deb: test deb package by piuparts #164

kenhys · 2020-08-04T04:57:32Z

No description provided.

cosmo0920 · 2020-08-04T05:31:49Z

Due to this line:
https://github.com/fluent-plugins-nursery/td-agent-builder/blob/master/td-agent/apt/debian-buster/Dockerfile#L53
We need to execute apt update before installing package with apt.

cosmo0920 · 2020-08-04T05:49:03Z

Oh, piuparts! I got it.

kenhys · 2020-08-04T05:58:01Z

Piuparts caught exception, exiting...
------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/sbin/piuparts", line 3260, in <module>
    main()
  File "/usr/sbin/piuparts", line 3252, in main
    process_packages(regular_packages_list)
  File "/usr/sbin/piuparts", line 3147, in process_packages
    chroot.create()
  File "/usr/sbin/piuparts", line 779, in create
    self.create_temp_dir()
  File "/usr/sbin/piuparts", line 770, in create_temp_dir
    self.name = tempfile.mkdtemp(dir=settings.tmpdir)
  File "/usr/lib/python2.7/tempfile.py", line 339, in mkdtemp
    _os.mkdir(file, 0700)
OSError: [Errno 30] Read-only file system: '/fluentd/td-agent/apt/repositories/debian/pool/buster/main/t/td-agent/tmpQSOYEP'
------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/sbin/piuparts", line 3274, in <module>
    panic(1)
  File "/usr/sbin/piuparts", line 490, in panic

fails.

kenhys · 2020-08-04T06:00:59Z

it may be succeed when not to use /fluentd/ (guess)

cosmo0920 · 2020-08-05T01:42:38Z

Yep. piuparts can be started with this commit:1fb99a5

https://github.com/fluent-plugins-nursery/td-agent-builder/pull/164/checks?check_run_id=947401707#step:6:1687

kenhys · 2020-08-06T00:17:23Z

https://github.com/fluent-plugins-nursery/td-agent-builder/pull/164/checks?check_run_id=947531443

  E: Release signed by unknown key (key id 901F9177AB97ACBE)
     The specified keyring /usr/share/keyrings/debian-archive-keyring.gpg may be incorrect or out of date.
     You can find the latest Debian release key at https://ftp-master.debian.org/keys.html

kenhys · 2020-08-06T00:22:08Z

It may be caused by old keyring.
https://packages.ubuntu.com/search?suite=bionic&searchon=names&keywords=debian-archive-keyring bionic 2017.7ubuntu1: all
https://packages.debian.org/search?suite=buster&searchon=names&keywords=debian-archive-keyring buster 2019.1: all

kenhys · 2020-08-06T00:26:22Z

It may be caused by old keyring.
https://packages.ubuntu.com/search?suite=bionic&searchon=names&keywords=debian-archive-keyring bionic 2017.7ubuntu1: all
https://packages.debian.org/search?suite=buster&searchon=names&keywords=debian-archive-keyring buster 2019.1: all

fetch buster keyring package
--privileged mode?

cosmo0920 · 2020-08-06T00:34:25Z

Really? 901F9177AB97ACBE should not be included debian keyring.
It is Treasure Data key.

% gpg --search-keys 901F9177AB97ACBE                                                     
gpg: data source: http://keys.gnupg.net:11371
(1)	Treasure Data, Inc (Treasure Agent Official Signing key) <support@trea
	  4096 bit RSA key 901F9177AB97ACBE, 作成: 2016-12-27
Keys 1-1 of 1 for "901F9177AB97ACBE".  番号(s)、N)次、またはQ)中止を入力してください > q
gpg: error searching keyserver: 操作がキャンセルされました

% gpg --recv-key 901F9177AB97ACBE
gpg: 鍵901F9177AB97ACBE: 公開鍵"Treasure Data, Inc (Treasure Agent Official Signing key) <support@treasure-data.com>"をインポートしました
gpg: 処理数の合計: 1
gpg:               インポート: 1

kenhys · 2020-08-06T00:38:57Z

Oh,

Really? 901F9177AB97ACBE should not be included debian keyring.
It is Treasure Data key.

I've overlooked it, thanks!

kenhys · 2020-08-06T00:46:56Z

So, I need to prepare Treasure Data key
https://docs.fluentd.org/installation/install-by-deb

kenhys · 2020-08-06T00:59:54Z

curl https://packages.treasuredata.com/GPG-KEY-td-agent

kenhys · 2020-08-06T01:07:28Z

NOTE: apt-key will be removed in the future release

apt (2.1.8) unstable; urgency=medium
    
     [ Julian Andres Klode ]
    * Fully deprecate apt-key, schedule removal for Q2/2022

buster is not affected, but bullseye (Debian 11), it will not available anymore.

kenhys · 2020-08-06T02:24:16Z

piuparts runnning with Treasure Data key, but it shoots eatmydata issue.

0m0.0s DEBUG: Starting command: ['debootstrap', '--variant=minbase', '--keyring=/usr/share/keyrings/td-agent-archive-keryring.gpg', '--include=eatmydata', '--no-merged-usr', '--components=buster,contrib', 'buster', '/tmp/tmp0W0uoB', 'http://packages.treasuredata.com/4/debian/buster/']
0m0.4s DUMP: 
  I: Target architecture can be executed
  I: Retrieving InRelease 
  I: Checking Release signature
  I: Valid Release signature (key id BEE682289B2217F45AF4CC3F901F9177AB97ACBE)
  I: Retrieving Packages 
  I: Validating Packages 
  I: Resolving dependencies of required packages...
  I: Resolving dependencies of base packages...
  I: Checking component contrib on http://packages.treasuredata.com/4/debian/buster...
  E: Couldn't find these debs: eatmydata apt
0m0.4s ERROR: Command failed (status=1): ['debootstrap', '--variant=minbase', '--keyring=/usr/share/keyrings/td-agent-archive-keryring.gpg', '--include=eatmydata', '--no-merged-usr', '--components=buster,contrib', 'buster', '/tmp/tmp0W0uoB', 'http://packages.treasuredata.com/4/debian/buster/']
  I: Target architecture can be executed
  I: Retrieving InRelease

kenhys · 2020-08-06T02:51:10Z

It seems that official mirror is mising.

kenhys · 2020-08-06T03:11:17Z

Selecting previously unselected package libeatmydata1:amd64.
Preparing to unpack .../38-libeatmydata1_105-7_amd64.deb ...
Unpacking libeatmydata1:amd64 (105-7) ...
Selecting previously unselected package eatmydata.
Preparing to unpack .../39-eatmydata_105-7_all.deb ...
Unpacking eatmydata (105-7) ...

eatmydata is installed.

kenhys · 2020-08-06T03:42:52Z

piuparts(1) says: "Only the first mirror is used with debootstrap."

kenhys · 2020-08-06T04:46:07Z

0m41.3s DEBUG: Command ok: ['debootstrap', '--variant=minbase', '--keyring=/usr/share/keyrings/debian-archive-keyring.gpg', '--no-merged-usr', '--components=buster,main,main', 'buster', '/tmp/tmphFdPA0', 'http://deb.debian.org/debian']
0m41.3s DEBUG: Starting command: ['mount', '-t', 'proc', 'proc', '/tmp/tmphFdPA0/proc']
0m41.3s DUMP: 
  mount: /tmp/tmphFdPA0/proc: permission denied.
0m41.3s ERROR: Command failed (status=32): ['mount', '-t', 'proc', 'proc', '/tmp/tmphFdPA0/proc']
  mount: /tmp/tmphFdPA0/proc: permission denied.

found permission issue

kenhys · 2020-08-06T04:58:18Z

It requires --priviledged.

.github/workflows/apt.yml

kenhys · 2020-08-06T05:48:49Z

piuparts works (even though it fails)

0m43.4s DEBUG: Starting command: ['umount', '/tmp/tmpikq4F6/dev/shm']
0m43.4s DEBUG: Command ok: ['umount', '/tmp/tmpikq4F6/dev/shm']
0m43.4s DEBUG: Starting command: ['umount', '/tmp/tmpikq4F6/dev/console']
0m43.4s DEBUG: Command ok: ['umount', '/tmp/tmpikq4F6/dev/console']
0m43.4s DEBUG: Starting command: ['umount', '/tmp/tmpikq4F6/dev/ptmx']
0m43.4s DEBUG: Command ok: ['umount', '/tmp/tmpikq4F6/dev/ptmx']
0m43.4s DEBUG: Starting command: ['umount', '/tmp/tmpikq4F6/dev/pts']
0m43.4s DEBUG: Command ok: ['umount', '/tmp/tmpikq4F6/dev/pts']
0m43.4s DEBUG: Starting command: ['umount', '/tmp/tmpikq4F6/proc']
0m43.4s DEBUG: Command ok: ['umount', '/tmp/tmpikq4F6/proc']
0m43.4s DEBUG: Starting command: ['rm', '-rf', '--one-file-system', '/tmp/tmpikq4F6']
0m43.6s DEBUG: Command ok: ['rm', '-rf', '--one-file-system', '/tmp/tmpikq4F6']
0m43.6s DEBUG: Removed directory tree at /tmp/tmpikq4F6
0m43.6s ERROR: piuparts run ends.
##[error]Process completed with exit code 1.

kenhys · 2020-08-06T05:49:03Z

Use /etc/apt/trusted.gpg.d/.

kenhys · 2020-08-06T06:03:36Z

To enable additional keyring, use debootstrap in advance.

kenhys · 2020-08-07T01:01:15Z

   
  The following packages have unmet dependencies:
   td-agent : Depends: libyaml-0-2 but it is not installable
  E: Unable to correct problems, you have held broken packages.
0m5.2s ERROR: Command failed (status=100): ['chroot', '/tmp/tmpTYY4wQ', 'apt-get', '-y', '--allow-downgrades', 'install', './tmp/td-agent-dbgsym_4.0.0-1_amd64.deb', './tmp/td-agent_4.0.0-1_amd64.deb']
  Reading package lists...
  Building dependency tree...
  Some packages could not be installed. This may mean that you have
  requested an impossible situation or if you are using the unstable
  distribution that some required packages have not yet been created
  or been moved out of Incoming.
  The following information may help to resolve the situation:
  
  The following packages have unmet dependencies:
   td-agent : Depends: libyaml-0-2 but it is not installable
  E: Unable to correct problems, you have held broken packages.

It seems that keyring issue was fixed.

kenhys · 2020-08-07T01:12:05Z

It will be fixed runtime dependency is installed in advance.

td-agent/apt/install-test.sh

kenhys · 2020-08-07T01:59:11Z

It seems that chroot /var/lib/chroot/buster-root/ apt install -y libyaml-0-2 will work.

kenhys · 2020-08-07T04:08:09Z

2020-08-07T02:12:16.8293296Z 0m14.8s DEBUG: Starting command: ['chroot', '/tmp/tmpxGttLP', '/usr/sbin/logrotate', '/etc/logrotate.d/td-agent']
2020-08-07T02:12:16.8311096Z 0m14.8s DUMP: 
2020-08-07T02:12:16.8311800Z   error: stat of /var/log/td-agent/td-agent.log failed: No such file or directory

lotating failure.

There are some pitfall to achieve * use --priviledged to allow debootstrap * deb is copied into /tmp because /fluentd/ is read-only file system. * keyring must be created by gnupg1 because gnupg2 default keyring format is changed to keybox.

cosmo0920 · 2020-08-07T07:39:30Z

Ubuntu Focal jobs was stuck due to interactive selections:

debconf: falling back to frontend: Readline
Configuring tzdata
------------------

Please select the geographic area in which you live. Subsequent configuration
questions will narrow this down by presenting a list of cities, representing
the time zones in which they are located.

  1. Africa      4. Australia  7. Atlantic  10. Pacific  13. Etc
  2. America     5. Arctic     8. Europe    11. SystemV
  3. Antarctica  6. Asia       9. Indian    12. US
##[error]The operation was canceled.

ref: https://github.com/fluent-plugins-nursery/td-agent-builder/runs/956381796?check_suite_focus=true#step:6:1953

How can we solve this?

kenhys · 2020-08-11T01:59:23Z

0m15.2s ERROR: FAIL: Package purging left files on system:
  /etc/td-agent/	 owned by: td-agent
  /etc/td-agent/plugin/	 not owned
  /var/log/td-agent/	 not owned

above issue was fixed.

kenhys · 2020-08-11T02:00:06Z

0m17.7s ERROR: FAIL: After purging files have disappeared:
  /opt/	 owned by: td-agent

above error still happens. It is strage.

kenhys · 2020-08-11T02:33:18Z

mkdir -p /opt/ in postrm pass piuparts test , but I'm no willing to do it.

kenhys · 2020-08-11T02:53:55Z

2020-08-11T02:44:28.1562383Z + ls /var/lib/chroot/buster-root/
2020-08-11T02:44:28.1573877Z bin   dev  home  lib32	libx32	mnt  proc  run	 srv  tmp  var
2020-08-11T02:44:28.1577642Z boot  etc  lib	 lib64	media	opt  root  sbin  sys  usr
2020-08-11T02:44:28.1578501Z + piuparts --distribution=buster --existing-chroot=/var/lib/chroot/buster-root --keyring=/usr/share/keyrings/td-agent-archive-keyring.gpg '--mirror=http://packages.treasuredata.com/4/debian/buster/ buster contrib' --skip-logrotatefiles-test --warn-on-leftovers-after-purge /tmp/td-agent-dbgsym_4.0.0-1_amd64.deb /tmp/td-agent_4.0.0-1_amd64.deb

before runnning piuparts, opt is already created.

kenhys · 2020-08-11T04:13:10Z

bionic debootstrap: security update is not applied?

kenhys · 2020-08-11T04:23:19Z

On bionic chroot, there is no security updates:

  # cat chroot/bionic-root/etc/apt/sources.list 
  deb http://archive.ubuntu.com/ubuntu bionic main

kenhys · 2020-08-11T04:52:28Z

suppress manual configuration via noninteractive when tzdata is installed.

Because libssl-dev depends on libssl1.1.

Signed-off-by: Kentaro Hayashi <hayashi@clear-code.com>

piuparts detects /opt is missing

Without this fix, tzdata reconfigure is executed unexpectedly

kenhys · 2020-08-12T02:31:23Z

@ashie could you review this PR, please?

td-agent/templates/package-scripts/td-agent/deb/postrm

td-agent/apt/install-test.sh

kenhys force-pushed the use-piuparts branch from fd73a8c to 4745fd9 Compare August 4, 2020 05:34

cosmo0920 force-pushed the use-piuparts branch from 330bdd3 to 1fb99a5 Compare August 5, 2020 01:28

cosmo0920 reviewed Aug 6, 2020

View reviewed changes

.github/workflows/apt.yml Outdated Show resolved Hide resolved

cosmo0920 reviewed Aug 7, 2020

View reviewed changes

td-agent/apt/install-test.sh Outdated Show resolved Hide resolved

deb: test deb package by piuparts

0fdd04a

There are some pitfall to achieve * use --priviledged to allow debootstrap * deb is copied into /tmp because /fluentd/ is read-only file system. * keyring must be created by gnupg1 because gnupg2 default keyring format is changed to keybox.

kenhys force-pushed the use-piuparts branch 2 times, most recently from a493c27 to 8e8607f Compare August 7, 2020 06:38

kenhys force-pushed the use-piuparts branch from ef86ea6 to d002570 Compare August 11, 2020 01:52

kenhys force-pushed the use-piuparts branch from 55d46d3 to c06c251 Compare August 11, 2020 02:32

kenhys force-pushed the use-piuparts branch from c06c251 to 3a65cfe Compare August 11, 2020 02:55

kenhys force-pushed the use-piuparts branch from 96b0e6d to 9f95350 Compare August 11, 2020 04:42

kenhys marked this pull request as ready for review August 11, 2020 04:52

kenhys added 5 commits August 12, 2020 10:27

deb: install libssl1.1 explicitly for testing

74614ca

Because libssl-dev depends on libssl1.1.

deb: remove dpkg-statoverrides configuration in advance

dd44906

Signed-off-by: Kentaro Hayashi <hayashi@clear-code.com>

deb: ensure to purge completely

17468af

Signed-off-by: Kentaro Hayashi <hayashi@clear-code.com>

deb: remove $CHROOT/opt in advance

3ea004e

piuparts detects /opt is missing

deb: try to set nonintractive on focal

6573932

Without this fix, tzdata reconfigure is executed unexpectedly

kenhys force-pushed the use-piuparts branch from ef9e0dd to 6573932 Compare August 12, 2020 01:31

kenhys requested a review from ashie August 12, 2020 02:14

ashie requested changes Aug 12, 2020

View reviewed changes

td-agent/templates/package-scripts/td-agent/deb/postrm Outdated Show resolved Hide resolved

td-agent/apt/install-test.sh Outdated Show resolved Hide resolved

kenhys added 2 commits August 13, 2020 09:15

deb: align indent

1144af5

deb: unify DEBIAN_FRONTEND=noninteractive block

d8bd078

ashie merged commit d4ad01c into master Aug 13, 2020

ashie deleted the use-piuparts branch August 13, 2020 01:38

kenhys mentioned this pull request Aug 13, 2020

CI: Introduce piuparts on Debian to reduce deb package regression #148

Closed

deb: test deb package by piuparts #164

deb: test deb package by piuparts #164

Conversation

kenhys commented Aug 4, 2020

cosmo0920 commented Aug 4, 2020

cosmo0920 commented Aug 4, 2020

kenhys commented Aug 4, 2020

kenhys commented Aug 4, 2020 • edited Loading

cosmo0920 commented Aug 5, 2020

kenhys commented Aug 6, 2020

kenhys commented Aug 6, 2020

kenhys commented Aug 6, 2020

cosmo0920 commented Aug 6, 2020

kenhys commented Aug 6, 2020

kenhys commented Aug 6, 2020

kenhys commented Aug 6, 2020

kenhys commented Aug 6, 2020

kenhys commented Aug 6, 2020

kenhys commented Aug 6, 2020

kenhys commented Aug 6, 2020

kenhys commented Aug 6, 2020

kenhys commented Aug 6, 2020

kenhys commented Aug 6, 2020

kenhys commented Aug 6, 2020

kenhys commented Aug 6, 2020

kenhys commented Aug 6, 2020

kenhys commented Aug 7, 2020

kenhys commented Aug 7, 2020

kenhys commented Aug 7, 2020

kenhys commented Aug 7, 2020

cosmo0920 commented Aug 7, 2020

kenhys commented Aug 11, 2020

kenhys commented Aug 11, 2020

kenhys commented Aug 11, 2020

kenhys commented Aug 11, 2020

kenhys commented Aug 11, 2020

kenhys commented Aug 11, 2020

kenhys commented Aug 11, 2020

kenhys commented Aug 12, 2020

kenhys commented Aug 4, 2020 •

edited

Loading