How to figure out what to put in CONTRACT_ALLOWLIST variable?

openBalena
1

There is a new API fix but I don’t fully understand how to use it.

In https://github.com/balena-io/open-balena-api/blob/9fd9697f37423c891aea9faa92e45a9ca0db2137/src/lib/config.ts#L87C48-L87C48 the comment mentions

/**
 * null: include all device type and device contract slugs
 * "x;y;z": include only the specified device type and contract slugs - note that you MUST list
 *          all dependent slugs as well so for hw.device-type/asus-tinker-board-s you would need:
 *          `arch.sw/armv7hf;hw.device-manufacturer/asus;hw.device-family/tinkerboard;hw.device-type/asus-tinker-board-s`
 * 		    For something like hw.device-type/iot-gate-imx8 you would need:
 * 			`arch.sw/aarch64;hw.device-type/iot-gate-imx8`
 *          (the order of the slugs in this variable does not matter)
 */

How does one figure out all dependent slugs given device type?
For example, we use:
raspberrypi4-64
raspberrypi3
asus-tinker-board
asus-tinker-board-s

What should CONTRACT_ALLOWLIST look like?

2

My best guess is that in our case CONTRACT_ALLOWLIST should look like this:

export OPENBALENA_CONTRACT_ALLOWLIST="arch.sw/armv7hf;arch.sw/aarch64;hw.device-manufacturer/asus;hw.device-family/tinkerboard;hw.device-type/asus-tinker-board-s;hw.device-type/asus-tinker-board;hw.device-type/raspberrypi3;hw.device-type/raspberrypi4-64;sw.os+hw.device-type/ubuntu@lunar+raspberrypi3;sw.os+hw.device-type/ubuntu@jammy+raspberrypi3;sw.os+hw.device-type/alpine+raspberrypi3;sw.os+hw.device-type/debian@sid+raspberrypi3;sw.os+hw.device-type/debian+raspberrypi3;sw.os+hw.device-type/ubuntu@focal+raspberrypi3;sw.os+hw.device-type/ubuntu@focal+raspberrypi4-64;sw.os+hw.device-type/debian@sid+raspberrypi4-64;sw.os+hw.device-type/alpine+raspberrypi4-64;sw.os+hw.device-type/debian+raspberrypi4-64;sw.os+hw.device-type/ubuntu@lunar+raspberrypi4-64;sw.os+hw.device-type/ubuntu@jammy+raspberrypi4-64;sw.os+hw.device-type/debian@bookworm+raspberrypi4-64"

Here is the same but with an explanation of why it’s there.

arch.sw/armv7hf;                                        # asus-tinker-board, asus-tinker-board-s, raspberrypi3
arch.sw/aarch64;                                        # raspberrypi4-64
hw.device-manufacturer/asus;                            # asus-tinker-board, asus-tinker-board-s
hw.device-family/tinkerboard;                           # asus-tinker-board, asus-tinker-board-s
hw.device-type/asus-tinker-board-s;                     # asus-tinker-board-s
hw.device-type/asus-tinker-board;                       # asus-tinker-board
hw.device-type/raspberrypi3;                            # raspberrypi3
hw.device-type/raspberrypi4-64;                         # raspberrypi4-64
sw.os+hw.device-type/ubuntu@lunar+raspberrypi3;         # raspberrypi3
sw.os+hw.device-type/ubuntu@jammy+raspberrypi3;         # raspberrypi3
sw.os+hw.device-type/alpine+raspberrypi3;               # raspberrypi3
sw.os+hw.device-type/debian@sid+raspberrypi3;           # raspberrypi3
sw.os+hw.device-type/debian+raspberrypi3;               # raspberrypi3
sw.os+hw.device-type/ubuntu@focal+raspberrypi3;         # raspberrypi3
sw.os+hw.device-type/ubuntu@focal+raspberrypi4-64;      # raspberrypi4-64        
sw.os+hw.device-type/debian@sid+raspberrypi4-64;        # raspberrypi4-64   
sw.os+hw.device-type/alpine+raspberrypi4-64;            # raspberrypi4-64
sw.os+hw.device-type/debian+raspberrypi4-64;            # raspberrypi4-64
sw.os+hw.device-type/ubuntu@lunar+raspberrypi4-64;      # raspberrypi4-64     
sw.os+hw.device-type/ubuntu@jammy+raspberrypi4-64;      # raspberrypi4-64
sw.os+hw.device-type/debian@bookworm+raspberrypi4-64    # raspberrypi4-64

I got this from GitHub - balena-io/contracts: Balena.io Base Contracts.

If anybody can confirm that this is right or correct it if it is wrong that would be great :slight_smile:

3

I believe I replied to you on github here (similar username), but I figured I’d add the notes here in case anyone else is only checking the forums and not GitHub:

I would suggest looking through contracts/contracts at master · balena-io/contracts · GitHub

For example, start with hw.device-type/raspberrypi3/contract.json and you’ll see it references "arch": "armv7hf" on line 14, so for this you’d need:

  • arch.sw/armv7hf
  • hw.device-type/raspberrypi3

Doing the same for hw.device-type/raspberrypi4-64/contract.json gets you:

  • arch.sw/aarch64
  • hw.device-type/raspberrypi4-64

And for Doing the same for hw.device-type/asus-tinker-board-s/contract.json gets you’ll see both "arch": "armv7hf" and "family": "family-tinkerboard", so you need:

  • arch.sw/armv7hf
  • hw.device-family/tinkerboard
  • hw.device-type/asus-tinker-board-s

… but if you check hw.device-family/tinkerboard/contract.json you’ll see that it references "manufacturedBy": "manufacturer-asus" on line 8, so you also need:

  • hw.device-manufacturer/asus (which is the contract.json with a slug of “manufacturer-asus” as referenced in the family contract)

If you don’t know in advance what you want in there, just don’t set OPENBALENA_CONTRACT_ALLOWLIST and open-balena will continue to pull down everything like it did before the change.

1 Like