Skip to content

Commit 40887c8

Browse files
maxmcdmaxmcd
authored
bramble run (#33)
* bramble run for git download * remove path from sandbox, just take args to match libcontainer limitation * tty support, exit code handling, initial run version * add go binaries to /bin * add run tests * integration test is integration test * submit config values for read_only_paths and hidden_paths * fix tmpfile length, run within docker * accidental delete Former-commit-id: 7d80644
1 parent 384cd62 commit 40887c8

28 files changed

Lines changed: 780 additions & 196 deletions

‎Dockerfile‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
FROM golang:alpine
2+
3+
4+
RUN apk add build-base linux-headers
5+
WORKDIR /go/src/github.com/maxmcd/bramble
6+
COPY go.sum go.mod ./
7+
RUN go mod download
8+
9+
COPY . .
10+
11+
RUN go install
12+
13+
# FROM alpine
14+
15+
# COPY --from=0 /go/src/github.com/maxmcd/bramble/bramble /bin/bramble

‎Makefile‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,5 +22,7 @@ integration_ci_test: install gotestsum
2222
env BRAMBLE_INTEGRATION_TEST=truthy gotestsum -- -v ./pkg/bramble/
2323

2424
integration_test: install
25-
env BRAMBLE_INTEGRATION_TEST=truthy go test -v ./pkg/bramble/
25+
env BRAMBLE_INTEGRATION_TEST=truthy go test -run=$(run) -v ./pkg/bramble/
2626

27+
rootless_within_docker:
28+
docker build -t bramble . && docker run --privileged -it bramble bramble build ./lib:busybox

‎bramble.toml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,5 @@
22

33
[module]
44
name = "github.com/maxmcd/bramble"
5+
read_only_paths = ["./"]
6+
hidden_paths = ["./lib"]

‎go.mod‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,12 @@ require (
77
github.com/bmatcuk/doublestar/v4 v4.0.2
88
github.com/certifi/gocertifi v0.0.0-20210507211836-431795d63e8d
99
github.com/containerd/console v1.0.3
10+
github.com/creack/pty v1.1.15 // indirect
1011
github.com/jaguilar/vt100 v0.0.0-20201024211400-81de19cb81a4
1112
github.com/maxmcd/dag v0.0.0-20210909010249-5757e2034a95
1213
github.com/mholt/archiver/v3 v3.5.0
1314
github.com/minio/sha256-simd v1.0.0
15+
github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6
1416
github.com/morikuni/aec v1.0.0
1517
github.com/opencontainers/runc v1.0.2
1618
github.com/peterbourgon/ff/v3 v3.1.0

‎go.sum‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
code.cloudfoundry.org/bytefmt v0.0.0-20190710193110-1eb035ffe2b6/go.mod h1:wN/zk7mhREp/oviagqUXY3EwuHhWyOvAdsn5Y4CzOrc=
2+
github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
3+
github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
24
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
35
github.com/BurntSushi/toml v0.4.1 h1:GaI7EiDXDRfa8VshkTj7Fym7ha+y8/XxIgD2okUIjLw=
46
github.com/BurntSushi/toml v0.4.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
@@ -29,6 +31,9 @@ github.com/coreos/go-systemd/v22 v22.3.2 h1:D9/bQk5vlXQFZ6Kwuu6zaiXJ9oTPe68++AzA
2931
github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
3032
github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
3133
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
34+
github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
35+
github.com/creack/pty v1.1.15 h1:cKRCLMj3Ddm54bKSpemfQ8AtYFBhAI2MPmdys22fBdc=
36+
github.com/creack/pty v1.1.15/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
3237
github.com/cyphar/filepath-securejoin v0.2.2 h1:jCwT2GTP+PY5nBz3c/YL5PAIbusElVrPujOBSCj8xRg=
3338
github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
3439
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -96,6 +101,8 @@ github.com/minio/sha256-simd v1.0.0/go.mod h1:OuYzVNI5vcoYIAmbIvHPl3N3jUzVedXbKy
96101
github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db/go.mod h1:l0dey0ia/Uv7NcFFVbCLtqEBQbrT4OCwCSKTEv6enCw=
97102
github.com/moby/sys/mountinfo v0.4.1 h1:1O+1cHA1aujwEwwVMa2Xm2l+gIpUHyd3+D+d7LZh1kM=
98103
github.com/moby/sys/mountinfo v0.4.1/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
104+
github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 h1:dcztxKSvZ4Id8iPpHERQBbIJfabdt4wUm5qy3wOL2Zc=
105+
github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6/go.mod h1:E2VnQOmVuvZB6UYnnDB0qG5Nq/1tD9acaOpo6xmt0Kw=
99106
github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
100107
github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
101108
github.com/mrunalp/fileutils v0.5.0 h1:NKzVxiH7eSk+OQ4M+ZYW1K6h27RUV3MI6NUTsHhU6Z4=
@@ -129,6 +136,7 @@ github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvW
129136
github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
130137
github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
131138
github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
139+
github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
132140
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
133141
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
134142
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
@@ -186,6 +194,7 @@ golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7w
186194
golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
187195
golang.org/x/sys v0.0.0-20210426230700-d19ff857e887/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
188196
golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
197+
golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
189198
golang.org/x/sys v0.0.0-20210909193231-528a39cd75f3 h1:3Ad41xy2WCESpufXwgs7NpDSu+vjxqLt2UFqUV+20bI=
190199
golang.org/x/sys v0.0.0-20210909193231-528a39cd75f3/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
191200
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
@@ -195,6 +204,7 @@ golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac h1:7zkz7BUtwNFFqcowJ+RIgu2M
195204
golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
196205
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
197206
golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
207+
golang.org/x/tools v0.0.0-20190624222133-a101b041ded4/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
198208
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
199209
golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
200210
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -225,3 +235,5 @@ gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
225235
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
226236
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=
227237
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
238+
gotest.tools/v3 v3.0.2 h1:kG1BFyqVHuQoVQiR1bWGnfz/fmHvvuiSPIV7rvl360E=
239+
gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=

‎lib/default.bramble‎

Lines changed: 23 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,22 @@ load("github.com/maxmcd/bramble/lib/std")
22

33

44
def cacerts():
5-
return std.fetch_url("https://brmbl.s3.amazonaws.com/ca-certificates.crt")
5+
return derivation(
6+
name="ca-certificates",
7+
builder=busybox().out + "/bin/sh",
8+
env=dict(
9+
PATH=busybox().out + "/bin",
10+
src=std.fetch_url("https://brmbl.s3.amazonaws.com/ca-certificates.crt"),
11+
),
12+
args=[
13+
"-c",
14+
"""
15+
set -ex
16+
cp -r $src/ca-certificates.crt $out
17+
cp $out/ca-certificates.crt $out/ca-bundle.crt
18+
""",
19+
],
20+
)
621

722

823
def git():
@@ -33,18 +48,17 @@ def git_fetcher():
3348
git=git(),
3449
PATH=git().out + "/bin",
3550
GIT_EXEC_PATH=git().out + "/libexec/git-core",
36-
GIT_SSL_CAINFO=cacerts(),
51+
GIT_SSL_CAINFO=cacerts().out + "/ca-certificates.crt",
3752
),
3853
)
3954

4055

41-
# Need better sandboxing
42-
# def git_test():
43-
# return derivation(
44-
# "git-test",
45-
# "fetch_git",
46-
# env=dict(url="https://github.com/maxmcd/bramble.git", cachebust=1),
47-
# )
56+
def git_test():
57+
return derivation(
58+
"git-test",
59+
"fetch_git",
60+
env=dict(url="https://github.com/maxmcd/bramble.git", cachebust=1),
61+
)
4862

4963

5064
def zig():

‎lib/go/build.sh‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
set -ex
22

3-
4-
export PATH=$stdenv/bin:$busybox/bin
53
export LD_LIBRARY_PATH=$stdenv/lib
64

75
mkdir -p /var/tmp
@@ -13,12 +11,18 @@ cd $out/go/src
1311
ls -lah ./cmd/dist
1412
export GO_LDFLAGS="-L $stdenv/lib -I $include -I $stdenv/include-glibc -I $stdenv/include"
1513
export CC="gcc -L $stdenv/lib -I $include -I $stdenv/include-glibc -I $stdenv/include -Wl,-rpath=$stdenv/lib -Wl,--dynamic-linker=$stdenv/lib/ld-linux-x86-64.so.2 "
16-
# export GOROOT_BOOTSTRAP=$(pwd)
14+
1715
export CGO_ENABLED="0"
1816
sed -i 's/set -e/set -ex/g' ./make.bash
19-
# cat ./make.bash
17+
2018
bash ./make.bash
2119

20+
21+
mkdir $out/bin
22+
cd $out/bin
23+
ln -s ../go/bin/go ./go
24+
ln -s ../go/bin/gofmt ./gofmt
25+
2226
# this works for a few things, but has trouble finding the network, resolve.conf
2327
# syslog, no go in PATH,
2428
# stat testdata/libmach8db: no such file or directory

‎notes/22-bramble-run.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
Bramble run and bramble shell
2+
3+
4+
Bramble run works to run a function, by default it takes no stdin and doesn't take the environment's variables.
5+
6+
Bramble shell runs a shell, takes environment variables from the local environment (maybe even allows RO access to $HOME??), but is not allowed for external deps.
7+
8+
9+
When either of these are called the drv $out/bin is added to the path.
10+

‎pkg/bramble/bramble.go‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
package bramble
2+
3+
import (
4+
build "github.com/maxmcd/bramble/pkg/bramblebuild"
5+
project "github.com/maxmcd/bramble/pkg/brambleproject"
6+
)
7+
8+
type bramble struct {
9+
store *build.Store
10+
project *project.Project
11+
}
12+
13+
func newBramble() (b bramble, err error) {
14+
if b.project, err = project.NewProject("."); err != nil {
15+
return
16+
}
17+
if b.store, err = build.NewStore(""); err != nil {
18+
return
19+
}
20+
b.store.RegisterGetGit(b.runGit)
21+
return b, nil
22+
}

‎pkg/bramble/build.go‎

Lines changed: 12 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -10,39 +10,28 @@ import (
1010
"github.com/pkg/errors"
1111
)
1212

13-
func runBuildFromOutput(output project.ExecModuleOutput) (outputDerivations []build.Derivation, err error) {
14-
return runBuild(func(p *project.Project) (project.ExecModuleOutput, error) {
13+
func (b bramble) runBuildFromOutput(output project.ExecModuleOutput) (outputDerivations []build.Derivation, err error) {
14+
return b.runBuild(func() (project.ExecModuleOutput, error) {
1515
return output, nil
1616
})
1717
}
1818

19-
func runBuildFromCLI(command string, args []string) (outputDerivations []build.Derivation, err error) {
20-
return runBuild(func(p *project.Project) (output project.ExecModuleOutput, err error) {
21-
return p.ExecModule(project.ExecModuleInput{
19+
func (b bramble) runBuildFromCLI(command string, args []string) (outputDerivations []build.Derivation, err error) {
20+
return b.runBuild(func() (output project.ExecModuleOutput, err error) {
21+
return b.project.ExecModule(project.ExecModuleInput{
2222
Command: command,
2323
Arguments: args,
2424
})
2525
})
2626
}
2727

28-
func runBuild(execModule func(*project.Project) (project.ExecModuleOutput, error)) (outputDerivations []build.Derivation, err error) {
29-
p, err := project.NewProject(".")
28+
func (b bramble) runBuild(execModule func() (project.ExecModuleOutput, error)) (outputDerivations []build.Derivation, err error) {
29+
output, err := execModule()
3030
if err != nil {
3131
return nil, err
3232
}
3333

34-
output, err := execModule(p)
35-
if err != nil {
36-
return nil, err
37-
}
38-
39-
store, err := build.NewStore("")
40-
if err != nil {
41-
return nil, err
42-
}
43-
store.RegisterGetGit(getGit)
44-
45-
builder := store.NewBuilder(false, p.URLHashes())
34+
builder := b.store.NewBuilder(false, b.project.URLHashes())
4635

4736
derivationIDUpdates := map[project.Dependency]build.DerivationOutput{}
4837
// allDerivations := []build.Derivation{}
@@ -63,16 +52,16 @@ func runBuild(execModule func(*project.Project) (project.ExecModuleOutput, error
6352
}
6453
derivationDataLock.Unlock()
6554

66-
source, err := store.StoreLocalSources(build.SourceFiles{
67-
ProjectLocation: p.Location(),
55+
source, err := b.store.StoreLocalSources(build.SourceFiles{
56+
ProjectLocation: b.project.Location(),
6857
Location: drv.Sources.Location,
6958
Files: drv.Sources.Files,
7059
}) // TODO: delete this if the build fails?
7160
if err != nil {
7261
return nil, errors.Wrap(err, "error moving local files to the store")
7362
}
7463

75-
_, buildDrv, err := store.NewDerivation(build.NewDerivationOptions{
64+
_, buildDrv, err := b.store.NewDerivation(build.NewDerivationOptions{
7665
Args: drv.Args,
7766
Builder: drv.Builder,
7867
Env: drv.Env,
@@ -120,7 +109,7 @@ func runBuild(execModule func(*project.Project) (project.ExecModuleOutput, error
120109
return nil, err
121110
}
122111

123-
err = p.AddURLHashesToLockfile(builder.URLHashes)
112+
err = b.project.AddURLHashesToLockfile(builder.URLHashes)
124113
if err != nil {
125114
return outputDerivations, err
126115
}

0 commit comments

Comments
 (0)