|
| 1 | +#!/usr/bin/env bash |
| 2 | +set -euo pipefail |
| 3 | + |
| 4 | +dn=$(dirname "$0") |
| 5 | +# shellcheck source=src/cmdlib.sh |
| 6 | +. "${dn}"/cmdlib.sh |
| 7 | + |
| 8 | +print_help() { |
| 9 | + cat 1>&2 <<'EOF' |
| 10 | +Usage: coreos-assembler build-with-buildah |
| 11 | + coreos-assembler build-with-buildah [OPTIONS]... |
| 12 | +
|
| 13 | + Build bootable container (ostree) and image base artifacts using the container runtime (buildah). |
| 14 | + `cosa build` will pivot to this script when the environment variable `COREOS_ASSEMBLER_BUILD_WITH_BUILDAH` is set. |
| 15 | +
|
| 16 | + The following options are supported: |
| 17 | + --version=VERSION Use the given version instead of using versionary. |
| 18 | + --versionary Generate non-development version using versionary. |
| 19 | + --direct Run buildah directly rather than within supermin. |
| 20 | + --autolock=VERSION If no base lockfile used, create one from any arch build of `VERSION`. |
| 21 | + Note this is automatically enabled when adding to an existing multi-arch |
| 22 | + non-strict build. |
| 23 | + --skip-prune Skip pruning previous builds. |
| 24 | + --strict Only allow installing locked packages when using lockfiles. |
| 25 | + --parent-build=VERSION The version that represents the parent to this build. Used for RPM diffs |
| 26 | + that get added to the meta.json |
| 27 | + --force Import a new build even if inputhash has not changed. |
| 28 | +EOF |
| 29 | +} |
| 30 | + |
| 31 | +FORCE= |
| 32 | +VERSION= |
| 33 | +VERSIONARY= |
| 34 | +DIRECT= |
| 35 | +AUTOLOCK_VERSION= |
| 36 | +SKIP_PRUNE= |
| 37 | +STRICT= |
| 38 | +PARENT_BUILD= |
| 39 | +rc=0 |
| 40 | +options=$(getopt --options h,d --longoptions help,version:,versionary,direct,autolock:,skip-prune,parent-build:,force,strict -- "$@") || rc=$? |
| 41 | +[ $rc -eq 0 ] || { |
| 42 | + print_help |
| 43 | + exit 1 |
| 44 | +} |
| 45 | +eval set -- "$options" |
| 46 | +while true; do |
| 47 | + case "$1" in |
| 48 | + -h | --help) |
| 49 | + print_help |
| 50 | + exit 0 |
| 51 | + ;; |
| 52 | + --version) |
| 53 | + shift |
| 54 | + VERSION=$1 |
| 55 | + ;; |
| 56 | + --versionary) |
| 57 | + VERSIONARY=1 |
| 58 | + ;; |
| 59 | + -d | --direct) |
| 60 | + DIRECT=1 |
| 61 | + ;; |
| 62 | + --autolock) |
| 63 | + shift |
| 64 | + AUTOLOCK_VERSION=$1 |
| 65 | + ;; |
| 66 | + --skip-prune) |
| 67 | + SKIP_PRUNE=1 |
| 68 | + ;; |
| 69 | + --strict) |
| 70 | + STRICT=1 |
| 71 | + ;; |
| 72 | + --parent-build) |
| 73 | + shift |
| 74 | + PARENT_BUILD=$1 |
| 75 | + ;; |
| 76 | + --force) |
| 77 | + FORCE=1 |
| 78 | + ;; |
| 79 | + --) |
| 80 | + shift |
| 81 | + break |
| 82 | + ;; |
| 83 | + -*) |
| 84 | + fatal "$0: unrecognized option: $1" |
| 85 | + ;; |
| 86 | + *) |
| 87 | + break |
| 88 | + ;; |
| 89 | + esac |
| 90 | + shift |
| 91 | +done |
| 92 | + |
| 93 | +if [ -z "${VERSION}" ]; then |
| 94 | + # let error out if file does not exist |
| 95 | + if [ -z "${VERSIONARY}" ]; then |
| 96 | + VERSION=$(src/config/versionary --dev) |
| 97 | + else |
| 98 | + VERSION=$(src/config/versionary) |
| 99 | + fi |
| 100 | +fi |
| 101 | + |
| 102 | +build_with_buildah() { |
| 103 | + echo "Building with container runtime (buildah) with VERSION=${VERSION}..." |
| 104 | + |
| 105 | + tempdir=$(mktemp -d --tmpdir=tmp "build-with-buildah.XXXXXXXX") |
| 106 | + |
| 107 | + # the config dir virtiofs mount is mounted ro; copy it to the tempdir |
| 108 | + cp -r src/config/ "${tempdir}/src" |
| 109 | + # Make sure there are no setgid/setuid bits in there. |
| 110 | + # See e.g. https://github.com/coreos/fedora-coreos-tracker/issues/1003. |
| 111 | + # This is analogous to the chmod we do in cmdlib.sh in the legacy path. |
| 112 | + chmod -R gu-s "${tempdir}/src" |
| 113 | + |
| 114 | + initconfig="src/config.json" |
| 115 | + if [ -f "${initconfig}" ]; then |
| 116 | + variant="$(jq --raw-output '."coreos-assembler.config-variant"' "${initconfig}")" |
| 117 | + manifest="src/config/manifest-${variant}.yaml" |
| 118 | + argsfile=build-args-${variant}.conf |
| 119 | + else |
| 120 | + manifest="src/config/manifest.yaml" |
| 121 | + argsfile=build-args.conf |
| 122 | + fi |
| 123 | + |
| 124 | + if [ -e "builds/$VERSION/${arch}" ]; then |
| 125 | + echo "Build ${VERSION} ($arch) already exists" |
| 126 | + exit 0 |
| 127 | + fi |
| 128 | + |
| 129 | + previous_inputhash= |
| 130 | + if [ -f "builds/latest/${arch}/meta.json" ]; then |
| 131 | + previous_inputhash=$(jq -r '.["coreos-assembler.oci-imported-labels"]["com.coreos.inputhash"] // ""' \ |
| 132 | + "builds/latest/${arch}/meta.json") |
| 133 | + if [ -n "${previous_inputhash}" ]; then |
| 134 | + echo "Previous input hash: ${previous_inputhash}" |
| 135 | + fi |
| 136 | + fi |
| 137 | + |
| 138 | + # Apply autolock from another build for this version (or for another version if |
| 139 | + # explicitly provided via --autolock) if no base lockfile exists. |
| 140 | + lockfile="manifest-lock.${arch}.json" |
| 141 | + if [ ! -f "src/config/${lockfile}" ] && { [ -n "${VERSION}" ] || [ -n "${AUTOLOCK_VERSION}" ]; }; then |
| 142 | + autolockfile=$(tmprepo=tmp/repo; workdir=.; |
| 143 | + ostree init --repo="${tmprepo}" --mode=archive; |
| 144 | + generate_autolock "${AUTOLOCK_VERSION:-${VERSION}}") |
| 145 | + if [ -n "${autolockfile}" ]; then |
| 146 | + echo "Injecting autolock-generated ${lockfile}..." |
| 147 | + cp "${autolockfile}" "${tempdir}/src/${lockfile}" |
| 148 | + fi |
| 149 | + fi |
| 150 | + |
| 151 | + # Here we call prepare_git_artifacts just for its git logic, We don't |
| 152 | + # actually care about the JSON file; the source of truth is in the labels. |
| 153 | + prepare_git_artifacts src/config "${tempdir}/coreos-assembler-config-git.json" |
| 154 | + source=$(jq -r .git.origin "${tempdir}/coreos-assembler-config-git.json") |
| 155 | + commit=$(jq -r .git.commit "${tempdir}/coreos-assembler-config-git.json") |
| 156 | + rm -f "${tempdir}/coreos-assembler-config-git.json" |
| 157 | + |
| 158 | + # For the source: check if there's only one remote, if so use it with get-url |
| 159 | + # For revision: rev-parse |
| 160 | + set -- build --security-opt=label=disable --cap-add=all --device /dev/fuse \ |
| 161 | + --pull=newer --layers=true \ |
| 162 | + --build-arg-file "$argsfile" -v "$(realpath "${tempdir}/src")":/run/src \ |
| 163 | + --build-arg VERSION="${VERSION}" \ |
| 164 | + --label org.opencontainers.image.source="${source}" \ |
| 165 | + --label org.opencontainers.image.revision="${commit}" |
| 166 | + |
| 167 | + # XXX: Temporary hack until we have https://github.com/coreos/rpm-ostree/pull/5454 |
| 168 | + # which would allow us to fold this back into the build process. |
| 169 | + # shellcheck source=/dev/null |
| 170 | + stream=$(yaml2json "$manifest" /dev/stdout | jq -r '.variables.stream') |
| 171 | + if [ "${stream}" != null ]; then |
| 172 | + set -- "$@" --label fedora-coreos.stream="$stream" \ |
| 173 | + --annotation fedora-coreos.stream="$stream" |
| 174 | + fi |
| 175 | + |
| 176 | + if [ -d "src/yumrepos" ] && [ -e "src/yumrepos/${variant:-}.repo" ]; then |
| 177 | + set -- "$@" --secret id=yumrepos,src="$(realpath "src/yumrepos/$variant.repo")" \ |
| 178 | + --secret id=contentsets,src="$(realpath src/yumrepos/content_sets.yaml)" \ |
| 179 | + -v /etc/pki/ca-trust:/etc/pki/ca-trust:ro |
| 180 | + fi |
| 181 | + |
| 182 | + if [ -n "${STRICT}" ]; then |
| 183 | + set -- "$@" --build-arg STRICT_MODE=1 |
| 184 | + fi |
| 185 | + |
| 186 | + if [ -d overrides ]; then |
| 187 | + if [ -d overrides/rpm ]; then |
| 188 | + # Clean up any previous repo metadata |
| 189 | + rm -rf overrides/rpm/repodata |
| 190 | + if [[ -n $(ls overrides/rpm/*.rpm 2> /dev/null) ]]; then |
| 191 | + # Generate new repo metadata since there are RPMs |
| 192 | + (cd overrides/rpm && createrepo_c .) |
| 193 | + fi |
| 194 | + fi |
| 195 | + set -- "$@" -v "$(realpath overrides)":/src/overrides |
| 196 | + fi |
| 197 | + |
| 198 | + # We'll also copy to an intermediate ociarchive file before |
| 199 | + # passing that ociarchive to cosa import |
| 200 | + tmp_oci_archive="oci-archive:$(realpath "${tempdir}/out.ociarchive")" |
| 201 | + |
| 202 | + # Set the output tag to be something unique |
| 203 | + osname=$(eval "$(grep 'NAME=' "src/config/${argsfile}")"; echo "${NAME}") |
| 204 | + final_ref="containers-storage:localhost/${osname}:${VERSION}" |
| 205 | + # and add the unique tag and context dir to the command |
| 206 | + set -- "$@" --tag "${final_ref}" . |
| 207 | + |
| 208 | + echo "Running:" buildah "$@" |
| 209 | + if [ -n "$DIRECT" ]; then |
| 210 | + cmd="bash" |
| 211 | + else |
| 212 | + cmd="/usr/lib/coreos-assembler/cmd-supermin-run --cache" |
| 213 | + fi |
| 214 | + cat <<EOF > "${tempdir}/build-with-buildah-script.sh" |
| 215 | + set -euxo pipefail |
| 216 | + env -C ${tempdir}/src TMPDIR=$(realpath cache) buildah $@ |
| 217 | + skopeo copy --quiet "${final_ref}" "${tmp_oci_archive}" |
| 218 | +EOF |
| 219 | + chmod +x "${tempdir}/build-with-buildah-script.sh" |
| 220 | + $cmd "${tempdir}/build-with-buildah-script.sh" |
| 221 | + |
| 222 | + new_inputhash=$(skopeo inspect "${tmp_oci_archive}" | jq -r '.Labels."com.coreos.inputhash"') |
| 223 | + if [ -n "${previous_inputhash}" ] && [ "$previous_inputhash" = "$new_inputhash" ]; then |
| 224 | + echo "Input hash unchanged ($new_inputhash)" |
| 225 | + if [ -z "$FORCE" ]; then |
| 226 | + skip_import=1 |
| 227 | + else |
| 228 | + echo "Importing new build anyway (--force)" |
| 229 | + fi |
| 230 | + fi |
| 231 | + |
| 232 | + # Finally import the ociarchive, if we should |
| 233 | + if [ -z "${skip_import:-}" ]; then |
| 234 | +<<<<<<< HEAD |
| 235 | + /usr/lib/coreos-assembler/cmd-import "${final_ref}" \ |
| 236 | + ${PARENT_BUILD:+--parent-build=${PARENT_BUILD}} ${SKIP_PRUNE:+--skip-prune} |
| 237 | +======= |
| 238 | + /usr/lib/coreos-assembler/cmd-import \ |
| 239 | + "${tmp_oci_archive}" ${SKIP_PRUNE:+--skip-prune} |
| 240 | +>>>>>>> 4855c1bd8 (cmd-build-with-buildah: unify more the direct and non-direct paths) |
| 241 | + fi |
| 242 | + |
| 243 | + rm -rf "${tempdir}" |
| 244 | +} |
| 245 | + |
| 246 | +build_with_buildah |
0 commit comments