openSUSE comes with site-config package, which makes configure select
${prefix}/lib64 as libdir on x86_64, unless explicitly specified.
Since release.sh relies on a particular libdir path (for pkgconfig), it
breaks things:
> + make -C /home/kir/git/runc PKG_CONFIG_PATH=/tmp/tmp.QgIJ1sR5c9/lib/pkgconfig COMMIT_NO= EXTRA_FLAGS=-a 'EXTRA_LDFLAGS=-w -s -buildid=' static
> make[1]: Entering directory '/home/kir/git/runc'
> CGO_ENABLED=1 go build -trimpath -a -tags "seccomp netgo osusergo" -ldflags "-extldflags -static -X main.gitCommit=v1.0.0-204-g963e0146 -X main.version=1.0.0+dev -w -s -buildid=" -o runc .
> Package libseccomp was not found in the pkg-config search path.
> Perhaps you should add the directory containing `libseccomp.pc'
To fix, we have to explicitly specify libdir.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit 39d0ee18e9)
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
https://golang.org/cmd/go/#hdr-Build_and_test_caching says:
> If you have made changes to the C libraries on your system, you will
> need to clean the cache explicitly or else use the -a build flag
> (see 'go help build') to force rebuilding of packages that depend
> on the updated C libraries.
This means that:
1. We need to either 'go clean -cache' or 'go build -a' when building
the release binary. Adding '-a' seems less intrusive / more focused.
2. The check for existing libseccomp.a (added by commit d748280aa)
is no longer needed.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
libseccomp is LGPL, meaning if we statically link it, we have to include
the source code of the library.
Amend "make release" to download and build libseccomp, build runc
against it, and include its sources into the release directory.
The only caveat is I found no way to stop go build from using the
stock (distro-provided) libseccomp.a, so the script checks that
the stock libseccomp.a is not available, and aborts otherwise.
While at it:
- enable shellcheck for script/release.sh
- remove libseccomp installation from the gha job
- add dependecies needed for libseccomp build to the gha job
[v2: also include libseccomp .asc file]
[v3: rebase]
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Apparently, scripts/validate-c is not working in CI (or maybe
maintainers ignored the failures from it) -- current C code
gets some changes if we run indent on it.
This commit fixes this, simplifying things along the way.
In particular:
1. Remove "validate" make target, add "cfmt" target that just runs
indent on all *.c files in the repository (NOTE that *.h files
are not included, as before).
This may help a contributor to fix their code -- they just need
to run "make cfmt" now instead of running "make validate" and
copy-pasting the indent command and options from the hint.
2. Split GHA validate/misc into validate/release and validate/cfmt.
The latter checks that the sources are not changed after "make cfmt".
3. Adds a few more options to indent. This was mostly motivated by
trying to save the existing formatting, minimizing the amount of
changes indent produces.
The new options are:
* -il0: sets the offset for goto labels to 0 (currently all labels
but one are not indented -- let's keep it that way);
* -ppi2: sets the indentation for nested preprocessor directives
to 2 spaces (same as it is done in "SYS_memfd_create" defines);
* -cp1: sets the indentation between #else / #endif and the
following comment to 1 space.
4. Reformat the code using the new indent options.
5. Remove the now-unused script/{.validate,validate-c}.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
These config options are removed by kernel commit f382fb0bcef4,
which made its way into kernel v5.0-rc1.
Make the check conditional.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Kernel commit 2d1c498072de69e (which made its way into kernel v5.8-rc1)
removed CONFIG_MEMCG_SWAP_ENABLED Kconfig option, making swap accounting
always enabled (unless swapaccount=0 boot option is provided).
Make the check conditional.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
CONFIG_NF_NAT_NEEDED was removed in kernel commit 4806e975729f99c7,
which made its way into v5.2-rc1. The functionality is now under
NF_NAT which we already check for.
Make the check for NF_NAT_NEEDED conditional.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
CONFIG_NF_NAT_IPV4 was removed in kernel commit 3bf195ae6037e310,
which made its way into v5.1-rc1. The functionality is now under
NF_NAT which we already check for.
Make the check for NF_NAT_IPV4 conditional.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
In here we have to use Docker, as Ubuntu does not support
all the architectures we're compile-testing here.
Since this is the only step that is using Docker,
there is no sense to separate `make runcimage` from
the rest of it. In case we'll have to use Docker image
more, it will make sense to do so.
While at it, ditch script/tmpmount (added by commit 1735ad788f),
because
- it required root (because mount);
- it is probably no longer needed.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
The apparmor tag was introduced in a01ed80 (2014) to make cgo dependency
on libapparmor optional.
However, the cgo dependency was removed in db093f6 (2017), so it is no
longer meaningful to keep apparmor build tag.
Close#2704
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
I played with shfmt options (-bn, -ci, -sr) a bit trying to minimize
the patch generated (and also because I don't have a strong preference
on these matters), and it appears to be that the patch size is about the
same nevertheless, so I chose no options.
This commit is brought to you by
shfmt -ln bash -w man/*.sh script/*.sh tests/*.sh tests/integration/*.bash
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This script is far easier to use than the previous `make release`
target, not to mention that it also automatically signs all of the
artefacts and makes everything really easy to do for maintainers.
Signed-off-by: Aleksa Sarai <asarai@suse.de>
We don't have that many scripts and for the amount of errors this is
causing on a weekly basis for contributors its not worth the overhead.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Recent changes in upstream shfmt have started causing our scripts to no
longer be "correctly formatted". Fix up with `shfmt -w`.
Signed-off-by: Aleksa Sarai <asarai@suse.de>
This uses the standard go vendor location instead of old Godeps
location.
Also remove usage of symlink GOPATH. Since our README mentions that you
should build it inside GOPATH, i think its a reasonable to assume that
you dont need to create a tmp GOPATH.
Signed-off-by: Daniel Dao <dqminh89@gmail.com>
If user run current script whthout argument, the script will search
config in default dir list, but output following message:
| # script/check-config.sh
| warning: /proc/config.gz seems not a kernel config, searching other paths for kernel config ...
^^^^^^^^^^^^^^^
| info: reading kernel config from /boot/config-4.7.0_HEAD_523d939ef98fd712632d93a5a2b588e477a7565e_ ...
| ...
We can make output better by restruct the code struct:
1: Specify nothing
Show info, and search default dir
2: Specify a config file
Use it directly
3: Specify a wrong config file
Show warning, and search default dir
4: Specify a dir
Info, and search specified dir
Test:
| # script/check-config.sh
| info: no config specified, searching for kernel config ...
| info: reading kernel config from /boot/config-4.7.0_HEAD_523d939ef98fd712632d93a5a2b588e477a7565e_ ...
|
| # script/check-config.sh /linux/.config
| info: reading kernel config from /linux/.config ...
|
| # script/check-config.sh /linux/.configgg
| warning: /linux/.configgg seems not a kernel config, searching other paths for kernel config ...
| info: reading kernel config from /boot/config-4.7.0_HEAD_523d939ef98fd712632d93a5a2b588e477a7565e_ ...
|
| # script/check-config.sh /linux
| info: input is a directory, searching for kernel config in this directory...
| info: reading kernel config from /linux/.config ...
|
Signed-off-by: Zhao Lei <zhaolei@cn.fujitsu.com>
This update allows more distributions to build runC with seccomp out of
the box (the include path and library paths are not always the Go
defaults). In addition, update the test's Dockerfile to have pkg-config
installed.
Signed-off-by: Aleksa Sarai <asarai@suse.de>
On some systems, the cgroup hierarchies are grouped together
(cpu,cpuacct). In order to avoid fake failures, update the cgroup
parsing to just check whether or not the mountinfo options *contain* the
cgroup type.
Signed-off-by: Aleksa Sarai <asarai@suse.de>
Enable the full test suite to run on `make test`. They also all run
inside a Docker container for maximum reproducibility.
Signed-off-by: Aleksa Sarai <asarai@suse.de>
As v2.1.0 is no longer required for successful testing, do not build it in the
Dockerfile - instead just use the version Ubuntu ships.
Signed-off-by: Matthew Heon <mheon@redhat.com>
This removes the existing, native Go seccomp filter generation and replaces it
with Libseccomp. Libseccomp is a C library which provides architecture
independent generation of Seccomp filters for the Linux kernel.
This adds a dependency on v2.2.1 or above of Libseccomp.
Signed-off-by: Matthew Heon <mheon@redhat.com>
Kir Kolyshkin