SysAdmin
38ac4f8a96
Some checks failed
Build SilverMetal Linux ISO (reproducibility-gated) / build-and-verify (push) Failing after 15m34s
Run #4258 cleared the systemctl shim only to die two seconds later on the *next* expectation derivative-maker has of a real systemd host: its sources.list points at http://127.0.0.1:9977/debian (the approx package-cache socket-activated by systemd) and apt-get update could not reach the daemon because nothing was actually started by the no-op shim: Err:1 http://127.0.0.1:9977/debian trixie InRelease Could not connect to 127.0.0.1:9977 (127.0.0.1). - connect (111: Connection refused) Whack-a-mole'ing each service derivative-maker tries to start (approx today, then journald, then systemd-logind, then who-knows-what tomorrow) is going to keep failing for a while — derivative-maker is fundamentally designed for a real systemd-managed Debian host. The container pattern upstream itself ships (linux/build/derivative-maker/docker/) runs systemd as PID 1 inside the container; this commit adopts that approach. Architecture: - PID 1 in the build container is now systemd. Upstream's vendored entrypoint.sh records the user-supplied command into /etc/docker-entrypoint-cmd, captures env into /etc/docker-entrypoint-env, masks irrelevant units, and execs systemd. systemd boots, docker-entrypoint.service runs the command, docker-entrypoint-stop.sh propagates the exit code via `systemctl exit <code>` so the container exits with the right status. - The four entrypoint files (entrypoint.sh, docker-entrypoint.service / .target, docker-entrypoint-stop.sh) are vendored at linux/build/docker/systemd-entrypoint/ rather than COPY'd from the submodule path — Docker build context can only reach below itself, and bumping is tracked in that dir's README. - Container runtime now requires --cgroupns=host, --tmpfs /run, --tmpfs /run/lock, and -v /sys/fs/cgroup:/sys/fs/cgroup:rw so systemd can manage cgroups properly. -t allocates a TTY, satisfying entrypoint.sh's `[ ! -t 0 ] && exit 1` check in CI where stdin is otherwise /dev/null. - User renamed builder → user (uid 1000, passwordless sudo) to match upstream's USER=user / HOME=/home/user convention. chown in build.sh now uses uid 1000:1000 so it's name-agnostic. - Image package list grew to match upstream's derivative-maker-docker-setup (sq stack + dbus + approx + the rest) plus our ISO toolchain (live-build / debootstrap / xorriso / squashfs-tools / etc.). Snapshot.debian.org pinning is preserved (same APT_SNAPSHOT_URL, two-phase install pattern). Verified: Smoke test on 10.0.0.51 — `docker run --rm --privileged --cgroupns=host --tmpfs /run --tmpfs /run/lock -v /sys/fs/cgroup:...:rw -t <image> /bin/bash -c 'echo OK'` — booted systemd, ran the command via docker-entrypoint.service, captured the output, shut down filesystems and exited cleanly. build.sh BUILDER_IMAGE pin → sha256:dc9dd29d…8811. Image rebuilt natively on 10.0.0.51, pushed to docker-registry.silverlabs.uk. The systemctl shim is removed by virtue of the Dockerfile rewrite — real systemd makes it unnecessary. The previous "iter6 / iter7" intermediate digests stay in the registry until we GC; the live one is m1.1-iter8-systemd. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
67 lines
3.2 KiB
Bash
Executable File
67 lines
3.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SilverMetal Linux — inner build step.
|
|
#
|
|
# Runs *inside* the silvermetal-builder container, as the unprivileged
|
|
# `user` (uid 1000). build.sh's docker-run cmd chowns the workspace and
|
|
# sudoes here. The container's PID 1 is systemd (upstream's
|
|
# systemd-in-container pattern), so any `systemctl` calls derivative-
|
|
# maker makes — to start approx, daemon-reload, etc. — actually do
|
|
# what they're supposed to. derivative-maker uses sudo internally for
|
|
# its privileged ops.
|
|
#
|
|
# Why this is its own file:
|
|
# The previous incarnation lived as a heredoc inside build.sh's docker
|
|
# run command. Once we needed to drop privileges from root to user,
|
|
# the nested-heredoc / nested-quoting situation became unreadable; a
|
|
# plain script with normal quoting is far easier to maintain.
|
|
#
|
|
# Required env vars (set by build.sh and forwarded into the container):
|
|
# REPO_ROOT — absolute path to the SilverMetal repo root
|
|
# BUILD_DIR — where to drop the resulting *.iso and manifests
|
|
# SOURCE_DATE_EPOCH — reproducibility timestamp (forwarded to live-build)
|
|
# SNAPSHOT_TIMESTAMP — apt snapshot pin (forwarded to live-build)
|
|
|
|
set -euo pipefail
|
|
|
|
: "${REPO_ROOT:?REPO_ROOT must be set}"
|
|
: "${BUILD_DIR:?BUILD_DIR must be set}"
|
|
|
|
# shellcheck disable=SC1091
|
|
source "${REPO_ROOT}/linux/build/config/silvermetal-base.conf"
|
|
|
|
cd "${REPO_ROOT}/linux/build/derivative-maker"
|
|
|
|
# CLI grammar comes from derivative-maker/help-steps/parse-cmd. The
|
|
# valid options are a closed set; passing anything else (including
|
|
# --build, --dist, or --config) trips the "unknown option" guard at
|
|
# parse-cmd line 725. Spelling matters too: upstream uses --flavor
|
|
# (American), not --flavour. --freedom is mandatory for amd64/i386.
|
|
# Dist is implicit from --flavor (kicksecure-cli => trixie), and
|
|
# the silvermetal-base.conf is sourced into the env above rather than
|
|
# passed as a flag because derivative-maker has no --config option.
|
|
#
|
|
# --allow-untagged true / --allow-uncommitted true: the pinned upstream
|
|
# tag (18.1.7.4-developers-only — name says it all) deliberately ships
|
|
# with some submodules at intermediate / merge commits. sq-git still
|
|
# verifies every signature in the chain — these flags only relax the
|
|
# additional "must be at a release tag" check. Appropriate for a
|
|
# downstream consumer pinned to a developer tag.
|
|
./derivative-maker \
|
|
--flavor "${DERIVATIVE_FLAVOUR}" \
|
|
--target "${DERIVATIVE_BUILD_TARGET}" \
|
|
--arch "${DERIVATIVE_TARGET_ARCH}" \
|
|
--freedom "${DERIVATIVE_FREEDOM}" \
|
|
--allow-untagged true \
|
|
--allow-uncommitted true
|
|
|
|
# derivative-maker writes into its own build/ tree; collect into BUILD_DIR.
|
|
# Exact upstream output paths can shift between tags — keep this tolerant.
|
|
# Anything matching *.iso under the tree is what we want.
|
|
find . -maxdepth 6 -type f -name "*.iso" -print0 \
|
|
| xargs -0 -I{} cp -av "{}" "${BUILD_DIR}/"
|
|
|
|
# Manifest of file metadata that lives inside the ISO. Useful when
|
|
# diagnosing reproducibility regressions without re-extracting.
|
|
find . -maxdepth 6 -type f -name "*.manifest" -print0 \
|
|
| xargs -0 -I{} cp -av "{}" "${BUILD_DIR}/" 2>/dev/null || true
|