#!/bin/bash # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; version 2 of the License. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. m4_include(lib/common.sh) shopt -s nullglob makepkg_args='-s --noconfirm -L --holdver' repack=false update_first=false clean_first=false install_pkg= run_namcap=false temp_chroot=false chrootdir= passeddir= declare -a install_pkgs declare -i ret=0 copy=$USER [[ -n $SUDO_USER ]] && copy=$SUDO_USER [[ -z "$copy" || $copy = root ]] && copy=copy src_owner=${SUDO_USER:-$USER} usage() { echo "Usage: ${0##*/} [options] -r <chrootdir> [--] [makepkg args]" echo ' Run this script in a PKGBUILD dir to build a package inside a' echo ' clean chroot. All unrecognized arguments passed to this script' echo ' will be passed to makepkg.' echo '' echo ' The chroot dir consists of the following directories:' echo ' <chrootdir>/{root, copy} but only "root" is required' echo ' by default. The working copy will be created as needed' echo '' echo 'The chroot "root" directory must be created via the following' echo 'command:' echo ' mkarchroot <chrootdir>/root base-devel' echo '' echo "Default makepkg args: $makepkg_args" echo '' echo 'Flags:' echo '-h This help' echo '-c Clean the chroot before building' echo '-u Update the working copy of the chroot before building' echo ' This is useful for rebuilds without dirtying the pristine' echo ' chroot' echo '-r <dir> The chroot dir to use' echo '-I <pkg> Install a package into the working copy of the chroot' echo '-l <copy> The directory to use as the working copy of the chroot' echo ' Useful for maintaining multiple copies' echo " Default: $copy" echo '-n Run namcap on the package' echo '-T Build in a temporary directory' exit 1 } while getopts 'hcur:I:l:nT' arg; do case "$arg" in h) usage ;; c) clean_first=true ;; u) update_first=true ;; r) passeddir="$OPTARG" ;; I) install_pkgs+=("$OPTARG") ;; l) copy="$OPTARG" ;; n) run_namcap=true; makepkg_args="$makepkg_args -i" ;; T) temp_chroot=true; copy+="-$$" ;; *) makepkg_args="$makepkg_args -$arg $OPTARG" ;; esac done (( EUID != 0 )) && die 'This script must be run as root.' [[ ! -f PKGBUILD && -z "${install_pkgs[*]}" ]] && die 'This must be run in a directory containing a PKGBUILD.' # Canonicalize chrootdir, getting rid of trailing / chrootdir=$(readlink -e "$passeddir") [[ ! -d $chrootdir ]] && die "No chroot dir defined, or invalid path '$passeddir'" [[ ! -d $chrootdir/root ]] && die "Missing chroot dir root directory. Try using: mkarchroot $chrootdir/root base-devel" # Detect chrootdir filesystem type chroottype=$(stat -f -c %T "$chrootdir") if [[ ${copy:0:1} = / ]]; then copydir=$copy else copydir="$chrootdir/$copy" fi # Pass all arguments after -- right to makepkg makepkg_args="$makepkg_args ${*:$OPTIND}" # See if -R was passed to makepkg for arg in ${*:$OPTIND}; do if [[ $arg = -R ]]; then repack=true break fi done if [[ -n $SUDO_USER ]]; then USER_HOME=$(eval echo ~$SUDO_USER) else USER_HOME=$HOME fi # {{{ functions load_vars() { local makepkg_conf="$1" var [[ -f $makepkg_conf ]] || return 1 for var in {SRC,PKG,LOG}DEST MAKEFLAGS PACKAGER; do [[ -z ${!var} ]] && eval $(grep "^${var}=" "$makepkg_conf") done return 0 } create_chroot() { # Lock the chroot we want to use. We'll keep this lock until we exit. lock 9 "$copydir.lock" "Locking chroot copy [$copy]" if [[ ! -d $copydir ]] || $clean_first; then # Get a read lock on the root chroot to make # sure we don't clone a half-updated chroot slock 8 "$chrootdir/root.lock" "Locking clean chroot" stat_busy "Creating clean working copy [$copy]" if [[ "$chroottype" == btrfs ]]; then if [[ -d $copydir ]]; then btrfs subvolume delete "$copydir" >/dev/null || die "Unable to delete subvolume $copydir" fi btrfs subvolume snapshot "$chrootdir/root" "$copydir" >/dev/null || die "Unable to create subvolume $copydir" else mkdir -p "$copydir" rsync -a --delete -q -W -x "$chrootdir/root/" "$copydir" fi stat_done # Drop the read lock again exec 8>&- fi } clean_temporary() { stat_busy "Removing temporary copy [$copy]" if [[ "$chroottype" == btrfs ]]; then btrfs subvolume delete "$copydir" >/dev/null || die "Unable to delete subvolume $copydir" else # avoid change of filesystem in case of an umount failure rm --recursive --force --one-file-system "$copydir" || die "Unable to delete $copydir" fi # remove lock file rm -f "$copydir.lock" stat_done } install_packages() { local pkgname for install_pkg in "${install_pkgs[@]}"; do pkgname="${install_pkg##*/}" cp "$install_pkg" "$copydir/$pkgname" arch-nspawn "$copydir" pacman -U /$pkgname --noconfirm (( ret += !! $? )) rm "$copydir/$pkgname" done # If there is no PKGBUILD we are done [[ -f PKGBUILD ]] || exit $ret } prepare_chroot() { $repack || rm -rf "$copydir/build" mkdir -p "$copydir/build" if ! grep -q 'BUILDDIR="/build"' "$copydir/etc/makepkg.conf"; then echo 'BUILDDIR="/build"' >> "$copydir/etc/makepkg.conf" fi # Read .makepkg.conf and .gnupg/pubring.gpg even if called via sudo if [[ -r "$USER_HOME/.gnupg/pubring.gpg" ]]; then install -D "$USER_HOME/.gnupg/pubring.gpg" \ "$copydir/build/.gnupg/pubring.gpg" fi mkdir -p "$copydir/pkgdest" if ! grep -q 'PKGDEST="/pkgdest"' "$copydir/etc/makepkg.conf"; then echo 'PKGDEST="/pkgdest"' >> "$copydir/etc/makepkg.conf" fi mkdir -p "$copydir/logdest" if ! grep -q 'LOGDEST="/logdest"' "$copydir/etc/makepkg.conf"; then echo 'LOGDEST="/logdest"' >> "$copydir/etc/makepkg.conf" fi # These two get bind-mounted mkdir -p "$copydir/startdir" "$copydir/startdir_host" mkdir -p "$copydir/srcdest" "$copydir/srcdest_host" if ! grep -q 'SRCDEST="/srcdest"' "$copydir/etc/makepkg.conf"; then echo 'SRCDEST="/srcdest"' >> "$copydir/etc/makepkg.conf" fi chown -R nobody "$copydir"/{build,pkgdest,logdest,srcdest,startdir} if [[ -n $MAKEFLAGS ]]; then sed -i '/^MAKEFLAGS=/d' "$copydir/etc/makepkg.conf" echo "MAKEFLAGS='${MAKEFLAGS}'" >> "$copydir/etc/makepkg.conf" fi if [[ -n $PACKAGER ]]; then sed -i '/^PACKAGER=/d' "$copydir/etc/makepkg.conf" echo "PACKAGER='${PACKAGER}'" >> "$copydir/etc/makepkg.conf" fi if [[ ! -f $copydir/etc/sudoers.d/nobody-pacman ]]; then cat > "$copydir/etc/sudoers.d/nobody-pacman" <<EOF Defaults env_keep += "HOME" nobody ALL = NOPASSWD: /usr/bin/pacman EOF chmod 440 "$copydir/etc/sudoers.d/nobody-pacman" fi # This is a little gross, but this way the script is recreated every time in the # working copy printf $'#!/bin/bash\n%s\n_chrootbuild %q %q' "$(declare -f _chrootbuild)" \ "$makepkg_args" "$run_namcap" >"$copydir/chrootbuild" chmod +x "$copydir/chrootbuild" } download_sources() { local builddir="$(mktemp -d)" chmod 1777 "$builddir" # Ensure sources are downloaded if [[ -n $SUDO_USER ]]; then sudo -u $SUDO_USER env SRCDEST="$SRCDEST" BUILDDIR="$builddir" \ makepkg --config="$copydir/etc/makepkg.conf" --verifysource -o else ( export SRCDEST BUILDDIR="$builddir" makepkg --asroot --config="$copydir/etc/makepkg.conf" --verifysource -o ) fi (( $? != 0 )) && die "Could not download sources." # Clean up garbage from verifysource rm -rf $builddir } _chrootbuild() { # This function isn't run in makechrootpkg, # so no global variables local makepkg_args="$1" local run_namcap="$2" . /etc/profile export HOME=/build shopt -s nullglob # Workaround makepkg disliking read-only dirs ln -sft /srcdest /srcdest_host/* ln -sft /startdir /startdir_host/* cd /startdir # Keep PKGBUILD writable for pkgver() rm PKGBUILD* cp /startdir_host/PKGBUILD* . chown nobody PKGBUILD* # Safety check if [[ ! -w PKGBUILD ]]; then echo "Can't write to PKGBUILD!" exit 1 fi sudo -u nobody makepkg $makepkg_args || exit 1 if $run_namcap; then pacman -S --needed --noconfirm namcap for pkgfile in /startdir/PKGBUILD /pkgdest/*; do echo "Checking ${pkgfile##*/}" sudo -u nobody namcap "$pkgfile" 2>&1 | tee "/logdest/${pkgfile##*/}-namcap.log" done fi exit 0 } move_products() { for pkgfile in "$copydir"/pkgdest/*; do chown "$src_owner" "$pkgfile" mv "$pkgfile" "$PKGDEST" done for l in "$copydir"/logdest/*; do chown "$src_owner" "$l" mv "$l" "$LOGDEST" done } # }}} umask 0022 load_vars "$USER_HOME/.makepkg.conf" load_vars /etc/makepkg.conf # Use PKGBUILD directory if these don't exist [[ -d $PKGDEST ]] || PKGDEST=$PWD [[ -d $SRCDEST ]] || SRCDEST=$PWD [[ -d $LOGDEST ]] || LOGDEST=$PWD create_chroot $update_first && arch-nspawn "$copydir" pacman -Syu --noconfirm [[ -n ${install_pkgs[*]} ]] && install_packages prepare_chroot download_sources if arch-nspawn "$copydir" \ --bind-ro="$PWD:/startdir_host" \ --bind-ro="$SRCDEST:/srcdest_host" \ /chrootbuild then move_products else (( ret += 1 )) fi $temp_chroot && clean_temporary if (( ret != 0 )); then if $temp_chroot; then die "Build failed" else die "Build failed, check $copydir/build" fi else true fi