build: Run as root generally, drop privs on download/bundle

As an alternative to LD_LIBRARY_PATH.

build

@@ -2,13 +2,13 @@
 set -e
 [ -d cache ] || mkdir cache
 SPAWN="systemd-nspawn -M gentoolooqsbuilder -D gentoo --bind=$(realpath ./out):/out --bind=$(realpath scripts):/scripts --bind=$(realpath cache):/var/cache/distfiles"
+export UNPRIVUSER="user"
 
-
+su $UNPRIVUSER -c ./scripts/1-create.sh
-SETUPSCRIPT="/scripts/3-setup-gentoo.sh"
+./scripts/2-create.sh
-BUILDSCRIPT="/scripts/4-build-looqs.sh"
+${SPAWN} /scripts/3-setup-gentoo.sh
-./scripts/1-create.sh
+chown "$UNPRIVUSER" -R out
-sudo ./scripts/2-create.sh
+${SPAWN} su - builder -c /scripts/4-build-looqs.sh
-sudo ${SPAWN} /${SETUPSCRIPT}
+chown "$UNPRIVUSER" -R out
-sudo ${SPAWN} su - builder -c /${BUILDSCRIPT}
+su $UNPRIVUSER -c "cd $(pwd); ./scripts/5-bundle.sh"
-./scripts/5-bundle.sh   
 

scripts/1-create.sh

@@ -1,9 +1,9 @@
 #!/bin/bash
-
 set -e
-# TODO: always download latest
+
-wget https://bouncer.gentoo.org/fetch/root/all/releases/amd64/autobuilds/current-stage3-amd64-hardened-openrc/stage3-amd64-hardened-openrc-20220619T170540Z.tar.xz -O hardened.tar.xz
+LATEST=$( curl -L "https://bouncer.gentoo.org/fetch/root/all/releases/amd64/autobuilds/latest-stage3-amd64-hardened-openrc.txt" | tail -n 1 | awk '{print $1}' )
-wget https://bouncer.gentoo.org/fetch/root/all/releases/amd64/autobuilds/current-stage3-amd64-hardened-openrc/stage3-amd64-hardened-openrc-20220619T170540Z.tar.xz.asc -O hardened.tar.xz.asc
+wget "https://bouncer.gentoo.org/fetch/root/all/releases/amd64/autobuilds/$LATEST" -O hardened.tar.xz
+wget "https://bouncer.gentoo.org/fetch/root/all/releases/amd64/autobuilds/$LATEST.asc" -O hardened.tar.xz.asc
 gpg --verify hardened.tar.xz.asc hardened.tar.xz
 
 

scripts/3-setup-gentoo.sh

@@ -5,10 +5,13 @@ mkdir --parents /etc/portage/repos.conf
 cp /usr/share/portage/config/repos.conf /etc/portage/repos.conf/gentoo.conf
 emerge-webrsync 
 
-export USE="X jpeg png icu -accessibility -debug -dbus cairo"
+echo 'USE="X vulkan jpeg png icu cairo -accessibility -debug -dbus"' >> /etc/portage/make.conf
+emerge -v --update --newuse --deep @world
+
 emerge -v qtcore qtgui uchardet
 emerge -v qtwidgets qtsql qtnetwork qtconcurrent
-export USE="X jpeg png icu -accessibility -debug -dbus qt5 cairo minizip"
+emerge -v qtsvg
+export USE="minizip qt5"
 emerge -v app-text/poppler
 emerge -v dev-libs/quazip
 emerge -v dev-vcs/git

scripts/4-build-looqs.sh

@@ -31,7 +31,7 @@ done
 cp -a /usr/lib64/libcrypto* /out/lib/
 cp -a /usr/lib64/qt5/plugins /out/lib/
 
-for lib in $( ldd gui/looqs-gui |   awk '{print $3}' | grep so  | grep -vE "libGL|libm|libc|fontconfig|libgcc|freetype|libX11|libQt" ) ; do
+for lib in $( ldd gui/looqs-gui |   awk '{print $3}' | grep so  | grep -vE "libGL|libm.so|libc|harfbuzz|fontconfig|libgcc|freetype|libX11|libQt" ) ; do
 cp "$lib" /out/lib/
 done
 

scripts/5-bundle.sh

@@ -4,10 +4,17 @@ set -e
 
 DIRNAME="looqs-${TAG}"
 ARCHIVENAME="${DIRNAME}.tar.xz"
-mv out ${DIRNAME}
+rm -rf $DIRNAME*
+cp -a out ${DIRNAME}
 cp src/looqs-gui ${DIRNAME}
 cp src/looqs ${DIRNAME}
 chmod 755 src/looqs-gui
 chmod 755 src/looqs
+
+patchelf --set-rpath '$ORIGIN/../lib/' ${DIRNAME}/bin/*
+patchelf --set-rpath '$ORIGIN' ${DIRNAME}/lib/*.so*
+patchelf --set-rpath '$ORIGIN/../../' $( find "${DIRNAME}/lib/plugins/" | grep so$ )
+
+
 tar cfpvJ "${DIRNAME}".tar.xz "${DIRNAME}"
-gpg -b --local-user "$SIGNING_KEY_EMAIL" "$ARCHIVENAME"
+gpg --batch --no-tty -b --local-user "$SIGNING_KEY_EMAIL" "$ARCHIVENAME"

src/looqs

@@ -2,6 +2,5 @@
 SELF=$(readlink -f "$0")
 HERE=${SELF%/*}
 
-export LD_LIBRARY_PATH="/${HERE}/lib"
 export QT_PLUGIN_PATH="/${HERE}/lib/plugins"
 ./bin/looqs

src/looqs-gui

@@ -2,6 +2,5 @@
 SELF=$(readlink -f "$0")
 HERE=${SELF%/*}
 
-export LD_LIBRARY_PATH="/${HERE}/lib"
 export QT_PLUGIN_PATH="/${HERE}/lib/plugins"
 "${HERE}/bin/looqs-gui"