particle-os/debian-forge-composer
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

distro: allow user and group customizations for iot-installer

Browse source
This commit is contained in:
Jordi Gil 2022-04-13 11:09:48 -04:00 • committed by Tomáš Hozza
parent 6c11c27c48
commit 00a84d1fdc
14 changed files with 111395 additions and 121 deletions
Download patch file Download diff file Expand all files Collapse all files

7
internal/distro/fedora/distro.go
View file

@ -772,8 +772,11 @@ func (t *imageType) checkOptions(customizations *blueprint.Customizations, optio
return fmt.Errorf("boot ISO image type %q requires specifying a URL from which to retrieve the OSTree commit", t.name)
}
if customizations != nil {
return fmt.Errorf("boot ISO image type %q does not support blueprint customizations", t.name)
if t.name == "iot-installer" || t.name == "fedora-iot-installer" {
allowed := []string{"User", "Group"}
if err := customizations.CheckAllowed(allowed...); err != nil {
return fmt.Errorf("unsupported blueprint customizations found for boot ISO image type %q: (allowed: %s)", t.name, strings.Join(allowed, ", "))
}
}
}

75
internal/distro/fedora/pipelines.go
View file

@ -171,8 +171,12 @@ func iotInstallerPipelines(t *imageType, customizations *blueprint.Customization
kernelVer := rpmmd.GetVerStrFromPackageSpecListPanic(installerPackages, "kernel")
ostreeRepoPath := "/ostree/repo"
payloadStages := ostreePayloadStages(options, ostreeRepoPath)
kickstartOptions := ostreeKickstartStageOptions(makeISORootPath(ostreeRepoPath), options.OSTree.Ref)
pipelines = append(pipelines, *anacondaTreePipeline(repos, installerPackages, kernelVer, archName, d.product, d.osVersion, "iot"))
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, "", customizations.GetUsers(), customizations.GetGroups(), makeISORootPath(ostreeRepoPath), options.OSTree.Ref, "fedora")
if err != nil {
return nil, err
}
ksUsers := len(customizations.GetUsers())+len(customizations.GetGroups()) > 0
pipelines = append(pipelines, *anacondaTreePipeline(repos, installerPackages, kernelVer, archName, d.product, d.osVersion, "iot", ksUsers))
isolabel := fmt.Sprintf(d.isolabelTmpl, archName)
pipelines = append(pipelines, *bootISOTreePipeline(kernelVer, archName, d.vendor, d.product, d.osVersion, isolabel, kickstartOptions, payloadStages))
pipelines = append(pipelines, *bootISOPipeline(t.Filename(), d.isolabelTmpl, archName, false))
@ -225,7 +229,7 @@ func buildPipeline(repos []rpmmd.RepoConfig, buildPackageSpecs []rpmmd.PackageSp
p := new(osbuild.Pipeline)
p.Name = "build"
p.Runner = runner
p.AddStage(osbuild.NewRPMStage(rpmStageOptions(repos), osbuild.NewRpmStageSourceFilesInputs(buildPackageSpecs)))
p.AddStage(osbuild.NewRPMStage(osbuild.NewRPMStageOptions(repos), osbuild.NewRpmStageSourceFilesInputs(buildPackageSpecs)))
p.AddStage(osbuild.NewSELinuxStage(selinuxStageOptions(true)))
return p
}
@ -251,7 +255,8 @@ func osPipeline(t *imageType,
p.AddStage(osbuild.NewOSTreePasswdStage("org.osbuild.source", options.OSTree.Parent))
}
rpmOptions := rpmStageOptions(repos)
rpmOptions := osbuild.NewRPMStageOptions(repos)
rpmOptions.GPGKeysFromTree = imageConfig.GPGKeyFiles
p.AddStage(osbuild.NewRPMStage(rpmOptions, osbuild.NewRpmStageSourceFilesInputs(packages)))
// If the /boot is on a separate partition, the prefix for the BLS stage must be ""
@ -292,37 +297,29 @@ func osPipeline(t *imageType,
p.AddStage(osbuild.NewChronyStage(imageConfig.TimeSynchronization))
}
if groups := c.GetGroups(); len(groups) > 0 {
p.AddStage(osbuild.NewGroupsStage(osbuild.NewGroupsStageOptions(groups)))
}
if users := c.GetUsers(); len(users) > 0 {
userOptions, err := userStageOptions(users)
if err != nil {
return nil, err
if !t.bootISO {
// don't put users and groups in the payload of an installer
// add them via kickstart instead
if groups := c.GetGroups(); len(groups) > 0 {
p.AddStage(osbuild.NewGroupsStage(osbuild.NewGroupsStageOptions(groups)))
}
if t.rpmOstree {
// for ostree, writing the key during user creation is redundant
// and can cause issues so create users without keys and write them
// on first boot
userOptionsSansKeys := new(osbuild.UsersStageOptions)
userOptionsSansKeys.Users = make(map[string]osbuild.UsersStageOptionsUser, len(userOptions.Users))
for name, options := range userOptions.Users {
userOptionsSansKeys.Users[name] = osbuild.UsersStageOptionsUser{
UID: options.UID,
GID: options.GID,
Groups: options.Groups,
Description: options.Description,
Home: options.Home,
Shell: options.Shell,
Password: options.Password,
Key: nil,
if userOptions, err := osbuild.NewUsersStageOptions(c.GetUsers(), false); err != nil {
return nil, err
} else if userOptions != nil {
if t.rpmOstree {
// for ostree, writing the key during user creation is
// redundant and can cause issues so create users without keys
// and write them on first boot
userOptionsSansKeys, err := osbuild.NewUsersStageOptions(c.GetUsers(), true)
if err != nil {
return nil, err
}
p.AddStage(osbuild.NewUsersStage(userOptionsSansKeys))
p.AddStage(osbuild.NewFirstBootStage(usersFirstBootOptions(userOptions)))
} else {
p.AddStage(osbuild.NewUsersStage(userOptions))
}
p.AddStage(osbuild.NewUsersStage(userOptionsSansKeys))
p.AddStage(osbuild.NewFirstBootStage(usersFirstBootOptions(userOptions)))
} else {
p.AddStage(osbuild.NewUsersStage(userOptions))
}
}
@ -423,7 +420,11 @@ func osPipeline(t *imageType,
if cfg := imageConfig.Grub2Config; cfg != nil {
if grub2, ok := bootloader.Options.(*osbuild.GRUB2StageOptions); ok {
grub2.Config = cfg
// grub2.Config.Default is owned and set by `NewGrub2StageOptionsUnified`
// and thus we need to preserve it
if grub2.Config != nil {
cfg.Default = grub2.Config.Default
}
}
}
@ -478,7 +479,7 @@ func containerTreePipeline(repos []rpmmd.RepoConfig, packages []rpmmd.PackageSpe
p := new(osbuild.Pipeline)
p.Name = "container-tree"
p.Build = "name:build"
p.AddStage(osbuild.NewRPMStage(rpmStageOptions(repos), osbuild.NewRpmStageSourceFilesInputs(packages)))
p.AddStage(osbuild.NewRPMStage(osbuild.NewRPMStageOptions(repos), osbuild.NewRpmStageSourceFilesInputs(packages)))
language, _ := c.GetPrimaryLocale()
if language != nil {
p.AddStage(osbuild.NewLocaleStage(&osbuild.LocaleStageOptions{Language: *language}))
@ -538,11 +539,11 @@ func ostreePayloadStages(options distro.ImageOptions, ostreeRepoPath string) []*
return stages
}
func anacondaTreePipeline(repos []rpmmd.RepoConfig, packages []rpmmd.PackageSpec, kernelVer, arch, product, osVersion, variant string) *osbuild.Pipeline {
func anacondaTreePipeline(repos []rpmmd.RepoConfig, packages []rpmmd.PackageSpec, kernelVer, arch, product, osVersion, variant string, users bool) *osbuild.Pipeline {
p := new(osbuild.Pipeline)
p.Name = "anaconda-tree"
p.Build = "name:build"
p.AddStage(osbuild.NewRPMStage(rpmStageOptions(repos), osbuild.NewRpmStageSourceFilesInputs(packages)))
p.AddStage(osbuild.NewRPMStage(osbuild.NewRPMStageOptions(repos), osbuild.NewRpmStageSourceFilesInputs(packages)))
p.AddStage(osbuild.NewBuildstampStage(buildStampStageOptions(arch, product, osVersion, variant)))
p.AddStage(osbuild.NewLocaleStage(&osbuild.LocaleStageOptions{Language: "en_US.UTF-8"}))
@ -571,7 +572,7 @@ func anacondaTreePipeline(repos []rpmmd.RepoConfig, packages []rpmmd.PackageSpec
}
p.AddStage(osbuild.NewUsersStage(usersStageOptions))
p.AddStage(osbuild.NewAnacondaStage(anacondaStageOptions()))
p.AddStage(osbuild.NewAnacondaStage(osbuild.NewAnacondaStageOptions(users)))
p.AddStage(osbuild.NewLoraxScriptStage(loraxScriptStageOptions(arch)))
p.AddStage(osbuild.NewDracutStage(dracutStageOptions(kernelVer, arch, []string{
"anaconda",

71
internal/distro/fedora/stage_options.go
View file

@ -6,30 +6,14 @@ import (
"github.com/osbuild/osbuild-composer/internal/blueprint"
"github.com/osbuild/osbuild-composer/internal/common"
"github.com/osbuild/osbuild-composer/internal/crypt"
"github.com/osbuild/osbuild-composer/internal/distro"
osbuild "github.com/osbuild/osbuild-composer/internal/osbuild2"
"github.com/osbuild/osbuild-composer/internal/rpmmd"
)
const (
kspath = "/osbuild.ks"
)
func rpmStageOptions(repos []rpmmd.RepoConfig) *osbuild.RPMStageOptions {
var gpgKeys []string
for _, repo := range repos {
if repo.GPGKey == "" {
continue
}
gpgKeys = append(gpgKeys, repo.GPGKey)
}
return &osbuild.RPMStageOptions{
GPGKeys: gpgKeys,
}
}
// selinuxStageOptions returns the options for the org.osbuild.selinux stage.
// Setting the argument to 'true' relabels the '/usr/bin/cp'
// binariy with 'install_exec_t'. This should be set in the build root.
@ -45,39 +29,6 @@ func selinuxStageOptions(labelcp bool) *osbuild.SELinuxStageOptions {
return options
}
func userStageOptions(users []blueprint.UserCustomization) (*osbuild.UsersStageOptions, error) {
options := osbuild.UsersStageOptions{
Users: make(map[string]osbuild.UsersStageOptionsUser),
}
for _, c := range users {
if c.Password != nil && !crypt.PasswordIsCrypted(*c.Password) {
cryptedPassword, err := crypt.CryptSHA512(*c.Password)
if err != nil {
return nil, err
}
c.Password = &cryptedPassword
}
user := osbuild.UsersStageOptionsUser{
Groups: c.Groups,
Description: c.Description,
Home: c.Home,
Shell: c.Shell,
Password: c.Password,
Key: c.Key,
}
user.UID = c.UID
user.GID = c.GID
options.Users[c.Name] = user
}
return &options, nil
}
func usersFirstBootOptions(usersStageOptions *osbuild.UsersStageOptions) *osbuild.FirstBootStageOptions {
cmds := make([]string, 0, 3*len(usersStageOptions.Users)+2)
// workaround for creating authorized_keys file for user
@ -148,16 +99,6 @@ func buildStampStageOptions(arch, product, osVersion, variant string) *osbuild.B
}
}
func anacondaStageOptions() *osbuild.AnacondaStageOptions {
return &osbuild.AnacondaStageOptions{
KickstartModules: []string{
"org.fedoraproject.Anaconda.Modules.Network",
"org.fedoraproject.Anaconda.Modules.Payloads",
"org.fedoraproject.Anaconda.Modules.Storage",
},
}
}
func loraxScriptStageOptions(arch string) *osbuild.LoraxScriptStageOptions {
return &osbuild.LoraxScriptStageOptions{
Path: "99-generic/runtime-postinstall.tmpl",
@ -219,18 +160,6 @@ func dracutStageOptions(kernelVer, arch string, additionalModules []string) *osb
}
}
func ostreeKickstartStageOptions(ostreeURL, ostreeRef string) *osbuild.KickstartStageOptions {
return &osbuild.KickstartStageOptions{
Path: kspath,
OSTree: &osbuild.OSTreeOptions{
OSName: "fedora",
URL: ostreeURL,
Ref: ostreeRef,
GPG: false,
},
}
}
func bootISOMonoStageOptions(kernelVer, arch, vendor, product, osVersion, isolabel string) *osbuild.BootISOMonoStageOptions {
comprOptions := new(osbuild.FSCompressionOptions)
if bcj := osbuild.BCJOption(arch); bcj != "" {

2
internal/distro/rhel84/distro_v2.go
View file

@ -466,7 +466,7 @@ func (t *imageTypeS2) anacondaTreePipeline(repos []rpmmd.RepoConfig, customizati
p.AddStage(osbuild.NewAnacondaStage(osbuild.NewAnacondaStageOptions(nUsers)))
p.AddStage(osbuild.NewLoraxScriptStage(t.loraxScriptStageOptions()))
p.AddStage(osbuild.NewDracutStage(t.dracutStageOptions(kernelVer)))
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, "", customizations.GetUsers(), customizations.GetGroups(), fmt.Sprintf("file://%s", ostreeRepoPath), options.OSTree.Ref)
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, "", customizations.GetUsers(), customizations.GetGroups(), fmt.Sprintf("file://%s", ostreeRepoPath), options.OSTree.Ref, "rhel")
if err != nil {
return nil, err
}

4
internal/distro/rhel85/pipelines.go
View file

@ -920,7 +920,7 @@ func edgeInstallerPipelines(t *imageType, customizations *blueprint.Customizatio
kernelVer := rpmmd.GetVerStrFromPackageSpecListPanic(installerPackages, "kernel")
ostreeRepoPath := "/ostree/repo"
payloadStages := ostreePayloadStages(options, ostreeRepoPath)
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, "", customizations.GetUsers(), customizations.GetGroups(), makeISORootPath(ostreeRepoPath), options.OSTree.Ref)
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, "", customizations.GetUsers(), customizations.GetGroups(), makeISORootPath(ostreeRepoPath), options.OSTree.Ref, "rhel")
if err != nil {
return nil, err
}
@ -959,7 +959,7 @@ func imageInstallerPipelines(t *imageType, customizations *blueprint.Customizati
tarPath := "/liveimg.tar"
tarPayloadStages := []*osbuild.Stage{osbuild.NewTarStage(&osbuild.TarStageOptions{Filename: tarPath}, osbuild.NewTarStagePipelineTreeInputs(treePipeline.Name))}
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, makeISORootPath(tarPath), customizations.GetUsers(), customizations.GetGroups(), "", "")
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, makeISORootPath(tarPath), customizations.GetUsers(), customizations.GetGroups(), "", "", "rhel")
if err != nil {
return nil, err
}

4
internal/distro/rhel86/pipelines.go
View file

@ -242,7 +242,7 @@ func edgeInstallerPipelines(t *imageType, customizations *blueprint.Customizatio
kernelVer := rpmmd.GetVerStrFromPackageSpecListPanic(installerPackages, "kernel")
ostreeRepoPath := "/ostree/repo"
payloadStages := ostreePayloadStages(options, ostreeRepoPath)
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, "", customizations.GetUsers(), customizations.GetGroups(), makeISORootPath(ostreeRepoPath), options.OSTree.Ref)
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, "", customizations.GetUsers(), customizations.GetGroups(), makeISORootPath(ostreeRepoPath), options.OSTree.Ref, "rhel")
if err != nil {
return nil, err
}
@ -281,7 +281,7 @@ func imageInstallerPipelines(t *imageType, customizations *blueprint.Customizati
tarPath := "/liveimg.tar"
tarPayloadStages := []*osbuild.Stage{osbuild.NewTarStage(&osbuild.TarStageOptions{Filename: tarPath}, osbuild.NewTarStagePipelineTreeInputs(treePipeline.Name))}
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, makeISORootPath(tarPath), customizations.GetUsers(), customizations.GetGroups(), "", "")
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, makeISORootPath(tarPath), customizations.GetUsers(), customizations.GetGroups(), "", "", "rhel")
if err != nil {
return nil, err
}

4
internal/distro/rhel90/pipelines.go
View file

@ -234,7 +234,7 @@ func edgeInstallerPipelines(t *imageType, customizations *blueprint.Customizatio
kernelVer := rpmmd.GetVerStrFromPackageSpecListPanic(installerPackages, "kernel")
ostreeRepoPath := "/ostree/repo"
payloadStages := ostreePayloadStages(options, ostreeRepoPath)
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, "", customizations.GetUsers(), customizations.GetGroups(), makeISORootPath(ostreeRepoPath), options.OSTree.Ref)
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, "", customizations.GetUsers(), customizations.GetGroups(), makeISORootPath(ostreeRepoPath), options.OSTree.Ref, "rhel")
if err != nil {
return nil, err
}
@ -273,7 +273,7 @@ func imageInstallerPipelines(t *imageType, customizations *blueprint.Customizati
tarPath := "/liveimg.tar"
tarPayloadStages := []*osbuild.Stage{osbuild.NewTarStage(&osbuild.TarStageOptions{Filename: tarPath}, osbuild.NewTarStagePipelineTreeInputs(treePipeline.Name))}
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, makeISORootPath(tarPath), customizations.GetUsers(), customizations.GetGroups(), "", "")
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, makeISORootPath(tarPath), customizations.GetUsers(), customizations.GetGroups(), "", "", "rhel")
if err != nil {
return nil, err
}

4
internal/distro/rhel90beta/pipelines.go
View file

@ -626,7 +626,7 @@ func edgeInstallerPipelines(t *imageType, customizations *blueprint.Customizatio
ksUsers := len(customizations.GetUsers())+len(customizations.GetGroups()) > 0
pipelines = append(pipelines, *anacondaTreePipeline(repos, installerPackages, kernelVer, t.Arch().Name(), ostreePayloadStages(options, ostreeRepoPath), ksUsers))
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, "", customizations.GetUsers(), customizations.GetGroups(), fmt.Sprintf("file://%s", ostreeRepoPath), options.OSTree.Ref)
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, "", customizations.GetUsers(), customizations.GetGroups(), fmt.Sprintf("file://%s", ostreeRepoPath), options.OSTree.Ref, "rhel")
if err != nil {
return nil, err
}
@ -664,7 +664,7 @@ func imageInstallerPipelines(t *imageType, customizations *blueprint.Customizati
tarPath := "/liveimg.tar"
tarPayloadStages := []*osbuild.Stage{tarStage("os", tarPath)}
pipelines = append(pipelines, *anacondaTreePipeline(repos, installerPackages, kernelVer, t.Arch().Name(), tarPayloadStages, true))
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, fmt.Sprintf("file://%s", tarPath), customizations.GetUsers(), customizations.GetGroups(), "", "")
kickstartOptions, err := osbuild.NewKickstartStageOptions(kspath, fmt.Sprintf("file://%s", tarPath), customizations.GetUsers(), customizations.GetGroups(), "", "", "rhel")
if err != nil {
return nil, err
}

5
internal/osbuild2/kickstart_stage.go
View file

@ -44,7 +44,8 @@ func NewKickstartStageOptions(
userCustomizations []blueprint.UserCustomization,
groupCustomizations []blueprint.GroupCustomization,
ostreeURL string,
ostreeRef string) (*KickstartStageOptions, error) {
ostreeRef string,
osName string) (*KickstartStageOptions, error) {
var users map[string]UsersStageOptionsUser
if usersOptions, err := NewUsersStageOptions(userCustomizations, false); err != nil {
@ -61,7 +62,7 @@ func NewKickstartStageOptions(
var ostreeOptions *OSTreeOptions
if ostreeURL != "" {
ostreeOptions = &OSTreeOptions{
OSName: "rhel",
OSName: osName,
URL: ostreeURL,
Ref: ostreeRef,
GPG: false,

27099
test/data/manifests/fedora_34-aarch64-fedora_iot_installer_with_users-boot.json Normal file
View file

File diff suppressed because it is too large Load diff

27625
test/data/manifests/fedora_34-x86_64-fedora_iot_installer_with_users-boot.json Normal file
View file

File diff suppressed because it is too large Load diff

28022
test/data/manifests/fedora_35-aarch64-fedora_iot_installer_with_users-boot.json Normal file
View file

File diff suppressed because it is too large Load diff

28548
test/data/manifests/fedora_35-x86_64-fedora_iot_installer_with_users-boot.json Normal file
View file

File diff suppressed because it is too large Load diff

46
tools/test-case-generators/format-request-map.json
View file

@ -292,6 +292,52 @@
"no-image-info": true,
"overrides": {}
},
"fedora-iot-installer-with-users": {
"compose-request": {
"distro": "",
"arch": "",
"image-type": "fedora-iot-installer",
"repositories": [],
"filename": "installer.iso",
"ostree": {
"ref": "test/iot",
"url": "http://iot.example.com/repo",
"parent": "test/iot"
},
"blueprint": {
"name": "iot-installer-users",
"customizations": {
"user": [
{
"name": "user2",
"description": "description 2",
"password": "$6$BhyxFBgrEFh0VrPJ$MllG8auiU26x2pmzL4.1maHzPHrA.4gTdCvlATFp8HJU9UPee4zCS9BVl2HOzKaUYD/zEm8r/OF05F2icWB0K/",
"key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC61wMCjOSHwbVb4VfVyl5sn497qW4PsdQ7Ty7aD6wDNZ/QjjULkDV/yW5WjDlDQ7UqFH0Sr7vywjqDizUAqK7zM5FsUKsUXWHWwg/ehKg8j9xKcMv11AkFoUoujtfAujnKODkk58XSA9whPr7qcw3vPrmog680pnMSzf9LC7J6kXfs6lkoKfBh9VnlxusCrw2yg0qI1fHAZBLPx7mW6+me71QZsS6sVz8v8KXyrXsKTdnF50FjzHcK9HXDBtSJS5wA3fkcRYymJe0o6WMWNdgSRVpoSiWaHHmFgdMUJaYoCfhXzyl7LtNb3Q+Sveg+tJK7JaRXBLMUllOlJ6ll5Hod root@localhost",
"home": "/home/home2",
"shell": "/bin/sh",
"groups": [
"group1"
],
"uid": 1020,
"gid": 1050
}
],
"group": [
{
"name": "group1",
"gid": 1030
},
{
"name": "group2",
"gid": 1050
}
]
}
}
},
"no-image-info": true,
"overrides": {}
},
"openstack": {
"boot": {
"type": "openstack"