From 4aa59ba63313cd51b983646ad146e8c577e277bd Mon Sep 17 00:00:00 2001 From: SysAdmin Date: Thu, 7 May 2026 14:05:49 +0100 Subject: [PATCH] fix(linux/build): non-interactive mode + visible output + key import (M1.1) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Run #4260 cleared every harness layer and ran for 18 minutes — past sanity-tests, prepare-build-machine, cowbuilder-setup, local-deps — into 2100_create-debian-packages, where it died on: Could not check validity of signature with '92978A6E195E4921825F7FF0F34F09744E9F5DD9' in '/home/user/derivative-binary/temp_packages_debian_sid/virtualbox_7.2.8-dfsg-1.dsc' as public key missing! …and then *also* hung the runner indefinitely because, on any error, derivative-maker's exception_handler_general detected a TTY (we passed `docker run -t`) and dropped into an interactive `read -p 'Answer? '` prompt that nothing was ever going to answer. The orphan docker run in turn orphaned the act_runner job container, blocking the runner until manual cleanup. Three coordinated fixes, validated end-to-end with docker-side smoke tests on 10.0.0.51: 1. **Non-interactive mode without losing output visibility.** The original architectural goal: keep derivative-maker out of interactive mode (`[ -t 0 ]` must be false) AND keep the build log visible to docker run / Gitea Actions (PTY needed somewhere). Resolution: - `docker run -t` is kept (required for /dev/console to be a real PTY back to docker), but no `-i`, so fd 0 stays /dev/null. - docker-entrypoint.service: `StandardInput=tty-force` → `StandardInput=null` so the service's fd 0 is /dev/null too. Verified inside the container: `[ -t 0 ]` returns false. - entrypoint.sh now wraps the user command with an explicit `> /dev/console 2>&1` redirect before writing it to /etc/docker-entrypoint-cmd. systemd's `StandardOutput=inherit` does NOT propagate PID-1's stdout to services in this PID-1- systemd-in-container topology — the service log was going nowhere visible. /dev/console under `docker run -t` IS the allocated PTY back to docker, so the redirect surfaces the log to the act_runner / Gitea Actions log. - entrypoint.sh's `[ ! -t 0 ] && exit 1` guard removed (it would now always trigger). 2. **debian-keyring for reprepro source-package signature checks.** 2100_create-debian-packages calls dm-reprepro-wrapper includedsc on every .dsc in temp_packages_debian_sid (including virtualbox_*.dsc, even for `--target iso` — see line 114 of that build step). reprepro verifies the dsc signature against the user's GPG keyring; without the maintainer keys it fails. Adds `debian-keyring` to Dockerfile.builder. build-inner.sh now imports debian-keyring.gpg / debian-maintainers.gpg / debian-nonupload.gpg into the user's keyring before running derivative-maker. 3. **BUILDER_IMAGE digest re-pinned.** Built natively on 10.0.0.51 (per memory: never on WSL/aarch64). New digest: sha256:2f680c96…f0db. Smoke-test results (against this exact image): ==> START ← user output reaches docker stdout (keyring present) ← debian-keyring imported successfully STDIN_NOT_TTY ← derivative-maker WILL stay non-interactive ==> END ← clean shutdown docker run exit: 42 ← exit code propagates correctly on failure Files: Dockerfile.builder, systemd-entrypoint/entrypoint.sh, systemd-entrypoint/docker-entrypoint.service, scripts/build.sh, scripts/build-inner.sh. Co-Authored-By: Claude Opus 4.7 (1M context) --- linux/build/docker/Dockerfile.builder | 1 + .../docker-entrypoint.service | 17 +++++++++- .../docker/systemd-entrypoint/entrypoint.sh | 32 ++++++++++++++++--- linux/build/scripts/build-inner.sh | 21 ++++++++++++ linux/build/scripts/build.sh | 20 +++++++++--- 5 files changed, 80 insertions(+), 11 deletions(-) diff --git a/linux/build/docker/Dockerfile.builder b/linux/build/docker/Dockerfile.builder index 83ed5e8..1fc0015 100644 --- a/linux/build/docker/Dockerfile.builder +++ b/linux/build/docker/Dockerfile.builder @@ -95,6 +95,7 @@ RUN set -eux; \ adduser \ ca-certificates \ curl \ + debian-keyring \ dpkg-dev \ fakeroot \ fasttrack-archive-keyring \ diff --git a/linux/build/docker/systemd-entrypoint/docker-entrypoint.service b/linux/build/docker/systemd-entrypoint/docker-entrypoint.service index 0282632..cc25d39 100644 --- a/linux/build/docker/systemd-entrypoint/docker-entrypoint.service +++ b/linux/build/docker/systemd-entrypoint/docker-entrypoint.service @@ -8,7 +8,22 @@ Description=docker-entrypoint.service ExecStartPre=/bin/bash -e -x -c "cat -- /etc/docker-entrypoint-cmd" ExecStart=/bin/bash -e -x -c /etc/docker-entrypoint-cmd ExecStopPost=/usr/bin/docker-entrypoint-stop.sh -StandardInput=tty-force +## SilverMetal patches: +## StandardInput: was `tty-force`. That requires a docker-allocated +## TTY (`docker run -t`), but we deliberately run without -t in CI +## so derivative-maker's exception handler stays in non-interactive +## mode (otherwise any error drops into a `read -p` prompt and the +## container hangs forever). `null` gives the service /dev/null for +## stdin — derivative-maker doesn't read stdin during a normal build. +## StandardOutput / StandardError: keep upstream's `inherit`. With the +## container running with `-t` (which gives the systemd PID-1 a PTY +## for fd 1/2), inherit propagates that PTY to the service so its +## output reaches docker run / the act_runner log. We pair this with +## StandardInput=null above so derivative-maker's `[ -t 0 ]` returns +## false and it uses the non-interactive error handler — i.e. we +## get the visibility benefit of -t without the interactive-prompt +## hang on errors. +StandardInput=null StandardOutput=inherit StandardError=inherit EnvironmentFile=/etc/docker-entrypoint-env diff --git a/linux/build/docker/systemd-entrypoint/entrypoint.sh b/linux/build/docker/systemd-entrypoint/entrypoint.sh index a3c64e8..27391ce 100644 --- a/linux/build/docker/systemd-entrypoint/entrypoint.sh +++ b/linux/build/docker/systemd-entrypoint/entrypoint.sh @@ -19,10 +19,24 @@ if [ $# -eq 0 ]; then exit 1 fi -if [ ! -t 0 ]; then - printf '%s\n' 'ERROR: TTY needs to be enabled ("docker run -t ...").' >&2 - exit 1 -fi +## SilverMetal patch: TTY check disabled. +## +## Upstream's check exits if stdin isn't a TTY. That's right for an +## interactive `docker run -t ...` invocation by a developer, but in CI +## we cannot allocate a TTY without it making derivative-maker think +## a human is present — at which point any error drops it into an +## interactive `read -p 'Answer? ' answer` prompt and the container +## hangs forever (orphaning the docker run, which orphans the +## act_runner job container, and so on). +## +## Removing the check is safe: nothing downstream actually needs a TTY; +## entrypoint.sh just writes the command and execs systemd. +## +## --- original upstream block (kept commented for the next bump) --- +## if [ ! -t 0 ]; then +## printf '%s\n' 'ERROR: TTY needs to be enabled ("docker run -t ...").' >&2 +## exit 1 +## fi env | tee -- /etc/docker-entrypoint-env >/dev/null @@ -30,7 +44,15 @@ env | tee -- /etc/docker-entrypoint-env >/dev/null cat -- /etc/docker-entrypoint-env quoted_args="$(printf " %q" "${@}")" -printf '%s\n' "${quoted_args}" | tee -- /etc/docker-entrypoint-cmd >/dev/null +## SilverMetal patch: wrap the command with an explicit redirect to +## /dev/console. systemd's `StandardOutput=inherit` on a service does +## not propagate PID 1's stdout in a containerized PID-1-systemd +## context, so service stdout ends up nowhere visible. With `docker +## run -t`, /dev/console *is* the allocated PTY connected back to +## docker run, so writing there surfaces the build log to the +## act_runner / Gitea Actions log surface. +printf '%s\n' "exec${quoted_args} > /dev/console 2>&1" \ + | tee -- /etc/docker-entrypoint-cmd >/dev/null chmod +x -- /etc/docker-entrypoint-cmd systemctl mask systemd-firstboot.service systemd-udevd.service systemd-modules-load.service diff --git a/linux/build/scripts/build-inner.sh b/linux/build/scripts/build-inner.sh index 83a26fc..257c231 100755 --- a/linux/build/scripts/build-inner.sh +++ b/linux/build/scripts/build-inner.sh @@ -48,6 +48,27 @@ export user_name=user # here so we don't depend on upstream's wrapper. mkdir -p "${HOME}/derivative-binary" +# Import Debian developer keys into the user's GPG keyring. +# 2100_create-debian-packages calls `dm-reprepro-wrapper includedsc` +# on Debian source packages it pulls in (e.g. virtualbox_*.dsc, even +# for --target iso — see 2100_create-debian-packages line 114), and +# reprepro verifies each .dsc's signature against the user's keyring. +# Without this, every dsc with a Debian-uploader signature fails: +# Could not check validity of signature with '' in +# '...virtualbox_7.2.8-dfsg-1.dsc' as public key missing! +# There have been errors! +# debian-keyring (~40 MB, snapshot-pinned) provides the developer +# keys; importing it once at the start of the build seeds the keyring +# reprepro will consult. +if [ -d /usr/share/keyrings ]; then + for f in /usr/share/keyrings/debian-keyring.gpg \ + /usr/share/keyrings/debian-maintainers.gpg \ + /usr/share/keyrings/debian-nonupload.gpg; do + [ -f "$f" ] || continue + gpg --quiet --no-tty --import "$f" 2>/dev/null || true + done +fi + # shellcheck disable=SC1091 source "${REPO_ROOT}/linux/build/config/silvermetal-base.conf" diff --git a/linux/build/scripts/build.sh b/linux/build/scripts/build.sh index 74ee2f5..c3f6f37 100755 --- a/linux/build/scripts/build.sh +++ b/linux/build/scripts/build.sh @@ -32,7 +32,7 @@ cd "${REPO_ROOT}" # outside the LAN — it's the entry that fleet-wide /etc/docker/daemon.json # registers as an insecure-registry. The host-style "docker-registry:5000" # is *not* DNS-resolvable; do not use it. -BUILDER_IMAGE="${BUILDER_IMAGE:-docker-registry.silverlabs.uk/silvermetal-builder@sha256:dc9dd29df4bee54807aee5bb2605b400754cba86db5343b4947a81a7ecea8811}" +BUILDER_IMAGE="${BUILDER_IMAGE:-docker-registry.silverlabs.uk/silvermetal-builder@sha256:2f680c9629833400573d26a0e25b32b4f13a61a7e4d91543df8983a67801f0db}" if [[ "${BUILDER_IMAGE}" != *"@sha256:"* ]]; then echo "build.sh: BUILDER_IMAGE must be pinned by digest, got: ${BUILDER_IMAGE}" >&2 @@ -118,16 +118,26 @@ fi # namespace it can't see the host hierarchy # --tmpfs /run, /run/lock systemd writes runtime state here # -v /sys/fs/cgroup:rw the cgroup tree systemd manages -# -t entrypoint.sh requires a TTY (it `exit 1`s on -# stdin not a tty); allocating one keeps that -# path happy in CI too where stdin is otherwise -# /dev/null # # `tail -f /dev/null` is NOT used — control flow goes through systemd: # entrypoint.sh writes the user command to /etc/docker-entrypoint-cmd, # execs systemd, systemd boots docker-entrypoint.service which runs the # command, and docker-entrypoint-stop.sh propagates exit code via # `systemctl exit ` so the container exits with the right status. +# +# `-t` (PTY for stdout/stderr) is required for build-log visibility: +# systemd-as-PID-1 inherits the PTY from the container, and the +# docker-entrypoint.service propagates it to the build via +# StandardOutput=inherit. Without -t, the service log goes to the +# journal only (invisible to docker run / Gitea Actions). +# +# Critically, we do NOT add `-i`. Without -i, fd 0 inside the container +# is /dev/null, not a TTY — and the vendored docker-entrypoint.service +# explicitly sets `StandardInput=null` so the service inherits no TTY +# on fd 0 either. That keeps derivative-maker's `[ -t 0 ]` check false +# so its exception handler stays in non-interactive mode (otherwise any +# error drops into a `read -p 'Answer? '` prompt and the whole +# container hangs forever, orphaning docker run and blocking the runner). docker run --rm --privileged \ --cgroupns=host \ --tmpfs /run \