mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 17:11:30 +00:00
Josh Siviour
a2c451128d
setup.sh aborts twice on resolute. qemu-kvm is a virtual package with two providers there, so apt refuses to resolve it; the token was redundant anyway since $QEMU_PACKAGES already installs qemu-system-x86/arm and spinifex execs the qemu-system-* binaries directly. sudo-rs, Ubuntu's default sudo since 25.10, then rejects the sudoers file: it implements no pam_session Defaults setting, and forbids a wildcard inside a command argument. pam_session is now emitted only for classic sudo, and the sysctl grant names a fixed-verb helper instead of a wildcard. The helper is narrower than the rule it replaces: it accepts one interface, a key restricted to rp_filter or accept_local, and a value restricted to 0 or 1, where the old grant permitted any net.ipv4.conf key at any value. Granting sysctl with an unconstrained argument was rejected as root-equivalent. Adds scripts/lint-apt-packages.sh and an Apt Packages workflow so the runtime package list is resolved against each supported suite's real indices in CI.
33 lines
1.2 KiB
Bash
Executable File
33 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Resolves setup.sh's runtime apt list against a suite's real indices with
|
|
# apt-get install -s. Catches a package that has been renamed, dropped, or made
|
|
# ambiguously virtual before it reaches a user's machine.
|
|
set -euo pipefail
|
|
|
|
IMAGE="${1:?usage: lint-apt-packages.sh <docker image>, e.g. ubuntu:26.04}"
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
|
|
# Source setup.sh for the list rather than restating it here, so the lint cannot
|
|
# drift from what the installer actually asks apt for.
|
|
INSTALL_SPINIFEX_LIB_ONLY=1
|
|
export INSTALL_SPINIFEX_LIB_ONLY
|
|
# shellcheck source=/dev/null
|
|
. "${SCRIPT_DIR}/setup.sh"
|
|
|
|
if [ -z "${APT_RUNTIME_PACKAGES:-}" ]; then
|
|
echo "setup.sh did not define APT_RUNTIME_PACKAGES" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Both arch-specific qemu packages exist in the amd64 archive, so linting them
|
|
# together covers the aarch64 install path from an amd64 runner.
|
|
PACKAGES="qemu-system-x86 qemu-system-arm ${APT_RUNTIME_PACKAGES}"
|
|
|
|
echo "Resolving ${IMAGE}..."
|
|
# shellcheck disable=SC2086
|
|
docker run --rm "${IMAGE}" bash -c \
|
|
"apt-get update -qq >/dev/null && apt-get install -s -y -qq ${PACKAGES//$'\n'/ } >/dev/null"
|
|
|
|
echo "OK: every package resolves on ${IMAGE}"
|