rootfs.tar.gz: Automate construction from Gentoo's amd64 stage3 #3
Conversation
Based on [1] and relicenced under the Apache License, Version 2.0. [1]: https://github.com/wking/oci-gentoo-minimal/blob/5f6850f05a4c183434cdb77774b10c9719649d49/grab.sh Signed-off-by: W. Trevor King <[email protected]>
Based on [1] and relicenced under the Apache License, Version 2.0. [1]: https://github.com/wking/oci-gentoo-minimal/blob/5f6850f05a4c183434cdb77774b10c9719649d49/Makefile#L18-L20 Signed-off-by: W. Trevor King <[email protected]>
Based on [1] and relicenced under the Apache License, Version 2.0. The 'sudo' for mkdir generates a directory belonging to root. We check the digest signature and SHA512 hash of the stage3 to ensure the downloaded file is from Gentoo's release engineering team. For the SHA512 check, the first grep removes the Whirlpool hashes to avoid confusing sha512sum. The second grep removes the '--' separator added by the first grep. The touch avoids attempted rebuilds if the stage3's busybox has an mtime older than the local dependencies like downloads/stage3-amd64-current.tar.bz2. [1]: https://github.com/wking/oci-gentoo-minimal/blob/5f6850f05a4c183434cdb77774b10c9719649d49/Makefile#L22-L25 Signed-off-by: W. Trevor King <[email protected]>
For creating symlinks for all of the BusyBox binary's supported commands. We could put these in their usual directories by using --list-full (which would give entries like sbin/brctl), but I don't think it's worth keeping multiple bin directories in a single-filesystem root that's only used for containers. Signed-off-by: W. Trevor King <[email protected]>
For creating a tarball that can be committed to version control. Git just tracks the executable bit (not the file owner etc.), so using a tarball is easier than restoring that stuff after clones and checkouts. Signed-off-by: W. Trevor King <[email protected]>
Generated with: $ make rootfs.tar.gz stage3-amd64-20151203.tar.bz2 had a SHA512 hash of [1], and a valid signature by [2]. [1]: 180741e224714fc48962f5ed61fa0340e6ce544ba6174d503db960e5eaafc4c3e568bee69490bbe6f632dbf437335652a2988297ae50d532e5c718f6abd911e6 [2]: Gentoo Linux Release Engineering (Automated Weekly Release Key) <[email protected]> Primary key fingerprint: 13EB BDBE DE7A 1277 5DFD B1BA BB57 2E0E 2D18 2910 Signed-off-by: W. Trevor King <[email protected]>
Signed-off-by: W. Trevor King <[email protected]>
|
I followed the guide. It probably needs more info to setup the keys ;) |
|
On Wed, Jan 20, 2016 at 02:02:20PM -0800, Mrunal Patel wrote:
You need: and then import the key. Until your web-of-trust reaches out to the gpg: WARNING: This key is not certified with a trusted signature! but that's not fatal (and I'm not sure how you'd make it fatal even if |
|
@wking I think we should just add to the steps so it is easy for someone to rebuild the rootfs. |
We were linking to the [gentoo-signatures] reference before, and they give this example command there, but Mrunal wanted explicit docs to make everything as obvious as possible [1]. [1]: opencontainers#3 (comment) Signed-off-by: W. Trevor King <[email protected]>
|
On Wed, Jan 20, 2016 at 02:25:49PM -0800, Mrunal Patel wrote:
I just pushed a328eef with more docs around this. Let me know if |
|
LGTM |
rootfs.tar.gz: Automate construction from Gentoo's amd64 stage3
Cross-posted from mrunalp/ocitools#17.
Details in the commit messages (and docs in the README commit), but
this pulls a statically-linked BusyBox from Gentoo's amd64 stage3 and
uses it to seed the tarball. We can also easily grab other things
from that stage3 if we need them later, but things like libapparmor
(that aren't in Gentoo's stage3) will need a different approach.