30065 Commits

Author SHA1 Message Date
Benjamin Gilbert
e9936d4b86 coreos-base/oem-oracle-oci: add link-local iptables rules
Prevent non-root users from accessing certain link-local services per
Oracle recommendation. Also apply filters to IP-forwarded virtual
interfaces.
2017-09-09 01:55:58 -07:00
Euan Kemp
cab9dc7285 Merge pull request #2752 from euank/ca-unsync
coreos-devel/sdk-depends: remove casync
2017-09-08 17:35:56 -07:00
Euan Kemp
cdea0df9c3 coreos-devel/sdk-depends: remove casync
It was going to be used in torcx manifest generation, but that
dependency has been removed for now.

I'm optimistically leaving the ebuild in.

Removing it from sdk-depends should speed up sdk bootstrap at least.
2017-09-08 17:31:19 -07:00
Euan Kemp
83a16990d1 Merge pull request #737 from euank/torcx-cas
rework torcx uploading to include a manifest
2017-09-08 17:09:54 -07:00
Euan Kemp
677b5ae116 build_torcx_store: back-out reproducible digests
Per the comment there, they were implemented in a broken fashion.

This leaves the door open for using them in the future, but in the
meanwhile simply uses the sha512sum as the digest (which solves the
immediate issue).
2017-09-08 16:59:54 -07:00
Euan Kemp
ee54181503 build_torcx_store: upload manifests to upload_root
Rather than to a location special to them.
The comment in the code explains the reasoning for this.
2017-09-08 16:59:54 -07:00
Euan Kemp
f496072a10 jenkins/images: use torcx packages from manifest
This accompanies the other changes around moving to a torcx manifest.
2017-09-08 16:59:54 -07:00
Euan Kemp
cc23e8e49e jenkins/packages: configure download root
Pending jenkins also including this variable.
2017-09-08 16:59:54 -07:00
Euan Kemp
1989ff96d8 build_torcx_store: upload to 'pkgs'
This is consistent with the local directory hierarchy
2017-09-08 16:59:51 -07:00
Euan Kemp
d3867403ed build_image: populate torcx store from manifest
This moves the default symlinking logic into build image as well.

This assumes that a torcx store is available locally with all images
referenced in the torcx manifest.

This is accomplished with a highly-indented double-for-loop, but I think
it's still decently readable.
2017-09-08 16:58:51 -07:00
Euan Kemp
31d7b40af3 build_library: add more torcx_manifest helpers
These are useful for the build_image_util code soon to come.
2017-09-08 16:58:51 -07:00
Euan Kemp
c196be8798 build_torcx_store: add package 'url' location
This also moves the 'torcx' prefixing logic over to the torcx upload
root introduced in the release util library.

It also corrects a bug in how the source package was being determined.
2017-09-08 16:58:38 -07:00
Euan Kemp
8f712b2af1 build_library: add torcx upload/download roots
Torcx is special in that it wishes to be uploaded under a prefixed
directory (torcx), typically wishes to be downloaded from there, but
ultimately wants to be downloaded from a location without that prefix.

In fact, I expect during a normal release process, it will be uploaded
with that prefix to the build bucket, copied without that prefix to the
final bucket (during pre-release), and then finally downloaded without
the prefix.

I think this set of variables ends up being the cleanest way to
represent this complexity.
2017-09-08 16:42:47 -07:00
Euan Kemp
fcef524c3a build_torcx_store: generate a torcx_manifest
This modifies the `build_torcx_store` script to produce a manifest and
cas-like structure of packages referenced by that manifest.

It also removes the symlink creation logic (which will be re-added in
build_image in coming commits).

The concept of "extra packages", which are referenced in the manifest,
but aren't installed in the rootfs, is also introduced.

Since the logic of what to include in the rootfs is also extracted into
build_image, supporting these "extra packages" isn't very complicated
for this file.
2017-09-08 16:42:47 -07:00
David Michael
5d6e40fa1d Merge pull request #2751 from dm0-/docker
Update to Docker 17.06.2
2017-09-08 14:48:33 -07:00
David Michael
e06e149561 app-emulation/docker: Pull the build date from the tar file 2017-09-08 14:25:40 -07:00
David Michael
03ee9a16a1 chore(metadata): Regenerate cache 2017-09-08 12:57:43 -07:00
David Michael
05a399a1d6 app-emulation/docker: Bump to 17.06.2 2017-09-08 12:57:30 -07:00
Benjamin Gilbert
2098a0780d Merge pull request #739 from bgilbert/oracle
build_library: rename oracle_oci image to oracle_oci_qcow
2017-09-07 14:57:22 -07:00
Benjamin Gilbert
6f7abe198a Merge pull request #738 from bgilbert/gc
bin: drop some obviously unused scripts
2017-09-07 14:57:05 -07:00
Euan Kemp
301a6460f8 Merge pull request #2747 from euank/bump-tcpdump
profiles/coreos: accept newer tcpdump for arm
2017-09-07 14:29:24 -07:00
Euan Kemp
44ae47074e Merge pull request #584 from euank/tcpdump-bump
bump(net-analyzer/tcpdump): sync with upstream
2017-09-07 14:29:17 -07:00
Euan Kemp
b0498c5b8f profiles/coreos: accept newer tcpdump for arm
Accompanies https://github.com/coreos/portage-stable/pull/584
2017-09-07 14:27:47 -07:00
Euan Kemp
4131d7555f bump(net-analyzer/tcpdump): sync with upstream 2017-09-07 14:18:43 -07:00
Euan Kemp
0604b5c40a build_library: add torcx_manifest helper
This implements some basic functionality around working with torcx
manifests.
2017-09-07 12:21:36 -07:00
Euan Kemp
37f3657539 Merge pull request #740 from euank/ccache-mask
update_chroot: set a more permissive ccache umask
2017-09-07 12:19:30 -07:00
Euan Kemp
62bff69a19 update_chroot: set a more permissive ccache umask
This seems to fix the ccache permission issues `update_chroot` hits
while building ninja.

The erroneous files were created as root:portage, so a umask of 002
should let other portage group members share them, which seems entirely
reasonable.
2017-09-07 11:56:51 -07:00
Benjamin Gilbert
e22f23443a Merge pull request #2745 from bgilbert/fortify
sys-kernel/coreos-modules: enable FORTIFY_SOURCE
2017-09-06 19:02:33 -07:00
Benjamin Gilbert
1872f3ec4a Merge pull request #2746 from bgilbert/oracle
coreos-init, bootengine: bump for Oracle network unit consolidation
2017-09-06 18:30:10 -07:00
Benjamin Gilbert
aa0a377b09 sys-kernel/bootengine: bump for Oracle network unit consolidation 2017-09-06 18:26:07 -07:00
Benjamin Gilbert
f57c304e88 coreos-base/coreos-init: bump for Oracle network unit consolidation 2017-09-06 18:25:47 -07:00
Benjamin Gilbert
8faa25540d sys-kernel/coreos-modules: enable FORTIFY_SOURCE
Enable some buffer overflow checking added in
6974f0c4555e285ab217cee58b6e874f776ff409.
2017-09-06 17:53:17 -07:00
Benjamin Gilbert
2024326789 build_library: rename oracle_oci image to oracle_oci_qcow
Reserve the unsuffixed name for a raw image, in case we ever want to
support installing to disk using "coreos-install -o" on a PXE-booted
system.
2017-09-06 17:46:07 -07:00
Benjamin Gilbert
2de95be0ef bin: drop some obviously unused scripts 2017-09-06 15:33:42 -07:00
Benjamin Gilbert
97ab652443 Merge pull request #735 from bgilbert/signing
offline_signing: Allow download/upload for multiple releases with a single invocation
2017-09-06 12:38:19 -07:00
Benjamin Gilbert
9c93dcb272 offline_signing: add subcommand to upload to roller 2017-09-05 17:34:33 -07:00
Benjamin Gilbert
3ed15a8762 offline_signing: automatically fix ownership of output dir 2017-09-05 16:38:16 -07:00
Benjamin Gilbert
b3cb2e0608 offline_signing: download multiple versions and boards per invocation 2017-09-05 16:35:34 -07:00
Euan Kemp
92166d5904 Merge pull request #2742 from euank/casync
app-backup/casync: add initial ebuild
2017-09-05 15:51:16 -07:00
Euan Kemp
07307069e9 Merge pull request #583 from euank/add-zstd
bump(app-arch/zstd): sync with upstream
2017-09-05 15:51:08 -07:00
Benjamin Gilbert
0a74a57c40 offline_signing: verify downloads with gpg2 2017-09-05 15:32:05 -07:00
Euan Kemp
4c3996b7cb coreos-devel/sdk-depends: add casync to sdk 2017-09-05 15:11:18 -07:00
Euan Kemp
ed7a4a8ef2 app-backup/casync: add initial ebuild
This is a fairly boring meson ebuild. I had to apply a patch to make it
build.

This is included in the sdk for the torcx packaging work, where we'd
like to get a digest of a given torcx pkg. `casync digest` works well
for that and can be pointed at a directory easily enough.
2017-09-05 15:10:42 -07:00
Benjamin Gilbert
35136f96ef Merge pull request #2743 from bgilbert/4.13.0
Upgrade Linux in master to 4.13
2017-09-05 13:53:43 -07:00
Benjamin Gilbert
5d34a86d1b sys-kernel/coreos-*: bump to 4.13.0 2017-09-05 13:46:11 -07:00
Benjamin Gilbert
93365ac694 sys-kernel/coreos-modules: enable megaraid_mm and megaraid_mbox 2017-09-05 13:39:41 -07:00
Euan Kemp
c536c21895 Merge pull request #2741 from euank/reproducible-docker
app-emulation/docker: build reproducibly
2017-09-05 12:50:27 -07:00
Euan Kemp
dfde9c44af app-emulation/docker: build reproducibly
The docker client and engine both include a 'BuildTime' variable set in
their build scripts.
Overriding that to a consistent value is sufficient for them to build
reproducibly as best I can tell.

This CLI's build scripts have a mechanism for doing this. The engine has
an upstream patch (included starting with 17.07) that allows doing the
same.

This modifies the build to apply the above build patch, and set a build
time for both.

It's expected that the build time will be set by the ebuild author each
time the ebuild is modified, thus turning the 'build time' output to
really be the 'package created time', which I think is a reasonable
difference.
2017-09-05 12:25:08 -07:00
Euan Kemp
170734c0ec bump(app-arch/zstd): sync with upstream
This is a dependency of the 'casync' tool.
2017-09-01 17:54:14 -07:00
David Michael
59a7befbbf Merge pull request #2740 from dm0-/rkt
app-emulation/rkt: Correct the project name
2017-09-01 10:20:54 -07:00