Commit 4d9a878b authored by Jérome Perrin's avatar Jérome Perrin

component/ca-certificates: don't use implicit `python`

We can not rely on system python here, it's a bit better to rely on
buildout's python ( the main reason is that it complies with
slapos-sr-testing not having system python ).

The implementation is a bit complicated, we can not just reference
${buildout:executable} in the profile, because doing so will cause an
infinite loop with rebootstrap and software installation never finish
because options of ca-certificates change at every run if they include
the python path. Instead, we use a pre-make-hook to rewrite the Makefile
without saving the interpreter in option. This python is only used
during the build process (to generate the certificate files) and not
used at run time, so it does not really depend on python strictly
speaking. Anyway, because it's a component used very early in the
bootstrap, we can not reference python here.
parent 3e154810
...@@ -16,7 +16,7 @@ url = https://deb.debian.org/debian/pool/main/c/ca-certificates/ca-certificates_ ...@@ -16,7 +16,7 @@ url = https://deb.debian.org/debian/pool/main/c/ca-certificates/ca-certificates_
md5sum = fc1c3ec0067385f0be8ac7f6e670a0f8 md5sum = fc1c3ec0067385f0be8ac7f6e670a0f8
patch-binary = ${patch:location}/bin/patch patch-binary = ${patch:location}/bin/patch
patches = patches =
${:_profile_base_location_}/ca-certificates-any-python.patch#c13b44dfc3157dda13a9a2ff97a9d501 ${:_profile_base_location_}/ca-certificates-any-python.patch#a5817d1b7162f8f814960f72c747e3af
${:_profile_base_location_}/ca-certificates-mkdir-p.patch#02ed8a6d60c39c4b088657888af345ef ${:_profile_base_location_}/ca-certificates-mkdir-p.patch#02ed8a6d60c39c4b088657888af345ef
${:_profile_base_location_}/ca-certificates-no-cryptography.patch#14ad1308623b0d15420906ae3d9b4867 ${:_profile_base_location_}/ca-certificates-no-cryptography.patch#14ad1308623b0d15420906ae3d9b4867
patch-options = -p0 patch-options = -p0
...@@ -24,3 +24,5 @@ configure-command = true ...@@ -24,3 +24,5 @@ configure-command = true
make-targets = install DESTDIR=@@LOCATION@@ CERTSDIR=certs SBINDIR=sbin make-targets = install DESTDIR=@@LOCATION@@ CERTSDIR=certs SBINDIR=sbin
environment = environment =
PATH=${xz-utils:location}/bin:%(PATH)s PATH=${xz-utils:location}/bin:%(PATH)s
pre-make-hook =
${:_profile_base_location_}/ca-certificates-pre-make-hook.py#9e2f6f22d91ea7a089f0ea2c523b0c1e:pre_make_hook
...@@ -11,13 +11,12 @@ ...@@ -11,13 +11,12 @@
if line.startswith('CKA_CLASS'): if line.startswith('CKA_CLASS'):
--- mozilla/Makefile 2015-12-20 10:49:23.000000000 +0100 --- mozilla/Makefile 2015-12-20 10:49:23.000000000 +0100
+++ mozilla/Makefile 2016-01-05 20:19:11.006874271 +0100 +++ mozilla/Makefile 2016-01-05 20:19:11.006874271 +0100
@@ -3,7 +3,8 @@ @@ -3,7 +3,7 @@
# #
all: all:
- python3 certdata2pem.py - python3 certdata2pem.py
+ for x in 3 '' 2; do type python$$x && break; done >/dev/null \ + SLAPOS_BUILDOUT_PYTHON certdata2pem.py
+ && python$$x certdata2pem.py
clean: clean:
-rm -f *.crt -rm -f *.crt
import pathlib
import sys
def pre_make_hook(options, buildout, environ):
makefile = pathlib.Path('mozilla/Makefile')
txt = makefile.read_text().replace('SLAPOS_BUILDOUT_PYTHON', sys.executable)
makefile.write_text(txt)
  • Instead of a hook (that currently doesn't work with Python 2) and a patch, can you change to use pre-build = sed -i 's \bpython3\b ${buildout:executable} ' mozilla/Makefile (not tested) ?

    Edited by Julien Muchembled
  • this hooks runs with slapos buildout that is nowadays always python3, but that's right that a simple sed is easier, I'll try that, thanks

  • ah no, I remember, it's not OK to reference ${buildout:executable}, because it makes the part depend on python after rebootstrap and it rebootstraps for ever

  • this hooks runs with slapos buildout that is nowadays always python3

    That's not the case for ERP5.PerformanceTest-Master with is failing in loop for hours.

    ah no, I remember, it's not OK to reference ${buildout:executable}, because it makes the part depend on python after rebootstrap and it rebootstraps for ever

    Oops, I read too fast the commit message.

    Then let's still drop the patch but change the hook as follows (not tested):

    import re
    import sys
    
    def pre_make_hook(options, buildout, environ):
        with open('mozilla/Makefile', 'r+') as f:
            x = re.sub(r'\bpython3\b', sys.executable, f.read())
            f.seek(0)
            f.write(x)
            f.truncate()
    Edited by Julien Muchembled
  • oh I did not notice the testnode of ERP5.PerformanceTest-Master was not on "auto-upgrade", I changed this ( cc @tomo ), in theory, it should be OK soon. In a sense, this is good, this detects old slapos node that we forgot to update

  • but I'll implement this suggestion, it's silly to keep the patch now that we have the make hook and we don't really need to write this in python3 only, I did not think, I just like pathlib nowadays

Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment