From f95063ede4a90cc6c637591169ad87b0086e164b Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 29 Sep 2021 12:47:57 -0700 Subject: [PATCH] Dockerfile: fix for seccomp Commit f30244ee1b22223cf broke the scenario of using Dockefile for anything but making a release. This happened because it installed native libseccomp build to a temporary directory, and so linking against libseccomp required setting a few environment variables. Let's fix this, and simplify libseccomp installation. Instead of using temporary directories, let's install native libseccomp to a specified directory, all the cross-builds to its subdirectories, and set PKG_CONFIG_PATH and LD_LIBRARY_PATH in Dockerfile so that the built library will found by pkg-config and the dynamic linker (without setting LD_LIBRARY_PATH, ld picks up distro-provided libseccomp.so). While at it, fix some bugs introduced by the abovementioned commit. This fixes building runc in make targets like shell, dbuild, integration, unittest -- i.e. those that depend on runcimage. Fixes: f30244ee1b22223cf38b505b42 Signed-off-by: Kir Kolyshkin --- Dockerfile | 7 +++++-- script/release.sh | 52 ++++++++++++++++++++++++++--------------------- script/seccomp.sh | 30 +++++++++++---------------- 3 files changed, 46 insertions(+), 43 deletions(-) diff --git a/Dockerfile b/Dockerfile index ae07e3b15..920b6e3ae 100644 --- a/Dockerfile +++ b/Dockerfile @@ -53,7 +53,10 @@ RUN cd /tmp \ # install libseccomp ARG LIBSECCOMP_VERSION COPY script/* /tmp/script/ -RUN mkdir -p /usr/local/src/libseccomp \ - && /tmp/script/seccomp.sh "$LIBSECCOMP_VERSION" /usr/local/src/libseccomp /usr/local/src/libseccomp/.env-file arm64 armel armhf ppc64le +RUN mkdir -p /opt/libseccomp \ + && /tmp/script/seccomp.sh "$LIBSECCOMP_VERSION" /opt/libseccomp arm64 armel armhf ppc64le +ENV LIBSECCOMP_VERSION=$LIBSECCOMP_VERSION +ENV LD_LIBRARY_PATH=/opt/libseccomp/lib +ENV PKG_CONFIG_PATH=/opt/libseccomp/lib/pkgconfig WORKDIR /go/src/github.com/opencontainers/runc diff --git a/script/release.sh b/script/release.sh index 7b2605271..64d27b172 100755 --- a/script/release.sh +++ b/script/release.sh @@ -18,6 +18,7 @@ set -e ## ---> # Project-specific options and functions. In *theory* you shouldn't need to # touch anything else in this script in order to use this elsewhere. +: "${LIBSECCOMP_VERSION:=2.5.2}" project="runc" root="$(readlink -f "$(dirname "${BASH_SOURCE[0]}")/..")" @@ -31,7 +32,6 @@ source "$root/script/lib.sh" # $2 -- native architecture (a .suffix for a native binary file name). # $@ -- additional architectures to cross-build for. function build_project() { - local libseccomp_version=2.5.2 local builddir builddir="$(dirname "$1")" shift @@ -39,17 +39,14 @@ function build_project() { shift local arches=("$@") - # Assume that if /usr/local/src/libseccomp/.env-file exists, then - # we are run via Dockerfile, and seccomp is already built. - if [ -r /usr/local/src/libseccomp/.env-file ]; then - # shellcheck disable=SC1091 - source /usr/local/src/libseccomp/.env-file - # Copy the source tarball. - cp /usr/local/src/libseccomp/* "$builddir" - else - "$root/script/seccomp.sh" "$libseccomp_version" "$builddir" "./env-file" "${arches[@]}" - # shellcheck disable=SC1091 - source ./env-file + # Assume that if /opt/libseccomp exists, then we are run + # via Dockerfile, and seccomp is already built. + local seccompdir=/opt/libseccomp temp_dir + if [ ! -d "$seccompdir" ]; then + temp_dir="$(mktemp -d)" + seccompdir="$temp_dir" + # Download and build libseccomp. + "$root/script/seccomp.sh" "$LIBSECCOMP_VERSION" "$seccompdir" "${arches[@]}" fi # For reproducible builds, add these to EXTRA_LDFLAGS: @@ -64,28 +61,37 @@ function build_project() { # Build natively. make -C "$root" \ - PKG_CONFIG_PATH="${LIBSECCOMP_PREFIX}/lib/pkgconfig" \ - LD_LIBRARY_PATH="${LIBSECCOMP_PREFIX}/lib" \ + PKG_CONFIG_PATH="$seccompdir/lib/pkgconfig" \ "${make_args[@]}" strip "$root/$project" + # Sanity check: make sure libseccomp version is as expected. + local ver + ver=$("$root/$project" --version | awk '$1 == "libseccomp:" {print $2}') + if [ "$ver" != "$LIBSECCOMP_VERSION" ]; then + echo >&2 "libseccomp version mismatch: want $LIBSECCOMP_VERSION, got $ver" + exit 1 + fi + mv "$root/$project" "$builddir/$project.$native_arch" - rm -rf "${LIBSECCOMP_PREFIX}" # Cross-build for for other architectures. - local prefix arch + local arch for arch in "${arches[@]}"; do - eval prefix=\$"LIBSECCOMP_PREFIX_$arch" - if [ -z "$prefix" ]; then - echo "LIBSECCOMP_PREFIX_$arch is empty (unsupported arch?)" >&2 - exit 1 - fi set_cross_vars "$arch" make -C "$root" \ - PKG_CONFIG_PATH="${prefix}/lib/pkgconfig" "${make_args[@]}" + PKG_CONFIG_PATH="$seccompdir/$arch/lib/pkgconfig" \ + "${make_args[@]}" "$STRIP" "$root/$project" mv "$root/$project" "$builddir/$project.$arch" - rm -rf "$prefix" done + + # Copy libseccomp source tarball. + cp "$seccompdir"/src/* "$builddir" + + # Clean up. + if [ -n "$tempdir" ]; then + rm -rf "$tempdir" + fi } # End of the easy-to-configure portion. diff --git a/script/seccomp.sh b/script/seccomp.sh index b80ed9174..488ef5b99 100755 --- a/script/seccomp.sh +++ b/script/seccomp.sh @@ -1,5 +1,7 @@ #!/bin/bash +set -e -u -o pipefail + # shellcheck source=./script/lib.sh source "$(dirname "${BASH_SOURCE[0]}")/lib.sh" @@ -7,17 +9,13 @@ source "$(dirname "${BASH_SOURCE[0]}")/lib.sh" # so download, install and build against it. # Parameters: # $1 -- libseccomp version to download and build. -# $2 -- destination directory to put the source tarball in. -# $3 -- file to append LIBSECCOMP_PREFIX*= environment variables to -# (can be sourced to get install paths). +# $2 -- destination directory. # $@ -- additional architectures to cross-compile for. function build_libseccomp() { local ver="$1" shift local dest="$1" shift - local varfile="$1" - shift local arches=("$@") local tar="libseccomp-${ver}.tar.gz" @@ -28,36 +26,32 @@ function build_libseccomp() { tar xf "$tar" -C "$srcdir" pushd "$srcdir/libseccomp-$ver" || return - # Build and install natively. - local prefix - prefix="$(mktemp -d)" + # Build natively and install to /usr/local. ./configure \ - --prefix="$prefix" --libdir="$prefix/lib" \ - --enable-static --disable-shared - echo LIBSECCOMP_PREFIX="$prefix" >>"$varfile" + --prefix="$dest" --libdir="$dest/lib" \ + --enable-static --enable-shared make install make clean # Build and install for additional architectures. local arch for arch in "${arches[@]}"; do - prefix="$(mktemp -d)" set_cross_vars "$arch" ./configure --host "$HOST" \ - --prefix="$prefix" --libdir="$prefix/lib" \ + --prefix="$dest/$arch" --libdir="$dest/$arch/lib" \ --enable-static --enable-shared make install make clean - echo "LIBSECCOMP_PREFIX_${arch}=$prefix" >>"$varfile" done - # Place the source tarball to $dest. + # Place the source tarball to $dest/src. popd || return - mv "$tar"{,.asc} "$dest" + mkdir "$dest"/src + mv "$tar"{,.asc} "$dest"/src } -if $# -lt 4; then - echo "Usage: seccomp.sh [ ...]" >&2 +if [ $# -lt 4 ]; then + echo "Usage: seccomp.sh [ ...]" >&2 exit 1 fi