Skip to content

Commit cfa0455

Browse files
committed
releng/make-binary.sh: use containerized image builds
Using podman to containerize the production of release assets avoids potential leakage of personal information. To support this, the containerized build script has been modified to separate the repo path at /zbm from a "build" directory (previously /zbm/contrib/docker was hard coded, now it's just the default choice). The releng script creates a temporary directory to serve as the "build" path, populates configs, and runs the build container with the current repo at /zbm and the temporary directory at /build. The outputs are copied as before, with the EFI executable standing alone and the kernel/initramfs components stored in a gzipped tarball. If the releng script does not find the expected builder image (zbm-builder by default, but this can be passed as a second argument to the script), it will invoke `podman build` to create the image.
1 parent 4166967 commit cfa0455

File tree

3 files changed

+100
-69
lines changed

3 files changed

+100
-69
lines changed

contrib/docker/Dockerfile

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,19 +8,28 @@
88

99
# Use the official Void Linux container
1010
FROM voidlinux/voidlinux:latest
11+
ARG ZBM_COMMIT_HASH
1112

1213
# Ensure everything is up-to-date
1314
RUN xbps-install -Suy xbps && xbps-install -uy
1415

16+
# Prefer an LTS version over whatever Void thinks is current
17+
RUN echo "ignorepkg=linux" > /etc/xbps.d/10-nolinux.conf \
18+
&& echo "ignorepkg=linux-headers" >> /etc/xbps.d/10-nolinux.conf
19+
1520
# Install components necessary to build the image
1621
RUN xbps-query -Rp run_depends zfsbootmenu | xargs xbps-install -y
17-
RUN xbps-install -y linux linux-headers zfs gummiboot-efistub
22+
RUN xbps-install -y linux5.10 linux5.10-headers zfs gummiboot-efistub
23+
24+
# Record a commit hash if one was provided
25+
RUN if [ -n "${ZBM_COMMIT_HASH}" ]; then echo "${ZBM_COMMIT_HASH}" > /etc/zbm-commit-hash; fi
1826

1927
# Copy the build script
2028
COPY zbm-build.sh /zbm-build.sh
2129

2230
# To replace the default ZFSBootMenu tree, bind-mount over /zbm
2331
VOLUME /zbm
2432

25-
# Make sure a configuration exists or copy the default, then create the images
26-
CMD /zbm-build.sh
33+
# Run the build script with no arguments by default
34+
ENTRYPOINT [ "/zbm-build.sh" ]
35+
CMD [ ]

contrib/docker/zbm-build.sh

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,19 +9,31 @@ error() {
99
if ls -Aq /zbm | grep -q . >/dev/null 2>&1; then
1010
# If /zbm is not empty, make sure it looks like it has what we need
1111
[ -d /zbm/90zfsbootmenu ] || error "missing path /zbm/90zfsbootmenu"
12-
[ -d /zbm/contrib/docker ] || error "missing path /zbm/contrib/docker"
1312
[ -x /zbm/bin/generate-zbm ] || error "missing executable /zbm/bin/generate-zbm"
1413
else
1514
# If /zbm is empty, clone the upstream repo into it
1615
xbps-install -Sy git
17-
git clone --depth=1 https://github.com/zbm-dev/zfsbootmenu /zbm
16+
git clone https://github.com/zbm-dev/zfsbootmenu /zbm
17+
18+
# If the run specifies $ZBM_COMMIT_HASH, check out the hash
19+
# Get a default value for ZBM_COMMIT_HASH from /etc/zbm-commit-hash
20+
if [ -z "${ZBM_COMMIT_HASH}" ] && [ -r "/etc/zbm-commit-hash" ]; then
21+
read -r ZBM_COMMIT_HASH < /etc/zbm-commit-hash
22+
fi
23+
24+
if [ -n "${ZBM_COMMIT_HASH}" ]; then
25+
if ! ( cd /zbm && git checkout -q "${ZBM_COMMIT_HASH}" ); then
26+
error "failed to checkout commit, aborting"
27+
fi
28+
fi
1829
fi
1930

31+
BUILDROOT="${1:-/zbm/contrib/docker}"
32+
[ -d "${BUILDROOT}" ] || error "Build root does not appear to exist"
33+
2034
# Make sure that dracut can find the ZFSBootMenu module
2135
ln -sf /zbm/90zfsbootmenu /usr/lib/dracut/modules.d/90zfsbootmenu
2236

23-
BUILDROOT="/zbm/contrib/docker"
24-
2537
if [ ! -e "${BUILDROOT}/config.yaml" ]; then
2638
# If there is no provided config, copy the default
2739
cp "${BUILDROOT}/config.yaml.default" "${BUILDROOT}/config.yaml"

releng/make-binary.sh

Lines changed: 72 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -1,102 +1,112 @@
11
#!/bin/bash
22
# vim: softtabstop=2 shiftwidth=2 expandtab
33

4+
error() {
5+
echo "ERROR:" "$@"
6+
exit 1
7+
}
8+
49
cleanup() {
5-
test -d "${temp}" && rm -rf "${temp}"
10+
test -d "${buildtmp}" && rm -rf "${buildtmp}"
11+
unset buildtmp
612
exit
713
}
814

9-
release="${1?ERROR: no release version specified}"
15+
unset buildtmp
1016
trap cleanup EXIT INT TERM
11-
temp="$( mktemp -d )"
1217

13-
if [ ! -d /usr/lib/dracut ]; then
14-
echo "ERROR: missing /usr/lib/dracut"
15-
exit 1
16-
fi
18+
# Accept release with or without a leading "v"
19+
release="${1#v}"
1720

18-
DRACUTBIN="$( command -v dracut )"
19-
if [ ! -x "${DRACUTBIN}" ]; then
20-
echo "ERROR: missing dracut script"
21-
exit 1
22-
fi
21+
case "${release}" in
22+
"") error "usage: $0 <release> [buildtag]" ;;
23+
*/*) error "release must NOT contain a forward slash" ;;
24+
*) ;;
25+
esac
2326

24-
assets="$( realpath -e releng)/assets/${release}"
25-
if [ -d "${assets}" ]; then
26-
rm -f "${assets}"/*
27-
else
28-
mkdir -p "${assets}"
29-
fi
27+
buildtag="${2:-localhost/zbm-builder:$(date '+%Y%m%d')}"
28+
if ! podman inspect "${buildtag}" >/dev/null 2>&1; then
29+
if ! bldctx="$( realpath -e contrib/docker )"; then
30+
error "missing contrib/docker, cannot create image ${buildtag}"
31+
fi
32+
33+
if ZBM_COMMIT_HASH="$(git rev-parse HEAD)" && [ -n "${ZBM_COMMIT_HASH}" ]; then
34+
build_args=( "--build-arg=ZBM_COMMIT_HASH=${ZBM_COMMIT_HASH}" )
35+
else
36+
build_args=()
37+
fi
3038

31-
cp -a /usr/lib/dracut "${temp}"
32-
cp "${DRACUTBIN}" "${temp}/dracut"
39+
if ! podman build -t "${buildtag}" "${build_args[@]}" "${bldctx}"; then
40+
error "failed to create builder image"
41+
fi
42+
fi
3343

34-
cp -Rp etc/zfsbootmenu/dracut.conf.d "${temp}"
44+
buildtmp="$( mktemp -d )"
3545

36-
cat << EOF > "${temp}/dracut.conf.d/release.conf"
37-
omit_drivers+=" amdgpu radeon nvidia nouveau i915 "
38-
omit_dracutmodules+=" qemu qemu-net crypt-ssh nfs lunmask network network-legacy kernel-network-modules "
39-
embedded_kcl="rd.hostonly=0"
40-
release_build=1
41-
zfsbootmenu_teardown+=" $( realpath contrib/xhci-teardown.sh ) "
42-
EOF
46+
mkdir -p "${buildtmp}/dracut.conf.d"
4347

44-
_dracut_mods="${temp}/dracut/modules.d"
45-
if [ -d "${_dracut_mods}/90zfsbootmenu" ] ; then
46-
if ! rm -rf "${_dracut_mods}/90zfsbootmenu" ; then
47-
echo "Unable to remove ${_dracut_mods}/90zfsbootmenu"
48-
exit 1
49-
fi
48+
# Copy default dracut configuration and include a release-specific config
49+
if ! cp etc/zfsbootmenu/dracut.conf.d/* "${buildtmp}/dracut.conf.d"; then
50+
error "failed to copy dracut configuration"
5051
fi
5152

52-
ln -s "$(realpath -e 90zfsbootmenu)" "${_dracut_mods}"
53-
ln -s "$(realpath -e bin/generate-zbm)" "${temp}/generate-zbm"
53+
cat <<-EOF > "${buildtmp}/dracut.conf.d/release.conf"
54+
zfsbootmenu_teardown+="/zbm/contrib/xhci-teardown.sh"
55+
install_optional_items+=" /etc/zbm-commit-hash "
56+
omit_drivers+=" amdgpu radeon nvidia nouveau i915 "
57+
omit_dracutmodules+=" network network-legacy kernel-network-modules "
58+
omit_dracutmodules+=" qemu qemu-net crypt-ssh nfs lunmask "
59+
embedded_kcl="rd.hostonly=0"
60+
release_build=1
61+
EOF
62+
63+
yamlconf="${buildtmp}/config.yaml"
5464

55-
yamlconf="${temp}/local.yaml"
56-
cp etc/zfsbootmenu/config.yaml "${yamlconf}"
57-
build="${temp}/build"
65+
if ! cp etc/zfsbootmenu/config.yaml "${yamlconf}"; then
66+
error "failed to copy default ZFSBootMenu configuration"
67+
fi
5868

5969
arch="$( uname -m )"
6070
BUILD_EFI="false"
6171

6272
case "${arch}" in
63-
x86_64)
64-
BUILD_EFI="true"
65-
;;
66-
*)
67-
;;
73+
x86_64) BUILD_EFI="true" ;;
74+
*) ;;
6875
esac
6976

77+
zbmtriplet="zfsbootmenu-${arch}-v${release}"
78+
79+
# Modify the YAML configuration for the containerized build
7080
yq-go eval ".Components.Enabled = true" -i "${yamlconf}"
7181
yq-go eval ".Components.Versions = false" -i "${yamlconf}"
72-
yq-go eval ".Components.ImageDir = \"${build}\"" -i "${yamlconf}"
82+
yq-go eval ".Components.ImageDir = \"/build/${zbmtriplet}\"" -i "${yamlconf}"
7383
yq-go eval ".EFI.Enabled = ${BUILD_EFI}" -i "${yamlconf}"
7484
yq-go eval ".EFI.Versions = false" -i "${yamlconf}"
75-
yq-go eval ".EFI.ImageDir = \"${build}\"" -i "${yamlconf}"
85+
yq-go eval ".EFI.ImageDir = \"/build/uefi\"" -i "${yamlconf}"
7686
yq-go eval ".Global.ManageImages = true" -i "${yamlconf}"
77-
yq-go eval ".Global.DracutConfDir = \"${temp}/dracut.conf.d\"" -i "${yamlconf}"
78-
yq-go eval ".Global.DracutFlags = [ \"--local\", \"--no-early-microcode\" ]" -i "${yamlconf}"
87+
yq-go eval ".Global.DracutConfDir = \"/build/dracut.conf.d\"" -i "${yamlconf}"
88+
yq-go eval ".Global.DracutFlags = [ \"--no-early-microcode\" ]" -i "${yamlconf}"
89+
yq-go eval ".Kernel.CommandLine = \"loglevel=4 nomodeset\"" -i "${yamlconf}"
7990
yq-go eval "del(.Global.BootMountPoint)" -i "${yamlconf}"
80-
yq-go eval "del(.Kernel.CommandLine)" -i "${yamlconf}"
8191

82-
if ! ( cd "${temp}" && PATH=./dracut:${PATH} ./generate-zbm \
83-
--version "${release}" \
84-
--config "${yamlconf}" \
85-
--cmdline "loglevel=4 nomodeset" ) ; then
92+
# For the containerized build, use current repo by mounting at /zbm
93+
# Custom configs and outputs will be in the temp dir, mounted at /build
94+
podman run --rm -v ".:/zbm:ro" -v "${buildtmp}:/build" "${buildtag}" "/build" || exit 1
8695

87-
echo "ERROR: Unable to create images"
88-
exit 1
96+
if ! assets="$( realpath -e releng )/assets/${release}"; then
97+
error "unable to define path to built assets"
98+
fi
99+
100+
if [ -d "${assets}" ]; then
101+
rm -f "${assets}"/*
102+
else
103+
mkdir -p "${assets}"
89104
fi
90105

91106
# EFI file is currently only built on x86_64
92107
if [ "${BUILD_EFI}" = "true" ]; then
93-
mv "${build}/vmlinuz.EFI" "${assets}/zfsbootmenu-${arch}-v${release}.EFI"
108+
cp "${buildtmp}/uefi/vmlinuz.EFI" "${assets}/${zbmtriplet}.EFI" || exit 1
94109
fi
95110

96111
# Components are always built
97-
components="${build}/zfsbootmenu-${arch}-v${release}"
98-
mkdir -p "${components}"
99-
mv "${build}/initramfs-bootmenu.img" "${components}"
100-
mv "${build}/vmlinuz-bootmenu" "${components}"
101-
102-
( cd "${build}" && tar czvf "${assets}/zfsbootmenu-${arch}-v${release}.tar.gz" "$( basename "${components}" )" ) || exit 1
112+
( cd "${buildtmp}" && tar czvf "${assets}/${zbmtriplet}.tar.gz" "${zbmtriplet}" ) || exit 1

0 commit comments

Comments
 (0)