From de399a34769427c6030cd7f9ae1df32d13be6f68 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Wed, 6 Mar 2024 16:42:25 +0100
Subject: [PATCH] overlay stage1-hooks: Add hooks for libxcrypt migration

They are copying sys-libs/libxcrypt from new portage-stable and
updating package masks and USE flags in order to migrate from
glibc-provided libcrypt to libxcrypt-provided libcrypt.

The migration seems to be a bit complicated to do, because
bootstrapping a system using glibc with libxcrypt-provided libcrypt
using a build environment using glibc with glibc-provided libcrypt
results in some slot conflicts. Without the stage1 hooks the failure
happened in stage2. With the hooks, but without the seed SDK update,
the failure happened already in stage1.

Updating the seed SDK to use libxcrypt seems to do the trick. The
update of the seed SDK will happen only when transition happens - if
the seed SDK is already using libxcrypt, these hooks are noops.
---
 .../0000-glibc-crypt-portage-stable.sh        | 19 +++++++
 .../0002-glibc-crypt-coreos-overlay.sh        | 53 +++++++++++++++++++
 2 files changed, 72 insertions(+)
 create mode 100755 sdk_container/src/third_party/coreos-overlay/coreos/stage1_hooks/0000-glibc-crypt-portage-stable.sh
 create mode 100755 sdk_container/src/third_party/coreos-overlay/coreos/stage1_hooks/0002-glibc-crypt-coreos-overlay.sh

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/stage1_hooks/0000-glibc-crypt-portage-stable.sh b/sdk_container/src/third_party/coreos-overlay/coreos/stage1_hooks/0000-glibc-crypt-portage-stable.sh
new file mode 100755
index 0000000000..b5838185a1
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/stage1_hooks/0000-glibc-crypt-portage-stable.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+set -x
+set -euo pipefail
+
+stage1_repo=${1}
+new_repo=${2}
+update_seed_file=${3}
+
+cat=sys-libs
+pkg=libxcrypt
+
+if [[ -d "${stage1_repo}/${cat}/${pkg}" ]]; then
+    # libxcrypt is already a part of portage-stable, nothing to do
+    exit 0
+fi
+
+mkdir -p "${stage1_repo}/${cat}"
+cp -a "${new_repo}/${cat}/${pkg}" "${stage1_repo}/${cat}/${pkg}"
+echo x >"${update_seed_file}"
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/stage1_hooks/0002-glibc-crypt-coreos-overlay.sh b/sdk_container/src/third_party/coreos-overlay/coreos/stage1_hooks/0002-glibc-crypt-coreos-overlay.sh
new file mode 100755
index 0000000000..e8891c76a3
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/stage1_hooks/0002-glibc-crypt-coreos-overlay.sh
@@ -0,0 +1,53 @@
+#!/bin/bash
+set -x
+set -euo pipefail
+
+stage1_repo=${1}
+new_repo=${2}
+update_seed_file=${3}
+
+base_profile_dir='profiles/coreos/base'
+
+declare -A fixups_old=(
+    ['package.mask']='>=virtual/libcrypt-2'
+    ['package.unmask']='=virtual/libcrypt-1-r1'
+    ['package.use.force']='sys-libs/glibc crypt'
+    ['package.use.mask']='sys-libs/glibc -crypt'
+)
+
+declare -A fixups_new=(
+    ['package.mask']='>=virtual/libcrypt-2'
+    ['package.unmask']='<virtual/libcrypt-2'
+    ['package.use.force']='sys-libs/glibc crypt'
+    ['package.use.mask']='sys-libs/glibc -crypt'
+)
+
+for var_name in fixups_old fixups_new; do
+    declare -n fixups="${var_name}"
+
+    skip=''
+    for f in "${!fixups[@]}"; do
+        l=${fixups["${f}"]}
+        ff="${stage1_repo}/${base_profile_dir}/${f}"
+        if ! grep --quiet --fixed-strings --line-regexp --regexp="${l}" -- "${ff}"; then
+            # fixup not applicable, try next one
+            skip=x
+            break
+        fi
+    done
+
+    if [[ -n ${skip} ]]; then
+        unset -n fixups
+        continue
+    fi
+
+    for f in "${!fixups[@]}"; do
+        l=${fixups["${f}"]}
+        ff="${stage1_repo}/${base_profile_dir}/${f}"
+        ffb="${ff}.bak"
+        mv "${ff}" "${ffb}"
+        grep --invert-match --fixed-strings --line-regexp --regexp="${l}" -- "${ffb}" >"${ff}"
+    done
+    echo x >"${update_seed_file}"
+    exit 0
+done