Commit Graph

239 Commits

Author SHA1 Message Date
Brian C. Lane
1b84f90963 lifted directories should be under share_dir and lib_dir
Otherwise passing --sharedir pointed to some other path will not use the
correct providers.
2019-10-16 09:17:53 -07:00
Evan Goode
2692e8138c Automatically upload composed images to the cloud
Currently, Azure, vSphere, and OpenStack are supported. See
https://github.com/weldr/lorax/pull/826 for more details about this new
feature.

I've called the upload library "lifted" as a reference to Seuss'
The Lorax -- in the book, the Lorax lifts himself up by the seat of his
pants through a hole in the smog clouds, and they start calling him the
"Lifted Lorax."

This adds new features to the /compose route under API v1
2019-10-16 09:17:53 -07:00
Pat Riehecky
2c141950b0 lorax: Add debug log of command line options 2019-07-09 17:22:27 -07:00
Pat Riehecky
1f811523b5 lorax: provide runtime lorax config in debug log 2019-07-09 17:20:39 -07:00
David Shea
c941b82b0c Add a new output type, tar-disk.
This option will create an optionally compressed tarball containing a
disk image. This format is used by Google's Compute Engine.

This also adds a new option, tar_disk_name, to set the name of the disk
image that will be wrapped in the final tarball. opts.image_name
continues to be the final output file name.
2019-04-02 10:15:42 -04:00
Brian C. Lane
6c6e4fced1 Switch the --virt-uefi method to use SecureBoot
This updates the qemu arguments so that it will actually work, and
switches to using SecureBoot OVMF firmware.
2019-03-26 13:32:12 -07:00
Chris Lumens
022e9eba3e Run as root/weldr by default.
We need to be root to read the certificates that give access to the
package repos.  Right now, the alternative seems to be changing
permissions on the certs themselves, which seems less good.  We're
running anaconda as root anyway.
2019-02-11 16:20:39 -08:00
Brian C. Lane
e4fe1aab32 lorax: Move default tmp dir to /var/tmp/lorax
If systemd's tmpfiles.d timer is executed while lorax is running it will
remove any files and directories older than 30 days. This is what has
been causing the occasional error where /proc/ would seem to vanish
during the install.

Upstream has proposed this solution, https://github.com/systemd/systemd/pull/11482
but until that is released we need a work-around to protect the lorax
files.

This commit does several things:

* Move the default tmpdir from /var/tmp/ to /var/tmp/lorax/
* Add a lorax.conf tmpfiles.d file that prevents systemd-tmpfiles from
  removing anything under /var/tmp/lorax/
* Add an exit handler to lorax so that temporary directories are removed on
  exit or on a python traceback.
* Use flock to lock access to the tempdir while lorax is running.
* Remove any unlocked tempdirs named /var/tmp/lorax/lorax.* at startup

Note that the exit handler will not remove the tempdir if lorax is
killed with a signal -- those are being caught by dnf and prevent the
exit handler from running.

systemd-tmpfiles cannot clean up the tempdirs at boot time because they
contain files labeled as shadow_t, so we have to remove those when lorax
runs. It uses the flock to prevent removing any directories created by
parallel instances of lorax and only removes ones that are unlocked.
Worst case they will be around until the first run of lorax after a
reboot.

If you want to keep the working directory around for debugging purposes
use --workdir /var/tmp/lorax/my-workdir and it won't be removed by
lorax.
2019-01-29 13:57:12 -08:00
Brian C. Lane
fd173f7265 Add timestamps to program.log and dnf.log
In lorax, lorax-composer, and livemedia-creator.
2018-12-19 12:13:24 -08:00
Brian C. Lane
35b8957f12 Remove SELinux Permissive checks
Anaconda, Lorax, lorax-composer, and livemedia-creator can all now run
with SELinux in Enforcing mode. It does not need to be disabled and if
there are denials they should be reported as a bug.

Log the current state of SELinux when starting, update the
documentation.
2018-11-29 11:06:26 -08:00
Brian C. Lane
c11bffc357 Add --no-system-repos to lorax-composer
Running lorax-composer --no-system-repos will prevent it from copying
the dnf repositories from /etc/yum.repos.d/ into the lorax-composer repo
directory. It will *only* use repositories setup using the sources api
or written to /var/lib/lorax/composer/repos.d/

If lorax-composer has previously been run without this switch the system
repos will need to be removed from the composer/repos.d/ directory. It
would also be a good idea to remove the cached metadata in
/var/tmp/composer/

Resolves: rhbz#1650363
2018-11-26 17:05:08 -08:00
Brian C. Lane
befa3128d7 Move get_dnf_base_object into a module
This allows it to be imported by tests.
2018-10-29 13:49:54 -07:00
Marek Marczykowski-Górecki
27e611629f Add --squashfs-only option to drop inner rootfs.img layer
Make runtime directly into squashfs image. This reduces largely
unreproducible ext4 layer, but requires anaconda's dracut module
modification to properly mount the image.
2018-10-29 13:16:38 -07:00
Brian C. Lane
5409748e75 lorax: Log when SOURCE_DATE_EPOCH is used for the current time 2018-10-19 14:43:29 -07:00
Brian C. Lane
d7951e3a10 Fix directory creation for blueprints
Depending on how lorax-composer is run setting up an empty blueprints
directory can fail. So this moves checking/creation until after the
other directories are created and uses make_owned_dir to make sure
ownership is correct.
2018-10-12 11:59:32 -07:00
Brian C. Lane
65b769984b Change make_dnf_dirs to be run as root
It needs to be root in order to set the ownership and permissions on the
directories that are under /var/lib/lorax/composer/

Refactor the directory creation into a utility function, and use a umask
of 0o006 to ensure that the parent directories created do not have o+rw
set on them (makedirs behavior is different between Python 3.6 and 3.7
so umask of 0 doesn't work consistently).
2018-10-12 11:59:32 -07:00
Adam Williamson
37f264c010 Don't try to append to DNF config value that can't take it
See https://bugzilla.redhat.com/show_bug.cgi?id=1595917 and
https://github.com/rpm-software-management/dnf/pull/1200 for
more on this. Briefly, DNF before 3.0 presented this config
value as a list...and mutating it worked. DNF from 3.0 until
3.6 presented it as a list...mutating it didn't work, but also
didn't *fail*, so this has actually not been doing anything on
DNF 3.x but we haven't noticed.

In DNF 3.6 values like this are presented as tuples instead of
lists, to try and catch usages like this, and it worked! We
need to change this one.

There is an additional weirdness here. tsflags is actually, in
libdnf terms, an OptionStringListAppend option: that means that
when something tries to *set* its value, the new value is just
appended to the existing list of values. This is very weird
behaviour when you're interacting with it like this, but
happens to be quite useful, as we can just 'set' the value to
a list like this and it will actually get appended (which is
what we want), and this one syntax happens to work correctly in
DNF 2.x, 3.0 through 3.5.1, and 3.6.

Signed-off-by: Adam Williamson <awilliam@redhat.com>
2018-10-02 14:07:06 -07:00
Brian C. Lane
51c73f7570 Always update repo metadata when building an image
When the kickstart is handed off to Anaconda for building it will
download its own copy of the metadata and re-run the depsolve. So if the
dnf cache isn't current there will be a mismatch and the build will
fail to find some of the versions in final-kickstart.ks

This adds a new context to DNFLock, .lock_check, that will force a check
of the metadata. It also implements its own timeout and forces a
refresh of the metadata when that expires because the dnf expiration
doesn't always work as expected.

Resolves: rhbz#1631561
2018-10-02 13:59:42 -07:00
Adam Williamson
5c0dfb74e6 Ditch all use of pyanaconda's simpleconfig
lorax uses pyanaconda's SimpleConfigParser in three different
places (twice with a copy that's been dumped into pylorax, once
by importing it), just to do a fairly simple job: read some
values out of /etc/os-release. The only value SimpleConfigParser
is adding over Python's own ConfigParser here is to read a file
with no section headers, and to unquote the values. The cost is
either a dependency on pyanaconda, or needing to copy the whole
of simpleparser plus some other utility bits from pyanaconda
into lorax. This seems like a bad trade-off.

This changes the approach: we copy one very simple utility
function from pyanaconda (`unquote`), and do some very simple
wrapping of ConfigParser to handle reading a file without any
section headers, and returning unquoted values. This way we can
read what we need out of os-release without needing a dep on
pyanaconda or to copy lots of things from it into pylorax.

Resolves: #449
Resolves: #450

Signed-off-by: Adam Williamson <awilliam@redhat.com>
2018-08-30 16:21:09 -07:00
Brian C. Lane
4d9ef60460 Add support for DNF 3.2 module_platform_id config value
This borrows simpleconfig.py from Anaconda to make parsing os-release
easier.

It defaults to platform:el8
2018-08-29 11:04:50 -07:00
Lars Karlitski
be5d50e6f3 Set TCP listen backlog for API socket to SOMAXCONN
A value of 1 is too low for heavy users of the API, such as the weldr-web
interface.

This is also systemd's default for sockets it opens. Using lorax-composer with
socket activation already results in a backlog of SOMAXCONN connections.
2018-08-20 14:54:07 -07:00
Brian C. Lane
b1dd22afa6 Log and exit on metadata update errors at startup
A bad system repo can cause lorax-composer to fail to start. Instead of
a traceback log the error and exit.

(note that the exit still results in an OSError traceback due to part of
it running as root, this needs to be addressed in another commit).
2018-07-18 16:09:03 -07:00
Brian C. Lane
460a277d4e Check the compose templates at startup
Depsolve the packages included in the templates and report any errors
using the /api/status 'msgs' field. This should help narrow down
problems with package sources not being setup correctly.
2018-07-13 10:18:07 -07:00
Brian C. Lane
56926baaec Add the ability to enable DNF plugins for lorax
Pass --dnfplugin='*' to enable all of them.
Pass --dnfplugin='plugin-name' to enable one fo them. You can use it
multiple times to enable multiple plugins. Globs work as well.
2018-06-22 09:07:01 -07:00
Brian C. Lane
d8ce013a2b Add --dracut-arg support to lorax
Use it to override the default dracut arguments (displayed as part of
the --help output). If you want to extend the default arguments they
all need to be passed in on the cmdline as well. eg.

--dracut-arg='--xz' --dracut-arg='--install /.buildstamp' ...

Resolves: rhbz#1452220
2018-06-06 17:10:35 -07:00
Brian C. Lane
c9ca451568 gevent has deprecated .wsgi, should use .pywsgi instead
https://github.com/gevent/gevent/blob/master/doc/api/gevent.wsgi.rst
2018-06-05 14:57:21 -07:00
Brian C. Lane
48e318b391 Add support for systemd socket activation
Instead of enabling lorax-composer.service enable lorax-composer.socket
and it will start lorax-composer on first access to
/run/weldr/api.socket
2018-05-14 13:57:44 -07:00
Brian C. Lane
db67c1267a Move lorax-composer and composer-cli argument parsing into modules
This allows sphinx-argparse to document them automatically.
2018-05-14 13:00:15 -07:00
Brian C. Lane
0455a5d740 Add --proxy to lorax-composer cmdline
Overrides the [dnf] proxy setting in the config file.
2018-05-14 13:00:15 -07:00
Brian C. Lane
12cb2736ac Pass the --tmp value into run_creator and cleanup after a crash
Crashing can sometimes leave directories in /var/tmp/lmc-* so clean
those up after run_creator is finished.
2018-05-14 13:00:15 -07:00
Brian C. Lane
3c31e52b3c Add --tmp to lorax-composer and set default tempdir
It was using /tmp/ which can fill up quickly when building images.
Default to /var/tmp unless the user passes --tmp /tmp/
2018-05-14 13:00:15 -07:00
Brian C. Lane
5e0246d4a9 Add selinux check to lorax-composer
anaconda needs to have SELinux set to disabled or permissive in order to
run correctly. Check at startup and exit with an error.
2018-05-14 13:00:15 -07:00
Brian C. Lane
2fa1da0f5e Add lorax-composer and the composer kickstart templates 2018-05-14 13:00:15 -07:00
Brian C. Lane
06c227598c Move core of livemedia-creator into pylorax.creator
This moves everything except the cmdline checking into run_creator in
pylorax.creator

It also rearranges some functions to prevent import loops, and adds a
utility function to imgutils (mkfsimage_from_disk for copying a
partition into a filesystem image).
2018-05-14 13:00:14 -07:00
Brian C. Lane
89050f068d livemedia-creator: Move core functions into pylorax modules
This reduces the amount of code in livemedia-creator to the cmdline
parsing and calling of the installer functions. Moving them into other
modules will allow them to be used by other projects, like the
lorax-composer API server.
2018-05-14 13:00:14 -07:00
Brian C. Lane
dc348fac25 Check selinux state before creating output directory
This closes issue #163
2018-04-26 11:12:24 -07:00
Jiri Konecny
2f3de6060b Update default releasever to Fedora 29 (rawhide)
There was Fedora 25 which is now unsupported.
2018-03-15 12:07:34 -07:00
Yuval Turgeman
68d1f4208d LMC: Make the QEMU RNG device optional
Added a new QEMU argument '--with-rng' to specify a RNG device other
than /dev/random or "none".

Signed-off-by: Yuval Turgeman <yturgema@redhat.com>
2018-01-23 08:22:38 -08:00
Brian C. Lane
e3dcb1e329 Add version output (#1335456)
Add -V to livemedia-creator, and log the running version when lorax or
lmc is started.
2017-08-14 13:54:02 -07:00
Brian C. Lane
cc56a5b5c9 Add --noverifyssl to lorax (#1430483)
Previously lorax had no way to use repos with self-signed certificates.
This adds the --noverifyssl cmdline option which will ignore certificate
errors.

Resolves: rhbz#1430483
2017-03-08 13:27:22 -08:00
Yuval Turgeman
46277f36db Fixed NameError on result_dir when calling with --image-only
Signed-off-by: Brian C. Lane <bcl@redhat.com>
2017-01-13 13:38:33 -08:00
Pat Riehecky
7ca356845b Added option to remove packages (parallel to installpkgs) 2016-11-14 09:06:10 -08:00
Igor Gnatenko
ef5475e552 adapt to DNF 2.0 API changes
References: https://bugzilla.redhat.com/show_bug.cgi?id=1380566
Signed-off-by: Igor Gnatenko <i.gnatenko.brain@gmail.com>
2016-09-30 09:09:41 -07:00
Brian C. Lane
37d36daa9c lorax: Add --rootfs-size (#1368743)
This controls how big the root filesystem is for the squashfs used in
the boot.iso, the default is 2GiB.

Note that larger rootfs sizes will require more memory and may cause the
build to fail.
2016-08-22 17:20:48 -07:00
Friedrich Schöller
c60338464b Allow supplying a disk image for PXE live systems
Fixes that the combination of command line arguments
"--make-ostree-live" and "--disk-image" lead to a program error.
2016-08-12 13:12:54 -07:00
Brian C. Lane
748259619b Make sure cmdline config file exists (#1348304)
If the --config file doesn't exist lorax will fall back to its defaults,
which are probably not what you want. Now it will exit if it doesn't
exist.
2016-06-20 16:13:45 -07:00
Brian C. Lane
5ef7c093b1 Stop using undocumented DNF logging API
DNF doesn't want users to access base.logging anymore.

Lorax already takes over the "dnf" logger and directs it to ./dnf.log,
so it wasn't really being used.

This raises the debug level to DNF's custom DDEBUG, and sets it up so
that dnf.librepo.log and hawkey.log are next to dnf.log
2016-06-03 16:44:30 -07:00
Brian C. Lane
3485fe462c livemedia-creator: Always copy novirt logs before cleanup
Before attempting to cleanup any dangling anaconda mounts copy the
anaconda logs to their final location.

Also, catch failures to cleanup the mounts, log it, and continue trying
the other mountpoints. A cleanup failure will result in an InstallError
instead of a CalledProcessError.
2016-06-01 11:48:41 -07:00
Brian C. Lane
551b27a8fa Update lmc UEFI support to use the edk2-ovmf package
Fedora now has a edk2 package so use the OVMF code from there. This also
adds using a copy of OVMF_VARS for each boot instead of reusing the one
provided by the package.
2016-05-17 16:44:22 -07:00
Brian C. Lane
2f66212c0f livemedia-creator: Update make-pxe-live to support missing initramfs
In some cases the initramfs may not be present in /boot to save space.
Use it if present, otherwise use the kernel version to recreate the name
of it.

This also fixes problems with dracut running out of space when not using
--live-rootfs-keep-size
2016-05-05 08:22:59 -07:00