prepare-chroot-debian

#!/bin/bash
# vim: set ts=4 sw=4 sts=4 et :

# XXX: Changed shebang from /bin/sh to /bin/bash for building on wheezy since
#      /bin/sh links to /bin/dash and VERBOSE compare will fail
#      *NOTE* its a good idea to manually link /bin/sh to /bin/bash in case we
#      run into this sort of issue somewhere else

if [ "$VERBOSE" -ge 2 -o "$DEBUG" == "1" ]; then
    set -x
fi

# ------------------------------------------------------------------------------
# Configuration
# $1: chroot directory [chroot-wheezy, chroot-jessie]
# $2: distribution [wheezy, jessie]
# ------------------------------------------------------------------------------
DIR=$1
DIST=$2

set -e

required_tools_list="debootstrap mount"
for required_tool in $required_tools_list; do
   if ! command -v "$required_tool" >/dev/null 2>&1 ; then
      echo "Required tool '$required_tool' missing! Have you installed build dependencies using 'make install-deps' yet?" >&2
      exit 1
   fi
done

# ------------------------------------------------------------------------------
# Build dependencies to be installed to allow building of Qubes modules
# ------------------------------------------------------------------------------
BUILDPACKAGES="reprepro build-essential devscripts git git-buildpackage debhelper quilt python3 libtool automake"
if [ "0${BUILDER_TURBO_MODE}" -gt 0 ]; then
    APT_GET_OPTIONS+=" -o Dpkg::Options::=--force-unsafe-io"
    eatmydata_maybe=eatmydata
fi
APT_GET_OPTIONS+=" -o Acquire::Retries=3"

if [ -n "${REPO_PROXY}" ]; then
    APT_GET_OPTIONS+=" -o Acquire::http::Proxy=${REPO_PROXY}"
    DEBOOTSTRAP_PREFIX+=" env http_proxy=${REPO_PROXY}"
fi

if ! [ -d $DIR/home/user ]; then
    # --------------------------------------------------------------------------
    # Install debian choot if /home/user does not exist (initial run)
    # --------------------------------------------------------------------------
    mkdir -p $DIR
    echo "-> Installing debian build chroot..."
    retry=0
    apt_https_pkgs="apt-transport-https,ca-certificates"
    while ! COMPONENTS="" $DEBOOTSTRAP_PREFIX debootstrap --arch=amd64 \
                --include=ncurses-term,debian-keyring,$apt_https_pkgs,$eatmydata_maybe \
                --keyring=${DEBIAN_PLUGIN_DIR}keys/$DIST-debian-archive-keyring.gpg \
                $DIST $DIR https://deb.debian.org/debian
    do
        if [ $retry -le 3 ]; then
            cat "$DIR/debootstrap/debootstrap.log"
            echo "Error in debootstrap. Sleeping 60 sec before retrying..."
            retry=$((retry + 1))
            sleep 60
        else
            cat "$DIR/debootstrap/debootstrap.log"
            echo "Error in debootstrap. Aborting due to too much retries."
            exit 1
        fi
    done

    # --------------------------------------------------------------------------
    # Set up a temporary policy-rc.d to prevent apt from starting services
    # on package installation
    # --------------------------------------------------------------------------
    cat > $DIR/usr/sbin/policy-rc.d <<EOF
#!/bin/sh
return 101 # Action forbidden by policy
EOF
    chmod 755 $DIR/usr/sbin/policy-rc.d

    # --------------------------------------------------------------------------
    # Add some groups and users
    # --------------------------------------------------------------------------
    [ -n "$SUDO_UID" ] && USER_OPTS="-u $SUDO_UID"
    [ -n "$USER_UID" ] && USER_OPTS="-u $USER_UID"

    # Added -f to ignore if group already exists
    if [ -n "$USER_GID" ]; then
        chroot $DIR groupadd -f -g $USER_GID user
    elif [ -n "$SUDO_GID" ]; then
        chroot $DIR groupadd -f -g $SUDO_GID user
    else
        chroot $DIR groupadd user
    fi
    chroot $DIR sh -c "useradd -g user $USER_OPTS -m user;su -c 'mkdir qubes-src' - user"

    # --------------------------------------------------------------------------
    # /dev/null should be 0666
    # --------------------------------------------------------------------------
    chroot $DIR sh -c "chmod 0666 /dev/null"
else
    # --------------------------------------------------------------------------
    # /home/user directory already exists, so above stage already complete so
    # temporary remove builder repo, it will be recreated at the end of this
    # script
    # --------------------------------------------------------------------------
    rm -f $DIR/etc/apt/sources.list.d/qubes-builder.list

    # update resolv.conf before calling apt-get
    cp -f /etc/resolv.conf "${DIR}/etc/resolv.conf"

    # update chroot
    chroot $DIR apt-get $APT_GET_OPTIONS update
    # check for CVE-2016-1252 - directly after debootstrap, still vulnerable
    # apt is installed
    wc -L "${DIR}/var/lib/apt/lists/"*InRelease | awk '$1 > 1024 {print; exit 1}'
    if [ -n "$eatmydata_maybe" -a ! -f "$DIR/usr/lib/libeatmydata/libeatmydata.so" ]; then
        chroot $DIR apt-get $APT_GET_OPTIONS -y install eatmydata
    fi
    chroot $DIR $eatmydata_maybe apt-get $APT_GET_OPTIONS -y upgrade
    # install it on build env update too
    chroot $DIR $eatmydata_maybe apt-get $APT_GET_OPTIONS -y install \
        apt-transport-https ca-certificates
fi

# ------------------------------------------------------------------------------
# Mount /proc within chroot environment
# ------------------------------------------------------------------------------
if ! [ -r $DIR/proc/cpuinfo ]; then
    mount -t proc proc $DIR/proc
fi

# ------------------------------------------------------------------------------
# Install all build dependencies specified
# ------------------------------------------------------------------------------
DEBIAN_FRONTEND="noninteractive" DEBIAN_PRIORITY="critical" DEBCONF_NOWARNINGS="yes" \
    chroot $DIR $eatmydata_maybe apt-get $APT_GET_OPTIONS -y install $BUILDPACKAGES

# ------------------------------------------------------------------------------
# Add repositories
# ------------------------------------------------------------------------------

add_repo() {
    local repo="$1"
    if ! fgrep -r -q "$repo" "${DIR}/etc/apt/sources.list"*; then
        touch "${DIR}/etc/apt/sources.list"
        echo "$repo" >> "${DIR}/etc/apt/sources.list"
        # remove old http line, if was there
        if [[ "${repo}" = *https://* ]] && \
                fgrep -q "${repo/https/http}" "${DIR}/etc/apt/sources.list"; then
            fgrep -v "${repo/https/http}" "${DIR}/etc/apt/sources.list" \
                > "${DIR}/etc/apt/sources.list.new"
            mv "${DIR}/etc/apt/sources.list.new" "${DIR}/etc/apt/sources.list"
        fi
    fi
}

del_repo() {
    local repo="$1"
    fgrep -v "$repo" "${DIR}/etc/apt/sources.list" > "${DIR}/etc/apt/sources.list.new"
    mv "${DIR}/etc/apt/sources.list.new" "${DIR}/etc/apt/sources.list"
}

if [ "$DIST" == "wheezy" ]; then
    # Looks like a SID only package is being used to build packages
    # there is a backport available for wheezy
    add_repo "deb https://deb.debian.org/debian wheezy-backports main"
    # wheezy is not affected by CVE-2016-1252
    chroot $DIR apt-get $APT_GET_OPTIONS update
    chroot $DIR $eatmydata_maybe apt-get $APT_GET_OPTIONS -t wheezy-backports install -y dh-systemd config-package-dev
fi

if [ "$DIST" == "stretch" ]; then
    # add stretch-security early, because before updating gnutls from there,
    # https://deb.qubes-os.org won't work (bugs.debian.org/961889)
    add_repo "deb https://deb.debian.org/debian-security stretch/updates main"
    chroot $DIR apt-get $APT_GET_OPTIONS update
    chroot $DIR $eatmydata_maybe apt-get $APT_GET_OPTIONS upgrade -y
fi

# ------------------------------------------------------------------------------
# Install Debian source repo
# ------------------------------------------------------------------------------
add_repo "deb-src https://deb.debian.org/debian ${DIST} main"

del_repo "//deb.qubes-os.org/"

if [ -n "$USE_QUBES_REPO_VERSION" ]; then
    add_repo "deb [arch=amd64 signed-by=/usr/share/keyrings/qubes-archive-keyring.asc] https://deb.qubes-os.org/r${USE_QUBES_REPO_VERSION}/vm $DIST main"
    if [ "0$USE_QUBES_REPO_TESTING" -gt 0 ]; then
        add_repo "deb [arch=amd64 signed-by=/usr/share/keyrings/qubes-archive-keyring.asc] https://deb.qubes-os.org/r${USE_QUBES_REPO_VERSION}/vm ${DIST}-testing main"
    fi
    cp ${DEBIAN_PLUGIN_DIR}keys/qubes-debian-r${USE_QUBES_REPO_VERSION}.asc "${DIR}/usr/share/keyrings/qubes-archive-keyring.asc"
fi

# ------------------------------------------------------------------------------
# Refresh package list (but not qubes repo since it does not yet exist)
# ------------------------------------------------------------------------------
chroot $DIR apt-get $APT_GET_OPTIONS update
# check for CVE-2016-1252 - directly after debootstrap, still vulnerable
# apt is installed
wc -L "${DIR}/var/lib/apt/lists/"*InRelease | awk '$1 > 1024 {print; exit 1}'

# ------------------------------------------------------------------------------
# Update debian apt sources list to use local qubes repo
# ------------------------------------------------------------------------------
cat > $DIR/etc/apt/sources.list.d/qubes-builder.list <<EOF
deb [trusted=yes] file:/tmp/qubes-deb $DIST main
EOF