Skip to content

Commit 1fc57ed

Browse files
cassavacassava
committed
tooling: Provide more robust setup.sh.example file
This moves clean-up into the `setup.sh` file, which is more robust and keeps the Dockerfile clean. This only works because of the `trap` shell feature / command.
1 parent 3a7baa0 commit 1fc57ed

File tree

4 files changed

+124
-34
lines changed

4 files changed

+124
-34
lines changed

‎Dockerfile

-2
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,6 @@ RUN --mount=type=cache,target=/ccache \
7979
if [ -r /root/setup.sh ]; then . /root/setup.sh; fi && \
8080
make -f Makefile.all ${VENDOR_TARGET} && \
8181
# Clean up:
82-
conan user --clean && \
8382
if [ ${KEEP_SOURCES} -eq 0 ]; then \
8483
find /root/.conan/data -name dl -type d -maxdepth 5 -exec rm -r {} + && \
8584
conan remove \* -s -b -f; \
@@ -100,7 +99,6 @@ RUN --mount=type=cache,target=/ccache \
10099
echo "${PROJECT_VERSION}" > /cloe/VERSION && \
101100
make ${PACKAGE_TARGET} && \
102101
# Clean up:
103-
conan user --clean && \
104102
if [ ${KEEP_SOURCES} -eq 0 ]; then \
105103
find /root/.conan/data -name dl -type d -maxdepth 5 -exec rm -r {} + && \
106104
conan remove \* -s -b -f; \

‎Makefile.docker

+1-1
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ run-ubuntu-%: FORCE
131131
release-ubuntu-%: FORCE
132132
@test -f setup.sh || echo 'Error: require setup.sh for user authentication'
133133
${DOCKER} run ${DOCKER_RUN_ARGS} ${DOCKER_USER_ARGS} ${DOCKER_IMAGE}-ubuntu-$* \
134-
bash -ec 'source /root/setup.sh && conan upload --force --all -c "*"'
134+
bash -ec 'source /root/setup.sh && upload_conan_packages'
135135

136136
.PHONY: require-setup-sh
137137
require-setup-sh:

‎optional/vtd/Dockerfile

-2
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,6 @@ RUN --mount=type=cache,target=/ccache \
3939
if [ -r /root/setup.sh ]; then . /root/setup.sh; fi && \
4040
make ${VENDOR_TARGET} && \
4141
# Clean up:
42-
conan user --clean && \
4342
if [ ${KEEP_SOURCES} -eq 0 ]; then \
4443
find /root/.conan/data -name dl -type d -maxdepth 5 -exec rm -r {} + && \
4544
conan remove \* -s -b -f; \
@@ -60,7 +59,6 @@ RUN --mount=type=cache,target=/ccache \
6059
echo "${PROJECT_VERSION}" > VERSION && \
6160
make ${PACKAGE_TARGET} && \
6261
# Clean up:
63-
conan user --clean && \
6462
if [ ${KEEP_SOURCES} -eq 0 ]; then \
6563
find /root/.conan/data -name dl -type d -maxdepth 5 -exec rm -r {} + && \
6664
conan remove \* -s -b -f; \

‎setup.sh.example

+123-29
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,136 @@
1-
#!/bin/sh
1+
#!/bin/bash
22
#
3-
# setup.sh.example
3+
# This script can be used to safely inject secrets into the Docker
4+
# build process.
45
#
5-
# This script is then used in the Docker image build process as a secret.
6-
# It should set up the default remote and authenticate if necessary.
6+
# Configure each `setup_` function defined as required and uncomment
7+
# them at the bottom. Then save the file as `setup.sh`, which `Makefile.docker`
8+
# will automatically add as a secret to the Docker image build process.
79
#
8-
# Copy this file to setup.sh and modify it to allow Docker configure Conan in
9-
# the Docker build process. If this file is absent, the default Conan settings
10-
# are used.
11-
#
12-
# Authenticate with the default remote using the correct username and password.
13-
# This should run without any user interaction.
1410

11+
# If any part of this script fails, the build process will too.
1512
set -e
1613

17-
export CONAN_REMOTE="https://artifactory.example.com/artifactory/api/conan/cloe-conan-local"
18-
export CONAN_REMOTE_VERIFY_SSL="True"
19-
export CONAN_LOGIN_USERNAME=
20-
export CONAN_PASSWORD=
14+
setup_hosts() {
15+
# If you need to update /etc/hosts, you can use `--add-host` on the command line
16+
# or you can add them here.
2117

22-
export VI_LIC_SERVER="vtd-licenses.example.com"
18+
local HOSTS=(
19+
"93.184.216.34 example.com"
20+
)
2321

24-
# Don't try to set up remotes if --network=none.
25-
if [ "$(ls /sys/class/net)" != "lo" ]; then
26-
# Set the request timeout to 360 seconds to work-around slow servers.
27-
conan config set general.request_timeout=360
22+
cat /etc/hosts >> /tmp/hosts
23+
for line in $HOSTS; do
24+
echo $line >> /tmp/hosts
25+
done
26+
mount -o bind /tmp/hosts /etc/hosts
2827

29-
if [ "${CONAN_REMOTE}" != "" ]; then
30-
conan remote clean
31-
conan remote add default "${CONAN_REMOTE}" "${CONAN_REMOTE_VERIFY_SSL}"
32-
fi
28+
CLEANUP_FUNCTIONS+=(cleanup_hosts)
29+
}
30+
31+
cleanup_hosts() {
32+
umount /etc/hosts
33+
}
34+
35+
setup_ssh() {
36+
# If you need SSH for any reason, you can make your SSH agent available to Docker
37+
# by passing the arguments `--ssh default=$SSH_AUTH_SOCK`.
38+
# You can then use ssh-scankey to add known hosts or hosts you want to fetch
39+
# things from.
40+
#
41+
# Using known-hosts is a security feature, and this function effectively
42+
# circumvents these protections. Consider using a bind mount instead if
43+
# protection against man-in-the-middle attacks are important!
44+
45+
local HOSTS=(
46+
"-p 80 github.com"
47+
)
48+
49+
for host in $HOSTS; do
50+
if grep -vqF "$host" ~/.ssh/known_hosts; then
51+
ssh-keyscan $host >> ~/.ssh/known_hosts
52+
fi
53+
done
54+
55+
CLEANUP_FUNCTIONS+=(cleanup_ssh)
56+
}
57+
58+
cleanup_ssh() {
59+
rm -rf ~/.ssh
60+
}
61+
62+
network_available() {
63+
# If you need to check whether network is available, i.e. Docker network is
64+
# not "none", then you can use something like this, which checks that there is
65+
# a network interface that is not "lo".
66+
ip link | sed -nr 's/^[0-9]+: ([^:]+):.*/\1/p' | grep -vq lo
67+
}
68+
69+
setup_conan() {
70+
# Authenticate with the default remote using the correct username and password.
71+
# This should run without any user interaction.
72+
73+
local CONAN_REMOTE="https://artifactory.example.com/artifactory/api/conan/cloe-conan-local"
74+
local CONAN_REMOTE_VERIFY_SSL="True"
75+
local CONAN_LOGIN_USERNAME=
76+
local CONAN_PASSWORD=
3377

34-
if [ "${CONAN_LOGIN_USERNAME}" != "" ]; then
35-
conan user --remote=default -p
78+
if network_available; then
79+
# Set the request timeout to 360 seconds to work-around slow servers.
80+
conan config set general.request_timeout=360
81+
82+
if [ "${CONAN_REMOTE}" != "" ]; then
83+
conan remote add default "${CONAN_REMOTE}" "${CONAN_REMOTE_VERIFY_SSL}"
84+
fi
85+
86+
if [ "${CONAN_LOGIN_USERNAME}" != "" ]; then
87+
conan user --remote=default -p
88+
fi
3689
fi
90+
91+
CLEANUP_FUNCTIONS+=(cleanup_conan)
92+
}
93+
94+
cleanup_conan() {
95+
# Deauthenticate so that we don't leak credentials.
96+
conan user --clean
97+
}
98+
99+
setup_vtd() {
100+
# Export environment variable telling VTD where it can find the license server:
101+
export VI_LIC_SERVER="vtd-licenses.example.com"
102+
}
103+
104+
upload_conan_packages() {
105+
# Prequisites:
106+
# 1. You need to add a 'default' remote and authenticate with it.
107+
# 2. You need to keep the original 'conancenter' remote, so
108+
# that Conan can fetch missing export_sources files.
109+
conan upload -r default --all --force -c "*"
110+
}
111+
112+
# This array with cleanup functions will be extended by each `setup_` function
113+
# that is called that needs cleanup after the Docker RUN step is finished.
114+
# This cleanup is ensured by the call to `trap` below.
115+
CLEANUP_FUNCTIONS=()
116+
117+
cleanup_all() {
118+
for func in $CLEANUP_FUNCTIONS; do
119+
$func
120+
done
121+
}
122+
123+
trap cleanup_all EXIT
124+
125+
# Now uncomment the setups you want to happen in a Docker environment:
126+
#
127+
# In a Docker RUN step, it's possible to have `--network=none`, in which case
128+
# we probably don't need to do anything in this script.
129+
if [ -f /.dockerenv ] && [ "$(ls /sys/class/net)" != "lo" ]; then
130+
#setup_hosts
131+
#setup_ssh
132+
#setup_conan
133+
#setup_vtd
37134
fi
38135

39-
unset CONAN_REMOTE
40-
unset CONAN_REMOTE_VERIFY_SSL
41-
unset CONAN_LOGIN_USERNAME
42-
unset CONAN_PASSWORD
136+
set +e

0 commit comments

Comments
 (0)