Makefile.toml

[config]
skip_core_tasks = true

[env]
BUILDSYS_ARCH = { script = ["uname -m"] }
BUILDSYS_ROOT_DIR = "${CARGO_MAKE_WORKING_DIRECTORY}"
BUILDSYS_BUILD_DIR = "${BUILDSYS_ROOT_DIR}/build"
BUILDSYS_PACKAGES_DIR = "${BUILDSYS_BUILD_DIR}/rpms"
BUILDSYS_STATE_DIR = "${BUILDSYS_BUILD_DIR}/state"
BUILDSYS_IMAGES_DIR = "${BUILDSYS_BUILD_DIR}/images"
BUILDSYS_ARCHIVES_DIR = "${BUILDSYS_BUILD_DIR}/archives"
BUILDSYS_TOOLS_DIR = "${BUILDSYS_ROOT_DIR}/tools"
BUILDSYS_SOURCES_DIR = "${BUILDSYS_ROOT_DIR}/sources"
BUILDSYS_TIMESTAMP = { script = ["date +%s"] }
BUILDSYS_VERSION_BUILD = { script = ["git describe --always --dirty --exclude '*' || echo 00000000"] }
# For now, release config path can't be overridden with -e, because it's used
# later in this section.  You have to edit the path here in Makefile.toml to
# use a different Release.toml.
BUILDSYS_RELEASE_CONFIG_PATH = "${BUILDSYS_ROOT_DIR}/Release.toml"
BUILDSYS_VERSION_IMAGE = { script = ["awk -F '[ =\"]+' '$1 == \"version\" {print $2}' ${BUILDSYS_RELEASE_CONFIG_PATH}"] }
# This can be overridden with -e to build a different variant from the variants/ directory
BUILDSYS_VARIANT = "aws-k8s-1.19"
# Product name used for file and directory naming
BUILDSYS_NAME = "bottlerocket"
# "Pretty" name used to identify OS in os-release, bootloader, etc.
# If you're building a Bottlerocket remix, you'd want to set this to something like
# "Bottlerocket Remix by ${CORP}" or "${CORP}'s Bottlerocket Remix"
BUILDSYS_PRETTY_NAME = "Bottlerocket OS"
# SDK version used for building
BUILDSYS_SDK_VERSION="0.15.0"
# Site for fetching the SDK
BUILDSYS_SDK_SITE="cache.bottlerocket.aws"

# These can be overridden with -e to change configuration for pubsys (`cargo
# make repo`).  In addition, you can set RELEASE_START_TIME to determine when
# update waves and repo metadata expiration times will start, instead of
# starting now.  (This can be an RFC3339 date, or an offset like "in X
# hours/days/weeks".)
PUBLISH_EXPIRATION_POLICY_PATH = "${BUILDSYS_ROOT_DIR}/tools/pubsys/policies/repo-expiration/2w-2w-1w.toml"
PUBLISH_WAVE_POLICY_PATH = "${BUILDSYS_ROOT_DIR}/sources/updater/waves/default-waves.toml"
PUBLISH_INFRA_CONFIG_PATH = "${BUILDSYS_ROOT_DIR}/Infra.toml"
# Default repo to read from PUBLISH_INFRA_CONFIG_PATH
PUBLISH_REPO = "default"

# The size in GiB of the data volume in the block device mapping of registered
# AMIs.  (You can also specify PUBLISH_ROOT_VOLUME_SIZE to override the root
# volume size; by default it's the image size, rounded up.)
PUBLISH_DATA_VOLUME_SIZE = "20"
# This can be overridden with -e to change the path to the file containing SSM
# parameter templates.  This file determines the parameter names and values
# that will be published to SSM when you run `cargo make ssm`.  See
# tools/pubsys/policies/ssm/README.md for more information.
PUBLISH_SSM_TEMPLATES_PATH = "${BUILDSYS_ROOT_DIR}/tools/pubsys/policies/ssm/defaults.toml"

# Specifies whether to validate all targets when validating TUF repositories
REPO_VALIDATE_TARGETS = "true"
# Specifies the timeframe to look for upcoming repository metadata expirations
REPO_METADATA_EXPIRING_WITHIN = "3 days"
# When refreshing repositories, you can set REPO_UNSAFE_REFRESH=true to refresh repositories that have expired metadata files.

# You can also set PUBLISH_REGIONS to override the list of regions from
# Infra.toml for AMI and SSM commands; it's a comma-separated list like
# "us-west-2,us-east-1".
# You can set NO_PROGRESS=true to not print progress bars during snapshot upload.
# You can use ALLOW_CLOBBER=true with the `ssm` task to make it overwrite existing values.
# (This is not required with `promote-ssm` because the intent of promotion is overwriting.)

# Disallow pulling directly Upstream URLs when lookaside cache results in MISSes as a fallback.
# To use the upstream source as fallback, override this on the command line and set it to 'true'
BUILDSYS_UPSTREAM_SOURCE_FALLBACK = "false"

# We require license checks to pass to build an image.  If you're working on a
# local change and don't have license information yet, you can run with `-e
# BUILDSYS_ALLOW_FAILED_LICENSE_CHECK=true` to allow the build to continue even
# if the license check fails.
BUILDSYS_ALLOW_FAILED_LICENSE_CHECK = "false"

# This controls how many `docker build` commands we'll invoke at once.
BUILDSYS_JOBS = "8"

CARGO_HOME = "${BUILDSYS_ROOT_DIR}/.cargo"
GO_MOD_CACHE = "${BUILDSYS_ROOT_DIR}/.gomodcache"
DOCKER_BUILDKIT = "1"

[env.development]
# Certain variables are defined here to allow us to override a component value
# on the command line.

# Depends on ${BUILDSYS_ARCH} and ${BUILDSYS_SDK_VERSION}.
BUILDSYS_SDK_IMAGE = { script = [ "echo bottlerocket/sdk-${BUILDSYS_ARCH}:v${BUILDSYS_SDK_VERSION}-$(uname -m)" ] }
BUILDSYS_TOOLCHAIN = { script = [ "echo bottlerocket/toolchain-${BUILDSYS_ARCH}:v${BUILDSYS_SDK_VERSION}-${BUILDSYS_ARCH}" ] }

# Depends on ${BUILDSYS_JOBS}.
CARGO_MAKE_CARGO_ARGS = "--jobs ${BUILDSYS_JOBS} --offline --locked"

# Depends on ${BUILDSYS_ARCH} and ${BUILDSYS_VARIANT}.
BUILDSYS_OUTPUT_DIR = "${BUILDSYS_IMAGES_DIR}/${BUILDSYS_ARCH}-${BUILDSYS_VARIANT}"

# Depends on a number of variables defined above, and each other.
BUILDSYS_VERSION_FULL="${BUILDSYS_VERSION_IMAGE}-${BUILDSYS_VERSION_BUILD}"
# These names are used as prefixes for build and repo steps.
BUILDSYS_NAME_VARIANT="${BUILDSYS_NAME}-${BUILDSYS_VARIANT}-${BUILDSYS_ARCH}"
BUILDSYS_NAME_VERSION="${BUILDSYS_NAME}-${BUILDSYS_VERSION_FULL}"
BUILDSYS_NAME_FULL="${BUILDSYS_NAME_VARIANT}-${BUILDSYS_VERSION_FULL}"
# Path to repo-specific root role.
PUBLISH_REPO_ROOT_JSON = "${BUILDSYS_ROOT_DIR}/roles/${PUBLISH_REPO}.root.json"
# If you don't specify a signing key in Infra.toml, we generate one at this path.
PUBLISH_REPO_KEY = "${BUILDSYS_ROOT_DIR}/keys/${PUBLISH_REPO}.pem"
# Repo directories have subdirectories for variant/arch, so we only want version here.
PUBLISH_REPO_BASE_DIR = "${BUILDSYS_BUILD_DIR}/repos"
PUBLISH_REPO_OUTPUT_DIR = "${PUBLISH_REPO_BASE_DIR}/${PUBLISH_REPO}/${BUILDSYS_NAME_VERSION}"
# The default name of registered AMIs; override by setting PUBLISH_AMI_NAME.
PUBLISH_AMI_NAME_DEFAULT = "${BUILDSYS_NAME}-${BUILDSYS_VARIANT}-${BUILDSYS_ARCH}-v${BUILDSYS_VERSION_IMAGE}-${BUILDSYS_VERSION_BUILD}"

# The name of the kmod kit archive, used to ease building out-of-tree kernel modules.
BUILDSYS_KMOD_KIT = "${BUILDSYS_VARIANT}-${BUILDSYS_ARCH}-kmod-kit-v${BUILDSYS_VERSION_IMAGE}"
BUILDSYS_KMOD_KIT_PATH="${BUILDSYS_ARCHIVES_DIR}/${BUILDSYS_KMOD_KIT}.tar.xz"

[tasks.setup]
script = [
'''
# Ensure we use a supported architecture
case "${BUILDSYS_ARCH}" in
   x86_64|aarch64) ;;
   *)
      echo "Unrecognized architecture '${BUILDSYS_ARCH}'; please use 'x86_64 or 'aarch64'"
      exit 1
      ;;
esac

mkdir -p ${BUILDSYS_BUILD_DIR}
mkdir -p ${BUILDSYS_OUTPUT_DIR}
mkdir -p ${BUILDSYS_PACKAGES_DIR}
mkdir -p ${BUILDSYS_STATE_DIR}
mkdir -p ${GO_MOD_CACHE}
'''
]

[tasks.setup-build]
dependencies = ["setup"]
script = [
'''
for cmd in curl docker gunzip lz4; do
  if ! command -v ${cmd} >/dev/null 2>&1 ; then
    echo "required program '${cmd}' not found" >&2
    exit 1
  fi
done
'''
]

[tasks.fetch]
dependencies = [
  "fetch-sdk",
  "fetch-sources",
  "fetch-vendored",
]

[tasks.fetch-sdk]
dependencies = ["setup-build"]
script_runner = "bash"
script = [
'''
set -o pipefail
if ! docker image inspect ${BUILDSYS_SDK_IMAGE} >/dev/null 2>&1 ; then
  # Let curl resolve the certificates instead of the tasks resolved bundle.
  unset SSL_CERT_FILE SSL_CERT_DIR
  if ! curl --silent --fail --show-error https://${BUILDSYS_SDK_SITE}/${BUILDSYS_SDK_IMAGE}.tar.gz \
       | gunzip | docker load ; then
    echo "failed to load '${BUILDSYS_SDK_IMAGE}'" >&2
    exit 1
  fi
fi
'''
]

[tasks.fetch-sources]
dependencies = ["setup"]
script_runner = "bash"
script = [
'''
for ws in sources packages variants/* tools; do
  [ -d "${ws}" ] || continue
  cargo fetch --locked --manifest-path ${ws}/Cargo.toml
done
chmod -R o+r ${CARGO_HOME}
'''
]

[tasks.fetch-vendored]
dependencies = ["fetch-sdk"]
script = [
'''
${BUILDSYS_TOOLS_DIR}/docker-go \
  --module-path ${BUILDSYS_SOURCES_DIR}/host-ctr \
  --sdk-image ${BUILDSYS_SDK_IMAGE} \
  --go-mod-cache ${GO_MOD_CACHE} \
  --command "go list -mod=readonly ./... >/dev/null && go mod vendor"
'''
]

[tasks.unit-tests]
dependencies = ["fetch-sdk", "fetch-sources", "fetch-vendored"]
script = [
'''
export VARIANT="${BUILDSYS_VARIANT}"

cargo test \
  ${CARGO_BUILD_ARGS} \
  ${CARGO_MAKE_CARGO_ARGS} \
  --manifest-path ${BUILDSYS_SOURCES_DIR}/Cargo.toml \
  --all

# host-ctr unit tests (go)
${BUILDSYS_TOOLS_DIR}/docker-go \
  --module-path ${BUILDSYS_SOURCES_DIR}/host-ctr \
  --sdk-image ${BUILDSYS_SDK_IMAGE} \
  --go-mod-cache ${GO_MOD_CACHE} \
  --command "cd cmd/host-ctr; go test -v"
'''
]

[tasks.build-tools]
dependencies = ["fetch"]
script = [
'''
cargo install \
  ${CARGO_MAKE_CARGO_ARGS} \
  --path tools/buildsys \
  --root tools \
  --force \
  --quiet
'''
]

# Note: this is separate from publish-tools because publish-tools takes a while
# to build and isn't needed to build an image.
[tasks.publish-setup-tools]
dependencies = ["setup", "fetch-sources", "tuftool"]
script = [
'''
cargo install \
  ${CARGO_MAKE_CARGO_ARGS} \
  --path tools/pubsys-setup \
  --root tools \
  --force \
  --quiet
'''
]

[tasks.publish-tools]
dependencies = ["setup", "fetch-sources"]
script = [
'''
cargo install \
  ${CARGO_MAKE_CARGO_ARGS} \
  --path tools/pubsys \
  --root tools \
  --force \
  --quiet
'''
]

[tasks.build-packages]
dependencies = ["build-tools", "publish-setup"]
script = [
'''
export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"
cargo build \
  ${CARGO_BUILD_ARGS} \
  ${CARGO_MAKE_CARGO_ARGS} \
  --manifest-path packages/Cargo.toml \
  --all
'''
]

[tasks.build-kmod-kit]
dependencies = ["build-packages"]
script_runner = "bash"
script = [
'''
mkdir -p "${BUILDSYS_ARCHIVES_DIR}"

# Find the most recent kernel archive. If we have more than one, we want the
# last one that was built.
kernel_archive="$(find "${BUILDSYS_PACKAGES_DIR}" \
  -type f -name '*-'"${BUILDSYS_ARCH}"'-kernel-archive-*.rpm' \
  -printf '%T@ %p\n' | sort -r | awk 'NR==1{print $2}')"

if [ "${?}" -ne 0 ] || [ -z "${kernel_archive}" ] || [ ! -s "${kernel_archive}" ]; then
  echo "Unable to find latest kernel archive for ${BUILDSYS_ARCH} in ${BUILDSYS_PACKAGES_DIR}"
  exit 1
fi

if [ -s "${BUILDSYS_KMOD_KIT_PATH}" ] && [ "${BUILDSYS_KMOD_KIT_PATH}" -nt "${kernel_archive}" ]; then
  echo "Existing kmod kit ${BUILDSYS_KMOD_KIT_PATH} is newer than kernel archive ${kernel_archive}; skipping build."
  exit 0
fi

prepare_kmod_kit="
set -e -o pipefail

mkdir -p /tmp/kit/${BUILDSYS_KMOD_KIT} /tmp/extract

# Retrieve the toolchain and kernel archives.
pushd /tmp/extract >/dev/null
curl --silent --fail --show-error --output /tmp/kit/${BUILDSYS_KMOD_KIT}/toolchain.tar.xz \
  https://${BUILDSYS_SDK_SITE}/${BUILDSYS_TOOLCHAIN}.tar.xz
find /tmp/rpms -name "${kernel_archive##*/}" \
  -exec rpm2cpio {} \; | cpio -idmu --quiet
find -name 'kernel-devel.tar.xz' -exec mv {} /tmp/kit/${BUILDSYS_KMOD_KIT} \;
popd >/dev/null

# Extract them into the same directory.
pushd /tmp/kit/${BUILDSYS_KMOD_KIT} >/dev/null
tar xf kernel-devel.tar.xz
rm kernel-devel.tar.xz
tar xf toolchain.tar.xz
rm toolchain.tar.xz
popd >/dev/null

# Merge them together into a unified archive.
pushd /tmp/kit >/dev/null
tar cf ${BUILDSYS_KMOD_KIT}.tar ${BUILDSYS_KMOD_KIT}
xz -T0 ${BUILDSYS_KMOD_KIT}.tar
popd >/dev/null

mv /tmp/kit/${BUILDSYS_KMOD_KIT}.tar.xz /tmp/archives
"

docker run --rm \
  --network=host \
  --user "$(id -u):$(id -g)" \
  --security-opt label:disable \
  -v "${BUILDSYS_PACKAGES_DIR}":/tmp/rpms \
  -v "${BUILDSYS_ARCHIVES_DIR}":/tmp/archives \
  "${BUILDSYS_SDK_IMAGE}" \
  bash -c "${prepare_kmod_kit}"
'''
]

[tasks.build-archives]
dependencies = ["build-kmod-kit"]

[tasks.build-variant]
dependencies = ["build-packages"]
script = [
'''
export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"
cargo build \
  ${CARGO_BUILD_ARGS} \
  ${CARGO_MAKE_CARGO_ARGS} \
  --manifest-path variants/${BUILDSYS_VARIANT}/Cargo.toml
'''
]

[tasks.world-packages]
alias = "build-packages"

[tasks.world-variant]
alias = "build-variant"

[tasks.check-licenses]
dependencies = ["fetch"]
script = [
'''
[ "${BUILDSYS_ALLOW_FAILED_LICENSE_CHECK}" = "true" ] && set +e
(cd sources && cargo deny check --disable-fetch licenses)
(cd tools && cargo deny check --disable-fetch licenses)
set -e
'''
]

[tasks.link-clean]
dependencies = ["fetch"]
script = [
'''
for link in ${BUILDSYS_OUTPUT_DIR}/latest/${BUILDSYS_NAME_VARIANT}*; do
  if [ -L "${link}" ]; then
    rm ${link}
  fi
done
'''
]

[tasks.link-variant]
dependencies = ["build-variant"]
script_runner = "bash"
script = [
'''
mkdir -p ${BUILDSYS_OUTPUT_DIR}/latest
for artifact in ${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}*; do
  file_name="${artifact##*/}"
  link_name="${file_name/${BUILDSYS_NAME_FULL}/${BUILDSYS_NAME_VARIANT}}"
  ln -snf "../${file_name}" "${BUILDSYS_OUTPUT_DIR}/latest/${link_name}"
done
'''
]

[tasks.build]
dependencies = [
    "link-clean",
    "check-licenses",
    "build-variant",
    "link-variant",
]

[tasks.world]
alias = "build"

[tasks.tuftool]
script = [
'''
cargo install \
  --jobs ${BUILDSYS_JOBS} \
  --root tools \
  --quiet \
  tuftool
'''
]

[tasks.publish-setup]
dependencies = ["publish-setup-tools"]
script = [
'''
set -e
export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

if [ "${ALLOW_MISSING_KEY}" = "true" ]; then
   ALLOW_MISSING_KEY_ARG="--allow-missing-key"
fi

pubsys-setup \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   --root-role-path "${PUBLISH_REPO_ROOT_JSON}" \
   --default-key-path "${PUBLISH_REPO_KEY}" \
   --repo "${PUBLISH_REPO}" \
   ${ALLOW_MISSING_KEY_ARG}
'''
]

[tasks.publish-setup-without-key]
env = { "ALLOW_MISSING_KEY" = "true" }
run_task = "publish-setup"

# Builds a local repository based on the 'latest' built targets.  Uses pubsys
# to create a repo under /build/repos, named after the arch/variant/version,
# containing subdirectories for the repo metadata and targets.
[tasks.repo]
# Rather than depend on "build", which currently rebuilds images each run, we
# check for the image files below to save time.  This does mean that `cargo
# make` must be run before `cargo make repo`.
dependencies = ["publish-setup", "publish-tools", "build-archives"]
script_runner = "bash"
script = [
'''
set -e

cleanup() {
   [ -n "${MIGRATIONS_DIR}" ] && rm -rf "${MIGRATIONS_DIR}"
}
trap 'cleanup' EXIT

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

bootlz4="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-boot.ext4.lz4"
rootlz4="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-root.ext4.lz4"
hashlz4="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-root.verity.lz4"
if [ ! -s "${bootlz4}" ] || [ ! -s "${rootlz4}" ] || [ ! -s "${hashlz4}" ]; then
   echo "Image files don't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make'" >&2
   exit 1
fi

COPY_REPO_TARGETS=()

# TODO: only add migrations from Release.toml, not all
MIGRATIONS_DIR="$(mktemp -d)"
tar xpf "${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-migrations.tar" -C "${MIGRATIONS_DIR}"
for file in ${MIGRATIONS_DIR}/*; do
   [ -e "${file}" ] || continue
   COPY_REPO_TARGETS+=("--copy-target ${file}")
done

# Include the kmod kit in the repo so it's easier to build out-of-tree kernel
# modules for a given release.
LINK_REPO_TARGETS=("--link-target ${BUILDSYS_KMOD_KIT_PATH}")

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   repo \
   \
   --repo "${PUBLISH_REPO}" \
   --arch "${BUILDSYS_ARCH}" \
   --version "${BUILDSYS_VERSION_IMAGE}" \
   --variant "${BUILDSYS_VARIANT}" \
   \
   --boot-image "${bootlz4}" \
   --root-image "${rootlz4}" \
   --hash-image "${hashlz4}" \
   ${LINK_REPO_TARGETS[*]} \
   ${COPY_REPO_TARGETS[*]} \
   \
   --repo-expiration-policy-path "${PUBLISH_EXPIRATION_POLICY_PATH}" \
   --release-config-path "${BUILDSYS_RELEASE_CONFIG_PATH}" \
   --wave-policy-path "${PUBLISH_WAVE_POLICY_PATH}" \
   \
   ${RELEASE_START_TIME:+--release-start-time ${RELEASE_START_TIME}} \
   \
   --root-role-path "${PUBLISH_REPO_ROOT_JSON}" \
   --default-key-path "${PUBLISH_REPO_KEY}" \
   \
   --outdir "${PUBLISH_REPO_OUTPUT_DIR}"

ln -sfn "${PUBLISH_REPO_OUTPUT_DIR##*/}" "${PUBLISH_REPO_OUTPUT_DIR%/*}/latest"
'''
]

[tasks.validate-repo]
dependencies = ["publish-setup-without-key", "publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

if [ "${REPO_VALIDATE_TARGETS}" = "true" ]; then
   REPO_VALIDATE_TARGETS_ARG="--validate-targets"
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   validate-repo \
   \
   --repo "${PUBLISH_REPO}" \
   --arch "${BUILDSYS_ARCH}" \
   --variant "${BUILDSYS_VARIANT}" \
   \
   --root-role-path "${PUBLISH_REPO_ROOT_JSON}" \
   ${REPO_VALIDATE_TARGETS_ARG}
'''
]

[tasks.check-repo-expirations]
dependencies = ["publish-setup-without-key", "publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   check-repo-expirations \
   \
   --repo "${PUBLISH_REPO}" \
   --arch "${BUILDSYS_ARCH}" \
   --variant "${BUILDSYS_VARIANT}" \
   \
   --root-role-path "${PUBLISH_REPO_ROOT_JSON}" \
   --expiration-limit "${REPO_METADATA_EXPIRING_WITHIN}"
'''
]

[tasks.refresh-repo]
dependencies = ["publish-setup", "publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

if [ "${REPO_UNSAFE_REFRESH}" = "true" ]; then
   REPO_UNSAFE_REFRESH_ARG="--unsafe-refresh"
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   refresh-repo \
   \
   --repo "${PUBLISH_REPO}" \
   --arch "${BUILDSYS_ARCH}" \
   --variant "${BUILDSYS_VARIANT}" \
   \
   --root-role-path "${PUBLISH_REPO_ROOT_JSON}" \
   --repo-expiration-policy-path "${PUBLISH_EXPIRATION_POLICY_PATH}" \
   ${REPO_UNSAFE_REFRESH_ARG} \
   --outdir "${PUBLISH_REPO_OUTPUT_DIR}"
'''
]

[tasks.ami]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the image files below to save time.
# This does mean that `cargo make` must be run before `cargo make ami`.
dependencies = ["setup-build", "publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

cleanup() {
   [ -f "${root_image}" ] && rm -f "${root_image}"
   [ -f "${data_image}" ] && rm -f "${data_image}"
}
trap 'cleanup' EXIT

# Unlz4 the root / data images
rootlz4="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}.img.lz4"
root_image="${rootlz4%.lz4}"
datalz4="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-data.img.lz4"
data_image="${datalz4%.lz4}"
if [ ! -s "${rootlz4}" ] || [ ! -s "${datalz4}" ]; then
   echo "Image files don't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make'" >&2
   exit 1
fi
lz4 -df "${rootlz4}" "${root_image}"
lz4 -df "${datalz4}" "${data_image}"

ami_output="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-amis.json"
ami_output_latest="${BUILDSYS_OUTPUT_DIR}/latest/${BUILDSYS_NAME_VARIANT}-amis.json"

ami_name="${PUBLISH_AMI_NAME:-${PUBLISH_AMI_NAME_DEFAULT}}"

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   ami \
   \
   --root-image "${root_image}" \
   --data-image "${data_image}" \
   ${PUBLISH_ROOT_VOLUME_SIZE:+--root-volume-size "${PUBLISH_ROOT_VOLUME_SIZE}"} \
   --data-volume-size "${PUBLISH_DATA_VOLUME_SIZE}" \
   \
   --arch "${BUILDSYS_ARCH}" \
   --name "${ami_name}" \
   --description "${PUBLISH_AMI_DESCRIPTION:-${ami_name}}" \
   \
   --ami-output "${ami_output}" \
   \
   ${NO_PROGRESS:+--no-progress} \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"}

ln -snf "../${ami_output##*/}" "${ami_output_latest}"
'''
]

[tasks.ami-public]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the input file below to save time.
# This does mean that `cargo make ami` must be run before `cargo make ami-public`.
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

ami_input="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-amis.json"
if [ ! -s "${ami_input}" ]; then
   echo "AMI input file doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make ami'" >&2
   exit 1
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   publish-ami \
   --grant \
   --group-names all \
   \
   --ami-input "${ami_input}" \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"}
'''
]

[tasks.ami-private]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the input file below to save time.
# This does mean that `cargo make ami` must be run before `cargo make ami-private`.
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

ami_input="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-amis.json"
if [ ! -s "${ami_input}" ]; then
   echo "AMI input file doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make ami'" >&2
   exit 1
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   publish-ami \
   --revoke \
   --group-names all \
   \
   --ami-input "${ami_input}" \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"}
'''
]

[tasks.grant-ami]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the input file below to save time.
# This does mean that `cargo make ami` must be run before `cargo make grant-ami`.
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

if [ -z "${GRANT_TO_USERS}" ] && [ -z "${GRANT_TO_GROUPS}" ]; then
   echo "GRANT_TO_USERS and/or GRANT_TO_GROUPS is mandatory for grant-ami; please give a comma-separated list of user IDs or group names" >&2
   exit 1
fi

ami_input="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-amis.json"
if [ ! -s "${ami_input}" ]; then
   echo "AMI input file doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make ami'" >&2
   exit 1
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   publish-ami \
   --grant \
   ${GRANT_TO_USERS:+--user-ids "${GRANT_TO_USERS}"} \
   ${GRANT_TO_GROUPS:+--group-names "${GRANT_TO_GROUPS}"} \
   \
   --ami-input "${ami_input}" \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"}
'''
]

[tasks.revoke-ami]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the input file below to save time.
# This does mean that `cargo make ami` must be run before `cargo make revoke-ami`.
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

if [ -z "${REVOKE_FROM_USERS}" ] && [ -z "${REVOKE_FROM_GROUPS}" ]; then
   echo "REVOKE_FROM_USERS and/or REVOKE_FROM_GROUPS is mandatory for revoke-ami; please give a comma-separated list of user IDs or group names" >&2
   exit 1
fi

ami_input="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-amis.json"
if [ ! -s "${ami_input}" ]; then
   echo "AMI input file doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make ami'" >&2
   exit 1
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   publish-ami \
   --revoke \
   ${REVOKE_FROM_USERS:+--user-ids "${REVOKE_FROM_USERS}"} \
   ${REVOKE_FROM_GROUPS:+--group-names "${REVOKE_FROM_GROUPS}"} \
   \
   --ami-input "${ami_input}" \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"}
'''
]

[tasks.ssm]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the input file below to save time.
# This does mean that `cargo make ami` must be run before `cargo make ssm`.
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

ami_input="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-amis.json"
if [ ! -s "${ami_input}" ]; then
   echo "AMI input file doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make ami'" >&2
   exit 1
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   ssm \
   \
   --ami-input "${ami_input}" \
   --arch "${BUILDSYS_ARCH}" \
   --variant "${BUILDSYS_VARIANT}" \
   --version "${BUILDSYS_VERSION_FULL}" \
   --template-path "${PUBLISH_SSM_TEMPLATES_PATH}" \
   \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"} \
   ${ALLOW_CLOBBER:+--allow-clobber}
'''
]

[tasks.promote-ssm]
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

source="${SSM_SOURCE:-${BUILDSYS_VERSION_FULL}}"
target="${SSM_TARGET}"
if [ -z "${target}" ]; then
   echo "SSM_TARGET is mandatory for promote-ssm; please give the version (or pointer like "latest") to which you want to promote ${source}" >&2
   exit 1
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   promote-ssm \
   \
   --arch "${BUILDSYS_ARCH}" \
   --variant "${BUILDSYS_VARIANT}" \
   --source "${source}" \
   --target "${target}" \
   --template-path "${PUBLISH_SSM_TEMPLATES_PATH}" \
   \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"}
'''
]

[tasks.clean]
dependencies = [
  "clean-sources",
  "clean-packages",
  "clean-archives",
  "clean-images",
  "clean-repos",
  "clean-state",
]

[tasks.clean-sources]
script_runner = "bash"
script = [
'''
for ws in sources variants/* tools/{buildsys,pubsys}; do
  [ -d "${ws}" ] || continue
  cargo clean --manifest-path ${ws}/Cargo.toml
done
rm -f ${BUILDSYS_TOOLS_DIR}/bin/{buildsys,pubsys}
'''
]

[tasks.clean-packages]
script_runner = "bash"
script = [
'''
for ws in packages; do
  [ -d "${ws}" ] || continue
  cargo clean --manifest-path ${ws}/Cargo.toml
done
rm -rf ${BUILDSYS_PACKAGES_DIR}
'''
]

[tasks.clean-archives]
script_runner = "bash"
script = [
'''
rm -rf ${BUILDSYS_ARCHIVES_DIR}
'''
]

[tasks.clean-images]
script_runner = "bash"
script = [
'''
rm -rf ${BUILDSYS_IMAGES_DIR}
'''
]

[tasks.clean-repos]
script_runner = "bash"
script = [
'''
rm -rf ${PUBLISH_REPO_BASE_DIR}
'''
]

[tasks.clean-state]
script_runner = "bash"
script = [
'''
rm -rf ${BUILDSYS_STATE_DIR}
'''
]

[tasks.default]
alias = "build"