prepare-chroot-base

#!/bin/bash
# vim: set ts=4 sw=4 sts=4 et :

set -e
if [ "${VERBOSE:-0}" -ge 2 ] || [ "${DEBUG:-0}" -eq 1 ]; then
    set -x
else
    YUM_OPTS="$YUM_OPTS -q"
fi

PLUGIN_DIR=$(dirname "$0")

INSTALLDIR=$1
DIST=$2

RPM_VERSION="$(rpm --version | awk '{print $3}')"

if [ "$(printf '%s\n' "$RPM_VERSION" "4.14.0" | sort -V | head -n1)" = "4.14.0" ]; then
    PGP_INVALID='SIGNATURES NOT OK'
    PGP_SIGNED='signatures OK'
else
    PGP_INVALID='PGP'
    PGP_SIGNED=' pgp '
fi

DOWNLOADDIR="${CACHEDIR}/base_rpms"

YUM=dnf

if [ "${DIST#fc}" != "${DIST}" ]; then
    DISTRIBUTION="fedora"
    DIST_VER="${DIST#fc}"
fi

if [ "${DIST#centos}" != "${DIST}" ]; then
    DISTRIBUTION="centos"
    DIST_VER="${DIST#centos}"
    if [ "$DIST_VER" = "7" ]; then
        YUM=yum
    fi
fi

if [ -e "${PLUGIN_DIR}/yum-bootstrap-${DISTRIBUTION}-${DIST_VER}.conf" ]; then
    YUM_BOOTSTRAP_CONF=yum-bootstrap-${DISTRIBUTION}-${DIST_VER}.conf
else
    YUM_BOOTSTRAP_CONF=yum-bootstrap-${DISTRIBUTION}.conf
fi

YUM="yum --downloaddir=${DOWNLOADDIR} --downloadonly install"
if type dnf >/dev/null 2>/dev/null; then
    YUM="dnf $YUM_OPTS --releasever ${DIST_VER} --downloaddir=${DOWNLOADDIR} --downloadonly install"
elif type yumdownloader >/dev/null 2>/dev/null; then
    # debian does not have --downloadonly plugin
    YUM="yumdownloader -q --resolve --destdir=${DOWNLOADDIR}"
fi

if ! [ -f "${INSTALLDIR}/tmp/.prepared_base" ]; then
    echo "-> Initializing RPM database..."
    RPM_OPTS=()
    YUM_OPTS=()
    if [ -e /etc/debian_version ] || grep -q openSUSE /etc/os-release; then
        # Debian by default keep rpmdb in ~/.rpmdb
        # OpenSUSE by default keep rpmdb in /usr/lib/sysimage/rpm
        RPM_OPTS+=("--define=_dbpath %{_var}/lib/rpm")
    fi
    if grep -q openSUSE /etc/os-release; then
        # zchunk is broken on OpenSUSE (at least together with Fedora repos):
        # https://bugzilla.opensuse.org/1160702
        YUM_OPTS+=("--setopt=zchunk=0")
        # Since OpenSUSE enable gpgcheck by default, make it find the keys
        mkdir -p "${INSTALLDIR}/usr/lib/sysimage"
        ln -ns ../../../var/lib/rpm "${INSTALLDIR}/usr/lib/sysimage/rpm"
    fi
    rpm "${RPM_OPTS[@]}" --initdb --root="${INSTALLDIR}"

    if [ "${DISTRIBUTION}" = "fedora" ]; then
        rpm "${RPM_OPTS[@]}" --import --root="${INSTALLDIR}" \
            "${PLUGIN_DIR}/keys/RPM-GPG-KEY-fedora-${DIST_VER}-primary"
    fi

    if [ "${DISTRIBUTION}" = "centos" ]; then
        rpm "${RPM_OPTS[@]}" --import --root="${INSTALLDIR}" \
            "${PLUGIN_DIR}/keys/RPM-GPG-KEY-CentOS-${DIST_VER}"\
            "${PLUGIN_DIR}/keys/RPM-GPG-KEY-EPEL-${DIST_VER}"
    fi

    echo "-> Retrieving core RPM packages..."

    if [ "${DISTRIBUTION}" = "fedora" ]; then
        INITIAL_PACKAGES="filesystem setup fedora-release dnf dnf-plugins-core"
        if [ "${DIST_VER}" -ge 25 ]; then
            # avoid pulling in glibc-all-langpacks to save space
            INITIAL_PACKAGES="$INITIAL_PACKAGES glibc-langpack-en"
        fi
        if [ "${DIST_VER}" -eq 25 ]; then
            # libcrypt conflicts with libcrypt-nss and yumdownloader is stupid
            # enough to try them both
            INITIAL_PACKAGES="--exclude=libcrypt $INITIAL_PACKAGES"
        fi

        if [ "${DIST_VER}" -ge 26 ]; then
            # coreutils conflicts with coreutils-single
            INITIAL_PACKAGES="--exclude=coreutils-single $INITIAL_PACKAGES"
        fi

        if [ "${DIST_VER}" -ge 27 ]; then
            # curl-minimal conflicts with curl, same for libcurl
            INITIAL_PACKAGES="--exclude=curl --exclude=libcurl $INITIAL_PACKAGES"
        fi

        mkdir -p "${DOWNLOADDIR}"
        yumconf=$(mktemp)

        if [ "x${FEDORA_MIRROR}" != "x" ]; then
            awk '
            BEGIN {
                mirror=ARGV[1];     delete ARGV[1];
                releasever=ARGV[2]; delete ARGV[2];
            }
            {
                gsub("^metalink", "#metalink");
                gsub("^#baseurl=.*/(linux|fedora)/", "baseurl=" mirror "/");
                gsub("\\$releasever", releasever);
                print;
            }' "${FEDORA_MIRROR%/}" "${DIST_VER}" \
                < "${PLUGIN_DIR}/${YUM_BOOTSTRAP_CONF}" \
                > "$yumconf"
        else
            sed -e "s/\\\$releasever/${DIST_VER}/g" \
                < "${PLUGIN_DIR}/${YUM_BOOTSTRAP_CONF}" \
                > "$yumconf"
        fi
    fi

    if [ "${DISTRIBUTION}" = "centos" ]; then
        INITIAL_PACKAGES="filesystem setup epel-release"

        if [ "$DIST_VER" = "7" ]; then
            INITIAL_PACKAGES="$INITIAL_PACKAGES centos-release yum yum-utils yum-plugin-copr centos-release-xen-412"
        else
            # coreutils conflicts with coreutils-single
            INITIAL_PACKAGES="--exclude=coreutils-single $INITIAL_PACKAGES"
            INITIAL_PACKAGES="$INITIAL_PACKAGES centos-release-stream dnf dnf-plugins-core"
        fi

        # Add groupadd, su etc.
        INITIAL_PACKAGES="$INITIAL_PACKAGES shadow-utils util-linux"

        mkdir -p "${DOWNLOADDIR}"
        yumconf=$(mktemp)
        yumconftmp=$(mktemp)

        sed -e "s/\\\$releasever/${DIST_VER}/g" \
            < "${PLUGIN_DIR}/${YUM_BOOTSTRAP_CONF}" \
            > "$yumconf"

        if [ "x${CENTOS_MIRROR}" != "x" ]; then
            awk '
            BEGIN {
                mirror=ARGV[1];     delete ARGV[1];
            }
            {
                gsub("^mirrorlist", "#mirrorlist");
                gsub("^#baseurl=.*/(centos|CentOS)/", "baseurl=" mirror "/");
                print;
            }' "${CENTOS_MIRROR%/}" \
                < "$yumconf" \
                > "$yumconftmp"
            mv "$yumconftmp" "$yumconf"
        fi

        if [ "x${EPEL_MIRROR}" != "x" ]; then
            awk '
            BEGIN {
                mirror=ARGV[1];     delete ARGV[1];
            }
            {
                gsub("^metalink", "#metalink");
                gsub("^#baseurl=.*/epel/", "baseurl=" mirror "/");
                print;
            }' "${EPEL_MIRROR%/}" \
                < "$yumconf" \
                > "$yumconftmp"
            mv "$yumconftmp" "$yumconf"
        fi
    fi

    # shellcheck disable=SC2086
    $YUM "${YUM_OPTS[@]}" -c "$yumconf" -y \
        --installroot="${INSTALLDIR}" ${INITIAL_PACKAGES}
    rm -f "$yumconf"

    echo "-> Verifying signatures..."
    set +x
    for file in "${DOWNLOADDIR}"/*; do
        result=$(rpm "${RPM_OPTS[@]}" --root="${INSTALLDIR}" --checksig "${file}") || {
            echo "Filename: ${file} failed verification.  Exiting!"
            exit 1
        }
        result_status="${result##*:}"
        echo "${result_status}" | grep -q "$PGP_INVALID" && {
            echo "Filename: ${file} contains an invalid PGP signature. Exiting!"
            exit 1
        }
        echo "${result_status}" | grep -q "$PGP_SIGNED" || {
            echo "Filename: ${file} is not signed.  Exiting!"
            exit 1
        }
    done

    echo "-> Printing hashes of downloaded packages:"
    sha256sum "${DOWNLOADDIR}/"*.rpm
    if [ "${VERBOSE:-0}" -ge 2 ] || [ "${DEBUG:-0}" -eq 1 ]; then
        set -x
    fi

    # Prepare /dev nodes
    mkdir -p "${INSTALLDIR}/dev/"
    for f in null urandom zero random console; do
        cp -a "/dev/$f" "$INSTALLDIR/dev/" || true
    done

    # Create loop devices as much as Mock does
    mknod -m 0666 "$INSTALLDIR/dev/loop-control" c 10 237

    for i in $(seq 0 8)
    do
        mknod -m 0666 "$INSTALLDIR/dev/loop$i" b 7 "$i"
    done

    echo "-> Installing core RPM packages..."
    rpm "${RPM_OPTS[@]}" -U --replacepkgs --root="${INSTALLDIR}" "${DOWNLOADDIR}/"*.rpm || exit 1

    if grep -q openSUSE /etc/os-release; then
        # Build the rpmdb again, in case of huge rpm version difference that makes
        # rpmdb --rebuilddb doesn't work anymore. Export using rpm from outside
        # chroot and import using rpm from within chroot
        rpmdb "${RPM_OPTS[@]}" --root="${INSTALLDIR}" --exportdb > "${CACHEDIR}/rpmdb.export" || exit 1
        rm -rf "${INSTALLDIR}/var/lib/rpm"
        chroot "${INSTALLDIR}" rpmdb --importdb < "${CACHEDIR}/rpmdb.export" || exit 1
    fi

    if [ "${DISTRIBUTION}" = "fedora" ]; then
        if [ "x$FEDORA_MIRROR" != "x" ]; then
            sed -i "s/^metalink/#metalink/g" "${INSTALLDIR}/etc/yum.repos.d/fedora.repo" "${INSTALLDIR}/etc/yum.repos.d/fedora-updates.repo"
            sed -i "s/#baseurl/baseurl/g" "${INSTALLDIR}/etc/yum.repos.d/fedora.repo" "${INSTALLDIR}/etc/yum.repos.d/fedora-updates.repo"
        fi
    fi

    if [ "${DISTRIBUTION}" = "centos" ]; then
        if [ "x$CENTOS_MIRROR" != "x" ]; then
            sed -i "s/^mirrorlist/#mirrorlist/g" "${INSTALLDIR}/etc/yum.repos.d/CentOS-Stream-Base.repo"
            sed -i "s/#baseurl/baseurl/g" "${INSTALLDIR}/etc/yum.repos.d/CentOS-Stream-Base.repo"
        fi

        if [ "x$EPEL_MIRROR" != "x" ]; then
            sed -i "s/^metalink/#metalink/g" "${INSTALLDIR}/etc/yum.repos.d/epel.repo"
            sed -i "s/#baseurl/baseurl/g" "${INSTALLDIR}/etc/yum.repos.d/epel.repo"
        fi

        if [ "${DIST_VER}" = "8" ]; then
            sed -i "s/enabled=0/enabled=1/g" "${INSTALLDIR}/etc/yum.repos.d/CentOS-Stream-PowerTools.repo"
        fi
    fi

    touch "${INSTALLDIR}/tmp/.prepared_base"
fi