mirror of
https://github.com/freedombox/FreedomBox.git
synced 2026-03-25 09:21:10 +00:00
65fecdc4cd
The new version of systemd in Debian testing expects the symlinked file to be ending with .raw as well. So, our .img files weren't being recognized by machinectl as machine images. Signed-off-by: Joseph Nuthalapati <njoseph@riseup.net> [sunil: Remove old symlink forcefully] Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org> Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
1608 lines
61 KiB
Python
Executable File
1608 lines
61 KiB
Python
Executable File
#!/usr/bin/python3
|
|
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
"""Script to manage a container or a VM for FreedomBox development.
|
|
|
|
This script creates either a simple container using systemd-nspawn or a virtual
|
|
machine using libvirt for developing FreedomBox. Containers have many
|
|
advantages over running a VM. RAM is allocated to processes in the container as
|
|
needed without any fixed limit. Also RAM does not have to be statically
|
|
allocated so it is typically much lighter than running an VM. There is no
|
|
hardware emulation when running a container with same architecture, so
|
|
processes run as fast as they would on the host machine. On the other hand, VMs
|
|
have the advantage of full machine emulation. They allow full permissions as
|
|
required for mounting filesystems, USB passthrough of Wi-Fi devices, emulation
|
|
of multiple disks, etc. as required for testing some of the features of
|
|
FreedomBox.
|
|
|
|
Environment: The script will run only run on hosts having systemd-nspawn,
|
|
virsh, and network-manager installed, typical GNU/Linux distributions. It has
|
|
been primarily developed and tested on Debian Buster but should work on most
|
|
modern GNU/Linux distributions.
|
|
|
|
Disk image: For a container, systemd-nspawn accepts not only a directory for
|
|
starting a container but also a disk image. This disk image is loop-back
|
|
mounted and container is started from that mounted directory. The partition to
|
|
use is determined by looking at the boot flag in the partition table. This
|
|
happens to work well with all existing FreedomBox images. In future, we may be
|
|
able to run different architectures in this manner.
|
|
|
|
For a VM, a disk drive is created that is backed by the image file. The image
|
|
is a bootable image using GRUB as built by freedom-maker.
|
|
|
|
After downloading, the disk image is expanded along with the partition and file
|
|
system inside so that development can be done without running into disk space
|
|
issues. Expanding the disk does not immediately consume disk space because it
|
|
will be a sparse file. As data is written to the disk, it will occupy more and
|
|
more space but the upper limit is the size to which disk has been expanded.
|
|
|
|
Downloading images: Images are downloaded from FreedomBox download server using
|
|
fixed URLs for each distribution. Signature is verified for the download
|
|
images. The fingerprint of the allowed signing key is hard-coded in this
|
|
script. Downloaded images are kept even after destroying the extracted raw
|
|
image along with container. This allows for quickly resetting the container
|
|
without downloading again.
|
|
|
|
Booting: For a container, systemd-nspawn is run in 'boot' mode. This means that
|
|
init process (happens to be systemd) is started inside the container. It then
|
|
spawns all the other necessary daemons including openssh-server, firewalld and
|
|
network-manager. A login terminal can be opened using 'machinectl login'
|
|
because container is running systemd. SSH into the container is possible
|
|
because network is up, configured by network-manager, and openssh server is
|
|
running.
|
|
|
|
For a VM, when the virtual machine is started, the firmware of the machine
|
|
boots the machine from the attached disk. The boot process is similar to a
|
|
physical machine.
|
|
|
|
Shared folder: For a container, using systemd-nspawn, the project directory is
|
|
mounted as /freedombox inside the container. The project directory is
|
|
determined as directory in which this script resides. The project folder from
|
|
the container point of view will be read-only. Container should be able to
|
|
write various files such as build files into the /freedombox folder. To enable
|
|
writing, an additional read-write folder is overlayed onto /freedombox folder
|
|
in the container. This directory can't be created under the project folder and
|
|
is created instead in
|
|
$XDG_DATA_HOME/freedombox-container/overlay/$DISTRIBUTION. If XDG_DATA_HOME is
|
|
not set, it is assumed to be $HOME/.local/shared/. Whenever data is written
|
|
into /freedombox directory inside the container, this directory on the host
|
|
receives the changes. See documentation for Overlay filesystem for further
|
|
details. When container is destroyed, this overlay folder is destroyed to
|
|
ensure clean state after bringing up the container again.
|
|
|
|
For a VM, the project directory is exposed into the virtual machine with the
|
|
mount token 'freedombox' using virtiofs. This is done as part of virtual
|
|
machine configuration. Inside the virtual machine, a systemd .mount unit will
|
|
mount the virtiofs filesystem using the 'freedombox' token onto the folder
|
|
/freedombox. The folder is read-write.
|
|
|
|
Users: In container, PrivateUsers configuration flag for systemd-nspawn is
|
|
currently off. This means that each user's UID on the host is also the same UID
|
|
in the container as along as there is an entry in the container's password
|
|
database. In future, we may explore using private users inside the container.
|
|
|
|
'fbx' is the development user and its UID is changed during setup phase to
|
|
10000 hoping it would not match anything on the host system. 'fbx' user has
|
|
full sudo access inside the container without needing a password. Password for
|
|
this user is not set by default, but can be set if needed. If there is no
|
|
access to the container in any way, one can run 'sudo machinectl shell' and
|
|
then run 'passwd fbx' to set the password for the 'fbx' user.
|
|
|
|
'plinth' user's UID in the container is also changed and set to the UID of
|
|
whichever user owns the project directory. This allows the files to written by
|
|
'plinth' container user in the project directory because UID of the owner of
|
|
the directory is same as the 'plinth' user's UID in container.
|
|
|
|
Network: For a container, a private network is created inside the container
|
|
using systemd-nspawn feature. Network interfaces from the host are not
|
|
available inside the container. A new network interface called 'host0' is
|
|
configured inside the container which is automatically configured by
|
|
network-manager. On the host a new network interface is created. This script
|
|
creates configuration for a 'shared' network using network-manager. When
|
|
bringing up the container, this network connection is also brought up. A DHCP
|
|
server and a DNS server are started network-manager on the host side so that
|
|
DHCP and DNS client functions work inside the container. Traffic from the
|
|
container is also masqueraded so that Internet connectivity inside the
|
|
container works if the host has one.
|
|
|
|
If necessary, the network interface on host side can be differently configured.
|
|
For example, it can be bridged with another interface to expose the container
|
|
on a network that the host machine participates in.
|
|
|
|
The network IP address inside the container can be queried using machinectl.
|
|
This script queries that IP address and presents the address in its console
|
|
messages. All ports in the container can be reached from the host using this IP
|
|
address as long as the firewall inside the container allows it. There is no
|
|
need to perform port forwarding or mapping.
|
|
|
|
For a VM, the network device is fully emulated. On the host it is exposed as
|
|
network interface that is bridged with the default libvirt bridge. The bridge
|
|
interface is configured by libvirt and it listens for DHCP requests from the
|
|
guests and also has a DNS server running. All traffic from the guest is NATed
|
|
and, as a result, the guest has full network access. The guest is accessible
|
|
from the host using the guest IP address which can be retrieved by asking
|
|
libvirt.
|
|
|
|
SSH: It is assumed that openssh-server is installed inside the container. SSH
|
|
server keys in the container are created if missing. Client side keys are
|
|
created in .container/ssh directory and the public key is installed in the
|
|
authorized keys file of the 'fbx' user. The 'ssh' sub-command to this script is
|
|
simply a convenience mechanism for quick launch of ssh with the right IP
|
|
address, user name and identity file.
|
|
|
|
Role of machinectl: For a container, most of the work is done by
|
|
systemd-nspawn. machinectl is useful for running systemd-nspawn in the
|
|
background and querying its current state. It also helps with providing the IP
|
|
address of the container. machinectl is made to recognize the container by
|
|
creating a link in /var/lib/machines/ to the image file. systemd-nspawn options
|
|
are added by creating a temporary file in /run/systemd/nspawn. All machinectl
|
|
commands should work.
|
|
|
|
"""
|
|
|
|
import argparse
|
|
import datetime
|
|
import ipaddress
|
|
import itertools
|
|
import json
|
|
import logging
|
|
import os
|
|
import pathlib
|
|
import platform
|
|
import re
|
|
import shlex
|
|
import shutil
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
import time
|
|
import urllib.parse
|
|
from typing import Callable
|
|
from urllib.request import urlopen
|
|
|
|
URLS_AMD64 = {
|
|
'oldstable': 'https://ftp.freedombox.org/pub/freedombox/hardware/'
|
|
'amd64/bookworm/freedombox-bookworm_all-amd64.img.xz',
|
|
'stable': 'https://ftp.freedombox.org/pub/freedombox/hardware/'
|
|
'amd64/trixie/freedombox-trixie_all-amd64.img.xz',
|
|
'testing': 'https://ftp.freedombox.org/pub/freedombox/hardware/'
|
|
'amd64/testing/freedombox-testing_dev_all-amd64.img.xz',
|
|
'unstable': 'https://ftp.freedombox.org/pub/freedombox/hardware/'
|
|
'amd64/nightly/freedombox-unstable_dev_all-amd64.img.xz',
|
|
}
|
|
|
|
URLS_ARM64 = {
|
|
'oldstable': 'https://ftp.freedombox.org/pub/freedombox/hardware/'
|
|
'arm64/bookworm/freedombox-bookworm_all-arm64.img.xz',
|
|
'stable': 'https://ftp.freedombox.org/pub/freedombox/hardware/'
|
|
'arm64/trixie/freedombox-trixie_all-arm64.img.xz',
|
|
'testing': 'https://ftp.freedombox.org/pub/freedombox/hardware/'
|
|
'arm64/testing/freedombox-testing_dev_all-arm64.img.xz',
|
|
'unstable': 'https://ftp.freedombox.org/pub/freedombox/hardware/'
|
|
'arm64/nightly/freedombox-unstable_dev_all-arm64.img.xz',
|
|
}
|
|
|
|
URLS = URLS_AMD64
|
|
|
|
TRUSTED_KEYS = ['D4B069124FCF43AA1FCD7FBC2ACFC1E15AF82D8C']
|
|
KEY_SERVER = 'keyserver.ubuntu.com'
|
|
KEY_SERVER_HTTPS_API = \
|
|
'https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x{key_id}'
|
|
|
|
PROVISION_SCRIPT = '''
|
|
set -xe pipefail
|
|
|
|
cd /freedombox/
|
|
|
|
sudo apt-get -y install make
|
|
sudo make provision-dev
|
|
|
|
# Make some pytest related files and directories writable to the fbx user
|
|
sudo touch geckodriver.log
|
|
sudo chmod a+rw geckodriver.log
|
|
sudo mkdir -p .pytest_cache/
|
|
sudo chmod --recursive a+rw .pytest_cache/
|
|
sudo chmod a+w /freedombox
|
|
sudo chmod --recursive --silent a+w htmlcov || true
|
|
sudo chmod --silent a+w .coverage || true
|
|
|
|
exit 0
|
|
''' # noqa
|
|
|
|
SETUP_AND_RUN_TESTS_SCRIPT = '''
|
|
set -x
|
|
|
|
BACKPORTS_SOURCES_LIST=/etc/apt/sources.list.d/freedombox2.list
|
|
LDAPSCRIPTS_CONF=/etc/ldapscripts/freedombox-ldapscripts.conf
|
|
|
|
# Remount /freedoombox to be up to date
|
|
echo "> In machine: Remounting /freedombox"
|
|
mount -o remount /freedombox
|
|
|
|
# Activate backports if Debian stable
|
|
if [[ "{distribution}" == "stable" && ! -e $BACKPORTS_SOURCES_LIST ]]
|
|
then
|
|
echo "> In machine: Enable backports"
|
|
/freedombox/bin/freedombox-cmd upgrades activate_backports --no-args
|
|
fi
|
|
|
|
echo "> In machine: Upgrade packages"
|
|
apt-get update
|
|
apt-mark hold freedombox freedombox-doc-en freedombox-doc-es
|
|
DEBIAN_FRONTEND=noninteractive apt-get -yq --with-new-pkgs upgrade
|
|
|
|
# Install requirements for tests if not already installed as root
|
|
if ! [[ -e /usr/local/bin/geckodriver ]]
|
|
then
|
|
/freedombox/plinth/tests/functional/install.sh
|
|
fi
|
|
|
|
# Run the plinth server if functional tests are requested
|
|
if [[ "{pytest_command}" =~ "--include-functional" ]]
|
|
then
|
|
make -C /freedombox wait-while-first-setup
|
|
|
|
if [[ "{pytest_command}" != *"--splinter-headless"* ]]
|
|
then
|
|
# Use the X11 authority file from the fbx user to run GUI programs
|
|
xauth merge /home/fbx/.Xauthority
|
|
fi
|
|
fi
|
|
|
|
# Run pytest
|
|
cd /freedombox
|
|
export FREEDOMBOX_URL=https://localhost
|
|
export FREEDOMBOX_SSH_PORT=22
|
|
export FREEDOMBOX_SAMBA_PORT=445
|
|
{pytest_command}
|
|
|
|
# Make pytest cache files writable to the fbx user
|
|
chmod --recursive --silent a+rw .pytest_cache/
|
|
chmod --recursive --silent a+w htmlcov
|
|
chmod --silent a+w .coverage
|
|
|
|
exit 0
|
|
'''
|
|
|
|
LIBVIRT_DOMAIN_XML_TEMPLATE = '''<domain type="kvm">
|
|
<name>{domain_name}</name>
|
|
<metadata>
|
|
<libosinfo:libosinfo xmlns:libosinfo="http://libosinfo.org/xmlns/libvirt/domain/1.0">
|
|
<libosinfo:os id="http://debian.org/debian/testing"/>
|
|
</libosinfo:libosinfo>
|
|
</metadata>
|
|
<memory unit="MiB">{memory_mib}</memory>
|
|
<currentMemory unit="MiB">{memory_mib}</currentMemory>
|
|
<memoryBacking>
|
|
<source type="memfd"/>
|
|
<access mode="shared"/>
|
|
</memoryBacking>
|
|
<vcpu placement="static">{cpus}</vcpu>
|
|
<os {firmware}>
|
|
<type arch="x86_64" machine="pc-q35-7.2">hvm</type>
|
|
<boot dev="hd"/>
|
|
</os>
|
|
<features>
|
|
<acpi/>
|
|
<apic/>
|
|
<vmport state="off"/>
|
|
</features>
|
|
<cpu mode="host-passthrough" check="none" migratable="on"/>
|
|
<clock offset="utc">
|
|
<timer name="rtc" tickpolicy="catchup"/>
|
|
<timer name="pit" tickpolicy="delay"/>
|
|
<timer name="hpet" present="no"/>
|
|
</clock>
|
|
<on_poweroff>destroy</on_poweroff>
|
|
<on_reboot>restart</on_reboot>
|
|
<on_crash>destroy</on_crash>
|
|
<pm>
|
|
<suspend-to-mem enabled="no"/>
|
|
<suspend-to-disk enabled="no"/>
|
|
</pm>
|
|
<devices>
|
|
<emulator>/usr/bin/qemu-system-x86_64</emulator>
|
|
<disk type="file" device="disk">
|
|
<driver name="qemu" type="qcow2"/>
|
|
<source file="{image_file}"/>
|
|
<target dev="vda" bus="virtio"/>
|
|
<address type="pci" domain="0x0000" bus="0x04" slot="0x00" function="0x0"/>
|
|
</disk>
|
|
<controller type="usb" index="0" model="qemu-xhci" ports="15">
|
|
<address type="pci" domain="0x0000" bus="0x02" slot="0x00" function="0x0"/>
|
|
</controller>
|
|
<controller type="pci" index="0" model="pcie-root"/>
|
|
<controller type="pci" index="1" model="pcie-root-port">
|
|
<model name="pcie-root-port"/>
|
|
<target chassis="1" port="0x10"/>
|
|
<address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x0" multifunction="on"/>
|
|
</controller>
|
|
<controller type="pci" index="2" model="pcie-root-port">
|
|
<model name="pcie-root-port"/>
|
|
<target chassis="2" port="0x11"/>
|
|
<address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x1"/>
|
|
</controller>
|
|
<controller type="pci" index="3" model="pcie-root-port">
|
|
<model name="pcie-root-port"/>
|
|
<target chassis="3" port="0x12"/>
|
|
<address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x2"/>
|
|
</controller>
|
|
<controller type="pci" index="4" model="pcie-root-port">
|
|
<model name="pcie-root-port"/>
|
|
<target chassis="4" port="0x13"/>
|
|
<address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x3"/>
|
|
</controller>
|
|
<controller type="pci" index="5" model="pcie-root-port">
|
|
<model name="pcie-root-port"/>
|
|
<target chassis="5" port="0x14"/>
|
|
<address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x4"/>
|
|
</controller>
|
|
<controller type="pci" index="6" model="pcie-root-port">
|
|
<model name="pcie-root-port"/>
|
|
<target chassis="6" port="0x15"/>
|
|
<address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x5"/>
|
|
</controller>
|
|
<controller type="pci" index="7" model="pcie-root-port">
|
|
<model name="pcie-root-port"/>
|
|
<target chassis="7" port="0x16"/>
|
|
<address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x6"/>
|
|
</controller>
|
|
<controller type="pci" index="8" model="pcie-root-port">
|
|
<model name="pcie-root-port"/>
|
|
<target chassis="8" port="0x17"/>
|
|
<address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x7"/>
|
|
</controller>
|
|
<controller type="pci" index="9" model="pcie-root-port">
|
|
<model name="pcie-root-port"/>
|
|
<target chassis="9" port="0x18"/>
|
|
<address type="pci" domain="0x0000" bus="0x00" slot="0x03" function="0x0" multifunction="on"/>
|
|
</controller>
|
|
<controller type="pci" index="10" model="pcie-root-port">
|
|
<model name="pcie-root-port"/>
|
|
<target chassis="10" port="0x19"/>
|
|
<address type="pci" domain="0x0000" bus="0x00" slot="0x03" function="0x1"/>
|
|
</controller>
|
|
<controller type="pci" index="11" model="pcie-root-port">
|
|
<model name="pcie-root-port"/>
|
|
<target chassis="11" port="0x1a"/>
|
|
<address type="pci" domain="0x0000" bus="0x00" slot="0x03" function="0x2"/>
|
|
</controller>
|
|
<controller type="pci" index="12" model="pcie-root-port">
|
|
<model name="pcie-root-port"/>
|
|
<target chassis="12" port="0x1b"/>
|
|
<address type="pci" domain="0x0000" bus="0x00" slot="0x03" function="0x3"/>
|
|
</controller>
|
|
<controller type="pci" index="13" model="pcie-root-port">
|
|
<model name="pcie-root-port"/>
|
|
<target chassis="13" port="0x1c"/>
|
|
<address type="pci" domain="0x0000" bus="0x00" slot="0x03" function="0x4"/>
|
|
</controller>
|
|
<controller type="pci" index="14" model="pcie-root-port">
|
|
<model name="pcie-root-port"/>
|
|
<target chassis="14" port="0x1d"/>
|
|
<address type="pci" domain="0x0000" bus="0x00" slot="0x03" function="0x5"/>
|
|
</controller>
|
|
<controller type="sata" index="0">
|
|
<address type="pci" domain="0x0000" bus="0x00" slot="0x1f" function="0x2"/>
|
|
</controller>
|
|
<controller type="virtio-serial" index="0">
|
|
<address type="pci" domain="0x0000" bus="0x03" slot="0x00" function="0x0"/>
|
|
</controller>
|
|
<filesystem type="mount" accessmode="passthrough">
|
|
<driver type="virtiofs"/>
|
|
<source dir="{source_dir}"/>
|
|
<target dir="freedombox"/>
|
|
<address type="pci" domain="0x0000" bus="0x07" slot="0x00" function="0x0"/>
|
|
</filesystem>
|
|
<interface type="network">
|
|
<source network="default"/>
|
|
<model type="virtio"/>
|
|
<address type="pci" domain="0x0000" bus="0x01" slot="0x00" function="0x0"/>
|
|
</interface>
|
|
<serial type="pty">
|
|
<target type="isa-serial" port="0">
|
|
<model name="isa-serial"/>
|
|
</target>
|
|
</serial>
|
|
<console type="pty">
|
|
<target type="serial" port="0"/>
|
|
</console>
|
|
<channel type="unix">
|
|
<target type="virtio" name="org.qemu.guest_agent.0"/>
|
|
<address type="virtio-serial" controller="0" bus="0" port="1"/>
|
|
</channel>
|
|
<channel type="spicevmc">
|
|
<target type="virtio" name="com.redhat.spice.0"/>
|
|
<address type="virtio-serial" controller="0" bus="0" port="2"/>
|
|
</channel>
|
|
<input type="tablet" bus="usb">
|
|
<address type="usb" bus="0" port="1"/>
|
|
</input>
|
|
<input type="mouse" bus="ps2"/>
|
|
<input type="keyboard" bus="ps2"/>
|
|
<graphics type="spice" autoport="yes">
|
|
<listen type="address"/>
|
|
<image compression="off"/>
|
|
</graphics>
|
|
<sound model="ich9">
|
|
<address type="pci" domain="0x0000" bus="0x00" slot="0x1b" function="0x0"/>
|
|
</sound>
|
|
<audio id="1" type="spice"/>
|
|
<video>
|
|
<model type="virtio" heads="1" primary="yes"/>
|
|
<address type="pci" domain="0x0000" bus="0x00" slot="0x01" function="0x0"/>
|
|
</video>
|
|
<redirdev bus="usb" type="spicevmc">
|
|
<address type="usb" bus="0" port="2"/>
|
|
</redirdev>
|
|
<redirdev bus="usb" type="spicevmc">
|
|
<address type="usb" bus="0" port="3"/>
|
|
</redirdev>
|
|
<memballoon model="virtio">
|
|
<address type="pci" domain="0x0000" bus="0x05" slot="0x00" function="0x0"/>
|
|
</memballoon>
|
|
<rng model="virtio">
|
|
<backend model="random">/dev/urandom</backend>
|
|
<address type="pci" domain="0x0000" bus="0x06" slot="0x00" function="0x0"/>
|
|
</rng>
|
|
</devices>
|
|
</domain>
|
|
''' # noqa: E501
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
def parse_arguments() -> argparse.Namespace:
|
|
"""Return parsed command line arguments as dictionary."""
|
|
parser = argparse.ArgumentParser(
|
|
formatter_class=argparse.ArgumentDefaultsHelpFormatter)
|
|
subparsers = parser.add_subparsers(dest='subcommand', help='Sub command')
|
|
|
|
distributions = list(URLS.keys())
|
|
|
|
distribution = os.environ.get('DISTRIBUTION')
|
|
|
|
formatter_class = argparse.ArgumentDefaultsHelpFormatter
|
|
default_distribution = 'testing'
|
|
if distribution and distribution in distributions:
|
|
default_distribution = distribution
|
|
|
|
def _add_common_args(subparser):
|
|
subparser.add_argument('--distribution', choices=distributions,
|
|
default=default_distribution,
|
|
help='Distribution to work with')
|
|
subparser.add_argument(
|
|
'--machine-type', choices=('container', 'vm'), default='container',
|
|
help='Type of the machine, container to virtual machine, to run '
|
|
'operation on')
|
|
|
|
# Start
|
|
subparser = subparsers.add_parser('start', help='Bring up the container',
|
|
formatter_class=formatter_class,
|
|
aliases=['up'])
|
|
_add_common_args(subparser)
|
|
subparser.add_argument('--image-size', default='16G',
|
|
help='Disk image size to resize to after download')
|
|
subparser.add_argument('--hkp-client', choices=('gpg', 'wget'),
|
|
default='gpg', help='Client for key retrieval')
|
|
subparser.add_argument(
|
|
'--skip-install', action='store_true',
|
|
help='Skip running make provision-dev in the container')
|
|
|
|
# Print IP address
|
|
subparser = subparsers.add_parser(
|
|
'ip', help='Print the IP address of the container.',
|
|
formatter_class=formatter_class)
|
|
_add_common_args(subparser)
|
|
|
|
# ssh
|
|
subparser = subparsers.add_parser('ssh', help='SSH into the container',
|
|
formatter_class=formatter_class)
|
|
_add_common_args(subparser)
|
|
|
|
# Run tests
|
|
subparser = subparsers.add_parser('run-tests',
|
|
help='Run tests in the container',
|
|
formatter_class=formatter_class)
|
|
_add_common_args(subparser)
|
|
subparser.add_argument(
|
|
'--pytest-args', nargs='...',
|
|
help='Additional arguments to pass to the pytest command')
|
|
|
|
# Stop
|
|
subparser = subparsers.add_parser('stop', help='Stop the container',
|
|
formatter_class=formatter_class,
|
|
aliases=['down'])
|
|
_add_common_args(subparser)
|
|
|
|
# Destroy
|
|
subparser = subparsers.add_parser('destroy',
|
|
help='Destroy the container image',
|
|
formatter_class=formatter_class)
|
|
_add_common_args(subparser)
|
|
|
|
# Update
|
|
subparser = subparsers.add_parser(
|
|
'update', help='Update the container image to the latest version',
|
|
formatter_class=formatter_class)
|
|
_add_common_args(subparser)
|
|
subparser.add_argument('--hkp-client', choices=('gpg', 'wget'),
|
|
default='gpg', help='Client for key retrieval')
|
|
|
|
# Display help message when no args are passed
|
|
if len(sys.argv) == 1:
|
|
parser.print_help()
|
|
sys.exit()
|
|
|
|
return parser.parse_args()
|
|
|
|
|
|
def _get_work_directory() -> pathlib.Path:
|
|
"""Return script's working directory."""
|
|
return pathlib.Path(__file__).parent / '.container'
|
|
|
|
|
|
def _check_command(command) -> bool:
|
|
"""Check that a command is present in PATH."""
|
|
if command == 'sudo':
|
|
which = ['which', command]
|
|
else:
|
|
which = ['sudo', 'which', command]
|
|
|
|
process = subprocess.run(which, stdout=subprocess.DEVNULL, check=False)
|
|
return process.returncode == 0
|
|
|
|
|
|
def _verify_dependencies() -> None:
|
|
"""Ensure that all the dependencies are present."""
|
|
if not _check_command('sudo'):
|
|
logger.info('sudo command is needed. Run `apt install sudo`.')
|
|
sys.exit(1)
|
|
|
|
# Old versions of machinectl can't modprobe loop driver and immediately use
|
|
# it leading to machinectl start failing first time after boot. See
|
|
# https://github.com/systemd/systemd/issues/13130 . Workaround for old
|
|
# versions of machinectl. Ignore errors.
|
|
subprocess.run(['sudo', 'modprobe', '--all', '--quiet', 'loop'],
|
|
check=False)
|
|
|
|
dependencies = {
|
|
'systemd-nspawn': 'systemd-container',
|
|
'machinectl': 'systemd-container',
|
|
'kpartx': 'kpartx',
|
|
'wget': 'wget',
|
|
'gpg': 'gpg',
|
|
'xz': 'xz-utils',
|
|
'parted': 'parted',
|
|
'sgdisk': 'gdisk',
|
|
'btrfs': 'btrfs-progs',
|
|
'nmcli': 'network-manager',
|
|
'dnsmasq': 'dnsmasq',
|
|
'ssh': 'openssh-client',
|
|
'ssh-keygen': 'openssh-client',
|
|
'virsh': 'libvirt-clients',
|
|
}
|
|
missing_commands = []
|
|
missing_packages = []
|
|
for command, package in dependencies.items():
|
|
if not _check_command(command):
|
|
missing_commands.append(command)
|
|
missing_packages.append(package)
|
|
|
|
if not missing_commands:
|
|
return
|
|
|
|
logger.info('You need to install the following commands: %s',
|
|
' '.join(missing_commands))
|
|
|
|
process = subprocess.run(['lsb_release', '--id', '--short'],
|
|
stdout=subprocess.PIPE, check=False)
|
|
if process.stdout.decode().strip() != 'Debian':
|
|
sys.exit(1)
|
|
|
|
logger.info('Running apt for missing packages: %s',
|
|
' '.join(missing_packages))
|
|
subprocess.run(['sudo', 'apt', 'install'] + missing_packages, check=True)
|
|
|
|
|
|
def _download_file(url: str, target_file: pathlib.Path, force: bool = False):
|
|
"""Download a file from remote URL."""
|
|
if target_file.exists():
|
|
if force:
|
|
os.remove(target_file)
|
|
else:
|
|
return
|
|
|
|
partial_file = target_file.with_suffix(target_file.suffix + '.partial')
|
|
|
|
logger.info('Downloading %s', target_file)
|
|
subprocess.run([
|
|
'wget', '--quiet', '--show-progress', '--continue',
|
|
'--output-document',
|
|
str(partial_file), url
|
|
], check=True)
|
|
partial_file.rename(target_file)
|
|
|
|
|
|
def _receive_keys_with_gpg(gpg_home: pathlib.Path, key_ids: list[str]):
|
|
"""Use gpg to retrieve and import a list of keys."""
|
|
subprocess.run([
|
|
'gpg', '--quiet', '--homedir',
|
|
str(gpg_home), '--keyserver', KEY_SERVER, '--recv-keys'
|
|
] + key_ids, check=True)
|
|
|
|
|
|
def _receive_keys_with_wget(gpg_home: pathlib.Path, key_ids: list[str]):
|
|
"""Use wget to retrieve a list of keys and import them."""
|
|
for key_id in key_ids:
|
|
# Download public key
|
|
logger.info('Getting public key %s', key_id)
|
|
url = KEY_SERVER_HTTPS_API.format(key_id=key_id)
|
|
wget_result = subprocess.run(
|
|
['wget', '--quiet', '--output-document=-', url], check=True,
|
|
capture_output=True)
|
|
public_key = wget_result.stdout
|
|
subprocess.run(
|
|
['gpg', '--quiet', '--homedir',
|
|
str(gpg_home), '--import=-'], input=public_key, check=True)
|
|
|
|
|
|
def _verify_signature(hkp_client: str, data_file: pathlib.Path,
|
|
signature_file: pathlib.Path):
|
|
"""Verify the detached signature on a file using GPG."""
|
|
verified_file = signature_file.with_suffix(signature_file.suffix +
|
|
'.verified')
|
|
if verified_file.exists():
|
|
return
|
|
|
|
gpg_home = _get_work_directory() / 'gpg'
|
|
gpg_home.mkdir(exist_ok=True)
|
|
gpg_home.chmod(0o700)
|
|
|
|
logger.info('Receiving GPG keys')
|
|
if hkp_client == 'wget':
|
|
_receive_keys_with_wget(gpg_home, TRUSTED_KEYS)
|
|
else:
|
|
_receive_keys_with_gpg(gpg_home, TRUSTED_KEYS)
|
|
|
|
process = subprocess.run(
|
|
['gpg', '--quiet', '--homedir',
|
|
str(gpg_home), '--armor', '--export'] + TRUSTED_KEYS, check=True,
|
|
stdout=subprocess.PIPE)
|
|
exported_keys = process.stdout
|
|
trusted_keys = gpg_home / 'trustedkeys.gpg'
|
|
subprocess.run([
|
|
'gpg', '--quiet', '--homedir',
|
|
str(gpg_home), '--no-default-keyring', '--keyring',
|
|
str(trusted_keys), '--import', '-'
|
|
], check=True, input=exported_keys)
|
|
|
|
logger.info('Verify GPG signature')
|
|
subprocess.run([
|
|
'gpgv', '--quiet', '--homedir',
|
|
str(gpg_home),
|
|
str(signature_file),
|
|
str(data_file)
|
|
], check=True)
|
|
|
|
verified_file.touch()
|
|
|
|
|
|
def _extract_image(compressed_file: pathlib.Path):
|
|
"""Extract the image file."""
|
|
# Strip the .xz extension, then replace .img with .raw
|
|
decompressed_file = compressed_file.with_suffix('').with_suffix('.raw')
|
|
older_image = compressed_file.with_suffix('')
|
|
|
|
if decompressed_file.exists():
|
|
return decompressed_file
|
|
|
|
# Rename older image and its corresponding state files.
|
|
if older_image.exists():
|
|
logger.info('Renaming .img file to .raw')
|
|
older_image.rename(decompressed_file)
|
|
|
|
for ext in ['.setup', '.provisioned']:
|
|
old_state = older_image.with_suffix(older_image.suffix + ext)
|
|
new_state = decompressed_file.with_suffix(
|
|
decompressed_file.suffix + ext)
|
|
if old_state.exists():
|
|
old_state.rename(new_state)
|
|
|
|
return decompressed_file
|
|
|
|
logger.info('Decompressing file %s', compressed_file)
|
|
partial_file = compressed_file.with_suffix('.partial')
|
|
with partial_file.open('w', encoding='utf-8') as file_handle:
|
|
subprocess.run([
|
|
'xz', '--verbose', '--decompress', '--keep', '--to-stdout',
|
|
str(compressed_file)
|
|
], check=True, stdout=file_handle)
|
|
partial_file.rename(decompressed_file)
|
|
return decompressed_file
|
|
|
|
|
|
def _get_compressed_image_path(distribution: str) -> pathlib.Path:
|
|
"""Return the path of the compressed image."""
|
|
url = URLS[distribution]
|
|
result = urllib.parse.urlparse(url)
|
|
|
|
return _get_work_directory() / pathlib.Path(result.path).name
|
|
|
|
|
|
def _get_image_file(distribution: str) -> pathlib.Path:
|
|
"""Return the path of the image file."""
|
|
compressed_image = _get_compressed_image_path(distribution)
|
|
# Strip the .xz extension, then replace .img with .raw
|
|
return compressed_image.with_suffix('').with_suffix('.raw')
|
|
|
|
|
|
def _get_project_folder() -> pathlib.Path:
|
|
"""Return the read-only folder that should be exposed into container."""
|
|
return _get_work_directory().parent.resolve()
|
|
|
|
|
|
def _get_overlay_folder(distribution: str) -> pathlib.Path:
|
|
"""Return the writable folder that should be exposed into container."""
|
|
default_data_dir = pathlib.Path.home() / '.local' / 'share'
|
|
data_folder = os.environ.get('XDG_DATA_HOME', default_data_dir)
|
|
folder = pathlib.Path(data_folder) / \
|
|
'freedombox-container' / 'overlay' / distribution
|
|
return folder.resolve()
|
|
|
|
|
|
def _download_disk_image(distribution: str, hkp_client: str,
|
|
force: bool = False) -> pathlib.Path:
|
|
"""Download and unpack FreedomBox disk image."""
|
|
_get_work_directory().mkdir(exist_ok=True)
|
|
|
|
url = URLS[distribution]
|
|
|
|
target_file = _get_compressed_image_path(distribution)
|
|
_download_file(url, target_file, force=force)
|
|
|
|
signature_file = target_file.with_suffix(target_file.suffix + '.sig')
|
|
_download_file(url + '.sig', signature_file, force=force)
|
|
|
|
_verify_signature(hkp_client, target_file, signature_file)
|
|
|
|
return _extract_image(target_file)
|
|
|
|
|
|
def _get_partition_info(image_file: pathlib.Path) -> tuple[str, str]:
|
|
"""Return the number of the final partition in the image file."""
|
|
process = subprocess.run(
|
|
['sudo', 'parted', '--script',
|
|
str(image_file), 'print'], stdout=subprocess.PIPE, check=True)
|
|
lines = process.stdout.decode().splitlines()
|
|
last_partition_number = lines[-2].split()[0]
|
|
partition_table_type = 'msdos'
|
|
for line in lines:
|
|
if line.startswith('Partition Table:'):
|
|
partition_table_type = line.partition(': ')[2]
|
|
|
|
logger.info('Main partition: %s', last_partition_number)
|
|
return partition_table_type, last_partition_number
|
|
|
|
|
|
def _resize_disk_image(image_file: pathlib.Path, new_size: str,
|
|
distribution: str):
|
|
"""Resize the disk image if has not already been."""
|
|
if new_size[-1] != 'G':
|
|
raise ValueError(f'Invalid size: {new_size}')
|
|
|
|
new_size_bytes = int(new_size.strip('G')) * 1024 * 1024 * 1024
|
|
image_size = image_file.stat().st_size
|
|
if image_size >= new_size_bytes:
|
|
return
|
|
|
|
logger.info('Resizing disk image to %s', new_size)
|
|
|
|
disk_free = shutil.disk_usage(_get_work_directory()).free
|
|
if disk_free < new_size_bytes - image_size:
|
|
raise ValueError(f'Not enough free space on disk: {disk_free} bytes')
|
|
|
|
subprocess.run(
|
|
['truncate', '--size',
|
|
str(new_size_bytes),
|
|
str(image_file)], check=True)
|
|
partition_table_type, last_partition_number = _get_partition_info(
|
|
image_file)
|
|
if partition_table_type == 'gpt':
|
|
subprocess.run(
|
|
['sudo', 'sgdisk', '--move-second-header',
|
|
str(image_file)], check=True)
|
|
|
|
subprocess.run([
|
|
'sudo', 'parted', '--align=optimal', '--script',
|
|
str(image_file), 'resizepart', last_partition_number, '100%'
|
|
], check=True)
|
|
process = subprocess.run(
|
|
['sudo', 'kpartx', '-avs', str(image_file)], stdout=subprocess.PIPE,
|
|
check=True)
|
|
last_line = process.stdout.decode().splitlines()[-1]
|
|
partition = '/dev/mapper/' + last_line.split()[2]
|
|
old_fsid = _get_fsid(partition)
|
|
subprocess.run(['sudo', 'btrfstune', '-uf', partition], check=True)
|
|
new_fsid = _get_fsid(partition)
|
|
|
|
with tempfile.TemporaryDirectory(
|
|
dir=_get_work_directory().resolve()) as mount_point:
|
|
subprocess.run(['sudo', 'mount', partition, mount_point], check=True)
|
|
time.sleep(2) # Mount may trigger some re-balancing
|
|
subprocess.run(
|
|
['sudo', 'btrfs', 'filesystem', 'resize', 'max', mount_point],
|
|
check=True, stdout=subprocess.DEVNULL)
|
|
_update_fsid(mount_point, partition, old_fsid, new_fsid, distribution)
|
|
subprocess.run(['sudo', 'umount', mount_point], check=True)
|
|
|
|
subprocess.run(
|
|
['sudo', 'kpartx', '-ds', str(image_file)], check=True,
|
|
stderr=subprocess.DEVNULL)
|
|
|
|
|
|
def _get_fsid(partition: str) -> str:
|
|
"""Return the btrfs filesystem ID for a device."""
|
|
# Find the new FSID
|
|
process = subprocess.run(
|
|
['sudo', 'btrfs', 'filesystem', 'show', partition], check=True,
|
|
stdout=subprocess.PIPE)
|
|
return process.stdout.decode().splitlines()[0].rpartition(' ')[2]
|
|
|
|
|
|
def _update_fsid(mount_point: str, partition: str, old_fsid: str,
|
|
new_fsid: str, distribution: str):
|
|
"""After changing btrfs fsid, run grub-install to keep image bootable."""
|
|
is_efi = (platform.machine() in ('aarch64', 'arm64')
|
|
or distribution != 'oldstable')
|
|
|
|
# Guess the loopback device for the filesystem
|
|
matches = re.match(r'^/dev/mapper/loop(\d+)p(\d+)$', partition)
|
|
assert matches
|
|
loop_device = f'/dev/loop{matches[1]}'
|
|
if is_efi:
|
|
efi_device = f'/dev/mapper/loop{matches[1]}p{int(matches[2]) - 1}'
|
|
|
|
# Mount /dev, /proc and run grub commands in chroot
|
|
grub_args = []
|
|
if platform.machine() in ('aarch64', 'arm64'):
|
|
grub_args += ['--no-nvram']
|
|
elif distribution != 'oldstable':
|
|
grub_args += [
|
|
'--target=x86_64-efi', '--no-nvram', '--uefi-secure-boot'
|
|
]
|
|
|
|
subprocess.run(
|
|
['sudo', 'mount', '-o', 'bind', '/dev/', f'{mount_point}/dev'],
|
|
check=True)
|
|
subprocess.run(
|
|
['sudo', 'mount', '-o', 'bind', '/proc/', f'{mount_point}/proc'],
|
|
check=True)
|
|
if is_efi:
|
|
subprocess.run(
|
|
['sudo', 'mount', efi_device, f'{mount_point}/boot/efi'],
|
|
check=True)
|
|
|
|
subprocess.run(['sudo', 'chroot', mount_point, 'update-grub'], check=True)
|
|
subprocess.run(
|
|
['sudo', 'chroot', mount_point, 'grub-install', loop_device] +
|
|
grub_args, check=True)
|
|
subprocess.run([
|
|
'sudo', 'chroot', mount_point, 'sed', '-ie',
|
|
f's|UUID={old_fsid}|UUID={new_fsid}|', '/etc/fstab'
|
|
], check=True)
|
|
if is_efi:
|
|
subprocess.run(['sudo', 'umount', f'{mount_point}/boot/efi'],
|
|
check=True)
|
|
|
|
subprocess.run(['sudo', 'umount', f'{mount_point}/proc'], check=True)
|
|
subprocess.run(['sudo', 'umount', f'{mount_point}/dev'], check=True)
|
|
|
|
|
|
def _runc(image_file: pathlib.Path, command: list[str], **kwargs):
|
|
"""Run a command inside the container."""
|
|
subprocess.run([
|
|
'sudo', 'systemd-nspawn', '--image',
|
|
str(image_file), '--console=autopipe', '--quiet'
|
|
] + command, check=True, **kwargs)
|
|
|
|
|
|
def _setup_users(image_file: pathlib.Path):
|
|
"""Change UID, GID and password of fbx user in container."""
|
|
folder = _get_project_folder()
|
|
|
|
uid = 10000
|
|
gid = 10000
|
|
logger.info('In image: Setting UID/GID of "fbx" to %s/%s', uid, gid)
|
|
_runc(image_file, ['groupmod', '--gid', str(gid), 'fbx'])
|
|
_runc(image_file, ['usermod', '--uid',
|
|
str(uid), '--gid',
|
|
str(gid), 'fbx'], stdout=subprocess.DEVNULL)
|
|
|
|
uid = folder.stat().st_uid
|
|
gid = folder.stat().st_gid
|
|
logger.info(
|
|
'In image: Setting UID/GID of "plinth" to %s/%s to match %s/%s', uid,
|
|
gid, folder.owner(), folder.group())
|
|
_runc(image_file, ['groupmod', '--gid', str(gid), 'plinth'])
|
|
_runc(image_file,
|
|
['usermod', '--uid',
|
|
str(uid), '--gid',
|
|
str(gid), 'plinth'], stdout=subprocess.DEVNULL)
|
|
|
|
logger.info('In image: Setting up sudo for users "fbx" and "plinth"')
|
|
sudo_config = 'fbx ALL=(ALL:ALL) NOPASSWD : ALL\n'
|
|
_runc(image_file, ['tee', '/etc/sudoers.d/01-freedombox-development'],
|
|
input=sudo_config.encode(), stdout=subprocess.DEVNULL)
|
|
|
|
|
|
def _setup_ssh(image_file: pathlib.Path):
|
|
"""Setup SSH server and client keys."""
|
|
logger.info('In image: Generating SSH server keys')
|
|
_runc(image_file, ['dpkg-reconfigure', 'openssh-server'],
|
|
stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
|
|
|
|
ssh_directory = _get_work_directory() / 'ssh'
|
|
ssh_directory.mkdir(exist_ok=True)
|
|
ssh_directory.chmod(0o700)
|
|
|
|
key_file = ssh_directory / 'id_ed25519'
|
|
if not key_file.exists():
|
|
logger.info('Generating SSH client key %s', key_file)
|
|
subprocess.run(
|
|
['ssh-keygen', '-t', 'ed25519', '-N', '', '-f',
|
|
str(key_file)], stdout=subprocess.DEVNULL, check=True)
|
|
|
|
public_key_file = key_file.with_suffix('.pub')
|
|
public_key = public_key_file.read_bytes()
|
|
if not public_key:
|
|
logger.error('Unable to read SSH public key from %s', public_key_file)
|
|
sys.exit(1)
|
|
|
|
logger.info(
|
|
'Adding SSH client key to "fbx" user authorized keys in container')
|
|
_runc(image_file, ['mkdir', '--parents', '/home/fbx/.ssh'])
|
|
_runc(image_file, ['tee', '--append', '/home/fbx/.ssh/authorized_keys'],
|
|
input=public_key, stdout=subprocess.DEVNULL)
|
|
_runc(image_file, ['chmod', '600', '/home/fbx/.ssh/authorized_keys'])
|
|
_runc(image_file, ['chown', 'fbx:fbx', '/home/fbx/.ssh/authorized_keys'])
|
|
|
|
|
|
def _setup_image(image_file: pathlib.Path, skip_install: bool = False):
|
|
"""Prepare the image for execution."""
|
|
setup_file = image_file.with_suffix(image_file.suffix + '.setup')
|
|
if setup_file.exists():
|
|
return
|
|
|
|
logger.info('In image: Disabling automatic updates temporarily')
|
|
contents = 'APT::Periodic::Update-Package-Lists "0";\n' \
|
|
'APT::Periodic::Unattended-Upgrade "0";\n'
|
|
_runc(image_file, ['tee', '/etc/apt/apt.conf.d/20auto-upgrades'],
|
|
input=contents.encode())
|
|
|
|
if not skip_install:
|
|
logger.info('In image: Disabling FreedomBox service')
|
|
_runc(image_file, ['systemctl', 'disable', 'plinth'],
|
|
stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
|
|
|
|
logger.info('In image: Creating virtiofs mount at /freedombox')
|
|
mount = '''[Unit]
|
|
Description=FreedomBox development directory on host
|
|
ConditionVirtualization=kvm
|
|
|
|
[Mount]
|
|
What=freedombox
|
|
Where=/freedombox
|
|
Type=virtiofs
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
'''
|
|
_runc(image_file, ['tee', '/usr/lib/systemd/system/freedombox.mount'],
|
|
input=mount.encode(), stdout=subprocess.DEVNULL)
|
|
_runc(image_file, ['systemctl', 'enable', 'freedombox.mount'],
|
|
stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
|
|
|
|
_setup_ssh(image_file)
|
|
|
|
_setup_users(image_file)
|
|
|
|
setup_file.touch()
|
|
logger.info('Setup completed')
|
|
|
|
|
|
def _destroy_image(distribution: str):
|
|
"""Remove all traces of the machine and its image."""
|
|
image_file = _get_image_file(distribution)
|
|
logger.info('Removing image file %s', image_file)
|
|
try:
|
|
image_file.with_suffix(image_file.suffix + '.provisioned').unlink()
|
|
except FileNotFoundError:
|
|
pass
|
|
|
|
try:
|
|
image_file.with_suffix(image_file.suffix + '.setup').unlink()
|
|
except FileNotFoundError:
|
|
pass
|
|
|
|
try:
|
|
image_file.unlink()
|
|
except FileNotFoundError:
|
|
pass
|
|
|
|
logger.info('Keeping downloaded image: %s',
|
|
_get_compressed_image_path(distribution))
|
|
|
|
|
|
def _is_provisioned(distribution: str) -> bool:
|
|
"""Return the container has been provisioned fully."""
|
|
image_file = _get_image_file(distribution)
|
|
provision_file = image_file.with_suffix(image_file.suffix + '.provisioned')
|
|
return provision_file.exists()
|
|
|
|
|
|
def _provision(image_file: pathlib.Path, machine_type: str, distribution: str,
|
|
skip_install: bool = False):
|
|
"""Run app setup inside the container."""
|
|
if _is_provisioned(distribution):
|
|
return
|
|
|
|
if skip_install:
|
|
logger.info('Skipping provision step (--skip-install)')
|
|
else:
|
|
machine = Machine.get_instance(machine_type, distribution)
|
|
ssh_command = machine.get_ssh_command()
|
|
subprocess.run(ssh_command + ['bash'], check=True,
|
|
input=PROVISION_SCRIPT.encode())
|
|
|
|
provision_file = image_file.with_suffix(image_file.suffix + '.provisioned')
|
|
provision_file.touch()
|
|
logger.info('Provision completed')
|
|
|
|
|
|
def _print_banner(machine_type: str, distribution: str):
|
|
"""Print a friendly message on how to use."""
|
|
machine = Machine.get_instance(machine_type, distribution)
|
|
ip_address = _wait_for(lambda: machine.get_ip_address())
|
|
|
|
_get_work_directory().owner()
|
|
script = sys.argv[0]
|
|
options = ''
|
|
if distribution != 'testing':
|
|
options = f'--distribution={distribution}'
|
|
|
|
project_folder = _get_project_folder()
|
|
overlay_folder = _get_overlay_folder(distribution)
|
|
message = f'''==== Ready ====
|
|
|
|
Development user : fbx
|
|
Plinth user : (host){project_folder.owner()} -> (container)plinth
|
|
Folder overlay : (host, read-only){project_folder}
|
|
+ (host, read-write){overlay_folder}
|
|
-> (container)/freedombox
|
|
|
|
SSH easily : {script} ssh {options}
|
|
Run tests : {script} run-tests {options} [ --pytest-args ... ]
|
|
Watch FreedomBox logs : sudo freedombox-logs
|
|
|
|
Web access : https://{ip_address}/
|
|
Ports access : Any port on {ip_address}
|
|
|
|
Terminal login : sudo machinectl login fbx-{distribution}
|
|
Open a root shell : sudo machinectl shell fbx-{distribution}
|
|
Shutdown : {script} stop {options}
|
|
Destroy : {script} destroy {options}
|
|
Reset : {script} destroy {options}; {script} start {options}'''
|
|
logger.info(message)
|
|
|
|
|
|
def _wait_for(method: Callable[[], None | object]):
|
|
"""Wait until a condition is satisfied or finally give up."""
|
|
for _ in range(60):
|
|
return_value = method()
|
|
if return_value:
|
|
return return_value
|
|
|
|
logger.info('Waiting for machine')
|
|
time.sleep(3)
|
|
|
|
logger.error('Failed')
|
|
sys.exit(1)
|
|
|
|
|
|
def _get_latest_image_timestamp(distribution: str) -> float:
|
|
"""Get the timestamp of the latest available image."""
|
|
url = URLS[distribution]
|
|
response = urlopen(url[0:url.rindex('/')])
|
|
page_contents = response.read().decode()
|
|
str_time = re.findall(r'\d{4}-\d{2}-\d{2} \d{2}:\d{2}', page_contents)[0]
|
|
return datetime.datetime.strptime(str_time, '%Y-%m-%d %H:%M').timestamp()
|
|
|
|
|
|
def _is_update_required(distribution: str) -> bool:
|
|
"""Compare local image timestamp against the latest image timestamp."""
|
|
file_path = _get_work_directory() / URLS[distribution].split('/')[-1]
|
|
|
|
if not file_path.exists():
|
|
return True
|
|
|
|
local_image_timestamp = os.path.getmtime(file_path)
|
|
one_day = datetime.timedelta(days=1).total_seconds()
|
|
latest_image_timestamp = _get_latest_image_timestamp(distribution)
|
|
return latest_image_timestamp - local_image_timestamp > one_day
|
|
|
|
|
|
class Machine:
|
|
"""Base class for different types of machines."""
|
|
|
|
def __init__(self, distribution: str):
|
|
"""Initialize the machine object."""
|
|
machine_name = f'fbx-{distribution}'
|
|
self.machine_name = machine_name
|
|
self.distribution = distribution
|
|
|
|
@staticmethod
|
|
def get_instance(machine_type: str, distribution: str):
|
|
"""Return instance of a concrete machine class based on type."""
|
|
if machine_type == 'container':
|
|
return Container(distribution)
|
|
|
|
if machine_type == 'vm':
|
|
return VM(distribution)
|
|
|
|
raise ValueError('Unknown machine type')
|
|
|
|
def get_status(self) -> bool:
|
|
"""Return whether the machine is currently running."""
|
|
return False
|
|
|
|
def setup(self) -> None:
|
|
"""Setup the infrastructure needed for the machine."""
|
|
|
|
def launch(self) -> None:
|
|
"""Start the machine."""
|
|
|
|
def stop(self) -> None:
|
|
"""Stop the machine."""
|
|
|
|
def terminate(self) -> None:
|
|
"""Terminate, i.e., force stop the machine."""
|
|
|
|
def destroy(self) -> None:
|
|
"""Remove all traces of the machine from the host."""
|
|
|
|
def get_ip_address(self) -> str | None:
|
|
"""Return the IP address assigned to the machine."""
|
|
|
|
def get_ssh_command(self) -> list[str]:
|
|
"""Return the SSH command to execute for the machine."""
|
|
return []
|
|
|
|
|
|
class Container(Machine):
|
|
"""Handle container specific operations."""
|
|
|
|
def get_status(self) -> bool:
|
|
"""Return the running status of a container."""
|
|
process = subprocess.run(
|
|
['sudo', 'machinectl', 'status', self.machine_name],
|
|
stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False)
|
|
return process.returncode == 0
|
|
|
|
def setup(self) -> None:
|
|
"""Setup the infrastructure needed for the container."""
|
|
self._setup_nm_connection()
|
|
|
|
def launch(self) -> None:
|
|
"""Start the container."""
|
|
self._create_nspawn_machine()
|
|
|
|
logger.info('Running `machinectl start %s`', self.machine_name)
|
|
subprocess.run(['sudo', 'machinectl', 'start', self.machine_name],
|
|
check=True)
|
|
|
|
logger.info('Bringing up host network connection: %s',
|
|
f'fbx-{self.distribution}-shared')
|
|
# This command requires dnsmasq
|
|
subprocess.run([
|
|
'sudo', 'nmcli', 'connection', 'up',
|
|
f'fbx-{self.distribution}-shared'
|
|
], stdout=subprocess.DEVNULL, check=True)
|
|
|
|
def stop(self) -> None:
|
|
"""Stop the container."""
|
|
logger.info('Running `machinectl stop %s`', self.machine_name)
|
|
subprocess.run(['sudo', 'machinectl', 'stop', self.machine_name],
|
|
check=False)
|
|
|
|
def terminate(self) -> None:
|
|
"""Terminate, i.e., force stop the container."""
|
|
logger.info('Running `machinectl terminate %s`', self.machine_name)
|
|
subprocess.run(['sudo', 'machinectl', 'terminate', self.machine_name],
|
|
check=False)
|
|
|
|
def destroy(self) -> None:
|
|
"""Remove all traces of the machine from the host."""
|
|
image_link = pathlib.Path(f'/var/lib/machines/{self.machine_name}.raw')
|
|
|
|
logger.info('Removing link to systemd-nspawn image %s', image_link)
|
|
subprocess.run(['sudo', 'rm', '--force', str(image_link)], check=False)
|
|
nspawn_file = f'/run/systemd/nspawn/{self.machine_name}.nspawn'
|
|
|
|
logger.info('Removing systemd-nspawn configuration: %s', nspawn_file)
|
|
subprocess.run(['sudo', 'rm', '--force', nspawn_file], check=False)
|
|
|
|
overlay_folder = _get_overlay_folder(self.distribution)
|
|
logger.info('Removing overlay folder with container written data: %s',
|
|
overlay_folder)
|
|
subprocess.run(['sudo', 'rm', '-r', '--force', overlay_folder],
|
|
check=False)
|
|
|
|
connection_name = f'fbx-{self.distribution}-shared'
|
|
logger.info('Removing Network Manager connection %s', connection_name)
|
|
result = subprocess.run(
|
|
['sudo', 'nmcli', 'connection', 'delete', connection_name],
|
|
capture_output=True, check=False)
|
|
if result.returncode not in (0, 10):
|
|
# nmcli failed and not due to 'Connection, device, or access point
|
|
# does not exist.' See
|
|
# https://developer-old.gnome.org/NetworkManager/stable/nmcli.html
|
|
logger.error('nmcli returned code %d', result.returncode)
|
|
logger.error('Error message:\n%s', result.stderr.decode())
|
|
logger.error('Output:\n%s', result.stdout.decode())
|
|
|
|
def get_ip_address(self) -> str | None:
|
|
"""Return the IPv4 address assigned to the container or None."""
|
|
process = subprocess.run(
|
|
['machinectl', 'list', '--output=json', '--max-addresses=all'],
|
|
stdout=subprocess.PIPE, check=True)
|
|
output = process.stdout.decode()
|
|
if not output:
|
|
return None
|
|
|
|
machines = json.loads(output)
|
|
for machine in machines:
|
|
if (machine['machine'] == f'fbx-{self.distribution}'
|
|
and machine['addresses'] not in (None, '-')):
|
|
for address in machine['addresses'].split():
|
|
if ipaddress.ip_address(address).version == 4:
|
|
return address
|
|
|
|
return None
|
|
|
|
def get_ssh_command(self) -> list[str]:
|
|
"""Return the SSH command to execute for the container."""
|
|
ip_address = _wait_for(lambda: self.get_ip_address())
|
|
public_key = _get_work_directory() / 'ssh' / 'id_ed25519'
|
|
if ipaddress.ip_address(ip_address).is_link_local:
|
|
ip_address = f'{ip_address}%' + self._get_interface_name()
|
|
|
|
return [
|
|
'ssh', '-Y', '-C', '-t', '-i',
|
|
str(public_key), '-o', 'LogLevel=error', '-o',
|
|
'StrictHostKeyChecking=no', '-o', 'UserKnownHostsFile=/dev/null',
|
|
'-o', 'IdentitiesOnly=yes', f'fbx@{ip_address}'
|
|
]
|
|
|
|
def _get_interface_name(self) -> str:
|
|
"""Return the name of the interface."""
|
|
return f've-fbx-{self.distribution}'
|
|
|
|
def _setup_nm_connection(self) -> None:
|
|
"""Create a NM conn. on host for DHCP/DNS with container."""
|
|
connection_name = f'fbx-{self.distribution}-shared'
|
|
process = subprocess.run(
|
|
['sudo', 'nmcli', 'connection', 'show', connection_name],
|
|
stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False)
|
|
if not process.returncode:
|
|
return
|
|
|
|
logger.info('Creating Network Manager connection in host: %s',
|
|
connection_name)
|
|
properties = {
|
|
'connection.id': connection_name,
|
|
'connection.type': '802-3-ethernet',
|
|
'connection.interface-name': self._get_interface_name(),
|
|
'connection.autoconnect': 'yes',
|
|
'connection.zone': 'trusted',
|
|
'ipv4.method': 'shared',
|
|
}
|
|
subprocess.run(['sudo', 'nmcli', 'connection', 'add'] +
|
|
list(itertools.chain(*properties.items())), check=True)
|
|
subprocess.run(['sudo', 'nmcli', 'connection', 'up', connection_name],
|
|
stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
|
|
check=False)
|
|
|
|
def _create_nspawn_machine(self) -> None:
|
|
"""Create systemd-nspawn options/image used by machinectl."""
|
|
image_file = _get_image_file(self.distribution)
|
|
overlay_folder = _get_overlay_folder(self.distribution)
|
|
logger.info('Creating overlay folder %s', overlay_folder)
|
|
overlay_folder.mkdir(parents=True, exist_ok=True)
|
|
|
|
nspawn_dir = pathlib.Path('/run/systemd/nspawn/')
|
|
if not nspawn_dir.exists():
|
|
subprocess.run(['sudo', 'mkdir', '--mode=700',
|
|
str(nspawn_dir)], check=True)
|
|
|
|
nspawn_options = f'''[Exec]
|
|
Boot=yes
|
|
PrivateUsers=no
|
|
# Allow all system calls to enable podman containers inside the nspawn
|
|
# container.
|
|
SystemCallFilter=@known
|
|
|
|
[Files]
|
|
Overlay={_get_project_folder()}:{overlay_folder}:/freedombox
|
|
|
|
[Network]
|
|
VirtualEthernet=yes
|
|
'''
|
|
nspawn_file = f'/run/systemd/nspawn/{self.machine_name}.nspawn'
|
|
logger.info('Creating systemd-nspawn configuration: %s', nspawn_file)
|
|
subprocess.run(['sudo', 'rm', '--force', nspawn_file], check=False)
|
|
subprocess.run(['sudo', 'tee', nspawn_file],
|
|
input=nspawn_options.encode(),
|
|
stdout=subprocess.DEVNULL, check=True)
|
|
|
|
image_link = pathlib.Path(f'/var/lib/machines/{self.machine_name}.raw')
|
|
logger.info('Linking systemd-nspawn image %s -> %s', image_link,
|
|
image_file)
|
|
result = subprocess.run(
|
|
['sudo', 'test', '-e', str(image_link)], check=False)
|
|
if not result.returncode:
|
|
result = subprocess.run(
|
|
['sudo', 'test', '-L', str(image_link)], check=False)
|
|
if result.returncode:
|
|
raise Exception(f'Image file {image_link} is not a symlink.')
|
|
|
|
# May be linked to wrong place (such as old .img file)
|
|
subprocess.run(['sudo', 'rm', '--force', str(image_link)], check=False)
|
|
subprocess.run([
|
|
'sudo', 'ln', '--symbolic',
|
|
str(image_file.resolve()),
|
|
str(image_link)
|
|
], check=False)
|
|
|
|
|
|
class VM(Machine):
|
|
"""Handle VM specific operations."""
|
|
|
|
def get_status(self) -> bool:
|
|
"""Return whether the VM is currently running."""
|
|
process = self._virsh(['domstate', self.machine_name], check=False,
|
|
stdout=subprocess.PIPE,
|
|
stderr=subprocess.DEVNULL)
|
|
return process.stdout.decode().splitlines()[0] not in ('shut off', '')
|
|
|
|
def setup(self) -> None:
|
|
"""Setup the infrastructure needed for the VM."""
|
|
try:
|
|
self._virsh(['dominfo', self.machine_name],
|
|
stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
|
|
return # Already exists
|
|
except subprocess.CalledProcessError:
|
|
pass
|
|
|
|
qcow_image = self._create_qcow_image()
|
|
firmware = 'firmware="efi"' if self.distribution != 'oldstable' else ''
|
|
domain_xml = LIBVIRT_DOMAIN_XML_TEMPLATE.format(
|
|
domain_name=self.machine_name, memory_mib='2048', cpus='4',
|
|
firmware=firmware, image_file=qcow_image,
|
|
source_dir=_get_project_folder())
|
|
|
|
with tempfile.NamedTemporaryFile() as file_handle:
|
|
file_handle.write(domain_xml.encode())
|
|
logger.info('Running `virsh define %s`', file_handle.name)
|
|
self._virsh(['define', file_handle.name],
|
|
stdout=subprocess.DEVNULL)
|
|
|
|
def launch(self) -> None:
|
|
"""Start the VM."""
|
|
if self.get_status():
|
|
return
|
|
|
|
logger.info('Running `virsh start %s`', self.machine_name)
|
|
self._virsh(['start', self.machine_name], stdout=subprocess.DEVNULL)
|
|
|
|
def stop(self) -> None:
|
|
"""Stop the VM."""
|
|
if not self.get_status(): # Already shut off
|
|
return
|
|
|
|
logger.info('Running `virsh shutdown %s`', self.machine_name)
|
|
self._virsh(['shutdown', self.machine_name], stdout=subprocess.DEVNULL)
|
|
|
|
def terminate(self) -> None:
|
|
"""Terminate, i.e., force stop the VM."""
|
|
if not self.get_status(): # Already shut off
|
|
return
|
|
|
|
logger.info('Running `virsh destroy %s`', self.machine_name)
|
|
try:
|
|
self._virsh(['undefine', '--nvram', self.machine_name],
|
|
stdout=subprocess.DEVNULL)
|
|
except subprocess.CalledProcessError:
|
|
pass
|
|
|
|
def destroy(self) -> None:
|
|
"""Remove all traces of the VM from the host."""
|
|
logger.info('Running `virsh undefine %s`', self.machine_name)
|
|
try:
|
|
self._virsh(['undefine', '--nvram', self.machine_name],
|
|
stdout=subprocess.DEVNULL)
|
|
except subprocess.CalledProcessError:
|
|
pass
|
|
|
|
self._destroy_qcow_image()
|
|
|
|
def get_ip_address(self) -> str | None:
|
|
"""Return the IP address assigned to the VM."""
|
|
try:
|
|
process = self._virsh(['domifaddr', self.machine_name],
|
|
stdout=subprocess.PIPE)
|
|
except subprocess.CalledProcessError:
|
|
return None
|
|
|
|
lines = process.stdout.decode().splitlines()
|
|
if len(lines) < 3: # First two lines are header
|
|
return None
|
|
|
|
# Example: 'vnet12 52:54:00:55:8c:68 ipv4 192.168.122.203/24'
|
|
return lines[2].rpartition(' ')[2].partition('/')[0]
|
|
|
|
def get_ssh_command(self) -> list[str]:
|
|
"""Return the SSH command to execute for the VM."""
|
|
ip_address = _wait_for(lambda: self.get_ip_address())
|
|
public_key = _get_work_directory() / 'ssh' / 'id_ed25519'
|
|
return [
|
|
'ssh', '-Y', '-C', '-t', '-i',
|
|
str(public_key), '-o', 'LogLevel=error', '-o',
|
|
'StrictHostKeyChecking=no', '-o', 'UserKnownHostsFile=/dev/null',
|
|
'-o', 'IdentitiesOnly=yes', f'fbx@{ip_address}'
|
|
]
|
|
|
|
def _virsh(self, args: list[str], check=True, **kwargs):
|
|
"""Run virsh to control the virtual machine."""
|
|
return subprocess.run(['sudo', 'virsh'] + args, check=check, **kwargs)
|
|
|
|
def _create_qcow_image(self) -> pathlib.Path:
|
|
"""Convert raw image into qcow2 image.
|
|
|
|
qcow2 image format allows snapshots of VM.
|
|
"""
|
|
image_file = _get_image_file(self.distribution)
|
|
qcow_image = image_file.with_suffix('.qcow2')
|
|
logger.info('Creating qcow2 image: %s', qcow_image)
|
|
subprocess.run([
|
|
'sudo', 'qemu-img', 'convert', '-f', 'raw', '-O', 'qcow2',
|
|
image_file, qcow_image
|
|
], check=True)
|
|
return qcow_image
|
|
|
|
def _destroy_qcow_image(self) -> None:
|
|
"""Delete the qcow image."""
|
|
image_file = _get_image_file(self.distribution)
|
|
qcow_image = image_file.with_suffix('.qcow2')
|
|
logger.info('Removing qcow2 image: %s', qcow_image)
|
|
qcow_image.unlink(missing_ok=True)
|
|
|
|
|
|
def subcommand_start(arguments: argparse.Namespace):
|
|
"""Download, setup and bring up the container."""
|
|
machine = Machine.get_instance(arguments.machine_type,
|
|
arguments.distribution)
|
|
if machine.get_status() and _is_provisioned(arguments.distribution):
|
|
logger.info('Container is already running')
|
|
_print_banner(arguments.machine_type, arguments.distribution)
|
|
return
|
|
|
|
_verify_dependencies()
|
|
image_file = _download_disk_image(arguments.distribution,
|
|
arguments.hkp_client)
|
|
_resize_disk_image(image_file, arguments.image_size,
|
|
arguments.distribution)
|
|
_setup_image(image_file, arguments.skip_install)
|
|
machine.setup()
|
|
machine.launch()
|
|
_provision(image_file, arguments.machine_type, arguments.distribution,
|
|
arguments.skip_install)
|
|
_print_banner(arguments.machine_type, arguments.distribution)
|
|
|
|
|
|
def subcommand_ip(arguments: argparse.Namespace):
|
|
"""Print the IP address of the container."""
|
|
machine = Machine.get_instance(arguments.machine_type,
|
|
arguments.distribution)
|
|
print(machine.get_ip_address() or '')
|
|
|
|
|
|
def subcommand_ssh(arguments: argparse.Namespace):
|
|
"""Open an SSH shell into the container."""
|
|
machine = Machine.get_instance(arguments.machine_type,
|
|
arguments.distribution)
|
|
command = machine.get_ssh_command()
|
|
logger.info('Running command: %s', ' '.join(command))
|
|
os.execlp('ssh', *command)
|
|
|
|
|
|
def subcommand_run_tests(arguments: argparse.Namespace):
|
|
"""Run tests in the container."""
|
|
distribution = arguments.distribution
|
|
machine = Machine.get_instance(arguments.machine_type, distribution)
|
|
pytest_args_list = arguments.pytest_args or []
|
|
pytest_args = ' '.join((shlex.quote(arg) for arg in pytest_args_list))
|
|
|
|
ssh_command = machine.get_ssh_command()
|
|
|
|
pytest_command = f'py.test-3 --color=yes {pytest_args}'
|
|
logger.info('Pytest command: %s', pytest_command)
|
|
|
|
test_script = SETUP_AND_RUN_TESTS_SCRIPT.format(
|
|
pytest_command=pytest_command, distribution=distribution)
|
|
command = ssh_command + ['sudo', 'bash']
|
|
process = subprocess.run(command, input=test_script.encode(), check=False)
|
|
sys.exit(process.returncode)
|
|
|
|
|
|
def subcommand_stop(arguments: argparse.Namespace):
|
|
"""Stop the container."""
|
|
machine = Machine.get_instance(arguments.machine_type,
|
|
arguments.distribution)
|
|
machine.stop()
|
|
_wait_for(lambda: not machine.get_status())
|
|
|
|
|
|
def subcommand_destroy(arguments: argparse.Namespace):
|
|
"""Destroy the disk image."""
|
|
machine = Machine.get_instance(arguments.machine_type,
|
|
arguments.distribution)
|
|
machine.terminate()
|
|
_wait_for(lambda: not machine.get_status())
|
|
|
|
machine.destroy()
|
|
_destroy_image(arguments.distribution)
|
|
|
|
|
|
def subcommand_update(arguments: argparse.Namespace):
|
|
"""Update the disk image."""
|
|
if _is_update_required(arguments.distribution):
|
|
logger.info('Updating...')
|
|
_download_disk_image(arguments.distribution, arguments.hkp_client,
|
|
force=True)
|
|
else:
|
|
logger.info('Already using the latest image')
|
|
|
|
|
|
def set_URLs() -> None:
|
|
global URLS
|
|
arch = platform.machine()
|
|
if arch == 'x86_64' or arch == 'amd64':
|
|
URLS = URLS_AMD64
|
|
elif arch == 'aarch64' or arch == 'arm64':
|
|
URLS = URLS_ARM64
|
|
else:
|
|
logger.error('Unsupported architecture:', arch)
|
|
sys.exit(1)
|
|
|
|
|
|
def main():
|
|
"""Parse arguments and perform operations."""
|
|
set_URLs()
|
|
|
|
logging.basicConfig(level='INFO', format='> %(message)s')
|
|
arguments = parse_arguments()
|
|
|
|
aliases = {
|
|
'up': 'start',
|
|
'down': 'stop',
|
|
}
|
|
|
|
subcommand: str = arguments.subcommand.replace('-', '_')
|
|
subcommand = aliases.get(subcommand, subcommand)
|
|
subcommand_method = globals()['subcommand_' + subcommand]
|
|
subcommand_method(arguments)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main()
|