summaryrefslogtreecommitdiffstats
path: root/makechrootpkg.in
blob: c8b5f875f2fc3fdebda506bdaf77c174ee8f2bd7 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
#!/bin/bash
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; version 2 of the License.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.

m4_include(lib/common.sh)

shopt -s nullglob

makepkg_args='-s --noconfirm -L'
repack=false
update_first=false
clean_first=false
install_pkg=
add_to_db=false
run_namcap=false
chrootdir=
passeddir=
declare -a install_pkgs

default_copy=$USER
[[ -n $SUDO_USER ]] && default_copy=$SUDO_USER
[[ -z $default_copy || $default_copy = root ]] && default_copy=copy
src_owner=${SUDO_USER:-$USER}

usage() {
	echo "Usage: ${0##*/} [options] -r <chrootdir> [--] [makepkg args]"
	echo ' Run this script in a PKGBUILD dir to build a package inside a'
	echo ' clean chroot. All unrecognized arguments passed to this script'
	echo ' will be passed to makepkg.'
	echo ''
	echo ' The chroot dir consists of the following directories:'
	echo ' <chrootdir>/{root, copy} but only "root" is required'
	echo ' by default. The working copy will be created as needed'
	echo ''
	echo 'The chroot "root" directory must be created via the following'
	echo 'command:'
	echo '    mkarchroot <chrootdir>/root base base-devel sudo'
	echo ''
	echo "Default makepkg args: $makepkg_args"
	echo ''
	echo 'Flags:'
	echo '-h         This help'
	echo '-c         Clean the chroot before building'
	echo '-u         Update the working copy of the chroot before building'
	echo '           This is useful for rebuilds without dirtying the pristine'
	echo '           chroot'
	echo '-d         Add the package to a local db at /repo after building'
	echo '-r <dir>   The chroot dir to use'
	echo '-I <pkg>   Install a package into the working copy of the chroot'
	echo '-l <copy>  The directory to use as the working copy of the chroot'
	echo '           Useful for maintaining multiple copies.'
	echo "           Default: $default_copy"
	echo '-n         Run namcap on the package'
	exit 1
}

while getopts 'hcudr:I:l:n' arg; do
	case "$arg" in
		h) usage ;;
		c) clean_first=true ;;
		u) update_first=true ;;
		d) add_to_db=true ;;
		r) passeddir="$OPTARG" ;;
		I) install_pkgs+=("$OPTARG") ;;
		l) copy="$OPTARG" ;;
		n) run_namcap=true; makepkg_args="$makepkg_args -i" ;;
		*) makepkg_args="$makepkg_args -$arg $OPTARG" ;;
	esac
done

# Canonicalize chrootdir, getting rid of trailing /
chrootdir=$(readlink -e "$passeddir")

# Detect chrootdir filesystem type
chroottype=$(stat -f -c %T "$chrootdir")

if [[ ${copy:0:1} = / ]]; then
	copydir=$copy
else
	[[ -z $copy ]] && copy=$default_copy
	copydir="$chrootdir/$copy"
fi

# Pass all arguments after -- right to makepkg
makepkg_args="$makepkg_args ${*:$OPTIND}"

# See if -R was passed to makepkg
for arg in ${*:$OPTIND}; do
	if [[ $arg = -R ]]; then
		repack=true
		break
	fi
done

if (( EUID )); then
	die 'This script must be run as root.'
fi

if [[ ! -f PKGBUILD && -z "${install_pkgs[*]}" ]]; then
	die 'This must be run in a directory containing a PKGBUILD.'
fi

if [[ ! -d $chrootdir ]]; then
	die "No chroot dir defined, or invalid path '$passeddir'"
fi

if [[ ! -d $chrootdir/root ]]; then
	die "Missing chroot dir root directory. Try using: mkarchroot $chrootdir/root base base-devel sudo"
fi

umask 0022

# Lock the chroot we want to use. We'll keep this lock until we exit.
# Note this is the same FD number as in mkarchroot
exec 9>"$copydir.lock"
if ! flock -n 9; then
	stat_busy "Locking chroot copy [$copy]"
	flock 9
	stat_done
fi

if [[ ! -d $copydir ]] || $clean_first; then
	# Get a read lock on the root chroot to make
	# sure we don't clone a half-updated chroot
	exec 8>"$chrootdir/root.lock"

	if ! flock -sn 8; then
		stat_busy "Locking clean chroot"
		flock -s 8
		stat_done
	fi

	stat_busy "Creating clean working copy [$copy]"
	if [[ "$chroottype" == btrfs ]]; then
		if [[ -d $copydir ]]; then
			btrfs subvolume delete "$copydir" >/dev/null ||
				die "Unable to delete subvolume $copydir"
		fi
		btrfs subvolume snapshot "$chrootdir/root" "$copydir" >/dev/null ||
			die "Unable to create subvolume $copydir"
	else
		mkdir -p "$copydir"
		rsync -a --delete -q -W -x "$chrootdir/root/" "$copydir"
	fi
	stat_done

	# Drop the read lock again
	exec 8>&-
fi

if [[ -n "${install_pkgs[*]}" ]]; then
	declare -i ret=0
	for install_pkg in "${install_pkgs[@]}"; do
		pkgname="${install_pkg##*/}"
		cp "$install_pkg" "$copydir/$pkgname"

		mkarchroot -r "pacman -U /$pkgname --noconfirm" "$copydir"
		(( ret += !! $? ))

		rm "$copydir/$pkgname"
	done

	# If there is no PKGBUILD we have done
	[[ -f PKGBUILD ]] || exit $ret
fi

$update_first && mkarchroot -u "$copydir"

mkdir -p "$copydir/build"

# Remove anything in there UNLESS -R (repack) was passed to makepkg
$repack || rm -rf "$copydir"/build/*

# Read .makepkg.conf and .gnupg/pubring.gpg even if called via sudo
if [[ -n $SUDO_USER ]]; then
	SUDO_HOME="$(eval echo ~$SUDO_USER)"
	makepkg_conf="$SUDO_HOME/.makepkg.conf"
	if [[ -r "$SUDO_HOME/.gnupg/pubring.gpg" ]]; then
		install -D "$SUDO_HOME/.gnupg/pubring.gpg" "$copydir/build/.gnupg/pubring.gpg"
	fi
else
	makepkg_conf="$HOME/.makepkg.conf"
	if [[ -r "$HOME/.gnupg/pubring.gpg" ]]; then
		install -D "$HOME/.gnupg/pubring.gpg" "$copydir/build/.gnupg/pubring.gpg"
	fi
fi

# Get SRC/PKGDEST from makepkg.conf
if [[ -f $makepkg_conf ]]; then
	eval $(grep '^SRCDEST=' "$makepkg_conf")
	eval $(grep '^PKGDEST=' "$makepkg_conf")
	eval $(grep '^MAKEFLAGS=' "$makepkg_conf")
	eval $(grep '^PACKAGER=' "$makepkg_conf")
fi

[[ -z $SRCDEST ]] && eval $(grep '^SRCDEST=' /etc/makepkg.conf)
[[ -z $PKGDEST ]] && eval $(grep '^PKGDEST=' /etc/makepkg.conf)
[[ -z $MAKEFLAGS ]] && eval $(grep '^MAKEFLAGS=' /etc/makepkg.conf)
[[ -z $PACKAGER ]] && eval $(grep '^PACKAGER=' /etc/makepkg.conf)

# Use PKGBUILD directory if PKGDEST or SRCDEST don't exist
[[ -d $PKGDEST ]] || PKGDEST=.
[[ -d $SRCDEST ]] || SRCDEST=.

mkdir -p "$copydir/pkgdest"
if ! grep -q 'PKGDEST="/pkgdest"' "$copydir/etc/makepkg.conf"; then
	echo 'PKGDEST="/pkgdest"' >> "$copydir/etc/makepkg.conf"
fi

mkdir -p "$copydir/srcdest"
if ! grep -q 'SRCDEST="/srcdest"' "$copydir/etc/makepkg.conf"; then
	echo 'SRCDEST="/srcdest"' >> "$copydir/etc/makepkg.conf"
fi

if [[ -n $MAKEFLAGS ]]; then
	sed -i '/^MAKEFLAGS=/d' "$copydir/etc/makepkg.conf"
	echo "MAKEFLAGS='${MAKEFLAGS}'" >> "$copydir/etc/makepkg.conf"
fi

if [[ -n $PACKAGER ]]; then
	sed -i '/^PACKAGER=/d' "$copydir/etc/makepkg.conf"
	echo "PACKAGER='${PACKAGER}'" >> "$copydir/etc/makepkg.conf"
fi

# Set target CARCH as it might be used within the PKGBUILD to select correct sources
eval $(grep '^CARCH=' "$copydir/etc/makepkg.conf")
export CARCH

# Copy PKGBUILD and sources
cp PKGBUILD "$copydir/build/"
(
	source PKGBUILD
	for file in "${source[@]}"; do
		file="${file%%::*}"
		file="${file##*://*/}"
		if [[ -f $file ]]; then
			cp "$file" "$copydir/srcdest/"
		elif [[ -f $SRCDEST/$file ]]; then
			cp "$SRCDEST/$file" "$copydir/srcdest/"
		fi
	done

	# Find all changelog and install files, even inside functions
	for i in 'changelog' 'install'; do
		while read -r file; do
			# evaluate any bash variables used
			eval file=\"$(sed 's/^\(['\''"]\)\(.*\)\1$/\2/' <<< "$file")\"
			[[ -f $file ]] && cp "$file" "$copydir/build/"
		done < <(sed -n "s/^[[:space:]]*$i=//p" PKGBUILD)
	done
)

chown -R nobody "$copydir"/{build,pkgdest,srcdest}

cat > "$copydir/etc/sudoers.d/nobody-pacman" <<EOF
Defaults env_keep += "HOME"
nobody ALL = NOPASSWD: /usr/bin/pacman
EOF
chmod 440 "$copydir/etc/sudoers.d/nobody-pacman"

# This is a little gross, but this way the script is recreated every time in the
# working copy
cat >"$copydir/chrootbuild" <<EOF
#!/bin/bash
. /etc/profile
export HOME=/build

cd /build
sudo -u nobody makepkg $makepkg_args || touch BUILD_FAILED

[[ -f BUILD_FAILED ]] && exit 1

if $run_namcap; then
	pacman -S --needed --noconfirm namcap
	for pkgfile in /build/PKGBUILD /pkgdest/*.pkg.tar.?z; do
		echo "Checking \${pkgfile##*/}"
		sudo -u nobody namcap "\$pkgfile" 2>&1 | tee "/build/\${pkgfile##*/}-namcap.log"
	done
fi

exit 0
EOF
chmod +x "$copydir/chrootbuild"

if mkarchroot -r "/chrootbuild" "$copydir"; then
	for pkgfile in "$copydir"/pkgdest/*.pkg.tar.?z; do
		if $add_to_db; then
			mkdir -p "$copydir/repo"
			pushd "$copydir/repo" >/dev/null
			cp "$pkgfile" .
			repo-add repo.db.tar.gz "${pkgfile##*/}"
			popd >/dev/null
		fi

		chown "$src_owner" "$pkgfile"
		mv "$pkgfile" "$PKGDEST"
	done

	for l in "$copydir"/build/*-{build,check,namcap,package,package_*}.log; do
		chown "$src_owner" "$l"
		[[ -f $l ]] && mv "$l" .
	done
else
	# Just in case. We returned 1, make sure we fail
	touch "$copydir/build/BUILD_FAILED"
fi

for f in "$copydir"/srcdest/*; do
	chown "$src_owner" "$f"
	mv "$f" "$SRCDEST"
done

if [[ -e $copydir/build/BUILD_FAILED ]]; then
	rm "$copydir/build/BUILD_FAILED"
	die "Build failed, check $copydir/build"
fi