SilverMetal/linux/build/scripts/build.sh

#!/usr/bin/env bash
# SilverMetal Linux — ISO build wrapper.
#
# Runs the Kicksecure derivative-maker inside the pinned builder container
# with the reproducibility levers locked down. This script is the single
# entry point for both local developer builds and CI — there is no separate
# CI-only path. If you need to debug, run *this*, not lb directly.
#
# Usage:
#   linux/build/scripts/build.sh                # writes to linux/build/output/<commit>
#   BUILD_DIR=/tmp/build-a linux/build/scripts/build.sh   # override output root
#
# Exit codes:
#   0  ISO produced and SHA256SUMS written
#   1  argument / environment error
#   2  derivative-maker submodule missing
#   3  build failed
#   4  post-build hash/manifest step failed

set -euo pipefail

# --- Locate repo root -------------------------------------------------------
SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd -- "${SCRIPT_DIR}/../../.." && pwd)"
cd "${REPO_ROOT}"

# --- Pinned builder image ---------------------------------------------------
# Bumped together with linux/build/docker/Dockerfile.builder. The digest form
# is required; refusing the tag-only form is what stops a silent host drift.
#
# docker-registry.silverlabs.uk is the canonical hostname both inside and
# outside the LAN — it's the entry that fleet-wide /etc/docker/daemon.json
# registers as an insecure-registry. The host-style "docker-registry:5000"
# is *not* DNS-resolvable; do not use it.
BUILDER_IMAGE="${BUILDER_IMAGE:-docker-registry.silverlabs.uk/silvermetal-builder@sha256:f8f0db3756df220d3de79371054fd43cf7f824ad27d9900328fef5723821bedc}"

if [[ "${BUILDER_IMAGE}" != *"@sha256:"* ]]; then
    echo "build.sh: BUILDER_IMAGE must be pinned by digest, got: ${BUILDER_IMAGE}" >&2
    exit 1
fi

# --- Sanity: submodule present ---------------------------------------------
if [[ ! -f "linux/build/derivative-maker/.git" && ! -d "linux/build/derivative-maker/.git" ]]; then
    echo "build.sh: linux/build/derivative-maker submodule is not initialised." >&2
    echo "  Run: git submodule update --init --recursive" >&2
    exit 2
fi

# --- Compute SOURCE_DATE_EPOCH ---------------------------------------------
# Order of preference:
#   1. Explicit env var passed in (CI may set it for cross-runner consistency)
#   2. config/source-date-epoch.env override (offline rebuilds)
#   3. git commit timestamp of HEAD (default)
# shellcheck disable=SC1091
source linux/build/config/source-date-epoch.env || true
if [[ -z "${SOURCE_DATE_EPOCH:-}" ]]; then
    if [[ -n "${SOURCE_DATE_EPOCH_OVERRIDE:-}" ]]; then
        SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH_OVERRIDE}"
        echo "build.sh: using SOURCE_DATE_EPOCH override = ${SOURCE_DATE_EPOCH}"
    else
        SOURCE_DATE_EPOCH="$(git log -1 --pretty=%ct)"
    fi
fi
export SOURCE_DATE_EPOCH

# --- Pinned snapshot timestamp ---------------------------------------------
# shellcheck disable=SC1091
source linux/build/config/snapshot-pin.env
export SNAPSHOT_TIMESTAMP

# --- Resolve commit & output dir -------------------------------------------
COMMIT_SHA="$(git rev-parse --short=12 HEAD)"
BUILD_DIR="${BUILD_DIR:-${REPO_ROOT}/linux/build/output/${COMMIT_SHA}}"
mkdir -p "${BUILD_DIR}"

echo "build.sh: commit=${COMMIT_SHA} epoch=${SOURCE_DATE_EPOCH} snapshot=${SNAPSHOT_TIMESTAMP}"
echo "build.sh: output -> ${BUILD_DIR}"

# --- Mount strategy: local vs CI -------------------------------------------
# Locally we bind-mount the repo into the build container at the *same*
# path (self-referential), so internal references work transparently and
# the inner script doesn't need to care which host it's on.
#
# In CI we can't do that. build.sh runs inside a Gitea Actions job
# container which talks to the *host's* docker daemon via /var/run/docker.sock.
# Bind-mounting REPO_ROOT (= /workspace/<owner>/<repo>) would resolve
# against the host filesystem where that path doesn't exist; docker
# silently creates an empty dir on the host and mounts that, leaving the
# build container with an empty /work and a confusing "No such file or
# directory" error on the first config source.
#
# The standard fix for that DooD topology is --volumes-from of the parent
# job container, which inherits its /workspace mount intact. That keeps
# paths identical inside and outside, so the inner heredoc below is the
# same in both environments.
if [[ -n "${GITHUB_ACTIONS:-}" ]]; then
    BIND_ARGS=(--volumes-from "$(hostname)")
else
    BIND_ARGS=(-v "${REPO_ROOT}:${REPO_ROOT}:rw")
    # If BUILD_DIR lives outside REPO_ROOT (uncommon, but the env-var
    # override allows it), mount it explicitly too.
    if [[ "${BUILD_DIR}" != "${REPO_ROOT}/"* && "${BUILD_DIR}" != "${REPO_ROOT}" ]]; then
        BIND_ARGS+=(-v "${BUILD_DIR}:${BUILD_DIR}:rw")
    fi
fi

# --- Run the build inside the container ------------------------------------
# --privileged is required because live-build mounts loop devices and chroots.
# --network=host lets the container reach snapshot.debian.org without us
# fighting CI proxy config; tighten if/when that becomes a concern.
docker run --rm --privileged \
    --network=host \
    "${BIND_ARGS[@]}" \
    -e SOURCE_DATE_EPOCH \
    -e SNAPSHOT_TIMESTAMP \
    -e LC_ALL=C.UTF-8 \
    -e LANG=C.UTF-8 \
    -e TZ=UTC \
    -e REPO_ROOT="${REPO_ROOT}" \
    -e BUILD_DIR="${BUILD_DIR}" \
    -w "${REPO_ROOT}" \
    "${BUILDER_IMAGE}" \
    bash -euo pipefail -c '
        # derivative-maker refuses to run as root (it uses sudo internally
        # for the privileged ops). Hand the workspace ownership to the
        # unprivileged builder user (uid 1000, created in the Dockerfile
        # with passwordless sudo), then drop privs and let build-inner.sh
        # do the actual work.
        chown -R builder:builder "${REPO_ROOT}" "${BUILD_DIR}"
        runuser -u builder -- "${REPO_ROOT}/linux/build/scripts/build-inner.sh"
    ' || { echo "build.sh: derivative-maker failed"; exit 3; }

# --- Hash artefacts ---------------------------------------------------------
# Run hashing on the host (not in the container) so a busted container image
# can't tamper with the digests we publish.
shopt -s nullglob
ISO_FILES=("${BUILD_DIR}"/*.iso)
shopt -u nullglob
if (( ${#ISO_FILES[@]} == 0 )); then
    echo "build.sh: no ISO produced in ${BUILD_DIR}" >&2
    exit 4
fi

(
    cd "${BUILD_DIR}"
    sha256sum -- *.iso > SHA256SUMS
    cp -- "${REPO_ROOT}/linux/build/config/snapshot-pin.env" snapshot-pin.env
    {
        echo "commit=${COMMIT_SHA}"
        echo "source_date_epoch=${SOURCE_DATE_EPOCH}"
        echo "snapshot_timestamp=${SNAPSHOT_TIMESTAMP}"
        echo "builder_image=${BUILDER_IMAGE}"
        echo "host_uname=$(uname -srm)"
    } > BUILD_INFO
)

echo "build.sh: SHA256SUMS:"
cat "${BUILD_DIR}/SHA256SUMS"