SysAdmin
5bb24235bd
🎉 Run #4271's Build A actually produced the ISO. derivative-maker ran clean for 15:24: INFO: Script ./derivative-maker completed. Exit Code: 0. Errors Detected: 0. Execution Time: 00:15:24 '/home/user/derivative-binary/.../Kicksecure-CLI-18.1.7.4-developers-only.Intel_AMD64.iso' -> '/workspace/SilverLABS/SilverMetal/build-a/Kicksecure-CLI-18.1.7.4-developers-only.Intel_AMD64.iso' …but build-inner.sh then died on its own post-build collection step: find: '.../live-build/chroot/usr/src': Permission denied find: '.../live-build/chroot/etc/sudoers.d': Permission denied find: '.../live-build/chroot/boot': Permission denied … The chroot's standard hardened subdirs (/usr/src, /etc/sudoers.d, /etc/cron.*, /boot, /root, /run/{sudo,lvm,cryptsetup,openvpn-{client, server}}, cache/bootstrap/root) are 0700 root-owned because the live-build chroot was assembled under sudo. As `user` (uid 1000) we can't descend them. find emits Permission denied on each, exits with status 1, and `set -euo pipefail` in build-inner.sh propagates that through `xargs cp` and aborts — even though the ISO copy itself had already succeeded a few lines earlier in the same xargs stream. Fix: redirect find's stderr to /dev/null and tolerate non-zero exit on both the *.iso and *.manifest scans. build.sh already verifies an ISO landed in BUILD_DIR (exit 4 with "no ISO produced" if not), so a real miss is still caught — we just stop killing the script for the benign unreadable-chroot-subdirs case. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
140 lines
7.1 KiB
Bash
Executable File
140 lines
7.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SilverMetal Linux — inner build step.
|
|
#
|
|
# Runs *inside* the silvermetal-builder container, as the unprivileged
|
|
# `user` (uid 1000). build.sh's docker-run cmd chowns the workspace and
|
|
# sudoes here. The container's PID 1 is systemd (upstream's
|
|
# systemd-in-container pattern), so any `systemctl` calls derivative-
|
|
# maker makes — to start approx, daemon-reload, etc. — actually do
|
|
# what they're supposed to. derivative-maker uses sudo internally for
|
|
# its privileged ops.
|
|
#
|
|
# Why this is its own file:
|
|
# The previous incarnation lived as a heredoc inside build.sh's docker
|
|
# run command. Once we needed to drop privileges from root to user,
|
|
# the nested-heredoc / nested-quoting situation became unreadable; a
|
|
# plain script with normal quoting is far easier to maintain.
|
|
#
|
|
# Required env vars (set by build.sh and forwarded into the container):
|
|
# REPO_ROOT — absolute path to the SilverMetal repo root
|
|
# BUILD_DIR — where to drop the resulting *.iso and manifests
|
|
# SOURCE_DATE_EPOCH — reproducibility timestamp (forwarded to live-build)
|
|
# SNAPSHOT_TIMESTAMP — apt snapshot pin (forwarded to live-build)
|
|
|
|
set -euo pipefail
|
|
|
|
: "${REPO_ROOT:?REPO_ROOT must be set}"
|
|
: "${BUILD_DIR:?BUILD_DIR must be set}"
|
|
|
|
# Explicit user_name pin.
|
|
# derivative-maker/help-steps/variables (lines 80-93) computes user_name
|
|
# from $SUDO_USER as its first non-empty fallback. We enter this script
|
|
# via `sudo --preserve-env -u user --` from root, which makes sudo set
|
|
# SUDO_USER=root (the *calling* user). Variables.sh then picks
|
|
# user_name="root" and computes HOMEVAR=/home/root — which doesn't exist
|
|
# (root's home is /root). The first thing that breaks under that path
|
|
# is the aptgetopt config tee in 1100_sanity-tests:
|
|
# tee: /home/root/derivative-binary/30_derivative-maker.conf:
|
|
# No such file or directory
|
|
# Setting user_name explicitly satisfies the first-priority check in
|
|
# variables.sh and short-circuits the SUDO_USER fallback.
|
|
export user_name=user
|
|
|
|
# Create the binary output directory derivative-maker writes into.
|
|
# variables.sh sets binary_build_folder_dist=$HOMEVAR/derivative-binary
|
|
# (= /home/user/derivative-binary), and 1100_sanity-tests / later steps
|
|
# expect it to exist. Upstream's docker-start does the equivalent
|
|
# `mkdir --parents -- "${HOME}/derivative-binary"`; we replicate that
|
|
# here so we don't depend on upstream's wrapper.
|
|
mkdir -p "${HOME}/derivative-binary"
|
|
|
|
# Import Debian developer keys into the user's GPG keyring.
|
|
# 2100_create-debian-packages calls `dm-reprepro-wrapper includedsc`
|
|
# on Debian source packages it pulls in (e.g. virtualbox_*.dsc, even
|
|
# for --target iso — see 2100_create-debian-packages line 114), and
|
|
# reprepro verifies each .dsc's signature against the user's keyring.
|
|
# Without this, every dsc with a Debian-uploader signature fails:
|
|
# Could not check validity of signature with '<fingerprint>' in
|
|
# '...virtualbox_7.2.8-dfsg-1.dsc' as public key missing!
|
|
# There have been errors!
|
|
# debian-keyring (~40 MB, snapshot-pinned) provides the developer
|
|
# keys; importing it once at the start of the build seeds the keyring
|
|
# reprepro will consult.
|
|
if [ -d /usr/share/keyrings ]; then
|
|
for f in /usr/share/keyrings/debian-keyring.gpg \
|
|
/usr/share/keyrings/debian-maintainers.gpg \
|
|
/usr/share/keyrings/debian-nonupload.gpg; do
|
|
[ -f "$f" ] || continue
|
|
gpg --quiet --no-tty --import "$f" 2>/dev/null || true
|
|
done
|
|
fi
|
|
|
|
# Bridge the upstream-blessed checkout path.
|
|
# 1500_local-deps installs the in-repo `developer-meta-files.deb` system-
|
|
# wide. That deb ships /usr/bin/dm-reprepro-wrapper, which begins with
|
|
# source "${0%/*}/../../help-steps/pre"
|
|
# resolved against the install location (/usr/bin) and a user_name-relative
|
|
# layout that lands at /home/user/derivative-maker/help-steps/pre.
|
|
# When 2100_create-debian-packages calls `dm-reprepro-wrapper` via PATH
|
|
# (e.g. through `genmkfile reprepro-remove`), the system copy wins over
|
|
# the in-repo one, and the source fails:
|
|
# /usr/bin/dm-reprepro-wrapper: line 28:
|
|
# /home/user/derivative-maker/help-steps/pre: No such file or directory
|
|
# Make /home/user/derivative-maker resolve to our actual checkout so both
|
|
# the in-repo and system-installed wrappers find the same support files.
|
|
ln -sfn "${REPO_ROOT}/linux/build/derivative-maker" /home/user/derivative-maker
|
|
|
|
# shellcheck disable=SC1091
|
|
source "${REPO_ROOT}/linux/build/config/silvermetal-base.conf"
|
|
|
|
cd "${REPO_ROOT}/linux/build/derivative-maker"
|
|
|
|
# CLI grammar comes from derivative-maker/help-steps/parse-cmd. The
|
|
# valid options are a closed set; passing anything else (including
|
|
# --build, --dist, or --config) trips the "unknown option" guard at
|
|
# parse-cmd line 725. Spelling matters too: upstream uses --flavor
|
|
# (American), not --flavour. --freedom is mandatory for amd64/i386.
|
|
# Dist is implicit from --flavor (kicksecure-cli => trixie), and
|
|
# the silvermetal-base.conf is sourced into the env above rather than
|
|
# passed as a flag because derivative-maker has no --config option.
|
|
#
|
|
# --allow-untagged true / --allow-uncommitted true: the pinned upstream
|
|
# tag (18.1.7.4-developers-only — name says it all) deliberately ships
|
|
# with some submodules at intermediate / merge commits. sq-git still
|
|
# verifies every signature in the chain — these flags only relax the
|
|
# additional "must be at a release tag" check. Appropriate for a
|
|
# downstream consumer pinned to a developer tag.
|
|
./derivative-maker \
|
|
--flavor "${DERIVATIVE_FLAVOUR}" \
|
|
--target "${DERIVATIVE_BUILD_TARGET}" \
|
|
--arch "${DERIVATIVE_TARGET_ARCH}" \
|
|
--freedom "${DERIVATIVE_FREEDOM}" \
|
|
--allow-untagged true \
|
|
--allow-uncommitted true
|
|
|
|
# derivative-maker writes its outputs into ${HOME}/derivative-binary
|
|
# (per help-steps/variables: binary_build_folder_dist=$HOMEVAR/derivative-binary),
|
|
# *not* into the source tree. Collect from there into BUILD_DIR.
|
|
# Exact upstream output paths can shift between tags — keep this tolerant.
|
|
#
|
|
# stderr+exit suppression is essential: $HOME/derivative-binary contains
|
|
# the live-build chroot, and several of the chroot's own subdirs
|
|
# (/usr/src, /etc/sudoers.d, /etc/cron.*, /boot, /root, /run/sudo,
|
|
# cache/bootstrap/root, ...) are 0700 root-owned because the chroot
|
|
# creation step ran under sudo. As `user` (uid 1000) we can't traverse
|
|
# them. find emits "Permission denied" on each and exits non-zero;
|
|
# pipefail then kills the entire build script *after* the ISO has
|
|
# already been copied — exactly what happened on run #4271 (15:24
|
|
# clean derivative-maker run, ISO produced, build-inner died on this
|
|
# pipeline). Suppress and rely on build.sh's host-side
|
|
# "no *.iso in BUILD_DIR" check (exit 4) to surface a real miss.
|
|
find "${HOME}/derivative-binary" -maxdepth 6 -type f -name "*.iso" \
|
|
-print0 2>/dev/null \
|
|
| xargs -0 -I{} cp -av "{}" "${BUILD_DIR}/" || true
|
|
|
|
# Manifest of file metadata that lives inside the ISO. Useful when
|
|
# diagnosing reproducibility regressions without re-extracting.
|
|
find "${HOME}/derivative-binary" -maxdepth 6 -type f -name "*.manifest" \
|
|
-print0 2>/dev/null \
|
|
| xargs -0 -I{} cp -av "{}" "${BUILD_DIR}/" 2>/dev/null || true
|