update_jdn.sh 26.3 KB
Newer Older
1
#!/bin/bash
2
# vim: set noexpandtab:
3
# Copyright 2012-2020 Holger Levsen <holger@layer-acht.org>
4
#         ©      2018 Mattia Rizzolo <mattia@debian.org>
Holger Levsen's avatar
Holger Levsen committed
5
# released under the GPLv2
6

Holger Levsen's avatar
Holger Levsen committed
7
# puppet / salt / ansible / fai / chef / deployme.app - disclaimer
Holger Levsen's avatar
Holger Levsen committed
8
9
10
11
12
13
14
15
16
17
18
# (IOW: this script has been grown in almost 500 commits and it shows…)
#
# yes, we know… and: "it" should probably still be done.
#
# It just unclear, how/what, and what we have actually mostly works.
#
# Switching to jenkins.debian.org is probably an opportunity
# to write (refactor this into) *yet another deployment script*
# (interacting with the DSA machine setup which is in puppet…),
# thus obsoleting this script gradually, though this is used on
# 47 hosts currently (of which quite some were initially installed
Edward Betts's avatar
Edward Betts committed
19
# manually…)
Holger Levsen's avatar
Holger Levsen committed
20
21
22
#
# so, yes, patches welcome. saying this is crap alone is not helpful,
# nor is just suggesting some new or old technology. patches most welcome!
23
24
#
# that said, there's a new one: init_node ;)
Holger Levsen's avatar
Holger Levsen committed
25

26
27
set -e

Holger Levsen's avatar
Holger Levsen committed
28
# prevent failure on first run...
Holger Levsen's avatar
Holger Levsen committed
29
[ ! -f /srv/jenkins/bin/common-functions.sh ] || . /srv/jenkins/bin/common-functions.sh
Holger Levsen's avatar
Holger Levsen committed
30

31
BASEDIR="$(dirname "$(readlink -e $0)")"
32
STAMP=/var/log/jenkins/update-jenkins.stamp
33
34
# The $@ below means that command line args get passed on to j-j-b
# which allows one to specify --flush-cache or --ignore-cache
35
JJB="jenkins-jobs $@"
36
DPKG_ARCH="$(dpkg --print-architecture)"
Holger Levsen's avatar
Holger Levsen committed
37

38
# so we can later run some commands only if $0 has been updated…
Philip Hands's avatar
Philip Hands committed
39
if [ -f $STAMP ] && [ $STAMP -nt $BASEDIR/$0 ] ; then
Holger Levsen's avatar
Holger Levsen committed
40
	UP2DATE=true
Holger Levsen's avatar
Holger Levsen committed
41
	echo $HOSTNAME is up2date.
Philip Hands's avatar
Philip Hands committed
42
43
else
	UP2DATE=false
Holger Levsen's avatar
Holger Levsen committed
44
	echo $HOSTNAME needs to be updated.
45
46
47
fi


Holger Levsen's avatar
Holger Levsen committed
48
explain() {
Holger Levsen's avatar
Holger Levsen committed
49
	echo "$HOSTNAME: $1"
Holger Levsen's avatar
Holger Levsen committed
50
51
}

52
53
54
set_correct_date() {
		# set correct date
		sudo service ntp stop || true
55
		sudo ntpdate -b $1
56
}
57

58
disable_dsa_check_packages() {
59
	# disable check for outdated packages as someday in the future
60
	# packages from security.d.o will appear outdated always…
61
62
	echo -e "#!/bin/sh\n# disabled dsa-check by update_jdn.sh\nexit 0" | sudo tee /usr/local/bin/dsa-check-packages
	sudo chmod a+rx /usr/local/bin/dsa-check-packages
63
64
}

65
echo "--------------------------------------------"
Holger Levsen's avatar
Holger Levsen committed
66
explain "$(date) - begin deployment update."
67

68
69
70
71
#
# temporarily test to check which hosts don't use systemd
#
if [ -z "$(dpkg -l|grep systemd-sysv||true)" ] ; then 
72
	echo "no systemd-sysv installed on $(hostname), please enter to continue…"
73
74
75
	read
fi

76
# some nodes need special treatment…
77
case $HOSTNAME in
78
	profitbricks-build5-amd64|profitbricks-build6-i386|profitbricks-build15-amd64|profitbricks-build16-i386)
Holger Levsen's avatar
Holger Levsen committed
79
		# set correct date
80
		set_correct_date de.pool.ntp.org
81
		;;
82
	codethink-sled9*|codethink-sled11*|codethink-sled13*|codethink-sled15*)
83
		# set correct date
84
		set_correct_date de.pool.ntp.org
Holger Levsen's avatar
Holger Levsen committed
85
		;;
86
	osuosl-build170-amd64|osuosl-build172-amd64)
87
		# set correct date
88
		set_correct_date time.osuosl.org
89
		;;
90
91
92
	*)	;;
esac

93
94
95
96
97
98
99
100
101
102
103
# ubuntu decided to change kernel perms in the middle of LTS…
case $HOSTNAME in
	codethink-sled*)
		# fixup perms
		sudo chmod +r /boot/vmlinuz-*
		;;
	*)	;;
esac



104
105
106
#
# set up users and groups
#
107
declare -A user_host_groups u_shell
108
sudo_groups='jenkins,jenkins-adm,sudo,adm'
109
110
111

# if there's a need for host groups, a case statement on $HOSTNAME here that sets $GROUPNAME, say, should do the trick
# then you can define user_host_groups['phil','lvm_group']=... below
112
# and add checks for the GROUP version where ever the HOSTNAME is checked in the following code
113
114
115
116
117

user_host_groups['helmut','*']="$sudo_groups"
user_host_groups['holger','*']="$sudo_groups"
user_host_groups['holger','jenkins']="reproducible,${user_host_groups['holger','*']}"
user_host_groups['mattia','*']="$sudo_groups"
118
user_host_groups['mattia','jenkins']="reproducible,${user_host_groups['mattia','*']}"
119
user_host_groups['phil','jenkins-test-vm']="$sudo_groups,libvirt,libvirt-qemu"
120
user_host_groups['phil','jenkins']="$sudo_groups"
121
user_host_groups['lunar','jenkins']='reproducible'
122
123
user_host_groups['lynxis','osuosl-build171-amd64']="$sudo_groups"
user_host_groups['lynxis','osuosl-build172-amd64']="$sudo_groups"
124
user_host_groups['lynxis','jenkins']="jenkins"
125
126
user_host_groups['kpcyrd','osuosl-build169-amd64']="$sudo_groups"
user_host_groups['kpcyrd','osuosl-build170-amd64']="$sudo_groups"
127
user_host_groups['kpcyrd','jenkins']="jenkins"
128
user_host_groups['hans','osuosl-build168-amd64']="$sudo_groups"
Mattia Rizzolo's avatar
Mattia Rizzolo committed
129
user_host_groups['vagrant','*']="$sudo_groups"
130
user_host_groups['bernhard','osuosl-build174-amd64']="$sudo_groups"
131
132

u_shell['mattia']='/bin/zsh'
133
u_shell['lynxis']='/usr/bin/fish'
134
u_shell['kpcyrd']='/bin/bash'
135
u_shell['jenkins-adm']='/bin/bash'
136

137
138
139
# get the users out of the user_host_groups array's index
users=$(for i in ${!user_host_groups[@]}; do echo ${i%,*} ; done | sort -u)

140
141
( $UP2DATE && [ -z "$(find $BASEDIR/authorized_keys -newer $0)" ] ) || for user in ${users}; do
	cd $BASEDIR
142
	# -v is a bashism to check for set variables, used here to see if this user is active on this host
143
	if [ ! -v user_host_groups["$user","$HOSTNAME"] ] && [ ! -v user_host_groups["$user",'*'] ] && [ ! -v user_host_groups["$user","$DPKG_ARCH"] ] ; then
Holger Levsen's avatar
Holger Levsen committed
144
145
		continue
	fi
146

147
148
149
150
151
152
	# create the user
	if ! getent passwd $user > /dev/null ; then
		# adduser, defaulting to /bin/bash as shell
		sudo adduser --gecos "" --shell "${u_shell[$user]:-/bin/bash}" --disabled-password $user
	fi
	# add groups: first try the specific host, or if unset fall-back to default '*' setting
153
	for h in "$HOSTNAME" "$DPKG_ARCH" '*' ; do
154
		if [ -v user_host_groups["$user","$h"] ] ; then
Holger Levsen's avatar
Holger Levsen committed
155
			sudo usermod -G "${user_host_groups["$user","$h"]}" $user
156
			break
157
		fi
158
159
160
161
162
	done
	# add the user's keys (if any)
	if ls authorized_keys/${user}@*.pub >/dev/null 2>&1 ; then
		[ -d /var/lib/misc/userkeys ] || sudo mkdir -p /var/lib/misc/userkeys
		cat authorized_keys/${user}@*.pub | sudo tee /var/lib/misc/userkeys/${user} > /dev/null
163
	fi
164
165
done

166
167
168
169
170
sudo mkdir -p /srv/workspace
[ -d /srv/schroots ] || sudo mkdir -p /srv/schroots
[ -h /chroots ] || sudo ln -s /srv/workspace/chroots /chroots
[ -h /schroots ] || sudo ln -s /srv/schroots /schroots

171
172
# prepare tmpfs on some hosts
case $HOSTNAME in
Mattia Rizzolo's avatar
Mattia Rizzolo committed
173
174
175
176
	jenkins)
		TMPFSSIZE=100
		TMPSIZE=15
		;;
Holger Levsen's avatar
Holger Levsen committed
177
	profitbricks-build9-amd64)
178
		TMPFSSIZE=40
Mattia Rizzolo's avatar
Mattia Rizzolo committed
179
180
		TMPSIZE=8
		;;
Holger Levsen's avatar
Holger Levsen committed
181
	profitbricks-build*)
Mattia Rizzolo's avatar
Mattia Rizzolo committed
182
183
184
		TMPFSSIZE=200
		TMPSIZE=15
		;;
185
186
187
188
	codethink*)
		TMPFSSIZE=100
		TMPSIZE=15
		;;
189
190
191
192
	osuosl*)
		TMPFSSIZE=400
		TMPSIZE=50
		;;
193
194
195
	*) ;;
esac
case $HOSTNAME in
196
197
198
199
200
201
	profitbricks-build*i386)
		if ! grep -q '/srv/workspace' /etc/fstab; then
			echo "Warning: you need to manually create a /srv/workspace partition on i386 nodes, exiting."
			exit 1
		fi
		;;
202
	jenkins|profitbricks-build*amd64|codethink*|osuosl*)
203
		if ! grep -q '^tmpfs\s\+/srv/workspace\s' /etc/fstab; then
204
			echo "tmpfs		/srv/workspace	tmpfs	defaults,size=${TMPFSSIZE}g	0	0" | sudo tee -a /etc/fstab >/dev/null  
205
		fi
Mattia Rizzolo's avatar
Mattia Rizzolo committed
206
207
208
		if ! grep -q '^tmpfs\s\+/tmp\s' /etc/fstab; then
			echo "tmpfs		/tmp	tmpfs	defaults,size=${TMPSIZE}g	0	0" | sudo tee -a /etc/fstab >/dev/null
		fi
209
210
		if ! mountpoint -q /srv/workspace; then
			if test -z "$(ls -A /srv/workspace)"; then
211
				sudo mount /srv/workspace
212
			else
213
				explain "WARNING: mountpoint /srv/workspace is non-empty."
214
215
216
217
218
			fi
		fi
		;;
	*) ;;
esac
219

220
# make sure needed directories exists - some directories will not be needed on all hosts...
221
for directory in /schroots /srv/reproducible-results /srv/d-i /srv/udebs /var/log/jenkins/ /srv/jenkins /srv/jenkins/pseudo-hosts /srv/workspace/chroots ; do
222
223
224
	if [ ! -d $directory ] ; then
		sudo mkdir $directory
	fi
Holger Levsen's avatar
Holger Levsen committed
225
	sudo chown jenkins.jenkins $directory
226
done
Holger Levsen's avatar
Holger Levsen committed
227
for directory in /srv/jenkins ; do
228
229
230
231
232
	if [ ! -d $directory ] ; then
		sudo mkdir $directory
		sudo chown jenkins-adm.jenkins-adm $directory
	fi
done
233

234
if ! test -h /chroots; then
Holger Levsen's avatar
Holger Levsen committed
235
	sudo rmdir /chroots || sudo rm -f /chroots # do not recurse
236
	if test -e /chroots; then
Holger Levsen's avatar
Holger Levsen committed
237
		explain "/chroots could not be cleared."
238
	else
239
		sudo ln -s /srv/workspace/chroots /chroots
240
241
242
	fi
fi

243
244
245
246
247
# only on Debian systems
if [ -f /etc/debian_version ] ; then
	#
	# install packages we need
	#
248
	if [ $BASEDIR/$0 -nt $STAMP ] || [ ! -f $STAMP ] ; then
249
		DEBS="
Holger Levsen's avatar
Holger Levsen committed
250
			bash-completion 
251
252
			bc
			bsd-mailx
253
254
			curl
			debian-archive-keyring
255
			cdebootstrap-
256
			debootstrap
257
			devscripts
258
			eatmydata
259
			etckeeper
260
			figlet
Holger Levsen's avatar
Holger Levsen committed
261
			git
Holger Levsen's avatar
Holger Levsen committed
262
			gnupg
263
			haveged
Holger Levsen's avatar
Holger Levsen committed
264
			htop
265
			less
266
			locales-all
Mattia Rizzolo's avatar
Mattia Rizzolo committed
267
			lsof
268
269
			molly-guard
			moreutils
Holger Levsen's avatar
Holger Levsen committed
270
			mosh
271
272
273
			munin-node
			munin-plugins-core
			munin-plugins-extra
Holger Levsen's avatar
Holger Levsen committed
274
			needrestart
275
			netcat-traditional
276
277
			ntp
			ntpdate
278
			pbuilder
279
			pigz 
280
			postfix
281
			procmail
282
			psmisc
283
			python3-psycopg2 
284
			python3-yaml
Holger Levsen's avatar
Holger Levsen committed
285
			schroot 
286
287
			screen
			slay
288
			stunnel
Holger Levsen's avatar
Holger Levsen committed
289
290
291
			subversion 
			subversion-tools 
			sudo 
292
			systemd-sysv
293
			tmux
Holger Levsen's avatar
Holger Levsen committed
294
295
			unzip 
			vim 
296
			zsh
297
			"
298
		case $HOSTNAME in
299
300
301
			codethink*)
				# install debootstrap from stretch-backports on ubuntu nodes as since 20180927 debootstrap 1.0.78+nmu1ubuntu1.6 cannot install sid anymore
				DEBS="$DEBS
302
303
304
305
306
307
				debootstrap/stretch-backports
				munin-node/stretch-backports
				munin-plugins-core/stretch-backports
				munin-plugins-extra/stretch-backports
				pbuilder/stretch-backports
				" ;;
308
			*)	# not available in Ubuntu 16.04:
309
310
311
312
313
				DEBS="$DEBS
				ripgrep
				mmdebstrap
				devscripts/buster-backports
				" ;;
314
		esac
315
		case $HOSTNAME in
316
			# needed for rebuilding Debian (using .buildinfo files)
317
			osuosl-build173-amd64) DEBS="$DEBS libdpkg-perl libwww-mechanize-perl sbuild" ;;
318
319
			# needed for opensuse openbuildservice
			osuosl-build174-amd64) DEBS="$DEBS osc obs-build qemu-kvm libjson-perl libxml-simple-perl bsdtar" ;;
320
321
			*) ;;
		esac
322
323
324
325
326
327
		# install stuff for bremner's builtin-pho stuff
		# and building html pages there too
		case $HOSTNAME in
			profitbricks-build7-a*) DEBS="$DEBS
				postgresql
				postgresql-11-debversion
328
				python3-pystache
329
330
331
332
				python3-apt
				python3-psycopg2" ;;
			*) ;;
		esac
333
		# install squid / apache2 on a few nodes only
334
		case $HOSTNAME in
335
			profitbricks-build1-a*|profitbricks-build10*|codethink-sled16*|osuosl-build167*) DEBS="$DEBS
336
				squid" ;;
337
338
			profitbricks-build7-a*) DEBS="$DEBS
				apache2" ;;
339
340
341
342
343
			*) ;;
		esac
		# notifications are only done from a view nodes
		case $HOSTNAME in
			jenkins|jenkins-test-vm|profitbricks-build*) DEBS="$DEBS
344
345
				kgb-client
				python3-yaml" ;;
346
347
			*) ;;
		esac
348
349
		# needed to run the 2nd reproducible builds nodes in the future...
		case $HOSTNAME in
350
			profitbricks-build5-amd64|profitbricks-build6-i386|profitbricks-build15-amd64|profitbricks-build16-i386) DEBS="$DEBS ntpdate" ;;
351
			codethink-sled9*|codethink-sled11*|codethink-sled13*|codethink-sled15*) DEBS="$DEBS ntpdate" ;;
352
			osuosl-build170-amd64|osuosl-build172-amd64) DEBS="$DEBS ntpdate" ;;
353
354
			*) ;;
		esac
355
		# needed to run coreboot/openwrt/netbsd/fedora jobs
356
		case $HOSTNAME in
357
		osuosl-build171-amd64|osuosl-build172-amd64) DEBS="$DEBS
Holger Levsen's avatar
Holger Levsen committed
358
				bison
359
				ca-certificates
Holger Levsen's avatar
Holger Levsen committed
360
361
362
				cmake
				diffutils
				findutils
363
				fish
Holger Levsen's avatar
Holger Levsen committed
364
365
366
367
				flex
				g++
				gawk
				gcc
368
				gnat
Holger Levsen's avatar
Holger Levsen committed
369
370
371
372
373
374
375
376
				grep
				libc6-dev
				libncurses5-dev
				libssl-dev
				locales-all
				kgb-client
				m4
				make
377
378
				python3-clint
				python3-git
379
				python3-pystache
380
				python3-requests
Holger Levsen's avatar
Holger Levsen committed
381
382
				python3-yaml
				subversion
383
				tree
Holger Levsen's avatar
Holger Levsen committed
384
385
				unzip
				util-linux
386
387
				zlib1g-dev
				"
388
389
390
			;;
			*) ;;
		esac
391
392
		# needed to run fdroid jobs
		case $HOSTNAME in
393
			osuosl-build168-amd64) DEBS="$DEBS
394
				androguard
395
				android-sdk
396
397
				bzr
				git-svn
398
				fdroidserver
399
				linux-headers-amd64
400
				mercurial
401
				python3-asn1crypto
402
				python3-babel
403
				python3-mwclient
404
				python3-setuptools
405
				subversion
406
				vagrant
407
				virtualbox virtualbox-dkms
408
				"
409
			;;
410
			*) ;;
411
		esac
412
413
414
		if [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
			# for phil only
			DEBS="$DEBS postfix-pcre"
415
416
			# only needed on the main node
		elif [ "$HOSTNAME" = "jenkins" ] ; then
417
			DEBS="$DEBS ffmpeg python3-popcon dose-extra"
418
419
420
421
		fi
		# mock is needed to build fedora
		if [ "$HOSTNAME" = "osuosl-build171-amd64" ] || [ "$HOSTNAME" = "osuosl-build172-amd64" ] || [ "$HOSTNAME" = "jenkins" ] ; then
			DEBS="$DEBS mock"
422
		fi
423
		# only on main node
424
		if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
Holger Levsen's avatar
Holger Levsen committed
425
426
427
428
			MASTERDEBS=" 
				apache2 
				apt-file 
				apt-listchanges 
429
				asciidoc
Holger Levsen's avatar
Holger Levsen committed
430
				binfmt-support 
431
432
				bison
				botch
Holger Levsen's avatar
Holger Levsen committed
433
434
435
436
437
438
439
				build-essential 
				cmake 
				cron-apt 
				csvtool 
				dnsmasq-base 
				dstat 
				figlet 
Holger Levsen's avatar
Holger Levsen committed
440
				flex
Holger Levsen's avatar
Holger Levsen committed
441
				gawk 
442
				ghc
443
				git-lfs
444
				git-notifier 
Holger Levsen's avatar
Holger Levsen committed
445
446
447
448
				gocr 
				graphviz 
				iasl 
				imagemagick 
449
450
				ip2host
				jekyll
451
				jenkins-job-builder
452
				jq
453
				kgb-client
Holger Levsen's avatar
Holger Levsen committed
454
455
456
457
458
459
460
461
462
				libcap2-bin 
				libfile-touch-perl 
				libguestfs-tools 
				libjson-rpc-perl 
				libsoap-lite-perl 
				libxslt1-dev 
				moreutils 
				mr 
				mtr-tiny 
463
				munin
Holger Levsen's avatar
Holger Levsen committed
464
				ntp 
465
				obfs4proxy
Holger Levsen's avatar
Holger Levsen committed
466
467
				openbios-ppc 
				openbios-sparc 
468
				openjdk-11-jre-headless
469
				pandoc
470
				postgresql
471
				postgresql-autodoc
472
				postgresql-client 
Holger Levsen's avatar
Holger Levsen committed
473
474
475
				poxml 
				procmail 
				python3-debian 
476
				python3-pystache
477
				python3-requests
478
				python3-rpy2 
479
480
481
				python3-sqlalchemy
				python3-xdg
				python3-yaml
Holger Levsen's avatar
Holger Levsen committed
482
483
484
				python-arpy 
				python-hachoir-metadata 
				python-lzma 
485
				python-pil
Holger Levsen's avatar
Holger Levsen committed
486
487
488
489
490
491
492
493
494
				python-pip 
				python-setuptools 
				python-twisted 
				python-yaml 
				qemu 
				qemu-kvm 
				qemu-system-x86 
				qemu-user-static 
				radvd 
495
496
				ruby-rspec
				rustc
Holger Levsen's avatar
Holger Levsen committed
497
498
499
500
				seabios 
				shorewall 
				shorewall6 
				sqlite3 
501
				syslinux
502
				systemd
503
				thin-provisioning-tools
504
				tor
Holger Levsen's avatar
Holger Levsen committed
505
				vncsnapshot 
506
507
				vnstat
				whohas
Holger Levsen's avatar
Holger Levsen committed
508
				x11-apps 
509
				xtightvncviewer
510
				xvfb
511
				xvkbd
512
513
				zutils
				"
514
515
516
		else
			MASTERDEBS=""
		fi
517
		$UP2DATE || sudo apt-get update
518
		$UP2DATE || sudo apt-get install $DEBS $MASTERDEBS
519
520
521
522
523
524
		# for varying kernels:
		# - we use bpo kernels on pb-build5+15 (and the default amd64 kernel on pb-build6+16-i386)
		# - we also use the bpo kernel on osuosl-build172 (but not osuosl-build171)
		# - this is done as a seperate step as bpo kernels are frequently uninstallable when upgraded on bpo
		if [ "$HOSTNAME" = "profitbricks-build5-amd64" ] || [ "$HOSTNAME" = "profitbricks-build15-amd64" ] \
			|| [ "$HOSTNAME" = "osuosl-build172-amd64" ] ; then
525
			sudo apt install linux-image-amd64/buster-backports || true # backport kernels are frequently uninstallable...
526
			:
527
528
529
530
		elif [ "$HOSTNAME" = "profitbricks-build6-i386" ] || [ "$HOSTNAME" = "profitbricks-build16-i386" ] \
			|| [ "$HOSTNAME" = "profitbricks-build2-i386" ] || [ "$HOSTNAME" = "profitbricks-build12-i386" ] ; then
			# we dont vary the kernel on i386 atm, see #875990 + #876035
			sudo apt install linux-image-amd64:amd64
531
		elif [ "$HOSTNAME" = "osuosl-build169-amd64" ] || [ "$HOSTNAME" = "osuosl-build170-amd64" ] || [ "$HOSTNAME" = "osuosl-build173-amd64" ]; then
532
			# Arch Linux builds latest stuff which sometimes (eg, currentlt Qt) needs newer kernel to build...
533
			sudo apt install linux-image-amd64/buster-backports || true # backport kernels are frequently uninstallable...
534
			:
535
		fi
Edward Betts's avatar
Edward Betts committed
536
		# don't (re-)install pbuilder if it's on hold
537
		if [ "$(dpkg-query -W -f='${db:Status-Abbrev}\n' pbuilder)" != "hi " ] ; then
538
			$UP2DATE || sudo apt-get install pbuilder
539
		fi
540
		# remove unattended-upgrades if it's installed
541
		if [ "$(dpkg-query -W -f='${db:Status-Abbrev}\n' unattended-upgrades 2>/dev/null || true)" = "ii "  ] ; then
542
			 sudo apt-get -y purge unattended-upgrades
543
		fi
544
		sudo apt-get clean
Holger Levsen's avatar
Holger Levsen committed
545
		explain "packages installed."
546
	else
Holger Levsen's avatar
Holger Levsen committed
547
		explain "no new packages to be installed."
548
	fi
549
fi
550

551
#
Holger Levsen's avatar
Holger Levsen committed
552
# deploy package configuration in /etc and /usr
553
#
Holger Levsen's avatar
Holger Levsen committed
554
cd $BASEDIR
555
556
557
558
559
560
561
562
563
for h in common common-amd64 common-i386 common-arm64 common-armhf "$HOSTNAME" ; do
	# $HOSTNAME has precedence over common-$DPKG_ARCH over common
	case $h in
		common-amd64) [ $DPKG_ARCH = "amd64" ] || continue ;;
		common-i386)  [ $DPKG_ARCH = "i386" ] || continue ;;
		common-arm64) [ $DPKG_ARCH = "arm64" ] || continue ;;
		common-armhf) [ $DPKG_ARCH = "armhf" ] || continue ;;
		*) ;;
	esac
564
565
	if [ -d "hosts/$h/etc/sudoers.d/" ]; then
		for f in "hosts/$h/etc/sudoers.d/"* ; do
566
			/usr/sbin/visudo -c -f "$f" > /dev/null
567
568
569
		done
	fi
	for d in etc usr ; do
Mattia Rizzolo's avatar
Mattia Rizzolo committed
570
		if [ -d "hosts/$h/$d" ]; then
571
			sudo cp --preserve=mode,timestamps -r "hosts/$h/$d/"* "/$d"
572
573
574
		fi
	done
done
575
576
# we ship one or two service files…
sudo systemctl daemon-reload &
577
578
579
580
581

#
# more configuration than a simple cp can do
#
sudo chown root.root /etc/sudoers.d/jenkins ; sudo chmod 700 /etc/sudoers.d/jenkins
582
sudo chown root.root /etc/sudoers.d/jenkins-adm ; sudo chmod 700 /etc/sudoers.d/jenkins-adm
Holger Levsen's avatar
Holger Levsen committed
583
[ -f /etc/mailname ] || ( echo $HOSTNAME.debian.net | sudo tee /etc/mailname )
584

585
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "profitbricks-build7-amd64" ] ; then
586
	if ! $UP2DATE || [ $BASEDIR/hosts/$HOSTNAME/etc/apache2 -nt $STAMP ]  ; then
587
588
589
590
591
592
593
594
595
		if [ ! -e /etc/apache2/mods-enabled/proxy.load ] ; then
			sudo a2enmod proxy
			sudo a2enmod proxy_http
			sudo a2enmod rewrite
			sudo a2enmod ssl
			sudo a2enmod headers
			sudo a2enmod macro
			sudo a2enmod filter
		fi
596
597
598
		if [ "$HOSTNAME" = "jenkins" ] ; then
			sudo a2ensite -q jenkins.debian.net
			sudo chown jenkins-adm.jenkins-adm /etc/apache2/sites-enabled/jenkins.debian.net.conf
599
			sudo a2enconf -q munin
600
601
602
603
		else # "$HOSTNAME" = "profitbricks-build7-amd64"
			sudo a2ensite -q buildinfos.debian.net
			sudo chown jenkins-adm.jenkins-adm /etc/apache2/sites-enabled/buildinfos.debian.net.conf
		fi
604
605
606
		# for reproducible.d.n url rewriting:
		[ -L /var/www/userContent ] || sudo ln -sf /var/lib/jenkins/userContent /var/www/userContent
		sudo service apache2 reload
607
608
609
	fi
fi

610
if ! $UP2DATE || [ $BASEDIR/hosts/$HOSTNAME/etc/munin -nt $STAMP ] ; then
611
	cd /etc/munin/plugins
612
	sudo rm -f postfix_* open_inodes interrupts irqstats threads proc_pri vmstat if_err_* exim_* netstat fw_forwarded_local fw_packets forks open_files users nfs* iostat_ios ntp* df_abs 2>/dev/null
613
	case $HOSTNAME in
614
			profitbricks-build1-a*|profitbricks-build10*|codethink-sled16*|osuosl-build167*) [ -L /etc/munin/plugins/squid_cache ] || for i in squid_cache squid_objectsize squid_requests squid_traffic ; do sudo ln -s /usr/share/munin/plugins/$i $i ; done ;;
615
616
			*)	;;
	esac
Holger Levsen's avatar
Holger Levsen committed
617
618
619
620
	case $HOSTNAME in
			jenkins) [ -L /etc/munin/plugins/postfix_mailstats ] || for i in postfix_mailstats postfix_mailvolume postfix_mailqueue ; do sudo ln -s /usr/share/munin/plugins/$i $i ; done ;;
			*)	;;
	esac
621
622
623
	if [ "$HOSTNAME" != "jenkins" ] && [ -L /etc/munin/plugins/iostat ] ; then
		sudo rm /etc/munin/plugins/iostat
	fi
624
	if ( [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "profitbricks-build7-amd64" ] ) && [ ! -L /etc/munin/plugins/apache_accesses ] ; then
625
		for i in apache_accesses apache_volume ; do sudo ln -s /usr/share/munin/plugins/$i $i ; done
626
		sudo ln -s /usr/share/munin/plugins/loggrep jenkins_oom
627
	fi
628
629
	# this is a hack to work around (rare) problems with restarting munin-node...
	sudo service munin-node restart || sudo service munin-node restart || sudo service munin-node restart
630
fi
631
632
633
634

# add some users to groups after packages have been installed
if ! $UP2DATE ; then
	case $HOSTNAME in
Mattia Rizzolo's avatar
Mattia Rizzolo committed
635
		jenkins|osuosl-build169-amd64|osuosl-build170-amd64|osuosl-build173-amd64)
636
			# for building Archlinux
637
638
639
			sudo addgroup --system --gid 300 abuild
			sudo adduser jenkins abuild
			;;
640
641
642
643
644
		osuosl-build173-amd64)		sudo adduser jenkins sbuild ;;
		*) 				;;
	esac
fi
# finally
Holger Levsen's avatar
Holger Levsen committed
645
explain "packages configured."
Holger Levsen's avatar
Holger Levsen committed
646
647
648
649

#
# install the heart of jenkins.debian.net
#
Holger Levsen's avatar
Holger Levsen committed
650
cd $BASEDIR
651
[ -d /srv/jenkins/features ] && sudo rm -rf /srv/jenkins/features
652
# check for bash syntax *before* actually deploying anything
653
shopt -s nullglob
654
for f in bin/*.sh bin/**/*.sh ; do bash -n "$f" ; done
655
shopt -u nullglob
656
for dir in bin logparse mustache-templates ; do
657
658
	sudo mkdir -p /srv/jenkins/$dir
	sudo rsync -rpt --delete $dir/ /srv/jenkins/$dir/
Holger Levsen's avatar
Holger Levsen committed
659
	sudo chown -R jenkins-adm.jenkins-adm /srv/jenkins/$dir
660
done
661
662
HOST_JOBS="hosts/$HOSTNAME/job-cfg"
if [ -e "$HOST_JOBS" ] ; then
663
	sudo -u jenkins-adm rsync -rpt --copy-links --delete "$HOST_JOBS/" /srv/jenkins/job-cfg/
664
else
Philip Hands's avatar
Philip Hands committed
665
666
	# tidying up ... assuming that we don't want clutter on peripheral servers
	[ -d /srv/jenkins/job-cfg ] && sudo rm -rf /srv/jenkins/job-cfg
667
668
fi

669

670
sudo mkdir -p -m 700 /var/lib/jenkins/.ssh
671
sudo chown jenkins.jenkins /var/lib/jenkins/.ssh
672
if [ "$HOSTNAME" = "jenkins" ] ; then
673
674
	sudo -u jenkins install -m 600 jenkins-home/authorized_keys /var/lib/jenkins/.ssh/authorized_keys
	sudo -u jenkins cp jenkins-home/procmailrc /var/lib/jenkins/.procmailrc
675
	sudo -u jenkins cp jenkins-home/offline_nodes /var/lib/jenkins/offline_nodes
676
677
678
else
	sudo cp jenkins-nodes-home/authorized_keys /var/lib/jenkins/.ssh/authorized_keys
fi
679
if [ -f jenkins-nodes-home/authorized_keys.$HOSTNAME ] ; then
680
	cat jenkins-nodes-home/authorized_keys.$HOSTNAME | sudo tee -a /var/lib/jenkins/.ssh/authorized_keys
681
fi
682
sudo -u jenkins cp jenkins-home/gitconfig /var/lib/jenkins/.gitconfig
683
684
sudo -u jenkins cp jenkins-home/ssh_config.in /var/lib/jenkins/.ssh/config
nodes/gen_ssh_config | sudo -u jenkins tee -a /var/lib/jenkins/.ssh/config > /dev/null
685
nodes/gen_known_host_file | sudo tee /etc/ssh/ssh_known_hosts > /dev/null
Holger Levsen's avatar
Holger Levsen committed
686
explain "scripts and configurations for jenkins updated."
687

688
if [ "$HOSTNAME" = "jenkins" ] ; then
Holger Levsen's avatar
Holger Levsen committed
689
	sudo cp -pr README INSTALL TODO CONTRIBUTING d-i-preseed-cfgs /var/lib/jenkins/userContent/
690
	TMPFILE=$(mktemp)
691
	git log | grep ^Author| cut -d " " -f2-|sort -u -f > $TMPFILE
692
	echo "----" >> $TMPFILE
693
	sudo tee /var/lib/jenkins/userContent/THANKS > /dev/null < THANKS.head
694
695
	# samuel, lunar, jelle, josch and phil committed with several committers, only display one
	grep -v -e "samuel.thibault@ens-lyon.org" -e Lunar -e "j.schauer@email.de" -e "mattia@mapreri.org" -e "phil@jenkins-test-vm" -e "jelle@vdwaa.nl" $TMPFILE | sudo tee -a /var/lib/jenkins/userContent/THANKS > /dev/null
696
	rm $TMPFILE
697
	TMPDIR=$(mktemp -d -t update-jdn-XXXXXXXX)
698
	sudo cp -pr userContent $TMPDIR/
Holger Levsen's avatar
Holger Levsen committed
699
700
701
	sudo chown -R jenkins.jenkins $TMPDIR
	sudo cp -pr $TMPDIR/userContent  /var/lib/jenkins/
	sudo rm -r $TMPDIR > /dev/null
702
703
704
705
706
707
708
709
710
	cd /var/lib/jenkins/userContent/
	ASCIIDOC_PARAMS="-a numbered -a data-uri -a iconsdir=/etc/asciidoc/images/icons -a scriptsdir=/etc/asciidoc/javascripts -b html5 -a toc -a toclevels=4 -a icons -a stylesheet=$(pwd)/theme/debian-asciidoc.css"
	[ about.html -nt README ] || asciidoc $ASCIIDOC_PARAMS -o about.html README
	[ todo.html -nt TODO ] || asciidoc $ASCIIDOC_PARAMS -o todo.html TODO
	[ setup.html -nt INSTALL ] || asciidoc $ASCIIDOC_PARAMS -o setup.html INSTALL
	[ contributing.html -nt CONTRIBUTING ] || asciidoc $ASCIIDOC_PARAMS -o contributing.html CONTRIBUTING
	diff THANKS .THANKS >/dev/null || asciidoc $ASCIIDOC_PARAMS -o thanks.html THANKS
	mv THANKS .THANKS
	rm TODO README INSTALL CONTRIBUTING
711
	sudo chown jenkins.jenkins /var/lib/jenkins/userContent/*html
Holger Levsen's avatar
Holger Levsen committed
712
	explain "user content for jenkins updated."
713
fi
714

715
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
716
717
718
719
720
721
	#
	# run jenkins-job-builder to update jobs if needed
	#     (using sudo because /etc/jenkins_jobs is root:root 700)
	#
	cd /srv/jenkins/job-cfg
	for metaconfig in *.yaml.py ; do
Holger Levsen's avatar
Holger Levsen committed
722
723
724
725
726
727
		if [ -f $metaconfig ] ; then
			TMPFILE=$(sudo -u jenkins-adm mktemp)
			./$metaconfig | sudo -u jenkins-adm tee "$TMPFILE" >/dev/null
			if ! sudo -u jenkins-adm cmp -s ${metaconfig%.py} "$TMPFILE" ; then
				sudo -u jenkins-adm mv "$TMPFILE" "${metaconfig%.py}"
			fi
728
729
730
		fi
	done
	for config in *.yaml ; do
731
732
733
734
735
736
737
		# do update, if
		# no stamp file exist or
		# no .py file exists and config is newer than stamp or
		# a .py file exists and .py file is newer than stamp
		if [ ! -f $STAMP ] || \
		 ( [ ! -f $config.py ] && [ $config -nt $STAMP ] ) || \
		 ( [ -f $config.py ] && [ $config.py -nt $STAMP ] ) ; then
738
			echo "$config has changed, executing updates."
739
			$JJB update $config
740
741
		fi
	done
Holger Levsen's avatar
Holger Levsen committed
742
	explain "jenkins jobs updated."
743
fi
744

745
746
747
#
# generate the kgb-client configurations
#
748
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "osuosl-build168-amd64" ] || [ "$HOSTNAME" = "osuosl-build171-amd64" ] || [ "$HOSTNAME" = "osuosl-build172-amd64" ] || [ "$HOSTNAME" = "profitbricks-build2-i386" ] || [ "$HOSTNAME" = "profitbricks-build12-i386" ] ; then
749
750
751
	cd $BASEDIR
	KGB_SECRETS="/srv/jenkins/kgb/secrets.yml"
	if [ -f "$KGB_SECRETS" ] && [ $(stat -c "%a:%U:%G" "$KGB_SECRETS") = "640:jenkins-adm:jenkins-adm" ] ; then
Philip Hands's avatar
Philip Hands committed
752
		# the last condition is to assure the files are owned by the right user/team
753
		if [ "$KGB_SECRETS" -nt $STAMP ] || [ "deploy_kgb.py" -nt "$STAMP" ] || [ ! -f $STAMP ] ; then
Philip Hands's avatar
Philip Hands committed
754
755
756
757
			sudo -u jenkins-adm "./deploy_kgb.py"
		else
			explain "kgb-client configuration unchanged, nothing to do."
		fi
758
	else
Philip Hands's avatar
Philip Hands committed
759
760
761
		figlet -f banner Warning
		echo "Warning: $KGB_SECRETS either does not exist or has bad permissions. Please fix. KGB configs not generated"
		echo "We expect the secrets file to be mode 640 and owned by jenkins-adm:jenkins-adm."
Holger Levsen's avatar
Holger Levsen committed
762
763
		echo "/srv/jenkins/kgb should be mode 755 and owned by jenkins-adm:root."
		echo "/srv/jenkins/kgb/client-status should be mode 755 and owned by jenkins:jenkins."
764
	fi
765
	KGB_STATUS="/srv/jenkins/kgb/client-status"
766
767
	sudo mkdir -p $KGB_STATUS
	sudo chown jenkins:jenkins $KGB_STATUS
768
769
fi

770
771
772
#
# Create GPG key for jenkins user if they do not already exist (eg. to sign .buildinfo files)
#
773
if sudo -H -u jenkins gpg --with-colons --fixed-list-mode --list-secret-keys | cut -d: -f1 | grep -qsFx 'sec' >/dev/null 2>&1 ; then
Holger Levsen's avatar
Holger Levsen committed
774
	: # not generating GPG key as one already exists for jenkins user
775
else
Holger Levsen's avatar
Holger Levsen committed
776
	explain "$(date) - Generating GPG key for jenkins user."
777

778
	sudo -H -u jenkins gpg --no-tty --batch --gen-key <<EOF
779
780
781
Key-Type: RSA
Key-Length: 4096
Key-Usage: sign
782
Name-Real: $HOSTNAME
783
784
785
786
787
788
Name-Comment: Automatically generated key for signing .buildinfo files
Expire-Date: 0
%no-ask-passphrase
%no-protection
%commit
EOF
789

790
	GPG_KEY_ID="$(sudo -H -u jenkins gpg --with-colons --fixed-list-mode --list-secret-keys | grep '^sec' | cut -d: -f5 | tail -n1)"
791
792
793
794
795
796

	if [ "$GPG_KEY_ID" = "" ]
	then
		explain "$(date) - Generated GPG key but could not parse key ID"
	else
		explain "$(date) - Generated GPG key $GPG_KEY_ID - submitting to keyserver"
797
		sudo -H -u jenkins gpg --send-keys $GPG_KEY_ID
798
	fi
799
800
fi

801
#
802
# almost finally…
803
#
804
sudo touch $STAMP	# so on the next run, only configs newer than this file will be updated
Holger Levsen's avatar
Holger Levsen committed
805
explain "$(date) - finished deployment."
806

807
808
809
810
#
# some final checks only for the jenkins
#
if [ "$HOSTNAME" = "jenkins" ] ; then
Holger Levsen's avatar
Holger Levsen committed
811
	jenkins_bugs_check
Holger Levsen's avatar
Holger Levsen committed
812
	explain "$(date) - done checking for known jenkins bugs."
813
814
fi

Holger Levsen's avatar
Holger Levsen committed
815
#
816
# finally!
Holger Levsen's avatar
Holger Levsen committed
817
#
818
case $HOSTNAME in
819
	# set time back to the future
820
	profitbricks-build5-amd64|profitbricks-build6-i386|profitbricks-build15-amd64|profitbricks-build16-i386)
821
		disable_dsa_check_packages
822
823
		sudo date --set="+398 days +6 hours + 23 minutes"
		;;
824
	codethink-sled9*|codethink-sled11*|codethink-sled13*|codethink-sled15*)
825
		disable_dsa_check_packages
826
827
		sudo date --set="+398 days +6 hours + 23 minutes"
		;;
828
	osuosl-build170-amd64|osuosl-build172-amd64)
829
830
831
		disable_dsa_check_packages
		sudo date --set="+398 days +6 hours + 23 minutes"
		;;
832
	jenkins)
833
		# notify irc on updates of jenkins.d.n
834
835
		MESSAGE="jenkins.d.n updated to $(cd $BASEDIR ; git describe --always)."
		kgb-client --conf /srv/jenkins/kgb/debian-qa.conf --relay-msg "$MESSAGE"
Holger Levsen's avatar
Holger Levsen committed
836
		;;
837
838
	*)	;;
esac
839
840
841
842

echo
figlet ok
echo
Holger Levsen's avatar
Holger Levsen committed
843
844
echo "__$HOSTNAME=ok__"