#!/bin/sh set -eu export LC_ALL=C.UTF-8 export SOURCE_DATE_EPOCH={{ SOURCE_DATE_EPOCH }} echo "SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH" # we create the apt user ourselves or otherwise its uid/gid will differ # compared to the one chosen in debootstrap because of different installation # order in comparison to the systemd users # https://bugs.debian.org/969631 # we cannot use useradd because passwd is not Essential:yes {{ CMD }} --variant={{ VARIANT }} --mode={{ MODE }} \ --essential-hook='[ {{ DIST }} = oldstable ] && [ {{ VARIANT }} = - ] && echo _apt:*:100:65534::/nonexistent:/usr/sbin/nologin >> "$1"/etc/passwd || :' \ "$(if [ {{ DIST }} = oldstable ]; then echo --merged-usr; else echo --hook-dir=./hooks/merged-usr; fi)" \ "$(case {{ DIST }} in oldstable) echo --include=e2fsprogs,mount,tzdata,gcc-9-base ;; stable) echo --include=e2fsprogs,mount,tzdata ;; *) echo --include=base-files ;; esac)" \ {{ DIST }} /tmp/debian-{{ DIST }}-mm.tar {{ MIRROR }} mkdir /tmp/debian-{{ DIST }}-mm tar --xattrs --xattrs-include='*' -C /tmp/debian-{{ DIST }}-mm -xf /tmp/debian-{{ DIST }}-mm.tar rm /tmp/debian-{{ DIST }}-mm.tar mkdir /tmp/debian-{{ DIST }}-debootstrap tar --xattrs --xattrs-include='*' -C /tmp/debian-{{ DIST }}-debootstrap -xf "cache/debian-{{ DIST }}-{{ VARIANT }}.tar" # diff cannot compare device nodes, so we use tar to do that for us and then # delete the directory tar -C /tmp/debian-{{ DIST }}-debootstrap -cf /tmp/dev1.tar ./dev tar -C /tmp/debian-{{ DIST }}-mm -cf /tmp/dev2.tar ./dev ret=0 cmp /tmp/dev1.tar /tmp/dev2.tar >&2 || ret=$? if [ "$ret" -ne 0 ]; then if type diffoscope >/dev/null; then diffoscope /tmp/dev1.tar /tmp/dev2.tar exit 1 else echo "no diffoscope installed" >&2 fi if type base64 >/dev/null; then base64 /tmp/dev1.tar base64 /tmp/dev2.tar exit 1 else echo "no base64 installed" >&2 fi if type xxd >/dev/null; then xxd /tmp/dev1.tar xxd /tmp/dev2.tar exit 1 else echo "no xxd installed" >&2 fi exit 1 fi rm /tmp/dev1.tar /tmp/dev2.tar rm -r /tmp/debian-{{ DIST }}-debootstrap/dev /tmp/debian-{{ DIST }}-mm/dev # remove downloaded deb packages rm /tmp/debian-{{ DIST }}-debootstrap/var/cache/apt/archives/*.deb # remove aux-cache rm /tmp/debian-{{ DIST }}-debootstrap/var/cache/ldconfig/aux-cache # remove logs rm /tmp/debian-{{ DIST }}-debootstrap/var/log/dpkg.log \ /tmp/debian-{{ DIST }}-debootstrap/var/log/bootstrap.log \ /tmp/debian-{{ DIST }}-debootstrap/var/log/alternatives.log # remove *-old files rm /tmp/debian-{{ DIST }}-debootstrap/var/cache/debconf/config.dat-old \ /tmp/debian-{{ DIST }}-mm/var/cache/debconf/config.dat-old rm /tmp/debian-{{ DIST }}-debootstrap/var/cache/debconf/templates.dat-old \ /tmp/debian-{{ DIST }}-mm/var/cache/debconf/templates.dat-old rm /tmp/debian-{{ DIST }}-debootstrap/var/lib/dpkg/status-old \ /tmp/debian-{{ DIST }}-mm/var/lib/dpkg/status-old rm -f /tmp/debian-{{ DIST }}-debootstrap/var/lib/dpkg/diversions-old \ /tmp/debian-{{ DIST }}-mm/var/lib/dpkg/diversions-old # remove dpkg files rm /tmp/debian-{{ DIST }}-debootstrap/var/lib/dpkg/available rm /tmp/debian-{{ DIST }}-debootstrap/var/lib/dpkg/cmethopt # remove /var/lib/dpkg/arch rm /tmp/debian-{{ DIST }}-mm/var/lib/dpkg/arch # since we installed packages directly from the .deb files, Priorities differ # thus we first check for equality and then remove the files chroot /tmp/debian-{{ DIST }}-debootstrap dpkg --list >/tmp/dpkg1 chroot /tmp/debian-{{ DIST }}-mm dpkg --list >/tmp/dpkg2 diff -u /tmp/dpkg1 /tmp/dpkg2 >&2 rm /tmp/dpkg1 /tmp/dpkg2 grep -v '^Priority: ' /tmp/debian-{{ DIST }}-debootstrap/var/lib/dpkg/status >/tmp/status1 grep -v '^Priority: ' /tmp/debian-{{ DIST }}-mm/var/lib/dpkg/status >/tmp/status2 diff -u /tmp/status1 /tmp/status2 >&2 rm /tmp/status1 /tmp/status2 rm /tmp/debian-{{ DIST }}-debootstrap/var/lib/dpkg/status /tmp/debian-{{ DIST }}-mm/var/lib/dpkg/status # debootstrap exposes the hosts's kernel version if [ -e /tmp/debian-{{ DIST }}-debootstrap/etc/apt/apt.conf.d/01autoremove-kernels ]; then rm /tmp/debian-{{ DIST }}-debootstrap/etc/apt/apt.conf.d/01autoremove-kernels fi if [ -e /tmp/debian-{{ DIST }}-mm/etc/apt/apt.conf.d/01autoremove-kernels ]; then rm /tmp/debian-{{ DIST }}-mm/etc/apt/apt.conf.d/01autoremove-kernels fi # clear out /run except for /run/lock find /tmp/debian-{{ DIST }}-debootstrap/run/ -mindepth 1 -maxdepth 1 ! -name lock -print0 | xargs --no-run-if-empty -0 rm -r # debootstrap doesn't clean apt rm /tmp/debian-{{ DIST }}-debootstrap/var/lib/apt/lists/127.0.0.1_debian_dists_{{ DIST }}_main_binary-{{ HOSTARCH }}_Packages \ /tmp/debian-{{ DIST }}-debootstrap/var/lib/apt/lists/127.0.0.1_debian_dists_{{ DIST }}_InRelease \ /tmp/debian-{{ DIST }}-debootstrap/var/lib/apt/lists/127.0.0.1_debian_dists_{{ DIST }}_Release \ /tmp/debian-{{ DIST }}-debootstrap/var/lib/apt/lists/127.0.0.1_debian_dists_{{ DIST }}_Release.gpg if [ "{{ VARIANT }}" = "-" ]; then rm /tmp/debian-{{ DIST }}-debootstrap/etc/machine-id rm /tmp/debian-{{ DIST }}-mm/etc/machine-id rm /tmp/debian-{{ DIST }}-debootstrap/var/lib/systemd/catalog/database rm /tmp/debian-{{ DIST }}-mm/var/lib/systemd/catalog/database cap=$(chroot /tmp/debian-{{ DIST }}-debootstrap /sbin/getcap /bin/ping) expected="/bin/ping cap_net_raw=ep" if [ "$cap" != "$expected" ]; then echo "expected bin/ping to have capabilities $expected" >&2 echo "but debootstrap produced: $cap" >&2 exit 1 fi cap=$(chroot /tmp/debian-{{ DIST }}-mm /sbin/getcap /bin/ping) if [ "$cap" != "$expected" ]; then echo "expected bin/ping to have capabilities $expected" >&2 echo "but mmdebstrap produced: $cap" >&2 exit 1 fi fi rm /tmp/debian-{{ DIST }}-mm/var/cache/apt/archives/lock rm /tmp/debian-{{ DIST }}-mm/var/lib/apt/extended_states rm /tmp/debian-{{ DIST }}-mm/var/lib/apt/lists/lock # the list of shells might be sorted wrongly # /var/lib/dpkg/triggers/File might be sorted wrongly for f in "/var/lib/dpkg/triggers/File" "/etc/shells"; do f1="/tmp/debian-{{ DIST }}-debootstrap/$f" f2="/tmp/debian-{{ DIST }}-mm/$f" # both chroots must have the file if [ ! -e "$f1" ] || [ ! -e "$f2" ]; then continue fi # the file must be different if cmp "$f1" "$f2" >&2; then continue fi # then sort both sort -o "$f1" "$f1" sort -o "$f2" "$f2" done # Because of unreproducible uids (#969631) we created the _apt user ourselves # and because passwd is not Essential:yes we didn't use useradd. But newer # versions of adduser and shadow will create a different /etc/shadow if [ "{{ VARIANT }}" = "-" ] && [ "{{ DIST}}" = oldstable ]; then for f in shadow shadow-; do if grep -q '^_apt:!:' /tmp/debian-{{ DIST }}-debootstrap/etc/$f; then sed -i 's/^_apt:\*:\([^:]\+\):0:99999:7:::$/_apt:!:\1::::::/' /tmp/debian-{{ DIST }}-mm/etc/$f fi done fi for log in faillog lastlog; do f1="/tmp/debian-{{ DIST }}-debootstrap/var/log/$log" f2="/tmp/debian-{{ DIST }}-mm/var/log/$log" # skip cmp if file is absent in both chroots if [ ! -e "$f1" ] && [ ! -e "$f2" ]; then continue fi if ! cmp "$f1" "$f2" >&2; then # if the files differ, make sure they are all zeroes cmp -n "$(stat -c %s "$f1")" "$f1" /dev/zero >&2 cmp -n "$(stat -c %s "$f2")" "$f2" /dev/zero >&2 # then delete them rm "$f1" "$f2" fi done if [ "{{ VARIANT }}" = "-" ]; then # the order in which systemd and cron get installed differ and thus the order # of lines in /etc/group and /etc/gshadow differs for f in group group- gshadow gshadow-; do for d in mm debootstrap; do sort /tmp/debian-{{ DIST }}-$d/etc/$f >/tmp/debian-{{ DIST }}-$d/etc/$f.bak mv /tmp/debian-{{ DIST }}-$d/etc/$f.bak /tmp/debian-{{ DIST }}-$d/etc/$f done done # the order in which systemd and passwd get installed differ and thus # the order of lines in /etc/shadow and /etc/shadow- differs for f in shadow shadow-; do for d in mm debootstrap; do sort /tmp/debian-{{ DIST }}-$d/etc/$f >/tmp/debian-{{ DIST }}-$d/etc/$f.bak mv /tmp/debian-{{ DIST }}-$d/etc/$f.bak /tmp/debian-{{ DIST }}-$d/etc/$f done done # and since the order was different, ignore the *- files for f in shadow- passwd-; do for d in mm debootstrap; do rm /tmp/debian-{{ DIST }}-$d/etc/$f done done fi # since debootstrap 1.0.133 there is no tzdata in the buildd variant and thus # debootstrap creates its own /etc/localtime if [ "{{ VARIANT }}" = "buildd" ] && [ "{{ DIST }}" != "stable" ] && [ "{{ DIST }}" != "oldstable" ]; then [ "$(readlink /tmp/debian-{{ DIST }}-debootstrap/etc/localtime)" = /usr/share/zoneinfo/UTC ] rm /tmp/debian-{{ DIST }}-debootstrap/etc/localtime fi # starting with systemd 255 upstream dropped splitusr support and depending on # the installation order, symlink targets are prefixed with /usr or not # See #1060000 and #1054137 case {{ DIST }} in testing | unstable) for f in multi-user.target.wants/e2scrub_reap.service timers.target.wants/apt-daily-upgrade.timer timers.target.wants/apt-daily.timer timers.target.wants/e2scrub_all.timer; do for d in mm debootstrap; do [ -L "/tmp/debian-{{ DIST }}-$d/etc/systemd/system/$f" ] || continue oldlink="$(readlink "/tmp/debian-{{ DIST }}-$d/etc/systemd/system/$f")" case $oldlink in /usr/*) : ;; /*) oldlink="/usr$oldlink" ;; *) echo unexpected >&2 exit 1 ;; esac ln -sf "$oldlink" "/tmp/debian-{{ DIST }}-$d/etc/systemd/system/$f" done done ;; esac # check if the file content differs diff --unified --no-dereference --recursive /tmp/debian-{{ DIST }}-debootstrap /tmp/debian-{{ DIST }}-mm >&2 # check permissions, ownership, symlink targets, modification times using tar # directory mtimes will differ, thus we equalize them first find /tmp/debian-{{ DIST }}-debootstrap /tmp/debian-{{ DIST }}-mm -type d -print0 | xargs -0 touch --date="@{{ SOURCE_DATE_EPOCH }}" # debootstrap never ran apt -- fixing permissions for d in ./var/lib/apt/lists/partial ./var/cache/apt/archives/partial; do unmergedPATH="$PATH$(if [ "{{ DIST }}" = oldstable ]; then echo :/bin:/sbin; fi)" PATH="$unmergedPATH" chroot /tmp/debian-{{ DIST }}-debootstrap chmod 0700 $d PATH="$unmergedPATH" chroot /tmp/debian-{{ DIST }}-debootstrap chown "$(id -u _apt):root" $d done tar -C /tmp/debian-{{ DIST }}-debootstrap --numeric-owner --sort=name --clamp-mtime --mtime="$(date --utc --date=@{{ SOURCE_DATE_EPOCH }} --iso-8601=seconds)" -cf /tmp/root1.tar . tar -C /tmp/debian-{{ DIST }}-mm --numeric-owner --sort=name --clamp-mtime --mtime="$(date --utc --date=@{{ SOURCE_DATE_EPOCH }} --iso-8601=seconds)" -cf /tmp/root2.tar . tar --full-time --verbose -tf /tmp/root1.tar >/tmp/root1.tar.list tar --full-time --verbose -tf /tmp/root2.tar >/tmp/root2.tar.list diff -u /tmp/root1.tar.list /tmp/root2.tar.list >&2 rm /tmp/root1.tar /tmp/root2.tar /tmp/root1.tar.list /tmp/root2.tar.list # check if file properties (permissions, ownership, symlink names, modification time) differ # # we cannot use this (yet) because it cannot cope with paths that have [ or @ in them #fmtree -c -p /tmp/debian-{{ DIST }}-debootstrap -k flags,gid,link,mode,size,time,uid | sudo fmtree -p /tmp/debian-{{ DIST }}-mm rm -r /tmp/debian-{{ DIST }}-debootstrap /tmp/debian-{{ DIST }}-mm