feat(packaging): add amdrocm-repo package for ROCm repository setup

.pre-commit-config.yaml

@@ -42,7 +42,7 @@ repos:
   rev: v1.5.5
   hooks:
   - id: forbid-tabs
-    exclude: ".gitmodules|patches/.*|docs/development/git_chores.md|build_tools/packaging/linux/template/debian_rules.j2|third-party/sysdeps/linux/libdrm/patch_source.sh"
+    exclude: ".gitmodules|patches/.*|docs/development/git_chores.md|build_tools/packaging/linux/template/debian_rules.j2|build_tools/packaging/linux/template/repo/deb/rules.j2|third-party/sysdeps/linux/libdrm/patch_source.sh"
 
 - repo: https://github.com/rhysd/actionlint
   rev: v1.7.10

build_tools/packaging/linux/setup_repo_build_deps.sh

@@ -0,0 +1,104 @@
+#!/bin/bash
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+
+# Install the system tools needed to build the amdrocm-repo package.
+#
+# Package mapping by --os-profile:
+#
+# - ubuntu* / debian* -> apt: debhelper-compat, dpkg-dev, build-essential
+# - sles*             -> zypper: rpm-build
+# - else (RHEL-like)  -> dnf: rpm-build
+#
+# gpg is installed for every profile: signed streams need it to dearmor
+# the deb keyring and to check the signing key fingerprint.
+#
+# Python is installed separately by setup_python_cmd.sh.
+#
+# Commands are prefixed with sudo only when this runs as a non-root user on a
+# system that has it. The rpm build images run as root and ship no sudo.
+#
+# Sample usage
+# ------------
+#
+#     bash build_tools/packaging/linux/setup_repo_build_deps.sh --os-profile rhel10
+
+set -euo pipefail
+
+OS_PROFILE=""
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --os-profile)
+            # Check for the value before reading it: this script runs under
+            # "set -u", so a trailing "--os-profile" would otherwise abort with
+            # bash's own unbound-variable error instead of the message below.
+            if [[ $# -lt 2 ]]; then
+                echo "Error: --os-profile requires a value" >&2
+                exit 1
+            fi
+            OS_PROFILE="$2"
+            shift 2
+            ;;
+        *)
+            echo "Unknown option: $1" >&2
+            exit 1
+            ;;
+    esac
+done
+
+if [[ -z "$OS_PROFILE" ]]; then
+    echo "Error: --os-profile is required" >&2
+    exit 1
+fi
+
+# Trim whitespace; lowercase for glob matching (e.g. SLES16 must match sles*)
+OS_PROFILE="${OS_PROFILE#"${OS_PROFILE%%[![:space:]]*}"}"
+OS_PROFILE="${OS_PROFILE%"${OS_PROFILE##*[![:space:]]}"}"
+OS_PLC="${OS_PROFILE,,}"
+
+# Reject an unrecognised profile rather than letting it fall through to a
+# package manager that is not the one it needs. Matched by family so a new
+# release of a supported distro works without editing this script.
+case "$OS_PLC" in
+    ubuntu*|debian*|rhel*|sles*) ;;
+    *)
+        echo "Error: unrecognised --os-profile '$OS_PROFILE'" >&2
+        echo "Expected an ubuntu*, debian*, rhel* or sles* profile" \
+            "(this project builds ubuntu2404, rhel8, rhel10, sles16)" >&2
+        exit 1
+        ;;
+esac
+
+# Elevate only when sudo exists and we are not already root. The rpm build
+# images (UBI, BCI) run as root and ship no sudo at all, so calling it there
+# would fail; a developer following the documentation on a real RHEL or SLES
+# machine is not root and does have it. An empty array expands to nothing, so
+# the same command line serves both.
+SUDO=()
+if [[ "$(id -u)" -ne 0 ]] && command -v sudo >/dev/null 2>&1; then
+    SUDO=(sudo)
+fi
+
+if [[ "$OS_PLC" == ubuntu* ]] || [[ "$OS_PLC" == debian* ]]; then
+    export DEBIAN_FRONTEND=noninteractive
+    "${SUDO[@]}" apt-get update
+    "${SUDO[@]}" apt-get install -y \
+        ca-certificates \
+        gnupg \
+        debhelper-compat \
+        dpkg-dev \
+        build-essential
+elif [[ "$OS_PLC" == sles* ]]; then
+    "${SUDO[@]}" zypper --non-interactive refresh
+    "${SUDO[@]}" zypper --non-interactive install -y \
+        ca-certificates \
+        gpg2 \
+        rpm-build
+else
+    "${SUDO[@]}" dnf makecache
+    "${SUDO[@]}" dnf install -y \
+        ca-certificates \
+        gnupg2 \
+        rpm-build
+fi

build_tools/packaging/linux/template/repo/deb/amdrocm.sources.j2

@@ -0,0 +1,12 @@
+X-Repo-Id: {{ repo_id }}
+Types: deb
+URIs: {{ baseurl }}
+Suites: stable
+Components: main
+Architectures: amd64
+Enabled: yes
+{% if signed %}
+Signed-By: {{ deb_keyring_path }}
+{% else %}
+Trusted: yes
+{% endif %}

build_tools/packaging/linux/template/repo/deb/changelog.j2

@@ -0,0 +1,5 @@
+{{ pkg_name }} ({{ deb_version }}) stable; urgency=medium
+
+  * ROCm {{ rocm_version }} repository configuration.
+
+ -- {{ maintainer }}  {{ date }}

build_tools/packaging/linux/template/repo/deb/control.j2

@@ -0,0 +1,14 @@
+Source: {{ pkg_name }}
+Section: admin
+Priority: optional
+Maintainer: {{ maintainer }}
+Build-Depends: debhelper-compat (= 13)
+Standards-Version: 4.6.2
+Homepage: https://github.com/ROCm/TheRock
+
+Package: {{ pkg_name }}
+Architecture: all
+Depends: ${misc:Depends}
+Conflicts: {{ legacy_installer_package }}
+Description: {{ description_short }}
+ {{ description_long }}

build_tools/packaging/linux/template/repo/deb/install.j2

@@ -0,0 +1,4 @@
+{{ repo_id }}.sources /etc/apt/sources.list.d/
+{% if signed %}
+{{ deb_keyring_file }} {{ deb_keyring_dir }}/
+{% endif %}

build_tools/packaging/linux/template/repo/deb/postinst.j2

@@ -0,0 +1,36 @@
+#!/bin/sh
+set -e
+
+if [ "$1" = "configure" ]; then
+    echo "AMD ROCm repository configured."
+    echo "Run 'sudo apt-get update' to refresh package lists."
+
+    # apt satisfies this package's Conflicts by removing
+    # {{ legacy_installer_package }} rather than refusing it, and that
+    # package's repository definition and its apt pin are conffiles, so both
+    # survive the removal. The pin outranks this repository, so ROCm keeps
+    # resolving to the old one until the user purges rather than removes.
+    #
+    # Detect that one state -- removed but not purged -- rather than scanning
+    # apt's configuration. A scan cannot tell a leftover ROCm repository from
+    # the AMDGPU driver repository the same vendor ships and the user still
+    # needs, so it would name files that must not be removed.
+    #
+    # Every command below must succeed: this script runs under "set -e" and
+    # before #DEBHELPER#, so a non-zero status here fails the package install.
+    # dpkg-query exits non-zero for an unknown package, hence the guard.
+    legacy_state=$(
+        dpkg-query -W -f='${Status}' {{ legacy_installer_package }} 2>/dev/null || true
+    )
+
+    if [ "$legacy_state" = "deinstall ok config-files" ]; then
+        echo ""
+        echo "Warning: {{ legacy_installer_package }} must be fully removed before"
+        echo "the AMD ROCm repository will be used. Run"
+        echo "'sudo apt purge {{ legacy_installer_package }}'."
+    fi
+fi
+
+#DEBHELPER#
+
+exit 0

build_tools/packaging/linux/template/repo/deb/rules.j2

@@ -0,0 +1,11 @@
+#!/usr/bin/make -f
+%:
+	dh $@
+
+# Pin root:root ownership and xz compression, matching template/debian_rules.j2,
+# which every other ROCm package uses. The archive is root:root either way:
+# without Rules-Requires-Root, dpkg-buildpackage runs "debian/rules binary"
+# under the gain-root command (fakeroot) when not building as root, and with
+# "Rules-Requires-Root: no" dh_builddeb adds --root-owner-group itself.
+override_dh_builddeb:
+	dh_builddeb -- -Zxz --root-owner-group

build_tools/packaging/linux/template/repo/rpm/amdrocm-repo.spec.j2

@@ -0,0 +1,49 @@
+Name: {{ pkg_name }}
+Version: {{ version }}
+Release: {{ release }}
+BuildArch: noarch
+Summary: {{ description_short }}
+License: MIT
+Vendor: Advanced Micro Devices, Inc
+URL: https://github.com/ROCm/TheRock
+Conflicts: {{ legacy_installer_package }}
+
+%description
+{{ description_long }}
+
+%install
+mkdir -p %{buildroot}{{ rpm_repo_dir }}
+install -m 644 %{_sourcedir}/{{ repo_id }}.repo %{buildroot}{{ rpm_repo_dir }}/
+{% if signed %}
+mkdir -p %{buildroot}/etc/pki/rpm-gpg
+install -m 644 %{_sourcedir}/{{ rpm_gpg_key_file }} %{buildroot}{{ rpm_gpg_key_path }}
+{% endif %}
+
+# Messages only, mirroring the deb postinst greeting so both package types
+# behave the same on install.
+#
+# Nothing here may touch the rpm database -- in particular it must never run
+# "rpm --import" to add the signing key. rpm holds the database lock for the
+# whole transaction, so an import fails from this scriptlet and from a
+# post-transaction one alike, and it fails only as a warning: the package
+# installs looking healthy while the key was never added. Callers use their
+# package manager's own flag instead ("dnf -y", "zypper --gpg-auto-import-keys"),
+# which is what the documented install steps do.
+#
+# The legacy-installer warning the deb postinst prints has no counterpart here:
+# dnf and zypper enforce Conflicts by refusing the pair outright, so there is no
+# removed-but-not-purged state to detect.
+%post
+echo "AMD ROCm repository configured."
+echo "Run '{{ rpm_refresh_cmd }}' to refresh package lists."
+
+%files
+%defattr(-, root, root, -)
+%config(noreplace) {{ rpm_repo_dir }}/{{ repo_id }}.repo
+{% if signed %}
+{{ rpm_gpg_key_path }}
+{% endif %}
+
+%changelog
+* {{ changelog_date }} {{ maintainer }} - {{ version }}-{{ release }}
+- ROCm {{ rocm_version }} repository configuration.

build_tools/packaging/linux/template/repo/rpm/amdrocm.repo.j2

@@ -0,0 +1,8 @@
+[{{ repo_id }}]
+name={{ name }}
+baseurl={{ baseurl }}
+enabled=1
+gpgcheck={{ 1 if signed else 0 }}
+{% if signed %}
+gpgkey=file://{{ rpm_gpg_key_path }}
+{% endif %}