Commit Graph

205 Commits

Author SHA1 Message Date
Ian Wienand
f15550f9fe Special case dib-python in dib-lint
It seems that on Xenial, it does not take much to confuse "file" and
it's mime guessing such that it thinks some files are not python.

"package-installs-v2" is a good example, since it has an interpreter
"dib-python" that "file" doesn't know about, and no extension.  While
looking at this, I've added emacs vars here so it opens in python
mode.

Change-Id: I01994b08c5ad8987925f1eec4062f5b6ee72eb8f
2016-11-23 19:58:43 +11:00
Oliver Walsh
ae66b64c34 In disk-image-create, append to INSTALL_PACKAGES instead of clobbering.
This allows -p <packagelist> to be used multiple times.

Change-Id: Iabe43982e1606c7ca963a1dd3b23ba47d148ae38
Closes-Bug: #1641157
2016-11-11 17:11:38 +00:00
Ian Wienand
9e392f56b0 Don't set tracing in environment files
Because environment files are sourced into the current environment,
they shouldn't be setting global settings like tracing else they
affect every preceeding import.  This is quite confusing when only
half your imports are traced in the logs, because it was either turned
on, or off, by a preceeding environment import.

There is a corresponding dib-run-parts change in
I29f7df1514aeb988222d1094e8269eddb485c2a0 that will greatly increase
debugability for environment files by deliberately logging what files
are sourced and consistently turning on tracing around their import.

This isn't strictly necessary (since dib-run-parts with the prior
change will just turn tracing off after import anyway) but it's a
decent cleanup for consistency.  A bare-minimum dib-lint check is
added.  Documentation is updated.

Change-Id: I10f68be0642835a04af7e5a2bc101502f61e5357
2016-10-20 13:58:00 +11:00
Paul Belanger
2ea5feca5c
Create (md5|sha256) checksum files for images
In shade, we use both md5 and sha256 checksums to help validate the
integrity of an image. Rather then having nodepool do this each time
for every time, have diskimage-builder create these files when we
build the image.

We've added a flag (disabled by default) to toggle this functionality.

Change-Id: I5815ba69b7d477f1e91dc8ec0c69c86168770964
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
2016-10-05 19:34:03 -04:00
Ian Wienand
48daefb685 Use temp file for du calculations
Storing the du output in a variable seemed convenient, but I didn't
realise just how big it could get especially with things like infra
images -- there's something like 100MiB of text being stored in a bash
variable here.

Convert this to work with a temporary file

Change-Id: I6a6d22c2142e0f199490c39cca8c94769e4b0232
2016-08-18 15:31:07 +10:00
Ben Nemec
e49d347ba9 Generalize logic for skipping final image generation
Since the ironic-agent element builds the ramdisk and extracts the
kernel itself, there's no need to actually generate an image at the
end of the process.  Previously the unnecessary image was being
deleted, but this wastes a bunch of time compressing and converting
the image.  It's better to just not create the image at all.

This change adds a noop element called no-final-image that
disk-image-create looks for in the element list and, if found, will
cause it to skip the final image generation.  This is more flexible
than the previous ironic-agent-specific method that would have
required changes to disk-image-create for every element that wanted
to behave similarly.

Note that this cannot be done using an environment variable, because
element environments.d entries do not propagate out to
disk-image-create.  It also doesn't make sense as a user option
because it should be set by the element author, not the user.

Change-Id: I168feb18f0d578b3babbe4784d3ef75e755e1ebd
2016-07-28 13:14:36 -05:00
Jonas Sticha
616cca72b1 Correct order of parameters in call to tune2fs
Under some systems this leads to an error if the oder of parameters
does not comply exactly with the way it is specified.

Change-Id: Ie1ff871dfffecaf95e7ac467b18543561aaa0ceb
2016-07-21 10:55:20 +02:00
Jenkins
b879507420 Merge "Don't create an ironic-agent image just to delete it" 2016-07-13 21:22:32 +00:00
Ben Nemec
88bf264fbb Don't create an ironic-agent image just to delete it
The ironic-agent element doesn't care about the final qcow2/raw/
whatever image the disk-image-create command normally creates, so
previously it was deleting it at the end of the process.  This is
a pretty significant waste of time when building those images, and
instead we can just skip creating the image when building
ironic-agent.

Change-Id: If48f575e795a823c777891f193ebf8bd943aa296
2016-07-08 15:56:26 -05:00
Jenkins
867bfaa44d Merge "Install docker for tests" 2016-06-29 21:23:41 +00:00
Jenkins
a10a664a2a Merge "Add PS4 to show file/function/line in debug output" 2016-06-07 01:14:08 +00:00
Jenkins
9dedca018f Merge "Handle file magic type varying order matching" 2016-06-07 01:00:57 +00:00
Jenkins
5f4cac3303 Merge "Add a best-effort sudo safety check" 2016-05-26 17:31:00 +00:00
Darragh Bailey
716be1d6f0 Handle file magic type varying order matching
Allow file test to return all possible mime-types and ensure anything
that matches the python file type is parsed by flake8 instead of
relying on the first match returned.

Closes-Bug: #1585688
Change-Id: Iba31f1853537fe9234ab6f83d66f13dc1c578abb
2016-05-25 17:55:59 +01:00
Ian Wienand
34efed027a Add PS4 to show file/function/line in debug output
For something fairly simple, I went back-and-forward with this a bit.

Firstly, I realise calling readlink constantly sucks.  Due to the way
we call dib and source various files, you end up with the source-file
from "caller" being usually a very ugly path including levels of "../"
indirection.  Cleaning this up to something canonical is the only sane
way to present it.

Because we evaluate _ps4() from a sub-shell in the PS4 string, there's
no way for it to do something like build a global in-memory cache in
an associative array or similar.  It could write out a temp file or
some other side-band method, but the overheads of managing this don't
seem any different to just calling readlink.  If anyone can think of a
bash-hack around this that doesn't involve a fork() I'm interested.

We could potentially strip some of the leading paths in the assumption
you know what they are; but it gets complex when things are split
across /usr/bin & /usr/lib and external elements, etc.  I thought
about arbitrarily shortening it (e.g. just take last 20 characters)
which gives you enough of an idea of the file, but looks a bit ugly.
Or we could just leave the file-name out all together and assume the
function name is unique enough; this also seemed a bit ugly.

Obviously it's a matter of taste in the output.  It is certainly
wider, but it also adds a lot of information.  It also makes it fairly
clear where there are things we can make less verbose,
e.g. I1e39822f218dc0322e2490a770f3dc867a55802c disables tracing in
run-parts which is just noise.  There's a few other frequently used
loops that we could disable tracing for by default to benefit
signal:noise.

tl;dr : take a look at the logs.  I think it is a step in the right
direction of making the logs more usable for debugging.

Change-Id: I8054a3050415fcb527baeb7012bf133e5c864bf3
2016-05-18 09:23:15 +10:00
Gregory Haynes
edc06a20e5 Install docker for tests
We have some test cases which attempt to build docker images, therefore
we need docker.

Fix a few bugs that showed up when we run docker tests - we need to
docker rm with sudo and docker images don't always have a /tmp so check
before unmounting it.

Change-Id: I147d0ef3f2ea83f35bac568214573a6bde0b1967
2016-05-13 17:07:16 +00:00
Ian Wienand
672705831f Add a best-effort sudo safety check
As motivation for this; we have had two breakouts of dib in recent
memory.  One was a failure to unmount through symlinks in the core
code (I335316019ef948758392b03e91f9869102a472b9) and the other was
removing host keys on the build-system
(Ib01d71ff9415a0ae04d963f6e380aab9ac2260ce).

For the most part, dib runs unprivileged.  Bits of the core code are
hopefully well tested (modulo bugs like the first one!).  We give free
reign inside the chroot (although there is still some potential there
for adverse external affects via bind mounts).  Where we could be a
bit safer (and could have prevented at least the second of these
breakouts) is with some better checking that the "sudo" calls
*outside* the chroot at least looked sane.

This adds a basic check that we're using chroot or image paths when
calling sudo in those parts of elements that run *outside* the chroot.
Various files are updated to accomodate this check; mostly by just
ignoring it for existing code (I have not audited these calls).

Nobody is pretending this type of checking makes dib magically safe,
or removes the issues with it needing to do things as root during the
build.  But this can help find egregious errors like the key removal.

Change-Id: I161a5aea1d29dcdc7236f70d372c53246ec73749
2016-05-09 15:41:38 +10:00
Ian Wienand
8b4a5e9919 Split YAML & JSON parsing
It turns out that invalid JSON can be valid YAML ... thus if you mess
up a pkg-map file that still works as a YAML file dib-lint will let it
pass, but when pkg-map later tries to open it as a JSON file, it
fails.

Parse each type separately to catch these problems.

Change-Id: Ib3985e7d1599ed6bf3b7a73b786a53177b71fae0
2016-04-22 11:20:57 +10:00
Ian Wienand
b388b20f99 Add some output to dib-lint
It's hard to tell if dib-lint is working as it outputs nothing.  Add
some minimal output strings at some key points.

Change-Id: Id11cc9ecb8d5215d6fc8d8ef3584bfeeba53ff13
2016-04-22 11:20:10 +10:00
Jenkins
7e34c2d97d Merge "Allow skipping the md docs check" 2016-04-20 20:56:19 +00:00
Jenkins
bef58a0880 Merge "Don't stop dib-lint on first flake8 failure" 2016-04-20 18:00:20 +00:00
Jenkins
05382d10b9 Merge "Fix disk usage report" 2016-04-18 19:36:40 +00:00
Ben Nemec
c3ee0acdd8 Allow skipping the md docs check
Not every project that uses dib elements will necessarily want this
check enabled.

Change-Id: Id4b167ed220dd55852b6587b884fabe7bc8554eb
2016-04-15 10:38:32 -05:00
Ben Nemec
bdf3aab53a Don't stop dib-lint on first flake8 failure
It's better to report all of the failures in one shot, so we should
make sure a flake8 failure doesn't immediately end the dib-lint
run, and instead just sets the error flag like the other checks.

Change-Id: Ib13fc71bb12a6565888bdd89f33fc6ada89f8d8c
2016-04-15 10:29:48 -05:00
Jenkins
a6dd8d6b5a Merge "Turn down tracing for source-repo cache" 2016-04-11 06:12:49 +00:00
Ian Wienand
a7afe652d6 Fix disk usage report
This was not well tested.  Build the argument into a variable which
can be eval()ed to produce the final output.

Add the flag so we test this during functional tests.  Add "-x" to dib
invocations so we can more easily debug failures.

Change-Id: Ifdc82627c520379b4124ccb9a4c2fe806c52c75c
2016-04-08 07:07:00 +10:00
Ian Wienand
2f214ff3e8 Turn of tracing around du invocations
We don't want the output of "du" run on the image spammed into the
logs with "set -x".  Swizzle it off around the sensitive commands.

Change-Id: I687e77275f9a49e7934211835aba8610e88cdca6
2016-04-07 08:11:39 +10:00
Jenkins
404ca1b944 Merge "Add image size report" 2016-04-02 15:45:42 +00:00
Ian Wienand
8c837409b8 Turn down tracing for source-repo cache
If you check logs like [1] it's literally thousands of lines of the
same thing over-and-over as the git caching happens.  It is basically
all just noise unless you're debugging it specifically.  Up this to
tracing level 2 ("-x -x") to see it.  Add a note in the help about
multiple flags, which has always been intended but not documented.

Image builds should continue to run with single "-x", but we could
probably greatly increase signal:noise ratio in the logs with a little
more judicial use of this to turn down some of the very noisy &
repetitive parts.

[1] anything in http://nodepool.openstack.org/

Change-Id: I91c5e55814ba9840769357261d203f4850e2eba6
2016-03-22 09:57:30 +11:00
SamYaple
5b6716cee8 Use fstrim to prep the block device
This cuts the image size down alot, esspecially if there were lots of
small file deletes.

The fstrim utility is in the util-linux package and should be on
most all systems. fstrim also works with XFS, ext4, btrfs, etc
prodiving the kernel is new enough.

A reduction of 25% or more in size is common.

Change-Id: I269b4416be450369616f9b8e030f84c30e329804
2016-03-13 16:24:59 +00:00
Ian Wienand
fa3c5e3056 Add image size report
In the common case of not specifying a size, we are already running
"du" over the image to figure out how big it is.  Leverage that by
saving it's output and displaying a pruned list of big files when
requested.

We add a flag to show a summarised option (files >10MiB) and another
to show full output, should you wish that level of detail.

"Invocation" documentation is updated (and formatted a little better
while we're here).

Change-Id: I255800790a62fed1c82fcd311f1cc29c9867766d
2016-03-08 13:58:40 +11:00
Colleen Murphy
76a8d3704b Add --version option to disk-image-create
Being able to discover DIB's version from the command itself is
convenient. This patch adds a --version option to the disk-image-create
command, failing gracefully if diskimage-builder is not installed.

This adds an explicit dependency on pbr to the requirements since this
is required to run diskimage_builder/version.py outside of a test
environment.

This patch consciously chooses to only provide the long-form option
and no '-v' to allow for the future possibility that a '-v' might
indicate '--verbose' in the future.

Change-Id: I9fc084774d6c7a39a944b07680b3eb8be8e34f9c
2016-02-29 16:13:01 -08:00
Jenkins
6f6a096d94 Merge "Handle install with pip -e" 2016-02-12 20:28:51 +00:00
Jenkins
b13512a7f4 Merge "Only match #!/bin/bash in scripts" 2016-02-10 08:35:09 +00:00
Matthew Thode
01fce7b70c
Fix Gentoo hardened support
This checks the profile, if it has hardened in it's name it needs xattr support
unfortunately xattr support cannot yet be relied on everywhere, so it needs to
be disabled for hardened profile builds to correctly pax-mark.

Change-Id: I7fb855249a9e6c9b6497ab5061b4ea3c014f5081
Closes-Bug: 1537177
2016-02-01 20:56:37 -06:00
Ian Wienand
d8abe72537 Only match #!/bin/bash in scripts
Our dib-lint checking is only considering scripts with #!/bin/bash.
While there's nothing really wrong with some other shebang line like
"#!/usr/bin/env bash" let's keep things consistent.

We can use the same regex match to reduce a few forks in the main
checking.

Also a minor cleanup to the file matching

Change-Id: I609721b2671e704ea26075dad7e5b39a8b858f6b
2016-01-29 15:49:10 +11:00
Jenkins
c8c14edfe3 Merge "Support building ACIs" 2015-12-18 13:53:38 +00:00
Jenkins
3412ced2f0 Merge "dib-lint: ignore blank lines in element ordering" 2015-11-10 00:32:04 +00:00
Michael Johnson
590dce8dcc Fix diskimage-builder image size
This patch fixes the calculation of the resultant image size
when building an image with diskimage-builder on ext4 a
filesystem.

Prior to this, using the '--image-size 2' (2GB) setting would
generate an image that would not boot under a 2GB nova flavor.

Change-Id: I7a753bdef84c6300ccea73ae4a92bf330dcd77cb
Closes-Bug: #1513622
2015-11-09 16:20:18 +00:00
Jenkins
4d986ce3a5 Merge "Enable decimal value for $DIB_IMAGE_SIZE." 2015-11-02 20:13:22 +00:00
yogananth subramanian
f84b910f15 Enable decimal value for $DIB_IMAGE_SIZE.
Patch adds support for using decimal values for $DIB_IMAGE_SIZE.
This allows for creating images that are <1G in size.

Change-Id: I945644a8e77fecfb0b83efa282dc00bb29514e0b
Closes-Bug: #1366909
2015-10-13 15:51:27 +00:00
Ian Wienand
9189e24f6d dib-lint: ignore blank lines in element ordering
Some of the elements-deps in the project-config repo have a blank line
at the end, which throws out the ordering.  Strip blank lines, like
comment lines, before processing.

As an additional help, show a side-by-side diff of what is provided
versus what is expected when showing an error about sorting.

Change-Id: I007851ee01d6853ad992ce4437331e8bd79bbfce
2015-10-06 14:02:10 +11:00
Ian Wienand
e678910166 Output failing lines when dib-lint finds wrong indents
When dib-lint complains about wrong indents, it doesn't give you any
indication where the problem is.  This repeats the grep on failure,
outputting the line and line-number.

As a bonus, skip *.orig files from merges

Change-Id: Ifbbdf854ea19191f66e9823468dbc0afc2f93e1f
2015-09-24 21:03:36 +10:00
Pino Toscano
aeab45ad7f dib-lint: validate json/yaml files
Look for files .yaml and pkg-map configurations, and try to load them
either as json or yaml. This way, invalid ones can be detected before
they are committed unnoticed.

Also, exclude .yaml files from being searched while checking bash and
python scripts.

Change-Id: I2478837cfe66929ae1b0d7dd96e049773a35e11c
2015-09-15 12:48:23 +02:00
Ian Wienand
ab5ed610e4 Handle install with pip -e
As described in the comments, inspect the installation to see if we
have been installed with "pip -e" and, if so, make sure we reference
the scripts from the source location rather than the
system-installations.

Update the documentation with a terse but helpful quick-start to show
an easy way to start developing a change using this.

Closes-Bug: #1491035
Change-Id: I0460061b834a2b854175f8c9be2be8d38c540c9d
2015-09-10 16:55:39 +10:00
Gregory Haynes
eb6a260a5a Support building ACIs
App containers are a format used by rocket and are specified at the
following url:
https://github.com/appc/spec/

Change-Id: I8ac24f0194c4bf53dffd6c47e0587bc413101698
2015-07-22 09:30:09 +00:00
Jenkins
d748aa17d2 Merge "Add docker output support" 2015-07-19 11:40:43 +00:00
Monty Taylor
1187f9d5df Add docker output support
We can already produce tarballs, which is the input format docker import
expects. This makes it trivial to add docker as an output format.

Co-Authored-By: Dan Prince <dprince@redhat.com>

Change-Id: Ib60db3b717d33d4cf3181d70fe0ffbfa86fd5d02
2015-07-19 10:20:39 +00:00
Jenkins
cdf4467a8a Merge "Cleanup the build directories earlier" 2015-07-14 11:50:53 +00:00
Jenkins
7aab6c63c2 Merge "Remove deprecated disk-image-get-kernel" 2015-07-07 01:37:51 +00:00