-
Notifications
You must be signed in to change notification settings - Fork 115
/
build-image.sh
executable file
·318 lines (251 loc) · 11.5 KB
/
build-image.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
#! /bin/bash
set -e
set -x
if [ $EUID -ne 0 ]; then
echo "$(basename $0) must be run as root"
exit 1
fi
BUILD_USER=${BUILD_USER:-}
OUTPUT_DIR=${OUTPUT_DIR:-}
source manifest
if [ -z "${SYSTEM_NAME}" ]; then
echo "SYSTEM_NAME must be specified"
exit
fi
if [ -z "${VERSION}" ]; then
echo "VERSION must be specified"
exit
fi
DISPLAY_VERSION=${VERSION}
LSB_VERSION=${VERSION}
VERSION_NUMBER=${VERSION}
if [ -n "$1" ]; then
DISPLAY_VERSION="${VERSION} (${1})"
VERSION="${VERSION}_${1}"
LSB_VERSION="${LSB_VERSION} (${1})"
BUILD_ID="${1}"
fi
MOUNT_PATH=/tmp/${SYSTEM_NAME}-build
BUILD_PATH=${MOUNT_PATH}/subvolume
SNAP_PATH=${MOUNT_PATH}/${SYSTEM_NAME}-${VERSION}
BUILD_IMG=/output/${SYSTEM_NAME}-build.img
mkdir -p ${MOUNT_PATH}
fallocate -l ${SIZE} ${BUILD_IMG}
mkfs.btrfs -f ${BUILD_IMG}
mount -t btrfs -o loop,compress-force=zstd:15 ${BUILD_IMG} ${MOUNT_PATH}
btrfs subvolume create ${BUILD_PATH}
# copy the makepkg.conf into chroot
cp /etc/makepkg.conf rootfs/etc/makepkg.conf
# bootstrap using our configuration
pacstrap -K -C rootfs/etc/pacman.conf ${BUILD_PATH}
# copy the builder mirror list into chroot
mkdir -p rootfs/etc/pacman.d
cp /etc/pacman.d/mirrorlist rootfs/etc/pacman.d/mirrorlist
# copy files into chroot
cp -R manifest rootfs/. ${BUILD_PATH}/
mkdir ${BUILD_PATH}/own_pkgs
mkdir ${BUILD_PATH}/extra_pkgs
cp -rv aur-pkgs/*.pkg.tar* ${BUILD_PATH}/extra_pkgs
cp -rv pkgs/*.pkg.tar* ${BUILD_PATH}/own_pkgs
if [ -n "${PACKAGE_OVERRIDES}" ]; then
wget --directory-prefix=/tmp/extra_pkgs ${PACKAGE_OVERRIDES}
cp -rv /tmp/extra_pkgs/*.pkg.tar* ${BUILD_PATH}/own_pkgs
fi
# chroot into target
mount --bind ${BUILD_PATH} ${BUILD_PATH}
arch-chroot ${BUILD_PATH} /bin/bash <<EOF
set -e
set -x
# This will prevent frzr bootloader from erroring when installing kernels
# due to the pacman hook being executed at kernel-install time
export FRZR_IMAGE_GENERATION=1
source /manifest
pacman-key --populate
echo "LANG=en_US.UTF-8" > /etc/locale.conf
locale-gen
# Disable parallel downloads
sed -i '/ParallelDownloads/s/^/#/g' /etc/pacman.conf
# Cannot check space in chroot
sed -i '/CheckSpace/s/^/#/g' /etc/pacman.conf
# update package databases
pacman --noconfirm -Syy
# Avoid mkintcpio being auto-installed while installing the kernel (we want dracut)
pacman -S --noconfirm dracut
# install kernel package
if [ "$KERNEL_PACKAGE_ORIGIN" == "local" ] ; then
pacman --noconfirm -U --overwrite '*' \
/own_pkgs/${KERNEL_PACKAGE}-*.pkg.tar.zst
else
pacman --noconfirm -S "${KERNEL_PACKAGE}" "${KERNEL_PACKAGE}-headers"
fi
# install own override packages
pacman --noconfirm -U --overwrite '*' /own_pkgs/*
rm -rf /var/cache/pacman/pkg
# install packages
pacman --noconfirm -S --overwrite '*' --disable-download-timeout ${PACKAGES}
rm -rf /var/cache/pacman/pkg
# install AUR packages
pacman --noconfirm -U --overwrite '*' /extra_pkgs/*
rm -rf /var/cache/pacman/pkg
# Install the new iptables
# See https://gitlab.archlinux.org/archlinux/packaging/packages/iptables/-/issues/1
# Since base package group adds iptables by default
# pacman will ask for confirmation to replace that package
# but the default answer is no.
# doing yes | pacman omitting --noconfirm is a necessity
yes | pacman -S iptables-nft
# enable services
systemctl enable ${SERVICES}
# enable user services
systemctl --global enable ${USER_SERVICES}
# disable root login
passwd --lock root
# add root to the frzr group
sudo usermod -a -G frzr root
# create user
groupadd -r autologin
useradd -m ${USERNAME} -G autologin,wheel,plugdev,frzr
echo "${USERNAME}:${USERNAME}" | chpasswd
# set the default editor, so visudo works
echo "export EDITOR=/usr/bin/vim" >> /etc/bash.bashrc
echo "[Seat:*]
autologin-user=${USERNAME}
" > /etc/lightdm/lightdm.conf.d/00-autologin-user.conf
echo "${SYSTEM_NAME}" > /etc/hostname
# enable multicast dns in avahi
sed -i "/^hosts:/ s/resolve/mdns resolve/" /etc/nsswitch.conf
# configure ssh
echo "
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM yes
PrintMotd no # pam does that
Subsystem sftp /usr/lib/ssh/sftp-server
" > /etc/ssh/sshd_config
# Write the fstab file
# NOTE: gid=379 is the group ID of the frzr group
# WARNING: mounting partitions using LABEL exposes us to a bug where multiple disks cannot have frzr systems and how to solve this still is an open question
echo "
LABEL=frzr_efi /efi vfat uid=0,gid=379,fmask=0077,dmask=0077,rw,noatime,nofail 0 2
LABEL=frzr_root /frzr_root btrfs defaults,x-initrd.mount,subvolid=5,rw,noatime,nodatacow 0 2
LABEL=frzr_root /home btrfs defaults,x-systemd.rw-only,subvol=/home,rw,noatime,nodatacow,nofail 0 0
overlay /root overlay defaults,x-systemd.requires-mounts-for=/frzr_root,x-systemd.requires-mounts-for=/sysroot/frzr_root,x-initrd.mount,lowerdir=/sysroot/root,upperdir=/sysroot/frzr_root/deployments_data/${SYSTEM_NAME}-${VERSION}/root_overlay/upperdir,workdir=/sysroot/frzr_root/deployments_data/${SYSTEM_NAME}-${VERSION}/root_overlay/workdir,index=off,metacopy=off,xino=off,redirect_dir=off,comment=rootoverlay 0 0
overlay /boot overlay defaults,x-systemd.requires-mounts-for=/frzr_root,x-systemd.requires-mounts-for=/sysroot/frzr_root,x-initrd.mount,lowerdir=/sysroot/boot,upperdir=/sysroot/frzr_root/deployments_data/${SYSTEM_NAME}-${VERSION}/boot_overlay/upperdir,workdir=/sysroot/frzr_root/deployments_data/${SYSTEM_NAME}-${VERSION}/boot_overlay/workdir,index=off,metacopy=off,xino=off,redirect_dir=off,comment=bootoverlay 0 0
overlay /usr overlay defaults,x-systemd.requires-mounts-for=/frzr_root,x-systemd.requires-mounts-for=/sysroot/frzr_root,x-initrd.mount,lowerdir=/sysroot/usr,upperdir=/sysroot/frzr_root/deployments_data/${SYSTEM_NAME}-${VERSION}/usr_overlay/upperdir,workdir=/sysroot/frzr_root/deployments_data/${SYSTEM_NAME}-${VERSION}/usr_overlay/workdir,index=off,metacopy=off,xino=off,redirect_dir=off,comment=usroverlay 0 0
overlay /etc overlay defaults,x-systemd.requires-mounts-for=/frzr_root,x-systemd.requires-mounts-for=/sysroot/frzr_root,x-initrd.mount,x-systemd.rw-only,lowerdir=/sysroot/etc,upperdir=/sysroot/frzr_root/deployments_data/${SYSTEM_NAME}-${VERSION}/etc_overlay/upperdir,workdir=/sysroot/frzr_root/deployments_data/${SYSTEM_NAME}-${VERSION}/etc_overlay/workdir,index=off,metacopy=off,xino=off,redirect_dir=off,comment=etcoverlay 0 0
overlay /var overlay defaults,x-systemd.requires-mounts-for=/frzr_root,x-systemd.requires-mounts-for=/sysroot/frzr_root,x-initrd.mount,x-systemd.rw-only,lowerdir=/sysroot/var,upperdir=/sysroot/frzr_root/deployments_data/${SYSTEM_NAME}-${VERSION}/var_overlay/upperdir,workdir=/sysroot/frzr_root/deployments_data/${SYSTEM_NAME}-${VERSION}/var_overlay/workdir,index=off,metacopy=off,xino=off,redirect_dir=off,comment=varoverlay 0 0
" > /etc/fstab
echo "
LSB_VERSION=1.4
DISTRIB_ID=${SYSTEM_NAME}
DISTRIB_RELEASE=\"${LSB_VERSION}\"
DISTRIB_DESCRIPTION=${SYSTEM_DESC}
" > /etc/lsb-release
echo 'NAME="${SYSTEM_DESC}"
VERSION="${DISPLAY_VERSION}"
VERSION_ID="${VERSION_NUMBER}"
BUILD_ID="${BUILD_ID}"
PRETTY_NAME="${SYSTEM_DESC} ${DISPLAY_VERSION}"
ID=${SYSTEM_NAME}
ID_LIKE=arch
ANSI_COLOR="1;31"
HOME_URL="${WEBSITE}"
DOCUMENTATION_URL="${DOCUMENTATION_URL}"
BUG_REPORT_URL="${BUG_REPORT_URL}"' > /usr/lib/os-release
# install extra certificates
trust anchor --store /extra_certs/*.crt
# run post install hook
postinstallhook
# record installed packages & versions
pacman -Q > /manifest
# preserve installed package database
mkdir -p /usr/var/lib/
mv /var/lib/pacman /usr/var/lib/
# Remove the fallback: it is never used and takes up space
if [ -e "/boot/initramfs-${KERNEL_PACKAGE}-fallback.img" ]; then
rm "/boot/initramfs-${KERNEL_PACKAGE}-fallback.img"
fi
# Since frzr pre-v1.0.0 has an hardcoded cp of /boot/vmlinuz-linux and /boot/initramfs-linux.img
# create two empty files so that the cp command won't fail: these will be replaced by a migration hook.
#
# Note: The following is kept for compatibility with older frzr
# This can safely be removed when the compatibility with
# frzr pre-v1.0.0 will be dropped
if [ "${KERNEL_PACKAGE}" = "linux" ]; then
echo "Kernel is named 'linux' nothing to do."
else
touch /boot/vmlinuz-linux
touch /boot/initramfs-linux.img
fi
# clean up/remove unnecessary files
# Keep every file in /var except for logs (populated by GitHub CI)
# the pacman database: it was backed up to another location and
# will be restored by an unlock hook
rm -rf \
/own_pkgs \
/extra_pkgs \
/extra_certs \
/home \
/var/log \
/var/lib/pacman/local \
rm -rf ${FILES_TO_DELETE}
# create necessary directories
mkdir -p /home
mkdir -p /frzr_root
mkdir -p /efi
mkdir -p /var/log
EOF
#defrag the image
btrfs filesystem defragment -r ${BUILD_PATH}
# copy files into chroot again
cp -R rootfs/. ${BUILD_PATH}/
rm -rf ${BUILD_PATH}/extra_certs
echo "${SYSTEM_NAME}-${VERSION}" > ${BUILD_PATH}/build_info
echo "" >> ${BUILD_PATH}/build_info
cat ${BUILD_PATH}/manifest >> ${BUILD_PATH}/build_info
rm ${BUILD_PATH}/manifest
# freeze archive date of build to avoid package drift on unlock
# if no archive date is set
if [ -z "${ARCHIVE_DATE}" ]; then
export TODAY_DATE=$(date +%Y/%m/%d)
echo "Server=https://archive.archlinux.org/repos/${TODAY_DATE}/\$repo/os/\$arch" > \
${BUILD_PATH}/etc/pacman.d/mirrorlist
fi
btrfs subvolume snapshot -r ${BUILD_PATH} ${SNAP_PATH}
btrfs send -f ${SYSTEM_NAME}-${VERSION}.img ${SNAP_PATH}
cp ${BUILD_PATH}/build_info build_info.txt
# clean up
umount -l ${BUILD_PATH}
umount -l ${MOUNT_PATH}
rm -rf ${MOUNT_PATH}
rm -rf ${BUILD_IMG}
IMG_FILENAME="${SYSTEM_NAME}-${VERSION}.img.tar.xz"
if [ -z "${NO_COMPRESS}" ]; then
tar -c -I'xz -8 -T4' -f ${IMG_FILENAME} ${SYSTEM_NAME}-${VERSION}.img
rm ${SYSTEM_NAME}-${VERSION}.img
sha256sum ${SYSTEM_NAME}-${VERSION}.img.tar.xz > sha256sum.txt
cat sha256sum.txt
# Move the image to the output directory, if one was specified.
if [ -n "${OUTPUT_DIR}" ]; then
mkdir -p "${OUTPUT_DIR}"
mv ${IMG_FILENAME} ${OUTPUT_DIR}
mv build_info.txt ${OUTPUT_DIR}
mv sha256sum.txt ${OUTPUT_DIR}
fi
# set outputs for github actions
if [ -f "${GITHUB_OUTPUT}" ]; then
echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
echo "display_version=${DISPLAY_VERSION}" >> "${GITHUB_OUTPUT}"
echo "display_name=${SYSTEM_DESC}" >> "${GITHUB_OUTPUT}"
echo "image_filename=${IMG_FILENAME}" >> "${GITHUB_OUTPUT}"
else
echo "No github output file set"
fi
else
echo "Local build, output IMG directly"
if [ -n "${OUTPUT_DIR}" ]; then
mkdir -p "${OUTPUT_DIR}"
mv ${SYSTEM_NAME}-${VERSION}.img ${OUTPUT_DIR}
fi
fi