arch.setup

#!/bin/bash

set -ex
IMAGE="$1"

# avoid failures when running image builds in a non-English locale (ssh transfers the host environment)
unset LANGUAGE
unset LANG
export LC_ALL=C

# binutils for strip (required for fetching sources in devtools)
COCKPIT_DEPS="\
binutils \
edk2-ovmf \
json-glib \
krb5 \
cpio \
cdrtools \
docbook-xsl \
dmidecode \
openssh \
networkmanager \
pcp \
xmlto \
packagekit \
libvirt \
libvirt-python \
libvirt-dbus \
libblockdev-mdraid \
libpwquality \
tracer \
tuned \
virt-install \
udisks2 \
udisks2-btrfs \
udisks2-lvm2 \
devtools \
"

TEST_PACKAGES="\
clevis \
criu \
gdb \
fakeroot \
strace \
ltrace \
lvm2 \
cryptsetup \
dhclient \
dnsmasq \
iptables-nft \
socat \
sudo \
vim \
firewalld \
openssh \
podman \
qemu \
qemu-tools \
qemu-audio-spice \
qemu-ui-spice-app \
qemu-hw-usb-host \
qemu-hw-usb-redirect \
qemu-block-curl \
valkey \
openbsd-netcat \
nfs-utils \
sssd \
swtpm \
tang \
tpm2-tools \
jq \
ntfs-3g \
wireguard-tools \
xfsprogs \
"

# HACK: libosinfo requires gsettings-desktop-schemas but does not depend on it.
# https://gitlab.archlinux.org/archlinux/packaging/packages/libosinfo/-/issues/1
TEST_PACKAGES="$TEST_PACKAGES gsettings-desktop-schemas"

# iptables-nft (which provides ebtables) is required for libvirt NAT networking
# but provides iptables and therefore conflicts. First remove it before installing iptables-nft.
pacman -Rdd --noconfirm iptables

# Ignore a linux kernel update as it removes kernel modules which are required
# for starting firewalld and podman, as last step the kernel is upgraded.
pacman -Syu --noconfirm --asexplicit $COCKPIT_DEPS $TEST_PACKAGES cockpit --ignore linux

echo "127.0.1.1 $(hostname)" >> /etc/hosts

systemctl enable --now firewalld

# Use networkd for eth0
cat > /etc/systemd/network/20-wired.network << EOL
[Match]
Name=eth0

[Network]
DHCP=yes
EOL

# Enable networkmanager as no services are started by default
systemctl enable NetworkManager

# Don't let NetworkManager manage eth0 (networkd does), and don't autoconnect to eth1
cat > /etc/NetworkManager/conf.d/noauto.conf <<EOL
[main]
no-auto-default=*

[keyfile]
unmanaged-devices=interface-name:eth0
EOL

# Disable PerSourcePenalties, they interfere with the rapid failed
# logins performed by some tests.
echo "PerSourcePenalties no" >/etc/ssh/sshd_config.d/99-no-penalties.conf

# Disable mDNS for systemd-resolved, mDNS always times out in our testing setup which makes
# multi machine tests time out as the resolved timeout is ~ 7 seconds.
mkdir -p /etc/systemd/resolved.conf.d
printf '[Resolve]\nMulticastDNS=false' > /etc/systemd/resolved.conf.d/disable-mdns.conf

# Enable serial console, for debugging networking problems
sed -i '/GRUB_CMDLINE_LINUX=/ s/"$/ console=ttyS0,115200"/' /etc/default/grub
grub-mkconfig -o /boot/grub/grub.cfg

# Setup sudoers for admin user
echo "%wheel ALL=(ALL) ALL" > /etc/sudoers.d/90-cockpit-wheel

useradd -c Builder builder
echo "builder ALL = NOPASSWD: /usr/sbin/makechrootpkg, /usr/sbin/mkarchroot, /usr/bin/*-x86_64-build" > /etc/sudoers.d/90-archbuild

BUILD_DEPS="\
asciidoctor \
base-devel \
cockpit \
git \
glib-networking \
glib2-devel \
gobject-introspection \
gtk-doc \
intltool \
json-glib \
krb5 \
libvirt-dbus \
networkmanager \
npm \
pcp \
xmlto \
python-installer \
python-pip \
python-wheel \
python-build \
podman \
systemd \
"

# Create build chroot for cockpit projects for offline builds, the base chroot
# is created in /var/lib/archbuild/cockpit
mkdir -p /var/lib/archbuild/cockpit
mkarchroot -C /etc/pacman.conf -M /etc/makepkg.conf -c /var/cache/pacman/pkg/ /var/lib/archbuild/cockpit/root ${BUILD_DEPS}

# Setup rootless podman
touch /etc/subuid /etc/subgid
usermod --add-subuids 100000-165535 --add-subgids 100000-165535 admin
# Setup some test registries, as none are specified by default.
echo 'unqualified-search-registries = ["docker.io", "quay.io"]' > /etc/containers/registries.conf
podman system migrate

# Generate C.UTF-8 locale
echo 'C.UTF-8 UTF-8' >> /etc/locale.gen
locale-gen

# Update the kernel as last step.
pacman -Syu --noconfirm

# Reduce image size, remove cloud-init
pacman -R --noconfirm --recursive --cascade cloud-init

# Reduce image size, remove devtools VCS support for non-git sources
pacman -R --noconfirm --nodeps --nodeps mercurial breezy subversion

# Causes some sort of race condition in waiting on NTP to be synced
# https://github.com/cockpit-project/bots/issues/3901#issuecomment-1260579703
systemctl disable systemd-time-wait-sync.service

# https://gitlab.archlinux.org/archlinux/packaging/packages/openssh/-/issues/16
# https://github.com/openssh/openssh-portable/pull/388
# https://github.com/openssh/openssh-portable/pull/593
echo 100::55:4e4b:4e4f:574e UNKNOWN | tee -a /etc/hosts

# Reduce image size, clear package cache (/var/cache/pacman/pkg)
rm -f /var/cache/pacman/pkg/*

/var/lib/testvm/podman-images.setup
/var/lib/testvm/zero-disk.setup