| index : archiso32 | |
| Archlinux32 iso tools | gitolite user |
| summaryrefslogtreecommitdiff |
| -rwxr-xr-x | .gitlab/ci/build-host.sh | 2 | ||||
| -rwxr-xr-x | .gitlab/ci/build-inside-vm.sh | 226 |
diff --git a/.gitlab/ci/build-host.sh b/.gitlab/ci/build-host.sh index 7a15010..3377ba7 100755 --- a/.gitlab/ci/build-host.sh +++ b/.gitlab/ci/build-host.sh @@ -146,7 +146,7 @@ function main() { expect "# " 120 ## Start build and copy output to local disk - send "bash -x ./.gitlab/ci/build-inside-vm.sh ${PROFILE}\n " + send "bash -x ./.gitlab/ci/build-inside-vm.sh ${PROFILE} ${BUILDMODE}\n " expect "# " 2400 # mksquashfs can take a very long time send "cp -r --preserve=mode,timestamps -- output /mnt/project/tmp/$(basename "${tmpdir}")/\n" expect "# " 60 diff --git a/.gitlab/ci/build-inside-vm.sh b/.gitlab/ci/build-inside-vm.sh index a6ce79e..ac4bf0b 100755 --- a/.gitlab/ci/build-inside-vm.sh +++ b/.gitlab/ci/build-inside-vm.sh @@ -1,66 +1,156 @@ #!/usr/bin/env bash # -# This script is run within a virtual environment to build the available archiso profiles and create checksum files for -# the resulting images. +# This script is run within a virtual environment to build the available archiso profiles and their available build +# modes and create checksum files for the resulting images. # The script needs to be run as root and assumes $PWD to be the root of the repository. +# +# Dependencies: +# * all archiso dependencies +# * zsync +# +# $1: profile +# $2: buildmode + +set -euo pipefail +shopt -s extglob readonly orig_pwd="${PWD}" readonly output="${orig_pwd}/output" +readonly profile="${1}" +readonly buildmode="${2}" +readonly install_dir="arch" + tmpdir="" tmpdir="$(mktemp --dry-run --directory --tmpdir="${orig_pwd}/tmp")" gnupg_homedir="" +codesigning_dir="" +codesigning_cert="" +codesigning_key="" pgp_key_id="" cleanup() { # clean up temporary directories + + # gitlab collapsable sections start + printf "\e[0Ksection_start:%(%s)T:cleanup\r\e[0KCleaning up temporary directory" + if [ -n "${tmpdir:-}" ]; then rm -rf "${tmpdir}" fi + + # gitlab collapsable sections end + printf "\e[0Ksection_end:%(%s)T:cleanup\r\e[0K" } create_checksums() { - # create checksums for a file - # $1: a file - sha256sum "${1}" >"${1}.sha256" - sha512sum "${1}" >"${1}.sha512" - b2sum "${1}" >"${1}.b2" - if [[ -n "${SUDO_UID:-}" ]] && [[ -n "${SUDO_GID:-}" ]]; then - chown "${SUDO_UID}:${SUDO_GID}" "${1}"{,.b2,.sha{256,512}} - fi + # create checksums for files + # $@: files + local _file + + # gitlab collapsable sections start + printf "\e[0Ksection_start:%(%s)T:checksums\r\e[0KCreating checksums" + + for _file in "$@"; do + md5sum "${_file}" >"${_file}.md5" + sha1sum "${_file}" >"${_file}.sha1" + sha256sum "${_file}" >"${_file}.sha256" + sha512sum "${_file}" >"${_file}.sha512" + b2sum "${_file}" >"${_file}.b2" + + if [[ -n "${SUDO_UID:-}" ]] && [[ -n "${SUDO_GID:-}" ]]; then + chown "${SUDO_UID}:${SUDO_GID}" -- "${_file}"{,.b2,.sha{256,512}} + fi + done + + # gitlab collapsable sections end + printf "\e[0Ksection_end:%(%s)T:checksums\r\e[0K" } create_zsync_delta() { - # create a zsync control file for a file - # $1: a file - zsyncmake -C -u "${1##*/}" -o "${1}".zsync "${1}" - if [[ -n "${SUDO_UID:-}" ]] && [[ -n "${SUDO_GID:-}" ]]; then - chown "${SUDO_UID}:${SUDO_GID}" "${1}".zsync - fi + # create zsync control files for files + # $@: files + local _file + + # gitlab collapsable sections start + printf "\e[0Ksection_start:%(%s)T:zsync_delta\r\e[0KCreating zsync delta" + for _file in "$@"; do + if [[ "${buildmode}" == "bootstrap" ]]; then + # zsyncmake fails on 'too long between blocks' with default block size on bootstrap image + zsyncmake -b 512 -C -u "${_file##*/}" -o "${_file}".zsync "${_file}" + else + zsyncmake -C -u "${_file##*/}" -o "${_file}".zsync "${_file}" + fi + if [[ -n "${SUDO_UID:-}" ]] && [[ -n "${SUDO_GID:-}" ]]; then + chown "${SUDO_UID}:${SUDO_GID}" -- "${_file}"{,.zsync} + fi + done + + # gitlab collapsable sections end + printf "\e[0Ksection_end:%(%s)T:zsync_delta\r\e[0K" } create_metrics() { # create metrics + + # gitlab collapsable sections start + printf "\e[0Ksection_start:%(%s)T:metrics\r\e[0KCreating metrics" + { - printf 'image_size_mebibytes{image="%s"} %s\n' "${1}" "$(du -m "${output}/${1}/"*.iso | cut -f1)" - printf 'package_count{image="%s"} %s\n' "${1}" "$(sort -u "${tmpdir}/${1}/iso/"*/pkglist.*.txt | wc -l)" - if [[ -e "${tmpdir}/${1}/efiboot.img" ]]; then - printf 'eltorito_efi_image_size_mebibytes{image="%s"} %s\n' \ - "${1}" "$(du -m "${tmpdir}/${1}/efiboot.img" | cut -f1)" - fi - # shellcheck disable=SC2046 - # shellcheck disable=SC2183 - printf 'initramfs_size_mebibytes{image="%s",initramfs="%s"} %s\n' \ - $(du -m "${tmpdir}/${1}/iso/"*/boot/**/initramfs*.img | awk -v profile="${1}" ' - function basename(file) { - sub(".*/", "", file) - return file - } - { print profile, basename($2), $1 }') - } > "${output}/${1}/job-metrics" + # create metrics based on buildmode + case "${buildmode}" in + iso) + printf 'image_size_mebibytes{image="%s"} %s\n' \ + "${profile}" \ + "$(du -m -- "${output}/${profile}/"*.iso | cut -f1)" + printf 'package_count{image="%s"} %s\n' \ + "${profile}" \ + "$(sort -u -- "${tmpdir}/${profile}/iso/"*/pkglist.*.txt | wc -l)" + if [[ -e "${tmpdir}/${profile}/efiboot.img" ]]; then + printf 'eltorito_efi_image_size_mebibytes{image="%s"} %s\n' \ + "${profile}" \ + "$(du -m -- "${tmpdir}/${profile}/efiboot.img" | cut -f1)" + fi + # shellcheck disable=SC2046 + # shellcheck disable=SC2183 + printf 'initramfs_size_mebibytes{image="%s",initramfs="%s"} %s\n' \ + $(du -m -- "${tmpdir}/${profile}/iso/"*/boot/**/initramfs*.img | \ + awk -v profile="${profile}" \ + 'function basename(file) { + sub(".*/", "", file) + return file + } + { print profile, basename($2), $1 }' + ) + ;; + netboot) + printf 'netboot_size_mebibytes{image="%s"} %s\n' \ + "${profile}" \ + "$(du -m -- "${output}/${profile}/${install_dir}/" | tail -n1 | cut -f1)" + printf 'netboot_package_count{image="%s"} %s\n' \ + "${profile}" \ + "$(sort -u -- "${tmpdir}/${profile}/iso/"*/pkglist.*.txt | wc -l)" + ;; + bootstrap) + printf 'bootstrap_size_mebibytes{image="%s"} %s\n' \ + "${profile}" \ + "$(du -m -- "${output}/${profile}/"*.tar*(.gz|.xz|.zst) | cut -f1)" + printf 'bootstrap_package_count{image="%s"} %s\n' \ + "${profile}" \ + "$(sort -u -- "${tmpdir}/${profile}/"*/bootstrap/root.*/pkglist.*.txt | wc -l)" + ;; + esac + } > "${output}/${profile}/job-metrics" + + # gitlab collapsable sections end + printf "\e[0Ksection_end:%(%s)T:metrics\r\e[0K" } -create_temp_pgp_key() { +create_ephemeral_pgp_key() { # create an ephemeral PGP key for signing the rootfs image + + # gitlab collapsable sections start + printf "\e[0Ksection_start:%(%s)T:ephemeral_pgp_key\r\e[0KCreating ephemeral PGP key" + gnupg_homedir="$tmpdir/.gnupg" mkdir -p "${gnupg_homedir}" chmod 700 "${gnupg_homedir}" @@ -96,24 +186,74 @@ EOF --with-colons \ | awk -F':' '{if($1 ~ /sec/){ print $5 }}' )" + + # gitlab collapsable sections end + printf "\e[0Ksection_end:%(%s)T:ephemeral_pgp_key\r\e[0K" +} + +create_ephemeral_codesigning_key() { + # create ephemeral certificates used for codesigning + + # gitlab collapsable sections start + printf "\e[0Ksection_start:%(%s)T:ephemeral_codesigning_key\r\e[0KCreating ephemeral codesigning key" + + codesigning_dir="${tmpdir}/.codesigning/" + local codesigning_conf="${codesigning_dir}/openssl.cnf" + local codesigning_subj="/C=DE/ST=Berlin/L=Berlin/O=Arch Linux/OU=Release Engineering/CN=archlinux.org" + codesigning_cert="${codesigning_dir}/codesign.crt" + codesigning_key="${codesigning_dir}/codesign.key" + mkdir -p "${codesigning_dir}" + cp -- /etc/ssl/openssl.cnf "${codesigning_conf}" + printf "\n[codesigning]\nkeyUsage=digitalSignature\nextendedKeyUsage=codeSigning\n" >> "${codesigning_conf}" + openssl req \ + -newkey rsa:4096 \ + -keyout "${codesigning_key}" \ + -nodes \ + -sha256 \ + -x509 \ + -days 365 \ + -out "${codesigning_cert}" \ + -config "${codesigning_conf}" \ + -subj "${codesigning_subj}" \ + -extensions codesigning + + # gitlab collapsable sections end + printf "\e[0Ksection_end:%(%s)T:ephemeral_codesigning_key\r\e[0K" } run_mkarchiso() { # run mkarchiso - # $1: template name - create_temp_pgp_key - mkdir -p "${output}/${1}" "${tmpdir}/${1}" + # gitlab collapsable sections start + printf "\e[0Ksection_start:%(%s)T:mkarchiso\r\e[0KRunning mkarchiso" + + create_ephemeral_pgp_key + create_ephemeral_codesigning_key + + mkdir -p "${output}/${profile}" "${tmpdir}/${profile}" GNUPGHOME="${gnupg_homedir}" ./archiso/mkarchiso \ + -D "${install_dir}" \ + -c "${codesigning_cert} ${codesigning_key}" \ -g "${pgp_key_id}" \ - -o "${output}/${1}" \ - -w "${tmpdir}/${1}" \ - -v "configs/${1}" - create_checksums "${output}/${1}/"*.iso - create_zsync_delta "${output}/${1}/"*.iso - create_metrics "${1}" + -o "${output}/${profile}" \ + -w "${tmpdir}/${profile}" \ + -m "${buildmode}" \ + -v "configs/${profile}" + + # gitlab collapsable sections end + printf "\e[0Ksection_end:%(%s)T:mkarchiso\r\e[0K" + + if [[ "${buildmode}" =~ "iso" ]]; then + create_zsync_delta "${output}/${profile}/"*.iso + create_checksums "${output}/${profile}/"*.iso + fi + if [[ "${buildmode}" == "bootstrap" ]]; then + create_zsync_delta "${output}/${profile}/"*.tar*(.gz|.xz|.zst) + create_checksums "${output}/${profile}/"*.tar*(.gz|.xz|.zst) + fi + create_metrics } trap cleanup EXIT -run_mkarchiso "${1}" +run_mkarchiso |