|
| 1 | +#!/bin/bash |
| 2 | +# Copyright 2018-2021 Splunk |
| 3 | +# |
| 4 | +# Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | +# you may not use this file except in compliance with the License. |
| 6 | +# You may obtain a copy of the License at |
| 7 | +# |
| 8 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +# |
| 10 | +# Unless required by applicable law or agreed to in writing, software |
| 11 | +# distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | +# See the License for the specific language governing permissions and |
| 14 | +# limitations under the License. |
| 15 | + |
| 16 | +set -e |
| 17 | + |
| 18 | +# Generate UTF-8 char map and locale |
| 19 | +# Reinstalling local English def for now, removed in minimal image: https://bugzilla.redhat.com/show_bug.cgi?id=1665251 |
| 20 | +# Comment below install until glibc update is available in minimal image: https://access.redhat.com/errata/RHSA-2024:2722 |
| 21 | +#microdnf -y --nodocs install glibc-langpack-en |
| 22 | + |
| 23 | +# Currently there is no access to the UTF-8 char map. The following command is commented out until |
| 24 | +# the base container can generate the locale. |
| 25 | +# localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8 |
| 26 | +# We get around the gen above by forcing the language install, and then pointing to it. |
| 27 | +export LANG=en_US.utf8 |
| 28 | + |
| 29 | +# Install utility packages |
| 30 | +microdnf -y --nodocs install wget sudo shadow-utils procps tar make gcc \ |
| 31 | + openssl-devel libffi-devel findutils libssh-devel \ |
| 32 | + libcurl-devel ncurses-devel diffutils zlib-devel |
| 33 | +# Patch security updates |
| 34 | +microdnf -y --nodocs update gnutls kernel-headers libdnf librepo libnghttp2 nettle \ |
| 35 | + libpwquality libxml2 systemd-libs lz4-libs curl \ |
| 36 | + rpm rpm-libs sqlite-libs cyrus-sasl-lib vim expat \ |
| 37 | + openssl-libs xz-libs zlib libsolv file-libs pcre \ |
| 38 | + libarchive libgcrypt libksba libstdc++ json-c gnupg |
| 39 | + |
| 40 | +# TODO: install busybox via EPEL? Will this even work? |
| 41 | +# currently seeing errors when installing/building via source |
| 42 | + |
| 43 | +# Install Python and necessary packages |
| 44 | +PY_SHORT=${PYTHON_VERSION%.*} |
| 45 | +wget -O /tmp/python.tgz https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz |
| 46 | +wget -O /tmp/Python-gpg-sig-${PYTHON_VERSION}.tgz.asc https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz.asc |
| 47 | +gpg --keyserver keys.openpgp.org --recv-keys $PYTHON_GPG_KEY_ID \ |
| 48 | + || gpg --keyserver pool.sks-keyservers.net --recv-keys $PYTHON_GPG_KEY_ID \ |
| 49 | + || gpg --keyserver pgp.mit.edu --recv-keys $PYTHON_GPG_KEY_ID \ |
| 50 | + || gpg --keyserver keyserver.pgp.com --recv-keys $PYTHON_GPG_KEY_ID |
| 51 | +gpg --verify /tmp/Python-gpg-sig-${PYTHON_VERSION}.tgz.asc /tmp/python.tgz |
| 52 | +rm /tmp/Python-gpg-sig-${PYTHON_VERSION}.tgz.asc |
| 53 | +mkdir -p /tmp/pyinstall |
| 54 | +tar -xzC /tmp/pyinstall/ --strip-components=1 -f /tmp/python.tgz |
| 55 | +rm /tmp/python.tgz |
| 56 | +cd /tmp/pyinstall |
| 57 | +./configure --enable-optimizations --prefix=/usr --with-ensurepip=install |
| 58 | +make altinstall LDFLAGS="-Wl,--strip-all" |
| 59 | +rm -rf /tmp/pyinstall |
| 60 | +ln -sf /usr/bin/python${PY_SHORT} /usr/bin/python |
| 61 | +ln -sf /usr/bin/pip${PY_SHORT} /usr/bin/pip |
| 62 | +ln -sf /usr/bin/python${PY_SHORT} /usr/bin/python3 |
| 63 | +ln -sf /usr/bin/pip${PY_SHORT} /usr/bin/pip3 |
| 64 | + |
| 65 | +# Install splunk-ansible dependencies |
| 66 | +cd / |
| 67 | +/usr/bin/python3.9 -m pip install --upgrade pip |
| 68 | +pip -q --no-cache-dir install --upgrade requests_unixsocket requests six wheel Mako "urllib3<2.0.0" certifi jmespath future avro cryptography lxml protobuf setuptools ansible |
| 69 | + |
| 70 | +# Remove tests packaged in python libs |
| 71 | +find /usr/lib/ -depth \( -type d -a -not -wholename '*/ansible/plugins/test' -a \( -name test -o -name tests -o -name idle_test \) \) -exec rm -rf '{}' \; |
| 72 | +find /usr/lib/ -depth \( -type f -a -name '*.pyc' -o -name '*.pyo' -o -name '*.a' \) -exec rm -rf '{}' \; |
| 73 | +find /usr/lib/ -depth \( -type f -a -name 'wininst-*.exe' \) -exec rm -rf '{}' \; |
| 74 | +ldconfig |
| 75 | + |
| 76 | +# Cleanup |
| 77 | +microdnf remove -y make gcc openssl-devel findutils glibc-devel cpp \ |
| 78 | + libffi-devel libcurl-devel libssh-devel libxcrypt-devel \ |
| 79 | + ncurses-devel zlib-devel |
| 80 | +microdnf clean all |
| 81 | + |
| 82 | +# Enable busybox symlinks |
| 83 | +cd /bin |
| 84 | +BBOX_LINKS=( clear find diff hostname killall netstat nslookup ping ping6 readline route syslogd tail traceroute vi ) |
| 85 | +for item in "${BBOX_LINKS[@]}" |
| 86 | +do |
| 87 | + ln -s busybox $item || true |
| 88 | +done |
| 89 | +groupadd sudo |
| 90 | + |
| 91 | +echo " |
| 92 | +## Allows people in group sudo to run all commands |
| 93 | +%sudo ALL=(ALL) ALL" >> /etc/sudoers |
| 94 | + |
| 95 | +# Clean |
| 96 | +microdnf clean all |
| 97 | +rm -rf /install.sh /anaconda-post.log /var/log/anaconda/* |
0 commit comments