diff options
Diffstat (limited to 'build-alpine-avf')
| -rwxr-xr-x | build-alpine-avf | 274 |
1 files changed, 274 insertions, 0 deletions
diff --git a/build-alpine-avf b/build-alpine-avf new file mode 100755 index 0000000..65a3241 --- /dev/null +++ b/build-alpine-avf @@ -0,0 +1,274 @@ +#!/bin/sh +set -eu + +out="alpine-avf" +rootfs="$out/rootfs" +branch="${ALPINE_BRANCH:-v3.23}" +arch=aarch64 +mirror="https://dl-cdn.alpinelinux.org/alpine" +size="${ROOT_SIZE:-4G}" +tmp= + +packages="alpine-base linux-virt mkinitfs e2fsprogs e2fsprogs-extra doas ifupdown-ng ttyd \ +avahi avahi-openrc dbus dbus-openrc" + +die() { echo "$*" >&2; exit 1; } + +cleanup() { + if [ -n "$tmp" ] && [ -d "$tmp" ]; then + rm -rf "$tmp" || true + fi + for m in dev/pts dev sys proc; do + if mountpoint -q "$rootfs/$m"; then + umount "$rootfs/$m" || true + fi + done +} + +# cleanup unmounts best-effort only; rm -rf or mkfs -d on a rootfs that still +# has /dev bind-mounted would eat the host's /dev, so verify before either. +assert_unmounted() { + for m in dev/pts dev sys proc; do + ! mountpoint -q "$rootfs/$m" \ + || die "$rootfs/$m still mounted; unmount it and rerun" + done +} + +trap cleanup EXIT +trap 'exit 129' HUP +trap 'exit 130' INT +trap 'exit 143' TERM + +[ "$(id -u)" = 0 ] || die "run as root" +[ "$(uname -m)" = "$arch" ] || [ -e "/proc/sys/fs/binfmt_misc/qemu-$arch" ] \ + || die "need a $arch host or qemu-user-static binfmt" +for c in curl grep head mktemp sha256sum tar sed gzip od tr dd basename mkfs.ext4 openssl mount umount mountpoint chroot; do + command -v "$c" >/dev/null 2>&1 || die "need $c" +done + +# Validate inputs before the destructive cleanup below, so a typo fails loudly +# here instead of after curl wipes the old output or deep inside mkfs.ext4. +case "$branch" in + "" | *[!a-zA-Z0-9.-]*) die "ALPINE_BRANCH must look like v3.23, latest-stable, or edge (got '$branch')" ;; +esac +case "${size%[sSkKmMgGtT]}" in + "" | *[!0-9]*) die "ROOT_SIZE must be digits with an optional s/K/M/G/T suffix (got '$size')" ;; +esac + +echo "cleaning $out" +cleanup +assert_unmounted +rm -rf "$out"; mkdir -p "$rootfs" + +echo "fetching alpine $branch minirootfs" +rel="$mirror/$branch/releases/$arch" +file="$(curl -fsSL "$rel/latest-releases.yaml" | grep -oE "alpine-minirootfs-[0-9.]+-$arch\.tar\.gz" | head -1)" +[ -n "$file" ] || die "cannot determine minirootfs filename" +tmp="$(mktemp -d)" +curl -fsSL -o "$tmp/$file" "$rel/$file" +curl -fsSL -o "$tmp/$file.sha256" "$rel/$file.sha256" +( cd "$tmp" && sha256sum -c "$file.sha256" ) +tar -xzf "$tmp/$file" -C "$rootfs" +rm -rf "$tmp" + +echo "installing packages" +printf 'nameserver 8.8.8.8\nnameserver 1.1.1.1\n' >"$rootfs/etc/resolv.conf" +printf '%s\n%s\n' "$mirror/$branch/main" "$mirror/$branch/community" >"$rootfs/etc/apk/repositories" +mount -t proc none "$rootfs/proc" +mount -t sysfs none "$rootfs/sys" +mount --bind /dev "$rootfs/dev" +mount --bind /dev/pts "$rootfs/dev/pts" +chroot "$rootfs" /bin/sh -c "apk update && apk add $packages" + +echo "configuring" +echo alpine >"$rootfs/etc/hostname" +mkdir -p "$rootfs/mnt/internal" "$rootfs/mnt/shared" + +cat >"$rootfs/etc/modules" <<'EOF' +virtio_blk +virtio_pci +virtio_net +virtio_console +virtiofs +vmw_vsock_virtio_transport +EOF + +chroot "$rootfs" passwd -d root +chroot "$rootfs" adduser -D -u 1000 -s /bin/ash user +chroot "$rootfs" addgroup user video +chroot "$rootfs" passwd -d user +echo 'permit nopass user' >"$rootfs/etc/doas.conf" + +grep -q '^ttyS0::' "$rootfs/etc/inittab" \ + || echo 'ttyS0::respawn:/sbin/getty -L 0 ttyS0 vt100' >>"$rootfs/etc/inittab" + +cat >"$rootfs/etc/network/interfaces" <<'EOF' +auto lo +iface lo inet loopback +auto eth0 +iface eth0 inet dhcp +EOF + +mkdir -p "$rootfs/etc/ttyd" +openssl req -x509 -newkey rsa:2048 -nodes -days 3650 -subj /CN=localhost \ + -keyout "$rootfs/etc/ttyd/server.key" -out "$rootfs/etc/ttyd/server.crt" 2>/dev/null +chmod 0600 "$rootfs/etc/ttyd/server.key" + +cat >"$rootfs/etc/init.d/ttyd" <<'EOF' +#!/sbin/openrc-run +description="ttyd terminal for the AVF Terminal app" +supervisor=supervise-daemon +command="/usr/bin/ttyd" +command_args="--ssl --ssl-cert /etc/ttyd/server.crt --ssl-key /etc/ttyd/server.key --ssl-ca /mnt/internal/ca.crt -t disableLeaveAlert=true -W login -f user" +respawn_delay=2 +depend() { need avf-mounts; after net avahi-daemon; } +EOF +chmod +x "$rootfs/etc/init.d/ttyd" + +rm -f "$rootfs"/etc/avahi/services/*.service +cat >"$rootfs/etc/avahi/services/ttyd.service" <<'EOF' +<?xml version="1.0" standalone='no'?> +<!DOCTYPE service-group SYSTEM "avahi-service.dtd"> +<service-group> + <name>ttyd</name> + <service><type>_http._tcp</type><port>7681</port></service> +</service-group> +EOF +sed -i 's/^#*use-ipv4=.*/use-ipv4=yes/; s/^#*use-ipv6=.*/use-ipv6=no/' "$rootfs/etc/avahi/avahi-daemon.conf" + +cat >"$rootfs/etc/init.d/avf-mounts" <<'EOF' +#!/sbin/openrc-run +description="Load AVF virtio modules and mount virtiofs shares" +depend() { after modules; before net; } +start() { + ebegin "Mounting AVF virtiofs shares" + for m in virtio_net virtiofs vmw_vsock_virtio_transport; do modprobe "$m" 2>/dev/null || true; done + mkdir -p /mnt/internal /mnt/shared + # ownership only shows through if a mount fails and the bare dir is used + chown 1000:1000 /mnt/internal /mnt/shared 2>/dev/null || true + if ! mountpoint -q /mnt/internal && ! mount -t virtiofs internal /mnt/internal; then + eend 1 "failed to mount /mnt/internal" + return 1 + fi + if ! mountpoint -q /mnt/shared && ! mount -t virtiofs android /mnt/shared; then + ewarn "failed to mount /mnt/shared" + fi + eend 0 +} +EOF +chmod +x "$rootfs/etc/init.d/avf-mounts" + +cat >"$rootfs/etc/init.d/avf-clock" <<'EOF' +#!/sbin/openrc-run +description="Set the AVF guest clock from the Terminal app CA certificate" +depend() { need avf-mounts; before net; } +start() { + ebegin "Setting clock from /mnt/internal/ca.crt" + n=0 + while [ ! -e /mnt/internal/ca.crt ] && [ "$n" -lt 10 ]; do + sleep 1 + n=$((n + 1)) + done + if [ ! -e /mnt/internal/ca.crt ]; then + eend 1 "/mnt/internal/ca.crt not found" + return 1 + fi + ts="$(date -u -r /mnt/internal/ca.crt '+%Y-%m-%d %H:%M:%S' 2>/dev/null)" || { + eend 1 "could not read /mnt/internal/ca.crt mtime" + return 1 + } + date -u -s "$ts" >/dev/null || { + eend 1 "could not set clock" + return 1 + } + eend 0 +} +EOF +chmod +x "$rootfs/etc/init.d/avf-clock" + +cat >"$rootfs/etc/init.d/avf-resize" <<'EOF' +#!/sbin/openrc-run +description="Grow the root filesystem to fill its block device" +depend() { after root; before localmount; } +start() { + ebegin "Growing root filesystem to fill the disk" + dev="$(awk '$2 == "/" { print $1; exit }' /proc/mounts)" + [ -b "$dev" ] || { ewarn "root device not found"; return 0; } + resize2fs "$dev" + eend $? +} +EOF +chmod +x "$rootfs/etc/init.d/avf-resize" + +chroot "$rootfs" /bin/sh <<'EOF' +set -e +for s in devfs dmesg mdev hwdrivers cgroups; do rc-update add "$s" sysinit || true; done +for s in modules sysctl hostname bootmisc syslog seedrng localmount networking; do rc-update add "$s" boot || true; done +for s in killprocs mount-ro savecache; do rc-update add "$s" shutdown || true; done +rc-update add avf-mounts boot +rc-update add avf-clock boot +rc-update add avf-resize boot +rc-update add dbus default +rc-update add avahi-daemon default +rc-update add ttyd default +EOF + +echo "building image" +echo 'features="base virtio ext4"' >"$rootfs/etc/mkinitfs/mkinitfs.conf" +kver="$(basename "$(ls -d "$rootfs"/lib/modules/*-virt | head -1)")" +[ -n "$kver" ] || die "no -virt kernel modules under $rootfs/lib/modules" +chroot "$rootfs" mkinitfs -o /boot/initramfs-avf "$kver" +cp "$rootfs/boot/initramfs-avf" "$out/initrd.img" + +# Alpine ships vmlinuz as an EFI zboot PE wrapping a gzip Image; crosvm needs the +# raw arm64 Image (magic "ARMd" / 41524d64 at offset 0x38). +vmlinuz="$rootfs/boot/vmlinuz-virt" +if [ "$(od -An -c -j4 -N4 "$vmlinuz" | tr -d ' ')" = "zimg" ]; then + off="$(od -An -tu4 -j8 -N4 "$vmlinuz" | tr -d ' ')" + sz="$(od -An -tu4 -j12 -N4 "$vmlinuz" | tr -d ' ')" + dd if="$vmlinuz" bs=1M iflag=skip_bytes,count_bytes skip="$off" count="$sz" 2>/dev/null | gzip -dc >"$out/vmlinuz" +else + cp "$vmlinuz" "$out/vmlinuz" +fi +[ "$(od -An -tx1 -j56 -N4 "$out/vmlinuz" | tr -d ' \n')" = "41524d64" ] \ + || die "extracted kernel is not a raw arm64 Image" + +cleanup +assert_unmounted +rm -f "$rootfs/etc/resolv.conf" +# ^orphan_file: Alpine's mke2fs enables it by default; the image must still +# pass the stock VM's e2fsck (the stage 2 gate in install-alpine-avf) and +# online resize2fs under crosvm, so keep the feature set conservative. +mkfs.ext4 -q -F -L ROOT -O ^orphan_file -d "$rootfs" "$out/root_part" "$size" + +# keep the stock layout; "name" stays "debian" (anything else is untested +# against the Terminal app). +cat >"$out/vm_config.json" <<EOF +{ + "name": "debian", + "disks": [ { "partitions": [ + { "label": "ROOT", "path": "\$PAYLOAD_DIR/root_part", "writable": true, "guid": "$(cat /proc/sys/kernel/random/uuid)" } + ], "writable": true } ], + "sharedPath": [ { "sharedPath": "/storage/emulated" }, { "sharedPath": "\$APP_DATA_DIR/files" } ], + "kernel": "\$PAYLOAD_DIR/vmlinuz", + "initrd": "\$PAYLOAD_DIR/initrd.img", + "params": "root=/dev/vda1 rootfstype=ext4 rw console=ttyS0", + "protected": false, + "cpu_topology": "match_host", + "platform_version": "~1.0", + "memory_mib": 4096, + "debuggable": true, + "connect_console": true, + "console_out": true, + "console_input_device": "ttyS0", + "network": true, + "auto_memory_balloon": false, + "gpu": { "backend": "2d" } +} +EOF + +# The Terminal app parses the LAST space-separated token of build_id as a 4-digit +# year and reinstalls the stock Debian (InstalledImage.isOlderThanCurrentVersion) +# if it is below the app's release year. Keep the trailing year; do not drop it. +echo "alpine $(date -u +%Y%m%dT%H%M%SZ) $(date -u +%Y)" >"$out/build_id" +echo "done: $out" |