SysAdmin
4aa59ba633
Some checks failed
Build SilverMetal Linux ISO (reproducibility-gated) / build-and-verify (push) Failing after 11m33s
Run #4260 cleared every harness layer and ran for 18 minutes — past sanity-tests, prepare-build-machine, cowbuilder-setup, local-deps — into 2100_create-debian-packages, where it died on: Could not check validity of signature with '92978A6E195E4921825F7FF0F34F09744E9F5DD9' in '/home/user/derivative-binary/temp_packages_debian_sid/virtualbox_7.2.8-dfsg-1.dsc' as public key missing! …and then *also* hung the runner indefinitely because, on any error, derivative-maker's exception_handler_general detected a TTY (we passed `docker run -t`) and dropped into an interactive `read -p 'Answer? '` prompt that nothing was ever going to answer. The orphan docker run in turn orphaned the act_runner job container, blocking the runner until manual cleanup. Three coordinated fixes, validated end-to-end with docker-side smoke tests on 10.0.0.51: 1. **Non-interactive mode without losing output visibility.** The original architectural goal: keep derivative-maker out of interactive mode (`[ -t 0 ]` must be false) AND keep the build log visible to docker run / Gitea Actions (PTY needed somewhere). Resolution: - `docker run -t` is kept (required for /dev/console to be a real PTY back to docker), but no `-i`, so fd 0 stays /dev/null. - docker-entrypoint.service: `StandardInput=tty-force` → `StandardInput=null` so the service's fd 0 is /dev/null too. Verified inside the container: `[ -t 0 ]` returns false. - entrypoint.sh now wraps the user command with an explicit `> /dev/console 2>&1` redirect before writing it to /etc/docker-entrypoint-cmd. systemd's `StandardOutput=inherit` does NOT propagate PID-1's stdout to services in this PID-1- systemd-in-container topology — the service log was going nowhere visible. /dev/console under `docker run -t` IS the allocated PTY back to docker, so the redirect surfaces the log to the act_runner / Gitea Actions log. - entrypoint.sh's `[ ! -t 0 ] && exit 1` guard removed (it would now always trigger). 2. **debian-keyring for reprepro source-package signature checks.** 2100_create-debian-packages calls dm-reprepro-wrapper includedsc on every .dsc in temp_packages_debian_sid (including virtualbox_*.dsc, even for `--target iso` — see line 114 of that build step). reprepro verifies the dsc signature against the user's GPG keyring; without the maintainer keys it fails. Adds `debian-keyring` to Dockerfile.builder. build-inner.sh now imports debian-keyring.gpg / debian-maintainers.gpg / debian-nonupload.gpg into the user's keyring before running derivative-maker. 3. **BUILDER_IMAGE digest re-pinned.** Built natively on 10.0.0.51 (per memory: never on WSL/aarch64). New digest: sha256:2f680c96…f0db. Smoke-test results (against this exact image): ==> START ← user output reaches docker stdout (keyring present) ← debian-keyring imported successfully STDIN_NOT_TTY ← derivative-maker WILL stay non-interactive ==> END ← clean shutdown docker run exit: 42 ← exit code propagates correctly on failure Files: Dockerfile.builder, systemd-entrypoint/entrypoint.sh, systemd-entrypoint/docker-entrypoint.service, scripts/build.sh, scripts/build-inner.sh. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
82 lines
2.5 KiB
Bash
82 lines
2.5 KiB
Bash
#!/bin/bash
|
|
|
|
## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
|
|
## See the file COPYING for copying conditions.
|
|
|
|
## TODO: document
|
|
|
|
set -x
|
|
set -o errexit
|
|
set -o nounset
|
|
set -o errtrace
|
|
set -o pipefail
|
|
|
|
container=docker
|
|
export container
|
|
|
|
if [ $# -eq 0 ]; then
|
|
printf '%s\n' 'ERROR: No command specified. You probably want to run "journalctl -f", or maybe "bash"?' >&2
|
|
exit 1
|
|
fi
|
|
|
|
## SilverMetal patch: TTY check disabled.
|
|
##
|
|
## Upstream's check exits if stdin isn't a TTY. That's right for an
|
|
## interactive `docker run -t ...` invocation by a developer, but in CI
|
|
## we cannot allocate a TTY without it making derivative-maker think
|
|
## a human is present — at which point any error drops it into an
|
|
## interactive `read -p 'Answer? ' answer` prompt and the container
|
|
## hangs forever (orphaning the docker run, which orphans the
|
|
## act_runner job container, and so on).
|
|
##
|
|
## Removing the check is safe: nothing downstream actually needs a TTY;
|
|
## entrypoint.sh just writes the command and execs systemd.
|
|
##
|
|
## --- original upstream block (kept commented for the next bump) ---
|
|
## if [ ! -t 0 ]; then
|
|
## printf '%s\n' 'ERROR: TTY needs to be enabled ("docker run -t ...").' >&2
|
|
## exit 1
|
|
## fi
|
|
|
|
env | tee -- /etc/docker-entrypoint-env >/dev/null
|
|
|
|
## Debugging.
|
|
cat -- /etc/docker-entrypoint-env
|
|
|
|
quoted_args="$(printf " %q" "${@}")"
|
|
## SilverMetal patch: wrap the command with an explicit redirect to
|
|
## /dev/console. systemd's `StandardOutput=inherit` on a service does
|
|
## not propagate PID 1's stdout in a containerized PID-1-systemd
|
|
## context, so service stdout ends up nowhere visible. With `docker
|
|
## run -t`, /dev/console *is* the allocated PTY connected back to
|
|
## docker run, so writing there surfaces the build log to the
|
|
## act_runner / Gitea Actions log surface.
|
|
printf '%s\n' "exec${quoted_args} > /dev/console 2>&1" \
|
|
| tee -- /etc/docker-entrypoint-cmd >/dev/null
|
|
chmod +x -- /etc/docker-entrypoint-cmd
|
|
|
|
systemctl mask systemd-firstboot.service systemd-udevd.service systemd-modules-load.service
|
|
systemctl unmask systemd-logind
|
|
systemctl enable docker-entrypoint.service
|
|
|
|
systemd=
|
|
if [ -x /lib/systemd/systemd ]; then
|
|
systemd=/lib/systemd/systemd
|
|
elif [ -x /usr/lib/systemd/systemd ]; then
|
|
systemd=/usr/lib/systemd/systemd
|
|
elif [ -x /sbin/init ]; then
|
|
systemd=/sbin/init
|
|
else
|
|
printf '%s\n' 'ERROR: systemd is not installed' >&2
|
|
exit 1
|
|
fi
|
|
|
|
declare -a systemd_args=(
|
|
--show-status=false
|
|
--unit=docker-entrypoint.target
|
|
)
|
|
|
|
printf '%s\n' "$0: starting $systemd ${systemd_args[*]}"
|
|
|
|
exec "$systemd" "${systemd_args[@]}"
|