run.sh

#!/usr/bin/env bash

# This file is part of ELNBuildSync
# Copyright (C) 2023-2026 Stephen Gallagher <sgallagh@redhat.com>

# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.

# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <https://www.gnu.org/licenses/>.

# SPDX-License-Identifier: 	GPL-3.0-or-later

# Created by argbash-init v2.11.0
# ARG_OPTIONAL_SINGLE([log-level],[],[Log verbosity],[INFO])
# ARG_OPTIONAL_SINGLE([static-config-file],[],[Static configuration file],[/etc/elnbuildsync/static-config/elnbuildsync.yaml])
# ARG_OPTIONAL_SINGLE([dynamic-config-file],[],[Dynamic configuration file])
# ARG_OPTIONAL_SINGLE([dynamic-config-url],[],[Dynamic configuration Git URL],[https://github.com/fedora-eln/elnbuildsync-config.git])
# ARG_OPTIONAL_SINGLE([dynamic-config-branch],[],[Dynamic configuration Git branch],[main])
# ARG_OPTIONAL_SINGLE([krb5-keytab-file],[],[Kerberos keytab for in-process TGT acquisition (optional)])
# ARG_OPTIONAL_SINGLE([krb5-keytab-principal],[],[Kerberos principal for keytab-based TGT acquisition only (default: guessed from static configuration)])
# ARG_OPTIONAL_SINGLE([keytab-file],[],[Deprecated in favor of --krb5-keytab-file])
# ARG_OPTIONAL_SINGLE([keytab-principal],[],[Deprecated in favor of --krb5-keytab-principal])
# ARG_OPTIONAL_SINGLE([openid-ca-file],[],[OIDC CA certificate file],[])
# ARG_POSITIONAL_DOUBLEDASH([])
# ARG_POSITIONAL_INF([custom],[Additional arguments to pass to the ELNBuildSync daemon])
# ARG_HELP([],[Run the ELNBuildSync daemon])
# ARGBASH_GO()
# needed because of Argbash --> m4_ignore([
### START OF CODE GENERATED BY Argbash v2.11.0 one line above ###
# Argbash is a bash code generator used to get arguments parsing right.
# Argbash is FREE SOFTWARE, see https://argbash.dev for more info


die()
{
	local _ret="${2:-1}"
	test "${_PRINT_HELP:-no}" = yes && print_help >&2
	echo "$1" >&2
	exit "${_ret}"
}


begins_with_short_option()
{
	local first_option all_short_options='h'
	first_option="${1:0:1}"
	test "$all_short_options" = "${all_short_options/$first_option/}" && return 1 || return 0
}

# THE DEFAULTS INITIALIZATION - POSITIONALS
_positionals=()
_arg_custom=()
# THE DEFAULTS INITIALIZATION - OPTIONALS
_arg_log_level="INFO"
_arg_static_config_file="/etc/elnbuildsync/static-config/elnbuildsync.yaml"
_arg_dynamic_config_file=
_arg_dynamic_config_url="https://github.com/fedora-eln/elnbuildsync-config.git"
_arg_dynamic_config_branch="main"
_arg_krb5_keytab_file=
_arg_krb5_keytab_principal=
_arg_keytab_file=
_arg_keytab_principal=
_arg_openid_ca_file=


print_help()
{
	printf 'Usage: %s [--log-level <arg>] [--static-config-file <arg>] [--dynamic-config-file <arg>] [--dynamic-config-url <arg>] [--dynamic-config-branch <arg>] [--krb5-keytab-file <arg>] [--krb5-keytab-principal <arg>] [--keytab-file <arg>] [--keytab-principal <arg>] [--openid-ca-file <arg>] [-h|--help] [--] [<custom-1>] ... [<custom-n>] ...\n' "$0"
	printf '\t%s\n' "<custom>: Additional arguments to pass to the ELNBuildSync daemon"
	printf '\t%s\n' "--log-level: Log verbosity (default: 'INFO')"
	printf '\t%s\n' "--static-config-file: Static configuration file (default: '/etc/elnbuildsync/static-config/elnbuildsync.yaml')"
	printf '\t%s\n' "--dynamic-config-file: Dynamic configuration file (no default)"
	printf '\t%s\n' "--dynamic-config-url: Dynamic configuration Git URL (default: 'https://github.com/fedora-eln/elnbuildsync-config.git')"
	printf '\t%s\n' "--dynamic-config-branch: Dynamic configuration Git branch (default: 'main')"
	printf '\t%s\n' "--krb5-keytab-file: Kerberos keytab for in-process TGT acquisition (optional) (no default)"
	printf '\t%s\n' "--krb5-keytab-principal: Kerberos principal for keytab-based TGT acquisition only (default: guessed from static configuration) (no default)"
	printf '\t%s\n' "--keytab-file: Deprecated in favor of --krb5-keytab-file (no default)"
	printf '\t%s\n' "--keytab-principal: Deprecated in favor of --krb5-keytab-principal (no default)"
	printf '\t%s\n' "--openid-ca-file: OIDC CA certificate file (no default)"
	printf '\t%s\n' "-h, --help: Prints help"
	printf '\n%s\n' "Run the ELNBuildSync daemon"
}


parse_commandline()
{
	_positionals_count=0
	local _key
	while test $# -gt 0
	do
		_key="$1"
		if test "$_key" = '--'
		then
			shift
			test $# -gt 0 || break
			_positionals+=("$@")
			_positionals_count=$((_positionals_count + $#))
			shift $(($# - 1))
			_last_positional="$1"
			break
		fi
		case "$_key" in
			--log-level)
				test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
				_arg_log_level="$2"
				shift
				;;
			--log-level=*)
				_arg_log_level="${_key##--log-level=}"
				;;
			--static-config-file)
				test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
				_arg_static_config_file="$2"
				shift
				;;
			--static-config-file=*)
				_arg_static_config_file="${_key##--static-config-file=}"
				;;
			--dynamic-config-file)
				test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
				_arg_dynamic_config_file="$2"
				shift
				;;
			--dynamic-config-file=*)
				_arg_dynamic_config_file="${_key##--dynamic-config-file=}"
				;;
			--dynamic-config-url)
				test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
				_arg_dynamic_config_url="$2"
				shift
				;;
			--dynamic-config-url=*)
				_arg_dynamic_config_url="${_key##--dynamic-config-url=}"
				;;
			--dynamic-config-branch)
				test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
				_arg_dynamic_config_branch="$2"
				shift
				;;
			--dynamic-config-branch=*)
				_arg_dynamic_config_branch="${_key##--dynamic-config-branch=}"
				;;
			--krb5-keytab-file)
				test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
				_arg_krb5_keytab_file="$2"
				shift
				;;
			--krb5-keytab-file=*)
				_arg_krb5_keytab_file="${_key##--krb5-keytab-file=}"
				;;
			--krb5-keytab-principal)
				test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
				_arg_krb5_keytab_principal="$2"
				shift
				;;
			--krb5-keytab-principal=*)
				_arg_krb5_keytab_principal="${_key##--krb5-keytab-principal=}"
				;;
			--keytab-file)
				test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
				_arg_keytab_file="$2"
				shift
				;;
			--keytab-file=*)
				_arg_keytab_file="${_key##--keytab-file=}"
				;;
			--keytab-principal)
				test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
				_arg_keytab_principal="$2"
				shift
				;;
			--keytab-principal=*)
				_arg_keytab_principal="${_key##--keytab-principal=}"
				;;
			--openid-ca-file)
				test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
				_arg_openid_ca_file="$2"
				shift
				;;
			--openid-ca-file=*)
				_arg_openid_ca_file="${_key##--openid-ca-file=}"
				;;
			-h|--help)
				print_help
				exit 0
				;;
			-h*)
				print_help
				exit 0
				;;
			*)
				_last_positional="$1"
				_positionals+=("$_last_positional")
				_positionals_count=$((_positionals_count + 1))
				;;
		esac
		shift
	done
}


assign_positional_args()
{
	local _positional_name _shift_for=$1
	_positional_names=""
	_our_args=$((${#_positionals[@]} - 0))
	for ((ii = 0; ii < _our_args; ii++))
	do
		_positional_names="$_positional_names _arg_custom[$((ii + 0))]"
	done

	shift "$_shift_for"
	for _positional_name in ${_positional_names}
	do
		test $# -gt 0 || break
		eval "$_positional_name=\${1}" || die "Error during argument parsing, possibly an Argbash bug." 1
		shift
	done
}

parse_commandline "$@"
assign_positional_args 1 "${_positionals[@]}"

# OTHER STUFF GENERATED BY Argbash

### END OF CODE GENERATED BY Argbash (sortof) ### ])
# [ <-- needed because of Argbash

set -eo pipefail

SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
export TMPDIR=/var/tmp

# Prefer --krb5-* over deprecated --keytab-* aliases
if [ -z "${_arg_krb5_keytab_file}" ] && [ -n "${_arg_keytab_file}" ]; then
  _arg_krb5_keytab_file="${_arg_keytab_file}"
fi
if [ -z "${_arg_krb5_keytab_principal}" ] && [ -n "${_arg_keytab_principal}" ]; then
  _arg_krb5_keytab_principal="${_arg_keytab_principal}"
fi

# When acquiring via keytab, use a private file ccache unless one is already set.
# Without a keytab, leave $KRB5CCNAME alone (existing TGT / KCM / system default).
if [ -n "${_arg_krb5_keytab_principal}" ] && [ -z "${_arg_krb5_keytab_file}" ]; then
  die "--krb5-keytab-principal requires --krb5-keytab-file" 1
fi
if [ -n "${_arg_krb5_keytab_file}" ] && [ -z "${KRB5CCNAME:-}" ]; then
  # Avoid a fixed path in world-writable $TMPDIR (symlink / pre-create races).
  _krb5_ccache_dir="$(mktemp -d "${TMPDIR}/elnbuildsync-krb5-XXXXXX")" || true
  if [ -z "${_krb5_ccache_dir}" ] || [ ! -d "${_krb5_ccache_dir}" ]; then
    die "Failed to create private Kerberos ccache directory" 1
  fi
  chmod 700 "${_krb5_ccache_dir}"
  export KRB5CCNAME="FILE:${_krb5_ccache_dir}/tgt"
  # Remove the private ccache directory (and TGT file) on shutdown.
  trap 'rm -rf -- "${_krb5_ccache_dir}"' EXIT
fi

STATIC_ARGS=(--static-config-file /etc/elnbuildsync/static-config/elnbuildsync.yaml)
if [ -n "${_arg_static_config_file}" ]; then
  STATIC_ARGS=(--static-config-file "${_arg_static_config_file}")
fi

if [ -n "${_arg_dynamic_config_file}" ]; then
  echo "Using dynamic config file at ${_arg_dynamic_config_file}"
  DYNAMIC_ARGS=(--dynamic-config-file "${_arg_dynamic_config_file}")
elif [ -f /etc/elnbuildsync/dynamic-config/elnbuildsync_dynamic.yaml ]; then
  # Check if we have mounted a dynamic config file into the container.
  # This is mostly useful for local development with a mounted dynamic config.
  echo "Using dynamic config file at /etc/elnbuildsync/dynamic-config/elnbuildsync_dynamic.yaml"
  DYNAMIC_ARGS=(--dynamic-config-file /etc/elnbuildsync/dynamic-config/elnbuildsync_dynamic.yaml)
else
  echo "Using dynamic config URL at ${_arg_dynamic_config_url}#${_arg_dynamic_config_branch}"
  DYNAMIC_ARGS=(--dynamic-config-url "${_arg_dynamic_config_url}#${_arg_dynamic_config_branch}")
fi

# Check that the DB password file exists
if [ ! -f /etc/elnbuildsync/secrets/ebs_db_pw ]; then
  echo "Error: DB password file /etc/elnbuildsync/secrets/ebs_db_pw is missing. Mount it with --volume /local/dir:/etc/elnbuildsync/secrets:Z"
  exit 1
fi

# Check that the SMTP password file exists
SMTP_ARGS=()
if [ ! -f /etc/elnbuildsync/secrets/ebs_smtp_pw ]; then
  echo "Warning: SMTP password file /etc/elnbuildsync/secrets/ebs_smtp_pw is missing. If using SMTP, mount it with --volume /local/dir:/etc/elnbuildsync/secrets:Z"
else
  SMTP_ARGS=(--smtp-pw-file /etc/elnbuildsync/secrets/ebs_smtp_pw)
fi

# OIDC client secret (when mounted under /etc/elnbuildsync/)
OIDC_ARGS=()
if [ ! -f /etc/elnbuildsync/secrets/ebs_oidc_client_secret ]; then
  echo "Warning: OIDC client secret file /etc/elnbuildsync/secrets/ebs_oidc_client_secret is missing. If using OIDC, mount it with --volume /local/dir:/etc/elnbuildsync/secrets:Z"
else
  OIDC_ARGS=(--openid-client-secret-file /etc/elnbuildsync/secrets/ebs_oidc_client_secret)
fi

OPENID_CA_ARG=()
if [ -n "${_arg_openid_ca_file}" ]; then
  OPENID_CA_ARG=(--openid-ca-file "${_arg_openid_ca_file}")
fi

KRB5_ARGS=()
if [ -n "${_arg_krb5_keytab_file}" ]; then
  KRB5_ARGS+=(--krb5-keytab-file "${_arg_krb5_keytab_file}")
fi
if [ -n "${_arg_krb5_keytab_principal}" ]; then
  KRB5_ARGS+=(--krb5-keytab-principal "${_arg_krb5_keytab_principal}")
fi

python3 --version

echo "Activating virtualenv"
virtualenv --system-site-packages "${TMPDIR}/.venv"
. "${TMPDIR}/.venv/bin/activate"
pip install --upgrade pip
pip install -r requirements.txt
pip install "${SCRIPT_DIR}"

export FEDORA_MESSAGING_CONF="${FEDORA_MESSAGING_CONF:-/etc/fedora-messaging/config.toml}"

# Container runtimes (podman/docker/Kubernetes) send SIGTERM to PID 1 to ask
# a container to stop. This script is PID 1 (the ENTRYPOINT), so without
# this, an un-trapped SIGTERM sent to the container would just terminate
# bash immediately, leaving elnbuildsync running as an orphan until the
# runtime gives up waiting and SIGKILLs the whole cgroup -- Twisted's
# reactor never gets a chance to shut down cleanly. Forward it (and SIGINT,
# for interactive `podman run`/Ctrl-C) to the real daemon instead.
#
# exec'ing into elnbuildsync instead of backgrounding it would be simpler,
# but would also skip the Kerberos ccache cleanup EXIT trap set up above.
#
# Installed *before* elnbuildsync is backgrounded below, so a signal that
# arrives before _elnbuildsync_pid is even assigned can't fall through to
# bash's default (immediate, unforwarded) termination; _forward_signal
# guards the kill call for exactly that case, since there's nothing to
# forward the signal to yet.
_term_received=0
_elnbuildsync_pid=""
_forward_signal() {
  _term_received=1
  if [ -n "${_elnbuildsync_pid}" ]; then
    kill -TERM "${_elnbuildsync_pid}" 2>/dev/null || true
  fi
}
trap _forward_signal TERM INT

elnbuildsync \
  "${STATIC_ARGS[@]}" \
  "${DYNAMIC_ARGS[@]}" \
  --log-level "${_arg_log_level}" \
  --db-pw-file /etc/elnbuildsync/secrets/ebs_db_pw \
  "${SMTP_ARGS[@]}" \
  "${OIDC_ARGS[@]}" \
  "${OPENID_CA_ARG[@]}" \
  "${KRB5_ARGS[@]}" \
  "${_arg_custom[@]}" &
_elnbuildsync_pid=$!

set +e
wait "${_elnbuildsync_pid}"
_elnbuildsync_rc=$?
if [ "${_term_received}" -eq 1 ]; then
  # A trapped signal interrupts `wait` as soon as the trap runs, before the
  # child has actually exited (and with the wrong exit status). Wait on it
  # again now that the signal has been forwarded, to block until it has
  # genuinely terminated and pick up its real exit status.
  wait "${_elnbuildsync_pid}"
  _elnbuildsync_rc=$?
fi
set -e

exit "${_elnbuildsync_rc}"

# ] <-- needed because of Argbash