[thirdparty/systemd.git] / mkosi.build

#!/bin/sh
# SPDX-License-Identifier: LGPL-2.1-or-later
set -e

# This is a build script for OS image generation using mkosi (https://github.com/systemd/mkosi).
# Simply invoke "mkosi" in the project directory to build an OS image.

ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1:disable_coredump=0:use_madv_dontdump=1
UBSAN_OPTIONS=print_stacktrace=1:print_summary=1:halt_on_error=1

# On Fedora "ld" is (unfortunately — if you ask me) managed via
# "alternatives". Since we'd like to support building images in environments
# with only /usr/ around (e.g. mkosi's UsrOnly=1 option), we have the problem
# that /usr/bin/ld is a symlink that points to a non-existing file in
# /etc/alternative/ in this mode. Let's work around this for now by manually
# redirect "ld" to "ld.bfd", i.e. circumventing the /usr/bin/ld symlink.
if [ ! -x /usr/bin/ld ] && [ -x /usr/bin/ld.bfd ]; then
        mkdir -p "$HOME"/bin
        ln -s /usr/bin/ld.bfd "$HOME"/bin/ld
        PATH="$HOME/bin:$PATH"
fi

# If mkosi.builddir/ exists mkosi will set $BUILDDIR to it, let's then use it
# as out-of-tree build dir. Otherwise, let's make up our own builddir.
[ -z "$BUILDDIR" ] && BUILDDIR=build

# Meson uses Python 3 and requires a locale with an UTF-8 character map.
# Not running under UTF-8 makes the `ninja test` step break with a CodecError.
# So let's ensure we're running under UTF-8.
#
# If our current locale already is UTF-8, then we don't need to do anything:
if [ "$(locale charmap 2>/dev/null)" != "UTF-8" ] ; then
        # Try using C.UTF-8 locale, if available. This locale is not shipped
        # by upstream glibc, so it's not available in all distros.
        # (In particular, it's not available in Arch Linux.)
        if locale -a | grep -q -E "C.UTF-8|C.utf8"; then
                export LC_CTYPE=C.UTF-8
        # Finally, try something like en_US.UTF-8, which should be
        # available in Arch Linux, but is not present in Debian's
        # minimal image in our mkosi config.
        elif locale -a | grep -q en_US.utf8; then
                export LC_CTYPE=en_US.UTF-8
        else
                # If nothing works, fail early.
                echo "*** Could not find a valid locale that supports UTF-8. ***" >&2
                exit 1
        fi
fi

# The bpftool script shipped by Ubuntu tries to find the actual program to run via querying `uname -r` and
# using the current kernel version. This obviously doesn't work in containers. As a workaround, we override
# the ubuntu script with a symlink to the first bpftool program we can find.
for bpftool in /usr/lib/linux-tools/*/bpftool; do
        [ -x "$bpftool" ] || continue
        ln -sf "$bpftool" /usr/sbin/bpftool
        break
done

# CentOS Stream 8 includes bpftool 4.18.0 which is lower than what we need. However, they've backported the
# specific feature we need ("gen skeleton") to this version, so we replace bpftool with a script that reports
# version 5.6.0 to satisfy meson which makes bpf work on CentOS Stream 8 as well.
if [ "$(grep '^ID=' /etc/os-release)" = "ID=\"centos\"" ] && [ "$(grep '^VERSION=' /etc/os-release)" = "VERSION=\"8\"" ]; then
        cp /usr/sbin/bpftool /usr/sbin/bpftool.real
        cat >/usr/sbin/bpftool <<EOF
#!/bin/sh
if [ "\$1" = --version ]; then
        echo 5.6.0
else
        exec /usr/sbin/bpftool.real \$@
fi
EOF
        chmod +x /usr/sbin/bpftool
fi

if [ ! -f "$BUILDDIR"/build.ninja ] ; then
        sysvinit_path=$(realpath /etc/init.d)

        init_path=$(realpath /sbin/init 2>/dev/null)
        if [ -z "$init_path" ] ; then
                rootprefix=""
        else
                rootprefix=${init_path%/lib/systemd/systemd}
                rootprefix=/${rootprefix#/}
        fi

        meson "$BUILDDIR" \
                -D "sysvinit-path=$sysvinit_path" \
                -D "rootprefix=$rootprefix" \
                -D man=false \
                -D translations=false \
                -D version-tag="${VERSION_TAG}" \
                -D mode=developer \
                -D b_sanitize="${SANITIZERS:-none}" \
                -D install-tests=true \
                -D tests=unsafe \
                -D slow-tests=true \
                -D utmp=true \
                -D hibernate=true \
                -D ldconfig=true \
                -D resolve=true \
                -D efi=true \
                -D tpm=true \
                -D environment-d=true \
                -D binfmt=true \
                -D repart=true \
                -D sysupdate=true \
                -D coredump=true \
                -D pstore=true \
                -D oomd=true \
                -D logind=true \
                -D hostnamed=true \
                -D localed=true \
                -D machined=true \
                -D portabled=true \
                -D sysext=true \
                -D userdb=true \
                -D homed=true \
                -D networkd=true \
                -D timedated=true \
                -D timesyncd=true \
                -D remote=true \
                -D nss-myhostname=true \
                -D nss-mymachines=true \
                -D nss-resolve=true \
                -D nss-systemd=true \
                -D firstboot=true \
                -D randomseed=true \
                -D backlight=true \
                -D vconsole=true \
                -D quotacheck=true \
                -D sysusers=true \
                -D tmpfiles=true \
                -D importd=true \
                -D hwdb=true \
                -D rfkill=true \
                -D xdg-autostart=true \
                -D translations=true \
                -D polkit=true \
                -D acl=true \
                -D audit=true \
                -D blkid=true \
                -D fdisk=true \
                -D kmod=true  \
                -D pam=true \
                -D pwquality=true \
                -D microhttpd=true \
                -D libcryptsetup=true \
                -D libcurl=true \
                -D idn=true \
                -D libidn2=true \
                -D qrencode=true \
                -D gcrypt=true \
                -D gnutls=true \
                -D openssl=true \
                -D cryptolib=openssl \
                -D p11kit=true \
                -D libfido2=true \
                -D tpm2=true \
                -D elfutils=true \
                -D zstd=true \
                -D xkbcommon=true \
                -D pcre2=true \
                -D glib=true \
                -D dbus=true \
                -D gnu-efi=true \
                -D kernel-install=true \
                -D analyze=true \
                -D bpf-framework=true
fi

cd "$BUILDDIR"
ninja "$@"
if [ "$WITH_TESTS" = 1 ] ; then
        for id in 1 2 3; do
                getent group $id >/dev/null || echo "g testgroup$id $id -" | ./systemd-sysusers -
        done

        if [ -n "$SANITIZERS" ]; then
                export ASAN_OPTIONS="$ASAN_OPTIONS"
                export UBSAN_OPTIONS="$UBSAN_OPTIONS"
                TIMEOUT_MULTIPLIER=3
        else
                TIMEOUT_MULTIPLIER=1
        fi

        meson test --print-errorlogs --timeout-multiplier=$TIMEOUT_MULTIPLIER
fi
cd "$SRCDIR"

# Ubuntu Focal is stuck with meson 0.53.0.
if [ "$(meson -v | cut -d . -f 2)" -gt 53 ] ; then
        meson install -C "$BUILDDIR" --quiet --no-rebuild --only-changed
else
        meson install -C "$BUILDDIR" --no-rebuild --only-changed
fi

mkdir -p "$DESTDIR"/etc

cat >"$DESTDIR"/etc/issue <<EOF
\S (built from systemd tree)
Kernel \r on an \m (\l)

EOF

if [ -n "$IMAGE_ID" ] ; then
        mkdir -p "$DESTDIR"/usr/lib
        sed -n \
                -e '/^IMAGE_ID=/!p' \
                -e "\$aIMAGE_ID=$IMAGE_ID" <"/usr/lib/os-release" >"${DESTDIR}/usr/lib/os-release"

        OSRELEASEFILE="$DESTDIR"/usr/lib/os-release
else
        OSRELEASEFILE=/usr/lib/os-release
fi


if [ -n "$IMAGE_VERSION" ] ; then
        mkdir -p "$DESTDIR"/usr/lib
        sed -n \
                -e '/^IMAGE_VERSION=/!p' \
                -e "\$aIMAGE_VERSION=$IMAGE_VERSION" <$OSRELEASEFILE >"/tmp/os-release.tmp"

        cat /tmp/os-release.tmp >"$DESTDIR"/usr/lib/os-release
        rm /tmp/os-release.tmp
fi

# If $CI_BUILD is set, copy over the CI service which executes a service check
# after boot and then shuts down the machine
if [ -n "$CI_BUILD" ]; then
        mkdir -p "$DESTDIR/usr/lib/systemd/system"
        cp -v "$SRCDIR/test/mkosi-check-and-shutdown.service" "$DESTDIR/usr/lib/systemd/system/mkosi-check-and-shutdown.service"
        cp -v "$SRCDIR/test/mkosi-check-and-shutdown.sh" "$DESTDIR/usr/lib/systemd/mkosi-check-and-shutdown.sh"
        chmod +x "$DESTDIR/usr/lib/systemd/mkosi-check-and-shutdown.sh"
fi

if [ -n "$SANITIZERS" ]; then
        LD_PRELOAD=$(ldd $BUILDDIR/systemd | grep libasan.so | awk '{print $3}')

        mkdir -p "$DESTDIR/etc/systemd/system.conf.d"

        cat >"$DESTDIR/etc/systemd/system.conf.d/10-asan.conf" <<EOF
[Manager]
ManagerEnvironment=ASAN_OPTIONS=$ASAN_OPTIONS\\
                   UBSAN_OPTIONS=$UBSAN_OPTIONS\\
                   LD_PRELOAD=$LD_PRELOAD
DefaultEnvironment=ASAN_OPTIONS=$ASAN_OPTIONS\\
                   UBSAN_OPTIONS=$UBSAN_OPTIONS\\
                   LD_PRELOAD=$LD_PRELOAD
EOF

        # ASAN logs to stderr by default. However, journald's stderr is connected to /dev/null, so we lose
        # all the ASAN logs. To rectify that, let's connect journald's stdout to the console so that any
        # sanitizer failures appear directly on the user's console.
        mkdir -p "$DESTDIR/etc/systemd/system/systemd-journald.service.d"

        cat >"$DESTDIR/etc/systemd/system/systemd-journald.service.d/10-stdout-tty.conf" <<EOF
[Service]
StandardOutput=tty
EOF

        # Both systemd and util-linux's login call vhangup() on /dev/console which disconnects all users.
        # This means systemd-journald can't log to /dev/console even if we configure `StandardOutput=tty`. As
        # a workaround, we modify console-getty.service to disable systemd's vhangup() and disallow login
        # from calling vhangup() so that journald's ASAN logs correctly end up in the console.

        mkdir -p "$DESTDIR/etc/systemd/system/console-getty.service.d"

        cat >"$DESTDIR/etc/systemd/system/console-getty.service.d/10-no-vhangup.conf" <<EOF
[Service]
TTYVHangup=no
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
EOF
fi

# Make sure services aren't enabled by default on Debian/Ubuntu.
mkdir -p "$DESTDIR/etc/systemd/system-preset"
echo "disable *" >"$DESTDIR/etc/systemd/system-preset/99-mkosi.preset"

if [ -d mkosi.kernel/ ]; then
        cd "$SRCDIR/mkosi.kernel"
        mkdir -p "$BUILDDIR/mkosi.kernel"

        # Ensure fast incremental builds by fixating these values which usually change for each build.
        export KBUILD_BUILD_TIMESTAMP="Fri Jun  5 15:58:00 CEST 2015"
        export KBUILD_BUILD_HOST="mkosi"

        make O="$BUILDDIR/mkosi.kernel" defconfig

        scripts/config \
                --file "$BUILDDIR/mkosi.kernel/.config" \
                --enable BPF_SYSCALL \
                --enable BPF_JIT \
                --enable BPF_JIT_ALWAYS_ON \
                --enable BPF_JIT_DEFAULT_ON \
                --enable BPF_UNPRIV_DEFAULT_OFF \
                --enable USERMODE_DRIVER \
                --enable BPF_PRELOAD \
                --enable BPF_PRELOAD_UMD \
                --enable BPF_LSM \
                --enable DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT \
                --enable DEBUG_INFO_BTF \
                --enable BTRFS_FS \
                --enable BTRFS_FS_POSIX_ACL \
                --enable PSI \
                --enable CGROUPS \
                --enable CGROUP_BPF \
                --enable MEMCG \
                --enable MEMCG_SWAP \
                --enable MEMCG_KMEM \
                --enable IMA_ARCH_POLICY \
                --enable DM_VERITY_VERIFY_ROOTHASH_SIG \
                --enable DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING \
                --enable INTEGRITY_MACHINE_KEYRING \
                --enable NETFILTER_ADVANCED \
                --enable NF_CONNTRACK_MARK

        # Make sure all unset options are set to their default value.
        make O="$BUILDDIR/mkosi.kernel" olddefconfig

        make O="$BUILDDIR/mkosi.kernel" -j "$(nproc)"

        KERNEL_RELEASE="$(make O=$BUILDDIR/mkosi.kernel -s kernelrelease)"
        mkdir -p "$DESTDIR/usr/lib/modules/$KERNEL_RELEASE"
        make O="$BUILDDIR/mkosi.kernel" INSTALL_HDR_PATH=/usr headers_install
        make O="$BUILDDIR/mkosi.kernel" INSTALL_MOD_PATH="$DESTDIR/usr" modules_install
        make O="$BUILDDIR/mkosi.kernel" INSTALL_PATH="$DESTDIR/usr/lib/modules/$KERNEL_RELEASE" install
        mkdir -p "$DESTDIR/usr/lib/kernel/selftests"
        make -C tools/testing/selftests -j "$(nproc)" O="$BUILDDIR/mkosi.kernel" KSFT_INSTALL_PATH="$DESTDIR/usr/lib/kernel/selftests" SKIP_TARGETS="" install
fi
Commit	Line	Data
7629744a	1	#!/bin/sh
8f5bcd61	2	# SPDX-License-Identifier: LGPL-2.1-or-later
1394a3ec	3	set -e
1b0ff615	4
1b0ff615 LP	5	# This is a build script for OS image generation using mkosi (https://github.com/systemd/mkosi).
	6	# Simply invoke "mkosi" in the project directory to build an OS image.
	7
69d638e6 DDM	8	ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1:disable_coredump=0:use_madv_dontdump=1
	9	UBSAN_OPTIONS=print_stacktrace=1:print_summary=1:halt_on_error=1
	10
7211773a LP	11	# On Fedora "ld" is (unfortunately — if you ask me) managed via
	12	# "alternatives". Since we'd like to support building images in environments
	13	# with only /usr/ around (e.g. mkosi's UsrOnly=1 option), we have the problem
	14	# that /usr/bin/ld is a symlink that points to a non-existing file in
	15	# /etc/alternative/ in this mode. Let's work around this for now by manually
	16	# redirect "ld" to "ld.bfd", i.e. circumventing the /usr/bin/ld symlink.
068d1338	17	if [ ! -x /usr/bin/ld ] && [ -x /usr/bin/ld.bfd ]; then
7211773a LP	18	mkdir -p "$HOME"/bin
	19	ln -s /usr/bin/ld.bfd "$HOME"/bin/ld
	20	PATH="$HOME/bin:$PATH"
	21	fi
	22
70e760e3 LP	23	# If mkosi.builddir/ exists mkosi will set $BUILDDIR to it, let's then use it
	24	# as out-of-tree build dir. Otherwise, let's make up our own builddir.
	25	[ -z "$BUILDDIR" ] && BUILDDIR=build
	26
2ea09665 FB	27	# Meson uses Python 3 and requires a locale with an UTF-8 character map.
	28	# Not running under UTF-8 makes the `ninja test` step break with a CodecError.
	29	# So let's ensure we're running under UTF-8.
	30	#
	31	# If our current locale already is UTF-8, then we don't need to do anything:
068d1338	32	if [ "$(locale charmap 2>/dev/null)" != "UTF-8" ] ; then
2ea09665 FB	33	# Try using C.UTF-8 locale, if available. This locale is not shipped
	34	# by upstream glibc, so it's not available in all distros.
	35	# (In particular, it's not available in Arch Linux.)
5e577e17 DDM	36	if locale -a \| grep -q -E "C.UTF-8\|C.utf8"; then
	37	export LC_CTYPE=C.UTF-8
	38	# Finally, try something like en_US.UTF-8, which should be
	39	# available in Arch Linux, but is not present in Debian's
	40	# minimal image in our mkosi config.
	41	elif locale -a \| grep -q en_US.utf8; then
2ea09665	42	export LC_CTYPE=en_US.UTF-8
5e577e17 DDM	43	else
	44	# If nothing works, fail early.
	45	echo "* Could not find a valid locale that supports UTF-8. *" >&2
	46	exit 1
2ea09665 FB	47	fi
2ea09665 FB	48	fi
9400405b	49
37d35150 DDM	50	# The bpftool script shipped by Ubuntu tries to find the actual program to run via querying `uname -r` and
	51	# using the current kernel version. This obviously doesn't work in containers. As a workaround, we override
	52	# the ubuntu script with a symlink to the first bpftool program we can find.
	53	for bpftool in /usr/lib/linux-tools/*/bpftool; do
	54	[ -x "$bpftool" ] \|\| continue
	55	ln -sf "$bpftool" /usr/sbin/bpftool
	56	break
	57	done
	58
6afeac1d DDM	59	# CentOS Stream 8 includes bpftool 4.18.0 which is lower than what we need. However, they've backported the
	60	# specific feature we need ("gen skeleton") to this version, so we replace bpftool with a script that reports
	61	# version 5.6.0 to satisfy meson which makes bpf work on CentOS Stream 8 as well.
	62	if [ "$(grep '^ID=' /etc/os-release)" = "ID=\"centos\"" ] && [ "$(grep '^VERSION=' /etc/os-release)" = "VERSION=\"8\"" ]; then
	63	cp /usr/sbin/bpftool /usr/sbin/bpftool.real
f7ad9650	64	cat >/usr/sbin/bpftool <<EOF
6afeac1d DDM	65	#!/bin/sh
	66	if [ "\$1" = --version ]; then
	67	echo 5.6.0
	68	else
	69	exec /usr/sbin/bpftool.real \$@
	70	fi
	71	EOF
	72	chmod +x /usr/sbin/bpftool
	73	fi
	74
c81a2569	75	if [ ! -f "$BUILDDIR"/build.ninja ] ; then
068d1338	76	sysvinit_path=$(realpath /etc/init.d)
8da0592c	77
068d1338	78	init_path=$(realpath /sbin/init 2>/dev/null)
bac567a5	79	if [ -z "$init_path" ] ; then
2401c9ac	80	rootprefix=""
bac567a5	81	else
2401c9ac DDM	82	rootprefix=${init_path%/lib/systemd/systemd}
2401c9ac DDM	83	rootprefix=/${rootprefix#/}
bac567a5 MK	84	fi
bac567a5 MK	85
db52af5a DDM	86	meson "$BUILDDIR" \
	87	-D "sysvinit-path=$sysvinit_path" \
	88	-D "rootprefix=$rootprefix" \
	89	-D man=false \
ef1bd234	90	-D translations=false \
c0daae3a	91	-D version-tag="${VERSION_TAG}" \
69d638e6	92	-D mode=developer \
819a2502	93	-D b_sanitize="${SANITIZERS:-none}" \
37d35150 DDM	94	-D install-tests=true \
	95	-D tests=unsafe \
	96	-D slow-tests=true \
	97	-D utmp=true \
	98	-D hibernate=true \
	99	-D ldconfig=true \
	100	-D resolve=true \
	101	-D efi=true \
	102	-D tpm=true \
	103	-D environment-d=true \
	104	-D binfmt=true \
	105	-D repart=true \
	106	-D sysupdate=true \
	107	-D coredump=true \
	108	-D pstore=true \
	109	-D oomd=true \
	110	-D logind=true \
	111	-D hostnamed=true \
	112	-D localed=true \
	113	-D machined=true \
	114	-D portabled=true \
	115	-D sysext=true \
	116	-D userdb=true \
	117	-D homed=true \
	118	-D networkd=true \
	119	-D timedated=true \
	120	-D timesyncd=true \
	121	-D remote=true \
	122	-D nss-myhostname=true \
	123	-D nss-mymachines=true \
	124	-D nss-resolve=true \
	125	-D nss-systemd=true \
	126	-D firstboot=true \
	127	-D randomseed=true \
	128	-D backlight=true \
	129	-D vconsole=true \
	130	-D quotacheck=true \
	131	-D sysusers=true \
	132	-D tmpfiles=true \
	133	-D importd=true \
	134	-D hwdb=true \
	135	-D rfkill=true \
	136	-D xdg-autostart=true \
	137	-D translations=true \
	138	-D polkit=true \
	139	-D acl=true \
	140	-D audit=true \
	141	-D blkid=true \
	142	-D fdisk=true \
	143	-D kmod=true \
	144	-D pam=true \
	145	-D pwquality=true \
	146	-D microhttpd=true \
	147	-D libcryptsetup=true \
	148	-D libcurl=true \
	149	-D idn=true \
	150	-D libidn2=true \
	151	-D qrencode=true \
	152	-D gcrypt=true \
	153	-D gnutls=true \
	154	-D openssl=true \
	155	-D cryptolib=openssl \
	156	-D p11kit=true \
	157	-D libfido2=true \
158	-D tpm2=true \
159	-D elfutils=true \
160	-D zstd=true \
161	-D xkbcommon=true \
162	-D pcre2=true \
163	-D glib=true \
164	-D dbus=true \
165	-D gnu-efi=true \
166	-D kernel-install=true \
167	-D analyze=true \
3632e90c	168	-D bpf-framework=true
c82ce4f2 LP	169	fi
c82ce4f2 LP	170
c3e2dc71	171	cd "$BUILDDIR"
44bc7f4f	172	ninja "$@"
ff549982 MK	173	if [ "$WITH_TESTS" = 1 ] ; then
ff549982 MK	174	for id in 1 2 3; do
80c2f3e4	175	getent group $id >/dev/null \|\| echo "g testgroup$id $id -" \| ./systemd-sysusers -
ff549982 MK	176	done
ff549982 MK	177
69d638e6 DDM	178	if [ -n "$SANITIZERS" ]; then
	179	export ASAN_OPTIONS="$ASAN_OPTIONS"
	180	export UBSAN_OPTIONS="$UBSAN_OPTIONS"
	181	TIMEOUT_MULTIPLIER=3
	182	else
	183	TIMEOUT_MULTIPLIER=1
	184	fi
	185
de9b57a1	186	meson test --print-errorlogs --timeout-multiplier=$TIMEOUT_MULTIPLIER
ff549982	187	fi
c3e2dc71	188	cd "$SRCDIR"
fe2b7631 DDM	189
	190	# Ubuntu Focal is stuck with meson 0.53.0.
	191	if [ "$(meson -v \| cut -d . -f 2)" -gt 53 ] ; then
2234c6a0	192	meson install -C "$BUILDDIR" --quiet --no-rebuild --only-changed
fe2b7631	193	else
2234c6a0	194	meson install -C "$BUILDDIR" --no-rebuild --only-changed
fe2b7631	195	fi
6344a7eb	196
70e760e3	197	mkdir -p "$DESTDIR"/etc
6344a7eb	198
068d1338	199	cat >"$DESTDIR"/etc/issue <<EOF
6344a7eb LP	200	\S (built from systemd tree)
	201	Kernel \r on an \m (\l)
	202
	203	EOF
d10ba83a	204
f533cda5	205	if [ -n "$IMAGE_ID" ] ; then
2401c9ac DDM	206	mkdir -p "$DESTDIR"/usr/lib
	207	sed -n \
	208	-e '/^IMAGE_ID=/!p' \
	209	-e "\$aIMAGE_ID=$IMAGE_ID" <"/usr/lib/os-release" >"${DESTDIR}/usr/lib/os-release"
f533cda5	210
2401c9ac	211	OSRELEASEFILE="$DESTDIR"/usr/lib/os-release
f533cda5	212	else
2401c9ac	213	OSRELEASEFILE=/usr/lib/os-release
f533cda5 LP	214	fi
	215
	216
	217	if [ -n "$IMAGE_VERSION" ] ; then
2401c9ac DDM	218	mkdir -p "$DESTDIR"/usr/lib
	219	sed -n \
	220	-e '/^IMAGE_VERSION=/!p' \
	221	-e "\$aIMAGE_VERSION=$IMAGE_VERSION" <$OSRELEASEFILE >"/tmp/os-release.tmp"
f533cda5	222
f7ad9650	223	cat /tmp/os-release.tmp >"$DESTDIR"/usr/lib/os-release
2401c9ac	224	rm /tmp/os-release.tmp
f533cda5	225	fi
24acd406 FS	226
	227	# If $CI_BUILD is set, copy over the CI service which executes a service check
	228	# after boot and then shuts down the machine
	229	if [ -n "$CI_BUILD" ]; then
2401c9ac DDM	230	mkdir -p "$DESTDIR/usr/lib/systemd/system"
	231	cp -v "$SRCDIR/test/mkosi-check-and-shutdown.service" "$DESTDIR/usr/lib/systemd/system/mkosi-check-and-shutdown.service"
	232	cp -v "$SRCDIR/test/mkosi-check-and-shutdown.sh" "$DESTDIR/usr/lib/systemd/mkosi-check-and-shutdown.sh"
	233	chmod +x "$DESTDIR/usr/lib/systemd/mkosi-check-and-shutdown.sh"
24acd406	234	fi
69d638e6 DDM	235
	236	if [ -n "$SANITIZERS" ]; then
	237	LD_PRELOAD=$(ldd $BUILDDIR/systemd \| grep libasan.so \| awk '{print $3}')
	238
	239	mkdir -p "$DESTDIR/etc/systemd/system.conf.d"
	240
f7ad9650	241	cat >"$DESTDIR/etc/systemd/system.conf.d/10-asan.conf" <<EOF
69d638e6 DDM	242	[Manager]
	243	ManagerEnvironment=ASAN_OPTIONS=$ASAN_OPTIONS\\
	244	UBSAN_OPTIONS=$UBSAN_OPTIONS\\
	245	LD_PRELOAD=$LD_PRELOAD
	246	DefaultEnvironment=ASAN_OPTIONS=$ASAN_OPTIONS\\
	247	UBSAN_OPTIONS=$UBSAN_OPTIONS\\
	248	LD_PRELOAD=$LD_PRELOAD
	249	EOF
	250
	251	# ASAN logs to stderr by default. However, journald's stderr is connected to /dev/null, so we lose
	252	# all the ASAN logs. To rectify that, let's connect journald's stdout to the console so that any
	253	# sanitizer failures appear directly on the user's console.
	254	mkdir -p "$DESTDIR/etc/systemd/system/systemd-journald.service.d"
	255
f7ad9650	256	cat >"$DESTDIR/etc/systemd/system/systemd-journald.service.d/10-stdout-tty.conf" <<EOF
69d638e6 DDM	257	[Service]
	258	StandardOutput=tty
	259	EOF
	260
	261	# Both systemd and util-linux's login call vhangup() on /dev/console which disconnects all users.
	262	# This means systemd-journald can't log to /dev/console even if we configure `StandardOutput=tty`. As
	263	# a workaround, we modify console-getty.service to disable systemd's vhangup() and disallow login
	264	# from calling vhangup() so that journald's ASAN logs correctly end up in the console.
	265
	266	mkdir -p "$DESTDIR/etc/systemd/system/console-getty.service.d"
	267
f7ad9650	268	cat >"$DESTDIR/etc/systemd/system/console-getty.service.d/10-no-vhangup.conf" <<EOF
69d638e6 DDM	269	[Service]
	270	TTYVHangup=no
	271	CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
	272	EOF
	273	fi
37d35150 DDM	274
	275	# Make sure services aren't enabled by default on Debian/Ubuntu.
	276	mkdir -p "$DESTDIR/etc/systemd/system-preset"
f7ad9650	277	echo "disable *" >"$DESTDIR/etc/systemd/system-preset/99-mkosi.preset"
d12e9bdc DDM	278
	279	if [ -d mkosi.kernel/ ]; then
	280	cd "$SRCDIR/mkosi.kernel"
	281	mkdir -p "$BUILDDIR/mkosi.kernel"
	282
6c2ff4a0 DDM	283	# Ensure fast incremental builds by fixating these values which usually change for each build.
	284	export KBUILD_BUILD_TIMESTAMP="Fri Jun 5 15:58:00 CEST 2015"
	285	export KBUILD_BUILD_HOST="mkosi"
	286
d12e9bdc DDM	287	make O="$BUILDDIR/mkosi.kernel" defconfig
	288
	289	scripts/config \
6c2ff4a0	290	--file "$BUILDDIR/mkosi.kernel/.config" \
d12e9bdc DDM	291	--enable BPF_SYSCALL \
	292	--enable BPF_JIT \
	293	--enable BPF_JIT_ALWAYS_ON \
	294	--enable BPF_JIT_DEFAULT_ON \
	295	--enable BPF_UNPRIV_DEFAULT_OFF \
	296	--enable USERMODE_DRIVER \
	297	--enable BPF_PRELOAD \
	298	--enable BPF_PRELOAD_UMD \
	299	--enable BPF_LSM \
6c2ff4a0 DDM	300	--enable DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT \
6c2ff4a0 DDM	301	--enable DEBUG_INFO_BTF \
d12e9bdc DDM	302	--enable BTRFS_FS \
	303	--enable BTRFS_FS_POSIX_ACL \
	304	--enable PSI \
	305	--enable CGROUPS \
	306	--enable CGROUP_BPF \
	307	--enable MEMCG \
	308	--enable MEMCG_SWAP \
6c2ff4a0	309	--enable MEMCG_KMEM \
a460debc LB	310	--enable IMA_ARCH_POLICY \
	311	--enable DM_VERITY_VERIFY_ROOTHASH_SIG \
	312	--enable DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING \
	313	--enable INTEGRITY_MACHINE_KEYRING \
6c2ff4a0 DDM	314	--enable NETFILTER_ADVANCED \
6c2ff4a0 DDM	315	--enable NF_CONNTRACK_MARK
d12e9bdc DDM	316
	317	# Make sure all unset options are set to their default value.
	318	make O="$BUILDDIR/mkosi.kernel" olddefconfig
	319
	320	make O="$BUILDDIR/mkosi.kernel" -j "$(nproc)"
	321
	322	KERNEL_RELEASE="$(make O=$BUILDDIR/mkosi.kernel -s kernelrelease)"
	323	mkdir -p "$DESTDIR/usr/lib/modules/$KERNEL_RELEASE"
6c2ff4a0	324	make O="$BUILDDIR/mkosi.kernel" INSTALL_HDR_PATH=/usr headers_install
d12e9bdc DDM	325	make O="$BUILDDIR/mkosi.kernel" INSTALL_MOD_PATH="$DESTDIR/usr" modules_install
d12e9bdc DDM	326	make O="$BUILDDIR/mkosi.kernel" INSTALL_PATH="$DESTDIR/usr/lib/modules/$KERNEL_RELEASE" install
6c2ff4a0 DDM	327	mkdir -p "$DESTDIR/usr/lib/kernel/selftests"
6c2ff4a0 DDM	328	make -C tools/testing/selftests -j "$(nproc)" O="$BUILDDIR/mkosi.kernel" KSFT_INSTALL_PATH="$DESTDIR/usr/lib/kernel/selftests" SKIP_TARGETS="" install
d12e9bdc	329	fi