From 36057b098a8f6fc91ec44cd5dc50e3791aa1692d Mon Sep 17 00:00:00 2001 From: Craig Comstock Date: Fri, 31 Oct 2025 09:06:20 -0500 Subject: [PATCH 1/2] Fixed build host setup chicken/egg logic Made the logic more clear to try quickinstall script, cf-remote and finally build from source. Ticket: ENT-13016 Changelog: none --- ci/setup-cfengine-build-host.sh | 76 ++++++++++++++++----------------- 1 file changed, 36 insertions(+), 40 deletions(-) diff --git a/ci/setup-cfengine-build-host.sh b/ci/setup-cfengine-build-host.sh index 8dc21c694..d2e9896a7 100755 --- a/ci/setup-cfengine-build-host.sh +++ b/ci/setup-cfengine-build-host.sh @@ -29,7 +29,7 @@ elif [ -f /etc/os-release ]; then fi fi if [ "$ID" = "ubuntu" ]; then - _version=$(echo $VERSION_ID | cut -d. -f1) + _version=$(echo "$VERSION_ID" | cut -d. -f1) if [ "$_version" -lt "16" ]; then echo "Platform $ID $VERSION_ID is too old." exit 9 @@ -54,16 +54,6 @@ fi mkdir -p /home/jenkins chown -R jenkins /home/jenkins -echo "checking for CFEngine install..." -if [ -d /var/cfengine ]; then - echo "Found CFEngine install at /var/cfengine" - if ! /var/cfengine/bin/cf-agent -V; then - echo "Failed to run cf-agent -V, will exit." - exit 1 - fi - echo "Found working cf-agent. Will proceed." -fi - function cleanup() { set -ex @@ -105,7 +95,6 @@ trap cleanup ERR trap cleanup SIGINT trap cleanup SIGTERM - echo "Using buildscripts commit:" # we have very old platforms with old git that doesn't understand -C option so cd/cd .. it is cd buildscripts @@ -122,7 +111,7 @@ if [ -d /home/jenkins/buildscripts/.git ]; then fi cd .. -echo "Install any distribution upgrades" +echo "Install distribution upgrades and set software alias for platform" if [ -f /etc/os-release ]; then if grep rhel /etc/os-release; then yum update --assumeyes @@ -153,37 +142,43 @@ else echo "Error: need something to fetch URLs. Didn't find either wget or curl." exit 1 fi -if grep -i suse /etc/os-release; then - # need to add our public key first otherwise zypper install fails - rpm --import https://cfengine-package-repos.s3.amazonaws.com/pub/gpg.key - if grep 'VERSION.*12' /etc/os-release; then - urlget https://cfengine-package-repos.s3.amazonaws.com/enterprise/Enterprise-"$CFE_VERSION"/agent/agent_suse12_x86_64/cfengine-nova-"$CFE_VERSION"-1.suse12.x86_64.rpm - zypper install -y cfengine-nova-"$CFE_VERSION"-1.suse12.x86_64.rpm - elif grep 'VERSION.*15' /etc/os-release; then - urlget https://cfengine-package-repos.s3.amazonaws.com/enterprise/Enterprise-"$CFE_VERSION"/agent/agent_suse15_x86_64/cfengine-nova-"$CFE_VERSION"-1.suse15.x86_64.rpm - zypper install -y cfengine-nova-"$CFE_VERSION"-1.suse15.x86_64.rpm + +echo "Checking for pre-installed CFEngine (chicken/egg problem)" +# We need a cf-agent to run build host setup policy and redhat-10-arm has not previous package to install. +# solution: install from source and make a custom AWS AMI image +if ! /var/cfengine/bin/cf-agent -V; then + echo "No existing CFEngine install found, try quickinstall script..." + if grep -i suse /etc/os-release; then + # need to add our public key first otherwise zypper install fails + rpm --import https://cfengine-package-repos.s3.amazonaws.com/pub/gpg.key + if grep 'VERSION.*12' /etc/os-release; then + urlget https://cfengine-package-repos.s3.amazonaws.com/enterprise/Enterprise-"$CFE_VERSION"/agent/agent_suse12_x86_64/cfengine-nova-"$CFE_VERSION"-1.suse12.x86_64.rpm + zypper install -y cfengine-nova-"$CFE_VERSION"-1.suse12.x86_64.rpm + elif grep 'VERSION.*15' /etc/os-release; then + urlget https://cfengine-package-repos.s3.amazonaws.com/enterprise/Enterprise-"$CFE_VERSION"/agent/agent_suse15_x86_64/cfengine-nova-"$CFE_VERSION"-1.suse15.x86_64.rpm + zypper install -y cfengine-nova-"$CFE_VERSION"-1.suse15.x86_64.rpm + else + echo "Unsupported suse version:" + grep VERSION /etc/os-release + exit 1 + fi else - echo "Unsupported suse version:" - grep VERSION /etc/os-release - exit 1 + urlget https://s3.amazonaws.com/cfengine.packages/quick-install-cfengine-enterprise.sh + # log sha256 checksum expected and actuall for debugging purposes + echo "Expected quick install checksum: " + cat ./buildscripts/ci/quick-install-cfengine-enterprise.sh.sha256 + echo "Actual quick install checksum: " + sha256sum quick-install-cfengine-enterprise.sh + + sha256sum --check ./buildscripts/ci/quick-install-cfengine-enterprise.sh.sha256 + chmod +x quick-install-cfengine-enterprise.sh + export CFEngine_Enterprise_Package_Version="$CFE_VERSION" + bash ./quick-install-cfengine-enterprise.sh agent fi -else - urlget https://s3.amazonaws.com/cfengine.packages/quick-install-cfengine-enterprise.sh - # log sha256 checksum expected and actuall for debugging purposes - echo "Expected quick install checksum: " - cat ./buildscripts/ci/quick-install-cfengine-enterprise.sh.sha256 - echo "Actual quick install checksum: " - sha256sum quick-install-cfengine-enterprise.sh - - sha256sum --check ./buildscripts/ci/quick-install-cfengine-enterprise.sh.sha256 - chmod +x quick-install-cfengine-enterprise.sh - export CFEngine_Enterprise_Package_Version="$CFE_VERSION" - bash ./quick-install-cfengine-enterprise.sh agent fi -# if cf-agent not installed, try cf-remote --version master -if [ ! -x /var/cfengine/bin/cf-agent ]; then - echo "quick install didn't install cf-agent, try cf-remote" +if ! /var/cfengine/bin/cf-agent -V; then + echo "quickinstall script didn't install CFEngine, try cf-remote..." # try pipx first for debian as pip won't work. # If that fails to install CFEngine then try python3-pip for redhats. if software pipx; then @@ -198,6 +193,7 @@ if [ ! -x /var/cfengine/bin/cf-agent ]; then fi if [ ! -x /var/cfengine/bin/cf-agent ]; then + echo "cf-remote didn't install CFEngine, build from source..." software git echo "quickinstall and cf-remote didn't install cf-agent, try from source" CFE_VERSION=3.26.0 # need to use an actualy release which has a checksum for masterfiles download From d67d9ffbc6b0bfa32863c11cafd7607da923da0a Mon Sep 17 00:00:00 2001 From: Craig Comstock Date: Fri, 31 Oct 2025 09:25:01 -0500 Subject: [PATCH 2/2] Fixed build host setup to not care about current directory There were relative paths that assumed execution from buildscripts/.. Ticket: ENT-13016 Changelog: none --- ci/setup-cfengine-build-host.sh | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/ci/setup-cfengine-build-host.sh b/ci/setup-cfengine-build-host.sh index d2e9896a7..610c26b34 100755 --- a/ci/setup-cfengine-build-host.sh +++ b/ci/setup-cfengine-build-host.sh @@ -1,5 +1,6 @@ #!/usr/bin/env bash shopt -s expand_aliases +thisdir="$(dirname "$0")" # Use the newest CFEngine version we can CFE_VERSION=3.26.0 @@ -97,19 +98,20 @@ trap cleanup SIGTERM echo "Using buildscripts commit:" # we have very old platforms with old git that doesn't understand -C option so cd/cd .. it is -cd buildscripts -# buildscripts is owned by jenkins so in order to run rev-parse command as root (this script is run with sudo) we must make it safe if git is used -if [ -d /home/jenkins/buildscripts/.git ]; then - if command -v git >/dev/null; then - git config --global --add safe.directory /home/jenkins/buildscripts - # show what version of buildscripts we are using - git rev-parse HEAD - else - echo "buildscripts/.git is present but git is not installed" - exit 1 +( + cd "$thisdir"/.. + # buildscripts is owned by jenkins so in order to run rev-parse command as root (this script is run with sudo) we must make it safe if git is used + if [ -d /home/jenkins/buildscripts/.git ]; then + if command -v git >/dev/null; then + git config --global --add safe.directory /home/jenkins/buildscripts + # show what version of buildscripts we are using + git rev-parse HEAD + else + echo "buildscripts/.git is present but git is not installed" + exit 1 + fi fi -fi -cd .. +) echo "Install distribution upgrades and set software alias for platform" if [ -f /etc/os-release ]; then @@ -166,11 +168,11 @@ if ! /var/cfengine/bin/cf-agent -V; then urlget https://s3.amazonaws.com/cfengine.packages/quick-install-cfengine-enterprise.sh # log sha256 checksum expected and actuall for debugging purposes echo "Expected quick install checksum: " - cat ./buildscripts/ci/quick-install-cfengine-enterprise.sh.sha256 + cat "$thisdir"/quick-install-cfengine-enterprise.sh.sha256 echo "Actual quick install checksum: " sha256sum quick-install-cfengine-enterprise.sh - sha256sum --check ./buildscripts/ci/quick-install-cfengine-enterprise.sh.sha256 + sha256sum --check "$thisdir"/quick-install-cfengine-enterprise.sh.sha256 chmod +x quick-install-cfengine-enterprise.sh export CFEngine_Enterprise_Package_Version="$CFE_VERSION" bash ./quick-install-cfengine-enterprise.sh agent @@ -208,7 +210,7 @@ fi # get masterfiles urlget https://cfengine-package-repos.s3.amazonaws.com/enterprise/Enterprise-"$CFE_VERSION"/misc/cfengine-masterfiles-"$CFE_VERSION"-1.pkg.tar.gz -sha256sum --check ./buildscripts/ci/cfengine-masterfiles-"$CFE_VERSION"-1.pkg.tar.gz.sha256 +sha256sum --check "$thisdir"/cfengine-masterfiles-"$CFE_VERSION"-1.pkg.tar.gz.sha256 tar xf cfengine-masterfiles-"$CFE_VERSION"-1.pkg.tar.gz cp -a masterfiles/* /var/cfengine/inputs/