Merge lp:~notnownikki/offspring/post-build-chroot into lp:offspring

[Nicola Heald]

Adds a routine that looks for a post-build bash script in the project config, and builds a chroot with access to the built image to run it in if it's there.

Requires the following commands to be runnable with sudo:

umount /var/tmp/lexbuild*
rm -rf /var/tmp/lexbuild*
debbootstrap
mkdir /var/tmp/lexbuild*
mount -o bind
chroot /var/tmp/lexbuild*
/bin/chown

Tim, can you check through and make sure I've got those extra sudo command right for our environment before I go merging anything? Cheers!

[Timothy R. Chavez (timrchavez)]

Hey, I looked at this and will look at it again in the morning. I also want to speak with you to get some clarifications on some things.

[Timothy R. Chavez (timrchavez)]

Okay, after some discussion with Kevin and Mike, I think we've agreed to not copy the ssh keys or apt sources into the post-build hook chroot since there is no post-build hook use case that requires either and raises some concerns about security (though to be perfectly honest these concerns already exist due to the fact that people can build in the buildd environment directly if they choose too) :/

review: Approve

=== modified file 'lib/offspring/build/bin/offspring-build'
--- lib/offspring/build/bin/offspring-build	2012-06-13 09:11:32 +0000
+++ lib/offspring/build/bin/offspring-build	2013-10-21 16:46:38 +0000
@@ -120,7 +120,6 @@
 
     Info "Saving copy of build setup to build results directory."
     Export_project_config "${PROJECT}" "${RESULTDIR_CONFIGFILES}/"
-
     Buildtool_build
 
     Catch_faults permit_errors
@@ -150,6 +149,43 @@
     Info "Build stage completed at %s" "`date`"
 }
 
+_PostBuild() {
+    IBS_USER_ID=`id -u`
+    IBS_GROUP_ID=`id -g`
+    POST_BUILD_SCRIPT="$IBS_PROJECTCONFIGDIR/post-build"
+    POST_BUILD_CHROOT_DIR="$IBS_WORK_DIR/post-build-chroot"
+    Info "Checking post build script at $POST_BUILD_SCRIPT"
+    if [ -e $POST_BUILD_SCRIPT ]
+    then
+        Info "Preparing chroot"
+        Info "Reading SSH keys"
+        SSH_KEY=$(<~/.ssh/id_rsa)
+        SSH_PUB_KEY=$(<~/.ssh/id_rsa.pub)
+        mkdir $POST_BUILD_CHROOT_DIR
+        Info "Copying extra apt sources"
+        mkdir -p $POST_BUILD_CHROOT_DIR/etc/apt/sources.list.d
+        cp /etc/apt/sources.list.d/* $POST_BUILD_CHROOT_DIR/etc/apt/sources.list.d
+        Info "Bootstrapping"
+        sudo debootstrap --variant=buildd precise $POST_BUILD_CHROOT_DIR
+        Info "Mounting project and build directories"
+        sudo mkdir $POST_BUILD_CHROOT_DIR/project
+        sudo mkdir $POST_BUILD_CHROOT_DIR/build
+        sudo mount -o bind $IBS_PROJECTCONFIGDIR $POST_BUILD_CHROOT_DIR/project
+        sudo mount -o bind $NEWMANIFESTDIR $POST_BUILD_CHROOT_DIR/build
+        Info "Installing ssh keys"
+        sudo chroot $POST_BUILD_CHROOT_DIR /bin/bash -c "mkdir -p ~/.ssh"
+        sudo chroot $POST_BUILD_CHROOT_DIR /bin/bash -c "echo \"$SSH_KEY\" > ~/.ssh/id_rsa"
+        sudo chroot $POST_BUILD_CHROOT_DIR /bin/bash -c "echo \"$SSH_PUB_KEY\" > ~/.ssh/id_rsa.pub"
+        sudo chroot $POST_BUILD_CHROOT_DIR /bin/bash -c "chmod 600 ~/.ssh/id_rsa"
+        Info "Installing apt keys"
+        apt-key exportall | sudo chroot $POST_BUILD_CHROOT_DIR /bin/bash -c "apt-key add -"
+        Info "Executing post-build script"
+        sudo chroot $POST_BUILD_CHROOT_DIR /bin/bash -c "PROJECT=$PROJECT BUILD_DATE=$DATE BUILD_ORDER=$BUILDCOUNT ISO_PATH=/build/$IBS_BUILT_ISO_FILENAME RESULT_DIR=/build /bin/bash /project/post-build"
+        Info "Restoring ownership of files in the build directory"
+        sudo /bin/chown $IBS_USER_ID:$IBS_GROUP_ID $NEWMANIFESTDIR/*
+    fi
+}
+
 _GenerateReports() {
     mkdir -p "${RESULTDIR_REPORTS}"
     generateTreeGraph
@@ -204,5 +240,6 @@
 
 # Perform the build
 _Build
+_PostBuild
 _GenerateReports
 _Culminate

=== modified file 'lib/offspring/build/functions/exit.sh'
--- lib/offspring/build/functions/exit.sh	2012-04-30 19:43:01 +0000
+++ lib/offspring/build/functions/exit.sh	2013-10-21 16:46:38 +0000
@@ -61,6 +61,14 @@
         Action_done
     fi
 
+    if [ -e "$IBS_WORK_DIR/post-build-chroot" ]
+    then
+        Info "Cleaning up post-build chroot"
+        sudo umount $IBS_WORK_DIR/post-build-chroot/project
+        sudo umount $IBS_WORK_DIR/post-build-chroot/build
+        sudo rm -rf $IBS_WORK_DIR/post-build-chroot
+    fi
+
     Action "Removing build statefile"
     rm ${IBS_BUILD_STATEFILE}
     Action_done

=== modified file 'lib/offspring/build/functions/files.sh'
--- lib/offspring/build/functions/files.sh	2013-02-28 12:31:01 +0000
+++ lib/offspring/build/functions/files.sh	2013-10-21 16:46:38 +0000
@@ -23,7 +23,7 @@
     fi
 
     _EXT="$(echo ${_FILE_PATH} | rev | cut -d'.' -f1 | rev)"
-    if [ "${_EXT}" = "zsync" ]
+    if [ "${_EXT}" = "zsync" ] && [ -z "${_DONT_RENAME}" ]
     then
         _ORIGINAL_TARGET="$(basename ${_FILE_PATH} | sed s/.zsync$//)"
         _NEW_TARGET="$(echo ${_NEW_FILENAME} | sed s/.zsync$//)"
@@ -52,10 +52,15 @@
         _FILE_HASH="$(Calculate_hash ${_CHECKSUM_TYPE} ${_FILE_PATH})"
         echo "${_FILE_HASH}  ${_NEW_FILENAME}" >> "${_DESTINATION}/${PROJECT}-${BUILDNAME}.${_CHECKSUM_TYPE}sums.txt"
     done
-    
+
     Debug "Copying file '${_FILE_PATH}' to '${_DESTINATION}/${_NEW_FILENAME}'"
     cp "${_FILE_PATH}" "${_DESTINATION}/${_NEW_FILENAME}"
 
+    if [ "${_EXT}" = "iso" ]
+    then
+        IBS_BUILT_ISO_FILENAME=$_NEW_FILENAME
+    fi
+
     Debug "Verifying integrity of copy"
     for _CHECKSUM_TYPE in ${IBS_CHECKSUM_TYPES}
     do