Author: adsb
Date: 2009-08-17 18:46:53 +0000 (Mon, 17 Aug 2009)
New Revision: 1961
Modified:
trunk/cowpoke.conf
trunk/debian/changelog
trunk/scripts/cowpoke.1
trunk/scripts/cowpoke.sh
Log:
* cowpoke:
+ Update to new upstream version
- Run with reduced privileges and only elevate them when needed to
run cowbuilder.
- Don't explicitly pass a buildd username unless it is set, this allows
people to configure the remote username in their ssh config or
similar. (Closes: #538191)
- Supply pbuilder with the --buildplace and --aptcache options to
enable use with reduced privileges.
- Relative paths are all relative to the BUILDD_USER's home directory
now, not the incoming dir.
- Add --dpkg-opts support for passing options on to dpkg.
- Autoclean the apt-cache so it doesn't grow unbounded.
Modified: trunk/cowpoke.conf
===================================================================
--- trunk/cowpoke.conf 2009-08-14 19:44:07 UTC (rev 1960)
+++ trunk/cowpoke.conf 2009-08-17 18:46:53 UTC (rev 1961)
@@ -10,7 +10,9 @@
BUILDD_HOST=
# The username for unprivileged operations on BUILDD_HOST
-#BUILDD_USER="$(id -un 2>/dev/null)"
+# If unset the user that invoked cowpoke will be assumed, or the user that
+# is configured for the BUILDD_HOST in your ssh config will be used.
+#BUILDD_USER=
# The Debian architecture(s) to build for. A space separated list of
# architectures may be used here to build for all of them in a single pass.
@@ -26,7 +28,8 @@
#INCOMING_DIR="cowbuilder-incoming"
# The filesystem root for all pbuilder COW and result files. Arch and dist
-# specific subdirectories will be created under this.
+# specific subdirectories normally will be created under this. The apt cache
+# and temporary build directory will also be located under this path.
#PBUILDER_BASE="/var/cache/pbuilder"
# The gpg key id to pass to debsign's -k option. eg. SIGN_KEYID="0x12345678"
@@ -38,15 +41,15 @@
# This option will be ignored if SIGN_KEYID is unset.
#UPLOAD_QUEUE=
-# An optional command that may be used to gain root access from the remote
-# build machine. If unset, cowpoke will attempt to log in directly as root,
-# which is the recommended method when used in conjunction with a secure key
-# to grant root access to the machine. If you prefer to gain root access
-# using a simple password (or worse, a normal user password), then you can
-# set this option to the security hole^W^W privilege escalation option of
-# your choice. If set, cowpoke will log in initially as the $BUILDD_USER,
-# then use this command to gain the privileges that it required to execute
-# the cowbuilder invocation script.
+# The command to use to gain root privileges on the remote build machine.
+# This is only required to invoke cowbuilder and allow it to enter its chroot,
+# so you may restrict this user to only being able to run that command with
+# escalated privileges. Something like this in sudoers will enable invoking
+# cowbuilder without an additional password entry required:
+# youruser ALL = NOPASSWD: /usr/sbin/cowbuilder
+# Alternatively you could use ssh with a forwarded key, or whatever other
+# mechanism suits your local access policy. su -c isn't really suitable
+# here due to its quoting requirements being different from all the rest.
#BUILDD_ROOTCMD="sudo"
# The utility to use when creating a new build root. Alternatives are
Modified: trunk/debian/changelog
===================================================================
--- trunk/debian/changelog 2009-08-14 19:44:07 UTC (rev 1960)
+++ trunk/debian/changelog 2009-08-17 18:46:53 UTC (rev 1961)
@@ -10,6 +10,19 @@
[ Adam D. Barratt ]
* bts:
+ Make "tags NNNNNN =" operate correctly again. (Closes: #539688)
+ * cowpoke:
+ + Update to new upstream version
+ - Run with reduced privileges and only elevate them when needed to
+ run cowbuilder.
+ - Don't explicitly pass a buildd username unless it is set, this allows
+ people to configure the remote username in their ssh config or
+ similar. (Closes: #538191)
+ - Supply pbuilder with the --buildplace and --aptcache options to
+ enable use with reduced privileges.
+ - Relative paths are all relative to the BUILDD_USER's home directory
+ now, not the incoming dir.
+ - Add --dpkg-opts support for passing options on to dpkg.
+ - Autoclean the apt-cache so it doesn't grow unbounded.
* dget: Update the dpkg-source output matching to enable --build to work
again. (Closes: #541409)
Modified: trunk/scripts/cowpoke.1
===================================================================
--- trunk/scripts/cowpoke.1 2009-08-14 19:44:07 UTC (rev 1960)
+++ trunk/scripts/cowpoke.1 2009-08-17 18:46:53 UTC (rev 1961)
@@ -60,6 +60,12 @@
to not have an existing cowbuilder root in the expected location.
.TP
+.BI \-\-dpkg\-opts= "'opt1 opt2 ...'"
+Specify additional options to be passed to \fBdpkg-buildpackage\fP(1).
Multiple
+options are delimited with spaces. This will override any options specified in
+DEBBUILDOPTS in the build host's pbuilderrc.
+
+.TP
.B \-\-help
Display a brief summary of the available options and current configuration.
@@ -70,7 +76,10 @@
.SH CONFIGURATION OPTIONS
When \fBcowpoke\fP is run the following configuration options are read from
-global, per\-user, and per\-project configuration files if present:
+global, per\-user, and per\-project configuration files if present. File paths
+may be absolute or relative, the latter being relative to the BUILDD_USER's
+home directory. Since the paths are typically quoted when used, tilde
expansion
+will \fBnot\fP be performed on them.
.SS Global defaults
These apply to every arch and dist in a single cowpoke invocation.
@@ -82,8 +91,9 @@
.TP
.B BUILDD_USER
The unprivileged user name for operations on the build machine. This defaults
-to the local name of the user executing \fBcowpoke\fP, and may be overridden by
-the \fB\-\-buildd\-user\fP command line option.
+to the local name of the user executing \fBcowpoke\fP (or to a username that is
+specified in your ssh config for BUILDD_HOST), and may be overridden by the
+\fB\-\-buildd\-user\fP command line option.
.TP
.B BUILDD_ARCH
The Debian architecture(s) to build for. This must match the
\fBDEB_BUILD_ARCH\fP
@@ -100,12 +110,12 @@
.TP
.B INCOMING_DIR
The directory path on the build machine where the source package will initially
-be placed. An absolute path may be used, but it must be writable by the
-\fBBUILDD_USER\fP. Relative paths are rooted at that user's home directory.
+be placed. This must be writable by the \fBBUILDD_USER\fP.
.TP
.B PBUILDER_BASE
The filesystem root for all pbuilder COW and result files. Arch and dist
-specific subdirectories will normally be created under this.
+specific subdirectories will normally be created under this. The apt cache
+and temporary build directory will also be located under this path.
.TP
.B SIGN_KEYID
@@ -116,7 +126,7 @@
made.
.TP
.B UPLOAD_QUEUE
-If this opton is set, it is expected to contain a 'host' specification for
+If this option is set, it is expected to contain a 'host' specification for
\fBdput\fP(1) which will be used to upload them after they are signed. You
will
be prompted to confirm whether you wish to upload the packages after they are
signed. If this option is unset or an empty string, no attempt to upload
packages
@@ -124,15 +134,24 @@
.TP
.B BUILDD_ROOTCMD
-If this opton is unset (which is the default), cowpoke will attempt to log in
-to the build machine as the root user initially, then drop those privileges to
-assume the identity of the \fBBUILDD_USER\fP for operations which do not
require
-them. This is the recommended method when used in conjunction with a secure
key
-to grant root access to the machine. If you prefer to gain root access through
-some other method, then you should set this option to contain the privilege
-escalation command that will be used to execute the scripts which must run as
-root, and cowpoke will initially log in as the \fBBUILDD_USER\fP.
+The command to use to gain root privileges on the remote build machine. If
+unset the default is \fBsudo\fP(8). This is only required to invoke cowbuilder
+and allow it to enter its chroot, so you may restrict this user to only being
+able to run that command with escalated privileges. Something like this in
+sudoers will enable invoking cowbuilder without an additional password entry
+required:
.TP
+.B " "
+.RS 1.5i
+youruser ALL = NOPASSWD: /usr/sbin/cowbuilder
+.RE
+.TP
+.B " "
+Alternatively you could use ssh with a forwarded key, or whatever other
+mechanism suits your local access policy. su -c isn't really suitable
+here due to its quoting requirements being different from all the rest.
+
+.TP
.B DEBOOTSTRAP
The utility to use when creating a new build root. Alternatives are
.BR debootstrap " or " cdebootstrap .
@@ -150,9 +169,9 @@
to compare the new package with the previous version after the build is
complete,
and the result will be included in the build log. Files in it must be readable
by the \fBBUILDD_USER\fP for sanity checking with \fBlintian\fP(1) and
-\fBdebdiff\fP(1), and for upload with \fBdput\fP(1). This should always be an
-absolute path. If this option is not specified for some arch and dist
combination
-then it will default to \fI$PBUILDER_BASE/$arch/$dist/result\fP.
+\fBdebdiff\fP(1), and for upload with \fBdput\fP(1). If this option is not
+specified for some arch and dist combination then it will default to
+.I $PBUILDER_BASE/$arch/$dist/result
.TP
.RB arch _ dist _BASE_PATH
@@ -196,9 +215,10 @@
and configured to use the 'host' alias specified by \fBUPLOAD_QUEUE\fP.
The user executing \fBcowpoke\fP must have ssh access to the build machine as
-both 'root' and the \fBBUILDD_USER\fP. Signing keys are not required to be
-installed on the build machine (and will be ignored there if they are). If the
-package is signed, keys will be expected on the machine that executes
\fBcowpoke\fP.
+the \fBBUILDD_USER\fP. That user must be able to invoke cowbuilder as root by
+using the \fBBUILDD_ROOTCMD\fP. Signing keys are not required to be installed
+on the build machine (and will be ignored there if they are). If the package
+is signed, keys will be expected on the machine that executes \fBcowpoke\fP.
When \fBcowpoke\fP is invoked, it will first attempt to update the cowbuilder
image if that has not already been done on the same day. This is checked by
@@ -221,7 +241,8 @@
.SH SEE ALSO
.BR cowbuilder (1),
.BR pbuilder (1),
-.BR ssh-agent (1).
+.BR ssh-agent (1),
+.BR sudoers (5).
.SH AUTHOR
.B cowpoke
Modified: trunk/scripts/cowpoke.sh
===================================================================
--- trunk/scripts/cowpoke.sh 2009-08-14 19:44:07 UTC (rev 1960)
+++ trunk/scripts/cowpoke.sh 2009-08-17 18:46:53 UTC (rev 1961)
@@ -1,14 +1,13 @@
#! /bin/bash
# Simple shell script for driving a remote cowbuilder via ssh
#
-# Copyright(C) 2007, 2008, Ron <r...@debian.org>
+# Copyright(C) 2007, 2008, 2009, Ron <r...@debian.org>
# This script is distributed according to the terms of the GNU GPL.
set -e
#BUILDD_HOST=
-#BUILDD_ROOTCMD=
-BUILDD_USER="$(id -un 2>/dev/null)"
+#BUILDD_USER=
BUILDD_ARCH="$(dpkg-architecture -qDEB_BUILD_ARCH 2>/dev/null)"
# The 'default' dist is whatever cowbuilder is locally configured for
@@ -19,6 +18,7 @@
#SIGN_KEYID=
#UPLOAD_QUEUE="ftp-master"
+BUILDD_ROOTCMD="sudo"
REMOTE_SCRIPT="cowssh_it"
DEBOOTSTRAP="cdebootstrap"
@@ -58,7 +58,7 @@
{
echo \
"This is $PROGNAME, from the Debian devscripts package, version ###VERSION###
-This code is copyright 2007-8 by Ron <r...@debian.org>, all rights reserved.
+This code is copyright 2007-9 by Ron <r...@debian.org>, all rights reserved.
This program comes with ABSOLUTELY NO WARRANTY.
You are free to redistribute this code under the terms of the
GNU General Public License."
@@ -90,15 +90,17 @@
The expected remote paths are:
- INCOMING_DIR = ~$BUILDD_USER/$INCOMING_DIR
+ INCOMING_DIR = $INCOMING_DIR
PBUILDER_BASE = ${PBUILDER_BASE:-/}
$(get_archdist_vars display)
- The cowbuilder image must have already been created on the build host,
+ The cowbuilder image must have already been created on the build host
and the expected remote paths must already exist if the --create option
- is not passed. You must have ssh access to the build host as '$BUILDD_USER'
- and the ability to either log in, or execute commands, as the root user.
+ is not passed. You must have ssh access to the build host as BUILDD_USER
+ if that is set, else as the user executing cowpoke or a user specified
+ in your ssh config for '$BUILDD_HOST'.
+ That user must be able to execute cowbuilder as root using '$BUILDD_ROOTCMD'.
EOF
@@ -128,6 +130,10 @@
CREATE_COW="yes"
;;
+ --dpkg-opts=*)
+ DEBBUILDOPTS="--debbuildopts \"${arg#*=}\""
+ ;;
+
*.dsc)
DSC="$arg"
;;
@@ -167,8 +173,8 @@
echo "No BUILDD_HOST set. Aborted."
exit 1
fi
-if [ -z "$BUILDD_USER" ]; then
- echo "No BUILDD_USER set. Aborted."
+if [ -z "$BUILDD_ROOTCMD" ]; then
+ echo "No BUILDD_ROOTCMD set. Aborted."
exit 1
fi
if [ -e "$REMOTE_SCRIPT" ]; then
@@ -186,6 +192,8 @@
esac
fi
+[ -z "$BUILDD_USER" ] || BUILDD_USER="$BUILDD_USER@"
+
PACKAGE="$(basename $DSC .dsc)"
DATE="$(date +%Y%m%d 2>/dev/null)"
@@ -203,7 +211,8 @@
echo " ------- Begin build for \$arch \$dist -------"
CHANGES="\$arch.changes"
- LOGFILE="build.${PACKAGE}_\$arch.\$dist.log"
+ LOGFILE="$INCOMING_DIR/build.${PACKAGE}_\$arch.\$dist.log"
+
UPDATELOG="$INCOMING_DIR/cowbuilder-\${arch}-\${dist}-update-log-$DATE"
RESULT_DIR="\$(eval echo "\\\$\${arch}_\${dist}_RESULT_DIR")"
BASE_PATH="\$(eval echo "\\\$\${arch}_\${dist}_BASE_PATH")"
@@ -242,18 +251,30 @@
if [ "$CREATE_COW" = "yes" ]; then
mkdir -p "\$RESULT_DIR"
mkdir -p "\$(dirname \$BASE_PATH)"
- cowbuilder --create --distribution \$dist --basepath
"\$BASE_PATH" \\
- --debootstrap "$DEBOOTSTRAP" --debootstrapopts
--arch="\$arch" 2>&1 \\
- | tee "cowbuilder-\${arch}-\${dist}-update-log-$DATE"
+ mkdir -p "$PBUILDER_BASE/aptcache"
+ $BUILDD_ROOTCMD cowbuilder --create --distribution \$dist
\\
+ --basepath "\$BASE_PATH"
\\
+ --aptcache
"$PBUILDER_BASE/aptcache" \\
+ --debootstrap "$DEBOOTSTRAP"
\\
+ --debootstrapopts
--arch="\$arch" \\
+ 2>&1 | tee "\$UPDATELOG"
else
echo "SKIPPING \$dist/\$arch build, '\$BASE_PATH' does not
exist" | tee "\$LOGFILE"
echo " use the cowpoke --create option to bootstrap
a new build root" | tee -a "\$LOGFILE"
continue
fi
- elif ! [ -e "cowbuilder-\${arch}-\${dist}-update-log-$DATE" ]; then
- cowbuilder --update --basepath "\$BASE_PATH" 2>&1 | tee
"cowbuilder-\${arch}-\${dist}-update-log-$DATE"
+ elif ! [ -e "\$UPDATELOG" ]; then
+ $BUILDD_ROOTCMD cowbuilder --update --basepath "\$BASE_PATH"
\\
+ --aptcache "$PBUILDER_BASE/aptcache"
\\
+ --autocleanaptcache
\\
+ 2>&1 | tee "\$UPDATELOG"
fi
- cowbuilder --build --basepath "\$BASE_PATH" --buildresult
"\$RESULT_DIR" "$(basename $DSC)" 2>&1 \\
+ $BUILDD_ROOTCMD cowbuilder --build --basepath "\$BASE_PATH" \\
+ --aptcache "$PBUILDER_BASE/aptcache" \\
+ --buildplace "$PBUILDER_BASE/build" \\
+ --buildresult "\$RESULT_DIR" \\
+ $DEBBUILDOPTS \\
+ "$INCOMING_DIR/$(basename $DSC)" 2>&1 \\
| tee "\$LOGFILE"
set +eo pipefail
@@ -261,13 +282,12 @@
echo >> "\$LOGFILE"
echo "lintian \$RESULT_DIR/${PACKAGE}_\$CHANGES" >> "\$LOGFILE"
- ( su "$BUILDD_USER" -c "lintian
\"\$RESULT_DIR/${PACKAGE}_\$CHANGES\"" ) 2>&1 \\
- | tee -a "\$LOGFILE"
+ lintian "\$RESULT_DIR/${PACKAGE}_\$CHANGES" 2>&1 | tee -a
"\$LOGFILE"
if [ -n "\$OLD_CHANGES" ]; then
echo >> "\$LOGFILE"
echo "debdiff \$OLD_CHANGES ${PACKAGE}_\$CHANGES" >> "\$LOGFILE"
- ( su "$BUILDD_USER" -c "debdiff \"\$OLD_CHANGES\"
\"\$RESULT_DIR/${PACKAGE}_\$CHANGES\"" ) 2>&1 \\
+ debdiff "\$OLD_CHANGES" "\$RESULT_DIR/${PACKAGE}_\$CHANGES"
2>&1 \\
| tee -a "\$LOGFILE"
else
echo >> "\$LOGFILE"
@@ -281,14 +301,9 @@
chmod 755 "$REMOTE_SCRIPT"
-dcmd scp $DSC "$REMOTE_SCRIPT" "$buildd_u...@$buildd_host:$INCOMING_DIR"
+dcmd scp $DSC "$REMOTE_SCRIPT" "$BUILDD_USER$BUILDD_HOST:$INCOMING_DIR"
+ssh -t "$BUILDD_USER$BUILDD_HOST" "\"$INCOMING_DIR/$REMOTE_SCRIPT\" && rm -f
\"$INCOMING_DIR/$REMOTE_SCRIPT\""
-if [ -z "$BUILDD_ROOTCMD" ]; then
- ssh "r...@$buildd_host" "cd ~$BUILDD_USER/\"$INCOMING_DIR\" &&
\"./$REMOTE_SCRIPT\" && rm -f \"./$REMOTE_SCRIPT\""
-else
- ssh -t "$buildd_u...@$buildd_host" "cd \"$INCOMING_DIR\" &&
$BUILDD_ROOTCMD \"./$REMOTE_SCRIPT\" && rm -f \"./$REMOTE_SCRIPT\""
-fi
-
echo
echo "Build completed."
@@ -308,11 +323,7 @@
read -e yesno
case "$yesno" in
YES | yes)
- if [ -z "$BUILDD_ROOTCMD" ] ; then
- debsign "-k$SIGN_KEYID" -r "r...@$buildd_host"
"$RESULT_DIR/${PACKAGE}_$CHANGES"
- else
- debsign "-k$SIGN_KEYID" -r "$buildd_u...@$buildd_host"
"$RESULT_DIR/${PACKAGE}_$CHANGES"
- fi
+ debsign "-k$SIGN_KEYID" -r "$BUILDD_USER$BUILDD_HOST"
"$RESULT_DIR/${PACKAGE}_$CHANGES"
if [ -n "$UPLOAD_QUEUE" ]; then
while true; do
@@ -320,7 +331,7 @@
read -e upload
case "$upload" in
YES | yes)
- ssh "${buildd_us...@$buildd_host" \
+ ssh "$BUILDD_USER$BUILDD_HOST" \
"cd \"$RESULT_DIR/\" && dput
\"$UPLOAD_QUEUE\" \"${PACKAGE}_$CHANGES\""
break 2
;;
--
To unsubscribe, send mail to pkg-devscripts-unsubscr...@teams.debian.net.
