Verified Commit d54bf635 authored by David Runge's avatar David Runge
Browse files

mkarchiso: Add buildmode to export netboot artifacts

archiso/mkarchiso:
Implement a buildmode to export artifacts required for netboot with IPXE.
When providing the buildmode 'netboot' via profiledef.sh or the `-m` option, all targets necessary to create an ISO
medium are built, but the components required for netboot are exported to the output dir.
Optionally, it is possible to provide a set of certificates for codsigning using the `-c` option, where the first file
is considered as the signer certificate and the second as the key.

Add `_export_netboot_artifacts()` to copy build artifacts to the output directory.
Add `_sign_netboot_artifacts()` to codesign the netboot artifacts in the work directory.
Add `_validate_requirements_buildmode_netboot()` to check for openssl.
Add `_build_iso_base()` to implement common function calls between the 'iso' and the 'netboot' buildmodes.
Add `_build_buildmode_netboot()` to make use of `_build_iso_base()`, (optionally) `_sign_netboot_artifacts()` and
`_export_netboot_artifacts()`.
Change `_build_buildmode_iso()` to make use of `_build_iso_base()`.
Add `-c` as an option to mkarchiso to read in a list of file names.
Unify the output of `_usage()` by using the same definition style for lists of strings provided to options that accept
them (e.g. `-c`, `-m`, `-p`).

Closes #128
parent 1fed84c7
......@@ -34,6 +34,8 @@ buildmodes=()
bootmodes=()
airootfs_image_type=""
airootfs_image_tool_options=()
cert_list=()
sign_netboot_artifacts=""
declare -A file_permissions=()
......@@ -96,13 +98,17 @@ usage: ${app_name} [options] <profile_dir>
Default: '${iso_label}'
-P <publisher> Set the ISO publisher
Default: '${iso_publisher}'
-c [cert ..] Provide certificates for codesigning of netboot artifacts
Multiple files are provided as quoted, space delimited list.
The first file is considered as the signing certificate,
the second as the key.
-g <gpg_key> Set the PGP key ID to be used for signing the rootfs image
-h This message
-m [build modes] Build modes to use (valid modes are: 'bootstrap' and 'iso').
-m [mode ..] Build mode(s) to use (valid modes are: 'bootstrap', 'iso' and 'netboot').
Multiple build modes are provided as quoted, space delimited list.
-o <out_dir> Set the output directory
Default: '${out_dir}'
-p PACKAGE(S) Package(s) to install.
-p [package ..] Package(s) to install.
Multiple packages are provided as quoted, space delimited list.
-v Enable verbose output
-w <work_dir> Set the working directory
......@@ -127,6 +133,7 @@ _show_config() {
_msg_info " Current build mode: ${buildmode}"
_msg_info " Build modes: ${buildmodes[*]}"
_msg_info " GPG key: ${gpg_key:-None}"
_msg_info "Code signing certificates: ${cert_list[*]}"
_msg_info " Profile: ${profile}"
_msg_info "Pacman configuration file: ${pacman_conf}"
_msg_info " Image file name: ${image_name:-None}"
......@@ -650,6 +657,34 @@ _prepare_airootfs_image() {
fi
}
# export build artifacts for netboot
_export_netboot_artifacts() {
_msg_info "Exporting netboot artifacts..."
install -d -m 0755 "${out_dir}"
cp -a -- "${isofs_dir}/${install_dir}/" "${out_dir}/"
_msg_info "Done!"
du -h -- "${out_dir}/${install_dir}"
}
# sign build artifacts for netboot
_sign_netboot_artifacts() {
local _file _dir
_msg_info "Signing netboot artifacts..."
_dir="${isofs_dir}/${install_dir}/"
for _file in "${_dir}/boot/"*ucode.img "${_dir}/boot/${arch}/vmlinuz-"* "${_dir}/boot/${arch}/initramfs-"*.img; do
openssl cms \
-sign \
-binary \
-noattr \
-in "${_file}" \
-signer "${cert_list[0]}" \
-inkey "${cert_list[1]}" \
-outform DER \
-out "${_file}".ipxe.sig
done
_msg_info "Done!"
}
_validate_requirements_airootfs_image_type_squashfs() {
if ! command -v mksquashfs &> /dev/null; then
(( validation_error=validation_error+1 ))
......@@ -703,6 +738,14 @@ _validate_requirements_buildmode_iso() {
fi
}
_validate_requirements_buildmode_netboot() {
_validate_requirements_buildmode_all
if ! command -v openssl &> /dev/null; then
(( validation_error=validation_error+1 ))
_msg_error "Validating build mode '${_buildmode}': openssl is not available on this host. Install 'openssl'!" 0
fi
}
# SYSLINUX El Torito
_add_xorrisofs_options_bios.syslinux.eltorito() {
xorrisofs_options+=(
......@@ -884,9 +927,10 @@ _read_profile() {
# Validate set options
_validate_options() {
local validation_error=0 bootmode _buildmode
local validation_error=0 bootmode _cert _buildmode
local pkg_list_from_file=()
local bootstrap_pkg_list_from_file=()
local _override_cert_list=()
_msg_info "Validating options..."
# Check if the package list file exists and read packages from it
......@@ -917,7 +961,23 @@ _validate_options() {
_msg_error "Bootstrap packages file '${bootstrap_packages}' does not exist." 0
fi
fi
if [[ "${sign_netboot_artifacts}" == "y" ]]; then
# Check if the certificate files exist
for _cert in "${cert_list[@]}"; do
if [[ -e "${_cert}" ]]; then
_override_cert_list+=("$(realpath -- "${_cert}")")
else
(( validation_error=validation_error+1 ))
_msg_error "File '${_cert}' does not exist." 0
fi
done
cert_list=("${_override_cert_list[@]}")
# Check if there are at least two certificate files
if (( "${#cert_list[@]}" < 2 )); then
(( validation_error=validation_error+1 ))
_msg_error "Two certificates are required for codesigning, but '${cert_list[*]}' is provided." 0
fi
fi
# Check if pacman configuration file exists
if [[ ! -e "${pacman_conf}" ]]; then
(( validation_error=validation_error+1 ))
......@@ -1017,6 +1077,10 @@ _set_overrides() {
install_dir="${app_name}"
fi
[[ ! -v override_gpg_key ]] || gpg_key="$override_gpg_key"
if [[ -v override_cert_list ]]; then
sign_netboot_artifacts="y"
fi
[[ ! -v override_cert_list ]] || cert_list+=("${override_cert_list[@]}")
if [[ -v override_quiet ]]; then
quiet="$override_quiet"
elif [[ -z "$quiet" ]]; then
......@@ -1079,38 +1143,15 @@ _make_pkglist() {
_msg_info "Done!"
}
_build_buildmode_bootstrap() {
local image_name="${iso_name}-bootstrap-${iso_version}-${arch}.tar.gz"
local run_once_mode="${buildmode}"
local buildmode_packages="${bootstrap_packages}"
local buildmode_pkg_list=()
# Set the package list to use
buildmode_pkg_list=("${bootstrap_pkg_list[@]}")
# Set up essential directory paths
pacstrap_dir="${work_dir}/${arch}/bootstrap/root.${arch}"
[[ -d "${work_dir}" ]] || install -d -- "${work_dir}"
install -d -m 0755 -o 0 -g 0 -- "${pacstrap_dir}"
[[ "${quiet}" == "y" ]] || _show_config
_run_once _make_pacman_conf
_run_once _make_packages
_run_once _make_version
_run_once _make_pkglist
_run_once _cleanup_pacstrap_dir
_run_once _build_bootstrap_image
}
_build_buildmode_iso() {
local image_name="${iso_name}-${iso_version}-${arch}.iso"
local run_once_mode="${buildmode}"
# build the base for an ISO and/or a netboot target
_build_iso_base() {
local run_once_mode="base"
local buildmode_packages="${packages}"
local buildmode_pkg_list=()
# Set the package list to use
local buildmode_pkg_list=("${pkg_list[@]}")
# Set up essential directory paths
pacstrap_dir="${work_dir}/${arch}/airootfs"
isofs_dir="${work_dir}/iso"
# Set the package list to use
buildmode_pkg_list=("${pkg_list[@]}")
# Create working directory
[[ -d "${work_dir}" ]] || install -d -- "${work_dir}"
......@@ -1132,6 +1173,46 @@ _build_buildmode_iso() {
_make_bootmodes
_run_once _cleanup_pacstrap_dir
_run_once _prepare_airootfs_image
}
# Build the bootstrap buildmode
_build_buildmode_bootstrap() {
local image_name="${iso_name}-bootstrap-${iso_version}-${arch}.tar.gz"
local run_once_mode="${buildmode}"
local buildmode_packages="${bootstrap_packages}"
# Set the package list to use
local buildmode_pkg_list=("${bootstrap_pkg_list[@]}")
# Set up essential directory paths
pacstrap_dir="${work_dir}/${arch}/bootstrap/root.${arch}"
[[ -d "${work_dir}" ]] || install -d -- "${work_dir}"
install -d -m 0755 -o 0 -g 0 -- "${pacstrap_dir}"
[[ "${quiet}" == "y" ]] || _show_config
_run_once _make_pacman_conf
_run_once _make_packages
_run_once _make_version
_run_once _make_pkglist
_run_once _cleanup_pacstrap_dir
_run_once _build_bootstrap_image
}
# Build the netboot buildmode
_build_buildmode_netboot() {
local run_once_mode="${buildmode}"
_run_once _build_iso_base
if [[ -v cert_list ]]; then
_run_once _sign_netboot_artifacts
fi
_run_once _export_netboot_artifacts
}
# Build the ISO buildmode
_build_buildmode_iso() {
local image_name="${iso_name}-${iso_version}-${arch}.iso"
local run_once_mode="${buildmode}"
_run_once _build_iso_base
_run_once _build_iso_image
}
......@@ -1145,7 +1226,7 @@ _build() {
done
}
while getopts 'p:C:L:P:A:D:w:m:o:g:vh?' arg; do
while getopts 'c:p:C:L:P:A:D:w:m:o:g:vh?' arg; do
case "${arg}" in
p) read -r -a override_pkg_list <<< "${OPTARG}" ;;
C) override_pacman_conf="${OPTARG}" ;;
......@@ -1153,6 +1234,7 @@ while getopts 'p:C:L:P:A:D:w:m:o:g:vh?' arg; do
P) override_iso_publisher="${OPTARG}" ;;
A) override_iso_application="${OPTARG}" ;;
D) override_install_dir="${OPTARG}" ;;
c) read -r -a override_cert_list <<< "${OPTARG}" ;;
w) override_work_dir="${OPTARG}" ;;
m) read -r -a override_buildmodes <<< "${OPTARG}" ;;
o) override_out_dir="${OPTARG}" ;;
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment