def __call__(
self,
location: Location,
system_context: SystemContext,
*args: typing.Any,
**kwargs: typing.Any,
) -> None:
"""Execute command."""
modules = system_context.file_name("/usr/lib/modules")
if not os.path.isdir(modules):
return # No kernel installed, nothing to do.
for kver in [
f for f in os.listdir(modules)
if os.path.isdir(os.path.join(modules, f))
]:
location.set_description(
f"Run depmod for kernel version {kver}...")
self._execute(
location,
system_context,
"run",
self._binary(Binaries.DEPMOD),
"-a",
"-b",
system_context.fs_directory,
kver,
)
def __call__(self, location: Location, system_context: SystemContext,
*args: typing.Any, **kwargs: typing.Any) -> None:
"""Execute command."""
pacman_setup(system_context, kwargs.get("config", ""))
pacman_key_command = self._binary(Binaries.PACMAN_KEY)
pacman_keyinit(system_context, pacman_key_command=pacman_key_command)
# Allow for customizations of the pacman keyring to happen:
self._execute(
location.next_line(),
system_context,
"_pacman_keyinit",
pacman_key=pacman_key_command,
gpg_dir=gpg_directory(system_context),
)
pacstrap(system_context,
*args,
pacman_command=self._binary(Binaries.PACMAN),
chroot_helper=self._binary(Binaries.SYSTEMD_NSPAWN),
**kwargs)
self._execute(location.next_line(), system_context,
"create_os_release")
self._setup_hooks(location, system_context)
def __call__(self, location: Location, system_context: SystemContext,
*args: typing.Any, **kwargs: typing.Any) -> None:
"""Execute command."""
for f in args:
source = (f if os.path.isabs(f) else os.path.join(
system_context.systems_definition_directory or "", f))
dest = os.path.join("/etc/ca-certificates/trust-source/anchors",
os.path.basename(f))
self._execute(
location.next_line(),
system_context,
"copy",
source,
dest,
from_outside=True,
)
self._execute(
location.next_line(),
system_context,
"chmod",
stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP | stat.S_IROTH,
dest,
)
run(
"/usr/bin/trust",
"extract-compat",
chroot=system_context.fs_directory,
chroot_helper=self._binary(Binaries.CHROOT_HELPER),
)
def __call__(self, location: Location, system_context: SystemContext,
*args: typing.Any, **kwargs: typing.Any) -> None:
"""Execute command."""
# Nested virtualization:
self._execute(location, system_context, 'create',
'/etc/modprobe.d/kvm_intel.conf',
'options kvm_intel nested=1')
# Intel ucode:
location.set_description('Install intel-ucode')
self._execute(location, system_context, 'pacman', 'intel-ucode')
initrd_parts = os.path.join(system_context.boot_directory,
'initrd-parts')
os.makedirs(initrd_parts, exist_ok=True)
self._execute(location,
system_context,
'move',
'/boot/intel-ucode.img',
os.path.join(initrd_parts, '00-intel-ucode'),
to_outside=True)
# enable kms:
self._execute(location.next_line(), system_context, 'sed',
's/^MODULES=(/MODULES=(crc32c-intel /',
'/etc/mkinitcpio.conf')
# Clean out firmware:
self._execute(location.next_line(),
system_context,
'remove',
'/usr/lib/firmware/amd-ucode/*',
force=True)
def __call__(self, location: Location, system_context: SystemContext,
*args: typing.Any, **kwargs: typing.Any) -> None:
"""Execute command."""
assert firewall_type(system_context) == 'iptables'
location.set_description('Enable firewall')
self._execute(location, system_context, 'systemd_enable',
'iptables.service', 'ip6tables.service')
def _setup_hooks(
self,
location: Location,
system_context: SystemContext,
locales: typing.Sequence[str],
) -> None:
if not system_context.substitution("CLRM_LOCALES", ""):
location.set_description("run locale-gen")
self._add_hook(
location,
system_context,
"export",
"run",
"/usr/bin/locale-gen",
inside=True,
)
location.set_description("Remove locale related data.")
self._add_hook(
location,
system_context,
"export",
"remove",
"/usr/share/locale/*",
"/etc/locale.gen",
"/usr/bin/locale-gen",
"/usr/bin/localedef",
force=True,
recursive=True,
)
system_context.set_substitution("CLRM_LOCALES", ",".join(locales))
def __call__(self, location: Location, system_context: SystemContext,
*args: typing.Any, **kwargs: typing.Any) -> None:
"""Execute command."""
location.set_description("Handle different kernel flavors")
vmlinuz = os.path.join(system_context.boot_directory, "vmlinuz")
makedirs(system_context, "/etc/mkinitcpio.d", exist_ok=True)
# Clean up after the mkinitcpio hook:
for kernel in (
"",
"-hardened",
"-lts",
"-zen",
"-git",
):
remove("/boot/vmlinuz{}".format(kernel), force=True)
# New style linux packages that put vmlinuz into /usr/lib/modules:
self._execute(
location.next_line(),
system_context,
"move",
"/usr/lib/modules/*/vmlinuz",
vmlinuz,
to_outside=True,
ignore_missing_sources=True,
)
assert os.path.isfile(vmlinuz)
def __call__(self, location: Location, system_context: SystemContext,
*args: typing.Any, **kwargs: typing.Any) -> None:
"""Execute command."""
location.set_description('Handle different kernel flavors')
vmlinuz = os.path.join(system_context.boot_directory, 'vmlinuz')
makedirs(system_context, '/etc/mkinitcpio.d', exist_ok=True)
# Clean up after the mkinitcpio hook:
for kernel in (
'',
'-hardened',
'-lts',
'-zen',
'-git',
):
remove('/boot/vmlinuz{}'.format(kernel), force=True)
# New style linux packages that put vmlinuz into /usr/lib/modules:
self._execute(location.next_line(),
system_context,
'move',
'/usr/lib/modules/*/vmlinuz',
vmlinuz,
to_outside=True,
ignore_missing_sources=True)
assert (os.path.isfile(vmlinuz))
def __call__(self, location: Location, system_context: SystemContext,
*args: typing.Any, **kwargs: typing.Any) -> None:
"""Execute command."""
# Nested virtualization:
create_file(
system_context,
"/etc/modprobe.d/kvm_amd.conf",
"options kvm_amd nested=1".encode("utf-8"),
)
# AMD ucode:
location.set_description("Install amd-ucode")
self._execute(location, system_context, "pacman", "amd-ucode")
initrd_parts = os.path.join(system_context.boot_directory,
"initrd-parts")
os.makedirs(initrd_parts, exist_ok=True)
self._execute(
location,
system_context,
"move",
"/boot/amd-ucode.img",
os.path.join(initrd_parts, "00-amd-ucode"),
to_outside=True,
)
def __call__(self, location: Location, system_context: SystemContext,
*args: typing.Any, **kwargs: typing.Any) -> None:
"""Execute command."""
# Shell cleanup:
location.set_description('Clear shell files')
self._add_hook(location,
system_context,
'_teardown',
'run',
'test',
'-x',
'/usr/bin/zsh',
'&&',
'rm',
'-rf',
'/usr/share/zsh',
shell=True,
returncode=None)
self._add_hook(location,
system_context,
'_teardown',
'run',
'test',
'-x',
'/usr/bin/bash',
'&&',
'rm',
'-rf',
'/usr/share/bash-completion',
shell=True,
returncode=None)
def _create_complete_kernel(
self,
location: Location,
system_context: SystemContext,
cmdline: str,
*,
kernel_file: str,
efi_key: str,
efi_cert: str,
):
self._create_efi_kernel(
location,
system_context,
cmdline,
kernel_file=kernel_file,
)
if efi_key and efi_cert:
debug("Signing EFI kernel.")
location.set_description("Sign EFI kernel")
self._execute(
location.next_line(),
system_context,
"sign_efi_binary",
kernel_file,
key=efi_key,
cert=efi_cert,
outside=True,
keep_unsigned=False,
)
trace(f"Validating existence of {kernel_file}.")
assert os.path.isfile(kernel_file)
def __call__(self, location: Location, system_context: SystemContext,
*args: typing.Any, **kwargs: typing.Any) -> None:
"""Execute command."""
assert firewall_type(system_context) == "iptables"
location.set_description("Enable firewall")
to_enable: typing.List[str] = []
if os.path.exists(
system_context.file_name(
"/usr/lib/systemd/system/iptables.service")):
to_enable.append("iptables.service")
if os.path.exists(
system_context.file_name(
"/usr/lib/systemd/system/ip6tables.service")):
to_enable.append("ip6tables.service")
if os.path.exists(
system_context.file_name(
"/usr/lib/systemd/system/iptables-restore.service")):
to_enable.append("iptables-restore.service")
self._execute(
location,
system_context,
"systemd_enable",
*to_enable,
)
def __call__(
self,
location: Location,
system_context: SystemContext,
*args: typing.Any,
**kwargs: typing.Any
) -> None:
"""Execute command."""
self._execute(
location, system_context, "pacman", "quassel-core", "postgresql-libs"
)
self._execute(
location.next_line(),
system_context,
"systemd_harden_unit",
"quassel.service",
)
self._execute(
location.next_line(), system_context, "systemd_enable", "quassel.service"
)
self._execute(
location.next_line(),
system_context,
"net_firewall_open_port",
4242,
protocol="tcp",
comment="Quassel",
)
def __call__(self, location: Location, system_context: SystemContext,
*args: typing.Any, **kwargs: typing.Any) -> None:
"""Execute command."""
location.set_description('Strip development files')
self._add_hook(location,
system_context,
'export',
'remove',
'/usr/include/*',
'/usr/src/*',
'/usr/share/pkgconfig/*',
'/usr/lib/pkgconfig/*',
'/usr/share/aclocal/*',
'/usr/lib/cmake/*',
'/usr/share/gir-1.0/*',
recursive=True,
force=True)
# Remove .so symlinks:
directory = system_context.file_name('/usr/lib')
for f in os.listdir(directory):
fullname = os.path.join(directory, f)
if fullname.endswith('/libnss_files.so'):
continue
if fullname.endswith('.a') \
or (fullname.endswith('.so') and os.path.islink(fullname)):
os.unlink(fullname)
def __call__(
self,
location: Location,
system_context: SystemContext,
*args: typing.Any,
**kwargs: typing.Any,
) -> None:
"""Execute command."""
modules = system_context.file_name("/usr/lib/modules")
if not os.path.isdir(modules):
return # No kernel installed, nothing to do.
kernel_version = system_context.substitution_expanded(
"KERNEL_VERSION", "")
assert kernel_version
location.set_description(
f"Run depmod for kernel version {kernel_version}...")
self._execute(
location,
system_context,
"run",
self._binary(Binaries.DEPMOD),
"-a",
"-b",
system_context.fs_directory,
kernel_version,
)
def __call__(self, location: Location, system_context: SystemContext,
*args: typing.Any, **kwargs: typing.Any) -> None:
"""Execute command."""
self._execute(location, system_context, 'pacman', 'avahi')
# Do setup:
# Fix missing symlink:
self._execute(location.next_line(),
system_context,
'symlink',
'avahi-daemon.service',
'dbus-org.freedesktop.Avahi.service',
work_directory='/usr/lib/systemd/system')
# enable the daemon (actually set up socket activation)
self._execute(location.next_line(), system_context, 'systemd_enable',
'avahi-daemon.service')
# Open the firewall for it:
self._execute(location.next_line(),
system_context,
'net_firewall_open_port',
'5353',
protocol='udp',
comment='Avahi')
# Edit /etc/nsswitch.conf:
self._execute(
location.next_line(), system_context, 'sed',
'/^hosts\\s*:/ s/resolve/mdns_minimal '
'[NOTFOUND=return] resolve/', '/etc/nsswitch.conf')
def __call__(self, location: Location, system_context: SystemContext,
*args: typing.Any, **kwargs: typing.Any) -> None:
"""Execute command."""
self._setup(*args, **kwargs)
h2('Exporting system "{}".'.format(system_context.system_name))
debug('Running Hooks.')
self._run_all_exportcommand_hooks(system_context)
verbose('Preparing system for export.')
self.prepare_for_export(location, system_context)
info('Validating installation for export.')
if not self._skip_validation:
_validate_installation(location.next_line(), system_context)
export_directory \
= self.create_export_directory(system_context)
assert export_directory
system_context.set_substitution('EXPORT_DIRECTORY', export_directory)
verbose('Exporting all data in {}.'.format(export_directory))
self._execute(location.next_line(),
system_context,
'_export_directory',
export_directory,
compression=self._repository_compression,
compression_level=self._repository_compression_level,
repository=self._repository)
info('Cleaning up export location.')
self.delete_export_directory(export_directory)
def __call__(self, location: Location, system_context: SystemContext,
*args: typing.Any, **kwargs: typing.Any) -> None:
"""Execute command."""
# Enable KMS:
self._execute(location, system_context, 'pkg_intel_kms')
self._execute(location, system_context, 'pkg_xorg')
# Set some kernel parameters:
cmdline = system_context.substitution('KERNEL_CMDLINE', '')
if cmdline:
cmdline += ' '
cmdline += 'intel_iommu=igfx_off i915.fastboot=1'
system_context.set_substitution('KERNEL_CMDLINE', cmdline)
self._execute(location, system_context, 'pacman', 'libva-intel-driver',
'mesa', 'vulkan-intel', 'xf86-video-intel',
'intel-media-driver')
self._execute(location.next_line(), system_context, 'create',
'/etc/modprobe.d/i915-guc.conf',
'options i915 enable_guc=3')
self._execute(location.next_line(),
system_context,
'remove',
'/usr/lib/firmware/amdgpu/*',
'/usr/lib/firmware/nvidia/*',
'/usr/lib/firmware/radeon/*',
force=True,
recursive=True)
def __call__(
self,
location: Location,
system_context: SystemContext,
*args: typing.Any,
**kwargs: typing.Any,
) -> None:
"""Execute command."""
## validate package type:
if system_context.substitution("CLRM_PACKAGE_TYPE", ""):
raise GenerateError(
"Trying to run swupd_init on a system that already has a CLRM_PACKAGE_TYPE defined."
)
system_context.set_substitution("CLRM_PACKAGE_TYPE", "swupd")
run(
self._binary(Binaries.SWUPD),
"autoupdate",
f"--path={system_context.fs_directory}",
"--disable",
"--no-progress",
returncode=28,
)
# Setup update-helper so that swupd os-install will actually work:
os.makedirs(system_context.file_name("/usr/bin"))
with open(system_context.file_name("/usr/bin/update-helper"), "wb") as fd:
fd.write(
dedent(
"""\
#!/usr/bin/sh
exit 0
"""
).encode("utf-8")
)
os.chmod(system_context.file_name("/usr/bin/update-helper"), 0o755)
run(
self._binary(Binaries.SWUPD),
"os-install",
f"--path={system_context.fs_directory}",
"--skip-optional",
"--no-progress",
)
location.set_description("Move systemd files into /usr")
self._add_hook(location, system_context, "_teardown", "systemd_cleanup")
with open(system_context.file_name("/usr/lib/os-release"), "r") as osr:
for l in osr:
l = l.strip()
if l.startswith("BUILD_ID="):
build_id = l[9:]
verbose(f"Installed {build_id}.")
system_context.set_substitution("DISTRO_VERSION_ID", build_id)
system_context.set_substitution("DISTRO_VERSION", build_id)
self._execute(location.next_line(), system_context, "create_os_release")
def __call__(self,
location: Location,
system_context: SystemContext,
*args: typing.Any,
message: str = '',
**kwargs: typing.Any) -> None:
"""Execute command."""
location.set_description(message)
self._add_hook(location, system_context, args[0], args[1], *args[2:],
**kwargs)
def __call__(self, location: Location, system_context: SystemContext,
*args: typing.Any, **kwargs: typing.Any) -> None:
"""Execute command."""
location.set_description("Run ldconfig")
self._add_hook(
location,
system_context,
"export",
"_depmod_all",
)
def __call__(self, location: Location, system_context: SystemContext,
*args: typing.Any, **kwargs: typing.Any) -> None:
"""Execute command."""
self._execute(location, system_context, 'pacman', 'glusterfs', 'grep',
'python3')
self._execute(location.next_line(),
system_context,
'create',
'/usr/lib/tmpfiles.d/mnt-gluster.conf',
textwrap.dedent('''\
d /mnt/gluster 0700 root root - -
d /mnt/gluster/0 0755 root root - -
d /mnt/gluster/1 0755 root root - -
d /mnt/gluster/2 0755 root root - -
d /mnt/gluster/4 0755 root root - -
'''),
mode=0o644)
self._execute(location.next_line(),
system_context,
'mkdir',
'/usr/lib/systemd/system/glusterd.service.d',
mode=0o755)
self._execute(
location.next_line(),
system_context,
'create',
'/usr/lib/systemd/system/glusterd.service.d/override.conf',
textwrap.dedent('''\
[Service]
Type=simple
ExecStart=
ExecStart=/usr/bin/glusterd -N --log-file=- --log-level INFO
PIDFile=
KillMode=control-group
Environment=
EnvironmentFile=
StateDirectory=glusterd
RuntimeDirectory=gluster
LogsDirectory=glusterfs
'''),
mode=0o644)
self._execute(location.next_line(),
system_context,
'systemd_harden_unit',
'glusterd.service',
PrivateUsers=False)
# Fix rdma usage which is not included in archlinux:
self._execute(
location.next_line(), system_context, 'sed',
'/option transport-type/ coption transport type = socket',
'/etc/glusterfs/glusterd.vol')
def _sign_efi_kernel(self, location: Location,
system_context: SystemContext, kernel: str, key: str,
cert: str) -> None:
location.set_description('Sign EFI kernel')
self._execute(location.next_line(),
system_context,
'sign_efi_binary',
kernel,
key=key,
cert=cert,
outside=True)
def __call__(self, location: Location, system_context: SystemContext,
*args: typing.Any, **kwargs: typing.Any) -> None:
"""Execute command."""
location.set_description('Strip license files')
self._add_hook(location,
system_context,
'export',
'remove',
'/usr/share/licenses/*',
recursive=True,
force=True)
def _create_initramfs(self, location: Location,
system_context: SystemContext) -> bool:
location.set_description('Create initrd')
initrd_parts = os.path.join(system_context.boot_directory,
'initrd-parts')
os.makedirs(initrd_parts, exist_ok=True)
self._execute(location.next_line(), system_context, 'create_initrd',
os.path.join(initrd_parts, '50-mkinitcpio'))
return os.path.exists(
os.path.join(system_context.boot_directory,
'initrd-parts/50-mkinitcpio'))
def _copy_extra_file(self, location: Location,
system_context: SystemContext,
extra_file: str) -> str:
location.set_description(
"Installing extra mkinitcpio file {}".format(extra_file))
helper_directory = self._helper_directory
assert helper_directory
source_path = os.path.join(helper_directory, extra_file)
dest_path = os.path.join("/usr/bin", extra_file)
copy(system_context, source_path, dest_path, from_outside=True)
chmod(system_context, 0o755, dest_path)
return dest_path
def _install_mkinitcpio(
self, location: Location,
system_context: SystemContext) -> typing.Sequence[str]:
to_clean_up = [
"/etc/mkinitcpio.d", "/etc/mkinitcpio.conf", "/boot/vmlinu*"
]
location.set_description("Install mkinitcpio")
self._execute(location, system_context, "pacman", "mkinitcpio")
location.set_description("Fix up mkinitcpio.conf")
self._execute(
location.next_line(),
system_context,
"sed",
"/^HOOKS=/ "
"cHOOKS=(base systemd keyboard sd-vconsole "
"sd-encrypt block sd-lvm2 filesystems btrfs "
"sd-shutdown)",
"/etc/mkinitcpio.conf",
)
self._execute(
location.next_line(),
system_context,
"append",
"/etc/mkinitcpio.conf",
'COMPRESSION="cat"',
)
location.set_description("Create mkinitcpio presets")
create_file(
system_context,
"/etc/mkinitcpio.d/cleanroom.preset",
textwrap.dedent("""\
# mkinitcpio preset file for cleanroom
ALL_config="/etc/mkinitcpio.conf"
ALL_kver="/boot/vmlinuz"
PRESETS=('default')
#default_config="/etc/mkinitcpio.conf"
default_image="/boot/initramfs.img"
#default_options=""
""").encode("utf-8"),
)
self._execute(
location.next_line(),
system_context,
"sed",
"s%/initramfs-linux.*.img%/initrd%",
"/etc/mkinitcpio.d/cleanroom.preset",
)
return to_clean_up
def _setup_hooks(self, location: Location, system_context: SystemContext,
locales: typing.Sequence[str]) -> None:
if not system_context.has_substitution('CLRM_LOCALES'):
location.set_description('run locale-gen')
self._add_hook(location, system_context, 'export',
'run', '/usr/bin/locale-gen', inside=True)
location.set_description('Remove locale related data.')
self._add_hook(location, system_context, 'export',
'remove', '/usr/share/locale/*',
'/etc/locale.gen', '/usr/bin/locale-gen',
'/usr/bin/localedef',
force=True, recursive=True)
system_context.set_substitution('CLRM_LOCALES', ','.join(locales))
def __call__(self, location: Location, system_context: SystemContext,
*args: str, **kwargs: typing.Any) -> None:
"""Execute command."""
debootstrap(system_context, suite=kwargs.get('suite', ''),
target=system_context.fs_directory,
mirror=kwargs.get('mirror', ''),
variant=kwargs.get('variant', None),
include=kwargs.get('include', None),
exclude=kwargs.get('exclude', None),
debootstrap_command=self._binary(Binaries.DEBOOTSTRAP))
location.set_description('Move systemd files into /usr')
self._add_hook(location, system_context, '_teardown', 'systemd_cleanup')
def __call__(self, location: Location, system_context: SystemContext,
*args: typing.Any, **kwargs: typing.Any) -> None:
"""Execute command."""
for a in args:
location.set_description('Processing application {}.'.format(a))
desktop_file = '/usr/share/applications/{}.desktop'.format(a)
if not os.path.exists(system_context.file_name(desktop_file)):
raise GenerateError(
'Desktop file "{}" not found.'.format(desktop_file),
location=location)
self._execute(location.next_line(), system_context, 'sed',
'/^Exec=.*$$/ s!^Exec=!Exec=/usr/bin/firejail !',
desktop_file)
