iceBear67
c7afb86ebc
Security & correctness fixes following the audit in REPORT.md.
- setup-hypervisor.sh: fix broken error handling — use curl -fsSL,
check failures properly, return valid exit codes, and fetch
/releases/latest (arch-aware) instead of the possibly-draft .[0]
- entrypoint.sh: quote "$@" and build --net conditionally so empty
NET_INTERFACE/NET_MAC don't yield "tap=,mac="
- image-updater: replace tight 3s retry loop with capped exponential
backoff + periodic pull instead of hammering the registry
- sshd: set PermitRootLogin prohibit-password explicitly (key-only root)
- vm.Dockerfile: copy only host private keys at mode 600 instead of
the whole secret/* glob (drops .gitkeep/.pub from /etc/ssh)
- Makefile: stop generating redundant _pub key files
- build-image.sh: detect failure via alpine-make-vm-image's real exit
status rather than grepping stdout for "ERROR"
- remove orphaned etc/alloy/config.alloy (service not installed)
- README: correct data.raw path
- add REPORT.md audit notes (H1/H2 accepted as out-of-scope)
48 lines
1.2 KiB
Bash
Executable File
48 lines
1.2 KiB
Bash
Executable File
#!/bin/sh
|
|
IMAGE_NAME="${IMAGE_NAME:=alpine-vm}"
|
|
IMAGE_SIZE="${IMAGE_SIZE:-512M}"
|
|
IMAGE_FORMAT="${IMAGE_FORMAT:=raw}"
|
|
ALPINE_BRANCH="${ALPINE_BRANCH:=latest-stable}"
|
|
KERNEL_FLAVOR="${KERNEL_FLAVOR:=virt}"
|
|
IMAGE_FILE="vm.${IMAGE_FORMAT}"
|
|
SCRIPT_DIR="$PWD"
|
|
OVERLAY_DIR="${SCRIPT_DIR}/overlay"
|
|
CONFIGURE_SH="${SCRIPT_DIR}/configure.sh"
|
|
|
|
TMP=$(mktemp)
|
|
|
|
modprobe nbd max_parts=8 && [ -e /dev/nbd0 ] || mknod /dev/nbd0 b 43 0
|
|
|
|
cleanup() {
|
|
rm -f "$TMP" "${TMP}.rc"
|
|
}
|
|
|
|
trap cleanup INT TERM EXIT
|
|
|
|
# We use BIOS here to skip creating partitions
|
|
|
|
RC_FILE="${TMP}.rc"
|
|
|
|
# Capture the real exit status of alpine-make-vm-image (the `| tee` pipeline
|
|
# would otherwise mask it behind tee's status; busybox ash has no PIPESTATUS).
|
|
{ alpine-make-vm-image \
|
|
--boot-mode "BIOS" \
|
|
--branch "$ALPINE_BRANCH" \
|
|
--image-format "$IMAGE_FORMAT" \
|
|
--image-size "$IMAGE_SIZE" \
|
|
--kernel-flavor "$KERNEL_FLAVOR" \
|
|
--serial-console \
|
|
--fs-skel-dir "$OVERLAY_DIR" \
|
|
--fs-skel-chown root:root \
|
|
--script-chroot \
|
|
--packages "nftables curl docker openssh" \
|
|
"$IMAGE_FILE" \
|
|
"$CONFIGURE_SH"; echo $? > "$RC_FILE"; } 2>&1 | tee "$TMP"
|
|
|
|
rc=$(cat "$RC_FILE" 2>/dev/null || echo 1)
|
|
|
|
if [ "$rc" -ne 0 ]; then
|
|
echo "BUILD FAILED (alpine-make-vm-image exited $rc)"
|
|
exit 1
|
|
fi
|