rbm.conf 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525
  1. # vim: filetype=yaml sw=2
  2. debug: '[% GET ! ENV.RBM_NO_DEBUG %]'
  3. compress_tar: gz
  4. output_dir: "out/[% project %]"
  5. tmp_dir: '[% c("basedir") %]/tmp'
  6. build_log: '[% GET ENV.RBM_LOGS_DIR ? ENV.RBM_LOGS_DIR : "logs" %]/[% project %][% IF c("var/osname") %]-[% c("var/osname") %][% END %].log'
  7. pkg_type: build
  8. steps:
  9. src-tarballs:
  10. compress_tar: xz
  11. src-tarballs: |
  12. #!/bin/bash
  13. set -e
  14. mkdir -p '[% dest_dir %]'
  15. mv -vf '[% project %]-[% c("version") %].tar.xz' '[% dest_dir %]/[% c("filename") %]'
  16. # buildconf contains build options that the user can change in rbm.local.conf
  17. # When adding a new option to buildconf, a default value should be defined
  18. # in var/build_id, so that changing this option does not affect the build_id.
  19. buildconf:
  20. num_procs: '[% GET ENV.RBM_NUM_PROCS ? ENV.RBM_NUM_PROCS : "4" %]'
  21. git_signtag_opt: '-s'
  22. var:
  23. torbrowser_version: '9.5a2'
  24. torbrowser_build: 'build6'
  25. torbrowser_incremental_from:
  26. - 9.5a1
  27. project_name: tor-browser
  28. multi_lingual: 0
  29. build_mar: 1
  30. # By default, we sort the list of installed packages. This allows sharing
  31. # containers with identical list of packages, even if they are not listed
  32. # in the same order. In the cases where the installation order is
  33. # important, sort_deps should be set to 0.
  34. sort_deps: 1
  35. build_id: '[% sha256(c("var/build_id_txt", { buildconf => { num_procs => 4 } })).substr(0, 6) %]'
  36. build_id_txt: |
  37. [% c("version") %]
  38. [% IF c("git_hash") || c("hg_hash"); GET c("abbrev"); END; %]
  39. [% IF c("var/container/use_container") && ! c("var/container/global_disable") -%]
  40. [% c("var/container/suite") %]
  41. [% c("var/container/arch") %]
  42. [% END -%]
  43. input_files: [% c("input_files_id") %]
  44. build:
  45. [% c("build", { filename => 'f', output_dir => '/out' }) %]
  46. container:
  47. dir: '[% c("rbm_tmp_dir") %]/rbm-containers/[% sha256(c("build_id")) %]'
  48. user: rbm
  49. disable_network:
  50. # disable network in the build scripts
  51. build: 1
  52. input_files_list: |
  53. [% FOREACH file IN c("input_files_by_name").keys.sort -%]
  54. [% c("input_files_by_name/" _ file) %]
  55. [% END -%]
  56. faketime: "faketime -f \"[% USE date; GET date.format(c('timestamp'), format = '%Y-%m-%d %H:%M:%S') %]\""
  57. touch: "[% USE date %]touch -m -t [% date.format(c('timestamp'), format = '%Y%m%d%H%M') %]"
  58. locale_ja: ja
  59. locales:
  60. - ar
  61. - ca
  62. - cs
  63. - da
  64. - de
  65. - el
  66. - es-AR
  67. - es-ES
  68. - fa
  69. - fr
  70. - ga-IE
  71. - he
  72. - hu
  73. - id
  74. - is
  75. - it
  76. - '[% c("var/locale_ja") %]'
  77. - ka
  78. - ko
  79. - mk
  80. - nb-NO
  81. - nl
  82. - pl
  83. - pt-BR
  84. - ro
  85. - ru
  86. - sv-SE
  87. - tr
  88. - vi
  89. - zh-CN
  90. - zh-TW
  91. sign_build: '[% ENV.RBM_SIGN_BUILD %]'
  92. sign_build_gpg_opts: '[% ENV.RBM_GPG_OPTS %]'
  93. rezip: |
  94. rezip_tmpdir=$(mktemp -d)
  95. mkdir -p "$rezip_tmpdir/z"
  96. unzip -d "$rezip_tmpdir/z" -- [% c("rezip_file") %] || [ $? -lt 3 ]
  97. pushd "$rezip_tmpdir/z"
  98. [% c("zip", {
  99. zip_src => [ '.' ],
  100. zip_args => '$rezip_tmpdir/new.zip',
  101. }) %]
  102. popd
  103. mv -f -- "$rezip_tmpdir/new.zip" [% c("rezip_file") %]
  104. rm -Rf "$rezip_tmpdir"
  105. set_default_env: |
  106. set -e
  107. [% FOREACH env = c('ENV') -%]
  108. export [% env.key %]="[% env.value %]"
  109. [% END -%]
  110. rootdir=$(pwd)
  111. export SHELL=/bin/bash
  112. export HOME=$rootdir
  113. umask 0022
  114. [% IF c("var/container/global_disable") -%]
  115. rm -Rf /var/tmp/build /var/tmp/dist
  116. [% END -%]
  117. DOCSDIR_project: '[% project %]'
  118. set_PTDIR_DOCSDIR: |
  119. PTDIR="$distdir/TorBrowser/Tor/PluggableTransports"
  120. DOCSDIR="$distdir/TorBrowser/Docs/[% c("var/DOCSDIR_project") %]"
  121. targets:
  122. notarget: linux-x86_64
  123. noint:
  124. debug: 0
  125. release:
  126. var:
  127. release: 1
  128. channel: release
  129. alpha:
  130. var:
  131. alpha: 1
  132. channel: alpha
  133. nightly:
  134. fetch: 1
  135. var:
  136. nightly: 1
  137. channel: nightly
  138. torbrowser_version: '[% ENV.TORBROWSER_NIGHTLY_VERSION ? ENV.TORBROWSER_NIGHTLY_VERSION : c("var_p/nightly_torbrowser_version") %]'
  139. torbrowser-testbuild:
  140. - testbuild
  141. - alpha
  142. testbuild:
  143. var:
  144. testbuild: 1
  145. # Don't create mar files to save time
  146. build_mar: 0
  147. # The common-stretch target is used to build components that are common to all
  148. # platforms, using Debian stretch.
  149. common-stretch:
  150. var:
  151. common: 1
  152. container:
  153. suite: stretch
  154. arch: amd64
  155. pre_pkginst: ''
  156. deps:
  157. - build-essential
  158. - python
  159. - automake
  160. - libtool
  161. - zip
  162. - unzip
  163. torbrowser-android-armv7:
  164. - android-armv7
  165. - android
  166. android-armv7:
  167. arch: armv7
  168. var:
  169. android-armv7: 1
  170. osname: android-armv7
  171. toolchain_arch: arm
  172. torbrowser-android-x86:
  173. - android-x86
  174. - android
  175. android-x86:
  176. arch: x86
  177. var:
  178. android-x86: 1
  179. osname: android-x86
  180. toolchain_arch: x86
  181. torbrowser-android-x86_64:
  182. - android-x86_64
  183. - android
  184. android-x86_64:
  185. arch: x86_64
  186. var:
  187. android-x86_64: 1
  188. osname: android-x86_64
  189. toolchain_arch: x86_64
  190. torbrowser-android-aarch64:
  191. - android-aarch64
  192. - android
  193. android-aarch64:
  194. arch: aarch64
  195. var:
  196. android-aarch64: 1
  197. osname: android-aarch64
  198. toolchain_arch: arm64
  199. android:
  200. var:
  201. android: 1
  202. compiler: android-toolchain
  203. # API 16 is the minimum we currently support for Tor Browser on Android
  204. android_min_api: '[% GET c("var/android_min_api_" _ c("arch")) %]'
  205. # API 21 is the minimum we currently support for arm64 on Android
  206. android_min_api_aarch64: 21
  207. android_min_api_armv7: 16
  208. android_min_api_x86: 16
  209. android_min_api_x86_64: 21
  210. snowflake: 0
  211. namecoin: 0
  212. CC: '$ANDROID_NDK_HOME/[% c("var/toolchain_arch") %]/bin/clang'
  213. CXX: '$ANDROID_NDK_HOME/[% c("var/toolchain_arch") %]/bin/clang++'
  214. container:
  215. suite: stretch
  216. arch: amd64
  217. deps:
  218. - build-essential
  219. - python
  220. - automake
  221. - libtool
  222. - zip
  223. - unzip
  224. torbrowser-linux-x86_64:
  225. - linux-x86_64
  226. - linux
  227. torbrowser-linux-x86_64-debug:
  228. - linux-debug
  229. - linux-x86_64
  230. - linux
  231. torbrowser-linux-i686:
  232. - linux-i686
  233. - linux
  234. linux-x86_64:
  235. arch: x86_64
  236. var:
  237. linux-x86_64: 1
  238. osname: linux-x86_64
  239. linux-i686:
  240. arch: i686
  241. var:
  242. linux-i686: 1
  243. osname: linux-i686
  244. configure_opt_i686: '--host=i686-linux-gnu CFLAGS=-m32 CXXFLAGS=-m32 LDFLAGS=-m32'
  245. configure_opt: '[% c("var/configure_opt_i686") %]'
  246. linux:
  247. var:
  248. linux: 1
  249. compiler: gcc
  250. # We only build snowflake on the alpha and nightly
  251. # channels for now.
  252. snowflake: '[% c("var/alpha") || c("var/nightly") %]'
  253. # Only build Namecoin for linux on nightly
  254. namecoin: '[% c("var/nightly") %]'
  255. container:
  256. suite: wheezy
  257. arch: amd64
  258. pre_pkginst: dpkg --add-architecture i386
  259. deps:
  260. - libc6-dev-i386
  261. - lib32stdc++6
  262. - build-essential
  263. - python
  264. - bison
  265. - hardening-wrapper
  266. - automake
  267. - libtool
  268. - zip
  269. - unzip
  270. linux-debug:
  271. var:
  272. asan: 1
  273. torbrowser-windows-i686:
  274. - windows-i686
  275. - windows
  276. torbrowser-windows-x86_64:
  277. - windows-x86_64
  278. - windows
  279. windows-x86_64:
  280. arch: x86_64
  281. var:
  282. windows-x86_64: 1
  283. osname: windows-x86_64
  284. # HEASLR is 64 bit only (see bug 12968)
  285. flag_HEASLR: '-Wl,--high-entropy-va'
  286. windows-i686:
  287. arch: i686
  288. var:
  289. windows-i686: 1
  290. osname: windows-i686
  291. windows:
  292. var:
  293. windows: 1
  294. container:
  295. suite: stretch
  296. arch: amd64
  297. configure_opt: '--host=[% c("arch") %]-w64-mingw32 CFLAGS="[% c("var/CFLAGS") %]" LDFLAGS="[% c("var/LDFLAGS") %]"'
  298. CFLAGS: '-fstack-protector-strong -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security [% c("var/flag_mwindows") %]'
  299. LDFLAGS: '-Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -Wl,--no-insert-timestamp -lssp -L$gcclibs [% c("var/flag_HEASLR") %] [% c("var/flag_mwindows") %]'
  300. flag_mwindows: '-mwindows'
  301. compiler: mingw-w64
  302. faketime_path: /usr/lib/x86_64-linux-gnu/faketime/libfaketime.so.1
  303. # We only build snowflake on the alpha and nightly
  304. # channels for now.
  305. snowflake: '[% c("var/alpha") || c("var/nightly") %]'
  306. namecoin: 0
  307. deps:
  308. - build-essential
  309. - python
  310. - bison
  311. - automake
  312. - libtool
  313. - zip
  314. - unzip
  315. torbrowser-osx-x86_64:
  316. - osx-x86_64
  317. osx-x86_64:
  318. arch: x86_64
  319. var:
  320. osx: 1
  321. osname: osx-x86_64
  322. container:
  323. suite: stretch
  324. arch: amd64
  325. compiler: 'macosx-toolchain'
  326. configure_opt: '--host=x86_64-apple-darwin11 CC="x86_64-apple-darwin11-clang [% c("var/FLAGS") %]" CXX="x86_64-apple-darwin11-clang++ [% c("var/FLAGS") %]"'
  327. FLAGS: "-target x86_64-apple-darwin11 -B $cctoolsdir -isysroot $sysrootdir"
  328. LDFLAGS: "-Wl,-syslibroot,$sysrootdir -Wl,-dead_strip -Wl,-pie"
  329. macosx_deployment_target: '10.9'
  330. locale_ja: ja-JP-mac
  331. # We only build snowflake on the alpha and nightly
  332. # channels for now.
  333. snowflake: '[% c("var/alpha") || c("var/nightly") %]'
  334. namecoin: 0
  335. deps:
  336. - build-essential
  337. - python
  338. - automake
  339. - libtool
  340. - zip
  341. - unzip
  342. faketime_path: /usr/lib/x86_64-linux-gnu/faketime/libfaketime.so.1
  343. set_PTDIR_DOCSDIR: |
  344. PTDIR="$distdir/Contents/MacOS/Tor/PluggableTransports"
  345. DOCSDIR="$distdir/Contents/Resources/TorBrowser/Docs/[% c("var/DOCSDIR_project") %]"
  346. # The no_build_id target can be useful if you want to quickly display
  347. # a build template or other option but don't want to spend time to
  348. # compute the various build ids
  349. no_build_id:
  350. # The defaut timestamp value will use the commit time of the
  351. # selected commit for the project, which will require cloning the
  352. # git repository if it is not present. When we use the no_build_id
  353. # target to display a script, we usually don't care about such
  354. # details, so we set timestamp to 0 to avoid unnecessary cloning.
  355. timestamp: 0
  356. var:
  357. build_id: 1
  358. no_containers:
  359. var:
  360. container:
  361. global_disable: 1
  362. # change the default gpg_wrapper to allow git tag signed using an
  363. # expired key.
  364. # https://bugs.torproject.org/19737
  365. gpg_wrapper: |
  366. #!/bin/bash
  367. export LC_ALL=C
  368. [%
  369. IF c('gpg_keyring');
  370. SET gpg_kr = '--keyring ' _ path(c('gpg_keyring'), path(c('gpg_keyring_dir'))) _ ' --no-default-keyring';
  371. END;
  372. -%]
  373. gpg_verify=0
  374. for opt in "$@"
  375. do
  376. test "$opt" = '--verify' && gpg_verify=1
  377. done
  378. if [ $gpg_verify = 1 ]
  379. then
  380. [% c('gpg_bin') %] [% c('gpg_args') %] --with-fingerprint [% gpg_kr %] "$@" | sed 's/^\[GNUPG:\] EXPKEYSIG /\[GNUPG:\] GOODSIG /'
  381. exit ${PIPESTATUS[0]}
  382. else
  383. exec [% c('gpg_bin') %] [% c('gpg_args') %] --with-fingerprint [% gpg_kr %] "$@"
  384. fi
  385. remote_start: '[% IF c("var/container/use_container") && ! c("var/container/global_disable") %][% c("runc/remote_start") %][% END %]'
  386. remote_exec: '[% IF c("var/container/use_container") && ! c("var/container/global_disable") %][% c("runc/remote_exec") %][% END %]'
  387. remote_put: '[% IF c("var/container/use_container") && ! c("var/container/global_disable") %][% c("runc/remote_put") %][% END %]'
  388. remote_get: '[% IF c("var/container/use_container") && ! c("var/container/global_disable") %][% c("runc/remote_get") %][% END %]'
  389. remote_finish: '[% IF c("var/container/use_container") && ! c("var/container/global_disable") %][% c("runc/remote_finish") %][% END %]'
  390. runc:
  391. remote_start: |
  392. #!/bin/sh
  393. set -e
  394. if [ $(ls -1 '[% c("remote_srcdir", { error_if_undef => 1 }) %]/container-image_'* | wc -l) -ne 1 ]
  395. then
  396. echo "Can't find container image in input files" >&2
  397. ls -l '[% c("remote_srcdir") %]' >&2
  398. exit 1
  399. fi
  400. mkdir -p '[% c("var/container/dir") %]'/rootfs/rbm
  401. sudo tar -C '[% c("var/container/dir") %]'/rootfs -xf $(ls -1 '[% c("remote_srcdir", { error_if_undef => 1 }) %]/container-image_'*)
  402. [% SET user = c("var/container/user") -%]
  403. [% c("remote_exec", { exec_as_root => 1, exec_cmd => 'id ' _ user
  404. _ ' >/dev/null 2>&1 || adduser -m ' _ user _ ' || useradd -m ' _ user }) %]
  405. remote_exec: |
  406. #!/bin/sh
  407. set -e
  408. [% IF c("interactive") -%]
  409. echo Container directory: [% shell_quote(c("var/container/dir")) %]
  410. [% END -%]
  411. mkdir -p '[% c("var/container/dir", { error_if_undef => 1 }) %]'/rootfs/rbm
  412. echo '#!/bin/sh' > '[% c("var/container/dir") %]'/rootfs/rbm/cmd
  413. echo [% shell_quote(c('exec_cmd')) %] >> '[% c("var/container/dir") %]'/rootfs/rbm/cmd
  414. echo '#!/bin/sh' > '[% c("var/container/dir") %]'/rootfs/rbm/run
  415. [% IF c('exec_as_root'); SET user = 'root'; ELSE; SET user = c("var/container/user", { error_if_undef => 1 }); END; %]
  416. echo 'su - [% user %] -c /rbm/cmd' >> '[% c("var/container/dir") %]'/rootfs/rbm/run
  417. chmod +x '[% c("var/container/dir") %]'/rootfs/rbm/cmd
  418. chmod +x '[% c("var/container/dir") %]'/rootfs/rbm/run
  419. cat > '[% c("var/container/dir") %]'/config.json << EOF
  420. [% INCLUDE 'runc-config.json' %]
  421. EOF
  422. [% IF c("var/container/disable_network/" _ c("exec_name")) -%]
  423. sudo ip netns add 'rbm-[% sha256(c("build_id", { error_if_undef => 1 })) %]'
  424. # make sure the lo interface is up (see bug 31293)
  425. sudo ip netns exec 'rbm-[% sha256(c("build_id", { error_if_undef => 1 })) %]' ip link set lo up
  426. [% END -%]
  427. sudo runc [% IF c("var_p/runc100") %]run[% ELSE %]start[% END %] -b '[% c("var/container/dir") %]' rbm-[% sha256(c("build_id", { error_if_undef => 1 })) %] [% IF c("runc_hide_stderr") %]2>/dev/null[% END %]
  428. [% IF c("var/container/disable_network/" _ c("exec_name")) -%]
  429. sudo ip netns delete 'rbm-[% sha256(c("build_id", { error_if_undef => 1 })) %]'
  430. [% END -%]
  431. remote_put: |
  432. #!/bin/sh
  433. set -e
  434. [%
  435. SET src = shell_quote(c('put_src', { error_if_undef => 1 }));
  436. SET dst = shell_quote(c('put_dst', { error_if_undef => 1 }));
  437. -%]
  438. sudo mkdir -p '[% c("var/container/dir") %]'/rootfs/[% dst %]
  439. sudo cp -aP [% src %] '[% c("var/container/dir") %]'/rootfs/[% dst %]
  440. # On Ubuntu, the /root/.profile file contains a `mesg n` line which is
  441. # producing some `stdin: is not a tty` messages. To hide them, we hide
  442. # stderr from this part by setting runc_hide_stderr.
  443. [% c("remote_exec", { exec_as_root => 1, exec_cmd => 'chown -R ' _ c("var/container/user") _ ' ' _ dst, runc_hide_stderr => 1 }) %]
  444. remote_get: |
  445. #!/bin/sh
  446. set -e
  447. [%
  448. SET src = shell_quote(c('get_src', { error_if_undef => 1 }));
  449. SET dst = shell_quote(c('get_dst', { error_if_undef => 1 }));
  450. -%]
  451. mkdir -p [% dst %]
  452. srcdir='[% c("var/container/dir", { error_if_undef => 1 }) %]'/rootfs/[% src %]
  453. sudo chown -R $(whoami) "$srcdir"
  454. if [ $(ls -1 "$srcdir"/* 2> /dev/null | wc -l) -gt 0 ]
  455. then
  456. for file in "$srcdir"/*
  457. do
  458. bname="$(basename "$file")"
  459. test -e [% dst %]/"$bname" && rm -Rf [% dst %]/"$bname"
  460. mv -f "$file" [% dst %]/
  461. done
  462. fi
  463. remote_finish: |
  464. #!/bin/sh
  465. set -e
  466. sudo rm -Rf '[% c("var/container/dir", { error_if_undef => 1 }) %]'/rootfs '[% c("var/container/dir", { error_if_undef => 1 }) %]'/config.json
  467. rmdir '[% c("var/container/dir") %]'
  468. ENV:
  469. TZ: UTC
  470. LC_ALL: C
  471. --- |
  472. # This part of the file contains options written in perl
  473. use IO::CaptureOutput qw(capture_exec);
  474. (
  475. var_p => {
  476. # runc100 is true if we are using runc >= 1.0.0
  477. # we assume that any version that is not 0.1.1 is >= 1.0.0
  478. runc100 => sub {
  479. my ($out) = capture_exec('sudo', 'runc', '--version');
  480. return !($out =~ m/^runc version 0.1.1/);
  481. },
  482. # runc_spec100 is true if runc spec is at least 1.0.0
  483. # We will need to update this when there is a new spec version available
  484. runc_spec100 => sub {
  485. my ($out) = capture_exec('sudo', 'runc', '--version');
  486. return $out =~ m/^.*spec: 1\.[0-9]+\.[0-9]+(?:-dev)?$/m;
  487. },
  488. nightly_torbrowser_version => sub {
  489. state $version = '';
  490. return $version if $version;
  491. my (undef, undef, undef, $day, $mon, $year) = gmtime;
  492. $version = sprintf("tbb-nightly.%u.%02u.%02u", $year + 1900, $mon + 1, $day);
  493. return $version;
  494. },
  495. },
  496. )