Skip to content

Commit dfffe82

Browse files
committed
sysext: Move OEM sysext build to image phase
Move OEM sysext building from the vms phase to the image phase. This ensures OEM sysexts are signed with the same ephemeral key as other sysexts, which is generated during image build and discarded afterward. - Add create_oem_sysexts() to build all OEM sysexts during image build - Add oem_sysexts.sh with OEM sysext definitions - Update install_oem_sysext() to use prebuilt sysexts - Add OEM sysext download to vms.sh for CI builds Signed-off-by: Daniel Zatovic <[email protected]>
1 parent 8cd4f6a commit dfffe82

File tree

8 files changed

+194
-92
lines changed

8 files changed

+194
-92
lines changed

build_image

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,10 +60,12 @@ different forms. This scripts can be used to build the following:
6060
prod - Production image for CoreOS. This image is for booting (default if no argument is given).
6161
prodtar - Production container tar ball (implies prod). This can e.g. be used to run the Flatcar production image as a container (run machinectl import-tar or docker import).
6262
container - Developer image with single filesystem, bootable by nspawn.
63+
sysext - Build extra sysexts (podman, python, zfs, etc.).
64+
oem_sysext - Build OEM sysexts for all supported platforms.
6365
6466
Examples:
6567
66-
build_image --board=<board> [prod] [prodtar] [container] - builds developer and production images/tars.
68+
build_image --board=<board> [prod] [prodtar] [container] [sysext] [oem_sysext] - builds developer and production images/tars.
6769
...
6870
"
6971
show_help_if_requested "$@"
@@ -81,7 +83,7 @@ DEFINE_string version "" \
8183
# Parse command line.
8284
FLAGS "$@" || exit 1
8385

84-
eval set -- "${FLAGS_ARGV:-prod}"
86+
eval set -- "${FLAGS_ARGV:-prod oem_sysext}"
8587

8688
# Only now can we die on error. shflags functions leak non-zero error codes,
8789
# so will die prematurely if 'switch_to_strict_mode' is specified before now.
@@ -103,17 +105,20 @@ fi
103105
. "${BUILD_LIBRARY_DIR}/test_image_content.sh" || exit 1
104106
. "${BUILD_LIBRARY_DIR}/vm_image_util.sh" || exit 1
105107
. "${BUILD_LIBRARY_DIR}/extra_sysexts.sh" || exit 1
108+
. "${BUILD_LIBRARY_DIR}/oem_sysexts.sh" || exit 1
106109

107110
PROD_IMAGE=0
108111
PROD_TAR=0
109112
CONTAINER=0
110113
SYSEXT=0
114+
OEM_SYSEXT=0
111115
for arg in "$@"; do
112116
case "${arg}" in
113117
prod) PROD_IMAGE=1 ;;
114118
prodtar) PROD_IMAGE=1 PROD_TAR=1 ;;
115119
container) CONTAINER=1 ;;
116120
sysext) SYSEXT=1 ;;
121+
oem_sysext) OEM_SYSEXT=1 ;;
117122
*) die_notrace "Unknown image type ${arg}" ;;
118123
esac
119124
done
@@ -187,6 +192,9 @@ fi
187192
if [[ "${SYSEXT}" -eq 1 ]]; then
188193
create_prod_sysexts "${FLATCAR_PRODUCTION_IMAGE_NAME}"
189194
fi
195+
if [[ "${OEM_SYSEXT}" -eq 1 ]]; then
196+
create_oem_sysexts "${FLATCAR_PRODUCTION_IMAGE_NAME}"
197+
fi
190198

191199
if [[ ${FLAGS_extract_update} -eq ${FLAGS_TRUE} ]]; then
192200
zip_update_tools

build_library/oem_sysexts.sh

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# OEM sysexts table mapping OEM IDs to their packages and USE flags.
2+
# Format: "name|metapackage|useflag|arches"
3+
#
4+
# VM types that use each OEM sysext:
5+
# oem-akamai -> akamai
6+
# oem-ami -> ami, ami_vmdk
7+
# oem-azure -> azure
8+
# oem-digitalocean -> digitalocean
9+
# oem-gce -> gce
10+
# oem-hetzner -> hetzner
11+
# oem-hyperv -> hyperv, hyperv_vhdx
12+
# oem-kubevirt -> kubevirt
13+
# oem-nutanix -> nutanix
14+
# oem-openstack -> openstack, openstack_mini
15+
# oem-packet -> packet
16+
# oem-proxmoxve -> proxmoxve
17+
# oem-qemu -> qemu_uefi
18+
# oem-scaleway -> scaleway
19+
# oem-stackit -> stackit
20+
# oem-vmware -> vmware, vmware_ova, vmware_raw
21+
22+
OEM_SYSEXTS=(
23+
"oem-akamai|coreos-base/oem-akamai|akamai|amd64,arm64"
24+
"oem-ami|coreos-base/oem-ami|ami|amd64,arm64"
25+
"oem-azure|coreos-base/oem-azure|azure|amd64,arm64"
26+
"oem-digitalocean|coreos-base/oem-digitalocean|digitalocean|amd64"
27+
"oem-gce|coreos-base/oem-gce|gce|amd64"
28+
"oem-hetzner|coreos-base/oem-hetzner|hetzner|amd64,arm64"
29+
"oem-hyperv|coreos-base/oem-hyperv|hyperv|amd64"
30+
"oem-kubevirt|coreos-base/oem-kubevirt|kubevirt|amd64,arm64"
31+
"oem-nutanix|coreos-base/oem-nutanix|nutanix|amd64"
32+
"oem-openstack|coreos-base/oem-openstack|openstack|amd64,arm64"
33+
"oem-packet|coreos-base/oem-packet|packet|amd64,arm64"
34+
"oem-proxmoxve|coreos-base/oem-proxmoxve|proxmoxve|amd64,arm64"
35+
"oem-qemu|coreos-base/oem-qemu|qemu|amd64,arm64"
36+
"oem-scaleway|coreos-base/oem-scaleway|scaleway|amd64,arm64"
37+
"oem-stackit|coreos-base/oem-stackit|stackit|amd64,arm64"
38+
"oem-vmware|coreos-base/oem-vmware|vmware|amd64"
39+
)

build_library/prod_image_util.sh

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,6 +273,67 @@ create_prod_sysexts() {
273273
done
274274
}
275275

276+
create_oem_sysexts() {
277+
local image_name="$1"
278+
local image_sysext_base="${image_name%.bin}_sysext.squashfs"
279+
local overlay_path
280+
overlay_path=$(portageq get_repo_path / coreos-overlay)
281+
282+
for sysext in "${OEM_SYSEXTS[@]}"; do
283+
local name metapkg useflags arches
284+
IFS="|" read -r name metapkg useflags arches <<< "$sysext"
285+
286+
if [[ "${name}" != oem-* ]]; then
287+
die "OEM sysext name must start with 'oem-', got '${name}'"
288+
fi
289+
290+
local arch_array=(${arches//,/ })
291+
292+
if [[ -n "$arches" ]]; then
293+
local should_skip=1
294+
for arch in "${arch_array[@]}"; do
295+
if [[ $arch == "$ARCH" ]]; then
296+
should_skip=0
297+
fi
298+
done
299+
if [[ $should_skip -eq 1 ]]; then
300+
continue
301+
fi
302+
fi
303+
304+
# Check for manglefs script in the package's files directory
305+
local mangle_script="${overlay_path}/${metapkg}/files/manglefs.sh"
306+
if [[ ! -x "${mangle_script}" ]]; then
307+
mangle_script=
308+
fi
309+
310+
sudo rm -f "${BUILD_DIR}/${name}.raw" \
311+
"${BUILD_DIR}/flatcar_test_update-${name}.gz" \
312+
"${BUILD_DIR}/${name}_"*
313+
314+
info "Building OEM sysext ${name} with USE=${useflags}"
315+
# The --install_root_basename="${name}-oem-sysext-rootfs" flag is
316+
# important - it sets the name of a rootfs directory, which is
317+
# used to determine the package target in
318+
# coreos/base/profile.bashrc
319+
#
320+
# OEM sysexts use no compression here since they will be stored
321+
# in a compressed OEM partition.
322+
USE="${useflags}" sudo -E "${SCRIPT_ROOT}/build_sysext" --board="${BOARD}" \
323+
--squashfs_base="${BUILD_DIR}/${image_sysext_base}" \
324+
--image_builddir="${BUILD_DIR}" \
325+
--metapkgs="${metapkg}" \
326+
--install_root_basename="${name}-oem-sysext-rootfs" \
327+
--compression=none \
328+
${mangle_script:+--manglefs_script="${mangle_script}"} \
329+
"${name}"
330+
delta_generator \
331+
-private_key "/usr/share/update_engine/update-payload-key.key.pem" \
332+
-new_image "${BUILD_DIR}/${name}.raw" \
333+
-out_file "${BUILD_DIR}/flatcar_test_update-${name}.gz"
334+
done
335+
}
336+
276337
sbsign_prod_image() {
277338
local image_name="$1"
278339
local disk_layout="$2"

build_library/vm_image_util.sh

Lines changed: 10 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -568,71 +568,33 @@ install_oem_package() {
568568
sudo rm -rf "${oem_tmp}"
569569
}
570570

571-
# Write the OEM sysext file into the OEM partition.
571+
# Install the prebuilt OEM sysext file into the OEM partition.
572+
# The sysext should have been built by 'build_image oem_sysext'.
572573
install_oem_sysext() {
573574
local oem_sysext=$(_get_vm_opt OEM_SYSEXT)
574575

575576
if [[ -z "${oem_sysext}" ]]; then
576577
return 0
577578
fi
578579

579-
local built_sysext_dir="${FLAGS_to}/${oem_sysext}-sysext"
580-
local built_sysext_filename="${oem_sysext}.raw"
581-
local built_sysext_path="${built_sysext_dir}/${built_sysext_filename}"
580+
local prebuilt_sysext_filename="${oem_sysext}.raw"
581+
local prebuilt_sysext_path="${FLAGS_from}/${prebuilt_sysext_filename}"
582582
local version="${FLATCAR_VERSION}"
583-
local metapkg="coreos-base/${oem_sysext}"
584-
# The --install_root_basename="${name}-oem-sysext-rootfs" flag is
585-
# important - it sets the name of a rootfs directory, which is
586-
# used to determine the package target in
587-
# coreos/base/profile.bashrc
588-
#
589-
# OEM sysexts are stored in the compressed partition, so we disable
590-
# compression to avoid double-compression.
591-
local build_sysext_flags=(
592-
--board="${BOARD}"
593-
--squashfs_base="${VM_SRC_SYSEXT_IMG}"
594-
--image_builddir="${built_sysext_dir}"
595-
--metapkgs="${metapkg}"
596-
--compression=none
597-
--install_root_basename="${VM_IMG_TYPE}-oem-sysext-rootfs"
598-
)
599-
local overlay_path mangle_fs
600-
overlay_path=$(portageq get_repo_path / coreos-overlay)
601-
mangle_fs="${overlay_path}/${metapkg}/files/manglefs.sh"
602-
if [[ -x "${mangle_fs}" ]]; then
603-
build_sysext_flags+=(
604-
--manglefs_script="${mangle_fs}"
605-
)
606-
fi
607583

608-
mkdir -p "${built_sysext_dir}"
609-
sudo -E "${build_sysext_env[@]}" "${SCRIPT_ROOT}/build_sysext" "${build_sysext_flags[@]}" "${oem_sysext}"
584+
if [[ ! -f "${prebuilt_sysext_path}" ]]; then
585+
die "Prebuilt OEM sysext not found at ${prebuilt_sysext_path}. Run 'build_image oem_sysext' first."
586+
fi
610587

611588
local installed_sysext_oem_dir='/oem/sysext'
612589
local installed_sysext_file_prefix="${oem_sysext}-${version}"
613590
local installed_sysext_filename="${installed_sysext_file_prefix}.raw"
614591
local installed_sysext_abspath="${installed_sysext_oem_dir}/${installed_sysext_filename}"
615-
info "Installing ${oem_sysext} sysext"
592+
593+
info "Installing ${oem_sysext} sysext from prebuilt image"
616594
sudo install -Dpm 0644 \
617-
"${built_sysext_path}" \
595+
"${prebuilt_sysext_path}" \
618596
"${VM_TMP_ROOT}${installed_sysext_abspath}" ||
619597
die "Could not install ${oem_sysext} sysext"
620-
# Move sysext image and reports to a destination directory to
621-
# upload them, thus making them available as separate artifacts to
622-
# download.
623-
local upload_dir to_move
624-
upload_dir="$(_dst_dir)"
625-
for to_move in "${built_sysext_dir}/${oem_sysext}"*; do
626-
mv "${to_move}" "${upload_dir}/${to_move##*/}"
627-
done
628-
# Generate dev-key-signed update payload for testing
629-
delta_generator \
630-
-private_key "/usr/share/update_engine/update-payload-key.key.pem" \
631-
-new_image "${upload_dir}/${built_sysext_filename}" \
632-
-out_file "${upload_dir}/flatcar_test_update-${oem_sysext}.gz"
633-
# Remove sysext_dir if building sysext and installing it
634-
# succeeded.
635-
rm -rf "${built_sysext_dir}"
636598

637599
# Mark the installed sysext as active.
638600
sudo touch "${VM_TMP_ROOT}${installed_sysext_oem_dir}/active-${oem_sysext}"

build_packages

Lines changed: 53 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,7 @@ fi
118118
. "${BUILD_LIBRARY_DIR}/board_options.sh" || exit 1
119119
. "${BUILD_LIBRARY_DIR}/test_image_content.sh" || exit 1
120120
. "${BUILD_LIBRARY_DIR}/extra_sysexts.sh" || exit 1
121+
. "${BUILD_LIBRARY_DIR}/oem_sysexts.sh" || exit 1
121122

122123
# Setup all the emerge command/flags.
123124
EMERGE_FLAGS=( --update --deep --newuse --verbose --backtrack=30 --select )
@@ -288,50 +289,62 @@ fi
288289
export KBUILD_BUILD_USER="${BUILD_USER:-build}"
289290
export KBUILD_BUILD_HOST="${BUILD_HOST:-pony-truck.infra.kinvolk.io}"
290291

291-
info "Merging board packages now"
292-
sudo -E "${EMERGE_CMD[@]}" "${EMERGE_FLAGS[@]}" "$@"
293-
294-
info "Merging sysext packages now"
295-
for sysext in "${EXTRA_SYSEXTS[@]}"; do
296-
IFS="|" read -r SYSEXT_NAME PACKAGE_ATOMS USEFLAGS ARCHES <<< "$sysext"
297-
298-
arch_array=("${ARCHES//,/ }")
299-
if [[ -n $ARCHES ]]; then
300-
should_skip=1
301-
for arch in "${arch_array[@]}"; do
302-
if [[ $arch == "$ARCH" ]]; then
303-
should_skip=0
292+
# Build sysext packages from an array of sysext definitions.
293+
# Usage: build_sysext_packages "description" "${SYSEXT_ARRAY[@]}"
294+
# Array format: "name|packages|useflags|arches"
295+
build_sysext_packages() {
296+
local description="$1"
297+
shift
298+
local sysexts=("$@")
299+
300+
info "Merging ${description} packages now"
301+
for sysext in "${sysexts[@]}"; do
302+
local sysext_name package_atoms useflags arches
303+
IFS="|" read -r sysext_name package_atoms useflags arches <<< "$sysext"
304+
305+
local arch_array=(${arches//,/ })
306+
if [[ -n $arches ]]; then
307+
local should_skip=1
308+
for arch in "${arch_array[@]}"; do
309+
if [[ $arch == "$ARCH" ]]; then
310+
should_skip=0
311+
fi
312+
done
313+
if [[ $should_skip -eq 1 ]]; then
314+
continue
304315
fi
305-
done
306-
if [[ $should_skip -eq 1 ]]; then
307-
continue
308316
fi
309-
fi
310-
311317

312-
info "Building packages for $SYSEXT_NAME sysext with USE=$USEFLAGS"
313-
IFS=,
314-
for package in $PACKAGE_ATOMS; do
315-
# --buildpkgonly does not install dependencies, so we install them
316-
# separately before building the binary package
317-
sudo --preserve-env=MODULES_SIGN_KEY,MODULES_SIGN_CERT \
318-
env USE="$USEFLAGS" FEATURES="-ebuild-locks binpkg-multi-instance" "${EMERGE_CMD[@]}" \
319-
"${EMERGE_FLAGS[@]}" \
320-
--quiet \
321-
--onlydeps \
322-
--binpkg-respect-use=y \
323-
"${package}"
324-
325-
sudo --preserve-env=MODULES_SIGN_KEY,MODULES_SIGN_CERT \
326-
env USE="$USEFLAGS" FEATURES="-ebuild-locks binpkg-multi-instance" "${EMERGE_CMD[@]}" \
327-
"${EMERGE_FLAGS[@]}" \
328-
--quiet \
329-
--buildpkgonly \
330-
--binpkg-respect-use=y \
331-
"${package}"
318+
info "Building packages for $sysext_name sysext with USE=$useflags"
319+
IFS=,
320+
for package in $package_atoms; do
321+
# --buildpkgonly does not install dependencies, so we install them
322+
# separately before building the binary package
323+
sudo --preserve-env=MODULES_SIGN_KEY,MODULES_SIGN_CERT \
324+
env USE="$useflags" FEATURES="-ebuild-locks binpkg-multi-instance" "${EMERGE_CMD[@]}" \
325+
"${EMERGE_FLAGS[@]}" \
326+
--quiet \
327+
--onlydeps \
328+
--binpkg-respect-use=y \
329+
"${package}"
330+
331+
sudo --preserve-env=MODULES_SIGN_KEY,MODULES_SIGN_CERT \
332+
env USE="$useflags" FEATURES="-ebuild-locks binpkg-multi-instance" "${EMERGE_CMD[@]}" \
333+
"${EMERGE_FLAGS[@]}" \
334+
--quiet \
335+
--buildpkgonly \
336+
--binpkg-respect-use=y \
337+
"${package}"
338+
done
339+
unset IFS
332340
done
333-
unset IFS
334-
done
341+
}
342+
343+
info "Merging board packages now"
344+
sudo -E "${EMERGE_CMD[@]}" "${EMERGE_FLAGS[@]}" "$@"
345+
346+
build_sysext_packages "extra sysexts" "${EXTRA_SYSEXTS[@]}"
347+
build_sysext_packages "OEM sysexts" "${OEM_SYSEXTS[@]}"
335348

336349
info "Removing obsolete packages"
337350
# The return value of emerge is not clearly reliable. It may fail with

build_sysext

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -216,7 +216,7 @@ if [[ ${#} -lt 1 ]]; then
216216
show_help_if_requested -h
217217
fi
218218

219-
info "Building '${SYSEXTNAME}' squashfs with (meta-)packages '${@}' in '${BUILD_DIR}' using '${FLAGS_compression}' compression".
219+
info "Building '${SYSEXTNAME}' sysext with (meta-)packages '${@}' in '${BUILD_DIR}' using '${FLAGS_compression}' compression".
220220

221221
for package; do
222222
echo "Installing package into sysext image: $package"

ci-automation/image.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ function _image_build_impl() {
103103
--base_sysexts="${base_sysexts_param}" \
104104
--output_root="${CONTAINER_IMAGE_ROOT}" \
105105
--only_store_compressed \
106-
prodtar container sysext
106+
prodtar container sysext oem_sysext
107107

108108
# copy resulting images + push to buildcache
109109
local images_out="images/"

ci-automation/vms.sh

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,25 @@ function _vm_build_impl() {
116116
for file in flatcar_production_image.bin.bz2 flatcar_production_image_sysext.squashfs flatcar_production_image.vmlinuz version.txt; do
117117
copy_from_buildcache "images/${arch}/${vernum}/${file}" "${images_in}"
118118
done
119+
120+
# Download prebuilt OEM sysexts
121+
source build_library/oem_sysexts.sh
122+
local sysext name arches arch_array
123+
for sysext in "${OEM_SYSEXTS[@]}"; do
124+
IFS="|" read -r name _ _ arches <<< "$sysext"
125+
# Skip if sysext doesn't support this architecture
126+
if [[ -n "$arches" ]]; then
127+
arch_array=(${arches//,/ })
128+
local should_skip=1
129+
local a
130+
for a in "${arch_array[@]}"; do
131+
[[ "$a" == "$arch" ]] && should_skip=0
132+
done
133+
[[ $should_skip -eq 1 ]] && continue
134+
fi
135+
copy_from_buildcache "images/${arch}/${vernum}/${name}.raw" "${images_in}"
136+
done
137+
119138
lbunzip2 "${images_in}/flatcar_production_image.bin.bz2"
120139
./run_sdk_container -x ./ci-cleanup.sh -n "${vms_container}" -C "${packages_image}" \
121140
-v "${vernum}" \

0 commit comments

Comments
 (0)