deployment-iso

Author SHA1 Message Date

Author	SHA1	Message	Date
Michael Prokop	3afd4c0e54	MT#60283 Fix puppetlabs repository situation with puppet.gpg key In jenkins-configs commit 765cbf270df321c8c08d567a9803064696c78028 AKA "TT#62000 Add puppet key to Grml-sipwise image" we included the puppetlabs upstream key into our deployment ISO. Updating the file is error prone and requires quite some effort (including changes to jenkins-configs!), whenever the file needs to be adjusted. In commit `8647b3d7b5` we went for usage of http://apt.puppetlabs.com/DEB-GPG-KEY-puppetlabs, which is the expired key though. :-/ \| % gpg DEB-GPG-KEY-puppetlabs \| gpg: WARNING: no command supplied. Trying to guess what you mean ... \| pub rsa4096/1054B7A24BD6EC30 2010-07-10 [SC] [expired: 2017-01-05] \| 47B320EB4C7C375AA9DAE1A01054B7A24BD6EC30 \| uid Puppet Labs Release Key (Puppet Labs Release Key) <info@puppetlabs.com> \| \| % md5sum DEB-GPG-KEY-puppetlabs \| 7b4ed31e1028f921b5c965df0a42e508 DEB-GPG-KEY-puppetlabs So let's check for the expired key, and if present then retrieve the current and proper repository key instead. But instead of using upstream infra http://apt.puppetlabs.com/pubkey.gpg (which we don't have under control on our own and might be unavailable during our deployments), we placed a copy of the key on our own infrastructure: \| mprokop@jenkins1 ~www/files % wget --quiet -O puppetlabs-pubkey-2025.gpg http://apt.puppetlabs.com/pubkey.gpg \| mprokop@jenkins1 ~www/files % ls -lah puppetlabs-pubkey-2025.gpg \| -rw-r--r-- 1 mprokop sipwise 3.2K Apr 9 19:56 puppetlabs-pubkey-2025.gpg \| mprokop@jenkins1 ~www/files % gpg puppetlabs-pubkey-2025.gpg \| gpg: WARNING: no command supplied. Trying to guess what you mean ... \| pub rsa4096 2019-04-08 [SC] \| D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26 \| uid Puppet, Inc. Release Key (Puppet, Inc. Release Key) <release@puppet.com> \| sub rsa4096 2019-04-08 [E] \| mprokop@jenkins1 ~www/files % md5sum puppetlabs-pubkey-2025.gpg \| d6368c2df370ff2093831daad16d9eeb puppetlabs-pubkey-2025.gpg \| mprokop@jenkins1 ~www/files % Given that the file puppet.gpg is also in the wrong format for direct usage with apt-key with its gpg file extension, let's copy it as puppet.asc then, as expected by apt. FTR: this used to work in the past only, as in jenkins-config's jobs/internal/grml/build_grml_image.sh we converted the key for usage as puppet.gpg within apt, via: \| puppet_key='puppet.gpg' \| gpg --export --no-default-keyring --keyring /etc/apt/trusted.gpg \ \| --output "${puppet_key}" release@puppet.com Change-Id: I7fe7dd20d89ed638112638930f578b6bb3783a5c	8 months ago
Michael Prokop	8647b3d7b5	MT#60283 Update to grml-live version v0.53.2 + Debian/trixie grml-live had >410 commits since v0.47.7 (which we used so far), including getting rid of FAI (through our own so called minifai implementation), supporting mmdebstrap for bootstrapping (and using it by default nowadays), and usage inside non-privileged containers. Misc changes: * No longer run any docker containers with --privileged, now that this is handled all internally from within grml-live's build driver * Upgrade everything to Debian/trixie (given that we also switched our trunk/master branch towards trixie also) * Provide wrapper.sh script to avoid maintaining it also inside jenkins-configs' jobs/internal/grml/build_grml_image.sh (which meant going through yet another layer and every single change to it required a full jenkins-config change). Update README.txt accordingly to provide usage examples. * Set up keyring for custom bootstrapping using our own mirror, using grml_build/config/bootstrap-keyring/SIPWISE and deploying /usr/share/keyrings/sipwise-archive-keyring.gpg via updatebase hook script * Ship .gitignore files to ignore directories that are relevant for the build process, though we also don't need to explicitly create them on every single build any longer. * Update configuration layout for grml-live change as of upstream version v0.51.0 (see grml-live.git commit f1dc42a), moving from /etc/grml/fai/config into /usr/share/grml-live/config. * Update configuration layout for grml-live change as of upstream version 0.53.0 (see grml-live.git commit 3a4bd41), changing schema files/<path>/<CLASS> into files/<CLASS>/<path>, class/<CLASS>.var into env/<CLASS> and hooks/<hookname>.<CLASS> into hooks/<CLASS>/<hookname>. * Add memtest86+ + ipxe to SIPWISE class, so they are available for boot menu integration (grml-live uses addons from grml_chroot and no longer from host system). grml_build/Dockerfile related changes: * Adjust ENV usage (fixes `LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 9)`) * Add snippet for usage with debian:trixie-slim as base docker image (useful for debugging e.g. without access to Sipwise systems) * Install ca-certificates (needed for access to https://github.com/ with debian:trixie-slim) * Switch from grml-live v0.47.7 to v0.53.2 * Drop deprecated dependencies that are no longer relevant with recent grml-live versions (fai-client + fai-server get replaced by our own minifai implementation, mksh is no longer relevant for grml-live, and isolinux, ipxe, memtest86+ + syslinux are used from the grml_chroot instead of from the host system, also see above) * Instead install mmdebstrap (which is much faster for bootstrapping than debootstrap), now being supported and the default, thanks to our minifai implementation * Drop /root/.bash_history, as we switched towards our custom wrapper.sh script t/Dockerfile related changes: * Mark /code as safe directory for git, to not fail with "fatal: detected dubious ownership in repository at '/code'" * Adjust ENV usage (fixes `LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 8)`) Addendum: it's yet unclear why we need the `ulimit -n 1048576` workaround to fix an apt/apt-mark performance issue. It feels similar to what has been observed for fakeroot at https://bugs.debian.org/920913. Credits to Chris Hofstaedtler for review and working on grml-live's minifai, to support all our needs. Change-Id: I85111806a550f1aeffcb5263af2455ec8b90cc32	8 months ago

Michael Prokop

MT#60283 Fix puppetlabs repository situation with puppet.gpg key

In jenkins-configs commit 765cbf270df321c8c08d567a9803064696c78028
AKA "TT#62000 Add puppet key to Grml-sipwise image" we
included the puppetlabs upstream key into our deployment ISO.

Updating the file is error prone and requires quite some effort
(including changes to jenkins-configs!), whenever the file needs to be
adjusted.  In commit 8647b3d7b5 we went
for usage of http://apt.puppetlabs.com/DEB-GPG-KEY-puppetlabs, which is
the *expired* key though. :-/

| % gpg DEB-GPG-KEY-puppetlabs
| gpg: WARNING: no command supplied.  Trying to guess what you mean ...
| pub   rsa4096/1054B7A24BD6EC30 2010-07-10 [SC] [expired: 2017-01-05]
|       47B320EB4C7C375AA9DAE1A01054B7A24BD6EC30
| uid                           Puppet Labs Release Key (Puppet Labs Release Key) <info@puppetlabs.com>
|
| % md5sum DEB-GPG-KEY-puppetlabs
| 7b4ed31e1028f921b5c965df0a42e508  DEB-GPG-KEY-puppetlabs

So let's check for the expired key, and if present then retrieve the
*current* and proper repository key instead. But instead of using
upstream infra http://apt.puppetlabs.com/pubkey.gpg (which we don't have
under control on our own and might be unavailable during our
deployments), we placed a copy of the key on our own infrastructure:

| mprokop@jenkins1 ~www/files % wget --quiet -O puppetlabs-pubkey-2025.gpg http://apt.puppetlabs.com/pubkey.gpg
| mprokop@jenkins1 ~www/files % ls -lah puppetlabs-pubkey-2025.gpg
| -rw-r--r-- 1 mprokop sipwise 3.2K Apr  9 19:56 puppetlabs-pubkey-2025.gpg
| mprokop@jenkins1 ~www/files % gpg puppetlabs-pubkey-2025.gpg
| gpg: WARNING: no command supplied.  Trying to guess what you mean ...
| pub   rsa4096 2019-04-08 [SC]
|       D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26
| uid           Puppet, Inc. Release Key (Puppet, Inc. Release Key) <release@puppet.com>
| sub   rsa4096 2019-04-08 [E]
| mprokop@jenkins1 ~www/files % md5sum puppetlabs-pubkey-2025.gpg
| d6368c2df370ff2093831daad16d9eeb  puppetlabs-pubkey-2025.gpg
| mprokop@jenkins1 ~www/files %

Given that the file puppet.gpg is also in the wrong format for direct
usage with apt-key with its gpg file extension, let's copy it as
puppet.asc then, as expected by apt.

FTR: this used to work in the past only, as in jenkins-config's
jobs/internal/grml/build_grml_image.sh we converted the key for usage as
puppet.gpg within apt, via:

| puppet_key='puppet.gpg'
| gpg --export --no-default-keyring --keyring /etc/apt/trusted.gpg \
|   --output "${puppet_key}" release@puppet.com

Change-Id: I7fe7dd20d89ed638112638930f578b6bb3783a5c

Michael Prokop

8647b3d7b5

MT#60283 Update to grml-live version v0.53.2 + Debian/trixie

grml-live had >410 commits since v0.47.7 (which we used so far),
including getting rid of FAI (through our own so called minifai
implementation), supporting mmdebstrap for bootstrapping (and using it
by default nowadays), and usage inside non-privileged containers.

Misc changes:

* No longer run any docker containers with --privileged, now that this
  is handled all internally from within grml-live's build driver

* Upgrade everything to Debian/trixie (given that we also switched our
  trunk/master branch towards trixie also)

* Provide wrapper.sh script to avoid maintaining it also inside
  jenkins-configs' jobs/internal/grml/build_grml_image.sh (which meant
  going through yet another layer and every single change to it required
  a full jenkins-config change). Update README.txt accordingly to
  provide usage examples.

* Set up keyring for custom bootstrapping using our own mirror, using
  grml_build/config/bootstrap-keyring/SIPWISE and
  deploying /usr/share/keyrings/sipwise-archive-keyring.gpg via
  updatebase hook script

* Ship .gitignore files to ignore directories that are relevant for
  the build process, though we also don't need to explicitly create them
  on every single build any longer.

* Update configuration layout for grml-live change as of upstream
  version v0.51.0 (see grml-live.git commit f1dc42a), moving from
  /etc/grml/fai/config into /usr/share/grml-live/config.

* Update configuration layout for grml-live change as of upstream
  version 0.53.0 (see grml-live.git commit 3a4bd41), changing schema
  files/<path>/<CLASS> into files/<CLASS>/<path>,
  class/<CLASS>.var into env/<CLASS> and
  hooks/<hookname>.<CLASS> into hooks/<CLASS>/<hookname>.

* Add memtest86+ + ipxe to SIPWISE class, so they are available for boot
  menu integration (grml-live uses addons from grml_chroot and no longer
  from host system).

grml_build/Dockerfile related changes:

* Adjust ENV usage (fixes `LegacyKeyValueFormat: "ENV key=value" should
  be used instead of legacy "ENV key value" format (line 9)`)

* Add snippet for usage with debian:trixie-slim as base docker image
  (useful for debugging e.g. without access to Sipwise systems)

* Install ca-certificates (needed for access to https://github.com/ with
  debian:trixie-slim)

* Switch from grml-live v0.47.7 to v0.53.2

* Drop deprecated dependencies that are no longer relevant with recent
  grml-live versions (fai-client + fai-server get replaced by our own
  minifai implementation, mksh is no longer relevant for grml-live, and
  isolinux, ipxe, memtest86+ + syslinux are used from the grml_chroot
  instead of from the host system, also see above)

* Instead install mmdebstrap (which is much faster for bootstrapping
  than debootstrap), now being supported and the default, thanks to our
  minifai implementation

* Drop /root/.bash_history, as we switched towards our custom wrapper.sh
  script

t/Dockerfile related changes:

* Mark /code as safe directory for git, to not fail with
  "fatal: detected dubious ownership in repository at '/code'"

* Adjust ENV usage (fixes `LegacyKeyValueFormat: "ENV key=value" should
  be used instead of legacy "ENV key value" format (line 8)`)

Addendum: it's yet unclear why we need the `ulimit -n 1048576`
workaround to fix an apt/apt-mark performance issue. It feels similar to
what has been observed for fakeroot at https://bugs.debian.org/920913.

Credits to Chris Hofstaedtler for review and working on grml-live's
minifai, to support all our needs.

Change-Id: I85111806a550f1aeffcb5263af2455ec8b90cc32

2 Commits (f18b82cbf004386b1b3fe29f53aecd65dba83cec)