From f3c42b256df4e7c4f9434c2dc497526b516f28f3 Mon Sep 17 00:00:00 2001 From: Craig Comstock Date: Sun, 26 Jul 2026 10:17:02 -0400 Subject: [PATCH 1/9] Fixed unpack-tarballs handling of masterfiles tarballs The symlink step was failing due to the tarball itself matching the glob Ticket: none Changelog: none --- build-scripts/unpack-tarballs | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/build-scripts/unpack-tarballs b/build-scripts/unpack-tarballs index 9130c973b..01f67afb8 100755 --- a/build-scripts/unpack-tarballs +++ b/build-scripts/unpack-tarballs @@ -62,9 +62,11 @@ cd "$BASEDIR" gzip -dc $SOURCE_TARBALL | tar -xf - ln -s cfengine-3* core -log_debug "UNPACKING MASTERFILES TARBALL AND SYMLINKING masterfiles/" +log_debug "UNPACKING MASTERFILES TARBALL: $MASTERFILES_TARBALL AND SYMLINKING masterfiles/" # shellcheck disable=SC2086 # > Double quote to prevent globbing and word splitting. # We want globbing here gzip -dc $MASTERFILES_TARBALL | tar -xf - -ln -s cfengine-masterfiles-* masterfiles +# the masterfiles tarball would match cfengine-masterfiles-* so find the unpacked dir specifically +_cfmpfdir=$(find -type d -name 'cfengine-masterfiles-*') +ln -s "$_cfmpfdir" masterfiles From bd68d536f931a0f1dd416dc700b466a923ec8950 Mon Sep 17 00:00:00 2001 From: Craig Comstock Date: Sun, 26 Jul 2026 10:18:15 -0400 Subject: [PATCH 2/9] Make initialize-build-host.sh a bit more quiet For now just commented out current environment and cloud-init log output. A follow-up would be to capture those and print them out only in case of problems. Ticket: none Changelog: none --- ci/initialize-build-host.sh | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/ci/initialize-build-host.sh b/ci/initialize-build-host.sh index 90bbc9392..7080d2dd4 100644 --- a/ci/initialize-build-host.sh +++ b/ci/initialize-build-host.sh @@ -136,9 +136,10 @@ do sleep 10 done -echo '========================================= PRINTING CLOUD-INIT LOG ===================================================' -sudo sed 's/^.*/>>> &/' /var/log/cloud-init-output.log || true -echo '======================================= DONE PRINTING CLOUD-INIT LOG ================================================' +# TODO, instead of printing this out ALWAYS, print it out only in case of errors ENT-14372 +#echo '========================================= PRINTING CLOUD-INIT LOG ===================================================' +#sudo sed 's/^.*/>>> &/' /var/log/cloud-init-output.log || true +#echo '======================================= DONE PRINTING CLOUD-INIT LOG ================================================' if [ $attempts -le 0 ] then @@ -147,9 +148,10 @@ then exit 1 fi -echo '=========================================== CURRENT ENVIRONMENT =====================================================' -export -echo '========================================= CURRENT ENVIRONMENT END ===================================================' +# TODO only print current environment on errors, maybe save the environment NOW and then show a diff at ERROR +#echo '=========================================== CURRENT ENVIRONMENT =====================================================' +#export +#echo '========================================= CURRENT ENVIRONMENT END ===================================================' # Disable TTY requirement. This normally happens in initialize-user-data.sh, but # for hosts that do not support cloud user data, it may not have happened From 275334f2e9be46f883b3670309bb2702269f78ea Mon Sep 17 00:00:00 2001 From: Craig Comstock Date: Sun, 26 Jul 2026 10:19:27 -0400 Subject: [PATCH 3/9] Migrate centos-7 and container build host setup from policy to scripts Ticket: ENT-14330 Changelog: none --- ci/setup-cfengine-build-host.sh | 19 +++ ci/setup-ci-host.sh | 208 ++++++++++++++++++++++++++++++++ 2 files changed, 227 insertions(+) create mode 100755 ci/setup-ci-host.sh diff --git a/ci/setup-cfengine-build-host.sh b/ci/setup-cfengine-build-host.sh index cac131fde..e6adec97b 100755 --- a/ci/setup-cfengine-build-host.sh +++ b/ci/setup-cfengine-build-host.sh @@ -26,6 +26,8 @@ rm -rf cfengine-masterfiles* function cleanup() { set -e + [ -f /var/log/messages ] && tail /var/log/messages + command -v journalctl >/dev/null && journalctl --lines=20 if command -v apt >/dev/null 2>&1; then # workaround for CFE-4544, remove scriptlets call systemctl even when systemctl is-system-running returns false # Replace systemctl with a no-op stub that always succeeds. We can't @@ -95,9 +97,12 @@ if [ -f /etc/os-release ]; then yum update --assumeyes alias software='yum install --assumeyes' elif grep -q debian /etc/os-release; then + DEBIAN_FRONTEND=noninteractive apt update + # sometimes the /boot partition is too small to handle kernel upgrade regenerations of initrd and related files on ubuntu, so allow failure first DEBIAN_FRONTEND=noninteractive apt upgrade --yes || true DEBIAN_FRONTEND=noninteractive apt autoremove --yes + # and now perform the upgrade a second time after hopefully autoremove cleans up /boot partition of kernel files that cause failure DEBIAN_FRONTEND=noninteractive apt upgrade --yes DEBIAN_FRONTEND=noninteractive apt autoremove --yes @@ -145,6 +150,20 @@ if [ -f /etc/cfengine-bootstrap-pr-host.flag ]; then exit fi +if [ -f /etc/cfengine-containers-host.flag ]; then + "$thisdir"/setup-ci-host.sh + exit +fi + +# platforms too old to support cf-remote, use scripts instead +if [ -f /etc/os-release ]; then + source /etc/os-release + if [ "$ID" = "centos" ] && [ "$VERSION_ID" = "7" ]; then + "$thisdir"/setup-ci-host.sh + exit + fi +fi + if grep -q ubuntu /etc/os-release; then if grep -qi version=\"16 /etc/os-release; then urlget https://cfengine-package-repos.s3.amazonaws.com/enterprise/Enterprise-3.21.8/agent/agent_ubuntu16_x86_64/cfengine-nova_3.21.8-1.ubuntu16_amd64.deb diff --git a/ci/setup-ci-host.sh b/ci/setup-ci-host.sh new file mode 100755 index 000000000..447223627 --- /dev/null +++ b/ci/setup-ci-host.sh @@ -0,0 +1,208 @@ +#!/usr/bin/env bash +set -e +shopt -s expand_aliases +thisdir="$(dirname "$0")" + +packages="" # a space separated list of packages to install +function add-pkg() +{ + packages+=" $*" +} + +# we setup some vars for platform versions to make it easier to make choice later +# default version is 0 so that a check can be [ "$debian" -gt "12" ] and that will skip non-debians and such +redhat=0 +debian=0 +ubuntu=0 +suse=0 +# shellcheck disable=SC2034 +solaris=0 +# shellcheck disable=SC2034 +hpux=0 +# shellcheck disable=SC2034 +aix=0 + +if [ -f /etc/os-release ]; then + source /etc/os-release + if grep -q rhel /etc/os-release; then + yum update --assumeyes + alias packages='yum install --assumeyes' + redhat="$VERSION_ID" + elif grep -q debian /etc/os-release; then + alias packages='DEBIAN_FRONTEND=noninteractive apt install --yes' + debian="$VERSION_ID" + elif grep -q suse /etc/os-release; then + alias packages='zypper install -y' + # shellcheck disable=SC2034 + suse="$VERSION_ID" + else + echo "Unknown platform ID $ID. Need this information in order to update/upgrade distribution packages." + exit 1 + fi +elif [ -f /etc/redhat-release ]; then + alias packages='yum install --assumeyes' + # shellcheck disable=SC1091 + source /etc/redhat-release + redhat="$VERSION_ID" +else + echo "No /etc/os-release or /etc/redhat-release so cant determine platform." + exit 1 +fi + +if [ -f /etc/cfengine-containers-host.flag ]; then + if [ "$debian" -ge "12" ]; then + # in jenkins, CONTAINER labeled nodes are capable of running container builds like valgrind-check and static-check + add-pkg unzip # linux-install-groovy.sh needs unzip to unpack the groovy distribution archive + add-pkg buildah + add-pkg jq + add-pkg make + add-pkg parallel + add-pkg podman + if ! command -v groovy; then + bash "$thisdir"/linux-install-groovy.sh + fi + + # NOPASSWD is needed for various tools related to container jobs + rm -rf /etc/sudoers.d/999-local + cat >/etc/sudoers.d/999-local </dev/null; then + if [ ! -f /etc/cfengine-containers-host.flag ]; then + sysctl kernel.core_pattern='|/lib/systemd/systemd-coredump %p %u %g %s %t %e' + fi +fi + +"$thisdir"/linux-install-jdk.sh # the script should skip if sufficient java is already installed + +# leech2 build toolchain host +if [ "$ubuntu" -ge 20 ] || [ "$debian" -ge 12 ] || [ "$redhat" -ge 7 ]; then + "$thisdir"/linux-install-protobuf.sh + # TODO if mingw then pass along x86_64-pc-windows-gnu as an arg to install rust + "$thisdir"/linux-install-rust.sh +fi + +if [ "$redhat" -ge 7 ]; then + yum groups install -y 'Development Tools' +fi + +if [ "$redhat" = 8 ]; then + sudo rpm -iv https://kojipkgs.fedoraproject.org//packages/fakeroot/1.23/1.fc29/x86_64/fakeroot-1.23-1.fc29.x86_64.rpm https://kojipkgs.fedoraproject.org//packages/fakeroot/1.23/1.fc29/x86_64/fakeroot-libs-1.23-1.fc29.x86_64.rpm +fi + +if [ "$redhat" -gt 7 ]; then + yum install --assumeyes https://dl.fedoraproject.org/pub/epel/epel-release-latest-"$redhat".noarch.rpm +fi From 46df9a53bc32d2515e64bfb8424a6d1a5397faf5 Mon Sep 17 00:00:00 2001 From: Craig Comstock Date: Mon, 27 Jul 2026 06:32:11 -0500 Subject: [PATCH 4/9] Refactor sshd restart for hardening to a reload instead for use in packer image building systemctl restart doesn't work well in a packer session so we use a kill -1 (SIGHUP) instead which causes future ssh sessions to use our new hardened configuration. Ticket: ENT-14330 Changelog: none --- ci/cfengine-build-host-setup.cf | 11 +++++------ ci/setup-cfengine-build-host.sh | 3 ++- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/ci/cfengine-build-host-setup.cf b/ci/cfengine-build-host-setup.cf index 46e4b2890..a8205af36 100644 --- a/ci/cfengine-build-host-setup.cf +++ b/ci/cfengine-build-host-setup.cf @@ -378,6 +378,11 @@ bundle agent cfengine_build_host_setup comment => "note: centos-7 has installed instead of --installed argument, and that works on rhel-8 and rhel-9 so go with the sub-command instead of option"; commands: + sshd_hardened:: + 'kill -1 $(pgrep -f "sshd -D")' + handle => "sshd_restarted", + contain => in_shell, + comment => "Reload sshd config with SIGHUP(1) to apply hardened configuration"; have_tmp_mount:: "mount -o remount,size=5G /tmp" comment => "We could check if /tmp was size 5G but not worth the trouble since this remount call just sets the maximum size of the tmpfs in virtual memory.", @@ -651,12 +656,6 @@ jenkins ALL=NOPASSWD: /usr/bin/podman comment => "Verify KbdInteractiveAuthentication (OpenSSH 8.7+) or ChallengeResponseAuthentication (older) is disabled"; services: - sshd_hardened:: - "$(sshd_service_name)" - service_policy => "restart", - handle => "sshd_restarted", - comment => "Restart sshd to apply hardened configuration"; - any:: "fail2ban" service_policy => "start", diff --git a/ci/setup-cfengine-build-host.sh b/ci/setup-cfengine-build-host.sh index e6adec97b..88df7ac83 100755 --- a/ci/setup-cfengine-build-host.sh +++ b/ci/setup-cfengine-build-host.sh @@ -26,8 +26,9 @@ rm -rf cfengine-masterfiles* function cleanup() { set -e + set -x [ -f /var/log/messages ] && tail /var/log/messages - command -v journalctl >/dev/null && journalctl --lines=20 + command -v journalctl >/dev/null && journalctl | grep -P '(error|fail)' if command -v apt >/dev/null 2>&1; then # workaround for CFE-4544, remove scriptlets call systemctl even when systemctl is-system-running returns false # Replace systemctl with a no-op stub that always succeeds. We can't From 3510e53c9246f579bf4d277cbaed43d1017596a8 Mon Sep 17 00:00:00 2001 From: Craig Comstock Date: Mon, 27 Jul 2026 10:32:52 -0500 Subject: [PATCH 5/9] Ran shellcheck and shfmt on ci/setup-*.sh Ticket: ENT-14330 Changelog: none --- ci/setup-cfengine-build-host.sh | 2 +- ci/setup-ci-host.sh | 199 ++++++++++++++++---------------- 2 files changed, 99 insertions(+), 102 deletions(-) diff --git a/ci/setup-cfengine-build-host.sh b/ci/setup-cfengine-build-host.sh index 88df7ac83..d47f3246b 100755 --- a/ci/setup-cfengine-build-host.sh +++ b/ci/setup-cfengine-build-host.sh @@ -237,7 +237,7 @@ if ! /var/cfengine/bin/cf-agent -V 2>/dev/null; then else _VERSION="" fi - cf-remote --log-level info $_VERSION install --clients localhost || true + cf-remote --log-level info "$_VERSION" install --clients localhost || true fi if [ ! -x /var/cfengine/bin/cf-agent ]; then diff --git a/ci/setup-ci-host.sh b/ci/setup-ci-host.sh index 447223627..defa736d6 100755 --- a/ci/setup-ci-host.sh +++ b/ci/setup-ci-host.sh @@ -4,9 +4,8 @@ shopt -s expand_aliases thisdir="$(dirname "$0")" packages="" # a space separated list of packages to install -function add-pkg() -{ - packages+=" $*" +function add-pkg() { + packages+=" $*" } # we setup some vars for platform versions to make it easier to make choice later @@ -50,21 +49,21 @@ else fi if [ -f /etc/cfengine-containers-host.flag ]; then - if [ "$debian" -ge "12" ]; then - # in jenkins, CONTAINER labeled nodes are capable of running container builds like valgrind-check and static-check - add-pkg unzip # linux-install-groovy.sh needs unzip to unpack the groovy distribution archive - add-pkg buildah - add-pkg jq - add-pkg make - add-pkg parallel - add-pkg podman - if ! command -v groovy; then - bash "$thisdir"/linux-install-groovy.sh - fi - - # NOPASSWD is needed for various tools related to container jobs - rm -rf /etc/sudoers.d/999-local - cat >/etc/sudoers.d/999-local </etc/sudoers.d/999-local </dev/null; then - if [ ! -f /etc/cfengine-containers-host.flag ]; then - sysctl kernel.core_pattern='|/lib/systemd/systemd-coredump %p %u %g %s %t %e' - fi + if [ ! -f /etc/cfengine-containers-host.flag ]; then + sysctl kernel.core_pattern='|/lib/systemd/systemd-coredump %p %u %g %s %t %e' + fi fi "$thisdir"/linux-install-jdk.sh # the script should skip if sufficient java is already installed @@ -196,13 +193,13 @@ if [ "$ubuntu" -ge 20 ] || [ "$debian" -ge 12 ] || [ "$redhat" -ge 7 ]; then fi if [ "$redhat" -ge 7 ]; then - yum groups install -y 'Development Tools' + yum groups install -y 'Development Tools' fi if [ "$redhat" = 8 ]; then - sudo rpm -iv https://kojipkgs.fedoraproject.org//packages/fakeroot/1.23/1.fc29/x86_64/fakeroot-1.23-1.fc29.x86_64.rpm https://kojipkgs.fedoraproject.org//packages/fakeroot/1.23/1.fc29/x86_64/fakeroot-libs-1.23-1.fc29.x86_64.rpm + sudo rpm -iv https://kojipkgs.fedoraproject.org//packages/fakeroot/1.23/1.fc29/x86_64/fakeroot-1.23-1.fc29.x86_64.rpm https://kojipkgs.fedoraproject.org//packages/fakeroot/1.23/1.fc29/x86_64/fakeroot-libs-1.23-1.fc29.x86_64.rpm fi if [ "$redhat" -gt 7 ]; then - yum install --assumeyes https://dl.fedoraproject.org/pub/epel/epel-release-latest-"$redhat".noarch.rpm + yum install --assumeyes https://dl.fedoraproject.org/pub/epel/epel-release-latest-"$redhat".noarch.rpm fi From 9070bd7a4ace403f3677641c53ffcb61b968e8db Mon Sep 17 00:00:00 2001 From: Craig Comstock Date: Mon, 27 Jul 2026 10:49:16 -0500 Subject: [PATCH 6/9] Fixed setup-ci-host dnf/yum conf fixes for redhats Ticket: ENT-14330 Changelog: none --- ci/setup-ci-host.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ci/setup-ci-host.sh b/ci/setup-ci-host.sh index defa736d6..c88f5d7a3 100755 --- a/ci/setup-ci-host.sh +++ b/ci/setup-ci-host.sh @@ -78,10 +78,12 @@ EOF fi if [ "$redhat" != 0 ]; then - if [ "$redhat" -le 7 ]; then + if [ "$redhat" -gt 7 ]; then if ! grep best=False /etc/yum.conf; then sed -i '/best=True/s/True/False/' /etc/yum.conf fi + fi + if [ "$redhat" -ge 8 ]; then if ! grep best=False /etc/dnf/dnf.conf; then sed -i '/best=True/s/True/False/' /etc/dnf/dnf.conf fi From 8b2c11b0a1c7d9e91a3518956c77cdf80e513d20 Mon Sep 17 00:00:00 2001 From: Craig Comstock Date: Mon, 27 Jul 2026 14:17:56 -0500 Subject: [PATCH 7/9] Fixed setup-cfengine-build-host to use cf-remote with older python versions see ENT-14373, a cf-remote bug which is worked around in our script here for now. Ticket: ENT-14330 Changelog: none --- ci/setup-cfengine-build-host.sh | 43 +++++++++++++++++++++------------ 1 file changed, 28 insertions(+), 15 deletions(-) diff --git a/ci/setup-cfengine-build-host.sh b/ci/setup-cfengine-build-host.sh index d47f3246b..c9fc6270d 100755 --- a/ci/setup-cfengine-build-host.sh +++ b/ci/setup-cfengine-build-host.sh @@ -36,7 +36,7 @@ function cleanup() { # single multi-call uutils binary that dispatches on argv[0], so it # would fail with "coreutils: unknown program 'systemctl'". rm -f /bin/systemctl - printf '#!/bin/sh\nexit 0\n' > /bin/systemctl + printf '#!/bin/sh\nexit 0\n' >/bin/systemctl chmod +x /bin/systemctl apt remove -y cfengine-nova || true elif command -v yum >/dev/null 2>&1; then @@ -97,6 +97,7 @@ if [ -f /etc/os-release ]; then if grep -q rhel /etc/os-release; then yum update --assumeyes alias software='yum install --assumeyes' + alias erase-packages='yum erase --assumeyes' elif grep -q debian /etc/os-release; then DEBIAN_FRONTEND=noninteractive apt update @@ -108,9 +109,11 @@ if [ -f /etc/os-release ]; then DEBIAN_FRONTEND=noninteractive apt upgrade --yes DEBIAN_FRONTEND=noninteractive apt autoremove --yes alias software='DEBIAN_FRONTEND=noninteractive apt install --yes' + alias erase-packages='DEBIAN_FRONTEND=noninteractive apt purge --yes' elif grep -q suse /etc/os-release; then zypper -n update alias software='zypper install -y' + alias erase-packages='zypper uninstall -y' else echo "Unknown platform ID $ID. Need this information in order to update/upgrade distribution packages." exit 1 @@ -147,22 +150,13 @@ fi # Here we start replacing the use of CFEngine policy with scripts. See ENT-14330 if [ -f /etc/cfengine-bootstrap-pr-host.flag ]; then - "$thisdir"/setup-bootstrap-host.sh - exit + "$thisdir"/setup-bootstrap-host.sh + exit fi if [ -f /etc/cfengine-containers-host.flag ]; then - "$thisdir"/setup-ci-host.sh - exit -fi - -# platforms too old to support cf-remote, use scripts instead -if [ -f /etc/os-release ]; then - source /etc/os-release - if [ "$ID" = "centos" ] && [ "$VERSION_ID" = "7" ]; then "$thisdir"/setup-ci-host.sh exit - fi fi if grep -q ubuntu /etc/os-release; then @@ -227,8 +221,8 @@ echo "Checking for pre-installed CFEngine (chicken/egg problem)" # We need a cf-agent to run build host setup policy and redhat-10-arm did not have a previous package to install. if ! /var/cfengine/bin/cf-agent -V 2>/dev/null; then echo "No existing CFEngine install found, try cf-remote..." - if grep -qi stretch /etc/os-release || grep -qi buster /etc/os-release; then - _VERSION="--version 3.21.8" # 3.27.0 and 3.24.x do not have debian 9 (stretch) or debian 10 (buster) + if grep -qi stretch /etc/os-release || grep -qi buster /etc/os-release || grep -qi bionic /etc/os-release; then + _VERSION="--version 3.21.8" # 3.27.0 and 3.24.x do not have debian 9 (stretch) or debian 10 (buster) or ubuntu 18 (bionic) elif grep -qi bullseye /etc/os-release; then _VERSION="--version 3.24.3" # 3.27.0 has only debian > 11 (bullseye) elif grep -q suse /etc/os-release; then @@ -237,10 +231,29 @@ if ! /var/cfengine/bin/cf-agent -V 2>/dev/null; then else _VERSION="" fi - cf-remote --log-level info "$_VERSION" install --clients localhost || true + + # ENT-14373, migrate any cf-remote cache/config files to avoid dirs_exist_ok problems on old pythons + if [ -d "$HOME"/.cfengine/cf-remote/json ]; then + mkdir -p "$HOME"/.cache/cfengine/cf-remote + mv "$HOME"/.cfengine/cf-remote/json "$HOME"/.cache/cfengine/cf-remote/ + fi + if [ -d "$HOME"/.cfengine/cf-remote/packages ]; then + mkdir -p "$HOME"/.cache/cfengine/cf-remote + mv "$HOME"/.cfengine/cf-remote/packages "$HOME"/.cache/cfengine/cf-remote/ + fi + if [ -d "$HOME"/.cfengine/cf-remote ]; then + mkdir -p "$HOME"/.config/cfengine/cf-remote + mv "$HOME"/.cfengine/cf-remote/* "$HOME"/.config/cfengine/cf-remote/ + fi + + # We are passing a two-token string and need it to stay two tokens for proper argument parsing in $_VERSION + # shellcheck disable=SC2086 + erase-packages cfbuild-* # in case a dirty build was left on a long-living build host + cf-remote --log-level info $_VERSION install --clients localhost || true fi if [ ! -x /var/cfengine/bin/cf-agent ]; then + [ -f /var/log/CFEngine-Install.log ] && tail /var/log/CFEngine-Install.log echo "cf-remote didn't install CFEngine, build from source..." software git echo "cf-remote didn't install cf-agent, try from source" From c43b4f27f813e47a9da52aae9be074800fbf21aa Mon Sep 17 00:00:00 2001 From: Craig Comstock Date: Mon, 27 Jul 2026 14:35:33 -0500 Subject: [PATCH 8/9] Added a few needed packages to setup-bootstrap-host.sh librsync-dev autoconf-archive required to resolve the AX_PTHREAD macro Ticket: ENT-14330 Changelog: none --- ci/setup-bootstrap-host.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ci/setup-bootstrap-host.sh b/ci/setup-bootstrap-host.sh index 4cc4a1a33..dfd681ab7 100755 --- a/ci/setup-bootstrap-host.sh +++ b/ci/setup-bootstrap-host.sh @@ -9,6 +9,8 @@ apt-get -qy update apt-get -qy upgrade apt-get -y install git autogen autoconf automake m4 make bison flex binutils libtool gcc g++ libc-dev \ liblmdb-dev libpam0g-dev python libssl-dev libpcre3-dev psmisc curl jq unzip \ + librsync-dev \ + autoconf-archive \ pigz parallel libpcre2-dev php-zip bash "$thisdir"/linux-install-php.sh From cf1262a080eda10adcee526d51ef7a7992d8de59 Mon Sep 17 00:00:00 2001 From: Craig Comstock Date: Mon, 27 Jul 2026 14:57:03 -0500 Subject: [PATCH 9/9] Adjusted setup-cfengine-build-host.sh to cleanup previous build more This is needed because now we run this script in each bootstrap-pr and testing-pr job. Ticket: ENT-14330 Changelog: none --- ci/setup-cfengine-build-host.sh | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/ci/setup-cfengine-build-host.sh b/ci/setup-cfengine-build-host.sh index c9fc6270d..795d5f567 100755 --- a/ci/setup-cfengine-build-host.sh +++ b/ci/setup-cfengine-build-host.sh @@ -19,6 +19,13 @@ if ! id -u jenkins; then useradd jenkins -p jenkins fi mkdir -p /home/jenkins + +# The following is copied from prepare-testmachine-chroot +CHROOT_ROOT=/home/jenkins/testmachine-chroot/ +fuser -k "$CHROOT_ROOT" >/dev/null 2>&1 || true +# Unmount the /proc filesystem if it was previously mounted inside the chroot. +umount "${CHROOT_ROOT}proc" >/dev/null 2>&1 || true + chown -R jenkins /home/jenkins # cleanup any previous runs cfengine-masterfiles tar balls @@ -246,9 +253,11 @@ if ! /var/cfengine/bin/cf-agent -V 2>/dev/null; then mv "$HOME"/.cfengine/cf-remote/* "$HOME"/.config/cfengine/cf-remote/ fi + + erase-packages cfbuild-* || true # in case a dirty build was left on a long-living build host + # We are passing a two-token string and need it to stay two tokens for proper argument parsing in $_VERSION # shellcheck disable=SC2086 - erase-packages cfbuild-* # in case a dirty build was left on a long-living build host cf-remote --log-level info $_VERSION install --clients localhost || true fi