SysAdmin 4aa59ba633 fix(linux/build): non-interactive mode + visible output + key import (M1.1) ...

Run #4260 cleared every harness layer and ran for 18 minutes — past
sanity-tests, prepare-build-machine, cowbuilder-setup, local-deps —
into 2100_create-debian-packages, where it died on:

    Could not check validity of signature with
    '92978A6E195E4921825F7FF0F34F09744E9F5DD9' in
    '/home/user/derivative-binary/temp_packages_debian_sid/virtualbox_7.2.8-dfsg-1.dsc'
    as public key missing!

…and then *also* hung the runner indefinitely because, on any error,
derivative-maker's exception_handler_general detected a TTY (we passed
`docker run -t`) and dropped into an interactive `read -p 'Answer? '`
prompt that nothing was ever going to answer. The orphan docker run
in turn orphaned the act_runner job container, blocking the runner
until manual cleanup.

Three coordinated fixes, validated end-to-end with docker-side smoke
tests on 10.0.0.51:

1. **Non-interactive mode without losing output visibility.**

   The original architectural goal: keep derivative-maker out of
   interactive mode (`[ -t 0 ]` must be false) AND keep the build log
   visible to docker run / Gitea Actions (PTY needed somewhere).

   Resolution:
   - `docker run -t` is kept (required for /dev/console to be a real
     PTY back to docker), but no `-i`, so fd 0 stays /dev/null.
   - docker-entrypoint.service: `StandardInput=tty-force` →
     `StandardInput=null` so the service's fd 0 is /dev/null too.
     Verified inside the container: `[ -t 0 ]` returns false.
   - entrypoint.sh now wraps the user command with an explicit
     `> /dev/console 2>&1` redirect before writing it to
     /etc/docker-entrypoint-cmd. systemd's `StandardOutput=inherit`
     does NOT propagate PID-1's stdout to services in this PID-1-
     systemd-in-container topology — the service log was going
     nowhere visible. /dev/console under `docker run -t` IS the
     allocated PTY back to docker, so the redirect surfaces the
     log to the act_runner / Gitea Actions log.
   - entrypoint.sh's `[ ! -t 0 ] && exit 1` guard removed (it
     would now always trigger).

2. **debian-keyring for reprepro source-package signature checks.**

   2100_create-debian-packages calls dm-reprepro-wrapper includedsc
   on every .dsc in temp_packages_debian_sid (including
   virtualbox_*.dsc, even for `--target iso` — see line 114 of that
   build step). reprepro verifies the dsc signature against the
   user's GPG keyring; without the maintainer keys it fails.

   Adds `debian-keyring` to Dockerfile.builder. build-inner.sh now
   imports debian-keyring.gpg / debian-maintainers.gpg /
   debian-nonupload.gpg into the user's keyring before running
   derivative-maker.

3. **BUILDER_IMAGE digest re-pinned.**

   Built natively on 10.0.0.51 (per memory: never on WSL/aarch64).
   New digest: sha256:2f680c96…f0db.

Smoke-test results (against this exact image):

    ==> START                  ← user output reaches docker stdout
    (keyring present)          ← debian-keyring imported successfully
    STDIN_NOT_TTY              ← derivative-maker WILL stay non-interactive
    ==> END                    ← clean shutdown
    docker run exit: 42        ← exit code propagates correctly on failure

Files: Dockerfile.builder, systemd-entrypoint/entrypoint.sh,
       systemd-entrypoint/docker-entrypoint.service, scripts/build.sh,
       scripts/build-inner.sh.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-07 14:05:49 +01:00

2.5 KiB

Raw Blame History

View Raw