Also works for the case where shrinkwrap.params doesn't exist.
+      - 'echo "${param:join_equal}" > ${param:builddir}/shrinkwrap.params.new'
+      - if ! cmp -s "${param:builddir}/shrinkwrap.params.new" "${param:builddir}/shrinkwrap.params"; then
+      -     make BUILD_BASE=${param:builddir} clean
+      - fi
+      - mv ${param:builddir}/shrinkwrap.params.new ${param:builddir}/shrinkwrap.params
+
+    build:
+      # tfa has makefile dependency bug that makes parallel make for more than
+      # ~8 jobs unreliable, so limit it to 8.
+      - "make BUILD_BASE=${param:builddir} ${param:join_equal} -j$$(( ${param:jobs} < 8 ? ${param:jobs} : 8 )) all fip"
+
+    artifacts:
+      BL1: ${param:builddir}/fvp/release/bl1.bin
+      BL2: ${param:builddir}/fvp/release/bl2.bin
+      BL31: ${param:builddir}/fvp/release/bl31.bin
+      FIP: ${param:builddir}/fvp/release/fip.bin

shrinkwrap/config/tfa-rme.yaml

@@ -0,0 +1,36 @@
+# Copyright (c) 2024, Arm Limited.
+# SPDX-License-Identifier: MIT
+
+%YAML 1.2
+---
+description: >-
+  Layer builds TF-A, TF-RMM, along with the required device tree, configured for
+  RME with Armv9.2 architecture extension. This yaml file can be customized and
+  used as base for building higher layers.
+
+layers:
+  - FVP_Base_RevC-2xAEMvA-rme.yaml
+  - tfa-base.yaml
+  - rmm-base.yaml
+  - dt-base.yaml
+  - arch/v9.2.yaml
+
+build:
+  tfa:
+    params:
+      ENABLE_RME: 1
+      RMM: ${artifact:RMM}
+      FVP_HW_CONFIG: ${artifact:DTB}
+
+run:
+  terminals:
+    bp.terminal_3:
+      friendly: rmm
+
+  params:
+    # If BRBE is implemented and this is set to true, disable BRBE recording.
+    # All registers will be functional, but no branches will be recorded.
+    # This will improve model performance for workloads that enable BRBE,
+    # but don't care about the information stored in it.
+    -C cluster0.brbe_disable_recording: 1
+    -C cluster1.brbe_disable_recording: 1

shrinkwrap/config/tftf-base.yaml

@@ -0,0 +1,32 @@
+# Copyright (c) 2023, Arm Limited.
+# SPDX-License-Identifier: MIT
+
+%YAML 1.2
+---
+description: >-
+  The Trusted Firmware-A Tests (TF-A-Tests) is a suite of baremetal tests that
+  exercise the Trusted Firmware-A (TF-A) features. This provides a baseline
+  configuration that can be customized by higher layers.
+
+build:
+  tftf:
+    repo:
+      remote: https://git.trustedfirmware.org/TF-A/tf-a-tests.git
+      revision: v2.14.0
+
+    toolchain: aarch64-none-elf-
+
+    params:
+      PLAT: fvp
+      DEBUG: 0
+      ENABLE_REALM_PAYLOAD_TESTS: 1
+
+    build:
+      # tfa-tests has makefile dependency bug that makes parallel make for more
+      # than ~8 jobs unreliable, so limit it to 8.
+      - "make BUILD_BASE=${param:builddir} ${param:join_equal} -j$$(( ${param:jobs} < 8 ? ${param:jobs} : 8 )) all"
+
+    artifacts:
+      TFTF_BIN: ${param:builddir}/fvp/release/tftf.bin
+      SP_LAYOUT: ${param:builddir}/fvp/release/sp_layout.json
+

shrinkwrap/shrinkwrap_main.py

@@ -0,0 +1,133 @@
+#!/usr/bin/env python3
+# Copyright (c) 2022-2026, Arm Limited.
+# SPDX-License-Identifier: MIT
+
+import argparse
+import shutil
+from shrinkwrap import __version__
+
+
+from shrinkwrap.commands import build
+from shrinkwrap.commands import buildall
+from shrinkwrap.commands import clean
+from shrinkwrap.commands import inspect
+from shrinkwrap.commands import process
+from shrinkwrap.commands import run
+
+
+VERBOSE = True
+
+
+def config_verbose_flag(args):
+	global VERBOSE
+	# Not all commands (e.g. run) have --verbose. Choose not to change
+	# behavior in that case.
+	if 'verbose' in args:
+		VERBOSE = args.verbose
+	else:
+		VERBOSE = False
+
+
+def formatter(prog):
+	width = shutil.get_terminal_size().columns
+	width -= 2
+	width = min(80, width)
+	return argparse.HelpFormatter(prog, width=width)
+
+
+def main():
+	"""
+	Main entry point. Parses command line and dispatches to appropriate
+	command handler.
+	"""
+
+	tool_name = "shrinkwrap"
+
+	# Parse the arguments. The parser will raise an exception if the
+	# required arguments are not present, which will tell the user what they
+	# did wrong.
+
+	parser = argparse.ArgumentParser(epilog='To file a bug report, contact '
+						'<ryan.roberts@arm.com>.',
+					 formatter_class=formatter)
+
+	parser.add_argument('--version',
+		action='version',
+		version=f'{tool_name} version {__version__}')
+
+	parser.add_argument('-R', '--runtime',
+		metavar='engine', required=False, default='docker',
+		choices=['null', 'docker', 'docker-local', 'podman', 'podman-local'],
+		help="""Specifies the environment in which to execute build and
+		     run commands. If 'null', executes natively on the host.
+		     'docker' attempts to download the image from dockerhub and
+		     execute the commands in a container. 'docker-local' is like
+		     'docker' but will only look for the image locally. 'podman'
+		     and 'podman-local' are like 'docker' and 'docker-local'
+		     except podman is used as the runtime instead of docker.
+		     Defaults to 'docker'.""")
+
+	parser.add_argument('-I', '--image',
+		metavar='name',
+		required=False,
+		type=str,
+		default=None,
+		help="""If using a container runtime, specifies the name of the
+		     image to use. Defaults to the official shrinkwrap image,
+			 unless a specific image is required in the config file.""")
+
+	parser.add_argument('--ssh-agent',
+		default=False,
+		action='store_true',
+		required=False,
+		help="""Start ssh-agent and add default keys.""")
+
+	parser.add_argument('--ssh-agent-key',
+		dest='ssh_agent_keys',
+		default=[],
+		metavar='key',
+		action='append',
+		type=str,
+		required=False,
+		help="""Start ssh-agent and add specified key.""")
+
+	subparsers = parser.add_subparsers(dest='command',
+					   metavar='<command>',
+					   title=f'Supported commands (run '
+						 f'"{tool_name} <command> '
+						 f'--help" for more info)')
+
+	# Register all the commands.
+	cmds = {}
+	cmds[build.add_parser(subparsers, formatter)] = build
+	cmds[buildall.add_parser(subparsers, formatter)] = buildall
+	cmds[clean.add_parser(subparsers, formatter)] = clean
+	cmds[inspect.add_parser(subparsers, formatter)] = inspect
+	cmds[process.add_parser(subparsers, formatter)] = process
+	cmds[run.add_parser(subparsers, formatter)] = run
+
+	# Parse the arguments.
+	args = parser.parse_args()
+	config_verbose_flag(args)
+
+	if args.ssh_agent:
+		args.ssh_agent_keys.append(None)
+
+	# Dispatch to the correct command.
+	if args.command in cmds:
+		cmds[args.command].dispatch(args)
+	else:
+		print(f'Unknown command {args.command}')
+		parser.print_help()
+
+
+if __name__ == "__main__":
+	try:
+		main()
+	except SystemExit as e:
+		raise
+	except BaseException as e:
+		if VERBOSE:
+			raise
+		print(f'{e.__class__.__name__}: {e}')
+		exit(1)

shrinkwrap/utils/clivars.py

@@ -0,0 +1,16 @@
+# Copyright (c) 2022, Arm Limited.
+# SPDX-License-Identifier: MIT
+
+_defaults = {
+	'jobs': 4,
+}
+
+
+def get(**kwargs):
+	clivars = dict(_defaults)
+
+	for k, v in kwargs.items():
+		assert(k in clivars)
+		clivars[k] = v
+
+	return {k: str(v) for k, v in clivars.items()}