bt-bugfix

#!/bin/bash -e
# Copyright (c) 2022 TurnKey GNU/Linux - https://www.turnkeylinux.org
# 
# This file is part of buildtasks.
# 
# Buildtasks is free software; you can redistribute it and/or modify it
# under the terms of the GNU Affero General Public License as published by the
# Free Software Foundation; either version 3 of the License, or (at your
# option) any later version.

fatal() { echo "FATAL [$(basename $0)]: $@" 1>&2; exit 1; }
warning() { echo "WARNING [$(basename $0)]: $@"; }
info() { echo "INFO [$(basename $0)]: $@"; }

usage() {
cat<<EOF
Syntax: $(basename $0) [ --options ] appname-version
Patch appliance appname-version with appname-version patch (if it exists),
increment version and repackage as ISO, (re)generating tklbam profile.

Arguments::

    appname-version     - e.g., core-17.0-bullseye-amd64

Options::

    --publish           - publish iso, release files and tklbam profile
    --secupdates        - run secupdates
    --updates           - install all available updates
    --bug-number        - note bug number closed in updated changelog
    --force             - do not fail if directories exist

Environment::

    BT_DEBUG            - turn on debugging
EOF
exit 1
}

unset appver publish secupdates updates bug_num force
while [ "$1" != "" ]; do
    case $1 in
        --help|-h)     usage;;
        --publish)     publish="yes";;
        --secupdates)  secupdates="yes";;
        --updates)     updates="yes";;
        --bug-number)  shift; bug_num="$1";;
        --force)       force="yes";;
        *)             if [ -n "$appver" ]; then usage; else appver=$1; fi ;;
    esac
    shift
done

[ -n "$appver" ] || usage
[ -n "$secupdates" ] || warning "--secupdates was not specified"

[ -z "$BT_DEBUG" ] || set -x

export BT=$(dirname $(readlink -f $0))
export BT_CONFIG=$BT/config
. $BT_CONFIG/common.cfg

if [ "$publish" == "yes" ]; then
    [ -n "$BT_PUBLISH_IMGS" ] || fatal "BT_PUBLISH_IMGS not set"
    [ -n "$BT_PUBLISH_META" ] || fatal "BT_PUBLISH_META not set"
    [ -n "$BT_PUBLISH_PROFILES" ] || fatal "BT_PUBLISH_PROFILES not set"
else
    warning "--publish was not specified"
fi

info "Setting up."
O=$BT_ISOS
mkdir -p $O
parsed_appname_version=$($BT/bin/parse-appname-version $appver)
read appname appversion codename arch <<< "$parsed_appname_version"
export BT_VERSION=${appversion}-${codename}-${arch}

os_arch=$(dpkg --print-architecture)
[ "$arch" == "$os_arch" ] || fatal "os_arch mismatch: $arch != $os_arch"

major_v=$(echo $appversion | sed -En "s|^([0-9]+)\.[0-9]+|\1|p")
minor_v=$(echo $appversion | sed -En "s|^[0-9]+\.([0-9]+)|\1|p")
new_appversion="${major_v}.$(( $minor_v + 1 ))"
export NEW_BT_VERSION=${new_appversion}-${codename}-${arch}

name=turnkey-${appname}-${BT_VERSION}
new_name=turnkey-${appname}-${NEW_BT_VERSION}
isofile=$name.iso
rootfs=$name.rootfs
cdroot=$name.cdroot
new_isofile=$new_name.iso
old_sec_pkg=turnkey-${appname}-${appversion}
new_sec_pkg=turnkey-${appname}-${new_appversion}
old_changelog=$rootfs/usr/share/doc/$old_sec_pkg/changelog
new_changelog=$new_name.changelog

_umount() {
    info "Unmounting resources from rootfs."
    umount -l $rootfs/run || true
    umount -l $rootfs/dev || true
    umount -l $rootfs/sys || true
    umount -l $rootfs/proc || true
}

_cleanup() {
    _umount
    if [[ -z "$BT_DEBUG" ]] || [[ "$force" == "yes" ]]; then
        info "Cleaning up files and directories."
        rm -rf $O/$new_sec_pkg
        if ! (mount | grep -q $(basename $rootfs)); then
            rm -rf $O/$rootfs
            rm -rf $O/$cdroot
        else
            warning "$rootfs not unmounted."
        fi
    fi
}

#trap _cleanup INT TERM EXIT

info "Download and verfiy ISO."
$BT/bin/iso-download $BT_ISOS $BT_VERSION $appname \
    || $BT/bt-iso $appname
$BT/bin/iso-verify $BT_ISOS $BT_VERSION $appname

cd $O
[[ "$force" == "yes" ]] || _cleanup
tklpatch-extract-iso $isofile

unset patches
[[ ! -d "$BT/patches/$BT_VERSION" ]] \
    || patches="$BT/patches/$BT_VERSION"
[[ ! -d "$BT/patches/${appname}-${NEW_BT_VERSION}" ]] \
    || patches="$patches $BT-patches/${appname}-${NEW_BT_VERSION}"
if [[ "$updates" == "yes" ]]; then
    patches="$patches $BT/patches/updates"
elif [[ "$secupdates" == "yes" ]]; then
    patches="$patches $BT/patches/secupdates"
fi

patch_test=$(echo $patches | tr -d '[[:space:]]')
if [[ -z "$patch_test" ]]; then
    if [[ -z "$BT_DEBUG" ]]; then
        fatal "Exiting. No patches to be applied."
    else
        info "No patches to be applied - continuing because BT_DEBUG"
    fi
else
    info "Patches to be applied: $patches."
fi

info "Generating updated updated changelog."
# update changelog
msg="Patched bugfix release."
[[ -z "$bug_num" ]] || msg="$msg Closes #${bug_num}."
cat > $new_changelog <<EOF
${new_sec_pkg} (1) turnkey; urgency=low
EOF
if [[ "$patches" == *"/updates"* ]]; then
    cat >> $new_changelog <<EOF

  * Updated all Debian packages to latest.
    [ autopatched by buildtasks ]
EOF
elif [[ "$patches" == *"/secupdates"* ]]; then
    cat >> $new_changelog <<EOF

  * Pre-installed all latest Debian security updates.
    [ autopatched by buildtasks ]
EOF
fi
cat >> $new_changelog <<EOF

  * $msg
    [ autopatched by buildtasks ]

 -- Jeremy Davis <jeremy@turnkeylinux.org>  $(date +"%a, %d %b %Y %H:%M:%S %z")

EOF
cat $old_changelog >> $new_changelog

info "Updating turnkey_version and preparing update version package."
echo "$new_name" > $rootfs/etc/turnkey_version
$BT/bin/generate-release-deb $new_changelog $rootfs
update_patch=$BT/patches/update-release
conf_script=$update_patch/conf
mkdir -p $update_patch
touch $conf_script
cat > $conf_script <<EOF
#!/bin/bash -e
export DEBIAN_FRONTEND=noninteractive
apt-get purge -y $old_sec_pkg
apt-get install -y /$new_sec_pkg*.deb
rm -rf /$new_sec_pkg*.deb
EOF
chmod +x $conf_script

mount --bind --make-rslave /proc $rootfs/proc
mount --bind --make-rslave /sys $rootfs/sys
mount --bind --make-rslave /dev $rootfs/dev
mount --bind --make-rslave /run $rootfs/run

info "Applying patches:"
info " - $update_patch."
tklpatch-apply-conf $rootfs $conf_script
info " - $update_patch - done."
rm -rf $update_patch
for patch in $patches; do
    info " - $patch."
    [[ ! -d "$patch/overlay" ]] || tklpatch-apply-overlay $patch/overlay
    tklpatch-apply-conf $rootfs $patch/conf
    info " - $patch - done."
done
tklpatch-apply-cleanup $rootfs

_umount

info "Cleaning up rootfs and rebuilding new ISO."
$BT/bin/rootfs-cleanup $rootfs
$BT/bin/aptconf-tag $rootfs iso
tklpatch-prepare-cdroot $rootfs $cdroot
TKLPATCH_ISOLABEL=${appname} tklpatch-geniso $cdroot $new_isofile

info "Preparing release files."
$BT/bin/generate-signature $O/$new_isofile
$BT/bin/generate-manifest $rootfs > $O/$new_name.manifest
$BT/bin/generate-buildenv iso $appname > $O/$new_name.iso.buildenv
if [ -e $BT_PROFILES/$appname ]; then
    mkdir -p $O/$new_name.tklbam
    export PROFILES_CONF=$BT_PROFILES
    $BT/bin/generate-tklbam-profile $O/$new_name.iso $O/$new_name.tklbam
fi
_cleanup

if [ "$publish" == "yes" ]; then
    $BT/bin/iso-publish $BT_ISOS/$new_name.iso
    if [[ -z "BT_DEBUG" ]]; then
        rm -rf $BT_ISOS/$name.iso*
        rm -rf $BT_ISOS/$new_name*
    fi
fi