build

#!/bin/bash

set -e
set -u
set -x

. "$(dirname $0)/scripts/utils.sh"

# get $BUILD_BASENAME
. tmp/build_environment

umask 022

### functions

syslinux_utils_upstream_version () {
   dpkg-query -W -f='${Version}\n' syslinux-utils | \
       # drop epoch
       sed -e 's,.*:,,' | \
       # drop +dfsg and everything that follows
       sed -e 's,\+dfsg.*,,'
}

print_iso_size () {
   local isofile="$1"
   [ -f "$isofile" ] || return 23
   size=$(stat --printf='%s' "$isofile")
   echo "The ISO is ${size} bytes large."
}

### Main

# we require building from git
git rev-parse --is-inside-work-tree &> /dev/null \
   || fatal "${PWD} is not a Git tree."

. config/amnesia
if [ -e config/amnesia.local ] ; then
   . config/amnesia.local
fi

# a clean starting point
rm -rf cache/stages_rootfs

# get LB_BINARY_IMAGES
. config/binary

# get LB_ARCHITECTURE and LB_DISTRIBUTION
. config/bootstrap

# save variables that are needed by chroot_local-hooks
echo "KERNEL_VERSION=${KERNEL_VERSION}" \
   >> config/chroot_local-includes/usr/share/tails/build/variables
echo "KERNEL_SOURCE_VERSION=${KERNEL_SOURCE_VERSION}" \
   >> config/chroot_local-includes/usr/share/tails/build/variables
echo "LB_DISTRIBUTION=${LB_DISTRIBUTION}" >> config/chroot_local-includes/usr/share/tails/build/variables
echo "POTFILES_DOT_IN='$(
         /bin/grep -E --no-filename '[^ #]*\.in$' po/POTFILES.in \
       | sed -e 's,^config/chroot_local-includes,,' | tr "\n" ' '
   )'" \
   >> config/chroot_local-includes/usr/share/tails/build/variables

# fix permissions on some source files that will be copied as is to the chroot.
# they may be wrong, e.g. if the Git repository was cloned with a strict umask.
chown    0:0   config/chroot_local-includes/etc/resolv.conf
chmod -R go+rX config/binary_local-includes/
chmod -R go+rX config/chroot_local-includes/etc
chmod    0440  config/chroot_local-includes/etc/sudoers.d/*
chmod    go+rX config/chroot_local-includes/lib
chmod    go+rX config/chroot_local-includes/lib/live
chmod -R go+rx config/chroot_local-includes/lib/live/config
chmod    go+rX config/chroot_local-includes/lib/live/mount
chmod -R go+rX config/chroot_local-includes/lib/systemd
chmod    go+rX config/chroot_local-includes/live
chmod -R go+rX config/chroot_local-includes/usr
chmod -R go+rx config/chroot_local-includes/usr/local/bin
chmod -R go+rx config/chroot_local-includes/usr/local/sbin
chmod -R go+rX config/chroot_local-includes/usr/share/doc
chmod -R go+rX config/chroot_local-includes/var
chmod -R go+rX config/chroot_apt
chmod -R go+rX config/chroot_sources

# normalize file timestamps
find \
   config/binary_local-includes \
   config/chroot_local-includes \
   wiki/src \
   -exec touch --date="@$SOURCE_DATE_EPOCH" '{}' \;

# build the image

# we need /debootstrap/deburis to build a manifest of used packages:
DEBOOTSTRAP_OPTIONS="${DEBOOTSTRAP_OPTIONS:-} --keep-debootstrap-dir"

# we're not ready for merged-/usr yet: Debian#843461, Tails#11903
DEBOOTSTRAP_OPTIONS="${DEBOOTSTRAP_OPTIONS:-} --no-merged-usr"

# use our own APT repository's key:
DEBOOTSTRAP_GNUPG_HOMEDIR=$(mktemp -d)
gpg --homedir "$DEBOOTSTRAP_GNUPG_HOMEDIR" \
    --import config/chroot_sources/tails.chroot.gpg
if [ -e "$DEBOOTSTRAP_GNUPG_HOMEDIR/pubring.gpg" ]; then
    DEBOOTSTRAP_GNUPG_KEYRING="$DEBOOTSTRAP_GNUPG_HOMEDIR/pubring.gpg"
elif [ -e "$DEBOOTSTRAP_GNUPG_HOMEDIR/pubring.kbx" ]; then
    DEBOOTSTRAP_GNUPG_KEYRING="$DEBOOTSTRAP_GNUPG_HOMEDIR/pubring.kbx"
else
   fatal "No debootstrap GnuPG keyring was created."
fi
DEBOOTSTRAP_OPTIONS="$DEBOOTSTRAP_OPTIONS --keyring=$DEBOOTSTRAP_GNUPG_KEYRING"

export DEBOOTSTRAP_OPTIONS

: ${MKSQUASHFS_OPTIONS:='-comp xz -Xbcj x86 -b 1024K -Xdict-size 1024K -no-exports'}
MKSQUASHFS_OPTIONS="${MKSQUASHFS_OPTIONS} -wildcards -ef chroot/usr/share/tails/build/mksquashfs-excludes"
export MKSQUASHFS_OPTIONS

# build the doc wiki
./build-website

# refresh translations of our programs
./refresh-translations || fatal "refresh-translations failed ($?)."

case "$LB_BINARY_IMAGES" in
   iso)
      which isohybrid >/dev/null || fatal 'Cannot find isohybrid in $PATH'
      installed_syslinux_utils_upstream_version="$(syslinux_utils_upstream_version)"
      if dpkg --compare-versions \
	   "$installed_syslinux_utils_upstream_version" \
	   'lt' \
	   "$REQUIRED_SYSLINUX_UTILS_UPSTREAM_VERSION" ; then
	  fatal \
	      "syslinux-utils '${installed_syslinux_utils_upstream_version}' is installed, " \
	      "while we need at least '${REQUIRED_SYSLINUX_UTILS_UPSTREAM_VERSION}'."
      fi
      ;;
   *)
      fatal "Image type ${LB_BINARY_IMAGES} is not supported."
      ;;
esac
BUILD_ISO_FILENAME="${BUILD_BASENAME}.iso"
BUILD_MANIFEST="${BUILD_BASENAME}.build-manifest"
BUILD_APT_SOURCES="${BUILD_BASENAME}.apt-sources"
BUILD_PACKAGES="${BUILD_BASENAME}.packages"
BUILD_LOG="${BUILD_BASENAME}.buildlog"
BUILD_USB_IMAGE_FILENAME="${BUILD_BASENAME}.img"

# Clone all output, from this point on, to the log file
exec >  >(tee -a "$BUILD_LOG")
trap "kill -9 $! 2>/dev/null" EXIT HUP INT QUIT TERM
exec 2> >(tee -a "$BUILD_LOG" >&2)
trap "kill -9 $! 2>/dev/null" EXIT HUP INT QUIT TERM

(
   echo "Mirrors:"
   apt-mirror debian
   apt-mirror debian-security
   apt-mirror torproject
   echo "Additional sources:"
   cat config/chroot_sources/*.chroot
) > "$BUILD_APT_SOURCES"

echo "Building ISO image ${BUILD_BASENAME}..."
set -o pipefail
time lb build noauto ${@}
RET=$?
if [ -e binary.iso ]; then
   echo "Image was successfully created"
   [ "$RET" -eq 0 ] || \
       echo "Warning: lb build exited with code $RET"
   print_iso_size binary.iso
   echo "Hybriding it..."
   isohybrid $AMNESIA_ISOHYBRID_OPTS binary.iso || fatal "isohybrid failed"
   print_iso_size binary.iso
   truncate -s %2048 binary.iso
   print_iso_size binary.iso
   echo "Renaming generated files..."
   mv -i binary.iso "${BUILD_ISO_FILENAME}"
   mv -i binary.packages "${BUILD_PACKAGES}"
   generate-build-manifest chroot/debootstrap "${BUILD_MANIFEST}"
else
   fatal "lb build failed ($?)."
fi

echo "Creating USB image ${BUILD_USB_IMAGE_FILENAME}..."
create-usb-image-from-iso "${BUILD_ISO_FILENAME}"