SysAdmin
9c406598e2
Some checks failed
Build SilverMetal Linux ISO (reproducibility-gated) / build-and-verify (push) Failing after 18m13s
Run #4259 (the systemd-in-container debut) cleared every prior failure class, ran for 15 minutes, then died inside 1100_sanity-tests' aptgetopt_conf_add at: tee: /home/root/derivative-binary/30_derivative-maker.conf: No such file or directory last_failed_bash_command: tee --append -- "$dist_aptgetopt_file" > /dev/null Two compounding bugs: 1. **user_name resolves to "root" via $SUDO_USER** derivative-maker/help-steps/variables (lines 80-93) computes user_name with these fallbacks, in order: [ -n "$user_name" ] || user_name="$SUDO_USER" [ -n "$user_name" ] || user_name="$(logname 2>/dev/null)" if [ -z "$user_name" ] && [ "$(id -u)" != "0" ]; then user_name="$(whoami)" [ -n "$user_name" ] || user_name="$USER" fi build.sh enters the container as root (systemd's docker-entrypoint.service runs as root), then sudoes to user via `sudo --preserve-env -u user --`. sudo always sets SUDO_USER to the *calling* user (= root), regardless of --preserve-env. So variables.sh hits the first fallback and computes user_name="root", then HOMEVAR=/home/root, then binary_build_folder_dist= /home/root/derivative-binary — a directory that does not exist because root's home is /root (not /home/root). Fix: build-inner.sh now exports user_name=user before sourcing the config, satisfying the first-priority check in variables.sh and short-circuiting the SUDO_USER fallback. The comment in the script notes the failure mode for the next reader. 2. **Missing mkdir of derivative-binary** Upstream's derivative-maker-docker-start does: mkdir --parents -- "${HOME}/derivative-binary" before invoking derivative-maker. Our build-inner.sh skipped that because previous iterations didn't reach the point where it mattered. Now that we do, we replicate it. 3. **Output collection path correction** derivative-maker writes its ISO/manifest output into ${HOME}/derivative-binary (per variables.sh:109) — not into the source tree under linux/build/derivative-maker. The previous `find . -maxdepth 6 -type f -name "*.iso"` would have missed everything once we got that far. Updated to `find "${HOME}/derivative-binary" ...`. No image rebuild needed — this is a pure script-and-env change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
90 lines
4.4 KiB
Bash
Executable File
90 lines
4.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SilverMetal Linux — inner build step.
|
|
#
|
|
# Runs *inside* the silvermetal-builder container, as the unprivileged
|
|
# `user` (uid 1000). build.sh's docker-run cmd chowns the workspace and
|
|
# sudoes here. The container's PID 1 is systemd (upstream's
|
|
# systemd-in-container pattern), so any `systemctl` calls derivative-
|
|
# maker makes — to start approx, daemon-reload, etc. — actually do
|
|
# what they're supposed to. derivative-maker uses sudo internally for
|
|
# its privileged ops.
|
|
#
|
|
# Why this is its own file:
|
|
# The previous incarnation lived as a heredoc inside build.sh's docker
|
|
# run command. Once we needed to drop privileges from root to user,
|
|
# the nested-heredoc / nested-quoting situation became unreadable; a
|
|
# plain script with normal quoting is far easier to maintain.
|
|
#
|
|
# Required env vars (set by build.sh and forwarded into the container):
|
|
# REPO_ROOT — absolute path to the SilverMetal repo root
|
|
# BUILD_DIR — where to drop the resulting *.iso and manifests
|
|
# SOURCE_DATE_EPOCH — reproducibility timestamp (forwarded to live-build)
|
|
# SNAPSHOT_TIMESTAMP — apt snapshot pin (forwarded to live-build)
|
|
|
|
set -euo pipefail
|
|
|
|
: "${REPO_ROOT:?REPO_ROOT must be set}"
|
|
: "${BUILD_DIR:?BUILD_DIR must be set}"
|
|
|
|
# Explicit user_name pin.
|
|
# derivative-maker/help-steps/variables (lines 80-93) computes user_name
|
|
# from $SUDO_USER as its first non-empty fallback. We enter this script
|
|
# via `sudo --preserve-env -u user --` from root, which makes sudo set
|
|
# SUDO_USER=root (the *calling* user). Variables.sh then picks
|
|
# user_name="root" and computes HOMEVAR=/home/root — which doesn't exist
|
|
# (root's home is /root). The first thing that breaks under that path
|
|
# is the aptgetopt config tee in 1100_sanity-tests:
|
|
# tee: /home/root/derivative-binary/30_derivative-maker.conf:
|
|
# No such file or directory
|
|
# Setting user_name explicitly satisfies the first-priority check in
|
|
# variables.sh and short-circuits the SUDO_USER fallback.
|
|
export user_name=user
|
|
|
|
# Create the binary output directory derivative-maker writes into.
|
|
# variables.sh sets binary_build_folder_dist=$HOMEVAR/derivative-binary
|
|
# (= /home/user/derivative-binary), and 1100_sanity-tests / later steps
|
|
# expect it to exist. Upstream's docker-start does the equivalent
|
|
# `mkdir --parents -- "${HOME}/derivative-binary"`; we replicate that
|
|
# here so we don't depend on upstream's wrapper.
|
|
mkdir -p "${HOME}/derivative-binary"
|
|
|
|
# shellcheck disable=SC1091
|
|
source "${REPO_ROOT}/linux/build/config/silvermetal-base.conf"
|
|
|
|
cd "${REPO_ROOT}/linux/build/derivative-maker"
|
|
|
|
# CLI grammar comes from derivative-maker/help-steps/parse-cmd. The
|
|
# valid options are a closed set; passing anything else (including
|
|
# --build, --dist, or --config) trips the "unknown option" guard at
|
|
# parse-cmd line 725. Spelling matters too: upstream uses --flavor
|
|
# (American), not --flavour. --freedom is mandatory for amd64/i386.
|
|
# Dist is implicit from --flavor (kicksecure-cli => trixie), and
|
|
# the silvermetal-base.conf is sourced into the env above rather than
|
|
# passed as a flag because derivative-maker has no --config option.
|
|
#
|
|
# --allow-untagged true / --allow-uncommitted true: the pinned upstream
|
|
# tag (18.1.7.4-developers-only — name says it all) deliberately ships
|
|
# with some submodules at intermediate / merge commits. sq-git still
|
|
# verifies every signature in the chain — these flags only relax the
|
|
# additional "must be at a release tag" check. Appropriate for a
|
|
# downstream consumer pinned to a developer tag.
|
|
./derivative-maker \
|
|
--flavor "${DERIVATIVE_FLAVOUR}" \
|
|
--target "${DERIVATIVE_BUILD_TARGET}" \
|
|
--arch "${DERIVATIVE_TARGET_ARCH}" \
|
|
--freedom "${DERIVATIVE_FREEDOM}" \
|
|
--allow-untagged true \
|
|
--allow-uncommitted true
|
|
|
|
# derivative-maker writes its outputs into ${HOME}/derivative-binary
|
|
# (per help-steps/variables: binary_build_folder_dist=$HOMEVAR/derivative-binary),
|
|
# *not* into the source tree. Collect from there into BUILD_DIR.
|
|
# Exact upstream output paths can shift between tags — keep this tolerant.
|
|
find "${HOME}/derivative-binary" -maxdepth 6 -type f -name "*.iso" -print0 \
|
|
| xargs -0 -I{} cp -av "{}" "${BUILD_DIR}/"
|
|
|
|
# Manifest of file metadata that lives inside the ISO. Useful when
|
|
# diagnosing reproducibility regressions without re-extracting.
|
|
find "${HOME}/derivative-binary" -maxdepth 6 -type f -name "*.manifest" -print0 \
|
|
| xargs -0 -I{} cp -av "{}" "${BUILD_DIR}/" 2>/dev/null || true
|