144 lines
6.1 KiB
Shell
Executable file
144 lines
6.1 KiB
Shell
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
root="$(cd "$(dirname "$0")/.." && pwd)"
|
|
revision=9f8f6c917885d9ef3d84c17280939c012dea0dfe
|
|
archive_checksum=9d96426115f1bf54ef09ba41964c73dc3c809743519c8442016b8dd3fce0889d
|
|
patch_files=(
|
|
"$root/patches/gvisor-9f8f6c917-directory-handles.patch"
|
|
"$root/patches/gvisor-9f8f6c917-private-ownership.patch"
|
|
"$root/patches/gvisor-9f8f6c917-per-description-file-handles.patch"
|
|
"$root/patches/gvisor-9f8f6c917-hostinet-recv-flags.patch"
|
|
"$root/patches/gvisor-9f8f6c917-gofer-zombie-state.patch"
|
|
)
|
|
patch_checksums=(
|
|
541420eece9ec7efbef156bdb726744ead6b4d991d41c5560f4fdfe83fb2357a
|
|
79a8c98502d3bb7c254ffb0885dbd26afffac227d04a0091ff91383df0842561
|
|
2403efb81df3185145d18ebdf8d511252fbc2fb414bae4746d7fe471ec4ea9d9
|
|
d3f49a22fe60955d422f63557bc16907fdf65dff368dff296af5535a67b76e74
|
|
2b7c7444dc56ff47e63af951c24d1dd30092c278c4cba7a6dcd3c3f1062c3206
|
|
)
|
|
patch_digest=669b658a29c006d7fd0a472f959265ee79f1fbc78673d0cdc3b31a7721afab98
|
|
bazel_version=8.3.1
|
|
module_lock="$root/patches/gvisor-9f8f6c917-MODULE.bazel.lock"
|
|
module_checksum=8402c7beb4baf2c666f4b78e400ea3f15514b56117598c2cb5411d6a35208d34
|
|
build_id=9e711e005f13402e728a0c3ada3fdc67a38918da31f720e5be1006edc4272a51
|
|
archive="$root/.lazaret/cache/gvisor-$revision.tar.gz"
|
|
source="$root/.lazaret/vendor/gvisor-$build_id"
|
|
binary="$root/.lazaret/bin/lazaret-runsc-$build_id"
|
|
mode=source
|
|
|
|
if [[ "${1:-}" == "--build" && $# -eq 1 ]]; then
|
|
mode=build
|
|
elif [[ "${1:-}" == "--test" && $# -eq 1 ]]; then
|
|
mode=test
|
|
elif [[ $# -ne 0 ]]; then
|
|
printf '%s\n' 'usage: tools/materialize-runsc [--build|--test]' >&2
|
|
exit 2
|
|
fi
|
|
|
|
fail() {
|
|
printf 'materialize-runsc: %s\n' "$*" >&2
|
|
exit 1
|
|
}
|
|
|
|
for command in curl patch sha256sum tar; do
|
|
command -v "$command" >/dev/null 2>&1 || fail "$command is required"
|
|
done
|
|
|
|
for index in "${!patch_files[@]}"; do
|
|
patch_file="${patch_files[$index]}"
|
|
[[ -f "$patch_file" ]] || fail "missing patch: $patch_file"
|
|
[[ "$(sha256sum "$patch_file" | cut -d ' ' -f 1)" == "${patch_checksums[$index]}" ]] ||
|
|
fail "patch checksum mismatch: $patch_file"
|
|
done
|
|
[[ "$(printf '%s\n' "${patch_checksums[@]}" | sha256sum | cut -d ' ' -f 1)" == "$patch_digest" ]] ||
|
|
fail 'ordered patch digest mismatch'
|
|
[[ -f "$module_lock" ]] || fail "missing module lock: $module_lock"
|
|
[[ "$(sha256sum "$module_lock" | cut -d ' ' -f 1)" == "$module_checksum" ]] ||
|
|
fail 'module lock checksum mismatch'
|
|
|
|
stamp="$revision $archive_checksum $patch_digest $bazel_version $module_checksum $build_id"
|
|
if [[ ! -f "$source/.lazaret-materialization" ]]; then
|
|
mkdir -p "$root/.lazaret/cache" "$root/.lazaret/vendor"
|
|
if [[ ! -f "$archive" ]]; then
|
|
partial="$archive.partial.$$"
|
|
trap 'rm -f "$partial"' EXIT
|
|
curl --fail --location --output "$partial" \
|
|
"https://codeload.github.com/google/gvisor/tar.gz/$revision"
|
|
[[ "$(sha256sum "$partial" | cut -d ' ' -f 1)" == "$archive_checksum" ]] ||
|
|
fail 'downloaded archive checksum mismatch'
|
|
mv "$partial" "$archive"
|
|
trap - EXIT
|
|
fi
|
|
[[ "$(sha256sum "$archive" | cut -d ' ' -f 1)" == "$archive_checksum" ]] ||
|
|
fail 'cached archive checksum mismatch'
|
|
temporary="$(mktemp -d "$root/.lazaret/vendor/.gvisor-$build_id.XXXXXX")"
|
|
trap 'rm -rf "$temporary"' EXIT
|
|
tar -xzf "$archive" -C "$temporary"
|
|
extracted="$temporary/gvisor-$revision"
|
|
[[ -d "$extracted" ]] || fail 'archive has an unexpected root directory'
|
|
for patch_file in "${patch_files[@]}"; do
|
|
patch --directory="$extracted" --strip=1 --batch --fuzz=0 --forward <"$patch_file"
|
|
done
|
|
[[ "$(tr -d '\n' <"$extracted/.bazelversion")" == "$bazel_version" ]] ||
|
|
fail 'Bazel version mismatch'
|
|
install -m 0644 "$module_lock" "$extracted/MODULE.bazel.lock"
|
|
printf '%s\n' "$stamp" >"$extracted/.lazaret-materialization"
|
|
[[ ! -e "$source" ]] || fail 'immutable source destination already exists without a valid stamp'
|
|
mv "$extracted" "$source"
|
|
trap - EXIT
|
|
elif [[ "$(tr -d '\n' <"$source/.lazaret-materialization")" != "$stamp" ]]; then
|
|
fail 'materialized source identity mismatch'
|
|
fi
|
|
|
|
if [[ "$mode" != source ]]; then
|
|
[[ "${LAZARET_BUILD_CONTAINER:-}" == 1 ]] || fail 'build and test modes require tools/build'
|
|
command -v bazel >/dev/null 2>&1 || fail 'bazel is required'
|
|
[[ "$(bazel --version)" == "bazel $bazel_version" ]] || fail 'Bazel version mismatch'
|
|
fi
|
|
if [[ "$mode" == test ]]; then
|
|
(
|
|
cd "$source"
|
|
bazel test \
|
|
--color=no \
|
|
--curses=no \
|
|
--incompatible_sandbox_hermetic_tmp=false \
|
|
--keep_going \
|
|
--strip=never \
|
|
--test_output=errors \
|
|
--verbose_failures=true \
|
|
//pkg/sentry/fsimpl/gofer:gofer_test \
|
|
//runsc/fsgofer:lisafs_test \
|
|
//test/syscalls:socket_ip_tcp_generic_loopback_test_native \
|
|
//test/syscalls:socket_ip_tcp_generic_loopback_test_runsc_systrap_hostnet
|
|
bazel test \
|
|
--color=no \
|
|
--curses=no \
|
|
--incompatible_sandbox_hermetic_tmp=false \
|
|
--strip=never \
|
|
--test_filter=TestProcessStateIsTerminal \
|
|
--test_output=errors \
|
|
--verbose_failures=true \
|
|
//runsc/container:container_test
|
|
)
|
|
fi
|
|
if [[ "$mode" != source ]]; then
|
|
(cd "$source" && bazel build --color=no --curses=no //runsc:runsc)
|
|
built="$source/bazel-bin/runsc/runsc_/runsc"
|
|
[[ -x "$built" ]] || fail 'canonical build did not produce runsc'
|
|
version_output="$($built --version 2>&1)"
|
|
[[ "$version_output" == $'runsc version 0.0.0\nspec: 1.2.1' ]] ||
|
|
fail 'built runsc reports an unexpected version'
|
|
mkdir -p "$root/.lazaret/bin"
|
|
if [[ ! -e "$binary" ]]; then
|
|
temporary_binary="$root/.lazaret/bin/.lazaret-runsc-$build_id.$$"
|
|
trap 'rm -f "$temporary_binary"' EXIT
|
|
install -m 0755 "$built" "$temporary_binary"
|
|
mv "$temporary_binary" "$binary"
|
|
trap - EXIT
|
|
fi
|
|
[[ -x "$binary" ]] || fail 'materialized runsc is not executable'
|
|
sha256sum "$binary" >"$binary.sha256"
|
|
printf '%s\n' "$binary"
|
|
fi
|