Merge lp:~robru/cupstream2distro/no-source-build-deps into lp:cupstream2distro

[Robert Bruce Park]

Stop installing build deps at source package build time.

[lp:~robru/cupstream2distro/no-source-build-deps]

1385. By Robert Bruce Park on 2016-03-18

Drop unused var.

1386. By Robert Bruce Park on 2016-03-18

Add new tools.

1387. By Robert Bruce Park on 2016-03-18

Call aa-exec directly.

1388. By Robert Bruce Park on 2016-03-18

Run package hook for secondary builds too.

1389. By Robert Bruce Park on 2016-03-18

Fix docstring.

1390. By Robert Bruce Park on 2016-03-18

Fix tests.

1391. By Robert Bruce Park on 2016-03-18

100% tests.

1392. By Robert Bruce Park on 2016-03-18

Fix some docstrings.

1393. By Robert Bruce Park on 2016-03-18

Exclude debian dir from orig.tar.

1394. By Robert Bruce Park on 2016-03-18

Fix tools path.

1395. By Robert Bruce Park on 2016-03-18

Fix permissions.

1396. By Robert Bruce Park on 2016-03-18

Fix tar.

1397. By Robert Bruce Park on 2016-03-18

Iterate.

1398. By Robert Bruce Park on 2016-03-18

Log to stderr.

1399. By Robert Bruce Park on 2016-03-18

Bah

1400. By Robert Bruce Park on 2016-03-18

Lowercase non-env var.

1401. By Robert Bruce Park on 2016-03-18

--human-readable.

1402. By Robert Bruce Park on 2016-03-18

Try quilt format.

1403. By Robert Bruce Park on 2016-03-18

Fix upstream tarball name.

1404. By Robert Bruce Park on 2016-03-18

Include .bzr-builddeb in upstream tarball.

1405. By Robert Bruce Park on 2016-03-18

orig.tar.gz for now.

1406. By Robert Bruce Park on 2016-03-18

What happens when debian/source is missing?

1407. By Robert Bruce Park on 2016-03-18

dpkg-buildpackage -i

1408. By Robert Bruce Park on 2016-03-18

Ignore bzr-builddeb.

1409. By Robert Bruce Park on 2016-03-18

Ignore a lot more.

1410. By Robert Bruce Park on 2016-03-18

Add comments.

1411. By Robert Bruce Park on 2016-03-19

Add new deps.

1412. By Robert Bruce Park on 2016-03-19

Full path to aa-exec because $PATH is wrong.

1413. By Robert Bruce Park on 2016-03-19

Force apparmor_parser.

1414. By Robert Bruce Park on 2016-03-19

Fix path.

1415. By Robert Bruce Park on 2016-03-19

Allow find and xgettext.

1416. By Robert Bruce Park on 2016-03-19

Allow sort and uniq.

1417. By Robert Bruce Park on 2016-03-19

Allow readlink.

[Robert Bruce Park (robru)]

Here's some successful runs in staging if you want to see this in action:

https://ci-train.staging.ubuntu.com/job/ubuntu-landing-008-1-build/12/console

https://ci-train.staging.ubuntu.com/job/ubuntu-landing-009-1-build/15/console

review: Approve

[lp:~robru/cupstream2distro/no-source-build-deps]

1418. By Robert Bruce Park on 2016-03-19

Define $SERIES env var.

[Martin Pitt (pitti)]

What's the purpose of these hooks? If they are meant to be able to install additional build dependencies to be able to build a source package, then this won't work. It seems they are meant to be limited to reading/writing files from their own source tree, but most of that could already be done in the bzr branch? Do you have an example what such a hook should do? Why is that coupled to not building the source in pbuilder?

I'm doubtful about the apparmor stuff and I found some smaller issues, see the inline comments.

review: Needs Fixing

[Robert Bruce Park (robru)]

On Mon, Mar 21, 2016 at 4:20 AM, Martin Pitt <email address hidden> wrote:
> What's the purpose of these hooks? If they are meant to be able to install additional build dependencies to be able to build a source package, then this won't work. It seems they are meant to be limited to reading/writing files from their own source tree, but most of that could already be done in the bzr branch? Do you have an example what such a hook should do? Why is that coupled to not building the source in pbuilder?

The purpose of these hooks is to allow people to munge debian/control
prior to source-build-time, eg, if you want to build vivid & xenial
builds out of the same source tree, but they build different package
names due to SONAME changes due to gcc abi breakage between vivid &
xenial. Here is one such example:

http://bazaar.launchpad.net/~robru/unity-scopes-api/vivid-tweaks/view/head:/debian/bileto_pre_release_hook

Another usage is to update translation templates automatically prior
to building:

http://bazaar.launchpad.net/~robru/unity8/pre_release_hook/view/head:/debian/bileto_pre_release_hook

> You don't use patchutils and diffstat anywhere. But you do need to add dpkg-dev.

Ah, sorry. This work was actually backported from a much larger branch
where I do use patchutils and diffstat, I wasn't paying attention when
I copied over the updated deps.

> It seems to me that creating and maintaining this list is quite some busy-work -- if the package hooks will actually get used for anything, then they will hit a wall fairly quickly. What's the point of restricting package hooks to only run some of these commands, but not others? sed and dash by themselves are powerful enough to emulate pretty much everything else. This hook runs as some "ci train" user, right?
>
> But consider your trust model: If you cannot trust the contents of branches, then with sed, sh, and shipping/reading/writing arbitrary files into the silos/** dir you can already do pretty much anything as that "CI train" user -- including messing up files from different silos!
>
> I think it would be both safer (and also avoid maintaining the above list) to create a temporary "silo-XXXXX" unix user, do the "unpack source/run hook" and the dpkg-buildpackage -S as that user, chown the resulting .dsc back to the CI train user and deluser the temporary silo-XXXX one again.

Hmmm, not sure. The silo dirs are short-lived (eg they are empty while
not actively being built, so the idea of a hook script being malicious
and attacking other silo dirs doesn't bother me that much. The main
reason for the apparmor profile is to prevent the script from being
able to read/write sensitive files in ~ and /tmp, eg to avoid leaking
GPG keys and other sensitive state, which the apparmor profile
successfully prevents.

What would a chown solution look like? Note that we explicitly do not
install build deps or run debian/rules from dpkg-buildpackage so
isolating that is not necessary, just the hook script. But we'd need
to chown the source tree to the temp user and then chown it back
after. Doesn't it require root to change the ownership of something
you don't own back to your own user? I guess we could make t...

[Robert Bruce Park (robru)]

On Mon, Mar 21, 2016 at 7:45 AM, Barry Warsaw <email address hidden> wrote:
>> + rm -rf /etc/sudoers.d/citrain # TODO drop this transition
>
> Maybe prepend the line with - to ignore the error if the file doesn't exist, during the transition?
>
> https://ftp.gnu.org/old-gnu/Manuals/make-3.79.1/html_chapter/make_5.html#SEC48

'rm -rf does_not_exist' exits with 0 though?

> Is that safer and more robust in the long run than building the source package in a container, e.g. an schroot, lxc or other container? I agree with Martin about the current model, so his suggestion does improve things, and there may be problems with getting the artifacts of the source build out of whatever container you create, but it feels cleaner to use a container than to do the temporary user creation. But anyway if you do that, be sure to handle any errors and clear out any allocated resources (e.g. the temp silo-XXXX user) when things fail.

No, containers/chroots is what we already were doing, and it didn't
make any sense. We spent a lot of time debootstrapping whole systems
and keeping them updated and installing build dependencies that were
entirely unused. The apparmor profile is actually significantly more
secure than the chroot it's replacing because if you look at the
chroot it just bindmounts ~ which means any malicious `debian/rules
clean` could actually leak our GPG keys, but the apparmor profile does
not allow access to ~.

> The other thing to consider is local reproducibility. With all automated systems (e.g. autopkgtest, source->binary builds), things *will* fail and they will fail in mysterious ways. IMHO it's always better to have a system where the environment is both well-documented and locally reproducible so developers can try to debug the problems on their own. Otherwise, mysterious failures will fall on you to debug and that doesn't scale.

I believe this approach is more reproducible because it is simpler and
more direct than the previous approach. Somebody trying to reproduce
the old way would need a chroot, but reproducing the new way just
requires dpkg-buildpackage. And the code is open of course so they can
view it and run what it does with significantly less setup.

But dpkg-buildpackage isn't really something that can fail because it
doesn't invoke any custom code in debian/rules (at least not the way
I'm invoking it). So making the source package is essentially just the
tar, then dpkg-genchanges, then signing it, then uploading. The only
real failure modes that people are going to encounter are a) merge
conflicts prior to the source build happening, and b) binary package
build failures in the PPA.

>
> I understand that a container-based approach may be slower, but I still would trade speed for robustness and reproducibility.

Everybody has been clamoring for speed improvements in the train as in
some cases it takes nearly 2 hours to build source packages, which is
really pathetic when you consider that a source package isn't much
more than a tarball. I took an example silo from production and build
it with this branch and the *source* package build time (not counting
binary builds in PPA) decreased from 100 minutes to 35 mi...

[lp:~robru/cupstream2distro/no-source-build-deps]

1419. By Robert Bruce Park on 2016-03-21

Fix deps as per pitti.

[Martin Pitt (pitti)]

Robert Bruce Park [2016-03-21 19:03 -0000]:
> The purpose of these hooks is to allow people to munge debian/control
> prior to source-build-time, eg, if you want to build vivid & xenial
> builds out of the same source tree, but they build different package
> names due to SONAME changes due to gcc abi breakage between vivid &
> xenial. Here is one such example:
>
> http://bazaar.launchpad.net/~robru/unity-scopes-api/vivid-tweaks/view/head:/debian/bileto_pre_release_hook

Ah, thanks. This particular case could also be done with substvars.

> Another usage is to update translation templates automatically prior
> to building:
>
> http://bazaar.launchpad.net/~robru/unity8/pre_release_hook/view/head:/debian/bileto_pre_release_hook

That's a better use case. Normally these should be done during binary
package build (as that's also the time when Launchpad will import
them), but for upstream translations it's important to have them up to
date in the source tree indeed. But this is also a rather complex use
case which is prone to use /tmp, as well as tools like intltool-update
(which isn't in your whitelist)?

> Hmmm, not sure. The silo dirs are short-lived (eg they are empty while
> not actively being built, so the idea of a hook script being malicious
> and attacking other silo dirs doesn't bother me that much. The main
> reason for the apparmor profile is to prevent the script from being
> able to read/write sensitive files in ~ and /tmp, eg to avoid leaking
> GPG keys and other sensitive state, which the apparmor profile
> successfully prevents.

Running it as a different user will also do all that, but in a much
more robust manner (IMHO).

> What would a chown solution look like?

A sketch:

U=citrain-$somerandomstring
sudo adduser $U
cat <<EOF | su - $U
bzr branch proj...
cd proj*
dpkg-buildpackage -S -us -uc ...
EOF
cp ~$U/proj_* some/ci-train-work/dir
sudo deluser --remove-home $U
debsign -k... some/ci-train-work/dir/*.dsc

> But we'd need to chown the source tree to the temp user and then
> chown it back after.

Not really, you just need to chown (or copy) the generated .dsc/tar.

> Doesn't it require root to change the ownership of something you
> don't own back to your own user?

Yes, it does. More importantly, you require root to create/remove/run
something as temporary user.

> I guess we could make the directory group-writable and also create a
> temporary group for the temporary user. The idea of allowing jenkins
> user to 'sudo chown' without restrictions sounds somewhat
> terrifying.

You could restrict the sudo capabilities to alling adduser and deluser
if you want (even with adding the "citrain-" user name prefix).

> Nah, at any given time, there will only be one or two silo dirs
> present, so a malicious script trying to trample on other people's
> silos would be limited by timing.

Well, bugs happen, not necessarily out of malice. Gems like
"rm -rf $TMPDIR/" have destroyed the world more than once already :-)

> Thanks for the tip about --with-colons, but the purpose of this code
> is to sort lexically and then choose the newest key

That should still be easier and more reliable using --with-colons;
that is meant to be a machin...

[lp:~robru/cupstream2distro/no-source-build-deps]

1420. By Robert Bruce Park on 2016-03-21

gpg --with-colons thanks to pitti.

1421. By Robert Bruce Park on 2016-03-21

Creation date, not expiry date.

1422. By Robert Bruce Park on 2016-03-21

Run hooks as temp user.

1423. By Robert Bruce Park on 2016-03-21

Resurrect sudoers.

1424. By Robert Bruce Park on 2016-03-21

Drop apparmor dep.

1425. By Robert Bruce Park on 2016-03-21

Fix perms.

1426. By Robert Bruce Park on 2016-03-21

Absolute paths in sudoers.

1427. By Robert Bruce Park on 2016-03-21

Run run_hook.sh as root.

1428. By Robert Bruce Park on 2016-03-21

Change ownership back.

1429. By Robert Bruce Park on 2016-03-21

Use absolute paths.

1430. By Robert Bruce Park on 2016-03-21

Stop hard-coding jenkins username.

1431. By Robert Bruce Park on 2016-03-21

Abort earlier.

1432. By Robert Bruce Park on 2016-03-21

Fix traps.

1433. By Robert Bruce Park on 2016-03-21

Drop unused job.

[Robert Bruce Park (robru)]

Hi Martin, Barry, please re-review. I've switched to a temporary-user based security approach, which you can see working here:

https://ci-train.staging.ubuntu.com/job/ubuntu-landing-002-1-build/6/console

+ hook=./debian/bileto_pre_release_hook
+ [ -s ./debian/bileto_pre_release_hook ]
+ trap userdel --force "$tmpuser"; rm --force "$tmpfile" EXIT
+ pwd
+ source_tree=/var/lib/jenkins/silos/ubuntu/landing-002/vivid/unity-scopes-api/unity-scopes-api
+ stat -c %U /var/lib/jenkins/silos/ubuntu/landing-002/vivid/unity-scopes-api/unity-scopes-api
+ orig_owner=jenkins
+ mktemp --tmpdir citrain-XXXXXXXXXXXXXXXXXXXXXXXX
+ tmpfile=/tmp/citrain-qR5kHMqYd2R8nT49XT4VLKRm
+ basename /tmp/citrain-qR5kHMqYd2R8nT49XT4VLKRm
+ tmpuser=citrain-qR5kHMqYd2R8nT49XT4VLKRm
+ useradd citrain-qR5kHMqYd2R8nT49XT4VLKRm
+ chown --recursive citrain-qR5kHMqYd2R8nT49XT4VLKRm /var/lib/jenkins/silos/ubuntu/landing-002/vivid/unity-scopes-api/unity-scopes-api
+ su --preserve-environment citrain-qR5kHMqYd2R8nT49XT4VLKRm --command ./debian/bileto_pre_release_hook
+ chown --recursive jenkins /var/lib/jenkins/silos/ubuntu/landing-002/vivid/unity-scopes-api/unity-scopes-api
+ userdel --force citrain-qR5kHMqYd2R8nT49XT4VLKRm
+ rm --force /tmp/citrain-qR5kHMqYd2R8nT49XT4VLKRm

review: Approve

[lp:~robru/cupstream2distro/no-source-build-deps]

1434. By Robert Bruce Park on 2016-03-22

Fix permissions on lp creds.

1435. By Robert Bruce Park on 2016-03-22

Fix permissions on openstack creds.

1436. By Robert Bruce Park on 2016-03-22

Moar permissions.

1437. By Robert Bruce Park on 2016-03-22

EVEN MOAR permissions.

[Robert Bruce Park (robru)]

Here's an example malicious script:

http://bazaar.launchpad.net/~robru/unity8/testing-train-please-ignore/view/2294/debian/bileto_pre_release_hook

And here's the output:

https://pastebin.canonical.com/152455/

It gets a directory listing for ~, which the apparmor profile wouldn't have allowed, but all the creds are only readable by owner so none of the attempts at leaking creds are successful.

let me know if there's other nefarious things to try in a malicious script. I want to make sure this is really secure.

Thanks!

[lp:~robru/cupstream2distro/no-source-build-deps]

1438. By Robert Bruce Park on 2016-03-22

Fix docstring.

1439. By Robert Bruce Park on 2016-03-22

More comments.

1440. By Robert Bruce Park on 2016-03-22

Tweak environment.

1441. By Robert Bruce Park on 2016-03-22

Tweak environment again.

1442. By Robert Bruce Park on 2016-03-22

Apparently unnecessary.

1443. By Robert Bruce Park on 2016-03-22

Fix comment.

1444. By Robert Bruce Park on 2016-03-22

Fix tests.

[Martin Pitt (pitti)]

Chowning the entire source tree twice is a bit more work than I had in mind, but it doesn't take that much time. This should work fine now. I just found one nitpick in the shell trap, otherwise LGTM, thanks!

review: Approve

[lp:~robru/cupstream2distro/no-source-build-deps]

1445. By Robert Bruce Park on 2016-03-22

Trap more signals.

1446. By Robert Bruce Park on 2016-03-22

Decrease log noise.

1447. By Robert Bruce Park on 2016-03-22

Simplify

[Robert Bruce Park (robru)]

On Tue, Mar 22, 2016 at 1:13 AM, Martin Pitt <email address hidden> wrote:
> Review: Approve
>
> Chowning the entire source tree twice is a bit more work than I had in mind, but it doesn't take that much time.

Due to the architecture of the train it's easier to just chown it and
chown it back within one little hook script rather than trying to keep
it as a unique owner all the time as we do a lot of transformations on
the source tree (lots of merges, variable substitutions in debian/
files, commits, etc). Would have taken lots of big changes to make it
always sudo to the owner of the files every time we want to touch it.

>> +trap 'userdel --force "$tmpuser"; rm --force "$tmpfile"' EXIT
>
> Please add INT QUIT PIPE too, as these are also common modes how a shell script can abort.

I played with this a little bit and found that when I trap INT QUIT
and PIPE, the trap runs twice when those signals are sent, but the
trap isn't run on just EXIT (I read some documentation that claimed
that EXIT fires on any exit, whether there was a signal or not, but
that doesn't seem to be the case according to my experiments). Still,
deleting the user twice is better than not at all.

Of course trapping INT QUIT and PIPE stops the script from actually
exiting when those are trapped so I had to add an exit statement, fun
times.

--
robru

[lp:~robru/cupstream2distro/no-source-build-deps]

1448. By Robert Bruce Park on 2016-03-22

Ensure we always chown source tree back to $orig_owner.

1449. By Robert Bruce Park on 2016-03-22

Add a warning for packages that may require transitioning.

1450. By Robert Bruce Park on 2016-03-22

Duh

1451. By Robert Bruce Park on 2016-03-22

debug

1452. By Robert Bruce Park on 2016-03-22

debug ls

1453. By Robert Bruce Park on 2016-03-22

Why isn't this working?

1454. By Robert Bruce Park on 2016-03-22

Sigh

1455. By Robert Bruce Park on 2016-03-22

Simplify.

1456. By Robert Bruce Park on 2016-03-22

All output to STDERR for logging.

1457. By Robert Bruce Park on 2016-03-23

Fix GLES builds.

1458. By Robert Bruce Park on 2016-03-23

Clean up logging a bit.

1459. By Robert Bruce Park on 2016-03-23

Stop deleting debian/watch

=== modified file 'Makefile'
--- Makefile	2016-02-05 00:23:41 +0000
+++ Makefile	2016-03-23 08:43:27 +0000
@@ -28,7 +28,7 @@
 
 # Charm runs this as root.
 install: install-common-deps
-	$(apt) sudo rsync cowbuilder eatmydata bzr-builddeb dput amqp-tools python-swiftclient
+	$(apt) sudo rsync dpkg-dev dput amqp-tools python-swiftclient
 	mkdir -p /etc/rsync-juju.d/
 	cp files/rsyncd.conf /etc/rsync-juju.d/020-ci-train.conf
 	service rsync restart
@@ -39,6 +39,7 @@
 
 # Charm runs this as unprivileged jenkins user.
 install-user:
+	chmod 0600 $(HOME)/.launchpad.credentials $(HOME)/os.* $(HOME)/*.token $(HOME)/*.key $(HOME)/cred*
 	bzr whoami "CI Train Bot <$(LAUNCHPAD_USER)@canonical.com>"
 	bzr launchpad-login $(LAUNCHPAD_USER)
 	$(envsubst) <files/dput.cf >$(HOME)/.dput.cf

=== removed file 'chroot-tools/.pbuilderrc'
--- chroot-tools/.pbuilderrc	2014-10-28 02:10:49 +0000
+++ chroot-tools/.pbuilderrc	1970-01-01 00:00:00 +0000
@@ -1,41 +0,0 @@
-# The file is automatically picked up by the internal pbuilder call
-# Just use it to create the cowbuilder with: sudo HOME=. DIST=<wanted_dist> cowbuilder --create --debootstrapopts --variant=buildd
-# If you need to tweak the base.cow, use: sudo HOME=. DIST=<wanted_dist> cowbuilder --login --save
-
-# Optionally set the series to the host series and
-# architecture to the host architecture if none set.
-: ${DIST:="$(lsb_release -sc)"}
-: ${ARCH:="$(dpkg --print-architecture)"}
-NAME="$DIST-$ARCH"
-
-BASETGZ="/var/cache/pbuilder/$NAME-base.tgz"
-BASEPATH="/var/cache/pbuilder/$NAME/base.cow" # for cowbuilder
-DISTRIBUTION="$DIST"
-BUILDRESULT="/var/cache/pbuilder/$NAME/result/"
-APTCACHE="/var/cache/pbuilder/$NAME/aptcache/"
-BUILDPLACE="/var/cache/pbuilder/build/"
-
-# create the directories if doesn't exist
-mkdir -p $BUILDRESULT
-mkdir -p $APTCACHE
-mkdir -p $BUILDPLACE
-
-# use ubuntu main mirror only
-# Ubuntu configuration
-MIRRORSITE="http://archive.ubuntu.com/ubuntu/"
-COMPONENTS="main restricted universe multiverse"
-OTHERMIRROR=""
-
-# Enable eatmydata
-# EXTRAPACKAGES is not obeyed by 'cowbuilder --create' but running
-# 'cowbuilder--update' will happily fix that.
-EXTRAPACKAGES="eatmydata pbuilder bzr bzr-builddeb"
-case $DIST in
-precise|trusty|utopic)
-    export LD_PRELOAD="${LD_PRELOAD:+$LD_PRELOAD:}/usr/lib/libeatmydata/libeatmydata.so"
-    ;;
-*)
-    # FIXME: This rubbish is totally broken in Vivid.
-    #export LD_PRELOAD="${LD_PRELOAD:+$LD_PRELOAD:}/usr/lib/$(dpkg-architecture -a$ARCH -qDEB_HOST_MULTIARCH)/libeatmydata.so"
-    ;;
-esac

=== removed file 'chroot-tools/buildsource-chroot'
--- chroot-tools/buildsource-chroot	2015-12-07 20:44:00 +0000
+++ chroot-tools/buildsource-chroot	1970-01-01 00:00:00 +0000
@@ -1,117 +0,0 @@
-#!/bin/bash
-# FIXME: This script should really use /bin/sh but it breaks pbuilder.
-# Copyright (C) 2012-2013 Canonical
-#
-# This program is free software; you can redistribute it and/or modify it under
-# the terms of the GNU General Public License as published by the Free Software
-# Foundation; version 3.
-#
-# This program is distributed in the hope that it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-# FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
-# details.
-#
-# You should have received a copy of the GNU General Public License along with
-# this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-#
-
-set -e
-
-# go to the working directory
-cd "$1"
-shift
-
-while [ -n "$1" ]; do
-    case "$1" in
-        --debug)
-            set -x
-            shift;
-            ;;
-        --distro-version)
-            DISTRO_VERSION=$2
-            shift; shift;
-            ;;
-        --gnupg-parentdir)
-            # set home directory to real HOME for signing the source packaging
-            CHROOT_HOME="${2}";
-            shift; shift;
-            ;;
-        --help)
-            echo "$0: Enable building a source package inside a chroot
-
-    Usage: $0 WORKDIR --gnupg-parentdir=DIR --distro-version=version_from_distro
-    All parameters below are mandatory:
-    - WORKDIR is the current package source directory (in tree)
-    - gnupg-parentdir is the directory containing the .gnupg/ directory. Certainly $HOME for you.
-    - distro-version is the latest version published to the distro
-
-    Note that WORKDIR and gnupg-keyid should be bindmounted into the chroot.
-    This will create a signed source package using bzr bd -S, after installing all build-deps, ran into the WORKDIR, with the correct permission.
-
-
-    Example on how to run it with pbuilder (cowbuilder can be used with exactly the same parameters, replace pbuilder with cowbuilder):"'
-
-    $ pbuilder --execute --distribution TARGET_DIST --bindmounts ${PWD} --bindmounts ${HOME} -- '$0' ${PWD} --gnupg-parentdir ${HOME}'
-            shift;
-            exit 0
-            ;;
-        --*)
-            echo "E: Unknown option [$1] was specified "
-            exit 1;
-            ;;
-        *)
-            break;
-            ;;
-    esac
-done
-
-if [ -z "$CHROOT_HOME" ]  || [ -z "DISTRO_VERSION" ] ; then
-    echo "Every parameters is mandatory to run $0. Use --help for more info."
-    exit 1
-fi
-
-SU="su -p pbuser -c"
-HOME="$CHROOT_HOME"
-export HOME;
-
-apt-get update
-apt-get -yq --force-yes dist-upgrade
-
-# this isn't needed (you should install them in the chroot), but easier for debugging
-apt-get install pbuilder bzr-builddeb libwww-perl -yq --force-yes
-
-# install build-deps
-. /usr/lib/pbuilder/pdebuild-checkparams
-export PBCURRENTCOMMANDLINEOPERATION="pdebuild"
-"$PBUILDERSATISFYDEPENDSCMD"-classic --force-version --continue-fail
-
-# create the user similar to that used outside.
-cmd_retry_exec () {
-    # Tries to execute $@ $loop times with a delay of 1s between retries
-    # before aborting
-    loop=10
-    set +e
-    while [ $loop -gt 0 ]; do
-        $@ && break
-        loop=$(expr $loop - 1)
-        sleep 1
-    done
-    set -e
-}
-
-# Workaround a bug where /etc/group or /etc/passwd are locked when several
-# jobs run in parallel (LP: #1155510)
-cmd_retry_exec groupadd -g "$(stat -c '%g' .)" -o pbgroup
-cmd_retry_exec useradd -g pbgroup -u "$(stat -c '%u' .)" -d "${HOME}" -o pbuser
-
-# Determine the most-recently-created GPG secret key we have available.
-# 'awk' converts "sec   2048R/9D68D3D4 2014-12-11" into "2014-12-112048R/9D68D3D4".
-# 'sort | tail -1' chooses the lexically highest (aka chronologically newest) one.
-# 'cut -f2 -d/' removes the date and key size, leaving only the key id.
-KEY=$($SU "gpg --list-secret-keys" | egrep ^sec | awk '{ print $3$2 }' | sort | tail -1 | cut -f2 -d/)
-
-set -x
-
-$SU "make -f ./debian/rules clean"
-$SU "bzr bd -S -- -sa -k$KEY -d -v$DISTRO_VERSION"

=== removed file 'chroot-tools/create-chroot'
--- chroot-tools/create-chroot	2015-06-29 22:52:03 +0000
+++ chroot-tools/create-chroot	1970-01-01 00:00:00 +0000
@@ -1,42 +0,0 @@
-#!/bin/sh
-export LANG=en_US.UTF-8
-
-if echo "$DIST" | egrep -q '[0-9]'; then
-    export ARCHIVE="http://derived.archive.canonical.com/ubuntu-rtm"
-fi
-
-OPTS=""
-if [ ! -z "$ARCHIVE" ]; then
-  OPTS="$OPTS --mirror=$ARCHIVE"
-fi
-
-ARCH=$(dpkg --print-architecture)
-
-# Use our custom .pbuilderrc
-export HOME=$(cd $(dirname "$0"); pwd)
-
-if [ ! -e "/var/cache/pbuilder/${DIST}-${ARCH}/base.cow" ]; then
-    echo "Preparing pbuilder for $DIST"
-
-    if [ ! -e "/usr/share/debootstrap/scripts/$DIST" ]; then
-         # Temporary solution
-         echo "Can't find any support for $DIST yet, improvising..."
-         cp -a /usr/share/debootstrap /tmp/debootstrap-$DIST
-
-         echo "Preparing a temporary symlink for the new distribution"
-         ln -s /usr/share/debootstrap/scripts/trusty /tmp/debootstrap-$DIST/scripts/$DIST
-         export DEBOOTSTRAP_DIR=/tmp/debootstrap-$DIST
-    fi
-
-    sudo -E cowbuilder --create --debootstrapopts --variant=buildd $OPTS
-    sudo -E cowbuilder --save --execute -- /usr/bin/apt-get install \
-        eatmydata bzr-builddeb software-properties-common -yq --force-yes
-
-    unset DEBOOTSTRAP_DIR
-    if [ -d "/tmp/debootstrap-$DIST" ]; then
-         echo "Cleaning up after setting up a temporary fix for debootstrap"
-         rm -rf /tmp/debootstrap-$DIST
-    fi
-
-    echo "$DIST pbuilder prepared"
-fi

=== removed file 'chroot-tools/pbuilder-clean'
--- chroot-tools/pbuilder-clean	2015-12-07 20:51:16 +0000
+++ chroot-tools/pbuilder-clean	1970-01-01 00:00:00 +0000
@@ -1,8 +0,0 @@
-#!/bin/sh
-
-set -x
-
-# Don't clean while builds are happening.
-if ! pgrep -c "^pbuilder$"; then
-    sudo pbuilder --clean
-fi

=== removed file 'citrain/jenkins-templates/upgrade-chroot.xml.tmpl'
--- citrain/jenkins-templates/upgrade-chroot.xml.tmpl	2015-12-16 21:53:13 +0000
+++ citrain/jenkins-templates/upgrade-chroot.xml.tmpl	1970-01-01 00:00:00 +0000
@@ -1,58 +0,0 @@
-<?xml version='1.0' encoding='UTF-8'?>
-<project>
-  <actions/>
-  <description>Upgrades the cowbuilder chroots.</description>
-  <logRotator class="hudson.tasks.LogRotator">
-    <daysToKeep>15</daysToKeep>
-    <numToKeep>-1</numToKeep>
-    <artifactDaysToKeep>-1</artifactDaysToKeep>
-    <artifactNumToKeep>-1</artifactNumToKeep>
-  </logRotator>
-  <keepDependencies>false</keepDependencies>
-  <properties/>
-  <scm class="hudson.scm.NullSCM"/>
-  <canRoam>true</canRoam>
-  <disabled>false</disabled>
-  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
-  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
-  <triggers>
-    <hudson.triggers.TimerTrigger>
-      <spec>@daily</spec>
-    </hudson.triggers.TimerTrigger>
-  </triggers>
-  <concurrentBuild>false</concurrentBuild>
-  <builders>
-    <hudson.tasks.Shell>
-      <command>#/bin/sh
-set -ex
-
-export HOME=/var/lib/citrain/chroot-tools/
-export ARCH=$(dpkg-architecture -qDEB_HOST_ARCH)
-
-# Create the script to be executed inside the chroot
-cat &gt; build.sh &lt;&lt; EOF
-#!/bin/sh
-set -x
-
-# apt-get update can encounter transient failures due to archive updates, etc.
-apt-get update || apt-get update || apt-get update
-
-# The following were used to fix a broken package upgrade and should be safe to use on a regular basis
-apt-get dist-upgrade -y --force-yes
-apt-get -f install -y --force-yes
-apt-get dist-upgrade -y --force-yes
-apt-get autoremove -y
-EOF
-
-for chroot in /var/cache/pbuilder/*-$ARCH; do
-    [ -d "$chroot" ] || exit 0  # Don't try to update literal "*-amd64"
-    export DIST=$(basename -s -$ARCH $chroot)
-    # If you want to do a &apos;dry-run&apos; and not commit any changes, just omit the --save option as shown:
-    # sudo -E cowbuilder --execute -- build.sh
-    sudo -E cowbuilder --execute --save -- build.sh
-done</command>
-    </hudson.tasks.Shell>
-  </builders>
-  <publishers/>
-  <buildWrappers/>
-</project>

=== modified file 'citrain/recipes/base.py'
--- citrain/recipes/base.py	2016-02-15 07:31:50 +0000
+++ citrain/recipes/base.py	2016-03-23 08:43:27 +0000
@@ -293,8 +293,7 @@
     def build_phase(self):
         """Build the source package in a chroot."""
         logging.info('Building in %s', self.path)
-        prev_version = self.get_archive_version(self.dest)
-        self.build_package(self.series.name, prev_version)
+        self.build_package()
 
     @staticmethod
     def pre_upload_phase(silo_state):

=== modified file 'citrain/recipes/merge.py'
--- citrain/recipes/merge.py	2016-01-26 23:16:49 +0000
+++ citrain/recipes/merge.py	2016-03-23 08:43:27 +0000
@@ -128,6 +128,7 @@
             revno = merge.source_branch.revision_count
             logging.info('Merging %s at r%s.', branch, revno)
             self.merge_branch(branch, message, authors)
+        self.package_hook()
         self.verify_changelog_versions()
         self.identify_versions()
 

=== modified file 'citrain/recipes/secondary.py'
--- citrain/recipes/secondary.py	2015-12-08 06:04:44 +0000
+++ citrain/recipes/secondary.py	2016-03-23 08:43:27 +0000
@@ -40,6 +40,7 @@
         shutil.copytree(self.primary.path, self.path, symlinks=True)
         ver = V(self.get_package_version()).change_series(self.series.version)
         self.correct_package_changelog(ver, self.series.name)
+        self.package_hook()
 
     def checkupload_phase(self):
         """The primary checkupload phase already tracks upload rights."""

=== modified file 'citrain/setup_citrain.py'
--- citrain/setup_citrain.py	2016-02-10 17:26:23 +0000
+++ citrain/setup_citrain.py	2016-03-23 08:43:27 +0000
@@ -116,7 +116,6 @@
         setup_silo(siloname)
     setup_job('cyphermox-test')
     setup_job('prepare-silo')
-    setup_job('upgrade-chroot')
     setup_job('apt-get-clean')
     setup_job('revert')
     setup_job('abandon')

=== modified file 'cupstream2distro/packagemanager.py'
--- cupstream2distro/packagemanager.py	2016-02-10 16:29:30 +0000
+++ cupstream2distro/packagemanager.py	2016-03-23 08:43:27 +0000
@@ -29,7 +29,6 @@
 from cupstream2distro.settings import (
     BOT_DEBEMAIL,
     BOT_DEBFULLNAME,
-    GNUPG_DIR,
     TOOLS,
 )
 from cupstream2distro.utils import (
@@ -69,8 +68,6 @@
 
 NOCHANGE = {BOT_DEBFULLNAME: ['No-change rebuild.']}
 
-BUILDSOURCE = join(TOOLS, 'buildsource-chroot')
-
 
 class Package(object):
     """Define methods for interacting with debian packages."""
@@ -191,20 +188,19 @@
                   'debian/{}: update to released version.'.format(filename)],
                  cwd=self.path, env=dch_env)
 
-    def build_package(self, series, distro_version):
-        """Build the source package in a chroot."""
-        distro_version = distro_version or '0'
-        environ = os.environ.copy()
-        environ.update(HOME=TOOLS, DIST=series)
-        log_call(['./create-chroot'], cwd=TOOLS, env=environ)
-        cmd = [
-            'sudo', '-E', 'cowbuilder', '--execute',
-            '--bindmounts', dirname(self.path),
-            '--bindmounts', GNUPG_DIR, '--', BUILDSOURCE, self.path,
-            '--gnupg-parentdir', GNUPG_DIR, '--distro-version', distro_version,
-        ]
-        instance = log_call(cmd, cwd=self.path, env=environ)[0]
-        log_call('./pbuilder-clean', cwd=TOOLS)
+    def package_hook(self):
+        """Run the pre_release_hook."""
+        hook_env = os.environ.copy()
+        hook_env.update(SERIES=self.series.name)
+        instance = log_call(
+            'sudo --preserve-env /bin/sh ' + join(TOOLS, 'run_hook.sh'),
+            cwd=self.path, env=hook_env)[0]
+        if instance.returncode != 0:
+            raise PackageError('{} pre release hook.'.format(self.name))
+
+    def build_package(self):
+        """Build the source package without installing build deps."""
+        instance = log_call(join(TOOLS, 'buildpackage.sh'), cwd=self.path)[0]
         if instance.returncode != 0:
             raise PackageError('{} source package.'.format(self.name))
 

=== modified file 'cupstream2distro/settings.py'
--- cupstream2distro/settings.py	2016-02-05 23:58:24 +0000
+++ cupstream2distro/settings.py	2016-03-23 08:43:27 +0000
@@ -43,7 +43,7 @@
 OLD_STACK_DIR = 'old'
 
 ROOT_CU2D = dirname(dirname(realpath(__file__)))
-TOOLS = join(ROOT_CU2D, 'chroot-tools')
+TOOLS = join(ROOT_CU2D, 'tools')
 
 SILO_NAMES_FILE = expanduser('~/.ci-train-silo-names')
 

=== added file 'files/sudoers.conf'
--- files/sudoers.conf	1970-01-01 00:00:00 +0000
+++ files/sudoers.conf	2016-03-23 08:43:27 +0000
@@ -0,0 +1,1 @@
+jenkins ALL=(ALL) NOPASSWD:SETENV: /bin/sh /var/lib/citrain/tools/run_hook.sh

=== removed file 'files/sudoers.conf'
--- files/sudoers.conf	2015-08-31 04:06:23 +0000
+++ files/sudoers.conf	1970-01-01 00:00:00 +0000
@@ -1,3 +0,0 @@
-jenkins ALL=(ALL) NOPASSWD:SETENV: /usr/sbin/cowbuilder
-jenkins ALL=(ALL) NOPASSWD:SETENV: /usr/bin/apt-get clean
-jenkins ALL=(ALL) NOPASSWD:SETENV: /usr/sbin/pbuilder --clean

=== modified file 'tests/unit/test_packagemanager.py'
--- tests/unit/test_packagemanager.py	2016-02-10 16:29:30 +0000
+++ tests/unit/test_packagemanager.py	2016-03-23 08:43:27 +0000
@@ -17,9 +17,8 @@
 """Tests for debian package related functions."""
 
 
-from pprint import pprint
-from os import stat, makedirs, readlink, symlink
-from os.path import dirname, exists, expanduser, isdir, islink, join
+from os import environ, stat, makedirs, readlink, symlink
+from os.path import dirname, exists, isdir, islink, join
 
 from mock import Mock, patch, call
 
@@ -30,6 +29,7 @@
 from cupstream2distro.packagemanager import Package
 from cupstream2distro.utils import env, utf8_open
 from cupstream2distro.errors import PackageError
+from cupstream2distro.settings import TOOLS
 
 
 class PackageManagerTests(BaseTestCase):
@@ -88,7 +88,7 @@
 
     @patch('cupstream2distro.packagemanager.call')
     def test_get_package_version_failed(self, call_mock):
-        """Raise PackageError when dpkg-parsechangelog errors out."""
+        """Return None when dpkg-parsechangelog errors out."""
         self.assertIsNone(self.package.get_package_version())
 
     def test_preserve_package_version(self):
@@ -104,80 +104,48 @@
             self.prep_debian_file('control', control)
             self.assertEqual(self.package.preserve_package_version(), result)
 
-    @patch('cupstream2distro.packagemanager.os.getuid', lambda: '1000')
-    @patch('cupstream2distro.packagemanager.os.getgid', lambda: '1000')
-    @patch('cupstream2distro.packagemanager.os.environ.copy')
-    @patch('cupstream2distro.packagemanager.log_call')
-    def test_build_package(self, call_mock, copy_mock):
-        """call cowbuilder and build a source package."""
-        home = expanduser('~')
-        copy_mock.return_value = {}
-        call_mock.return_value = (Mock(returncode=0), '', '')
-        self.package.build_package('raring', '1.1-0ubuntu1')
-        copy_mock.assert_called_once_with()
-        self.assertEqual(
-            copy_mock(), dict(DIST='raring', HOME=dirname(self.bsc)))
-        pprint(call_mock.mock_calls)
-        self.assertEqual(call_mock.mock_calls, [
-            call(['./create-chroot'],
-                 env=copy_mock(), cwd=dirname(self.bsc)),
-            call(['sudo', '-E', 'cowbuilder', '--execute', '--bindmounts',
-                  dirname(self.tempdir), '--bindmounts', home, '--',
-                  self.bsc, self.tempdir, '--gnupg-parentdir', home,
-                  '--distro-version', '1.1-0ubuntu1'],
-                 env=copy_mock(), cwd=self.tempdir),
-            call('./pbuilder-clean', cwd=dirname(self.bsc)),
-        ])
-
-    @patch('cupstream2distro.packagemanager.os.getuid', lambda: '1000')
-    @patch('cupstream2distro.packagemanager.os.getgid', lambda: '1000')
-    @patch('cupstream2distro.packagemanager.os.environ.copy')
-    @patch('cupstream2distro.packagemanager.log_call')
-    def test_build_with_other_distro_version(self, call_mock, copy_mock):
-        """Build a source package (unsigned for tests) for an older distro."""
-        home = expanduser('~')
-        copy_mock.return_value = {}
-        call_mock.return_value = (Mock(returncode=0), '', '')
-        self.package.build_package('precise', '1.1-0ubuntu1')
-        copy_mock.assert_called_once_with()
-        self.assertEqual(
-            copy_mock(), dict(DIST='precise', HOME=dirname(self.bsc)))
-        pprint(call_mock.mock_calls)
-        self.assertEqual(call_mock.mock_calls, [
-            call(['./create-chroot'],
-                 env=copy_mock(), cwd=dirname(self.bsc)),
-            call(['sudo', '-E', 'cowbuilder', '--execute', '--bindmounts',
-                  dirname(self.tempdir), '--bindmounts', home, '--',
-                  self.bsc, self.tempdir, '--gnupg-parentdir', home,
-                  '--distro-version', '1.1-0ubuntu1'],
-                 env=copy_mock(), cwd=self.tempdir),
-            call('./pbuilder-clean', cwd=dirname(self.bsc)),
-        ])
-
-    @patch('cupstream2distro.packagemanager.os.getuid', lambda: '1000')
-    @patch('cupstream2distro.packagemanager.os.getgid', lambda: '1000')
-    @patch('cupstream2distro.packagemanager.os.environ.copy')
-    @patch('cupstream2distro.packagemanager.log_call')
-    def test_build_package_raises_exception(self, call_mock, copy_mock):
+    @patch('cupstream2distro.packagemanager.log_call')
+    def test_build_package(self, call_mock):
+        """Build a source package."""
+        call_mock.return_value = (Mock(returncode=0), '', '')
+        self.package.build_package()
+        self.assertEqual(call_mock.mock_calls, [
+            call(join(TOOLS, 'buildpackage.sh'), cwd=self.package.path),
+        ])
+
+    @patch('cupstream2distro.packagemanager.log_call')
+    def test_build_package_raises_exception(self, call_mock):
         """Raise exception if subprocess returns error."""
-        home = expanduser('~')
-        copy_mock.return_value = {}
         call_mock.return_value = (Mock(returncode=30), '', '')
         with self.assertRaisesRegexp(PackageError, 'wheee-doggy source'):
-            self.package.build_package('raring', '1.1-0ubuntu1')
-        copy_mock.assert_called_once_with()
-        self.assertEqual(
-            copy_mock(), dict(DIST='raring', HOME=dirname(self.bsc)))
-        pprint(call_mock.mock_calls)
-        self.assertEqual(call_mock.mock_calls, [
-            call(['./create-chroot'],
-                 env=copy_mock(), cwd=dirname(self.bsc)),
-            call(['sudo', '-E', 'cowbuilder', '--execute', '--bindmounts',
-                  dirname(self.tempdir), '--bindmounts', home, '--',
-                  self.bsc, self.tempdir, '--gnupg-parentdir', home,
-                  '--distro-version', '1.1-0ubuntu1'],
-                 env=copy_mock(), cwd=self.tempdir),
-            call('./pbuilder-clean', cwd=dirname(self.bsc)),
+            self.package.build_package()
+        self.assertEqual(call_mock.mock_calls, [
+            call(join(TOOLS, 'buildpackage.sh'), cwd=self.package.path),
+        ])
+
+    @patch('cupstream2distro.packagemanager.log_call')
+    def test_package_hook(self, call_mock):
+        """Call hook script."""
+        hook_env = environ.copy()
+        hook_env.update(SERIES=self.package.series.name)
+        call_mock.return_value = (Mock(returncode=0), '', '')
+        self.package.package_hook()
+        self.assertEqual(call_mock.mock_calls, [
+            call('sudo --preserve-env /bin/sh ' + join(TOOLS, 'run_hook.sh'),
+                 cwd=self.package.path, env=hook_env),
+        ])
+
+    @patch('cupstream2distro.packagemanager.log_call')
+    def test_package_hook_fail(self, call_mock):
+        """Call failing hook script."""
+        hook_env = environ.copy()
+        hook_env.update(SERIES=self.package.series.name)
+        call_mock.return_value = (Mock(returncode=99), '', '')
+        with self.assertRaisesRegexp(PackageError, 'pre release hook'):
+            self.package.package_hook()
+        self.assertEqual(call_mock.mock_calls, [
+            call('sudo --preserve-env /bin/sh ' + join(TOOLS, 'run_hook.sh'),
+                 cwd=self.package.path, env=hook_env),
         ])
 
     @patch('cupstream2distro.packagemanager.glob')

=== modified file 'tests/unit/test_recipe_base.py'
--- tests/unit/test_recipe_base.py	2016-02-15 07:31:50 +0000
+++ tests/unit/test_recipe_base.py	2016-03-23 08:43:27 +0000
@@ -311,9 +311,7 @@
         build.get_archive_version = Mock()
         build.build_package = Mock()
         build.build_phase()
-        build.get_archive_version.assert_called_once_with(self.dest)
-        build.build_package.assert_called_once_with(
-            self.series.name, build.get_archive_version.return_value)
+        build.build_package.assert_called_once_with()
 
     @patch('citrain.recipes.base.name_ppa')
     def test_buildbase_upload_phase(self, name_mock):

=== modified file 'tests/unit/test_recipe_merge.py'
--- tests/unit/test_recipe_merge.py	2016-01-26 23:11:55 +0000
+++ tests/unit/test_recipe_merge.py	2016-03-23 08:43:27 +0000
@@ -214,6 +214,7 @@
 
     @patch('citrain.recipes.merge.reorder_branches')
     @patch('citrain.recipes.merge.Merge.merge_branch', Mock())
+    @patch('citrain.recipes.merge.Merge.package_hook', Mock())
     @patch('citrain.recipes.merge.Merge.identify_versions', Mock())
     @patch('citrain.recipes.merge.Merge.get_archive_version', Mock())
     @patch('citrain.recipes.merge.Merge.get_package_version', Mock())
@@ -252,6 +253,7 @@
         ])
         merge.verify_changelog_versions.assert_called_once_with()
         merge.identify_versions.assert_called_once_with()
+        merge.package_hook.assert_called_once_with()
 
     @patch('citrain.recipes.merge.Merge.release_branch', Mock())
     @patch('citrain.recipes.merge.Merge.get_package_version', Mock())

=== modified file 'tests/unit/test_recipe_secondary.py'
--- tests/unit/test_recipe_secondary.py	2015-11-24 20:03:28 +0000
+++ tests/unit/test_recipe_secondary.py	2016-03-23 08:43:27 +0000
@@ -53,6 +53,7 @@
         self.assertEqual(sec.get_archive_version.mock_calls, [])
 
     @patch(MOD + 'shutil')
+    @patch(MOD + 'Secondary.package_hook', Mock())
     @patch(MOD + 'Secondary.get_package_version', Mock())
     @patch(MOD + 'Secondary.correct_package_changelog', Mock())
     def test_secondary_collect_phase(self, sh_mock):
@@ -68,3 +69,4 @@
             symlinks=True)
         sec.correct_package_changelog.assert_called_once_with(
             '0+15.04.20150525-0ubuntu1', 'vivid')
+        sec.package_hook.assert_called_once_with()

=== modified file 'tests/unit/test_script_setup_citrain.py'
--- tests/unit/test_script_setup_citrain.py	2016-02-10 17:26:23 +0000
+++ tests/unit/test_script_setup_citrain.py	2016-03-23 08:43:27 +0000
@@ -120,7 +120,6 @@
         self.assertEqual(self.script.setup_job.mock_calls, [
             call('cyphermox-test'),
             call('prepare-silo'),
-            call('upgrade-chroot'),
             call('apt-get-clean'),
             call('revert'),
             call('abandon'),
@@ -138,7 +137,6 @@
             'ubuntu-landing-{:03d}-1-build/config.xml',
             'ubuntu-landing-{:03d}-2-publish/config.xml',
             'ubuntu-landing-{:03d}-3-merge-clean/config.xml',
-            'upgrade-chroot/config.xml',
         ]
 
         def gen_expected():

=== renamed directory 'chroot-tools' => 'tools'
=== added file 'tools/buildpackage.sh'
--- tools/buildpackage.sh	1970-01-01 00:00:00 +0000
+++ tools/buildpackage.sh	2016-03-23 08:43:27 +0000
@@ -0,0 +1,38 @@
+#!/bin/sh
+
+[ "$DEBUG" = "true" ] && verbose="--verbose" || verbose=""
+
+set -eu
+
+# Converts "sec::4096:1:359834FAB93307E4:2013-12-06:..." into
+# "2015-01-12\tDEADBEEF", sorts lexically (ie, chronologically), then chooses
+# the last (ie, newest) one.
+gpg_key=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec/ {print $6 "\t" $5}' | sort | tail -1 | cut --field 2)
+
+source_name="$(dpkg-parsechangelog --show-field Source)"
+upstream="$(dpkg-parsechangelog --show-field Version | sed -e 's/^[^:]\+://' -e 's/-[^-]\+$//')"
+orig_tar="../${source_name}_${upstream}.orig.tar.gz"
+
+nongles="$(echo $source_name | sed -n 's/-gles$//p')"
+
+if [ -n "$nongles" ]; then
+    grep --quiet get-orig-source ./debian/rules && echo "WARNING! Ignoring obsolete get-orig-source target in debian/rules." 1>&2 || true
+    set -x
+    cp --verbose ../../${nongles}/${nongles}_${upstream}.orig.tar.gz "$orig_tar" 1>&2
+else
+    set -x
+    tar --create --auto-compress $verbose --file "$orig_tar" \
+        --exclude='.bzr*' --exclude='.git*' --exclude="debian" . 1>&2
+fi
+
+# -sa: Force inclusion of original source.
+# -d:  Do not check build dependencies and conflicts.
+# -S:  Only build source package, no binaries.
+# -i:  Ignore VCS files from generated diff.
+# -I:  Ignore VCS files from generated tarball.
+# -nc: Do not run `./debian/rules clean`
+# -k:  Sign .changes with this key.
+# -i'^.bzr' and -I'.bzr*': Ignore .bzr-builddeb which default -i and -I miss.
+dpkg-buildpackage -sa -d -S -i -i'^.bzr' -I -I'.bzr*' -nc -k"$gpg_key" 1>&2
+
+ls -l --all --human-readable .. 1>&2

=== added file 'tools/run_hook.sh'
--- tools/run_hook.sh	1970-01-01 00:00:00 +0000
+++ tools/run_hook.sh	2016-03-23 08:43:27 +0000
@@ -0,0 +1,41 @@
+#!/bin/sh
+
+#
+# WARNING: This script runs as root, don't do anything stupid!
+#
+
+cleanup() {
+    chown --recursive "$orig_owner" "$source_tree" 1>&2
+    userdel --force "$tmpuser" 1>&2
+    rm --force "$tmpfile" 1>&2
+}
+
+hook="./debian/bileto_pre_release_hook"
+
+# Check for packages which might need the hook but don't have it.
+if ! [ -s "$hook" ]; then
+    grep --quiet override_dh_auto_clean ./debian/rules && cat 1>&2 <<EOF
+WARNING! Found override_dh_auto_clean but not bileto_pre_release_hook defined
+in this package. "./debian/rules clean" is no longer called during source
+package builds! If you have code you need to be run prior to the source package
+build, you must create a new script: $hook
+EOF
+    exit 0
+fi
+
+trap 'cleanup' EXIT
+trap 'cleanup; exit 1' INT QUIT TERM
+
+source_tree="$(pwd)"
+orig_owner="$(stat -c '%U' "$source_tree")"
+
+set -eux
+
+tmpfile="$(mktemp --tmpdir citrain-XXXXXXXXXXXXXXXXXXXXXXXX)"
+tmpuser="$(basename "$tmpfile")"
+
+useradd "$tmpuser" 1>&2
+
+chown --recursive "$tmpuser" "$source_tree" 1>&2
+
+su "$tmpuser" --command "$hook" 1>&2