Skip to content

Commit c5acd4e

Browse files
committed
Merge branch 'main' into 2.0
2 parents fd6953c + 7be162e commit c5acd4e

166 files changed

Lines changed: 4348 additions & 1744 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.pipelines/containerSourceData/base/Dockerfile-Busybox-Template renamed to .pipelines/containerSourceData/busybox/Dockerfile-Busybox

Lines changed: 12 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -7,31 +7,28 @@ FROM $BASE_IMAGE AS BASE
77

88
ARG AZL_VERSION=2.0
99

10-
ARG RPMS
11-
ARG LOCAL_REPO_FILE="local.repo"
12-
ARG LOCAL_REPO_PATH="/localrepo"
10+
ARG RPMS_TO_INSTALL
11+
ARG RPMS_PATH="/dockerStage/RPMS"
12+
ARG LOCAL_REPO_FILE="/dockerStage/marinerLocalRepo.repo"
13+
ARG LOCAL_REPO_PATH="/localrepo"
1314

14-
COPY ${RPMS} /WORKDIR/RPMS
15-
COPY ${LOCAL_REPO_FILE} /WORKDIR/REPO/local.repo
16-
17-
# Create local repo if RPMS are provided
15+
# Create local repo with the given RPMS.
1816
# This will allow the user to install packages from the local repo
1917
# instead of fetching from PMC
20-
RUN if [ "${RPMS}" ]; then \
18+
RUN --mount=type=bind,source=./Stage/,target=/dockerStage/ \
2119
mkdir -p $LOCAL_REPO_PATH; \
2220
tdnf install -y --releasever=$AZL_VERSION createrepo; \
23-
cp -r /WORKDIR/RPMS ${LOCAL_REPO_PATH}; \
24-
cp /WORKDIR/REPO/local.repo /etc/yum.repos.d/local.repo; \
25-
createrepo --database ${LOCAL_REPO_PATH} --workers 10; \
21+
cp -r ${RPMS_PATH} ${LOCAL_REPO_PATH}; \
22+
cp ${LOCAL_REPO_FILE} /etc/yum.repos.d/local.repo; \
23+
createrepo --compatibility --database ${LOCAL_REPO_PATH} --workers 10; \
2624
tdnf makecache; \
27-
tdnf autoremove -y createrepo; \
28-
fi
25+
tdnf autoremove -y createrepo;
2926

30-
# Install busybox, glibc, and their dependencies into a staging location.
27+
# Install packages into a staging location.
3128
# Staging directory is copied into the final scratch image.
3229
RUN mkdir /staging \
3330
&& tdnf install -y --releasever=$AZL_VERSION --installroot /staging \
34-
busybox glibc \
31+
${RPMS_TO_INSTALL} \
3532
&& tdnf clean all \
3633
&& pushd /staging \
3734
&& rm -rf boot media mnt opt run \
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
busybox
2+
glibc
3+
mariner-release

.pipelines/containerSourceData/scripts/BuildBaseContainers.sh

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ set -e
2323
# │ ├── base
2424
# │ │ ├── Dockerfile-Base-Template
2525
# │ │ ├── Dockerfile-Base-Nonroot-Template
26-
# │ | ├── Dockerfile-Busybox-Template
2726
# │ │ ├── Dockerfile-Distroless-Template
2827
# │ │ ├── Dockerfile-Distroless-Nonroot-Template
2928
# │ container_tarballs
@@ -165,7 +164,6 @@ function initialization {
165164
# Image types
166165
BASE="base"
167166
DISTROLESS="distroless"
168-
BUSYBOX="busybox"
169167
MARINARA="marinara"
170168

171169
base_tarball_file_name=$(basename "$BASE_TARBALL") # core-2.0.20230607.tar.gz
@@ -190,7 +188,6 @@ function initialization {
190188
DISTROLESS_DEBUG_NONROOT_IMAGE_NAME="$ACR_NAME_FULL/distroless/debug:$NONROOT_IMAGE_TAG"
191189
DISTROLESS_DEBUG_IMAGE_NAME="$ACR_NAME_FULL/distroless/debug:$IMAGE_TAG"
192190

193-
BUSYBOX_IMAGE_NAME="$ACR_NAME_FULL/busybox:$IMAGE_TAG"
194191
MARINARA_IMAGE_NAME="$ACR_NAME_FULL/marinara:$IMAGE_TAG"
195192

196193
echo "BASE_IMAGE_NAME -> $BASE_IMAGE_NAME"
@@ -201,7 +198,6 @@ function initialization {
201198
echo "DISTROLESS_MINIMAL_NONROOT_IMAGE_NAME -> $DISTROLESS_MINIMAL_NONROOT_IMAGE_NAME"
202199
echo "DISTROLESS_DEBUG_IMAGE_NAME -> $DISTROLESS_DEBUG_IMAGE_NAME"
203200
echo "DISTROLESS_DEBUG_NONROOT_IMAGE_NAME -> $DISTROLESS_DEBUG_NONROOT_IMAGE_NAME"
204-
echo "BUSYBOX_IMAGE_NAME -> $BUSYBOX_IMAGE_NAME"
205201
echo "MARINARA_IMAGE_NAME -> $MARINARA_IMAGE_NAME"
206202
}
207203

@@ -233,7 +229,8 @@ function docker_build {
233229
--build-arg EULA="$EULA_FILE_NAME" \
234230
--build-arg BASE_IMAGE="$temp_image" \
235231
-t "$image_full_name" \
236-
--no-cache
232+
--no-cache \
233+
--progress=plain
237234

238235
docker rmi "$temp_image"
239236
popd > /dev/null
@@ -261,7 +258,8 @@ function docker_build_custom {
261258
--build-arg LOCAL_REPO_FILE="$LOCAL_REPO_FILE" \
262259
-t "$image_full_name" \
263260
-f "$CONTAINER_SRC_DIR/base/$dockerfile" \
264-
--no-cache
261+
--no-cache \
262+
--progress=plain
265263

266264
popd > /dev/null
267265

@@ -323,8 +321,6 @@ function build_images {
323321
docker_build_custom $DISTROLESS "$DISTROLESS_MINIMAL_NONROOT_IMAGE_NAME" "$DISTROLESS_MINIMAL_IMAGE_NAME" "Dockerfile-Distroless-Nonroot-Template"
324322
docker_build_custom $DISTROLESS "$DISTROLESS_DEBUG_NONROOT_IMAGE_NAME" "$DISTROLESS_DEBUG_IMAGE_NAME" "Dockerfile-Distroless-Nonroot-Template"
325323

326-
docker_build_custom $BUSYBOX "$BUSYBOX_IMAGE_NAME" "" "Dockerfile-Busybox-Template"
327-
328324
docker_build_marinara
329325
}
330326

.pipelines/containerSourceData/scripts/BuildGoldenContainer.sh

Lines changed: 18 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ set -e
2727
# - s) SBOM tool path.
2828
# - t) Script to create SBOM for the container image.
2929
# - u) Create Distroless container (e.g. true, false. If true, the script will also create a distroless container)
30+
# - v) Version extract command (e.g. 'busybox | head -1 | cut -c 10-15')
3031

3132
# Assuming you are in your current working directory. Below should be the directory structure:
3233
# │ rpms.tar.gz
@@ -55,7 +56,7 @@ set -e
5556
# -j OUTPUT -k ./rpms.tar.gz -l ~/CBL-Mariner/.pipelines/containerSourceData \
5657
# -m "false" -n "false" -p development -q "false" -u "true"
5758

58-
while getopts ":a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:" OPTIONS; do
59+
while getopts ":a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:" OPTIONS; do
5960
case ${OPTIONS} in
6061
a ) BASE_IMAGE_NAME_FULL=$OPTARG;;
6162
b ) ACR=$OPTARG;;
@@ -78,6 +79,7 @@ while getopts ":a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:" OPTIONS; do
7879
s ) SBOM_TOOL_PATH=$OPTARG;;
7980
t ) SBOM_SCRIPT=$OPTARG;;
8081
u ) DISTROLESS=$OPTARG;;
82+
v ) VERSION_EXTRACT_CMD=$OPTARG;;
8183

8284
\? )
8385
echo "Error - Invalid Option: -$OPTARG" 1>&2
@@ -113,6 +115,7 @@ function print_inputs {
113115
echo "CONTAINER_SRC_DIR -> $CONTAINER_SRC_DIR"
114116
echo "IS_HCI_IMAGE -> $IS_HCI_IMAGE"
115117
echo "USE_RPM_QA_CMD -> $USE_RPM_QA_CMD"
118+
echo "Version Extract Command -> $VERSION_EXTRACT_CMD"
116119
echo "REPO_PREFIX -> $REPO_PREFIX"
117120
echo "PUBLISHING_LEVEL -> $PUBLISHING_LEVEL"
118121
echo "PUBLISH_TO_ACR -> $PUBLISH_TO_ACR"
@@ -277,21 +280,26 @@ function set_image_tag {
277280
local containerId
278281
local installedPackage
279282

280-
containerId=$(docker run --entrypoint /bin/bash -dt "$GOLDEN_IMAGE_NAME")
283+
containerId=$(docker run --entrypoint /bin/sh -dt "$GOLDEN_IMAGE_NAME")
281284

282285
echo "Container ID -> $containerId"
283286

284-
if [[ $USE_RPM_QA_CMD =~ [Tt]rue ]] ; then
285-
echo "Using rpm -qa command to get installed package."
286-
installedPackage=$(docker exec "$containerId" rpm -qa | grep ^"$COMPONENT")
287+
if [[ -n "$VERSION_EXTRACT_CMD" ]]; then
288+
echo "Using custom version extract command."
289+
COMPONENT_VERSION=$(docker exec "$containerId" sh -c "$VERSION_EXTRACT_CMD")
287290
else
288-
echo "Using tdnf repoquery command to get installed package."
289-
# exec as root as the default user for some containers is non-root
290-
installedPackage=$(docker exec -u 0 "$containerId" tdnf repoquery --installed "$COMPONENT" | grep ^"$COMPONENT")
291+
if [[ $USE_RPM_QA_CMD =~ [Tt]rue ]] ; then
292+
echo "Using rpm -qa command to get installed package."
293+
installedPackage=$(docker exec "$containerId" rpm -qa | grep ^"$COMPONENT")
294+
else
295+
echo "Using tdnf repoquery command to get installed package."
296+
# exec as root as the default user for some containers is non-root
297+
installedPackage=$(docker exec -u 0 "$containerId" tdnf repoquery --installed "$COMPONENT" | grep ^"$COMPONENT")
298+
fi
299+
echo "Full Installed Package: -> $installedPackage"
300+
COMPONENT_VERSION=$(echo "$installedPackage" | awk '{n=split($0,a,"-")};{split(a[n],b,".")}; {print a[n-1]"-"b[1]}') # 16.16.0-1
291301
fi
292302

293-
echo "Full Installed Package: -> $installedPackage"
294-
COMPONENT_VERSION=$(echo "$installedPackage" | awk '{n=split($0,a,"-")};{split(a[n],b,".")}; {print a[n-1]"-"b[1]}') # 16.16.0-1
295303
echo "Component Version -> $COMPONENT_VERSION"
296304
docker rm -f "$containerId"
297305

.pipelines/prchecks/PackageBuildPRCheck.yml

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,6 @@ variables:
4242
extends:
4343
template: v2/OneBranch.NonOfficial.CrossPlat.yml@templates
4444
parameters:
45-
featureFlags:
46-
runOnHost: true
4745
globalSdl:
4846
credscan:
4947
suppressionsFile: .config/CredScanSuppressions.json
@@ -57,7 +55,7 @@ extends:
5755
isCustom: true
5856
name: ${{ configuration.agentPool }}
5957
variables:
60-
ob_artifactBaseName: $(toolchainArtifactNameBase)_${{ configuration.name }}
58+
ob_artifactBaseName: $(toolchainArtifactNameBase)_${{ configuration.name }}_$(System.JobAttempt)
6159
ob_outputDirectory: $(Build.ArtifactStagingDirectory)
6260
steps:
6361
- template: .pipelines/templates/RawToolchainDownload.yml@self
@@ -74,13 +72,17 @@ extends:
7472
# and make it available to the next stage via an output variable: 'CalculateToolchainPackageRetestList.toolchainPackageRetestList'
7573
- template: .pipelines/templates/ToolchainCalculatePackageRetests.yml@self
7674

75+
- script: echo "##vso[task.setvariable variable=toolchainArtifactName;isOutput=true]$(ob_artifactBaseName)"
76+
name: "ToolchainArtifactName"
77+
displayName: "Set variable for published artifact name"
78+
7779
# 1. Automatic publishing won't work if 'isCustom: true' is set on the pool. We cannot do 'isCustom: false' because
7880
# then OneBranch attempts to perform additional actions (adding build tags for instance), which require additional permissions
7981
# that the PR check pipeline does not have.
8082
# 2. The value for 'artifact' must equal $(ob_artifactBaseName), as this is the only value OneBranch accepts.
8183
- task: PublishPipelineArtifact@1
8284
inputs:
83-
artifact: $(toolchainArtifactNameBase)_${{ configuration.name }}
85+
artifact: $(toolchainArtifactNameBase)_${{ configuration.name }}_$(System.JobAttempt)
8486
targetPath: $(ob_outputDirectory)
8587
condition: always()
8688
displayName: "Publish toolchain artifacts"
@@ -94,25 +96,31 @@ extends:
9496
isCustom: true
9597
name: ${{ configuration.agentPool }}
9698
variables:
97-
ob_artifactBaseName: ${{ variables.rpmsArtifactNameBase }}_${{ configuration.name }}
99+
ob_artifactBaseName: ${{ variables.rpmsArtifactNameBase }}_${{ configuration.name }}_$(System.JobAttempt)
98100
ob_outputDirectory: $(Build.ArtifactStagingDirectory)
99101
testListFromToolchain: $[ stageDependencies.Toolchain_${{ configuration.name }}.Build.outputs['CalculateToolchainPackageRetestList.toolchainPackageRetestList'] ]
102+
toolchainArtifactName: $[ stageDependencies.Toolchain_${{ configuration.name }}.Build.outputs['ToolchainArtifactName.toolchainArtifactName'] ]
100103
steps:
101104
- template: .pipelines/templates/PackageBuild.yml@self
102105
parameters:
103-
customToolchainArtifactName: $(toolchainArtifactNameBase)_${{ configuration.name }}
106+
customToolchainArtifactName: $(toolchainArtifactName)
104107
isCheckBuild: true
105108
isQuickRebuildPackages: true
109+
isUseCCache: true
106110
outputArtifactsFolder: $(ob_outputDirectory)
107111
maxCPU: "${{ configuration.maxCPUs }}"
108112
pipArtifactFeeds: "mariner/Mariner-Pypi-Feed"
109113
selfRepoName: self
110114
testSuiteName: "[${{ configuration.name }}] Package test"
111115
testRerunList: "$(testListFromToolchain)"
112116

117+
- script: echo "##vso[task.setvariable variable=rpmsArtifactName;isOutput=true]$(ob_artifactBaseName)"
118+
name: "RPMsArtifactName"
119+
displayName: "Set variable for published artifact name"
120+
113121
- task: PublishPipelineArtifact@1
114122
inputs:
115-
artifact: ${{ variables.rpmsArtifactNameBase }}_${{ configuration.name }}
123+
artifact: ${{ variables.rpmsArtifactNameBase }}_${{ configuration.name }}_$(System.JobAttempt)
116124
targetPath: $(ob_outputDirectory)
117125
condition: always()
118126
displayName: "Publish packages build artifacts"
@@ -125,7 +133,9 @@ extends:
125133
type: linux
126134
isCustom: true
127135
name: ${{ configuration.agentPool }}
136+
variables:
137+
rpmsArtifactName: $[ stageDependencies.RPMs_${{ configuration.name }}.BuildAndTest.outputs['RPMsArtifactName.rpmsArtifactName'] ]
128138
steps:
129139
- template: .pipelines/templatesWithCheckout/SodiffCheck.yml@self
130140
parameters:
131-
inputArtifactName: ${{ variables.rpmsArtifactNameBase }}_${{ configuration.name }}
141+
inputArtifactName: $(rpmsArtifactName)

.pipelines/templates/PackageBuild.yml

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,10 @@ steps:
182182
delta_fetch_arg="DELTA_FETCH=n"
183183
fi
184184
185+
if [[ -n "${{ parameters.maxCascadingRebuilds }}" ]]; then
186+
max_cascading_rebuilds_arg="MAX_CASCADING_REBUILDS=${{ parameters.maxCascadingRebuilds }}"
187+
fi
188+
185189
if [[ ${{ parameters.isQuickRebuildPackages }} == "true" ]]; then
186190
quick_rebuild_packages_arg="QUICK_REBUILD_PACKAGES=y"
187191
elif [[ ${{ parameters.isQuickRebuildPackages }} == "false" ]]; then
@@ -194,27 +198,27 @@ steps:
194198
run_check_arg="RUN_CHECK=n"
195199
fi
196200
201+
if [[ -n "${{ parameters.customToolchainArtifactName }}" ]]; then
202+
toolchain_archive_arg="TOOLCHAIN_ARCHIVE=$(toolchainArchive)"
203+
fi
204+
197205
if [[ ${{ parameters.isUseCCache }} == "true" ]]; then
198206
use_ccache_arg="USE_CCACHE=y"
199207
elif [[ ${{ parameters.isUseCCache }} == "false" ]]; then
200208
use_ccache_arg="USE_CCACHE=n"
201209
fi
202210
203-
if [[ -n "${{ parameters.customToolchainArtifactName }}" ]]; then
204-
toolchain_archive_arg="TOOLCHAIN_ARCHIVE=$(toolchainArchive)"
205-
fi
206-
207211
sudo make -C "${{ parameters.buildRepoRoot }}/toolkit" build-packages -j$(nproc) \
208212
CONCURRENT_PACKAGE_BUILDS=${{ parameters.concurrentPackageBuilds }} \
209213
CONFIG_FILE="" \
210-
MAX_CASCADING_REBUILDS="${{ parameters.maxCascadingRebuilds }}" \
211214
MAX_CPU="${{ parameters.maxCPU }}" \
212215
REBUILD_TOOLS=y \
213216
REPO_LIST="${{ parameters.extraPackageRepos }}" \
214217
SPECS_DIR="${{ parameters.buildRepoRoot }}/${{ parameters.specsFolderPath }}" \
215218
SRPM_PACK_LIST="${{ parameters.srpmPackList }}" \
216219
TEST_RERUN_LIST="${{ parameters.testRerunList }}" \
217220
$delta_fetch_arg \
221+
$max_cascading_rebuilds_arg \
218222
$quick_rebuild_packages_arg \
219223
$run_check_arg \
220224
$toolchain_archive_arg \

SPECS-SIGNED/kernel-azure-signed/kernel-azure-signed.spec

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
%define uname_r %{version}-%{release}
1010
Summary: Signed Linux Kernel for Azure
1111
Name: kernel-azure-signed-%{buildarch}
12-
Version: 5.15.148.2
12+
Version: 5.15.153.1
1313
Release: 1%{?dist}
1414
License: GPLv2
1515
Vendor: Microsoft Corporation
@@ -153,6 +153,18 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg
153153
%exclude /module_info.ld
154154

155155
%changelog
156+
* Wed Mar 27 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 5.15.153.1-1
157+
- Auto-upgrade to 5.15.153.1
158+
159+
* Mon Mar 25 2024 Rachel Menge <rachelmenge@microsoft.com> - 5.15.151.2-1
160+
- Upgrade to 5.15.151.2
161+
162+
* Wed Mar 13 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 5.15.151.1-1
163+
- Auto-upgrade to 5.15.151.1
164+
165+
* Sat Mar 02 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 5.15.150.1-1
166+
- Auto-upgrade to 5.15.150.1
167+
156168
* Thu Feb 08 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 5.15.148.2-1
157169
- Auto-upgrade to 5.15.148.2
158170

SPECS-SIGNED/kernel-hci-signed/kernel-hci-signed.spec

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
%define uname_r %{version}-%{release}
55
Summary: Signed Linux Kernel for HCI
66
Name: kernel-hci-signed-%{buildarch}
7-
Version: 5.15.148.2
7+
Version: 5.15.153.1
88
Release: 1%{?dist}
99
License: GPLv2
1010
Vendor: Microsoft Corporation
@@ -149,6 +149,18 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg
149149
%exclude /module_info.ld
150150

151151
%changelog
152+
* Wed Mar 27 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 5.15.153.1-1
153+
- Auto-upgrade to 5.15.153.1
154+
155+
* Mon Mar 25 2024 Rachel Menge <rachelmenge@microsoft.com> - 5.15.151.2-1
156+
- Upgrade to 5.15.151.2
157+
158+
* Wed Mar 13 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 5.15.151.1-1
159+
- Auto-upgrade to 5.15.151.1
160+
161+
* Sat Mar 02 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 5.15.150.1-1
162+
- Auto-upgrade to 5.15.150.1
163+
152164
* Thu Feb 08 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 5.15.148.2-1
153165
- Auto-upgrade to 5.15.148.2
154166

SPECS-SIGNED/kernel-signed/kernel-signed.spec

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@
99
%define uname_r %{version}-%{release}
1010
Summary: Signed Linux Kernel for %{buildarch} systems
1111
Name: kernel-signed-%{buildarch}
12-
Version: 5.15.148.2
13-
Release: 2%{?dist}
12+
Version: 5.15.153.1
13+
Release: 1%{?dist}
1414
License: GPLv2
1515
Vendor: Microsoft Corporation
1616
Distribution: Mariner
@@ -153,6 +153,18 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg
153153
%exclude /module_info.ld
154154

155155
%changelog
156+
* Wed Mar 27 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 5.15.153.1-1
157+
- Auto-upgrade to 5.15.153.1
158+
159+
* Mon Mar 25 2024 Rachel Menge <rachelmenge@microsoft.com> - 5.15.151.2-1
160+
- Upgrade to 5.15.151.2
161+
162+
* Wed Mar 13 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 5.15.151.1-1
163+
- Auto-upgrade to 5.15.151.1
164+
165+
* Sat Mar 02 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 5.15.150.1-1
166+
- Auto-upgrade to 5.15.150.1
167+
156168
* Wed Feb 14 2024 Rachel Menge <rachelmenge@microsoft.com> - 5.15.148.2-2
157169
- Bump release to match kernel
158170

0 commit comments

Comments
 (0)