mirror of
https://gitlab.archlinux.org/archlinux/archlinux-docker.git
synced 2025-08-07 06:37:23 +02:00
f737d64397
Embedding one pieces of code into another (shell script into a makefiles in this case) is rarely pretty. Split things up, as appropriate. While here, simplify the rootfs in a few ways: - pass only the extra non-base (and effectively group name) package - add a handy variable for the fakeroot/fakechroot combo - split and rewrap long lines As a bonus point, this makes it easier to use pattern rules in the makefile - which will be handy for the upcoming multilib-devel group/target. Plus we can check the scripts via shellcheck/etc CI stage, as follow-up. Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
58 lines
1.7 KiB
Bash
Executable File
58 lines
1.7 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
declare -r WRAPPER="fakechroot -- fakeroot"
|
|
|
|
declare -r GROUP="$1"
|
|
declare -r BUILDDIR="$2"
|
|
declare -r OUTPUTDIR="$3"
|
|
|
|
mkdir -vp "$BUILDDIR/alpm-hooks/usr/share/libalpm/hooks"
|
|
find /usr/share/libalpm/hooks -exec ln -sf /dev/null "$BUILDDIR/alpm-hooks"{} \;
|
|
|
|
mkdir -vp "$BUILDDIR/var/lib/pacman/" "$OUTPUTDIR"
|
|
install -Dm644 /usr/share/devtools/pacman.conf.d/extra.conf "$BUILDDIR/etc/pacman.conf"
|
|
cat pacman-conf.d-noextract.conf >> "$BUILDDIR/etc/pacman.conf"
|
|
|
|
sed 's/Include = /&rootfs/g' < "$BUILDDIR/etc/pacman.conf" > pacman.conf
|
|
|
|
$WRAPPER -- \
|
|
pacman -Sy -r "$BUILDDIR" \
|
|
--noconfirm --dbpath "$BUILDDIR/var/lib/pacman" \
|
|
--config pacman.conf \
|
|
--noscriptlet \
|
|
--hookdir "$BUILDDIR/alpm-hooks/usr/share/libalpm/hooks/" base "$GROUP"
|
|
|
|
cp --recursive --preserve=timestamps rootfs/* "$BUILDDIR/"
|
|
|
|
$WRAPPER -- chroot "$BUILDDIR" update-ca-trust
|
|
$WRAPPER -- chroot "$BUILDDIR" pacman-key --init
|
|
$WRAPPER -- chroot "$BUILDDIR" pacman-key --populate
|
|
|
|
rm -rf "$BUILDDIR/etc/pacman.d/gnupg/{openpgp-revocs.d/,private-keys-v1.d/,pubring.gpg~,gnupg.S.}*"
|
|
|
|
ln -fs /usr/lib/os-release "$BUILDDIR/etc/os-release"
|
|
|
|
# add system users
|
|
$WRAPPER -- chroot "$BUILDDIR" /usr/bin/systemd-sysusers --root "/"
|
|
|
|
# remove passwordless login for root (see CVE-2019-5021 for reference)
|
|
sed -i -e 's/^root::/root:!:/' "$BUILDDIR/etc/shadow"
|
|
|
|
# fakeroot to map the gid/uid of the builder process to root
|
|
# fixes #22
|
|
fakeroot -- \
|
|
tar \
|
|
--numeric-owner \
|
|
--xattrs \
|
|
--acls \
|
|
--exclude-from=exclude \
|
|
-C "$BUILDDIR" \
|
|
-c . \
|
|
-f "$OUTPUTDIR/$GROUP.tar"
|
|
|
|
cd "$OUTPUTDIR"
|
|
zstd --long -T0 -8 "$GROUP.tar"
|
|
sha256sum "$GROUP.tar.zst" > "$GROUP.tar.zst.SHA256"
|