vagrant/provision/assets/build-tails

   1 #!/bin/sh
   2 # -*- mode: sh; sh-basic-offset: 8; tab-width: 8; indent-tabs-mode:t; -*-
   3
   4 set -e
   5 set -x
   6
   7 if [ -n "${TAILS_PROXY:-}" ]; then
   8     export http_proxy="${TAILS_PROXY}"
   9 fi
  10
  11 if [ "${TAILS_WEBSITE_CACHE}" = 1 ]; then
  12     export WEBSITE_CACHE_BASEDIR=/var/cache/tails-website
  13 fi
  14
  15 as_root_do() {
  16     # shellcheck disable=SC2154
  17     sudo \
  18         ${RSYNC_PROXY:+RSYNC_PROXY="${RSYNC_PROXY}"} \
  19         ${http_proxy:+http_proxy="${http_proxy}"} \
  20         ${https_proxy:+https_proxy="${https_proxy}"} \
  21         ${ftp_proxy:+ftp_proxy="${ftp_proxy}"} \
  22         ${no_proxy:+no_proxy="${no_proxy}"} \
  23         ${MKSQUASHFS_OPTIONS:+MKSQUASHFS_OPTIONS="${MKSQUASHFS_OPTIONS}"} \
  24         ${APT_SNAPSHOTS_SERIALS:+APT_SNAPSHOTS_SERIALS="${APT_SNAPSHOTS_SERIALS}"} \
  25         ${TAILS_WEBSITE_CACHE:+TAILS_WEBSITE_CACHE="${TAILS_WEBSITE_CACHE}"} \
  26         ${WEBSITE_CACHE_BASEDIR:+WEBSITE_CACHE_BASEDIR="${WEBSITE_CACHE_BASEDIR}"} \
  27         ${GIT_COMMIT:+GIT_COMMIT="${GIT_COMMIT}"} \
  28         ${GIT_REF:+GIT_REF="${GIT_REF}"} \
  29         ${BASE_BRANCH_GIT_COMMIT:+BASE_BRANCH_GIT_COMMIT="${BASE_BRANCH_GIT_COMMIT}"} \
  30         ${FEATURE_BRANCH_GIT_COMMIT:+FEATURE_BRANCH_GIT_COMMIT="${FEATURE_BRANCH_GIT_COMMIT}"} \
  31         "${@}"
  32 }
  33
  34 cleanup() {
  35     [ -n "${BUILD_DIR}" ] || return 0
  36     cd /
  37     remove_build_dirs
  38     sudo rm -rf "${BUILD_DIR}"
  39 }
  40
  41 remove_build_dirs() {
  42     for mountpoint in $(old_build_dirs | tac); do
  43         tries=0
  44         sudo lsof | grep --fixed-strings "${mountpoint}" || true
  45         while ! sudo umount -f --verbose "${mountpoint}" && [ $tries -lt 12 ]; do
  46             sudo fuser --ismountpoint --mount "${mountpoint}" --kill || true
  47             sleep 5
  48             tries=$((tries + 1))
  49         done
  50         sudo rm -rf "${mountpoint}"
  51     done
  52 }
  53
  54 old_build_dirs() {
  55     mount |
  56         perl -ni -E 'say $mountpoint if (($mountpoint) = ($_ =~ m{^(?:tmpfs|devpts-live|proc-live|sysfs-live) on (/tmp/tails-build(?:-tmpfs)?\.[/[:alnum:]]+)}))'
  57 }
  58
  59 ntp_enabled() {
  60     timedatectl status | grep -qs -E '^\s*NTP\s+service:\s+active$'
  61 }
  62
  63 ntp_synchronized() {
  64     ntp_enabled &&
  65         timedatectl status | grep -qs -E '^\s*System\s+clock\s+synchronized:\s+yes$'
  66 }
  67
  68 shrink_acng_cache() {
  69     local proxy_type="$1"
  70     [ "${proxy_type}" = "vmproxy" ] || return 0
  71     # The apt-cacher-ng cache disk is 15G, so let's ensure at most 10G
  72     # of it is used so there is 5G before each build, which should be
  73     # enough for any build, even if we have to download a complete set
  74     # of new packages for a new Debian release.
  75     as_root_do /usr/lib/apt-cacher-ng/acngtool shrink 10G -f ||
  76         echo "The clean-up of apt-cacher-ng's cache failed: this is" \
  77             "not fatal and most likely just means that some disk" \
  78             "space could not be reclaimed -- in order to fix that" \
  79             "situation you need to manually investigate " \
  80             "/var/cache/apt-cacher-ng/apt-cacher-ng-log/main_*.html" >&2
  81 }
  82
  83 if [ "${TAILS_BUILD_FAILURE_RESCUE}" != 1 ]; then
  84     trap cleanup EXIT
  85     remove_build_dirs
  86 fi
  87
  88 # Required by jenkins isoworkers since git 2.39.5-0+deb12u1.
  89 for dir in /amnesia.git/.git /amnesia.git/.git/modules/submodules/*; do
  90     git config --global --add safe.directory "${dir}"
  91 done
  92
  93 TAILS_GIT_DIR="/home/vagrant/amnesia"
  94 rm -rf "${TAILS_GIT_DIR}"
  95 # We use --shared as an time/space optimization, and it is safe
  96 # since our build process doesn't modify any objects (which would
  97 # fail since the host's .git directory is shared read-only).
  98 git clone --shared --local /amnesia.git/.git "${TAILS_GIT_DIR}"
  99 # When we locally Git clone the main repo over the filesystem
 100 # above, it will use the host's local repo as origin, but the
 101 # submodules will continue to use their remote repos. A problem
 102 # with this, beside unnecessary fetching of the network, is that
 103 # any unpublished commits in the host's submodule are
 104 # inaccessible, so if we want to build we first have to push those
 105 # commits to the submodules remote repo. To avoid this, and in
 106 # general try to make sure that the Git state in the builder is
 107 # the same as on the host, we just clone the submodules in the
 108 # same way we do the main repo.
 109 (
 110     cd "${TAILS_GIT_DIR}/submodules"
 111     for submodule in *; do
 112         # handle the case when there is no submodule
 113         [ -e "$submodule" ] || break
 114         rm -rf "${submodule}"
 115         git clone --shared \
 116             "/amnesia.git/.git/modules/submodules/${submodule}"
 117         cd "${submodule}"
 118         # Mirror the branches this submodule tracks on its
 119         # "origin" remote as if they were on our own "origin" remote,
 120         # so our build scripts have access to refs. See more detailed
 121         # explanation below, where we do the same thing
 122         # in $TAILS_GIT_DIR.
 123         git config remote.origin.fetch \
 124             +refs/remotes/origin/*:refs/remotes/origin/*
 125         cd ..
 126     done
 127 )
 128
 129 cd "${TAILS_GIT_DIR}"
 130 # Mirror the branches amnesia.git tracks on its "origin" remote as if
 131 # they were on our own "origin" remote, (i.e. under the origin/$REF
 132 # name), even if it's untrue (our own "origin" is amnesia.git and has
 133 # only one local ref, which is the branch we work on and that it has
 134 # checked out as a local tracking branch). This allows
 135 # git_base_branch_head(), that's used by Rakefile to set
 136 # $BASE_BRANCH_GIT_COMMIT, to do its job: without this, it would not
 137 # have access to the state of the base branch because it would not
 138 # have any ref for it.
 139 git config remote.origin.fetch +refs/remotes/origin/*:refs/remotes/origin/*
 140
 141 # Ensure we have the same Git state as on the host
 142 git fetch --tags --recurse-submodules=no
 143 git checkout --force "${GIT_REF}"
 144 git reset --hard "${GIT_COMMIT}"
 145 git submodule update --init
 146
 147 # We use our own fork of live-build.  To ease development, we no
 148 # longer build and install Debian packages, but install it from a git
 149 # submodule.
 150 #
 151 # We just run make install here, which is cheap, and it makes sure
 152 # that we always use the current version even during development.
 153 as_root_do make -C "${TAILS_GIT_DIR}/submodules/live-build" install
 154
 155 if as_root_do systemctl --quiet is-active apt-cacher-ng.service; then
 156     as_root_do ./auto/scripts/update-acng-config
 157     as_root_do systemctl restart apt-cacher-ng.service
 158 fi
 159
 160 if [ "${TAILS_OFFLINE_MODE}" != 1 ]; then
 161     as_root_do timedatectl set-ntp true
 162     echo -n "Waiting for the time to be synchronized..."
 163     while ! ntp_synchronized; do
 164         sleep 1
 165         echo -n "."
 166     done
 167     echo " done."
 168 fi
 169 if [ -n "$TAILS_DATE_OFFSET" ]; then
 170     as_root_do timedatectl set-ntp false
 171
 172     echo -n "Waiting for NTP to be disabled..."
 173     while ntp_enabled; do
 174         sleep 1
 175         echo -n "."
 176     done
 177     echo " done."
 178
 179     DESIRED_DATE=$(date --utc --date="${TAILS_DATE_OFFSET} days" '+%F %T')
 180     echo "Setting system time to ${DESIRED_DATE}"
 181     as_root_do timedatectl set-time "$DESIRED_DATE"
 182 fi
 183
 184 shrink_acng_cache "${TAILS_PROXY_TYPE}"
 185
 186 BUILD_DIR=$(mktemp -d /tmp/tails-build.XXXXXXXX)
 187 if [ "${TAILS_RAM_BUILD}" ]; then
 188     as_root_do mount -t tmpfs -o "noatime,size=100%,mode=0770,uid=root,gid=${USER}" tmpfs "${BUILD_DIR}"
 189 fi
 190 as_root_do rsync -a "${TAILS_GIT_DIR}"/ "${BUILD_DIR}"/
 191
 192 cd "${BUILD_DIR}"
 193
 194 as_root_do lb config --cache false
 195 as_root_do lb build
 196
 197 shrink_acng_cache "${TAILS_PROXY_TYPE}"
 198
 199 mv -f tails-* "${TAILS_GIT_DIR}/"