Clean up branches in TrenchBoot repositories

[krystian-hebel]

Affected component(s) or functionality (if applicable)
All of them.

Brief summary
Analyze and reduce the number of branches on code repositories (mainly grub, xen and linux as they are modified most frequently). Ideally, users and developers shouldn't have to think about which branch is the main one that should be the target of pull requests.

Additional context
All of the following is open for discussion. I'm not strongly opposed to changing the rules, but we need something to start with, hence this list. Also, keeping the repositories clean is indefinite process, not a one-time task, so some rules will have to be added to documentation about expectations discussed here.

• Upstream branches are to be left as-is. They usually are for specific versions of component, keeping them may make backports easier.
• Branches may be part of PR or draft, in such cases reviewers and/or authors should be pinged to get such PRs merged or closed if they are no longer applicable.
• In the end there should be no more than one branch per upstream version that branch is based on. Exceptions:
  • Branches that are part of an open PR are allowed only if they target that versioned branch based on upstream version, or a chain that starts with such branch.
  • Branches that are part of active upstreaming effort (e.g. https://github.com/TrenchBoot/linux/tree/linux-sl-master-5-16-24-v9), with all previous iterations for reference, until the feature gets merged.
• There should be no branches for PoCs and demos presented on conferences after it has concluded, unless it is to be merged (in which case PR or draft should be opened). If the specific code must be kept because of external references, it should be tagged instead.

[SergiiDmytruk]

I'll post comments as I go through the repos for feedback and to not have a single huge comment at the end.

Xen

Dropped:

• aem-phase3-rebase (was d6111adaacf523b2c74b519373f46a23ea44ab90).

Pinged:

• Aem 4.17.4 xen#14
• Aem rebased wip xen#8

@krystian-hebel, absolute majority of branches come from upstream and I think we're only interested in stable-* ones. OK to remove all others? The removed would include staging-*, coverity/*, *-shim-* and smoke, which all seem useless for interacting with upstream.

[SergiiDmytruk]

GRUB

Dropped:

• several tb-2.12-57* that were created recently for temporary purposes
• test_gitlabci (TrenchBoot/grub@eeba8e6) seems to be an old branch name for gitlab-ci.yml: add basic CI file grub#1
• aem_p3_upstreaming (TrenchBoot/grub@66b9d72) looked outdated

Renamed:

• tb-2.12-57-linux-amd to tb-2.12-57, because the old name was reflecting contents of top patches only

Pinged:

• Intel txt aem 2.06 testing grub#16
• [NOT FOR MERGE] Intel txt aem 2.06 rebased grub#20

Questionable:

• these don't seem to appear in 3mdeb's blog posts but maybe they are referenced somewhere else, safe to drop?
  • https://github.com/TrenchBoot/grub/tree/intel-txt-aem
  • https://github.com/TrenchBoot/grub/tree/intel-txt
• these are older ones and can potentially contain something useful by @dpsmith
  • https://github.com/TrenchBoot/grub/tree/slaunch
  • https://github.com/TrenchBoot/grub/tree/raw-tpm
  • https://github.com/TrenchBoot/grub/tree/trustedgrub-tpm

[SergiiDmytruk]

Linux

Upstream:

• https://github.com/TrenchBoot/linux/tree/master

Upstreaming:

• https://github.com/TrenchBoot/linux/tree/linux-sl-master-5-16-24-v9
• https://github.com/TrenchBoot/linux/tree/linux-sl-master-2-5-24-v8
• https://github.com/TrenchBoot/linux/tree/linux-sl-master-11-9-23-v7
• https://github.com/TrenchBoot/linux/tree/linux-sl-master-5-1-23-v6
• https://github.com/TrenchBoot/linux/tree/linux-sl-master-2-16-22-v5
• https://github.com/TrenchBoot/linux/tree/linux-sl-master-8-24-21-v4
• https://github.com/TrenchBoot/linux/tree/linux-sl-master-8-4-21-v3
• https://github.com/TrenchBoot/linux/tree/linux-sl-master-6-16-21

Versions for different kernels (convert to tags?):

• https://github.com/TrenchBoot/linux/tree/linux-sl-6.9
• https://github.com/TrenchBoot/linux/tree/linux-sl-6.7
• https://github.com/TrenchBoot/linux/tree/linux-sl-6.6
• https://github.com/TrenchBoot/linux/tree/linux-sl-6.4
• https://github.com/TrenchBoot/linux/tree/linux-sl-6.0
• https://github.com/TrenchBoot/linux/tree/linux-sl-5.16
• https://github.com/TrenchBoot/linux/tree/linux-sl-5.13
• https://github.com/TrenchBoot/linux/tree/linux-sl-5.11
• https://github.com/TrenchBoot/linux/tree/linux-sl-5.8
• https://github.com/TrenchBoot/linux/tree/linux-sl-5.5
• https://github.com/TrenchBoot/linux/tree/linux-sl-5.4
• https://github.com/TrenchBoot/linux/tree/linux-sl-5.1
• https://github.com/TrenchBoot/linux/tree/linux-sl-4.19

Unique commits?:

• https://github.com/TrenchBoot/linux/tree/linux-sl-5.8-amd
• https://github.com/TrenchBoot/linux/tree/linux-sl-5.13-amd

Temporary branches?:

• https://github.com/TrenchBoot/linux/tree/linux-sl-5.11-review
• https://github.com/TrenchBoot/linux/tree/linux-sl-5.5-ordered
• https://github.com/TrenchBoot/linux/tree/linux-sl-5.4-migration

Also, I'm not sure how to interpret [revision] for {2ba13df} commits.

[SergiiDmytruk]

trenchboot-sdk

Pinged:

• Documentation/build_qubes_packages.md: add procedure for building qub… trenchboot-sdk#7
• Documentation/fw_dell_optiplex.md: update coreboot revision and coreboot-sdk revision trenchboot-sdk#9

[SergiiDmytruk]

TrenchBoot.github.io

Dropped:

• 3mdeb-presentations (was TrenchBoot/TrenchBoot.github.io@75953c7) because the branch was merged 3 years ago
• old-site-archive is pointing at a parent of current master, I've made a tag for reference to this older version before removing the branch
• hugo looked weird as it's mkdocs-based version, it looked like a test of Mkdocs TrenchBoot.github.io#16

The rest of the branches are from Dependabot which seems to be ignored and it won't even send any more PRs because of that. Should either use it (if its suggestions are even useful) or disable and remove all PRs and corresponding branches. Given that TrenchBoot/TrenchBoot.github.io#31 removes most of the files, we won't need those dependencies in the future?

slexec

One extra branch pre_slrt, convert to a tag?

trenchboot-issues

2 branches, pushed to #7 to get it merged and drop the second branch.

Other repos

Have only one branch.

[krystian-hebel]

Xen:

@krystian-hebel, absolute majority of branches come from upstream and I think we're only interested in stable-* ones. OK to remove all others? The removed would include staging-, coverity/, -shim- and smoke, which all seem useless for interacting with upstream.

Sure, let's remove them.

---

GRUB:

these don't seem to appear in 3mdeb's blog posts but maybe they are referenced somewhere else, safe to drop?

• https://github.com/TrenchBoot/grub/tree/intel-txt-aem
• https://github.com/TrenchBoot/grub/tree/intel-txt

Can be removed, all of the code was migrated to newer branches. IIRC the first one was used as a demo for one of the conferences, but we weren't able to reproduce it even few days after, most likely to different SKL (or LZ at that time).

---

Linux:

The *-amd branches may be used to help with implementation of the upcoming phase, I'd leave them until it is done.

Also, I'm not sure how to interpret [revision] for {2ba13df} commits.

I think this is some kind of patch queue, it allows adding changes as a new commit and squashing them later. @rossphilipson would probably know more, maybe we could use it somewhere.

---

trenchboot-sdk:

I've closed Optiplex PR and removed its branch. As for Qubes packages, on the one hand we have CI that does it automatically, on the other hand, it already got outdated several times. Perhaps manual instructions would allow to proceed in those cases using common sense, but it would have to be reworked to match current state of the builder(s).

[SergiiDmytruk]

Xen:

Sure, let's remove them.

-15 branches there.

GRUB:

Can be removed, all of the code was migrated to newer branches. IIRC the first one was used as a demo for one of the conferences, but we weren't able to reproduce it even few days after, most likely to different SKL (or LZ at that time).

-2 branches.

[SergiiDmytruk]

Went through the repos again to assess the updated state.

Xen

Restored TrenchBoot/xen#17 PR.
Also there was aem based on 4.17.2, so I renamed it to aem-4.17.2.
Renamed aem-phase4-rebase to aem-4.17.4 because that's what it is.

There are still a bunch of stable-4.* branches from upstream. Remove all but stable-4.17?

GRUB2

Removed intel-txt-aem-base (was 7e0310c) which was used as a target of TrenchBoot/grub#16.

Usefulness of the following old branches by @dpsmith is unclear:

• https://github.com/TrenchBoot/grub/tree/trenchboot_support_2.04
• https://github.com/TrenchBoot/grub/tree/slaunch
• https://github.com/TrenchBoot/grub/tree/raw-tpm
• https://github.com/TrenchBoot/grub/tree/trustedgrub-tpm

Turn them into tags?

Linux

Nothing was removed, #48 (comment) still applies (but see #48 (comment)).

trenchboot-sdk

On TrenchBoot/trenchboot-sdk#7 from #48 (comment):

As for Qubes packages, on the one hand we have CI that does it automatically, on the other hand, it already got outdated several times. Perhaps manual instructions would allow to proceed in those cases using common sense, but it would have to be reworked to match current state of the builder(s).

There are very few branches there, so keeping it isn't a big deal.

trenchboot-issues

Pinged #7. Update: it got approval and I merged it.

TrenchBoot.github.io

TrenchBoot/TrenchBoot.github.io#22 is an old PR, otherwise the repo has been cleaned up.

slexec

Still one extra branch pre_slrt, convert to a tag or let it be?

[krystian-hebel]

It seems that staging on Xen is actually needed: https://github.com/TrenchBoot/xen/actions/runs/11313225621

[SergiiDmytruk]

It seems that staging on Xen is actually needed: https://github.com/TrenchBoot/xen/actions/runs/11313225621

Restored it based on origin/staging in my local clone.

[krystian-hebel]

That helped, now it fails further: https://github.com/TrenchBoot/xen/actions/runs/11313225621/job/31464512006

I've updated staging to current upstream version, but it didn't fix the remaining issues.

[SergiiDmytruk]

  curl https://scan.coverity.com/download/cxx/linux64 \
    --no-progress-meter \
    --output cov-analysis.tar.gz \
    --data "token=${TOKEN}&project=XenProject"

No or an outdated token?

[krystian-hebel]

Probably no token, I haven't add any, this comes from CI pulled from upstream. I'd expect it to fail with more meaningful message, but I don't think we should worry about that, at least for now. It only happens after master is updated to upstream, AFAICT.

[SergiiDmytruk]

I'd expect it to fail with more meaningful message

Just tried it:

[~]$ curl https://scan.coverity.com/download/cxx/linux64 \
    --no-progress-meter \
    --output cov-analysis.tar.gz \
    --data "token=aaaaaaaaaaa&project=XenProject"
[~]$ echo $?
0
[~]$ ls -l cov-analysis.tar.gz 
-rw-r--r-- 1 emdeb users 0 2024-10-15 16:49 cov-analysis.tar.gz