SysAdmin
5918305fd7
iter21's /proc/self/cgroup approach hit:
build.sh: cgroup contents:
0::/
Empty path — act_runner runs job containers with cgroupns enabled, so
the in-container view of cgroup paths is rooted at the namespace, with
no trace of the host-side container ID. Same blocker as `hostname`.
The host docker daemon does know who we are, and we have its socket.
We're the only running container with /workspace/SilverLABS/SilverMetal
as a mount destination (concurrency: 1 in the workflow), so iterate
docker ps and match by mount destination. Found CID becomes the
--volumes-from argument; if no match, dump docker ps to the log and
fail loud.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
233 lines
10 KiB
Bash
Executable File
233 lines
10 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SilverMetal Linux — ISO build wrapper.
|
|
#
|
|
# Runs the Kicksecure derivative-maker inside the pinned builder container
|
|
# with the reproducibility levers locked down. This script is the single
|
|
# entry point for both local developer builds and CI — there is no separate
|
|
# CI-only path. If you need to debug, run *this*, not lb directly.
|
|
#
|
|
# Usage:
|
|
# linux/build/scripts/build.sh # writes to linux/build/output/<commit>
|
|
# BUILD_DIR=/tmp/build-a linux/build/scripts/build.sh # override output root
|
|
#
|
|
# Exit codes:
|
|
# 0 ISO produced and SHA256SUMS written
|
|
# 1 argument / environment error
|
|
# 2 derivative-maker submodule missing
|
|
# 3 build failed
|
|
# 4 post-build hash/manifest step failed
|
|
|
|
set -euo pipefail
|
|
|
|
# --- Locate repo root -------------------------------------------------------
|
|
SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd -- "${SCRIPT_DIR}/../../.." && pwd)"
|
|
cd "${REPO_ROOT}"
|
|
|
|
# --- Pinned builder image ---------------------------------------------------
|
|
# In CI this is always overridden by the BUILDER_IMAGE env var that the
|
|
# `builder-image` job in .gitea/workflows/build-iso-linux.yaml passes in
|
|
# (the digest of the silvermetal-builder image it just built and pushed).
|
|
# The hardcoded default below is the local-developer / offline-rebuild
|
|
# fallback; bump it after any meaningful Dockerfile.builder change merges
|
|
# so `linux/build/scripts/build.sh` works without CI for the same commit.
|
|
# The digest form is required either way; refusing the tag-only form is
|
|
# what stops a silent host drift.
|
|
#
|
|
# docker-registry.silverlabs.uk is the canonical hostname both inside and
|
|
# outside the LAN — it's the entry that fleet-wide /etc/docker/daemon.json
|
|
# registers as an insecure-registry. The host-style "docker-registry:5000"
|
|
# is *not* DNS-resolvable; do not use it.
|
|
BUILDER_IMAGE="${BUILDER_IMAGE:-docker-registry.silverlabs.uk/silvermetal-builder@sha256:2f680c9629833400573d26a0e25b32b4f13a61a7e4d91543df8983a67801f0db}"
|
|
|
|
if [[ "${BUILDER_IMAGE}" != *"@sha256:"* ]]; then
|
|
echo "build.sh: BUILDER_IMAGE must be pinned by digest, got: ${BUILDER_IMAGE}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# --- Sanity: submodule present ---------------------------------------------
|
|
if [[ ! -f "linux/build/derivative-maker/.git" && ! -d "linux/build/derivative-maker/.git" ]]; then
|
|
echo "build.sh: linux/build/derivative-maker submodule is not initialised." >&2
|
|
echo " Run: git submodule update --init --recursive" >&2
|
|
exit 2
|
|
fi
|
|
|
|
# --- Compute SOURCE_DATE_EPOCH ---------------------------------------------
|
|
# Order of preference:
|
|
# 1. Explicit env var passed in (CI may set it for cross-runner consistency)
|
|
# 2. config/source-date-epoch.env override (offline rebuilds)
|
|
# 3. git commit timestamp of HEAD (default)
|
|
# shellcheck disable=SC1091
|
|
source linux/build/config/source-date-epoch.env || true
|
|
if [[ -z "${SOURCE_DATE_EPOCH:-}" ]]; then
|
|
if [[ -n "${SOURCE_DATE_EPOCH_OVERRIDE:-}" ]]; then
|
|
SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH_OVERRIDE}"
|
|
echo "build.sh: using SOURCE_DATE_EPOCH override = ${SOURCE_DATE_EPOCH}"
|
|
else
|
|
SOURCE_DATE_EPOCH="$(git log -1 --pretty=%ct)"
|
|
fi
|
|
fi
|
|
export SOURCE_DATE_EPOCH
|
|
|
|
# --- Pinned snapshot timestamp ---------------------------------------------
|
|
# shellcheck disable=SC1091
|
|
source linux/build/config/snapshot-pin.env
|
|
export SNAPSHOT_TIMESTAMP
|
|
|
|
# --- Resolve commit & output dir -------------------------------------------
|
|
COMMIT_SHA="$(git rev-parse --short=12 HEAD)"
|
|
BUILD_DIR="${BUILD_DIR:-${REPO_ROOT}/linux/build/output/${COMMIT_SHA}}"
|
|
mkdir -p "${BUILD_DIR}"
|
|
|
|
echo "build.sh: commit=${COMMIT_SHA} epoch=${SOURCE_DATE_EPOCH} snapshot=${SNAPSHOT_TIMESTAMP}"
|
|
echo "build.sh: output -> ${BUILD_DIR}"
|
|
|
|
# --- Mount strategy: local vs CI -------------------------------------------
|
|
# Locally we bind-mount the repo into the build container at the *same*
|
|
# path (self-referential), so internal references work transparently and
|
|
# the inner script doesn't need to care which host it's on.
|
|
#
|
|
# In CI we can't do that. build.sh runs inside a Gitea Actions job
|
|
# container which talks to the *host's* docker daemon via /var/run/docker.sock.
|
|
# Bind-mounting REPO_ROOT (= /workspace/<owner>/<repo>) would resolve
|
|
# against the host filesystem where that path doesn't exist; docker
|
|
# silently creates an empty dir on the host and mounts that, leaving the
|
|
# build container with an empty /work and a confusing "No such file or
|
|
# directory" error on the first config source.
|
|
#
|
|
# The standard fix for that DooD topology is --volumes-from of the parent
|
|
# job container, which inherits its /workspace mount intact. That keeps
|
|
# paths identical inside and outside, so the inner heredoc below is the
|
|
# same in both environments.
|
|
#
|
|
# Discovering the job container's own ID. Three "obvious" approaches
|
|
# all fail for this runner setup:
|
|
# * `hostname` returns the literal string "docker" — catthehacker's
|
|
# /etc/hostname (run #4268).
|
|
# * /proc/self/cgroup returns just "0::/" because act_runner's job
|
|
# containers run with cgroupns enabled, hiding the host cgroup path
|
|
# (run #4269).
|
|
# * /proc/1/cpuset hits the same cgroupns wall.
|
|
#
|
|
# What we *do* have is the docker.sock pass-through. We're definitionally
|
|
# the only running container with /workspace/SilverLABS/SilverMetal as
|
|
# a mount destination (concurrency: 1 in build-iso-linux.yaml), so ask
|
|
# the host daemon to find us by that.
|
|
if [[ -n "${GITHUB_ACTIONS:-}" ]]; then
|
|
SELF_CID=""
|
|
for cid in $(docker ps -q --no-trunc 2>/dev/null); do
|
|
if docker inspect "$cid" --format \
|
|
'{{range .Mounts}}{{if eq .Destination "/workspace/SilverLABS/SilverMetal"}}match{{end}}{{end}}' \
|
|
2>/dev/null | grep -q match; then
|
|
SELF_CID="$cid"
|
|
break
|
|
fi
|
|
done
|
|
if [[ -z "${SELF_CID}" ]]; then
|
|
echo "build.sh: could not find own container via docker inspect on /workspace mount" >&2
|
|
echo "build.sh: docker ps -q output:" >&2
|
|
docker ps --no-trunc >&2 || true
|
|
exit 1
|
|
fi
|
|
echo "build.sh: --volumes-from ${SELF_CID:0:12}"
|
|
BIND_ARGS=(--volumes-from "${SELF_CID}")
|
|
else
|
|
BIND_ARGS=(-v "${REPO_ROOT}:${REPO_ROOT}:rw")
|
|
# If BUILD_DIR lives outside REPO_ROOT (uncommon, but the env-var
|
|
# override allows it), mount it explicitly too.
|
|
if [[ "${BUILD_DIR}" != "${REPO_ROOT}/"* && "${BUILD_DIR}" != "${REPO_ROOT}" ]]; then
|
|
BIND_ARGS+=(-v "${BUILD_DIR}:${BUILD_DIR}:rw")
|
|
fi
|
|
fi
|
|
|
|
# --- Run the build inside the container ------------------------------------
|
|
# This is a systemd-in-container build host. Upstream Kicksecure's
|
|
# derivative-maker assumes a real systemd-managed Debian — its build steps
|
|
# call `systemctl restart approx-derivative-maker.socket`,
|
|
# `systemctl daemon-reload`, etc. and depend on those services *actually*
|
|
# running. Without systemd as PID 1 we'd be playing whack-a-mole with
|
|
# every service derivative-maker starts.
|
|
#
|
|
# Required runtime flags for systemd-in-container:
|
|
# --privileged live-build needs loop devices + chroot mounts
|
|
# --cgroupns=host systemd needs to manage cgroups; with its own
|
|
# namespace it can't see the host hierarchy
|
|
# --tmpfs /run, /run/lock systemd writes runtime state here
|
|
# -v /sys/fs/cgroup:rw the cgroup tree systemd manages
|
|
#
|
|
# `tail -f /dev/null` is NOT used — control flow goes through systemd:
|
|
# entrypoint.sh writes the user command to /etc/docker-entrypoint-cmd,
|
|
# execs systemd, systemd boots docker-entrypoint.service which runs the
|
|
# command, and docker-entrypoint-stop.sh propagates exit code via
|
|
# `systemctl exit <code>` so the container exits with the right status.
|
|
#
|
|
# `-t` (PTY for stdout/stderr) is required for build-log visibility:
|
|
# systemd-as-PID-1 inherits the PTY from the container, and the
|
|
# docker-entrypoint.service propagates it to the build via
|
|
# StandardOutput=inherit. Without -t, the service log goes to the
|
|
# journal only (invisible to docker run / Gitea Actions).
|
|
#
|
|
# Critically, we do NOT add `-i`. Without -i, fd 0 inside the container
|
|
# is /dev/null, not a TTY — and the vendored docker-entrypoint.service
|
|
# explicitly sets `StandardInput=null` so the service inherits no TTY
|
|
# on fd 0 either. That keeps derivative-maker's `[ -t 0 ]` check false
|
|
# so its exception handler stays in non-interactive mode (otherwise any
|
|
# error drops into a `read -p 'Answer? '` prompt and the whole
|
|
# container hangs forever, orphaning docker run and blocking the runner).
|
|
docker run --rm --privileged \
|
|
--cgroupns=host \
|
|
--tmpfs /run \
|
|
--tmpfs /run/lock \
|
|
-v /sys/fs/cgroup:/sys/fs/cgroup:rw \
|
|
--network=host \
|
|
-t \
|
|
"${BIND_ARGS[@]}" \
|
|
-e SOURCE_DATE_EPOCH \
|
|
-e SNAPSHOT_TIMESTAMP \
|
|
-e LC_ALL=C.UTF-8 \
|
|
-e LANG=C.UTF-8 \
|
|
-e TZ=UTC \
|
|
-e REPO_ROOT="${REPO_ROOT}" \
|
|
-e BUILD_DIR="${BUILD_DIR}" \
|
|
"${BUILDER_IMAGE}" \
|
|
bash -c '
|
|
# docker-entrypoint.service runs this as root via systemd, with
|
|
# the env vars captured by entrypoint.sh into
|
|
# /etc/docker-entrypoint-env. We hand workspace ownership to the
|
|
# unprivileged user (uid 1000), then sudo into it for the
|
|
# derivative-maker invocation. derivative-maker uses sudo
|
|
# internally for the bits that need root.
|
|
set -e
|
|
chown -R 1000:1000 "${REPO_ROOT}" "${BUILD_DIR}"
|
|
exec sudo --non-interactive --preserve-env -u user -- \
|
|
"${REPO_ROOT}/linux/build/scripts/build-inner.sh"
|
|
' \
|
|
|| { echo "build.sh: derivative-maker failed"; exit 3; }
|
|
|
|
# --- Hash artefacts ---------------------------------------------------------
|
|
# Run hashing on the host (not in the container) so a busted container image
|
|
# can't tamper with the digests we publish.
|
|
shopt -s nullglob
|
|
ISO_FILES=("${BUILD_DIR}"/*.iso)
|
|
shopt -u nullglob
|
|
if (( ${#ISO_FILES[@]} == 0 )); then
|
|
echo "build.sh: no ISO produced in ${BUILD_DIR}" >&2
|
|
exit 4
|
|
fi
|
|
|
|
(
|
|
cd "${BUILD_DIR}"
|
|
sha256sum -- *.iso > SHA256SUMS
|
|
cp -- "${REPO_ROOT}/linux/build/config/snapshot-pin.env" snapshot-pin.env
|
|
{
|
|
echo "commit=${COMMIT_SHA}"
|
|
echo "source_date_epoch=${SOURCE_DATE_EPOCH}"
|
|
echo "snapshot_timestamp=${SNAPSHOT_TIMESTAMP}"
|
|
echo "builder_image=${BUILDER_IMAGE}"
|
|
echo "host_uname=$(uname -srm)"
|
|
} > BUILD_INFO
|
|
)
|
|
|
|
echo "build.sh: SHA256SUMS:"
|
|
cat "${BUILD_DIR}/SHA256SUMS"
|