Compare commits

...

29 Commits

Author SHA1 Message Date
Eli Schwartz
7fcf847bc3 Do not assume the makechrootpkg user's groupname is the same as the username
chown support "$user:$group" but also "$user:" which infers $group
rather than leaving it as root. This looks up the group name in cases
where the default group is e.g. "users" and users do not get their own
unique groups.
2018-05-16 10:37:55 -04:00
Eli Schwartz
5b3c14454a Proper fix for pacman-git returning file urls from the cache
It is much nicer to use a proper configuration parser to retrieve the
primary mirror, rather than clever hacks using undocumented APIs,
especially when their behavior as used then breaks in later releases.

Fortunately, pacutils exists now and pacconf handles this quite
elegantly. It has since been moved to pacman-git proper.

Check if pacman-conf from a new enough version of pacman exists and
fallback on pacconf from pacutils.
2018-05-13 09:16:20 -04:00
Eli Schwartz
4408bb2a15 Revert "arch-nspawn: Work around pacman master returning file-URLs from the cache"
This reverts commit eb6b0e3f11.

This never worked, as pacman-git returns file urls from the cache anyway
and pacman stable doesn't have any problem at all. Having useless code
which makes people think the issue is solved when it really isn't, is
bloat, so remove it.
2018-05-13 09:16:20 -04:00
Eli Schwartz
509c00ea23 makechrootpkg: Do not copy the user keyring into the chroot.
Since commit 75fdff1811 we no longer run
integrity checks inside the chroot anyway, so this is no longer needed
and will never be used.
2018-05-13 09:16:20 -04:00
Evangelos Foutras
5713cd629c makechrootpkg: add /etc/shadow entry for builduser
Without it, sudo 1.8.23 will return an error:

    sudo: PAM account management error: Authentication
    service cannot retrieve authentication info
2018-05-12 11:52:18 +03:00
Eli Schwartz
40f0179a5e makechrootpkg: fix verifysource with pacman-git
In pacman-git commit d8717a6a9666ec80c8645d190d6f9c7ab73084ac makepkg
started checking that the setuid/setgid bit could be removed on the
$BUILDDIR in order to prevent this propagating to the packages
themselves.  Unfortunately, this requires the temporary builddir used
during the --verifysource stage of makepkg, to be owned by $makepkg_user
which was not the case as it is created as root using mktemp (and given
world rwx in addition to the restricted deletion bit.)

Obviously makepkg cannot chmod a directory that it does not own. Fix
this by making $makepkg_user the owner of that directory, as should have
been the case all along.

(Giving world rwx is illogical on general principle. The fact that this
is a workaround for makepkg demanding these directories be writable even
when they are not going to be used for the makepkg options in question,
is not justification for being careless.)

Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
2018-03-24 20:54:24 +01:00
Emiel Wiedijk
ffb5003fda makechrootpkg: respect GNUPGHOME
Previously, makechrootpkg hardcoded ~/.gnupg. Therefore, if a user
uses a custom GPG home directory, the siganture checking would fail.
Now makechrootpkg uses $GNUPGHOME, with a fallback to ~/.gnupg.

Signed-off-by: Emiel Wiedijk <me@aimileus.nl>
2018-03-24 20:54:17 +01:00
Bartłomiej Piotrowski
ab3368f061 Remove corepkg symlink
While still possible with 'commitpkg core', there is a chance it will
prevent accidental pushes straight to [core].
2018-03-24 20:35:09 +01:00
Bartłomiej Piotrowski
38c7a391b0 makechrootpkg: make sure that makepkg.conf is always parsed as text 2018-01-21 14:18:43 +01:00
Luke Shumaker
75ad2aca57 makechrootpkg: Adjust to work properly with set -e
This worked properly until eab5aba.
2018-01-21 14:16:10 +01:00
Luke Shumaker
aee72cae32 lib/common.sh: Adjust to work properly with set -u
Support for working with `set -u` was broken by 94160d6.  Egg on my
face; I'm the one who wants `set -u` support, and I'm the author of
that commit!

libmakepkg does not work with `set -u`; but mostly because of the include
guards!  So we just need to temporarily disable `set -u` (nounset) while
loading libmakepkg.  Instead of introducing a new variable, just store the
initial nounset status in _INCLUDE_COMMON_SH; rather than a useless
fixed-string "true".

While we're at it, disable POSIX-mode (just in case we're running as "sh"
instead of "bash"), since libmakepkg uses bash-isms that won't parse in
POSIX mode.
2018-01-21 14:16:10 +01:00
Luke Shumaker
5ab8f8430a arch-nspawn: Remove pointless $(echo ...) subshell 2018-01-21 14:16:10 +01:00
Luke Shumaker
c9e287e845 arch-nspawn: make sure that makepkg.conf is always parsed as text
https://lists.parabola.nu/pipermail/dev/2017-June/005576.html
2018-01-21 14:16:10 +01:00
Eli Schwartz
48b2f8dcc4 makechrootpkg: Fix anti-pattern when checking for enabled features
Don't use error-prone logic e.g.
foo=true; if $foo ...

This completely fails to act as expected when the variable is unset
because of unrelated bugs.

While this merely causes the default behavior to be "false" rather than
"true" in such cases, it is better to fail to enable explicitly
requested behavior (which will be noticed by the user) than to simply
upgrade to this behavior for free (which may not seem to have any
obvious cause).

Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
2018-01-21 14:16:10 +01:00
Eli Schwartz
3b725b5843 makechrootpkg: Fix unconditionally running namcap
Fixes regression in 2fd5931a8c

$run_namcap will always be set to ""
`if $not_a_var; then ...; fi` is always truthful when $not_a_var is
unset or equal to "" and the `then` clause will always be run.

I'm not sure why global state variables need to be cloned locally for
their sole explicit purpose.

But for now this patch implements the minimum necessary work to properly
pass the "do I want namcap" variable into prepare_chroot() according to
the current logic flow.
Note that I have still not thorougly tested makechrootpkg.

Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
2018-01-21 14:16:10 +01:00
Evangelos Foutras
7a3c508501 Revert "makechrootpkg: Reopen console to assign the CTTY"
This reverts commit ddd508efc0.

The underlying bug (FS#56529) was fixed in glibc 2.26-9.
2017-12-27 23:33:45 +02:00
Eli Schwartz
eab5aba9b0 Support reproducible builds
Recent development versions of makepkg support reproducible builds
through the environment variable SOURCE_DATE_EPOCH. Pass this variable
through makechrootpkg to makepkg when available.

Also initialize SOURCE_DATE_EPOCH whenever running archbuild to enforce
reproducible builds for repository packages.

Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Levente Polyak <anthraxx@archlinux.org>
2017-11-22 16:35:25 +01:00
Bartłomiej Piotrowski
2a308821b3 Version 20171108 2017-11-08 14:23:26 +01:00
Bartłomiej Piotrowski
7259e7def0 Remove i686 support 2017-11-08 14:22:56 +01:00
Luke Shumaker
94160d62b8 use makepkg library instead of local function copies
This mirrors dbscripts commit
625fa02 by Pierre Schmitz <pierre@archlinux.de> at 2017-04-18 14:20:49
2017-10-30 16:03:15 +01:00
Luke Shumaker
095e5305e4 makechrootpkg: Fix function usage comments
A couple of the comments noting which globals are used by functions are
outdated/wrong.

 - download_sources() : Remove USER from the list.  It was always wrong.
   Originally, it should have been SUDO_USER (not USER), but I should have
   removed it entirely in 4f23609.

 - move_products() : Add SRCPKGDEST to the list.  Though the commit adding
   the comment was only recently upstreamed (as 2fd5931), it originated in
   2013 in a commit that has since  been rebased many times.  Anyway, in
   this rebasing, it missed move_products() starting to pay attention to
   SRCPKGDEST in fd1be1b (since nothing made git think there was a
   "conflict").
2017-10-30 15:59:38 +01:00
Luke Shumaker
e4db687d10 makechrootpkg: move init_variables() to be part of main()
The reason it wasn't moved before was just to keep the diffs
(with --ignore-all-space) smaller, to make merging and rebasing work
easier.  Moving code around in a file tends to make that difficult.

But, readability wise, it belongs in main().
2017-10-30 15:59:05 +01:00
Jan Alexander Steffens (heftig)
ddd508efc0 makechrootpkg: Reopen console to assign the CTTY
nspawn does not give us a controlling terminal, hence we ignore
interrupts. Apparently this was lost in systemd at some point.

Hack around this by reopening the console to make it the controlling
terminal.
2017-09-14 23:33:47 +02:00
Jan Alexander Steffens (heftig)
0f3778c3d3 makechrootpkg: Prevent collecting coredumps
Coredumps from build chroots are not generally useful. Prevent
them from being generated.

Avoids a lot of annoyance from the GCC testsuite spawning lots of
systemd-coredump processes.

Just set the soft limit so the user can still raise it in the PKGBUILD
if they insist.
2017-09-14 23:31:36 +02:00
Jan Alexander Steffens (heftig)
6b55282bd7 Revert "arch-nspawn: Hack to give the inner process a controlling terminal"
Whoops, this will of course mess with nspawn arguments passed to
arch-nspawn.
2017-09-13 00:25:06 +02:00
Jan Alexander Steffens (heftig)
6a7dcdeff9 arch-nspawn: Hack to give the inner process a controlling terminal
This was lost at some point.
2017-09-13 00:17:49 +02:00
Jan Alexander Steffens (heftig)
cd500d161f arch-nspawn: Pass --as-pid2
As not all commands we run are capable of reaping processes correctly.
For example, pacman is not.
2017-09-12 23:27:07 +02:00
Sébastien Luttringer
5ebb9c16c0 Version 20170911 2017-09-11 21:26:07 +02:00
Sébastien Luttringer
fecf107c37 arch-nspawn: Force PATH to be the Arch default
systemd-nspawn use a default environ PATH value of:
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

Since filesystem 2017.08, this is no more overrided by /etc/profile
to the Arch default:
PATH=/usr/local/sbin:/usr/local/bin:/usr/bin
2017-09-11 21:21:51 +02:00
10 changed files with 78 additions and 314 deletions

View File

@@ -1,4 +1,4 @@
V=20170813 V=20171108
PREFIX = /usr/local PREFIX = /usr/local
@@ -19,7 +19,6 @@ BINPROGS = \
makechrootpkg makechrootpkg
CONFIGFILES = \ CONFIGFILES = \
makepkg-i686.conf \
makepkg-x86_64.conf \ makepkg-x86_64.conf \
pacman-extra.conf \ pacman-extra.conf \
pacman-testing.conf \ pacman-testing.conf \
@@ -32,7 +31,6 @@ CONFIGFILES = \
COMMITPKG_LINKS = \ COMMITPKG_LINKS = \
extrapkg \ extrapkg \
corepkg \
testingpkg \ testingpkg \
stagingpkg \ stagingpkg \
communitypkg \ communitypkg \
@@ -45,18 +43,13 @@ COMMITPKG_LINKS = \
gnome-unstablepkg gnome-unstablepkg
ARCHBUILD_LINKS = \ ARCHBUILD_LINKS = \
extra-i686-build \
extra-x86_64-build \ extra-x86_64-build \
testing-i686-build \
testing-x86_64-build \ testing-x86_64-build \
staging-i686-build \
staging-x86_64-build \ staging-x86_64-build \
multilib-build \ multilib-build \
multilib-testing-build \ multilib-testing-build \
multilib-staging-build \ multilib-staging-build \
kde-unstable-i686-build \
kde-unstable-x86_64-build \ kde-unstable-x86_64-build \
gnome-unstable-i686-build \
gnome-unstable-x86_64-build gnome-unstable-x86_64-build
CROSSREPOMOVE_LINKS = \ CROSSREPOMOVE_LINKS = \

View File

@@ -58,8 +58,9 @@ else
cache_dirs=("$cache_dir") cache_dirs=("$cache_dir")
fi fi
pacconf_cmd=$(command -v pacman-conf || command -v pacconf)
# shellcheck disable=2016 # shellcheck disable=2016
host_mirror=$(pacman --cachedir /doesnt/exist -Sddp extra/devtools 2>/dev/null | sed -r 's#(.*/)extra/os/.*#\1$repo/os/$arch#') host_mirror=$($pacconf_cmd --repo extra Server 2> /dev/null | head -1 | sed -r 's#(.*/)extra/os/.*#\1$repo/os/$arch#')
# shellcheck disable=2016 # shellcheck disable=2016
[[ $host_mirror == *file://* ]] && host_mirror_path=$(echo "$host_mirror" | sed -r 's#file://(/.*)/\$repo/os/\$arch#\1#g') [[ $host_mirror == *file://* ]] && host_mirror_path=$(echo "$host_mirror" | sed -r 's#file://(/.*)/\$repo/os/\$arch#\1#g')
@@ -91,7 +92,7 @@ copy_hostconf () {
cp -T "$file" "$working_dir$file" cp -T "$file" "$working_dir$file"
done done
sed -r "s|^#?\\s*CacheDir.+|CacheDir = $(echo -n "${cache_dirs[@]}")|g" -i "$working_dir/etc/pacman.conf" sed -r "s|^#?\\s*CacheDir.+|CacheDir = ${cache_dirs[*]}|g" -i "$working_dir/etc/pacman.conf"
} }
# }}} # }}}
@@ -107,12 +108,13 @@ fi
build_mount_args build_mount_args
copy_hostconf copy_hostconf
eval "$(grep '^CARCH=' "$working_dir/etc/makepkg.conf")" eval "$(grep -a '^CARCH=' "$working_dir/etc/makepkg.conf")"
[[ -z $nosetarch ]] || unset CARCH [[ -z $nosetarch ]] || unset CARCH
exec ${CARCH:+setarch "$CARCH"} systemd-nspawn -q \ exec ${CARCH:+setarch "$CARCH"} systemd-nspawn -q \
-D "$working_dir" \ -D "$working_dir" \
--register=no --keep-unit \ -E "PATH=/usr/local/sbin:/usr/local/bin:/usr/bin" \
--register=no --keep-unit --as-pid2 \
"${mount_args[@]}" \ "${mount_args[@]}" \
"$@" "$@"

View File

@@ -39,7 +39,7 @@ while getopts 'hcr:' arg; do
esac esac
done done
check_root check_root SOURCE_DATE_EPOCH
# Pass all arguments after -- right to makepkg # Pass all arguments after -- right to makepkg
makechrootpkg_args+=("${@:$OPTIND}") makechrootpkg_args+=("${@:$OPTIND}")
@@ -74,5 +74,10 @@ else
pacman -Syu --noconfirm || abort pacman -Syu --noconfirm || abort
fi fi
# Always build official packages reproducibly
if [[ ! -v SOURCE_DATE_EPOCH ]]; then
export SOURCE_DATE_EPOCH=$(date +%s)
fi
msg "Building in chroot for [%s] (%s)..." "${repo}" "${arch}" msg "Building in chroot for [%s] (%s)..." "${repo}" "${arch}"
exec makechrootpkg -r "${chroots}/${repo}-${arch}" "${makechrootpkg_args[@]}" exec makechrootpkg -r "${chroots}/${repo}-${arch}" "${makechrootpkg_args[@]}"

View File

@@ -189,12 +189,11 @@ if [[ ${#uploads[*]} -gt 0 ]]; then
fi fi
if [[ "${arch[*]}" == 'any' ]]; then if [[ "${arch[*]}" == 'any' ]]; then
if [[ -d ../repos/$repo-i686 && -d ../repos/$repo-x86_64 ]]; then if [[ -d ../repos/$repo-x86_64 ]]; then
pushd ../repos/ >/dev/null pushd ../repos/ >/dev/null
stat_busy "Removing %s and %s" "$repo-i686" "$repo-x86_64" stat_busy "Removing %s" "$repo-x86_64"
svn rm -q "$repo-i686"
svn rm -q "$repo-x86_64" svn rm -q "$repo-x86_64"
svn commit -q -m "Removed $repo-i686 and $repo-x86_64 for $pkgname" svn commit -q -m "Removed $repo-x86_64 for $pkgname"
stat_done stat_done
popd >/dev/null popd >/dev/null
fi fi

View File

@@ -6,13 +6,15 @@
CHROOT_VERSION='v4' CHROOT_VERSION='v4'
## ##
# usage : check_root # usage : check_root $keepenv
## ##
orig_argv=("$0" "$@") orig_argv=("$0" "$@")
check_root() { check_root() {
local keepenv=$1
(( EUID == 0 )) && return (( EUID == 0 )) && return
if type -P sudo >/dev/null; then if type -P sudo >/dev/null; then
exec sudo -- "${orig_argv[@]}" exec sudo --preserve-env=$keepenv -- "${orig_argv[@]}"
else else
exec su root -c "$(printf ' %q' "${orig_argv[@]}")" exec su root -c "$(printf ' %q' "${orig_argv[@]}")"
fi fi

View File

@@ -4,7 +4,12 @@
# License: Unspecified # License: Unspecified
[[ -z ${_INCLUDE_COMMON_SH:-} ]] || return 0 [[ -z ${_INCLUDE_COMMON_SH:-} ]] || return 0
_INCLUDE_COMMON_SH=true _INCLUDE_COMMON_SH="$(set +o|grep nounset)"
set +u +o posix
# shellcheck disable=1091
. /usr/share/makepkg/util.sh
$_INCLUDE_COMMON_SH
# Avoid any encoding problems # Avoid any encoding problems
export LANG=C export LANG=C
@@ -12,56 +17,12 @@ export LANG=C
shopt -s extglob shopt -s extglob
# check if messages are to be printed using color # check if messages are to be printed using color
declare ALL_OFF='' BOLD='' BLUE='' GREEN='' RED='' YELLOW=''
if [[ -t 2 ]]; then if [[ -t 2 ]]; then
# prefer terminal safe colored and bold text when tput is supported colorize
if tput setaf 0 &>/dev/null; then else
ALL_OFF="$(tput sgr0)" # shellcheck disable=2034
BOLD="$(tput bold)" declare -gr ALL_OFF='' BOLD='' BLUE='' GREEN='' RED='' YELLOW=''
BLUE="${BOLD}$(tput setaf 4)"
GREEN="${BOLD}$(tput setaf 2)"
RED="${BOLD}$(tput setaf 1)"
YELLOW="${BOLD}$(tput setaf 3)"
else
ALL_OFF="\e[1;0m"
BOLD="\e[1;1m"
BLUE="${BOLD}\e[1;34m"
GREEN="${BOLD}\e[1;32m"
RED="${BOLD}\e[1;31m"
YELLOW="${BOLD}\e[1;33m"
fi
fi fi
readonly ALL_OFF BOLD BLUE GREEN RED YELLOW
plain() {
local mesg=$1; shift
# shellcheck disable=2059
printf "${BOLD} ${mesg}${ALL_OFF}\n" "$@" >&2
}
msg() {
local mesg=$1; shift
# shellcheck disable=2059
printf "${GREEN}==>${ALL_OFF}${BOLD} ${mesg}${ALL_OFF}\n" "$@" >&2
}
msg2() {
local mesg=$1; shift
# shellcheck disable=2059
printf "${BLUE} ->${ALL_OFF}${BOLD} ${mesg}${ALL_OFF}\n" "$@" >&2
}
warning() {
local mesg=$1; shift
# shellcheck disable=2059
printf "${YELLOW}==> WARNING:${ALL_OFF}${BOLD} ${mesg}${ALL_OFF}\n" "$@" >&2
}
error() {
local mesg=$1; shift
# shellcheck disable=2059
printf "${RED}==> ERROR:${ALL_OFF}${BOLD} ${mesg}${ALL_OFF}\n" "$@" >&2
}
stat_busy() { stat_busy() {
local mesg=$1; shift local mesg=$1; shift
@@ -110,51 +71,6 @@ die() {
cleanup 255 cleanup 255
} }
##
# usage : in_array( $needle, $haystack )
# return : 0 - found
# 1 - not found
##
in_array() {
local needle=$1; shift
local item
for item in "$@"; do
[[ $item = "$needle" ]] && return 0 # Found
done
return 1 # Not Found
}
##
# usage : get_full_version( [$pkgname] )
# return : full version spec, including epoch (if necessary), pkgver, pkgrel
##
get_full_version() {
# set defaults if they weren't specified in buildfile
local pkgbase=${pkgbase:-${pkgname[0]}}
local epoch=${epoch:-0}
local pkgver=${pkgver}
local pkgrel=${pkgrel}
if [[ -z $1 ]]; then
if (( ! epoch )); then
printf '%s\n' "$pkgver-$pkgrel"
else
printf '%s\n' "$epoch:$pkgver-$pkgrel"
fi
else
local pkgver_override='' pkgrel_override='' epoch_override=''
for i in pkgver pkgrel epoch; do
local indirect="${i}_override"
eval "$(declare -f "package_$1" | sed -n "s/\(^[[:space:]]*$i=\)/${i}_override=/p")"
[[ -z ${!indirect} ]] && eval ${indirect}=\"${!i}\"
done
if (( ! epoch_override )); then
printf '%s\n' "$pkgver_override-$pkgrel_override"
else
printf '%s\n' "$epoch_override:$pkgver_override-$pkgrel_override"
fi
fi
}
## ##
# usage : lock( $fd, $file, $message, [ $message_arguments... ] ) # usage : lock( $fd, $file, $message, [ $message_arguments... ] )
## ##

View File

@@ -4,23 +4,22 @@
# shellcheck disable=2034 # shellcheck disable=2034
_arch=( _arch=(
i686
x86_64 x86_64
any any
) )
# shellcheck disable=2034 # shellcheck disable=2034
_tags=( _tags=(
core-i686 core-x86_64 core-any core-x86_64 core-any
extra-i686 extra-x86_64 extra-any extra-x86_64 extra-any
multilib-x86_64 multilib-x86_64
staging-i686 staging-x86_64 staging-any staging-x86_64 staging-any
testing-i686 testing-x86_64 testing-any testing-x86_64 testing-any
multilib-testing-x86_64 multilib-testing-x86_64
multilib-staging-x86_64 multilib-staging-x86_64
community-i686 community-x86_64 community-any community-x86_64 community-any
community-staging-i686 community-staging-x86_64 community-staging-any community-staging-x86_64 community-staging-any
community-testing-i686 community-testing-x86_64 community-testing-any community-testing-x86_64 community-testing-any
kde-unstable-i686 kde-unstable-x86_64 kde-unstable-any kde-unstable-x86_64 kde-unstable-any
gnome-unstable-i686 gnome-unstable-x86_64 gnome-unstable-any gnome-unstable-x86_64 gnome-unstable-any
) )

View File

@@ -15,29 +15,6 @@ m4_include(lib/archroot.sh)
shopt -s nullglob shopt -s nullglob
init_variables() {
default_makepkg_args=(--syncdeps --noconfirm --log --holdver --skipinteg)
makepkg_args=("${default_makepkg_args[@]}")
keepbuilddir=false
update_first=false
clean_first=false
run_namcap=false
temp_chroot=false
chrootdir=
passeddir=
makepkg_user=
declare -ga install_pkgs
declare -gi ret=0
bindmounts_ro=()
bindmounts_rw=()
copy=$USER
[[ -n ${SUDO_USER:-} ]] && copy=$SUDO_USER
[[ -z "$copy" || $copy = root ]] && copy=copy
src_owner=${SUDO_USER:-$USER}
}
usage() { usage() {
echo "Usage: ${0##*/} [options] -r <chrootdir> [--] [makepkg args]" echo "Usage: ${0##*/} [options] -r <chrootdir> [--] [makepkg args]"
echo ' Run this script in a PKGBUILD dir to build a package inside a' echo ' Run this script in a PKGBUILD dir to build a package inside a'
@@ -92,7 +69,7 @@ load_vars() {
[[ -f $makepkg_conf ]] || return 1 [[ -f $makepkg_conf ]] || return 1
for var in {SRC,SRCPKG,PKG,LOG}DEST MAKEFLAGS PACKAGER; do for var in {SRC,SRCPKG,PKG,LOG}DEST MAKEFLAGS PACKAGER; do
[[ -z ${!var:-} ]] && eval "$(grep "^${var}=" "$makepkg_conf")" [[ -z ${!var:-} ]] && eval "$(grep -a "^${var}=" "$makepkg_conf")"
done done
return 0 return 0
@@ -188,7 +165,7 @@ prepare_chroot() {
local keepbuilddir=$3 local keepbuilddir=$3
local run_namcap=$4 local run_namcap=$4
$keepbuilddir || rm -rf "$copydir/build" [[ $keepbuilddir = true ]] || rm -rf "$copydir/build"
local builduser_uid builduser_gid local builduser_uid builduser_gid
builduser_uid="${SUDO_UID:-$UID}" builduser_uid="${SUDO_UID:-$UID}"
@@ -199,16 +176,12 @@ prepare_chroot() {
# We can't use useradd without chrooting, otherwise it invokes PAM modules # We can't use useradd without chrooting, otherwise it invokes PAM modules
# which we might not be able to load (i.e. when building i686 packages on # which we might not be able to load (i.e. when building i686 packages on
# an x86_64 host). # an x86_64 host).
sed -e '/^builduser:/d' -i "$copydir"/etc/{passwd,group} sed -e '/^builduser:/d' -i "$copydir"/etc/{passwd,shadow,group}
printf >>"$copydir/etc/group" 'builduser:x:%d:\n' "$builduser_gid" printf >>"$copydir/etc/group" 'builduser:x:%d:\n' "$builduser_gid"
printf >>"$copydir/etc/passwd" 'builduser:x:%d:%d:builduser:/build:/bin/bash\n' "$builduser_uid" "$builduser_gid" printf >>"$copydir/etc/passwd" 'builduser:x:%d:%d:builduser:/build:/bin/bash\n' "$builduser_uid" "$builduser_gid"
printf >>"$copydir/etc/shadow" 'builduser:!!:%d::::::\n' "$(( $(date -u +%s) / 86400 ))"
$install -d "$copydir"/{build,build/.gnupg,startdir,{pkg,srcpkg,src,log}dest} $install -d "$copydir"/{build,startdir,{pkg,srcpkg,src,log}dest}
for x in .gnupg/pubring.{kbx,gpg}; do
[[ -r $USER_HOME/$x ]] || continue
$install -m 644 "$USER_HOME/$x" "$copydir/build/$x"
done
sed -e '/^MAKEFLAGS=/d' -e '/^PACKAGER=/d' -i "$copydir/etc/makepkg.conf" sed -e '/^MAKEFLAGS=/d' -e '/^PACKAGER=/d' -i "$copydir/etc/makepkg.conf"
for x in BUILDDIR=/build PKGDEST=/pkgdest SRCPKGDEST=/srcpkgdest SRCDEST=/srcdest LOGDEST=/logdest \ for x in BUILDDIR=/build PKGDEST=/pkgdest SRCPKGDEST=/srcpkgdest SRCDEST=/srcdest LOGDEST=/logdest \
@@ -228,9 +201,10 @@ EOF
{ {
printf '#!/bin/bash\n' printf '#!/bin/bash\n'
declare -f _chrootbuild declare -f _chrootbuild
declare -p SOURCE_DATE_EPOCH 2>/dev/null || true
printf '_chrootbuild "$@" || exit\n' printf '_chrootbuild "$@" || exit\n'
if $run_namcap; then if [[ $run_namcap = true ]]; then
declare -f _chrootnamcap declare -f _chrootnamcap
printf '_chrootnamcap || exit\n' printf '_chrootnamcap || exit\n'
fi fi
@@ -241,13 +215,17 @@ EOF
# These functions aren't run in makechrootpkg, # These functions aren't run in makechrootpkg,
# so no global variables # so no global variables
_chrootbuild() { _chrootbuild() {
# No coredumps
ulimit -c 0
# shellcheck source=/dev/null # shellcheck source=/dev/null
. /etc/profile . /etc/profile
# Beware, there are some stupid arbitrary rules on how you can # Beware, there are some stupid arbitrary rules on how you can
# use "$" in arguments to commands with "sudo -i". ${foo} or # use "$" in arguments to commands with "sudo -i". ${foo} or
# ${1} is OK, but $foo or $1 isn't. # ${1} is OK, but $foo or $1 isn't.
# https://bugzilla.sudo.ws/show_bug.cgi?id=765 # https://bugzilla.sudo.ws/show_bug.cgi?id=765
sudo -iu builduser bash -c 'cd /startdir; makepkg "$@"' -bash "$@" sudo --preserve-env=SOURCE_DATE_EPOCH -iu builduser bash -c 'cd /startdir; makepkg "$@"' -bash "$@"
} }
_chrootnamcap() { _chrootnamcap() {
@@ -261,17 +239,17 @@ _chrootnamcap() {
# Usage: download_sources $copydir $makepkg_user # Usage: download_sources $copydir $makepkg_user
# Globals: # Globals:
# - SRCDEST # - SRCDEST
# - USER
download_sources() { download_sources() {
local copydir=$1 local copydir=$1
local makepkg_user=$2 local makepkg_user=$2
local builddir local builddir
builddir="$(mktemp -d)" builddir="$(mktemp -d)"
chmod 1777 "$builddir" chown "$makepkg_user:" "$builddir"
# Ensure sources are downloaded # Ensure sources are downloaded
sudo -u "$makepkg_user" env SRCDEST="$SRCDEST" BUILDDIR="$builddir" \ sudo -u "$makepkg_user" --preserve-env=GNUPGHOME \
env SRCDEST="$SRCDEST" BUILDDIR="$builddir" \
makepkg --config="$copydir/etc/makepkg.conf" --verifysource -o || makepkg --config="$copydir/etc/makepkg.conf" --verifysource -o ||
die "Could not download sources." die "Could not download sources."
@@ -283,6 +261,7 @@ download_sources() {
# Globals: # Globals:
# - PKGDEST # - PKGDEST
# - LOGDEST # - LOGDEST
# - SRCPKGDEST
move_products() { move_products() {
local copydir=$1 local copydir=$1
local src_owner=$2 local src_owner=$2
@@ -318,7 +297,26 @@ move_products() {
# }}} # }}}
main() { main() {
init_variables default_makepkg_args=(--syncdeps --noconfirm --log --holdver --skipinteg)
makepkg_args=("${default_makepkg_args[@]}")
keepbuilddir=false
update_first=false
clean_first=false
run_namcap=false
temp_chroot=false
chrootdir=
passeddir=
makepkg_user=
declare -a install_pkgs
declare -i ret=0
bindmounts_ro=()
bindmounts_rw=()
copy=$USER
[[ -n ${SUDO_USER:-} ]] && copy=$SUDO_USER
[[ -z "$copy" || $copy = root ]] && copy=copy
src_owner=${SUDO_USER:-$USER}
while getopts 'hcur:I:l:nTD:d:U:' arg; do while getopts 'hcur:I:l:nTD:d:U:' arg; do
case "$arg" in case "$arg" in
@@ -340,7 +338,7 @@ main() {
[[ -n $makepkg_user && -z $(id -u "$makepkg_user") ]] && die 'Invalid makepkg user.' [[ -n $makepkg_user && -z $(id -u "$makepkg_user") ]] && die 'Invalid makepkg user.'
makepkg_user=${makepkg_user:-${SUDO_USER:-$USER}} makepkg_user=${makepkg_user:-${SUDO_USER:-$USER}}
check_root check_root SOURCE_DATE_EPOCH,GNUPGHOME
# Canonicalize chrootdir, getting rid of trailing / # Canonicalize chrootdir, getting rid of trailing /
chrootdir=$(readlink -e "$passeddir") chrootdir=$(readlink -e "$passeddir")
@@ -408,7 +406,7 @@ main() {
download_sources "$copydir" "$makepkg_user" download_sources "$copydir" "$makepkg_user"
prepare_chroot "$copydir" "$USER_HOME" "$keepbuilddir" prepare_chroot "$copydir" "$USER_HOME" "$keepbuilddir" "$run_namcap"
if arch-nspawn "$copydir" \ if arch-nspawn "$copydir" \
--bind="$PWD:/startdir" \ --bind="$PWD:/startdir" \

View File

@@ -1,150 +0,0 @@
#!/hint/bash
# shellcheck disable=2034
#
# /etc/makepkg.conf
#
#########################################################################
# SOURCE ACQUISITION
#########################################################################
#
#-- The download utilities that makepkg should use to acquire sources
# Format: 'protocol::agent'
DLAGENTS=('ftp::/usr/bin/curl -fC - --ftp-pasv --retry 3 --retry-delay 3 -o %o %u'
'http::/usr/bin/curl -fLC - --retry 3 --retry-delay 3 -o %o %u'
'https::/usr/bin/curl -fLC - --retry 3 --retry-delay 3 -o %o %u'
'rsync::/usr/bin/rsync --no-motd -z %u %o'
'scp::/usr/bin/scp -C %u %o')
# Other common tools:
# /usr/bin/snarf
# /usr/bin/lftpget -c
# /usr/bin/wget
#-- The package required by makepkg to download VCS sources
# Format: 'protocol::package'
VCSCLIENTS=('bzr::bzr'
'git::git'
'hg::mercurial'
'svn::subversion')
#########################################################################
# ARCHITECTURE, COMPILE FLAGS
#########################################################################
#
CARCH="i686"
CHOST="i686-pc-linux-gnu"
#-- Compiler and Linker Flags
# -march (or -mcpu) builds exclusively for an architecture
# -mtune optimizes for an architecture, but builds for whole processor family
CPPFLAGS="-D_FORTIFY_SOURCE=2"
CFLAGS="-march=i686 -mtune=generic -O2 -pipe -fstack-protector-strong -fno-plt"
CXXFLAGS="-march=i686 -mtune=generic -O2 -pipe -fstack-protector-strong -fno-plt"
LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
#-- Make Flags: change this for DistCC/SMP systems
#MAKEFLAGS="-j2"
#-- Debugging flags
DEBUG_CFLAGS="-g -fvar-tracking-assignments"
DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
#########################################################################
# BUILD ENVIRONMENT
#########################################################################
#
# Defaults: BUILDENV=(!distcc color !ccache check !sign)
# A negated environment option will do the opposite of the comments below.
#
#-- distcc: Use the Distributed C/C++/ObjC compiler
#-- color: Colorize output messages
#-- ccache: Use ccache to cache compilation
#-- check: Run the check() function if present in the PKGBUILD
#-- sign: Generate PGP signature file
#
BUILDENV=(!distcc color !ccache check !sign)
#
#-- If using DistCC, your MAKEFLAGS will also need modification. In addition,
#-- specify a space-delimited list of hosts running in the DistCC cluster.
#DISTCC_HOSTS=""
#
#-- Specify a directory for package building.
#BUILDDIR=/tmp/makepkg
#########################################################################
# GLOBAL PACKAGE OPTIONS
# These are default values for the options=() settings
#########################################################################
#
# Default: OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !optipng !upx !debug)
# A negated option will do the opposite of the comments below.
#
#-- strip: Strip symbols from binaries/libraries
#-- docs: Save doc directories specified by DOC_DIRS
#-- libtool: Leave libtool (.la) files in packages
#-- staticlibs: Leave static library (.a) files in packages
#-- emptydirs: Leave empty directories in packages
#-- zipman: Compress manual (man and info) pages in MAN_DIRS with gzip
#-- purge: Remove files specified by PURGE_TARGETS
#-- upx: Compress binary executable files using UPX
#-- optipng: Optimize PNG images with optipng
#-- debug: Add debugging flags as specified in DEBUG_* variables
#
OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !optipng !upx !debug)
#-- File integrity checks to use. Valid: md5, sha1, sha256, sha384, sha512
INTEGRITY_CHECK=(md5)
#-- Options to be used when stripping binaries. See `man strip' for details.
STRIP_BINARIES="--strip-all"
#-- Options to be used when stripping shared libraries. See `man strip' for details.
STRIP_SHARED="--strip-unneeded"
#-- Options to be used when stripping static libraries. See `man strip' for details.
STRIP_STATIC="--strip-debug"
#-- Manual (man and info) directories to compress (if zipman is specified)
MAN_DIRS=({usr{,/local}{,/share},opt/*}/{man,info})
#-- Doc directories to remove (if !docs is specified)
DOC_DIRS=(usr/{,local/}{,share/}{doc,gtk-doc} opt/*/{doc,gtk-doc})
#-- Files to be removed from all packages (if purge is specified)
PURGE_TARGETS=(usr/{,share}/info/dir .packlist *.pod)
#########################################################################
# PACKAGE OUTPUT
#########################################################################
#
# Default: put built package and cached source in build directory
#
#-- Destination: specify a fixed directory where all packages will be placed
#PKGDEST=/home/packages
#-- Source cache: specify a fixed directory where source files will be cached
#SRCDEST=/home/sources
#-- Source packages: specify a fixed directory where all src packages will be placed
#SRCPKGDEST=/home/srcpackages
#-- Log files: specify a fixed directory where all log files will be placed
#LOGDEST=/home/makepkglogs
#-- Packager: name/email of the person or organization building packages
#PACKAGER="John Doe <john@doe.com>"
#-- Specify a key to use for package signing
#GPGKEY=""
#########################################################################
# COMPRESSION DEFAULTS
#########################################################################
#
COMPRESSGZ=(gzip -c -f -n)
COMPRESSBZ2=(bzip2 -c -f)
COMPRESSXZ=(xz -c -z -)
COMPRESSLRZ=(lrzip -q)
COMPRESSLZO=(lzop -q)
COMPRESSZ=(compress -c -f)
#########################################################################
# EXTENSION DEFAULTS
#########################################################################
#
# WARNING: Do NOT modify these variables unless you know what you are
# doing.
#
PKGEXT='.pkg.tar.xz'
SRCEXT='.src.tar.gz'
# vim: set ft=sh ts=2 sw=2 et:

View File

@@ -1,4 +1,4 @@
#compdef archbuild archco arch-nspawn archrelease archrm commitpkg finddeps makechrootpkg mkarchroot rebuildpkgs extrapkg=commitpkg corepkg=commitpkg testingpkg=commitpkg stagingpkg=commitpkg communitypkg=commitpkg community-testingpkg=commitpkg community-stagingpkg=commitpkg multilibpkg=commitpkg multilib-testingpkg=commitpkg extra-i686-build=archbuild extra-x86_64-build=archbuild testing-i686-build=archbuild testing-x86_64-build=archbuild staging-i686-build=archbuild staging-x86_64-build=archbuild multilib-build=archbuild multilib-testing-build=archbuild multilib-staging-build=archbuild kde-unstable-i686-build=archbuild kde-unstable-x86_64-build=archbuild gnome-unstable-i686-build=archbuild gnome-unstable-x86_64-build=archbuild communityco=archco #compdef archbuild archco arch-nspawn archrelease archrm commitpkg finddeps makechrootpkg mkarchroot rebuildpkgs extrapkg=commitpkg corepkg=commitpkg testingpkg=commitpkg stagingpkg=commitpkg communitypkg=commitpkg community-testingpkg=commitpkg community-stagingpkg=commitpkg multilibpkg=commitpkg multilib-testingpkg=commitpkg extra-x86_64-build=archbuild testing-x86_64-build=archbuild staging-x86_64-build=archbuild multilib-build=archbuild multilib-testing-build=archbuild multilib-staging-build=archbuild kde-unstable-x86_64-build=archbuild gnome-unstable-x86_64-build=archbuild communityco=archco
# License: Unspecified # License: Unspecified
m4_include(lib/valid-tags.sh) m4_include(lib/valid-tags.sh)