33 lines
1.5 KiB
Bash
Executable File
33 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Ubuntu's package transaction scans the hosted image's full dpkg database and
|
|
# runs post-install hooks. CI needs only the signed-archive payload, so pin and
|
|
# verify that payload before extracting it into the ephemeral runner directory.
|
|
readonly BUBBLEWRAP_VERSION='0.9.0-1ubuntu0.1'
|
|
readonly BUBBLEWRAP_SHA256='1b506492bd9c7fd0cdb4f02ac822f1d3e336b0aead5113c1239baf8db5db562a'
|
|
readonly BUBBLEWRAP_URL="https://archive.ubuntu.com/ubuntu/pool/main/b/bubblewrap/bubblewrap_${BUBBLEWRAP_VERSION}_amd64.deb"
|
|
|
|
: "${RUNNER_TEMP:?prepare-ci-bubblewrap requires RUNNER_TEMP}"
|
|
: "${GITHUB_PATH:?prepare-ci-bubblewrap requires GITHUB_PATH}"
|
|
|
|
if [[ "$(uname -s)" != 'Linux' || "$(uname -m)" != 'x86_64' ]]; then
|
|
echo 'prepare-ci-bubblewrap supports only Linux x86_64 hosted runners' >&2
|
|
exit 1
|
|
fi
|
|
|
|
archive="${RUNNER_TEMP}/bubblewrap_${BUBBLEWRAP_VERSION}_amd64.deb"
|
|
root="${RUNNER_TEMP}/dsh-bubblewrap"
|
|
|
|
curl --fail --silent --show-error --location --retry 3 --output "$archive" "$BUBBLEWRAP_URL"
|
|
printf '%s %s\n' "$BUBBLEWRAP_SHA256" "$archive" | sha256sum --check --status
|
|
mkdir -p "$root"
|
|
dpkg-deb --extract "$archive" "$root"
|
|
printf '%s\n' "$root/usr/bin" >> "$GITHUB_PATH"
|
|
|
|
sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 \
|
|
|| echo 'apparmor userns knob absent — the functional probe decides'
|
|
"$root/usr/bin/bwrap" --version
|
|
"$root/usr/bin/bwrap" --ro-bind / / --dev /dev --proc /proc --die-with-parent -- true
|
|
echo 'bubblewrap functional probe passed'
|