devtools/arch-nspawn.in

142 lines
4.3 KiB
Plaintext
Raw Normal View History

#!/bin/bash
# License: GNU GPLv2
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; version 2 of the License.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
m4_include(lib/common.sh)
m4_include(lib/archroot.sh)
# umask might have been changed in /etc/profile
# ensure that sane default is set again
umask 0022
working_dir=''
files=()
mount_args=()
usage() {
echo "Usage: ${0##*/} [options] working-dir [systemd-nspawn arguments]"
echo "A wrapper around systemd-nspawn. Provides support for pacman."
echo
echo ' options:'
echo ' -C <file> Location of a pacman config file'
echo ' -M <file> Location of a makepkg config file'
echo ' -c <dir> Set pacman cache'
echo ' -f <file> Copy file from the host to the chroot'
echo ' -s Do not run setarch'
echo ' -h This message'
exit 1
}
while getopts 'hC:M:c:f:s' arg; do
case "$arg" in
C) pac_conf="$OPTARG" ;;
M) makepkg_conf="$OPTARG" ;;
c) cache_dirs+=("$OPTARG") ;;
f) files+=("$OPTARG") ;;
s) nosetarch=1 ;;
h|?) usage ;;
*) error "invalid argument '%s'" "$arg"; usage ;;
esac
done
shift $((OPTIND - 1))
(( $# < 1 )) && die 'You must specify a directory.'
check_root
working_dir=$(readlink -f "$1")
shift 1
[[ -z $working_dir ]] && die 'Please specify a working directory.'
pacconf_cmd=$(command -v pacman-conf || command -v pacconf)
if (( ${#cache_dirs[@]} == 0 )); then
mapfile -t cache_dirs < <($pacconf_cmd --config "${pac_conf:-$working_dir/etc/pacman.conf}" CacheDir)
fi
# shellcheck disable=2016
host_mirrors=($($pacconf_cmd --repo extra Server 2> /dev/null | sed -r 's#(.*/)extra/os/.*#\1$repo/os/$arch#'))
for host_mirror in "${host_mirrors[@]}"; do
if [[ $host_mirror == *file://* ]]; then
host_mirror=$(echo "$host_mirror" | sed -r 's#file://(/.*)/\$repo/os/\$arch#\1#g')
for m in "$host_mirror"/pool/*/; do
in_array "$m" "${cache_dirs[@]}" || cache_dirs+=("$m")
done
fi
done
while read -r line; do
mapfile -t lines < <($pacconf_cmd --config "${pac_conf:-$working_dir/etc/pacman.conf}" \
--repo $line Server | sed -r 's#(.*/)[^/]+/os/.+#\1#')
for line in "${lines[@]}"; do
if [[ $line = file://* ]]; then
line=${line#file://}
in_array "$line" "${cache_dirs[@]}" || cache_dirs+=("$line")
fi
done
done < <($pacconf_cmd --config "${pac_conf:-$working_dir/etc/pacman.conf}" --repo-list)
mount_args+=("--bind=${cache_dirs[0]//:/\\:}")
for cache_dir in "${cache_dirs[@]:1}"; do
mount_args+=("--bind-ro=${cache_dir//:/\\:}")
done
# {{{ functions
copy_hostconf () {
unshare --fork --pid gpg --homedir "$working_dir"/etc/pacman.d/gnupg/ --no-permission-warning --quiet --batch --import --import-options import-local-sigs "$(pacman-conf GpgDir)"/pubring.gpg >/dev/null 2>&1
arch-nspawn: don't delete the guest gpg configuration It's important to ensure the guest has up to date data because updating a chroot after quite some time can potentially rely on updated archlinux-keyring, something which the host machine either kept up to date on or manually fixed, but it kills automation to mess around with chroot configs like that. Alternatively, signed packages added with -I need to work, and we assume the host is configured to accept these. That is *not* a good reason to completely nuke whatever is in the guest, though. A guest might have been manually configured to accept keys which aren't accepted by the host; one example of this happening in practice, is archlinux32 when building 32-bit packages from an archlinux host. The right solution is to append to, rather thna overwrite, the chrooted guest's pacman keyring. To do this, we will use gpg's native facility to dump the keyring from one GNUPGHOME and import it into another. We'd use pacman-key's --import option directly, but this doesn't support passing custom options like --import-options import-local-sigs Finally use pacman-key's native facility to import the trust status from the host. While we are at it, fix a bug where we didn't respect the host's pacman.conf settings for the GpgDir. While it isn't wildly likely a user will choose to customize this, it is a valid and supported use case and we must think about this ourselves. Signed-off-by: Eli Schwartz <eschwartz@archlinux.org> Signed-off-by: Levente Polyak <anthraxx@archlinux.org>
2018-12-02 01:36:23 +01:00
pacman-key --gpgdir "$working_dir"/etc/pacman.d/gnupg/ --import-trustdb "$(pacman-conf GpgDir)" >/dev/null 2>&1
2014-12-29 06:27:34 +01:00
#printf 'Server = %s\n' "${host_mirrors[@]}" >"$working_dir/etc/pacman.d/mirrorlist"
[[ -n $pac_conf ]] && cp "$pac_conf" "$working_dir/etc/pacman.conf"
[[ -n $makepkg_conf ]] && cp "$makepkg_conf" "$working_dir/etc/makepkg.conf"
local file
for file in "${files[@]}"; do
mkdir -p "$(dirname "$working_dir$file")"
cp -T "$file" "$working_dir$file"
done
sed -r "s|^#?\\s*CacheDir.+|CacheDir = ${cache_dirs[*]}|g" -i "$working_dir/etc/pacman.conf"
}
# }}}
umask 0022
# Sanity check
if [[ ! -f "$working_dir/.arch-chroot" ]]; then
die "'%s' does not appear to be an Arch chroot." "$working_dir"
elif [[ $(cat "$working_dir/.arch-chroot") != "$CHROOT_VERSION" ]]; then
die "chroot '%s' is not at version %s. Please rebuild." "$working_dir" "$CHROOT_VERSION"
fi
copy_hostconf
eval "$(grep -a '^CARCH=' "$working_dir/etc/makepkg.conf")"
[[ -z $nosetarch ]] || unset CARCH
for p in echo exec; do
[[ $p == echo ]] && msg "Entering chroot \"$working_dir\" via:"
"$p" systemd-nspawn -q \
-D "$working_dir" \
-E "PATH=/usr/local/sbin:/usr/local/bin:/usr/bin" \
--register=no \
--as-pid2 \
--rlimit=NOFILE=10000 \
--resolv-conf=copy-host \
"${mount_args[@]}" \
"$@"
done