Merge ~sespiros/ubuntu-security-tools/+git/ubuntu-security-tools:esm-chroot-names into ubuntu-security-tools:master

[Spyros Seimenis]

[Alex Murray (alexmurray)]

LGTM!

review: Approve

[Eduardo Barretto (ebarretto)]

This change broke umt build for me as my ppas don't follow the esm naming.
Not that this is too much of an issue, but this got me thinking if instead of having different chroots for LTS and ESM, instead we could have a flag, much like --force-updates, that would copy the esm ppa from the hosts sources.list into the schroot if it is an esm build.
Thoughts?

[Spyros Seimenis (sespiros)]

So to give a little bit of the reasoning behind this change and some points of discussion:

1) build chroots for ESM releases differ from the rest, they include the ESM ppas, the ESM credentials and the ESM PPA key. Those extra steps are documented in https://wiki.ubuntu.com/SecurityTeam/BuildEnvironment#:~:text=conf.d/%20%3B%20done-,Setting%20up%20a%20chroot%20for%20Extended%20Security%20Maintenance,-Extra%20steps%20are and the extra tasks needed to set them up are in https://github.com/canonical/sec-buildenv/blob/master/roles/esm_schroot/tasks/main.yml. To me this makes sense since a package built for an ESM release might have dependencies to ESM only stuff. This also means that if a release (i.e bionic) is both in LTS and ESM, I have 2 chroots for it (a normal and an ESM one).

2) What this change also enables me to do is to build ESM packages just by running 'umt build' without "special treatment" (like specifying the name of the schroot) by standardizing the chroot names. I think this is important for 2 reasons:
- less documentation/advice/guidance hunting is needed for someone trying to build something for ESM
- easier automation for my builds

A flag like --force-updates for ESM builds would need an extra step to get documented somewhere for someone to use it.

So I see 2 solutions to the problems above:
1) Standardize the chroot names, have separate ESM and non-ESM chroots (works as it is right now)
2) Implement the flag, have only non-ESM chroots, use the flag whenever we are building something for ESM. This would also require additional logic in 'umt build' to satisfy my point 2 above:
   a) the flag in umt build would need to implement the steps of point 1 to setup an ESM chroot (then we could also remove the steps in the wiki and the additional handling in sec-buildenv)
   b) auto use the flag when an ESM package is built

Solution 2 seems the cleaner way to do it but it requires some additional effort.

diff --git a/build-tools/umt b/build-tools/umt
index be017d7..689d2a0 100755
--- a/build-tools/umt
+++ b/build-tools/umt
@@ -522,10 +522,18 @@ def perform_source_build(details, opt):
         if "ubuntu1" in details['base_version']:
             prepare_merge_debdiff(opt.start_version, details['package'])
 
-    details['chroot'] = "%s-i386" % details['release']
+    chroot = details['release']
+
+    if 'esm' in details['version']:
+        chroot += "-esm"
+
     (rc, arch) = runcmd(['uname', '-m'])
     if arch.strip() == "x86_64":
-        details['chroot'] = "%s-amd64" % details['release']
+        chroot += "-amd64"
+    else:
+        chroot += "-i386"
+
+    details['chroot'] = chroot
 
     if opt.chroot:
         details['chroot'] = opt.chroot