[mirror_lxc.git] / templates / lxc-download.in

#!/bin/sh

# Client script for LXC container images.
#
# Copyright © 2014 Stéphane Graber <stgraber@ubuntu.com>
#
#  This library is free software; you can redistribute it and/or
#  modify it under the terms of the GNU Lesser General Public
#  License as published by the Free Software Foundation; either
#  version 2.1 of the License, or (at your option) any later version.

#  This library is distributed in the hope that it will be useful,
#  but WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
#  Lesser General Public License for more details.

#  You should have received a copy of the GNU Lesser General Public
#  License along with this library; if not, write to the Free Software
#  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
#  USA

set -eu

LXC_TEMPLATE_CONFIG="@LXCTEMPLATECONFIG@"
LXC_HOOK_DIR="@LXCHOOKDIR@"
LOCALSTATEDIR="@LOCALSTATEDIR@"

# Defaults
DOWNLOAD_DIST=
DOWNLOAD_RELEASE=
DOWNLOAD_ARCH=
DOWNLOAD_VARIANT="default"
DOWNLOAD_SERVER="images.linuxcontainers.org"
DOWNLOAD_KEYID="0xBAEFF88C22F6E216"
DOWNLOAD_KEYSERVER="pool.sks-keyservers.net"
DOWNLOAD_VALIDATE="true"
DOWNLOAD_FLUSH_CACHE="false"
DOWNLOAD_MODE="system"
DOWNLOAD_USE_CACHE="false"
DOWNLOAD_URL=
DOWNLOAD_SHOW_HTTP_WARNING="true"
DOWNLOAD_SHOW_GPG_WARNING="true"
DOWNLOAD_COMPAT_LEVEL=1
DOWNLOAD_LIST_IMAGES="false"
DOWNLOAD_BUILD=

LXC_NAME=
LXC_PATH=
LXC_ROOTFS=
LXC_MAPPED_UID=

# Some useful functions
cleanup() {
    if [ -d "$DOWNLOAD_TEMP" ]; then
        rm -Rf $DOWNLOAD_TEMP
    fi
}

download_file() {
    if ! wget -q https://${DOWNLOAD_SERVER}/$1 -O $2 >/dev/null 2>&1; then
        if ! wget -q http://${DOWNLOAD_SERVER}/$1 -O $2 >/dev/null 2>&1; then
            if [ "$3" = "noexit" ]; then
                return 1
            else
                echo "ERROR: Failed to download http://${DOWNLOAD_SERVER}/$1" 1>&2
                exit 1
            fi
        elif [ "$DOWNLOAD_SHOW_HTTP_WARNING" = "true" ]; then
            DOWNLOAD_SHOW_HTTP_WARNING="false"
            echo "WARNING: Failed to download the file over HTTPs." 1>&2
            echo -n "         The file was instead download over HTTP. " 1>&2
            echo "A server replay attack may be possible!" 1>&2
        fi
    fi
}

download_sig() {
    if ! download_file $1 $2 noexit; then
        if [ "$DOWNLOAD_VALIDATE" = "true" ]; then
            if [ "$3" = "normal" ]; then
                echo "ERROR: Failed to download http://${DOWNLOAD_SERVER}/$1" 1>&2
                exit 1
            else
                return 1
            fi
        else
            return 0
        fi
    fi
}

gpg_setup() {
    if [ "$DOWNLOAD_VALIDATE" = "false" ]; then
        return
    fi

    echo "Setting up the GPG keyring"

    mkdir -p "$DOWNLOAD_TEMP/gpg"
    chmod 700 "$DOWNLOAD_TEMP/gpg"
    export GNUPGHOME="$DOWNLOAD_TEMP/gpg"
    if ! gpg --keyserver $DOWNLOAD_KEYSERVER \
            --recv-keys ${DOWNLOAD_KEYID} >/dev/null 2>&1; then
        echo "ERROR: Unable to fetch GPG key from keyserver."
        exit 1
    fi
}

gpg_validate() {
    if [ "$DOWNLOAD_VALIDATE" = "false" ]; then
        if [ "$DOWNLOAD_SHOW_GPG_WARNING" = "true" ]; then
            echo "WARNING: Running without gpg validation!" 1>&2
        fi
        DOWNLOAD_SHOW_GPG_WARNING="false"
        return 0
    fi

    if ! gpg --verify $1 >/dev/zero 2>&1; then
        echo "ERROR: Invalid signature for $1" 1>&2
        exit 1
    fi
}

in_userns() {
    [ -e /proc/self/uid_map ] || { echo no; return; }
    [ "$(wc -l /proc/self/uid_map | awk '{ print $1 }')" -eq 1 ] || \
        { echo yes; return; }
    line=$(awk '{ print $1 " " $2 " " $3 }' /proc/self/uid_map)
    [ "$line" = "0 0 4294967295" ] && { echo no; return; }
    echo yes
}

relevant_file() {
    FILE_PATH="${LXC_CACHE_PATH}/$1"
    if [ -e "${FILE_PATH}-${DOWNLOAD_MODE}" ]; then
        FILE_PATH="${FILE_PATH}-${DOWNLOAD_MODE}"
    fi
    if [ -e "$FILE_PATH.${DOWNLOAD_COMPAT_LEVEL}" ]; then
        FILE_PATH="${FILE_PATH}.${DOWNLOAD_COMPAT_LEVEL}"
    fi

    echo $FILE_PATH
}

usage() {
    cat <<EOF
LXC container image downloader

Required arguments:
[ -d | --dist <distribution> ]: The name of the distribution
[ -r | --release <release> ]: Release name/version
[ -a | --arch <architecture> ]: Architecture of the container

Optional arguments:
[ -h | --help ]: This help message
[ -l | --list ]: List all available images
[ --variant <variant> ]: Variant of the image (default: "default")
[ --server <server> ]: Image server (default: "images.linuxcontainers.org")
[ --keyid <keyid> ]: GPG keyid (default: 0x...)
[ --keyserver <keyserver> ]: GPG keyserver to use
[ --no-validate ]: Disable GPG validation (not recommended)
[ --flush-cache ]: Flush the local copy (if present)
[ --force-cache ]; Force the use of the local copy even if expired

LXC internal arguments (do not pass manually!):
[ --name <name> ]: The container name
[ --path <path> ]: The path to the container
[ --rootfs <rootfs> ]: The path to the container's rootfs
[ --mapped-uid <map> ]: A uid/gid map (user namespaces)
EOF
    return 0
}

options=$(getopt -o d:r:a:hl -l dist:,release:,arch:,help,list,variant:,\
server:,keyid:,no-validate,flush-cache,force-cache,name:,path:,\
rootfs:,mapped-uid: -- "$@")

if [ $? -ne 0 ]; then
    usage
    exit 1
fi
eval set -- "$options"

while :; do
    case "$1" in
        -h|--help)          usage && exit 1;;
        -l|--list)          DOWNLOAD_LIST_IMAGES="true"; shift 1;;
        -d|--dist)          DOWNLOAD_DIST=$2; shift 2;;
        -r|--release)       DOWNLOAD_RELEASE=$2; shift 2;;
        -a|--arch)          DOWNLOAD_ARCH=$2; shift 2;;
        --variant)          DOWNLOAD_VARIANT=$2; shift 2;;
        --server)           DOWNLOAD_SERVER=$2; shift 2;;
        --keyid)            DOWNLOAD_KEYID=$2; shift 2;;
        --no-validate)      DOWNLOAD_VALIDATE="false"; shift 1;;
        --flush-cache)      DOWNLOAD_FLUSH_CACHE="true"; shift 1;;
        --force-cache)      DOWNLOAD_FORCE_CACHE="true"; shift 1;;
        --name)             LXC_NAME=$2; shift 2;;
        --path)             LXC_PATH=$2; shift 2;;
        --rootfs)           LXC_ROOTFS=$2; shift 2;;
        --mapped-uid)       LXC_MAPPED_UID=$2; shift 2;;
        *)                  break;;
    esac
done

# Check for required binaries
for bin in tar xz wget; do
    if ! type $bin >/dev/null 2>&1; then
        echo "ERROR: Missing required tool: $bin" 1>&2
        exit 1
    fi
done

# Check for GPG
if [ "$DOWNLOAD_VALIDATE" = "true" ]; then
    if ! type gpg >/dev/null 2>&1; then
        echo "ERROR: Missing recommended tool: gpg" 1>&2
        echo "You can workaround this by using --no-validate." 1>&2
        exit 1
    fi
fi

# Check that we have all variables we need
if [ -z "$LXC_NAME" ] || [ -z "$LXC_PATH" ] || [ -z "$LXC_ROOTFS" ]; then
    echo "ERROR: Not running through LXC." 1>&2
    exit 1
fi

if [ "$(in_userns)" = "yes" ]; then
    if [ -z "$LXC_MAPPED_UID" ] || [ "$LXC_MAPPED_UID" = "-1" ]; then
        echo "ERROR: In a user namespace without a map." 1>&2
        exit 1
    fi
    DOWNLOAD_MODE="user"
fi

if ([ -z "$DOWNLOAD_DIST" ] || [ -z "$DOWNLOAD_RELEASE" ] || \
    [ -z "$DOWNLOAD_ARCH" ]) && [ "$DOWNLOAD_LIST_IMAGES" = "false" ]; then
    echo "ERROR: Missing required argument" 1>&2
    usage
    exit 1
fi

# Trap all exit signals
trap cleanup EXIT HUP INT TERM
DOWNLOAD_TEMP=$(mktemp -d)

# Simply list images
if [ "$DOWNLOAD_LIST_IMAGES" = "true" ]; then
    # Initialize GPG
    gpg_setup

    # Grab the index
    DOWNLOAD_INDEX_PATH=/meta/1.0/index-${DOWNLOAD_MODE}

    echo "Downloading the image index"
    if ! download_file ${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL} \
         ${DOWNLOAD_TEMP}/index noexit ||
       ! download_sig ${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}.asc \
            ${DOWNLOAD_TEMP}/index.asc noexit; then
        download_file ${DOWNLOAD_INDEX_PATH} ${DOWNLOAD_TEMP}/index normal
        download_sig  ${DOWNLOAD_INDEX_PATH}.asc \
            ${DOWNLOAD_TEMP}/index.asc normal
    fi

    gpg_validate ${DOWNLOAD_TEMP}/index.asc

    # Parse it
    echo ""
    echo "---"
    echo "DIST\tRELEASE\tARCH\tVARIANT\tBUILD"
    echo "---"
    while read line; do
        # Basic CSV parser
        OLD_IFS=$IFS
        IFS=";"
        set -- $line
        IFS=$OLD_IFS

        [ -n "$DOWNLOAD_DIST" ] && [ "$1" != "$DOWNLOAD_DIST" ] && continue
        [ -n "$DOWNLOAD_RELEASE" ] && [ "$2" != "$DOWNLOAD_RELEASE" ] && continue
        [ -n "$DOWNLOAD_ARCH" ] && [ "$3" != "$DOWNLOAD_ARCH" ] && continue
        [ -n "$DOWNLOAD_VARIANT" ] && [ "$4" != "$DOWNLOAD_VARIANT" ] && continue
        [ -z "$5" ] || [ -z "$6" ] && continue

        echo "$1\t$2\t$3\t$4\t$5"
    done < ${DOWNLOAD_TEMP}/index
    echo "---"

    exit 1
fi

# Setup the cache
if [ "$DOWNLOAD_MODE" = "system" ]; then
    LXC_CACHE_BASE="$LOCALSTATEDIR/cache/"
    LXC_CACHE_PATH="$LOCALSTATEDIR/cache/lxc/download/$DOWNLOAD_DIST"
    LXC_CACHE_PATH="$LXC_CACHE_PATH/$DOWNLOAD_RELEASE/$DOWNLOAD_ARCH"
else
    LXC_CACHE_BASE="$HOME/.cache/lxc/"
    LXC_CACHE_PATH="$HOME/.cache/lxc/download/$DOWNLOAD_DIST"
    LXC_CACHE_PATH="$LXC_CACHE_PATH/$DOWNLOAD_RELEASE/$DOWNLOAD_ARCH"
fi

if [ -d "$LXC_CACHE_PATH" ]; then
    if [ "$DOWNLOAD_FLUSH_CACHE" = "true" ]; then
        echo "Flushing the cache..."
        rm -Rf $LXC_CACHE_PATH
    elif [ "$DOWNLOAD_FORCE_CACHE" = "true" ]; then
        DOWNLOAD_USE_CACHE="true"
    else
        DOWNLOAD_USE_CACHE="true"
        if [ -e "$(relevant_file expiry)" ]; then
            if [ "$(cat $(relevant_file expiry))" -lt $(date +%s) ]; then
                echo "The cached copy has expired, re-downloading..."
                DOWNLOAD_USE_CACHE="false"
            fi
        fi
    fi
fi

# Download what's needed
if [ "$DOWNLOAD_USE_CACHE" = "false" ]; then
    # Initialize GPG
    gpg_setup

    # Grab the index
    DOWNLOAD_INDEX_PATH=/meta/1.0/index-${DOWNLOAD_MODE}

    echo "Downloading the image index"
    if ! download_file ${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL} \
         ${DOWNLOAD_TEMP}/index noexit ||
       ! download_sig ${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}.asc \
            ${DOWNLOAD_TEMP}/index.asc noexit; then
        download_file ${DOWNLOAD_INDEX_PATH} ${DOWNLOAD_TEMP}/index normal
        download_sig  ${DOWNLOAD_INDEX_PATH}.asc \
            ${DOWNLOAD_TEMP}/index.asc normal
    fi

    gpg_validate ${DOWNLOAD_TEMP}/index.asc

    # Parse it
    while read line; do
        # Basic CSV parser
        OLD_IFS=$IFS
        IFS=";"
        set -- $line
        IFS=$OLD_IFS

        if [ "$1" != "$DOWNLOAD_DIST" ] || \
           [ "$2" != "$DOWNLOAD_RELEASE" ] || \
           [ "$3" != "$DOWNLOAD_ARCH" ] || \
           [ "$4" != "$DOWNLOAD_VARIANT" ] || \
           [ -z "$6" ]; then
            continue
        fi

        DOWNLOAD_BUILD=$5
        DOWNLOAD_URL=$6
        break
    done < ${DOWNLOAD_TEMP}/index

    if [ -z "$DOWNLOAD_URL" ]; then
        echo "ERROR: Couldn't find a matching image." 1>&1
        exit 1
    fi

    if [ -d "$LXC_CACHE_PATH" ] && [ -f "$LXC_CACHE_PATH/build_id" ] && \
       [ "$(cat $LXC_CACHE_PATH/build_id)" = "$DOWNLOAD_BUILD" ]; then
        echo "The cache is already up to date."
        echo "Using image from local cache"
    else
        # Download the actual files
        echo "Downloading the rootfs"
        download_file $DOWNLOAD_URL/rootfs.tar.xz \
            ${DOWNLOAD_TEMP}/rootfs.tar.xz normal
        download_sig  $DOWNLOAD_URL/rootfs.tar.xz.asc \
             ${DOWNLOAD_TEMP}/rootfs.tar.xz.asc normal
        gpg_validate ${DOWNLOAD_TEMP}/rootfs.tar.xz.asc

        echo "Downloading the metadata"
        download_file $DOWNLOAD_URL/meta.tar.xz \
            ${DOWNLOAD_TEMP}/meta.tar.xz normal
        download_sig  $DOWNLOAD_URL/meta.tar.xz.asc \
            ${DOWNLOAD_TEMP}/meta.tar.xz.asc normal
        gpg_validate ${DOWNLOAD_TEMP}/meta.tar.xz.asc

        if [ -d $LXC_CACHE_PATH ]; then
            rm -Rf $LXC_CACHE_PATH
        fi
        mkdir -p $LXC_CACHE_PATH
        mv ${DOWNLOAD_TEMP}/rootfs.tar.xz $LXC_CACHE_PATH
        if ! tar Jxf ${DOWNLOAD_TEMP}/meta.tar.xz -C $LXC_CACHE_PATH; then
            echo "ERROR: Invalid rootfs tarball." 2>&1
            exit 1
        fi

        echo $DOWNLOAD_BUILD > $LXC_CACHE_PATH/build_id

        if [ -n "$LXC_MAPPED_UID" ] && [ "$LXC_MAPPED_UID" != "-1" ]; then
            chown -R $LXC_MAPPED_UID $LXC_CACHE_BASE >/dev/null 2>&1 || true
        fi
        echo "The image cache is now ready"
    fi
else
    echo "Using image from local cache"
fi

# Unpack the rootfs
echo "Unpacking the rootfs"

EXCLUDES=""
excludelist=$(relevant_file excludes)
if [ -f "${excludelist}" ]; then
    while read line; do
        EXCLUDES="$EXCLUDES --exclude=$line"
    done < $excludelist
fi

tar  --anchored ${EXCLUDES} --numeric-owner -xpJf \
    ${LXC_CACHE_PATH}/rootfs.tar.xz -C ${LXC_ROOTFS}

mkdir -p ${LXC_ROOTFS}/dev/pts/

# Setup the configuration
configfile=$(relevant_file config)
fstab=$(relevant_file fstab)
if [ ! -e $configfile ]; then
    echo "ERROR: meta tarball is missing the configuration file" 1>&2
    exit 1
fi

## Extract all the network config entries
sed -i -e "/lxc.network/{w ${LXC_PATH}/config-network" -e "d}" \
    ${LXC_PATH}/config

## Extract any other config entry
sed -i -e "/lxc./{w ${LXC_PATH}/config-auto" -e "d}" ${LXC_PATH}/config

## Append the defaults
echo "" >> ${LXC_PATH}/config
echo "# Distribution configuration" >> ${LXC_PATH}/config
cat $configfile >> ${LXC_PATH}/config

## Add the container-specific config
echo "" >> ${LXC_PATH}/config
echo "# Container specific configuration" >> ${LXC_PATH}/config
if [ -e "${LXC_PATH}/config-auto" ]; then
    cat ${LXC_PATH}/config-auto >> ${LXC_PATH}/config
    rm ${LXC_PATH}/config-auto
fi
if [ -e "$fstab" ]; then
    echo "lxc.mount = ${LXC_PATH}/fstab" >> ${LXC_PATH}/config
fi
echo "lxc.utsname = ${LXC_NAME}" >> ${LXC_PATH}/config

## Re-add the previously removed network config
if [ -e "${LXC_PATH}/config-network" ]; then
    echo "" >> ${LXC_PATH}/config
    echo "# Network configuration" >> ${LXC_PATH}/config
    cat ${LXC_PATH}/config-network >> ${LXC_PATH}/config
    rm ${LXC_PATH}/config-network
fi

TEMPLATE_FILES="${LXC_PATH}/config"

# Setup the fstab
if [ -e $fstab ]; then
    cp ${fstab} ${LXC_PATH}/fstab
    TEMPLATE_FILES="$TEMPLATE_FILES ${LXC_PATH}/fstab"
fi

# Look for extra templates
if [ -e "$(relevant_file templates)" ]; then
    while read line; do
        fullpath=${LXC_ROOTFS}/$line
        [ ! -e "$fullpath" ] && continue
        TEMPLATE_FILES="$TEMPLATE_FILES $fullpath"
    done < $(relevant_file templates)
fi

# Replace variables in all templates
for file in $TEMPLATE_FILES; do
    [ ! -f "$file" ] && continue

    sed -i "s#LXC_NAME#$LXC_NAME#g" $file
    sed -i "s#LXC_PATH#$LXC_PATH#g" $file
    sed -i "s#LXC_ROOTFS#$LXC_ROOTFS#g" $file
    sed -i "s#LXC_TEMPLATE_CONFIG#$LXC_TEMPLATE_CONFIG#g" $file
    sed -i "s#LXC_HOOK_DIR#$LXC_HOOK_DIR#g" $file
done

if [ -n "$LXC_MAPPED_UID" ] && [ "$LXC_MAPPED_UID" != "-1" ]; then
    chown $LXC_MAPPED_UID $LXC_PATH/config $LXC_PATH/fstab >/dev/null 2>&1 || true
fi

if [ -e "$(relevant_file create-message)" ]; then
    echo ""
    echo "---"
    cat "$(relevant_file create-message)"
fi

exit 0
Commit	Line	Data
71d3a659 SG	1	#!/bin/sh
	2
	3	# Client script for LXC container images.
	4	#
	5	# Copyright © 2014 Stéphane Graber <stgraber@ubuntu.com>
	6	#
	7	# This library is free software; you can redistribute it and/or
	8	# modify it under the terms of the GNU Lesser General Public
	9	# License as published by the Free Software Foundation; either
	10	# version 2.1 of the License, or (at your option) any later version.
	11
	12	# This library is distributed in the hope that it will be useful,
	13	# but WITHOUT ANY WARRANTY; without even the implied warranty of
	14	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	15	# Lesser General Public License for more details.
	16
	17	# You should have received a copy of the GNU Lesser General Public
	18	# License along with this library; if not, write to the Free Software
	19	# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
	20	# USA
	21
	22	set -eu
	23
	24	LXC_TEMPLATE_CONFIG="@LXCTEMPLATECONFIG@"
	25	LXC_HOOK_DIR="@LXCHOOKDIR@"
	26	LOCALSTATEDIR="@LOCALSTATEDIR@"
	27
	28	# Defaults
	29	DOWNLOAD_DIST=
	30	DOWNLOAD_RELEASE=
	31	DOWNLOAD_ARCH=
	32	DOWNLOAD_VARIANT="default"
	33	DOWNLOAD_SERVER="images.linuxcontainers.org"
	34	DOWNLOAD_KEYID="0xBAEFF88C22F6E216"
	35	DOWNLOAD_KEYSERVER="pool.sks-keyservers.net"
	36	DOWNLOAD_VALIDATE="true"
	37	DOWNLOAD_FLUSH_CACHE="false"
	38	DOWNLOAD_MODE="system"
	39	DOWNLOAD_USE_CACHE="false"
	40	DOWNLOAD_URL=
	41	DOWNLOAD_SHOW_HTTP_WARNING="true"
	42	DOWNLOAD_SHOW_GPG_WARNING="true"
	43	DOWNLOAD_COMPAT_LEVEL=1
10a5fab6	44	DOWNLOAD_LIST_IMAGES="false"
9accc2ef	45	DOWNLOAD_BUILD=
71d3a659 SG	46
	47	LXC_NAME=
	48	LXC_PATH=
	49	LXC_ROOTFS=
	50	LXC_MAPPED_UID=
	51
	52	# Some useful functions
	53	cleanup() {
	54	if [ -d "$DOWNLOAD_TEMP" ]; then
	55	rm -Rf $DOWNLOAD_TEMP
	56	fi
	57	}
	58
	59	download_file() {
	60	if ! wget -q https://${DOWNLOAD_SERVER}/$1 -O $2 >/dev/null 2>&1; then
	61	if ! wget -q http://${DOWNLOAD_SERVER}/$1 -O $2 >/dev/null 2>&1; then
	62	if [ "$3" = "noexit" ]; then
	63	return 1
	64	else
fad96766	65	echo "ERROR: Failed to download http://${DOWNLOAD_SERVER}/$1" 1>&2
71d3a659 SG	66	exit 1
	67	fi
	68	elif [ "$DOWNLOAD_SHOW_HTTP_WARNING" = "true" ]; then
	69	DOWNLOAD_SHOW_HTTP_WARNING="false"
	70	echo "WARNING: Failed to download the file over HTTPs." 1>&2
	71	echo -n " The file was instead download over HTTP. " 1>&2
	72	echo "A server replay attack may be possible!" 1>&2
	73	fi
	74	fi
	75	}
	76
fad96766	77	download_sig() {
33aa351a SG	78	if ! download_file $1 $2 noexit; then
	79	if [ "$DOWNLOAD_VALIDATE" = "true" ]; then
	80	if [ "$3" = "normal" ]; then
	81	echo "ERROR: Failed to download http://${DOWNLOAD_SERVER}/$1" 1>&2
	82	exit 1
	83	else
	84	return 1
	85	fi
	86	else
	87	return 0
	88	fi
fad96766 DE	89	fi
	90	}
	91
71d3a659 SG	92	gpg_setup() {
	93	if [ "$DOWNLOAD_VALIDATE" = "false" ]; then
	94	return
	95	fi
	96
	97	echo "Setting up the GPG keyring"
	98
	99	mkdir -p "$DOWNLOAD_TEMP/gpg"
	100	chmod 700 "$DOWNLOAD_TEMP/gpg"
	101	export GNUPGHOME="$DOWNLOAD_TEMP/gpg"
	102	if ! gpg --keyserver $DOWNLOAD_KEYSERVER \
	103	--recv-keys ${DOWNLOAD_KEYID} >/dev/null 2>&1; then
	104	echo "ERROR: Unable to fetch GPG key from keyserver."
	105	exit 1
	106	fi
	107	}
	108
	109	gpg_validate() {
	110	if [ "$DOWNLOAD_VALIDATE" = "false" ]; then
	111	if [ "$DOWNLOAD_SHOW_GPG_WARNING" = "true" ]; then
	112	echo "WARNING: Running without gpg validation!" 1>&2
	113	fi
	114	DOWNLOAD_SHOW_GPG_WARNING="false"
	115	return 0
	116	fi
	117
	118	if ! gpg --verify $1 >/dev/zero 2>&1; then
	119	echo "ERROR: Invalid signature for $1" 1>&2
	120	exit 1
	121	fi
	122	}
	123
	124	in_userns() {
	125	[ -e /proc/self/uid_map ] \|\| { echo no; return; }
	126	[ "$(wc -l /proc/self/uid_map \| awk '{ print $1 }')" -eq 1 ] \|\| \
	127	{ echo yes; return; }
	128	line=$(awk '{ print $1 " " $2 " " $3 }' /proc/self/uid_map)
	129	[ "$line" = "0 0 4294967295" ] && { echo no; return; }
	130	echo yes
	131	}
	132
	133	relevant_file() {
	134	FILE_PATH="${LXC_CACHE_PATH}/$1"
	135	if [ -e "${FILE_PATH}-${DOWNLOAD_MODE}" ]; then
	136	FILE_PATH="${FILE_PATH}-${DOWNLOAD_MODE}"
	137	fi
	138	if [ -e "$FILE_PATH.${DOWNLOAD_COMPAT_LEVEL}" ]; then
	139	FILE_PATH="${FILE_PATH}.${DOWNLOAD_COMPAT_LEVEL}"
	140	fi
	141
	142	echo $FILE_PATH
	143	}
	144
	145	usage() {
	146	cat <<EOF
	147	LXC container image downloader
	148
	149	Required arguments:
	150	[ -d \| --dist <distribution> ]: The name of the distribution
	151	[ -r \| --release <release> ]: Release name/version
	152	[ -a \| --arch <architecture> ]: Architecture of the container
71d3a659 SG	153
71d3a659 SG	154	Optional arguments:
10a5fab6 SG	155	[ -h \| --help ]: This help message
10a5fab6 SG	156	[ -l \| --list ]: List all available images
71d3a659 SG	157	[ --variant <variant> ]: Variant of the image (default: "default")
	158	[ --server <server> ]: Image server (default: "images.linuxcontainers.org")
	159	[ --keyid <keyid> ]: GPG keyid (default: 0x...)
	160	[ --keyserver <keyserver> ]: GPG keyserver to use
	161	[ --no-validate ]: Disable GPG validation (not recommended)
	162	[ --flush-cache ]: Flush the local copy (if present)
9accc2ef	163	[ --force-cache ]; Force the use of the local copy even if expired
71d3a659 SG	164
	165	LXC internal arguments (do not pass manually!):
	166	[ --name <name> ]: The container name
	167	[ --path <path> ]: The path to the container
	168	[ --rootfs <rootfs> ]: The path to the container's rootfs
	169	[ --mapped-uid <map> ]: A uid/gid map (user namespaces)
	170	EOF
	171	return 0
	172	}
	173
10a5fab6	174	options=$(getopt -o d:r:a:hl -l dist:,release:,arch:,help,list,variant:,\
c1becef2	175	server:,keyid:,no-validate,flush-cache,force-cache,name:,path:,\
9accc2ef	176	rootfs:,mapped-uid: -- "$@")
71d3a659 SG	177
	178	if [ $? -ne 0 ]; then
	179	usage
	180	exit 1
	181	fi
	182	eval set -- "$options"
	183
	184	while :; do
	185	case "$1" in
10a5fab6 SG	186	-h\|--help) usage && exit 1;;
10a5fab6 SG	187	-l\|--list) DOWNLOAD_LIST_IMAGES="true"; shift 1;;
71d3a659 SG	188	-d\|--dist) DOWNLOAD_DIST=$2; shift 2;;
	189	-r\|--release) DOWNLOAD_RELEASE=$2; shift 2;;
	190	-a\|--arch) DOWNLOAD_ARCH=$2; shift 2;;
	191	--variant) DOWNLOAD_VARIANT=$2; shift 2;;
	192	--server) DOWNLOAD_SERVER=$2; shift 2;;
	193	--keyid) DOWNLOAD_KEYID=$2; shift 2;;
	194	--no-validate) DOWNLOAD_VALIDATE="false"; shift 1;;
	195	--flush-cache) DOWNLOAD_FLUSH_CACHE="true"; shift 1;;
9accc2ef	196	--force-cache) DOWNLOAD_FORCE_CACHE="true"; shift 1;;
71d3a659 SG	197	--name) LXC_NAME=$2; shift 2;;
	198	--path) LXC_PATH=$2; shift 2;;
	199	--rootfs) LXC_ROOTFS=$2; shift 2;;
	200	--mapped-uid) LXC_MAPPED_UID=$2; shift 2;;
	201	*) break;;
	202	esac
	203	done
	204
	205	# Check for required binaries
	206	for bin in tar xz wget; do
	207	if ! type $bin >/dev/null 2>&1; then
	208	echo "ERROR: Missing required tool: $bin" 1>&2
	209	exit 1
	210	fi
	211	done
	212
	213	# Check for GPG
	214	if [ "$DOWNLOAD_VALIDATE" = "true" ]; then
	215	if ! type gpg >/dev/null 2>&1; then
	216	echo "ERROR: Missing recommended tool: gpg" 1>&2
	217	echo "You can workaround this by using --no-validate." 1>&2
	218	exit 1
	219	fi
	220	fi
	221
	222	# Check that we have all variables we need
	223	if [ -z "$LXC_NAME" ] \|\| [ -z "$LXC_PATH" ] \|\| [ -z "$LXC_ROOTFS" ]; then
	224	echo "ERROR: Not running through LXC." 1>&2
	225	exit 1
	226	fi
	227
	228	if [ "$(in_userns)" = "yes" ]; then
	229	if [ -z "$LXC_MAPPED_UID" ] \|\| [ "$LXC_MAPPED_UID" = "-1" ]; then
	230	echo "ERROR: In a user namespace without a map." 1>&2
	231	exit 1
	232	fi
	233	DOWNLOAD_MODE="user"
	234	fi
	235
10a5fab6 SG	236	if ([ -z "$DOWNLOAD_DIST" ] \|\| [ -z "$DOWNLOAD_RELEASE" ] \|\| \
10a5fab6 SG	237	[ -z "$DOWNLOAD_ARCH" ]) && [ "$DOWNLOAD_LIST_IMAGES" = "false" ]; then
71d3a659 SG	238	echo "ERROR: Missing required argument" 1>&2
	239	usage
	240	exit 1
	241	fi
	242
	243	# Trap all exit signals
	244	trap cleanup EXIT HUP INT TERM
	245	DOWNLOAD_TEMP=$(mktemp -d)
	246
10a5fab6 SG	247	# Simply list images
	248	if [ "$DOWNLOAD_LIST_IMAGES" = "true" ]; then
	249	# Initialize GPG
	250	gpg_setup
	251
	252	# Grab the index
	253	DOWNLOAD_INDEX_PATH=/meta/1.0/index-${DOWNLOAD_MODE}
	254
	255	echo "Downloading the image index"
	256	if ! download_file ${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL} \
	257	${DOWNLOAD_TEMP}/index noexit \|\|
	258	! download_sig ${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}.asc \
	259	${DOWNLOAD_TEMP}/index.asc noexit; then
	260	download_file ${DOWNLOAD_INDEX_PATH} ${DOWNLOAD_TEMP}/index normal
	261	download_sig ${DOWNLOAD_INDEX_PATH}.asc \
	262	${DOWNLOAD_TEMP}/index.asc normal
	263	fi
	264
	265	gpg_validate ${DOWNLOAD_TEMP}/index.asc
	266
	267	# Parse it
	268	echo ""
	269	echo "---"
	270	echo "DIST\tRELEASE\tARCH\tVARIANT\tBUILD"
	271	echo "---"
	272	while read line; do
	273	# Basic CSV parser
	274	OLD_IFS=$IFS
	275	IFS=";"
	276	set -- $line
	277	IFS=$OLD_IFS
	278
	279	[ -n "$DOWNLOAD_DIST" ] && [ "$1" != "$DOWNLOAD_DIST" ] && continue
	280	[ -n "$DOWNLOAD_RELEASE" ] && [ "$2" != "$DOWNLOAD_RELEASE" ] && continue
	281	[ -n "$DOWNLOAD_ARCH" ] && [ "$3" != "$DOWNLOAD_ARCH" ] && continue
	282	[ -n "$DOWNLOAD_VARIANT" ] && [ "$4" != "$DOWNLOAD_VARIANT" ] && continue
	283	[ -z "$5" ] \|\| [ -z "$6" ] && continue
	284
	285	echo "$1\t$2\t$3\t$4\t$5"
	286	done < ${DOWNLOAD_TEMP}/index
	287	echo "---"
	288
	289	exit 1
	290	fi
	291
71d3a659 SG	292	# Setup the cache
	293	if [ "$DOWNLOAD_MODE" = "system" ]; then
	294	LXC_CACHE_BASE="$LOCALSTATEDIR/cache/"
	295	LXC_CACHE_PATH="$LOCALSTATEDIR/cache/lxc/download/$DOWNLOAD_DIST"
	296	LXC_CACHE_PATH="$LXC_CACHE_PATH/$DOWNLOAD_RELEASE/$DOWNLOAD_ARCH"
	297	else
	298	LXC_CACHE_BASE="$HOME/.cache/lxc/"
	299	LXC_CACHE_PATH="$HOME/.cache/lxc/download/$DOWNLOAD_DIST"
	300	LXC_CACHE_PATH="$LXC_CACHE_PATH/$DOWNLOAD_RELEASE/$DOWNLOAD_ARCH"
	301	fi
	302
	303	if [ -d "$LXC_CACHE_PATH" ]; then
	304	if [ "$DOWNLOAD_FLUSH_CACHE" = "true" ]; then
	305	echo "Flushing the cache..."
	306	rm -Rf $LXC_CACHE_PATH
9accc2ef SG	307	elif [ "$DOWNLOAD_FORCE_CACHE" = "true" ]; then
9accc2ef SG	308	DOWNLOAD_USE_CACHE="true"
71d3a659 SG	309	else
	310	DOWNLOAD_USE_CACHE="true"
	311	if [ -e "$(relevant_file expiry)" ]; then
	312	if [ "$(cat $(relevant_file expiry))" -lt $(date +%s) ]; then
	313	echo "The cached copy has expired, re-downloading..."
	314	DOWNLOAD_USE_CACHE="false"
71d3a659 SG	315	fi
	316	fi
	317	fi
	318	fi
	319
	320	# Download what's needed
	321	if [ "$DOWNLOAD_USE_CACHE" = "false" ]; then
	322	# Initialize GPG
	323	gpg_setup
	324
	325	# Grab the index
	326	DOWNLOAD_INDEX_PATH=/meta/1.0/index-${DOWNLOAD_MODE}
	327
	328	echo "Downloading the image index"
	329	if ! download_file ${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL} \
	330	${DOWNLOAD_TEMP}/index noexit \|\|
33aa351a	331	! download_sig ${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}.asc \
71d3a659 SG	332	${DOWNLOAD_TEMP}/index.asc noexit; then
71d3a659 SG	333	download_file ${DOWNLOAD_INDEX_PATH} ${DOWNLOAD_TEMP}/index normal
fad96766	334	download_sig ${DOWNLOAD_INDEX_PATH}.asc \
33aa351a	335	${DOWNLOAD_TEMP}/index.asc normal
71d3a659 SG	336	fi
	337
	338	gpg_validate ${DOWNLOAD_TEMP}/index.asc
	339
	340	# Parse it
	341	while read line; do
	342	# Basic CSV parser
	343	OLD_IFS=$IFS
	344	IFS=";"
	345	set -- $line
	346	IFS=$OLD_IFS
	347
	348	if [ "$1" != "$DOWNLOAD_DIST" ] \|\| \
	349	[ "$2" != "$DOWNLOAD_RELEASE" ] \|\| \
	350	[ "$3" != "$DOWNLOAD_ARCH" ] \|\| \
	351	[ "$4" != "$DOWNLOAD_VARIANT" ] \|\| \
	352	[ -z "$6" ]; then
	353	continue
	354	fi
	355
9accc2ef	356	DOWNLOAD_BUILD=$5
71d3a659 SG	357	DOWNLOAD_URL=$6
	358	break
	359	done < ${DOWNLOAD_TEMP}/index
	360
	361	if [ -z "$DOWNLOAD_URL" ]; then
	362	echo "ERROR: Couldn't find a matching image." 1>&1
	363	exit 1
	364	fi
	365
9accc2ef SG	366	if [ -d "$LXC_CACHE_PATH" ] && [ -f "$LXC_CACHE_PATH/build_id" ] && \
	367	[ "$(cat $LXC_CACHE_PATH/build_id)" = "$DOWNLOAD_BUILD" ]; then
	368	echo "The cache is already up to date."
	369	echo "Using image from local cache"
	370	else
	371	# Download the actual files
	372	echo "Downloading the rootfs"
	373	download_file $DOWNLOAD_URL/rootfs.tar.xz \
	374	${DOWNLOAD_TEMP}/rootfs.tar.xz normal
	375	download_sig $DOWNLOAD_URL/rootfs.tar.xz.asc \
	376	${DOWNLOAD_TEMP}/rootfs.tar.xz.asc normal
	377	gpg_validate ${DOWNLOAD_TEMP}/rootfs.tar.xz.asc
	378
	379	echo "Downloading the metadata"
	380	download_file $DOWNLOAD_URL/meta.tar.xz \
	381	${DOWNLOAD_TEMP}/meta.tar.xz normal
	382	download_sig $DOWNLOAD_URL/meta.tar.xz.asc \
	383	${DOWNLOAD_TEMP}/meta.tar.xz.asc normal
	384	gpg_validate ${DOWNLOAD_TEMP}/meta.tar.xz.asc
	385
	386	if [ -d $LXC_CACHE_PATH ]; then
	387	rm -Rf $LXC_CACHE_PATH
	388	fi
	389	mkdir -p $LXC_CACHE_PATH
	390	mv ${DOWNLOAD_TEMP}/rootfs.tar.xz $LXC_CACHE_PATH
	391	if ! tar Jxf ${DOWNLOAD_TEMP}/meta.tar.xz -C $LXC_CACHE_PATH; then
	392	echo "ERROR: Invalid rootfs tarball." 2>&1
	393	exit 1
	394	fi
71d3a659	395
9accc2ef SG	396	echo $DOWNLOAD_BUILD > $LXC_CACHE_PATH/build_id
	397
	398	if [ -n "$LXC_MAPPED_UID" ] && [ "$LXC_MAPPED_UID" != "-1" ]; then
0d656b05	399	chown -R $LXC_MAPPED_UID $LXC_CACHE_BASE >/dev/null 2>&1 \|\| true
9accc2ef SG	400	fi
9accc2ef SG	401	echo "The image cache is now ready"
71d3a659	402	fi
71d3a659 SG	403	else
	404	echo "Using image from local cache"
	405	fi
	406
	407	# Unpack the rootfs
	408	echo "Unpacking the rootfs"
fecf101c SG	409
	410	EXCLUDES=""
	411	excludelist=$(relevant_file excludes)
	412	if [ -f "${excludelist}" ]; then
	413	while read line; do
	414	EXCLUDES="$EXCLUDES --exclude=$line"
	415	done < $excludelist
71d3a659 SG	416	fi
71d3a659 SG	417
fecf101c SG	418	tar --anchored ${EXCLUDES} --numeric-owner -xpJf \
	419	${LXC_CACHE_PATH}/rootfs.tar.xz -C ${LXC_ROOTFS}
	420
	421	mkdir -p ${LXC_ROOTFS}/dev/pts/
	422
71d3a659 SG	423	# Setup the configuration
	424	configfile=$(relevant_file config)
	425	fstab=$(relevant_file fstab)
	426	if [ ! -e $configfile ]; then
	427	echo "ERROR: meta tarball is missing the configuration file" 1>&2
	428	exit 1
	429	fi
	430
	431	## Extract all the network config entries
	432	sed -i -e "/lxc.network/{w ${LXC_PATH}/config-network" -e "d}" \
	433	${LXC_PATH}/config
	434
	435	## Extract any other config entry
	436	sed -i -e "/lxc./{w ${LXC_PATH}/config-auto" -e "d}" ${LXC_PATH}/config
	437
	438	## Append the defaults
	439	echo "" >> ${LXC_PATH}/config
	440	echo "# Distribution configuration" >> ${LXC_PATH}/config
	441	cat $configfile >> ${LXC_PATH}/config
	442
	443	## Add the container-specific config
	444	echo "" >> ${LXC_PATH}/config
	445	echo "# Container specific configuration" >> ${LXC_PATH}/config
	446	if [ -e "${LXC_PATH}/config-auto" ]; then
	447	cat ${LXC_PATH}/config-auto >> ${LXC_PATH}/config
	448	rm ${LXC_PATH}/config-auto
	449	fi
	450	if [ -e "$fstab" ]; then
	451	echo "lxc.mount = ${LXC_PATH}/fstab" >> ${LXC_PATH}/config
	452	fi
	453	echo "lxc.utsname = ${LXC_NAME}" >> ${LXC_PATH}/config
	454
	455	## Re-add the previously removed network config
	456	if [ -e "${LXC_PATH}/config-network" ]; then
	457	echo "" >> ${LXC_PATH}/config
	458	echo "# Network configuration" >> ${LXC_PATH}/config
	459	cat ${LXC_PATH}/config-network >> ${LXC_PATH}/config
	460	rm ${LXC_PATH}/config-network
	461	fi
	462
	463	TEMPLATE_FILES="${LXC_PATH}/config"
	464
	465	# Setup the fstab
	466	if [ -e $fstab ]; then
	467	cp ${fstab} ${LXC_PATH}/fstab
	468	TEMPLATE_FILES="$TEMPLATE_FILES ${LXC_PATH}/fstab"
	469	fi
	470
	471	# Look for extra templates
	472	if [ -e "$(relevant_file templates)" ]; then
	473	while read line; do
	474	fullpath=${LXC_ROOTFS}/$line
	475	[ ! -e "$fullpath" ] && continue
	476	TEMPLATE_FILES="$TEMPLATE_FILES $fullpath"
	477	done < $(relevant_file templates)
	478	fi
	479
	480	# Replace variables in all templates
	481	for file in $TEMPLATE_FILES; do
fad96766	482	[ ! -f "$file" ] && continue
71d3a659 SG	483
	484	sed -i "s#LXC_NAME#$LXC_NAME#g" $file
	485	sed -i "s#LXC_PATH#$LXC_PATH#g" $file
	486	sed -i "s#LXC_ROOTFS#$LXC_ROOTFS#g" $file
	487	sed -i "s#LXC_TEMPLATE_CONFIG#$LXC_TEMPLATE_CONFIG#g" $file
	488	sed -i "s#LXC_HOOK_DIR#$LXC_HOOK_DIR#g" $file
	489	done
	490
	491	if [ -n "$LXC_MAPPED_UID" ] && [ "$LXC_MAPPED_UID" != "-1" ]; then
0d656b05	492	chown $LXC_MAPPED_UID $LXC_PATH/config $LXC_PATH/fstab >/dev/null 2>&1 \|\| true
71d3a659 SG	493	fi
	494
	495	if [ -e "$(relevant_file create-message)" ]; then
	496	echo ""
	497	echo "---"
	498	cat "$(relevant_file create-message)"
	499	fi
	500
	501	exit 0