diff --git a/build_all.sh b/build_all.sh deleted file mode 100755 index 2ca6662820..0000000000 --- a/build_all.sh +++ /dev/null @@ -1,18 +0,0 @@ -#!/bin/bash - -# Copyright (c) 2009 The Chromium OS Authors. All rights reserved. -# Use of this source code is governed by a BSD-style license that can be -# found in the LICENSE file. - -# Simple script for building the entire system. - -# Die on error; print commands -set -e - -SCRIPTS_DIR=$(dirname $0) - -$SCRIPTS_DIR/build_platform_packages.sh -$SCRIPTS_DIR/build_tests.sh -$SCRIPTS_DIR/build_kernel.sh -$SCRIPTS_DIR/run_tests.sh -$SCRIPTS_DIR/build_image.sh --replace diff --git a/build_chrome.sh b/build_chrome.sh deleted file mode 100755 index c730214e6a..0000000000 --- a/build_chrome.sh +++ /dev/null @@ -1,101 +0,0 @@ -#!/bin/bash - -# Copyright (c) 2009 The Chromium OS Authors. All rights reserved. -# Use of this source code is governed by a BSD-style license that can be -# found in the LICENSE file. - -# Script for building our own custom Chrome - -# Load common constants. This should be the first executable line. -# The path to common.sh should be relative to your script's location. -. "$(dirname "$0")/common.sh" - -# Script must be run outside the chroot -assert_outside_chroot - -# This script defaults Chrome source is in ~/chrome -# You may override the Chrome source dir via the --chrome_dir option or by -# setting CHROMEOS_CHROME_DIR (for example, in ./.chromeos_dev) -DEFAULT_CHROME_DIR="${CHROMEOS_CHROME_DIR:-/home/$USER/chrome}" - -# The number of jobs to pass to tools that can run in parallel (such as make -# and dpkg-buildpackage -NUM_JOBS=`grep -c "^processor" /proc/cpuinfo` - -# Flags -DEFINE_string chrome_dir "$DEFAULT_CHROME_DIR" \ - "Directory to Chrome/Chromium source" -DEFINE_string mode "Release" \ - "The mode to build Chrome/Chromium in (Debug or Release)" -DEFINE_string num_jobs "$NUM_JOBS" \ - "The number of jobs to run in parallel" -DEFINE_boolean runhooks true \ - "Execute gclient runhooks before build (if norunhooks then chrome and official are ignored)" -DEFINE_boolean chrome false \ - "Builds a chrome branded version (requires src-internal)" -DEFINE_boolean official false \ - "Builds an official version (additional optimizations)" - -# Parse command line -FLAGS "$@" || exit 1 -eval set -- "${FLAGS_ARGV}" - -# Die on error; print commands -set -e - -# Convert args to paths. Need eval to un-quote the string so that shell -# chars like ~ are processed; just doing FOO=`readlink -f $FOO` won't work. -FLAGS_chrome_dir=`eval readlink -f $FLAGS_chrome_dir` - -# Build Chrome -echo Building Chrome in mode $FLAGS_mode -export GYP_GENERATORS="make" -export GYP_DEFINES="target_arch=ia32 chromeos=1" - -if [ $FLAGS_chrome -eq $FLAGS_TRUE ] -then - export GYP_DEFINES="${GYP_DEFINES} branding=Chrome ffmpeg_branding=Chrome" -fi - -if [ $FLAGS_official -eq $FLAGS_TRUE ] -then - export GYP_DEFINES="${GYP_DEFINES} buildtype=Official" -fi - -CHROME_DIR=$FLAGS_chrome_dir -cd "$CHROME_DIR/src" - -if [ $FLAGS_runhooks -eq $FLAGS_TRUE ] -then - gclient runhooks --force -fi - -make BUILDTYPE=$FLAGS_mode -j$FLAGS_num_jobs -r chrome candidate_window - -# Zip into chrome-chromeos.zip and put in local_assets -BUILD_DIR="$CHROME_DIR/src/out" -CHROME_LINUX_DIR="$BUILD_DIR/chrome-chromeos" -OUTPUT_DIR="${SRC_ROOT}/build/x86/local_assets" -OUTPUT_ZIP="$BUILD_DIR/chrome-chromeos.zip" -if [ -n "$OUTPUT_DIR" ] -then - mkdir -p $OUTPUT_DIR -fi -# create symlink so that we can create the zip file with prefix chrome-chromeos -rm -f $CHROME_LINUX_DIR -ln -s $BUILD_DIR/$FLAGS_mode $CHROME_LINUX_DIR - -echo Zipping $CHROME_LINUX_DIR to $OUTPUT_ZIP -cd $BUILD_DIR -rm -f $OUTPUT_ZIP -zip -r1 $OUTPUT_ZIP chrome-chromeos -i \ - "chrome-chromeos/chrome" \ - "chrome-chromeos/chrome.*" \ - "chrome-chromeos/chrome-*" \ - "chrome-chromeos/candidate_window" \ - "chrome-chromeos/libffmpegsumo.so" "chrome-chromeos/xdg-settings" \ - "chrome-chromeos/locales/*" "chrome-chromeos/resources/*" \ - "chrome-chromeos/*.png" "chrome-chromeos/session" \ - "chrome-chromeos/emit_login_prompt_ready" -x "*.d" -cp -f $OUTPUT_ZIP $OUTPUT_DIR -echo Done. diff --git a/build_image.sh b/build_image.sh deleted file mode 100755 index cfa29d1770..0000000000 --- a/build_image.sh +++ /dev/null @@ -1,201 +0,0 @@ -#!/bin/bash - -# Copyright (c) 2009 The Chromium OS Authors. All rights reserved. -# Use of this source code is governed by a BSD-style license that can be -# found in the LICENSE file. - -# Script to build a bootable keyfob-based chromeos system image. -# It uses debootstrap (see https://wiki.ubuntu.com/DebootstrapChroot) to -# create a base file system. It then cusotmizes the file system and adds -# Ubuntu and chromeos specific packages. Finally, it creates a bootable USB -# image from the root fs. -# -# NOTE: This script must be run from the chromeos build chroot environment. -# - -# Load common constants. This should be the first executable line. -# The path to common.sh should be relative to your script's location. -. "$(dirname "$0")/common.sh" - -assert_inside_chroot -assert_not_root_user - -DEFAULT_PKGLIST="${SRC_ROOT}/package_repo/package-list-prod.txt" - -# Flags -DEFINE_integer build_attempt 1 \ - "The build attempt for this image build." -DEFINE_string output_root "${DEFAULT_BUILD_ROOT}/images" \ - "Directory in which to place image result directories (named by version)" -DEFINE_string build_root "$DEFAULT_BUILD_ROOT" \ - "Root of build output" -DEFINE_boolean replace $FLAGS_FALSE "Overwrite existing output, if any." -DEFINE_boolean increment $FLAGS_FALSE \ - "Picks the latest build and increments the minor version by one." - -DEFINE_string arch "x86" \ - "The target architecture to build for. One of { x86, armel }." -DEFINE_string mirror "$DEFAULT_IMG_MIRROR" "Repository mirror to use." -DEFINE_string suite "$DEFAULT_IMG_SUITE" "Repository suite to base image on." -DEFINE_string mirror2 "" "Additional repository mirror to use (URL only)." -DEFINE_string suite2 "" "Repository suite for additional mirror." -DEFINE_string pkglist "$DEFAULT_PKGLIST" \ - "Name of file listing packages to install from repository." -DEFINE_boolean with_dev_pkgs $FLAGS_TRUE \ - "Include additional developer-friendly packages in the image." - -# Parse command line -FLAGS "$@" || exit 1 -eval set -- "${FLAGS_ARGV}" - -# Die on any errors. -set -e - -# Determine build version -. "${SCRIPTS_DIR}/chromeos_version.sh" - -# Use canonical path since some tools (e.g. mount) do not like symlinks -# Append build attempt to output directory -IMAGE_SUBDIR="${CHROMEOS_VERSION_STRING}-a${FLAGS_build_attempt}" -OUTPUT_DIR="${FLAGS_output_root}/${IMAGE_SUBDIR}" -ROOT_FS_DIR="${OUTPUT_DIR}/rootfs" -ROOT_FS_IMG="${OUTPUT_DIR}/rootfs.image" -MBR_IMG="${OUTPUT_DIR}/mbr.image" -OUTPUT_IMG="${OUTPUT_DIR}/usb.img" - -LOOP_DEV= - -# Handle existing directory -if [ -e "$OUTPUT_DIR" ] -then - if [ $FLAGS_replace -eq $FLAGS_TRUE ] - then - sudo rm -rf "$OUTPUT_DIR" - else - echo "Directory $OUTPUT_DIR already exists." - echo "Use --build_attempt option to specify an unused attempt." - echo "Or use --replace if you want to overwrite this directory." - exit 1 - fi -fi - -# create the output directory -mkdir -p "$OUTPUT_DIR" - -cleanup_rootfs_loop() { - sudo umount "$LOOP_DEV" - sleep 1 # in case $LOOP_DEV is in use - sudo losetup -d "$LOOP_DEV" - LOOP_DEV="" -} - -cleanup() { - # Disable die on error. - set +e - if [ -n "$LOOP_DEV" ] - then - cleanup_rootfs_loop - fi - - # Turn die on error back on. - set -e -} -trap cleanup EXIT - -mkdir -p "$ROOT_FS_DIR" - -# Create root file system disk image to fit on a 1GB memory stick. -# 1 GB in hard-drive-manufacturer-speak is 10^9, not 2^30. 700MB < 10^9 bytes. -ROOT_SIZE_BYTES=$((1024 * 1024 * 700)) -dd if=/dev/zero of="$ROOT_FS_IMG" bs=1 count=1 seek=$((ROOT_SIZE_BYTES - 1)) - -# Format, tune, and mount the rootfs. -# Make sure we have a mtab to keep mkfs happy. -if [ ! -e /etc/mtab ]; then - sudo touch /etc/mtab -fi -UUID=`uuidgen` -DISK_LABEL=C-ROOT -LOOP_DEV=`sudo losetup -f` -sudo losetup "$LOOP_DEV" "$ROOT_FS_IMG" -sudo mkfs.ext3 "$LOOP_DEV" -sudo tune2fs -L "$DISK_LABEL" -U "$UUID" -c 0 -i 0 "$LOOP_DEV" -sudo mount "$LOOP_DEV" "$ROOT_FS_DIR" - -# -- Install packages and customize root file system. -- -PKGLIST="$FLAGS_pkglist" -if [ $FLAGS_with_dev_pkgs -eq $FLAGS_TRUE ]; then - PKGLIST="$PKGLIST,${SRC_ROOT}/package_repo/package-list-debug.txt" -fi -# Add official packages for ChromeOS if the file exists -if [ -f ${SRC_ROOT}/package_repo/package-list-official.txt ]; then - PKGLIST="$PKGLIST,${SRC_ROOT}/package_repo/package-list-official.txt" -fi -"${SCRIPTS_DIR}/install_packages.sh" \ - --build_root="${FLAGS_build_root}" \ - --root="$ROOT_FS_DIR" \ - --output_dir="${OUTPUT_DIR}" \ - --package_list="$PKGLIST" \ - --arch="$FLAGS_arch" \ - --mirror="$FLAGS_mirror" \ - --suite="$FLAGS_suite" \ - --mirror2="$FLAGS_mirror2" \ - --suite2="$FLAGS_suite2" - -"${SCRIPTS_DIR}/customize_rootfs.sh" --root="${ROOT_FS_DIR}" - -# -- Turn root file system into bootable image -- - -if [ "$FLAGS_arch" = "x86" ]; then - # Setup extlinux configuration. - # TODO: For some reason the /dev/disk/by-uuid is not being generated by udev - # in the initramfs. When we figure that out, switch to root=UUID=$UUID. - cat < " - echo "kernel_config: Kernel config from ${KERNEL_DATA}/config/." - echo "package_revision: The revision to stamp on the final .deb package." - echo "rootfs: Root directory of build environment" - echo "remaining arguments are assumed to be kernel patch names" - echo -n "Usage example: sh build_kernel.sh config.2.6.30-rc8-chromeos-intel-" - echo "menlow 001 ~/src/chromeos/devenv" - echo "" - exit 1 -fi - -# Use remaining arguments as patch names. -shift; shift; shift -PATCHES="$*" - -if [ ! -d "$ROOTFS" ] -then - echo "$ROOTFS is not a directory" - exit 1 -fi - -# Create a tmpfs to store output from build script which this script can copy -# the output from later on. We won't know the actual filename of the output -# but since this is a new namespace we're using it should be safe to use a use -# a wildcard (e.g. linux-image*.deb) without copying the wrong .debs. -OUTPUT_DIR="${ROOTFS}/tmp" -sudo mkdir -p "$OUTPUT_DIR" -sudo mount -t tmpfs size=32M "${OUTPUT_DIR}" -do_cleanup() { - sudo umount "${OUTPUT_DIR}" -} -trap do_cleanup EXIT - -# Copy kernel build helper script to chroot environment -sudo cp "${SRC_ROOT}/scripts/${BUILD_SCRIPT}" "${ROOTFS}/tmp/" - -# Run the build script. -sudo chroot "$ROOTFS" "/tmp/${BUILD_SCRIPT}" "$KCONFIG" \ - "$PKGREVISION" "${OUTPUT_DIR#$ROOTFS}/" "$PATCHES" - -# Copy kernel package from the output directory into Chrome OS sources -# before the cleanup routine clobbers it. -echo "Copying kernel to "$KERNEL_DATA"" -cp -i "$OUTPUT_DIR"/linux-image*.deb "$KERNEL_DATA" - -set +e diff --git a/chromiumos-build.cfg b/chromiumos-build.cfg deleted file mode 100644 index 8c13033c24..0000000000 --- a/chromiumos-build.cfg +++ /dev/null @@ -1,5 +0,0 @@ -[Options] -# ../third_party/xscreensaver is a bit of a wart here, necessitated by odd -# directory layout. -builddirs: ../build/%(architecture)s/external .. ../platform ../third_party ../third_party/xscreensaver -destdir: ../build/%(architecture)s/local_packages diff --git a/make_chroot.sh b/make_chroot.sh deleted file mode 100755 index 70e10b908c..0000000000 --- a/make_chroot.sh +++ /dev/null @@ -1,225 +0,0 @@ -#!/bin/bash - -# Copyright (c) 2009 The Chromium OS Authors. All rights reserved. -# Use of this source code is governed by a BSD-style license that can be -# found in the LICENSE file. - -# This script sets up an Ubuntu chroot environment. The ideas come -# from https://wiki.ubuntu.com/DebootstrapChroot and conversations with -# tedbo. The script is passed the path to an empty folder, which will be -# populated with the files to form an Ubuntu Jaunty system with the packages -# listed in PACKAGE_LIST_FILE (below) and their dependencies. Once created, -# the password is set to PASSWORD (below). One can enter the chrooted -# environment for work by running -# enter_chroot_dev_environment.sh /path/to/chroot-root - -# Load common constants. This should be the first executable line. -# The path to common.sh should be relative to your script's location. -. "$(dirname "$0")/common.sh" - -# Script must be run outside the chroot and as a regular user. -assert_outside_chroot -assert_not_root_user - -DEFAULT_PKGLIST="$SRC_ROOT/package_repo/package-list-dev.txt" - -# Define command line flags -# See http://code.google.com/p/shflags/wiki/Documentation10x -DEFINE_string suite "$DEFAULT_DEV_SUITE" \ - "Ubuntu suite to use to create the development chroot." -DEFINE_string mirror "$DEFAULT_DEV_MIRROR" \ - "Ubuntu mirror to use to create the development chroot." -DEFINE_string mirror_src "$DEFAULT_DEV_MIRROR" \ - "Ubuntu mirror to use to apt-get package sources." -DEFINE_string chroot "$DEFAULT_CHROOT_DIR" \ - "Destination dir for the chroot environment." -DEFINE_string pkglist "$DEFAULT_PKGLIST" \ - "File listing additional packages to install." -DEFINE_boolean delete $FLAGS_FALSE "Delete an existing chroot." -DEFINE_boolean replace $FLAGS_FALSE "Overwrite existing chroot, if any." - -# Parse command line flags -FLAGS "$@" || exit 1 -eval set -- "${FLAGS_ARGV}" - -# Only now can we die on error. shflags functions leak non-zero error codes, -# so will die prematurely if 'set -e' is specified before now. -# TODO: replace shflags with something less error-prone, or contribute a fix. -set -e - -# Add additional components if file exists -OFFICIAL_COMPONENTS=$SRC_ROOT/package_repo/package-list-official.txt -[ -f $OFFICIAL_COMPONENTS ] || OFFICIAL_COMPONENTS= -COMPONENTS=$(cat $FLAGS_pkglist $OFFICIAL_COMPONENTS | sed -e 's/#.*//' | grep -v '^ *$' | tr '\n' ' ') -FULLNAME="Chrome OS dev user" -DEFGROUPS="eng,admin,adm,dialout,cdrom,floppy,audio,dip,video" -PASSWORD=chronos -CRYPTED_PASSWD=$(perl -e 'print crypt($ARGV[0], "foo")', $PASSWORD) - -function in_chroot { - sudo chroot "$FLAGS_chroot" "$@" -} - -function bash_chroot { - # Use $* not $@ since 'bash -c' needs a single arg - sudo chroot "$FLAGS_chroot" bash -c "$*" -} - -function cleanup { - # Clean up mounts - mount | grep "on $(readlink -f "$FLAGS_chroot")" | awk '{print $3}' \ - | xargs -r -L1 sudo umount -} - -function delete_existing { - # Delete old chroot dir - if [ -e "$FLAGS_chroot" ] - then - echo "Cleaning up old mount points..." - cleanup - echo "Deleting $FLAGS_chroot..." - sudo rm -rf "$FLAGS_chroot" - fi -} - -# Install packages which may not be installed on the local system -install_if_missing debootstrap - -# Add debootstrap link for the suite, if it doesn't exist. -if [ ! -e "/usr/share/debootstrap/scripts/$FLAGS_suite" ] -then - sudo ln -s /usr/share/debootstrap/scripts/hardy \ - "/usr/share/debootstrap/scripts/$FLAGS_suite" -fi - -# Handle deleting an existing environment -if [ $FLAGS_delete -eq $FLAGS_TRUE ] -then - delete_existing - echo "Done." - exit 0 -fi - -# Handle existing directory -if [ -e "$FLAGS_chroot" ] -then - if [ $FLAGS_replace -eq $FLAGS_TRUE ] - then - delete_existing - else - echo "Directory $FLAGS_chroot already exists." - echo "Use --replace if you really want to overwrite it." - exit 1 - fi -fi - -# Create the destination directory -mkdir -p "$FLAGS_chroot" - -# Run debootstrap to create the base chroot environment -echo "Running debootstrap $FLAGS_mirror $FLAGS_suite ..." -echo "You may need to enter password for sudo now..." -sudo debootstrap --arch=i386 --exclude=rsyslog,ubuntu-minimal \ - "$FLAGS_suite" "$FLAGS_chroot" "$FLAGS_mirror" -echo "Done running debootstrap." - -# Set up necessary mounts -sudo mount none -t proc "$FLAGS_chroot/proc" -sudo mount none -t devpts "$FLAGS_chroot/dev/pts" -# ...and make sure we clean them up on exit -trap cleanup EXIT - -# Set up sudoers. Inside the chroot, the user can sudo without a password. -# (Safe enough, since the only way into the chroot is to 'sudo chroot', so -# the user's already typed in one sudo password...) -bash_chroot "echo %admin ALL=\(ALL\) ALL >> /etc/sudoers" -bash_chroot "echo $USER ALL=NOPASSWD: ALL >> /etc/sudoers" - -# Set up apt sources. -# prefer our tools or custom packages -bash_chroot "echo deb $DEFAULT_CHROMEOS_SERVER/tools chromiumos_dev \ - main > /etc/apt/sources.list" -# Add official apt source if file exists -OFFICIAL_SOURCE_LIST=$SRC_ROOT/package_repo/sources-official.list -if [ -f $OFFICIAL_SOURCE_LIST ] -then - # Copy the file into the chroot so it's cat'able - cp -fp $OFFICIAL_SOURCE_LIST $FLAGS_chroot/tmp - bash_chroot "cat /tmp/$(basename $OFFICIAL_SOURCE_LIST) >> /etc/apt/sources.list" -fi -# use specified mirror and suite for the rest of the development chroot -bash_chroot "echo deb $FLAGS_mirror $FLAGS_suite \ - main restricted multiverse universe >> /etc/apt/sources.list" -# NOTE: Add additional repos here, possibly via command-line args. - -# Enable sources for upstream packages. Currently, kernel source is checked in -# and all other sources are pulled via DEPS files. -bash_chroot "echo deb-src $FLAGS_mirror_src $FLAGS_suite \ - main restricted multiverse universe >> /etc/apt/sources.list" - -# Set /etc/debian_chroot so '(chroot)' shows up in shell prompts -CHROOT_BASE=`basename $FLAGS_chroot` -bash_chroot "echo $CHROOT_BASE > /etc/debian_chroot" - -# Copy config from outside chroot into chroot -sudo cp /etc/hosts "$FLAGS_chroot/etc/hosts" - -# Add ourselves as a user inside the chroot -in_chroot groupadd admin -in_chroot groupadd -g 5000 eng -in_chroot useradd -G ${DEFGROUPS} -g eng -u `id -u` -s \ - /bin/bash -m -c "${FULLNAME}" -p ${CRYPTED_PASSWD} ${USER} - -# Bind-mount trunk into chroot so we can install local packages -mkdir "${FLAGS_chroot}$CHROOT_TRUNK_DIR" -sudo mount --bind "$GCLIENT_ROOT" "${FLAGS_chroot}$CHROOT_TRUNK_DIR" - -# Niceties for interactive logins ('enter_chroot.sh'); these are ignored -# when specifying a command to enter_chroot.sh. -# Automatically change to scripts directory -echo "cd trunk/src/scripts" >> "$FLAGS_chroot/home/$USER/.profile" - -# Warn if attempting to use source control commands inside the chroot -for NOUSE in svn gcl gclient -do - echo "alias $NOUSE='echo In the chroot, it is a bad idea to run $NOUSE'" \ - >> "$FLAGS_chroot/home/$USER/.profile" -done - -if [ "$USER" = "chrome-bot" ] -then - # Copy ssh keys, so chroot'd chrome-bot can scp files from chrome-web. - cp -r ~/.ssh "$FLAGS_chroot/home/$USER/" -fi - -# Install additional packages -echo "Installing additional packages..." -in_chroot apt-get update -bash_chroot "export DEBIAN_FRONTEND=noninteractive LANG=C && \ - apt-get --yes --force-yes install $COMPONENTS" - -echo "Installing chromiumos-build tool..." -bash_chroot "cd $CHROOT_TRUNK_DIR/tools/chromiumos-build && \ - debuild -us -uc && \ - sudo dpkg -i ../chromiumos-build_*.deb && \ - rm ../chromiumos-build_*.{dsc,tar.gz,deb,build,changes}" - - -# Clean up the chroot mounts -trap - EXIT -cleanup - -if [ "$FLAGS_chroot" = "$DEFAULT_CHROOT_DIR" ] -then - CHROOT_EXAMPLE_OPT="" -else - CHROOT_EXAMPLE_OPT="--chroot=$FLAGS_chroot" -fi - -echo "All set up. To enter the chroot, run:" -echo " $SCRIPTS_DIR/enter_chroot.sh $CHROOT_EXAMPLE_OPT" -echo "" -echo "CAUTION: Do *NOT* rm -rf the chroot directory; if there are stale bind" -echo "mounts you may end up deleting your source tree too. To unmount and" -echo "delete the chroot cleanly, use:" -echo " $0 --delete $CHROOT_EXAMPLE_OPT" diff --git a/make_local_repo.sh b/make_local_repo.sh deleted file mode 100755 index f894c629fc..0000000000 --- a/make_local_repo.sh +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/bash -# This script is no longer needed. This stub is here to avoid immediate -# buildbot breakage and will be removed soon. -exit 0 diff --git a/package_script_whitelist.sh b/package_script_whitelist.sh deleted file mode 100755 index 9d1904dc6e..0000000000 --- a/package_script_whitelist.sh +++ /dev/null @@ -1,215 +0,0 @@ -#!/bin/bash - -# Copyright (c) 2010 The Chromium OS Authors. All rights reserved. -# Use of this source code is governed by a BSD-style license that can be -# found in the LICENSE file. - -# This script is used to maintain the whitelist for package maintainer scripts. -# If a package maintainer script is in the whitelist file then it is ok to skip -# running that maintainer script when installing the package. Otherwise there -# should be an equivalent script that can perform those operation on a target -# root file system. -# -# The whitelist contains on entry per line which is the filename followed by -# its md5sum. Ideally it is kept in sorted by package name like below: -# bar.postinst MD5SUM1 -# bar.postinst MD5SUM2 -# bar.preinst MD5SUM3 -# foo.postinst MD5SUM4 -# -# TODO: Should be able to whitelist on built packages and not just an already -# created rootfs. - -. "$(dirname "$0")/common.sh" - -DEFINE_string whitelist "${SRC_ROOT}/package_scripts/package.whitelist" \ - "The whitelist file to use." -DEFINE_string file "" "The path to a presinst/postinst file for add/audit." -DEFINE_string root "" \ - "Mounted root on which to look for the maintainer scripts when using audit." -DEFINE_string audit_pattern "*" \ - "Package name pattern used when auditing all packages [ex: 'lib*']" - -FLAGS_HELP="Usage: $(basename $0) [options] add|audit|check - -Use this script to maintain the package scripts whitelist. It handles the -following commands: - - add: Add the --file= specified file to the whitelist. - audit: If no --file= is given, audit all non-whitelisted scripts in the - given rootfs. This will show you the files in turn and give you - the option to Skip/View/Whitelist/Create template for the script. - If --file is given it will do the same for that one file. - check: Checks if the --file= is in the whitelist. -" - -# Parse command line -FLAGS "$@" || exit 1 -eval set -- "${FLAGS_ARGV}" - -# Adds a the file at the given path to the whitelist. -# -# $1 - Path to file to add to whitelist. -add_to_whitelist() { - local path=$1 - local whitelist="$FLAGS_whitelist" - local file=$(basename "$path") - - local checksum=$(md5sum "$path" | awk '{ print $1 }') - if [ ! -f "$whitelist" ]; then -cat < "$whitelist" -# Copyright (c) 2010 The Chromium OS Authors. All rights reserved. -# Use of this source code is governed by a BSD-style license that can be -# found in the LICENSE file. -EOF - fi - - echo "$file $checksum" | \ - sort -u -o "${whitelist}.new" "$whitelist" - - mv "${whitelist}.new" "$whitelist" -} - -# Creates a template alternative maintainer script in the same directory -# as the whitelist file. This will run instead of the whitelisted package -# scripts using only build machine binaries and targeting a rootfs. -# -# $1 - The name of the template (like 'foo.postinst') -create_script_template() { - local file=$1 - - local whitelist_dir=$(dirname "$FLAGS_whitelist") - local path="${whitelist_dir}/${file}" - if [ -f "$path" ]; then - echo "Error: Alternative maintainer script '$path' already exists." - return - fi - -cat < "$path" -#!/bin/bash - -# Copyright (c) 2010 The Chromium OS Authors. All rights reserved. -# Use of this source code is governed by a BSD-style license that can be -# found in the LICENSE file. - -# $file - -set -e - -# \$ROOT - The path to the target root file system. -# \$SRC_ROOT - The path to the source tree. - -# TODO: The equivalent of $file running from outside of the target rootfs -# that only uses tools from the build machine and not from the target. - -exit 1 - -EOF - chmod 0750 "$path" -} - -# Show the script to the user for audit purposes. -# -# $1 - The script to show. -show_script() { - local path=$1 - local type=$(file -b "$path") - local is_text=$(echo "$type" | grep -c "text") - if [ $is_text -eq 0 ]; then - local file=$(basename "$path") - echo "Unable to view '$file'; not a text file. Type is '$type'" - else - local pager="/usr/bin/less" - if [ -n "$PAGER" ]; then - pager="$PAGER" - fi - $pager "$path" - fi -} - -# Process a given script for audit purposes. We show the script to the user -# and then prompt them with options. -# -# $1 - The script to process -audit_script() { - local path=$1 - local file=$(basename "$path") - local prompt="$file: (Q)uit, (S)kip, (V)iew, (W)hitelist, (C)reate template?" - - show_script "$path" - while true; do - read -n 1 -p "$prompt " ANSWER - echo "" - ANSWER="${ANSWER:0:1}" # Get just the first character - case $ANSWER in - Q*|q*) - exit 0 - ;; - S*|s*) - echo "Skipping: $file" - return - ;; - V*|v*) - show_script "$path" - ;; - W*|w*) - echo "Whitelisting: $file" - add_to_whitelist "$path" - return - ;; - C*|c*) - echo "Creating template for: $file" - create_script_template "$file" - ;; - *) - echo "Unknown response: '$ANSWER'" - ;; - esac - done -} - -# Audit all non-whitelisted script in $FLAGS_root -audit_all() { - echo "Auditing packages at: $FLAGS_root" - local dpkg_info="$FLAGS_root/var/lib/dpkg/info" - local scripts=$(ls "$dpkg_info"/$FLAGS_audit_pattern.preinst \ - "$dpkg_info"/$FLAGS_audit_pattern.postinst | sort -r) - - for s in $scripts; do - if ! is_whitelisted "$s"; then - audit_script "$s" - fi - done -} - -case $1 in - add) - if [ -z "$FLAGS_file" ]; then - echo "--file parameter is required for 'add' command." - exit 1 - fi - add_to_whitelist "$FLAGS_file" - ;; - audit) - if [ -n "$FLAGS_file" ]; then - audit_script "$FLAGS_file" - elif [ -n "$FLAGS_root" ]; then - audit_all - else - echo "Error: One of --file or --root is needed for audit command." - fi - ;; - check) - if [ -z "$FLAGS_file" ]; then - echo "--file parameter is required for 'check' command." - exit 1 - fi - if is_whitelisted "$FLAGS_file"; then - echo "Whitelisted" - else - echo "Not whitelisted" - fi - ;; - *) - echo "Unknown command." - ;; -esac