SysAdmin
bf55a3f81c
Some checks failed
Build SilverMetal Linux ISO (reproducibility-gated) / build-and-verify (push) Failing after 1m14s
Run #4252 died at: runuser: failed to execute /workspace/SilverLABS/SilverMetal/linux/build/scripts/build-inner.sh: Permission denied The script was created on the WSL/Windows side (/mnt/c) where every file appears world-rwx regardless of git's index, so the local `chmod +x` was a no-op as far as git was concerned and the file got committed at mode 100644 like any other regular file. Sibling scripts (build.sh, verify-reproducibility.sh, diagnose-divergence.sh) all correctly carry 100755 in the index. Fix: `git update-index --chmod=+x` to set the bit in the index explicitly, independent of the working-tree perms. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
49 lines
2.0 KiB
Bash
Executable File
49 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SilverMetal Linux — inner build step.
|
|
#
|
|
# Runs *inside* the silvermetal-builder container, as the unprivileged
|
|
# `builder` user. build.sh sets up the container, chowns the workspace,
|
|
# and runuser's into here. derivative-maker takes it from there and uses
|
|
# sudo internally for its privileged operations.
|
|
#
|
|
# Why this is its own file:
|
|
# The previous incarnation lived as a heredoc inside build.sh's docker
|
|
# run command. Once we needed to drop privileges from root to builder,
|
|
# the nested-heredoc / nested-quoting situation became unreadable; a
|
|
# plain script with normal quoting is far easier to maintain.
|
|
#
|
|
# Required env vars (set by build.sh and forwarded into the container):
|
|
# REPO_ROOT — absolute path to the SilverMetal repo root
|
|
# BUILD_DIR — where to drop the resulting *.iso and manifests
|
|
# SOURCE_DATE_EPOCH — reproducibility timestamp (forwarded to live-build)
|
|
# SNAPSHOT_TIMESTAMP — apt snapshot pin (forwarded to live-build)
|
|
|
|
set -euo pipefail
|
|
|
|
: "${REPO_ROOT:?REPO_ROOT must be set}"
|
|
: "${BUILD_DIR:?BUILD_DIR must be set}"
|
|
|
|
# shellcheck disable=SC1091
|
|
source "${REPO_ROOT}/linux/build/config/silvermetal-base.conf"
|
|
|
|
cd "${REPO_ROOT}/linux/build/derivative-maker"
|
|
|
|
./derivative-maker \
|
|
--build \
|
|
--target "${DERIVATIVE_BUILD_TARGET}" \
|
|
--flavour "${DERIVATIVE_FLAVOUR}" \
|
|
--arch "${DERIVATIVE_TARGET_ARCH}" \
|
|
--dist "${DERIVATIVE_DIST}" \
|
|
--config "${REPO_ROOT}/linux/build/config/silvermetal-base.conf"
|
|
|
|
# derivative-maker writes into its own build/ tree; collect into BUILD_DIR.
|
|
# Exact upstream output paths can shift between tags — keep this tolerant.
|
|
# Anything matching *.iso under the tree is what we want.
|
|
find . -maxdepth 6 -type f -name "*.iso" -print0 \
|
|
| xargs -0 -I{} cp -av "{}" "${BUILD_DIR}/"
|
|
|
|
# Manifest of file metadata that lives inside the ISO. Useful when
|
|
# diagnosing reproducibility regressions without re-extracting.
|
|
find . -maxdepth 6 -type f -name "*.manifest" -print0 \
|
|
| xargs -0 -I{} cp -av "{}" "${BUILD_DIR}/" 2>/dev/null || true
|