|
| 1 | +# SPDX-FileCopyrightText: 2025 reshi <[email protected]> |
| 2 | +# SPDX-License-Identifier: CC0-1.0 |
| 3 | + |
| 4 | +# We need a handwave to make ubuntu happy in order to run bwrap |
| 5 | +# see https://etbe.coker.com.au/2024/04/24/ubuntu-24-04-bubblewrap/ |
| 6 | + |
| 7 | +# But, in some cases, it seems that 'ubuntu-latest' does not always |
| 8 | +# 'resolve' to 20.04, so we do some hand waves to check for |
| 9 | +# os version >= 20.04 (otherwise the build can die when |
| 10 | +# trying to apply bwrap.apparmor) |
| 11 | + |
| 12 | +# Figure out current ubuntu version |
| 13 | +# https://manpages.ubuntu.com/manpages/noble/man5/os-release.5.html |
| 14 | +# |
| 15 | +# The /etc/os-release and /usr/lib/os-release files contain |
| 16 | +# operating system identification data. |
| 17 | +# |
| 18 | +# The format of os-release is a newline-separated list of |
| 19 | +# environment-like shell-compatible variable assignments. |
| 20 | +# |
| 21 | +# The file /etc/os-release takes precedence over /usr/lib/os-release. |
| 22 | +# Applications should check for the former, |
| 23 | +# and exclusively use its data if it exists, |
| 24 | +# and only fall back to /usr/lib/os-release if it is missing. |
| 25 | +# |
| 26 | +# VERSION_ID= |
| 27 | +# A lower-case string |
| 28 | +# (mostly numeric, no spaces or other characters outside of 0-9, |
| 29 | +# a-z, ".", "_" and "-") |
| 30 | +# identifying the operating system version, |
| 31 | +# excluding any OS name information or release code name, |
| 32 | +# and suitable for processing by scripts |
| 33 | +# or usage in generated filenames. |
| 34 | +# This field is optional. |
| 35 | +# |
| 36 | +# Examples: "VERSION_ID=17", "VERSION_ID=11.04". |
| 37 | + |
| 38 | +# Check for /etc/os-release or fall back to /usr/lib/os-release |
| 39 | +if [ -f /etc/os-release ]; then |
| 40 | + OS_RELEASE_FILE="/etc/os-release" |
| 41 | +elif [ -f /usr/lib/os-release ]; then |
| 42 | + OS_RELEASE_FILE="/usr/lib/os-release" |
| 43 | +else |
| 44 | + echo "Error: Neither /etc/os-release nor /usr/lib/os-release found." |
| 45 | + exit 1 |
| 46 | +fi |
| 47 | + |
| 48 | +# Extract 'VERSION_ID=' line. |
| 49 | +VERSION_ID_LINE=$(grep '^VERSION_ID=' "$OS_RELEASE_FILE") |
| 50 | +if [ -z "$VERSION_ID_LINE" ]; then |
| 51 | + echo "Error: VERSION_ID not found in $OS_RELEASE_FILE." |
| 52 | + echo "Contents of $OS_RELEASE_FILE:" |
| 53 | + cat "$OS_RELEASE_FILE" |
| 54 | + exit 1 |
| 55 | +fi |
| 56 | + |
| 57 | +# Extract major/minor version |
| 58 | +if [[ "$VERSION_ID_LINE" =~ ^VERSION_ID=\"([0-9]+)\.([0-9]+)\"$ ]]; then |
| 59 | + # Matches 'VERSION_ID="major.minor"' (e.g., "24.04") |
| 60 | + MAJOR="${BASH_REMATCH[1]}" |
| 61 | + MINOR="${BASH_REMATCH[2]}" |
| 62 | + echo "Ubuntu version: $MAJOR.$MINOR" |
| 63 | +elif [[ "$VERSION_ID_LINE" =~ ^VERSION_ID=\"([0-9]+)\"$ ]]; then |
| 64 | + # Matches 'VERSION_ID="major"' (e.g., "24") |
| 65 | + MAJOR="${BASH_REMATCH[1]}" |
| 66 | + MINOR="0" |
| 67 | + echo "Ubuntu version: $MAJOR.$MINOR (no minor version specified)" |
| 68 | +else |
| 69 | + echo "Error: VERSION_ID is malformed in $OS_RELEASE_FILE." |
| 70 | + echo "VERSION_ID_LINE: \"$VERSION_ID_LINE\"" |
| 71 | + exit 1 |
| 72 | +fi |
| 73 | + |
| 74 | +# Check for version >= 24.04, do workaround if so |
| 75 | +check_version_ge() { |
| 76 | + local major=$1 |
| 77 | + local minor=$2 |
| 78 | + (( MAJOR > major || (MAJOR == major && MINOR >= minor) )) |
| 79 | +} |
| 80 | +if check_version_ge 24 4; then |
| 81 | + echo "Ubuntu version is >= 24.04, deploying bwrap work-around..." |
| 82 | + sudo cp .github/workflows/bwrap.apparmor /etc/apparmor.d/bwrap || { |
| 83 | + echo "Failed to copy AppArmor profile"; |
| 84 | + exit 1; |
| 85 | + } |
| 86 | + echo "Reloading AppArmor service..." |
| 87 | + sudo systemctl reload apparmor || { |
| 88 | + # error msg from 'systemctl reload apparmor' |
| 89 | + # suggests looking at the following... |
| 90 | + echo "Failed to reload AppArmor. Checking status..."; |
| 91 | + systemctl status apparmor.service; |
| 92 | + echo "Checking logs..."; |
| 93 | + journalctl -xeu apparmor.service; |
| 94 | + exit 1; |
| 95 | + } |
| 96 | +else |
| 97 | + echo "Ubuntu version is < 24.04, skipping bwrap work-around..." |
| 98 | +fi |
0 commit comments