Fix the static build code in light of CVE-2022-24765 (#12683)
Also, fix handling of the source directory in the builds so that we don’t leave behind a dirty source directory.
Austin S. Hemmelgarn committed
Apr 13, 2022 at 13:27 UTC
ac0fe6cf07d613623ac1edf35c3791a1f17256a9
2 files changed
+15
-20
packaging/makeself/build-static.sh
+6
-10
@@ -45,8 +45,8 @@ if ! docker inspect "${DOCKER_CONTAINER_NAME}" > /dev/null 2>&1; then
45
run docker pull --platform=${platform} alpine:3.15
46
fi
47
48
- run docker run --platform=${platform} -v "$(pwd)":/usr/src/netdata.git:rw alpine:3.15 \
49
- /bin/sh /usr/src/netdata.git/packaging/makeself/install-alpine-packages.sh
48
+ run docker run --platform=${platform} -v "$(pwd)":/netdata:rw alpine:3.15 \
49
+ /bin/sh /netdata/packaging/makeself/install-alpine-packages.sh
50
51
# save the changes made permanently
52
id=$(docker ps -l -q)
@@ -55,15 +55,11 @@ fi
55
56
# Run the build script inside the container
57
if [ -t 1 ]; then
58
- run docker run -e BUILDARCH="${BUILDARCH}" -a stdin -a stdout -a stderr -i -t -v "$(pwd)":/usr/src/netdata.git:rw \
58
+ run docker run -e BUILDARCH="${BUILDARCH}" -a stdin -a stdout -a stderr -i -t -v "$(pwd)":/netdata:rw \
59
"${DOCKER_CONTAINER_NAME}" \
60
- /bin/sh /usr/src/netdata.git/packaging/makeself/build.sh "${@}"
60
+ /bin/sh /netdata/packaging/makeself/build.sh "${@}"
61
else
62
- run docker run -e BUILDARCH="${BUILDARCH}" -v "$(pwd)":/usr/src/netdata.git:rw \
62
+ run docker run -e BUILDARCH="${BUILDARCH}" -v "$(pwd)":/netdata:rw \
63
-e GITHUB_ACTIONS="${GITHUB_ACTIONS}" "${DOCKER_CONTAINER_NAME}" \
64
- /bin/sh /usr/src/netdata.git/packaging/makeself/build.sh "${@}"
65
-fi
66
-
67
-if [ "${USER}" ]; then
68
- sudo chown -R "${USER}" .
64
+ /bin/sh /netdata/packaging/makeself/build.sh "${@}"
65
fi
packaging/makeself/build.sh
+9
-10
@@ -27,16 +27,11 @@ done
27
# the required packages. build-x86_64-static.sh will do this for you
28
# using docker.
29
30
-cd "$(dirname "$0")" || exit 1
31
-
32
-# if we don't run inside the netdata repo
33
-# download it and run from it
34
-if [ ! -f ../../netdata-installer.sh ]; then
35
- git clone https://github.com/netdata/netdata.git netdata.git || exit 1
36
- cd netdata.git/makeself || exit 1
37
- ./build.sh "$@"
38
- exit $?
39
-fi
30
+mkdir -p /usr/src
31
+cp -va /netdata /usr/src/netdata
32
+chown -R root:root /usr/src/netdata
33
+
34
+cd /usr/src/netdata/packaging/makeself || exit 1
35
36
git clean -dxf
37
git submodule foreach --recursive git clean -dxf
@@ -64,3 +59,7 @@ if ! ./run-all-jobs.sh "$@"; then
59
printf >&2 "Build failed."
60
exit 1
61
fi
62
+
63
+mkdir -p /netdata/artifacts
64
+cp -va /usr/src/netdata/artifacts/* /netdata/artifacts/
65
+chown -R "$(stat -c '%u:%g' /netdata)" /netdata/artifacts/