Add pre-build hooks

[aig787]

This PR addresses #565 and hopefully a number of the open issues about the lack of openssl in the builders. It does add a dependency on gosu which handles lowering the privileges down to user level after the pre-build hooks are run. For now I've only added it to the x86_64-unknown-linux-gnu target for testing pending feedback on it.

I was able to build Cargo successfully with all features with

[target.x86_64-unknown-linux-gnu]
image = "rustembedded/cross:x86_64-unknown-linux-gnu-0.2.1"
pre-build = """
yum update -y
yum install -y openssl-devel
"""

[Emilgardis]

Awesome!

This is really a workaround but it's quite neat.
Why do we need to lower privileges?

[aig787]

I'm not sure we necessarily need to - just seemed good practice to me especially since when hooks aren't provided the containers are run with the --user argument. Lowering privileges was just an attempt at getting us into the same state for the build whether they were provided or not.

[otavio]

I just small code comment, but I'd like to say I like the idea, and it does avoid the need for many custom images.

[otavio]

Please move the code back to the original place as it is a non-required code change.

[aig787]

I can revert some of this, but not all of it. In order for for the pre-build hooks to install packages we have to remove the --user flag when hooks are present. So we can either

• Remove --user all the time (cargo executes as root)
• Check for pre-build hooks and remove --user when they exist (cargo executes as root only when pre-build hooks are specified)
• Check for pre-build hooks and remove --user when they exist but de-escalate privileges so cargo still runs with the specified UID/GID (what the PR currently does)

I don't have a strong opinion which of them to use - but whichever one we go with this particular block has to move.

[Emilgardis]

marking as draft as only one target is implemented right now

[aig787]

marking as draft as only one target is implemented right now

I'm happy to get moving on the other targets if we're happy with the implementation. I'm also happy to revert the privilege de escalation first, just need to know what the preference is from your side.

[Emilgardis]

marking as draft as only one target is implemented right now

I'm happy to get moving on the other targets if we're happy with the implementation. I'm also happy to revert the privilege de escalation first, just need to know what the preference is from your side.

I think the gid/uid setting is good, there is a reason we allow setting it.

[Emilgardis]

see my comment on #643 (comment) regarding the "issue" that the image is now centos.

[Emilgardis]

Been thinking about this some more now, would it make sense to actually not do this, and just use the technique in #678 and hook into a dockerfile passed to stdin to docker build --build-arg cmd=blabla [additional flags] -

FROM {target}
ARG CMD=exit 0
RUN $CMD

This way we can even support custom images, and we get a cache

[patrickelectric]

This is a great feature!

[Alexhuszagh]

Closed since it has been superseded by #678.