builds.yml

name: Builds
on:
  - push

permissions:
  contents: read

concurrency:
  group: ${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-incus:
    name: Build Incus
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-20.04
          - ubuntu-22.04
          - debian-11
          - debian-12
        arch:
          - amd64
          - arm64
        exclude:
          - os: debian-11
            arch: arm64
    runs-on:
      - self-hosted
      - cpu-4
      - mem-4G
      - disk-50G
      - arch-${{ matrix.arch }}
      - image-${{ matrix.os }}

    env:
      OS_ARCH: ${{ matrix.arch }}
      HOME: "/root/"
      PKG_CONFIG_PATH: "/opt/incus/lib/pkgconfig/"
      CGO_LDFLAGS: "-L/opt/incus/lib/"
      CGO_CFLAGS: "-I/opt/incus/include/"
      LD_LIBRARY_PATH: "/opt/incus/lib/"
      PATH: "/opt/incus/bin:/usr/local/go/bin:/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin:/usr/local/sbin"
      LXC_TAG: "lxc-5.0.3"
      LXCFS_TAG: "lxcfs-5.0.4"
      INCUS_TAG: "main"
      RAFT_TAG: "main"
      COWSQL_TAG: "main"
      CRIU_TAG: "v3.18"
      EDK2_TAG: "edk2-stable202308"
      GOLANG_TAG: "1.21.1"
      LIBTPMS_TAG: "v0.9.6"
      LIBURING_TAG: "liburing-2.4"
      MINIO_TAG: "RELEASE.2023-09-07T02-05-02Z"
      NASM_TAG: "nasm-2.16.01"
      NVIDIA_CONTAINER_TAG: "v1.14.1"
      QEMU_TAG: "v8.1.0"
      SEABIOS_TAG: "rel-1.16.2"
      SWTPM_TAG: "v0.8.0"
      VIRTIOFSD_TAG: "v1.8.0"
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Configure git
        run: |
          git config --global --add advice.detachedHead false

      - name: Install dependencies
        run: |
          apt-get install --no-install-recommends --yes \
            acpica-tools \
            asciidoc \
            autoconf \
            automake \
            bison \
            bmake \
            build-essential \
            cargo \
            curl \
            debhelper \
            devscripts \
            dosfstools \
            expect \
            flex \
            gawk \
            git \
            iproute2 \
            libacl1-dev \
            libaio-dev \
            libapparmor-dev \
            libcap-dev \
            libcap-ng-dev \
            libdbus-1-dev \
            libelf-dev \
            libfuse3-dev \
            libglib2.0-dev \
            libgnutls28-dev \
            libjson-glib-dev \
            libnet1-dev \
            libnl-3-dev \
            libnuma-dev \
            libpam0g-dev \
            libpixman-1-dev \
            libprotobuf-c-dev \
            libprotobuf-dev \
            librbd-dev \
            libseccomp-dev \
            libselinux1-dev \
            libspice-server-dev \
            libsqlite3-dev \
            libssl-dev \
            libtool \
            libudev-dev \
            libusb-1.0-0-dev \
            libusbredirhost-dev \
            libuv1-dev \
            lsb-release \
            mtools \
            ninja-build \
            pkg-config \
            protobuf-c-compiler \
            protobuf-compiler \
            python3-cryptography \
            python3-jinja2 \
            python3-pexpect \
            python3-pip \
            python3-setuptools \
            python3-venv \
            rsync \
            rustc \
            socat \
            uuid-dev \
            xmlto \
            xorriso

          pip3 install meson || pip3 install meson --break-system-packages

      - name: Install Go
        run: |
          curl -sL "https://go.dev/dl/go${GOLANG_TAG}.linux-${OS_ARCH}.tar.gz" | tar -C /usr/local/ -zx
          go version

      - name: Build environment
        run: |
          mkdir /build/
          mkdir -p \
            /opt/incus/bin/ \
            /opt/incus/include/ \
            /opt/incus/lib/ \
            /opt/incus/lib/systemd/system/ \
            /opt/incus/share/

      - name: Get the code
        run: |
          git clone https://github.com/axboe/liburing /build/liburing --depth 1 -b "${LIBURING_TAG}"
          git clone https://github.com/cowsql/raft /build/raft --depth 1 -b "${RAFT_TAG}"
          git clone https://github.com/cowsql/cowsql /build/cowsql --depth 1 -b "${COWSQL_TAG}"
          git clone https://github.com/lxc/lxc /build/lxc --depth 1 -b "${LXC_TAG}"
          git clone https://github.com/lxc/lxcfs /build/lxcfs --depth 1 -b "${LXCFS_TAG}"
          git clone https://github.com/lxc/incus /build/incus --depth 1 -b "${INCUS_TAG}"

          git clone https://github.com/checkpoint-restore/criu /build/criu --depth 1 -b "${CRIU_TAG}"
          git clone https://github.com/NVIDIA/libnvidia-container /build/libnvidia-container --depth 1 -b "${NVIDIA_CONTAINER_TAG}"
          git clone https://github.com/minio/minio /build/minio --depth 1 -b "${MINIO_TAG}"

          git clone https://gitlab.com/qemu-project/seabios /build/seabios --depth 1 -b "${SEABIOS_TAG}"
          git clone https://github.com/netwide-assembler/nasm /build/nasm --depth 1 -b "${NASM_TAG}"
          git clone https://github.com/tianocore/edk2 /build/edk2 --recurse-submodules --shallow-submodules --depth 1 -b "${EDK2_TAG}"
          git clone https://github.com/stefanberger/libtpms /build/libtpms --depth 1 -b "${LIBTPMS_TAG}"
          git clone https://github.com/stefanberger/swtpm /build/swtpm --depth 1 -b "${SWTPM_TAG}"
          git clone https://gitlab.com/virtio-fs/virtiofsd /build/virtiofsd --depth 1 -b "${VIRTIOFSD_TAG}"
          git clone https://gitlab.com/qemu-project/qemu /build/qemu --depth 1 -b "${QEMU_TAG}"

      - name: Build liburing
        run: |
          cd /build/liburing
          ./configure --prefix=/opt/incus
          make

          mkdir -p /build/target/liburing/
          DESTDIR=/build/target/liburing make install
          rsync -a /build/target/liburing/opt/incus/include/* /opt/incus/include/
          rsync -a /build/target/liburing/opt/incus/lib/* /opt/incus/lib/

      - name: Build raft
        run: |
          cd /build/raft
          autoreconf -i
          ./configure --prefix=/opt/incus
          make

          mkdir -p /build/target/raft/
          DESTDIR=/build/target/raft/ make install
          rsync -a /build/target/raft/opt/incus/include/ /opt/incus/include/
          rsync -a /build/target/raft/opt/incus/lib/ /opt/incus/lib/

      - name: Build cowsql
        run: |
          cd /build/cowsql
          autoreconf -i
          ./configure --prefix=/opt/incus
          make

          mkdir -p /build/target/cowsql/
          DESTDIR=/build/target/cowsql/ make install
          rsync -a /build/target/cowsql/opt/incus/include/ /opt/incus/include/
          rsync -a /build/target/cowsql/opt/incus/lib/ /opt/incus/lib/

      - name: Build LXC
        run: |
          cd /build/lxc
          meson setup build \
                  --prefix=/opt/incus \
                  --libdir=/opt/incus/lib \
                  -Dexamples=false \
                  -Dman=false \
                  -Dtools=false \
                  -Dtests=false \
                  -Dmemfd-rexec=false \
                  -Dapparmor=true \
                  -Dseccomp=true \
                  -Dselinux=true \
                  -Dcapabilities=true \
                  -Dio-uring-event-loop=true
          meson compile -C build

          mkdir -p /build/target/lxc/
          DESTDIR=/build/target/lxc/ meson install -C build
          rsync -a /build/target/lxc/opt/incus/include/ /opt/incus/include/
          rsync -a /build/target/lxc/opt/incus/lib/ /opt/incus/lib/
          mkdir -p /opt/incus/share/lxc/config/common.conf.d/

      - name: Build LXCFS
        run: |
          REPO="${PWD}"

          cd /build/lxcfs
          meson setup build \
                  --prefix=/opt/incus \
                  --libdir=/opt/incus/lib \
                  -Ddocs=false \
                  -Dtests=false
          meson compile -C build

          mkdir -p /build/target/lxcfs/
          DESTDIR=/build/target/lxcfs/ meson install -C build
          rsync -a /build/target/lxcfs/opt/incus/bin/ /opt/incus/bin/
          rsync -a /build/target/lxcfs/opt/incus/share/ /opt/incus/share/
          rsync -a /build/target/lxcfs/opt/incus/lib/ /opt/incus/lib/

          sed -i "s#/var/lib/lxcfs#/var/lib/incus-lxcfs#g" /opt/incus/share/lxcfs/lxc.mount.hook
          patch -p1 /opt/incus/share/lxcfs/lxc.mount.hook < "${REPO}/patches/lxcfs-0001-hook.patch"
          cp "${REPO}/systemd/incus-lxcfs.service" /opt/incus/lib/systemd/system/

      - name: Build Incus
        run: |
          REPO="${PWD}"

          cd /build/incus
          go build -o "/opt/incus/bin/incus" github.com/lxc/incus/cmd/incus
          go build -o "/opt/incus/bin/incus-benchmark" -tags=libsqlite3 github.com/lxc/incus/cmd/incus-benchmark
          go build -o "/opt/incus/bin/incus-user" -tags=libsqlite3 github.com/lxc/incus/cmd/incus-user
          go build -o "/opt/incus/bin/incusd" -tags=libsqlite3 github.com/lxc/incus/incusd
          go build -o "/opt/incus/bin/lxc-to-incus" github.com/lxc/incus/cmd/lxc-to-incus
          CGO_ENABLED=0 go build -o "/opt/incus/bin/incus-agent" -tags=agent,netgo github.com/lxc/incus/cmd/incus-agent

          mkdir -p /opt/incus/share/bash_completion.d/
          cp scripts/bash/incus /opt/incus/share/bash_completion.d/incus

          cd /build/incus/cmd/lxd-to-incus
          go build -o "/opt/incus/bin/lxd-to-incus" -tags=libsqlite3 ./

          cp "${REPO}/systemd/incus.service" /opt/incus/lib/systemd/system/

      - name: Build CRIU
        run: |
          cd /build/criu
          make
          cp criu/criu /opt/incus/bin/

      - name: Build libnvidia-container
        run: |
          REPO="${PWD}"

          cd /build/libnvidia-container
          patch -p1 < "${REPO}/patches/nvidia-0001-Fix-for-22.04-build.patch"
          patch -p1 < "${REPO}/patches/nvidia-0002-pre-load-libdl.patch"
          make prefix=/

          mkdir /build/target/libnvidia-container
          DESTDIR=/build/target/libnvidia-container make install prefix=/
          rsync -a /build/target/libnvidia-container/bin/ /opt/incus/bin/
          rsync -a /build/target/libnvidia-container/include/ /opt/incus/include/
          rsync -a /build/target/libnvidia-container/lib/ /opt/incus/lib/

      - name: Build minio
        run: |
          cd /build/minio
          make build
          cp minio /opt/incus/bin/

      - name: Build seabios
        if: ${{ matrix.arch == 'amd64' }}
        run: |
          REPO="${PWD}"

          cd /build/seabios
          patch -p1 < "${REPO}/patches/seabios-0001-CSM-memory.patch"

          make clean distclean
          echo "CONFIG_QEMU_HARDWARE=y" > .config
          echo "CONFIG_CSM=y" >> .config
          echo "CONFIG_BOOTSPLASH=n" >> .config
          echo "CONFIG_ROM_SIZE=128" >> .config
          echo "CONFIG_PVSCSI=n" >> .config
          echo "CONFIG_ESP_SCSI=n" >> .config
          echo "CONFIG_LSI_SCSI=n" >> .config
          echo "CONFIG_MEGASAS=n" >> .config
          echo "CONFIG_MPT_SCSI=n" >> .config
          echo "CONFIG_FLOPPY=n" >> .config
          echo "CONFIG_FLASH_FLOPPY=n" >> .config
          make oldnoconfig V=1
          make V=1 PYTHON=python3

      - name: Build nasm
        run: |
          REPO="${PWD}"

          cd /build/nasm
          patch -p1 < "${REPO}/patches/nasm-0000-disable-manpages.patch"
          patch -p1 < "${REPO}/patches/nasm-0001-old-autoconf.patch"
          ./autogen.sh
          ./configure --prefix=/opt/incus
          make

          mkdir -p /build/target/nasm/
          DESTDIR=/build/target/nasm make install
          rsync -a /build/target/nasm/opt/incus/bin/ /opt/incus/bin/

      - name: Build EDK2
        run: |
          REPO="${PWD}"

          cd /build/edk2
          patch -p1 < "${REPO}/patches/edk2-0001-force-DUID-LLT.patch"
          cp "${REPO}/patches/edk2-0002-logo.bmp" MdeModulePkg/Logo/Logo.bmp
          patch -p1 < "${REPO}/patches/edk2-0003-boot-delay.patch"
          patch -p1 < "${REPO}/patches/edk2-0004-gcc-errors.patch"
          patch -p1 < "${REPO}/patches/edk2-0005-disable-EFI-memory-attributes-protocol.patch"

          if [ "$(uname -m)" = "x86_64" ]; then
              cp ../seabios/out/Csm16.bin OvmfPkg/Csm/Csm16/Csm16.bin
          fi

          EDK2_ARCH="X64"
          EDK2_PKG="OvmfPkg/OvmfPkgX64.dsc"
          EDK2_FV_CODE="OVMF_CODE"
          EDK2_FV_VARS="OVMF_VARS"
          if [ "$(uname -m)" = "aarch64" ]; then
              EDK2_ARCH="AARCH64"
              EDK2_PKG="ArmVirtPkg/ArmVirtQemu.dsc"
              EDK2_FV_CODE="QEMU_EFI"
              EDK2_FV_VARS="QEMU_VARS"
          fi

          build_edk2() {
              TARGET_CODE="$1"
              shift
              TARGET_VARS="$1"
              shift

              set -ex
              (
              cat << EOF
                  . ./edksetup.sh
                  make -C BaseTools ARCH=${EDK2_ARCH}
                  build -a ${EDK2_ARCH} -t GCC5 -b RELEASE -p ${EDK2_PKG} \
                    -DSMM_REQUIRE=FALSE \
                    -DSECURE_BOOT_ENABLE=TRUE \
                    -DNETWORK_IP4_ENABLE=TRUE \
                    -DNETWORK_IP6_ENABLE=TRUE \
                    -DNETWORK_TLS_ENABLE=TRUE \
                    -DNETWORK_HTTP_BOOT_ENABLE=TRUE \
                    -DTPM2_ENABLE=TRUE \
                    -DTPM2_CONFIG_ENABLE=TRUE \
                    $@
          EOF
              ) | bash -e

              cp Build/*/*/FV/${EDK2_FV_CODE}.fd "${TARGET_CODE}"
              cp Build/*/*/FV/${EDK2_FV_VARS}.fd "${TARGET_VARS}"

              if [ "$(uname -m)" = "aarch64" ]; then
                  truncate -s 64m "${TARGET_CODE}"
                  truncate -s 64m "${TARGET_VARS}"
              fi
          }

          mkdir -p "/opt/incus/share/qemu/"
          build_edk2 \
            "/opt/incus/share/qemu/OVMF_CODE.4MB.fd" \
            "/opt/incus/share/qemu/OVMF_VARS.4MB.fd" \
            -DFD_SIZE_4MB

          if [ "$(uname -m)" = "x86_64" ]; then
              build_edk2 \
                "/opt/incus/share/qemu/OVMF_CODE.4MB.CSM.fd" \
                "/opt/incus/share/qemu/OVMF_VARS.4MB.CSM.fd" \
                -DFD_SIZE_4MB \
                -DCSM_ENABLE=TRUE
          fi

          ln -s OVMF_CODE.4MB.fd /opt/incus/share/qemu/OVMF_CODE.fd
          ln -s OVMF_VARS.4MB.fd /opt/incus/share/qemu/OVMF_VARS.fd

      - name: Build libtmps
        run: |
          cd /build/libtpms
          ./autogen.sh
          ./configure --prefix=/opt/incus --with-tpm2 --with-openssl
          make

          mkdir -p /build/target/libtpms/
          DESTDIR=/build/target/libtpms make install
          rsync -a /build/target/libtpms/opt/incus/include/ /opt/incus/include/
          rsync -a /build/target/libtpms/opt/incus/lib/ /opt/incus/lib/

      - name: Build swtpm
        run: |
          cd /build/swtpm
          ./autogen.sh
          ./configure --prefix=/opt/incus --with-seccomp --with-openssl --without-cuse
          make

          mkdir -p /build/target/swtpm/
          DESTDIR=/build/target/swtpm make install
          rsync -a /build/target/swtpm/opt/incus/bin/ /opt/incus/bin/
          rsync -a /build/target/swtpm/opt/incus/include/ /opt/incus/include/
          rsync -a /build/target/swtpm/opt/incus/lib/ /opt/incus/lib/

      - name: Build virtiofsd
        run: |
          cd /build/virtiofsd
          cargo build --release
          cp target/release/virtiofsd /opt/incus/bin/

      - name: Build QEMU
        run: |
          cd /build/qemu
          sed -i "s/^unset target_list$/target_list=\"$(uname -m)-softmmu\"/" configure
          sed -i 's#libseccomp_minver=".*#libseccomp_minver="0.0"#g' configure
          ./configure \
                  --prefix=/opt/incus \
                  --libexecdir=lib/qemu \
                  --libdir=lib \
                  --disable-bochs \
                  --disable-cloop \
                  --disable-dmg \
                  --disable-docs  \
                  --disable-guest-agent \
                  --disable-parallels \
                  --disable-qed \
                  --disable-slirp \
                  --disable-user \
                  --disable-vdi \
                  --disable-vnc \
                  --disable-xen \
                  --disable-install-blobs \
                  --enable-attr \
                  --enable-cap-ng \
                  --enable-kvm \
                  --enable-libusb \
                  --enable-usb-redir \
                  --enable-linux-aio \
                  --enable-linux-io-uring \
                  --enable-numa \
                  --enable-pie \
                  --enable-rbd \
                  --enable-seccomp \
                  --enable-spice \
                  --enable-system \
                  --enable-tcg \
                  --enable-tools \
                  --enable-vhost-crypto \
                  --enable-vhost-kernel \
                  --enable-vhost-net \
                  --enable-vhost-user \
                  --enable-virtfs
          make

          mkdir /build/target/qemu/
          DESTDIR=/build/target/qemu/ make install
          rsync -a /build/target/qemu/opt/incus/bin/ /opt/incus/bin/
          rsync -a /build/target/qemu/opt/incus/lib/ /opt/incus/lib/
          rsync -a /build/target/qemu/opt/incus/share/qemu/ /opt/incus/share/qemu/
          cp /build/qemu/pc-bios/kvmvapic.bin /opt/incus/share/qemu/
          cp /build/qemu/pc-bios/vgabios-qxl.bin /opt/incus/share/qemu/
          cp /build/qemu/pc-bios/vgabios-virtio.bin /opt/incus/share/qemu/
          cp /build/qemu/pc-bios/efi-virtio.rom /opt/incus/share/qemu/

      - name: Build Secure Boot firmware
        run: |
          REPO="${PWD}"

          cd /build/edk2

          FIRMWARE="OVMF"
          if [ "$(uname -m)" = "aarch64" ]; then
            FIRMWARE="AAVMF"
          fi

          cd "${REPO}/edk2-vars-generator"
          ./edk2-vars-generator -f "${FIRMWARE}" \
            -e /build/edk2/Build/*/*/*/EnrollDefaultKeys.efi \
            -s /build/edk2/Build/*/*/*/Shell.efi \
            -c "/opt/incus/share/qemu/OVMF_CODE.4MB.fd" \
            -V "/opt/incus/share/qemu/OVMF_VARS.4MB.fd" \
            -C "$(cat ${REPO}/zabbly-sb.oem.crt)" \
            -o "/opt/incus/share/qemu/OVMF_VARS.4MB.ms.fd"

      - name: Strip and cleanup binaries
        run: |
          rm -Rf /opt/incus/lib/debug/
          rm -Rf /opt/incus/include/
          rm -Rf /opt/incus/lib/pkgconfig/
          strip /opt/incus/bin/*
          strip /opt/incus/lib/*so*
          rm /opt/incus/lib/*.a /opt/incus/lib/*.la /opt/incus/lib/*/*.a /opt/incus/lib/*/*.l