Add reproducible build system, native Unraid plugin, and WebUI
- versions.env pins podman, conmon, crun, netavark, aardvark-dns, passt, and fuse-overlayfs to verified upstream source checksums; SlackBuild recipes, scripts/build-packages.sh, checksums.sh, release.sh, and update-versions.sh implement the reproducible pipeline; GitHub Actions workflows build in a Slackware container and publish releases without committing any binaries. - plugin/podman.plg installs/updates/removes all eight packages (the seven components plus the plugin's own unraid-podman scaffolding package) via upgradepkg, using the official Unraid array-event hook mechanism (event/disks_mounted, event/stopping) instead of editing /boot/config/go. rc.podman and the sbin/ helper scripts implement storage creation, config seeding/sync, preflight checks, autostart with per-container Safe-Mode, and package verify/update/rollback. - webui/plugins/podman implements the Dashboard, Containers, Pods, Images, Volumes, Networks, Logs, Terminal, Compose, and Settings panels against the approved mockup (webui/mockups/prototype.html), talking to podman system service exclusively via PodmanClient.php (libpod REST API over the Unix socket), with two documented exceptions: Terminal's one-shot exec model and Compose's use of the podman compose CLI, since libpod has no REST equivalent for either. - docs/ARCHITECTURE.md and docs/ROADMAP.md record the design decisions and honest current status (syntax-checked, unit- and integration-tested against fake sockets/servers; not yet run against a real Unraid/Podman/Slackware system). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Claude Sonnet 5
Executable
+176
@@ -0,0 +1,176 @@
|
||||
#!/bin/bash
|
||||
# =============================================================================
|
||||
# scripts/lib/slackbuild-common.sh
|
||||
#
|
||||
# Shared helper functions sourced by every packages/*/*.SlackBuild script.
|
||||
# Centralizing this logic means each individual SlackBuild only has to
|
||||
# describe *how to compile* its component — fetching, checksum verification,
|
||||
# and final .txz packaging are implemented once, here, and used the same way
|
||||
# by all seven packages. This is what keeps the seven build scripts
|
||||
# consistent and short instead of each reinventing (and potentially
|
||||
# forgetting) checksum verification or Slackware package metadata.
|
||||
#
|
||||
# Every SlackBuild is expected to:
|
||||
# 1. `. "$(dirname "$0")/../../scripts/lib/slackbuild-common.sh"`
|
||||
# 2. `. "$(dirname "$0")/../../versions.env"`
|
||||
# 3. Call sb_init, sb_fetch_and_verify, do its own compile steps into
|
||||
# $PKG, then call sb_make_package.
|
||||
#
|
||||
# Not meant to be run directly.
|
||||
# =============================================================================
|
||||
|
||||
set -eu
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# sb_init <pkg-name>
|
||||
#
|
||||
# Sets up the standard SlackBuild working directories and exports the
|
||||
# variables every subsequent helper (and the calling SlackBuild) relies on:
|
||||
# CWD - directory the SlackBuild itself lives in (packages/<name>/)
|
||||
# TMP - scratch/build directory (source is extracted and compiled here)
|
||||
# PKG - staging directory that becomes the .txz payload
|
||||
# OUTPUT - where the finished .txz + checksum files are written
|
||||
# All three of TMP/PKG/OUTPUT are safe to delete/recreate; nothing outside
|
||||
# of them is ever touched, and nothing under them is ever committed to git
|
||||
# (see .gitignore: packages/**/src, packages/**/pkg, packages/**/work).
|
||||
# -----------------------------------------------------------------------------
|
||||
sb_init() {
|
||||
local pkg_name="$1"
|
||||
|
||||
PRGNAM="$pkg_name"
|
||||
CWD="$(cd "$(dirname "${BASH_SOURCE[1]}")" && pwd)"
|
||||
TMP="${TMP:-$CWD/work}"
|
||||
PKG="${PKG:-$TMP/package-$PRGNAM}"
|
||||
OUTPUT="${OUTPUT:-$CWD/../../dist}"
|
||||
|
||||
export PRGNAM CWD TMP PKG OUTPUT
|
||||
|
||||
rm -rf "$TMP"
|
||||
mkdir -p "$TMP" "$PKG" "$OUTPUT"
|
||||
|
||||
echo "==> [$PRGNAM] TMP=$TMP"
|
||||
echo "==> [$PRGNAM] PKG=$PKG"
|
||||
echo "==> [$PRGNAM] OUTPUT=$OUTPUT"
|
||||
}
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# sb_fetch_and_verify <url> <expected-sha256> <dest-filename>
|
||||
#
|
||||
# Downloads a source tarball into $TMP and verifies it against the SHA256
|
||||
# pinned in versions.env before anything is extracted or built. Aborts the
|
||||
# build loudly on any mismatch — a checksum mismatch means either
|
||||
# versions.env is stale (a legitimate new upstream release) or the source is
|
||||
# not what it claims to be; either way, an unreviewed build must not proceed.
|
||||
# -----------------------------------------------------------------------------
|
||||
sb_fetch_and_verify() {
|
||||
local url="$1"
|
||||
local expected_sha256="$2"
|
||||
local dest_name="$3"
|
||||
local dest_path="$TMP/$dest_name"
|
||||
|
||||
echo "==> [$PRGNAM] Fetching $url"
|
||||
curl -fL --retry 3 --retry-delay 2 -o "$dest_path" "$url"
|
||||
|
||||
local actual_sha256
|
||||
actual_sha256=$(sha256sum "$dest_path" | awk '{print $1}')
|
||||
|
||||
if [ "$actual_sha256" != "$expected_sha256" ]; then
|
||||
echo "!! [$PRGNAM] SHA256 MISMATCH for $dest_name" >&2
|
||||
echo "!! expected: $expected_sha256" >&2
|
||||
echo "!! actual: $actual_sha256" >&2
|
||||
echo "!! Refusing to build against unverified source. If upstream" >&2
|
||||
echo "!! genuinely released a new version, update versions.env via" >&2
|
||||
echo "!! scripts/update-versions.sh instead of editing the hash by hand." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "==> [$PRGNAM] SHA256 verified ($actual_sha256)"
|
||||
echo "$dest_path"
|
||||
}
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# sb_extract <tarball-path> [strip-components]
|
||||
#
|
||||
# Extracts a verified tarball into $TMP/src, normalizing away the
|
||||
# "<repo>-<version>/" wrapper directory GitHub/cgit archives always contain,
|
||||
# so every SlackBuild can `cd "$TMP/src"` regardless of upstream's archive
|
||||
# layout.
|
||||
# -----------------------------------------------------------------------------
|
||||
sb_extract() {
|
||||
local tarball="$1"
|
||||
local strip="${2:-1}"
|
||||
|
||||
mkdir -p "$TMP/src"
|
||||
tar -xf "$tarball" -C "$TMP/src" --strip-components="$strip"
|
||||
echo "$TMP/src"
|
||||
}
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# sb_install_docs <license-file> [readme-file]
|
||||
#
|
||||
# Installs upstream's license (and optionally README) into the standard
|
||||
# Slackware package documentation location, plus this project's own build
|
||||
# metadata, so `installpkg` output and /usr/doc/<pkg>-<version>/ are
|
||||
# populated per Slackware convention.
|
||||
# -----------------------------------------------------------------------------
|
||||
sb_install_docs() {
|
||||
local license_file="$1"
|
||||
local readme_file="${2:-}"
|
||||
local docdir="$PKG/usr/doc/$PRGNAM-$VERSION"
|
||||
|
||||
mkdir -p "$docdir"
|
||||
[ -f "$license_file" ] && cp "$license_file" "$docdir/"
|
||||
[ -n "$readme_file" ] && [ -f "$readme_file" ] && cp "$readme_file" "$docdir/"
|
||||
|
||||
{
|
||||
echo "Built by unraid-podman from upstream source."
|
||||
echo "Package: $PRGNAM $VERSION"
|
||||
echo "Built: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||
} > "$docdir/unraid-podman.build-info"
|
||||
}
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# sb_make_package
|
||||
#
|
||||
# Finalizes the Slackware package: installs slack-desc + doinst.sh (if
|
||||
# present) into $PKG/install/, strips binaries, sets root:root ownership,
|
||||
# runs makepkg to produce the .txz, then writes SHA256 + MD5 sidecar files
|
||||
# next to it.
|
||||
#
|
||||
# - SHA256 is used by scripts/build-packages.sh / CI to verify build
|
||||
# artifacts between jobs.
|
||||
# - MD5 is additionally generated because Unraid's .plg <FILE> mechanism
|
||||
# verifies downloads via MD5 by convention (see
|
||||
# docs/ARCHITECTURE.md section 3.2) — scripts/release.sh reads the .md5
|
||||
# file to populate plugin/podman.plg's entities.
|
||||
#
|
||||
# Produces: $OUTPUT/<name>-<version>-<arch>-<build><tag>.txz (+ .sha256, .md5)
|
||||
# -----------------------------------------------------------------------------
|
||||
sb_make_package() {
|
||||
local version="$1"
|
||||
local arch="$2"
|
||||
local build="$3"
|
||||
local tag="$4"
|
||||
|
||||
mkdir -p "$PKG/install"
|
||||
if [ -f "$CWD/slack-desc" ]; then
|
||||
cp "$CWD/slack-desc" "$PKG/install/slack-desc"
|
||||
else
|
||||
echo "!! [$PRGNAM] missing packages/$PRGNAM/slack-desc" >&2
|
||||
exit 1
|
||||
fi
|
||||
[ -f "$CWD/doinst.sh" ] && cp "$CWD/doinst.sh" "$PKG/install/doinst.sh"
|
||||
|
||||
# Strip debug symbols where possible to keep package size down; ignore
|
||||
# failures (e.g. static/stripped-already binaries, non-ELF files).
|
||||
find "$PKG" -type f \( -perm -u+x -o -name '*.so*' \) -exec sh -c \
|
||||
'file "$1" | grep -q ELF && strip --strip-unneeded "$1" 2>/dev/null || true' _ {} \;
|
||||
|
||||
local pkg_file="$PRGNAM-$version-$arch-$build$tag.txz"
|
||||
( cd "$PKG" && makepkg --linkadd y --chown y "$OUTPUT/$pkg_file" )
|
||||
|
||||
( cd "$OUTPUT" && sha256sum "$pkg_file" > "$pkg_file.sha256" )
|
||||
( cd "$OUTPUT" && md5sum "$pkg_file" > "$pkg_file.md5" )
|
||||
|
||||
echo "==> [$PRGNAM] built $OUTPUT/$pkg_file"
|
||||
}
|
||||
Reference in New Issue
Block a user