open-policy-agent / opa

Open Policy Agent (OPA) is an open source, general-purpose policy engine.
https://www.openpolicyagent.org
Apache License 2.0
9.57k stars 1.33k forks source link

freebsd build for v0.44.0 #5206

Closed yurivict closed 1 year ago

yurivict commented 1 year ago

Downstream report.

srenatus commented 1 year ago

Thanks. That installation method isn't supported, I'm afraid. Let's fix the build instead.

srenatus commented 1 year ago

To be clear, I certainly want that port to work! Is there an option not to use "go install"?

yurivict commented 1 year ago

What other methods exist in general?

You can also distribute tarballs with vendored (bundled) dependencies.

srenatus commented 1 year ago

The dependencies are all bundled in the git repo. The preferred build method would be to run make build in the sources.

yurivict commented 1 year ago

make build fails:

$ gmake build
Docker not installed or not running. Skipping OPA-WASM library build.
CGO_ENABLED=1 GOFLAGS="-buildmode=exe" go generate
CGO_ENABLED=1 GOFLAGS="-buildmode=exe" go build -tags=opa_wasm -o opa_freebsd_amd64 -ldflags " -X github.com/open-policy-agent/opa/version.Version=0.44.0 -X github.com/open-policy-agent/opa/version.Vcs=5701f4ab6e2f-dirty -X github.com/open-policy-agent/opa/version.Timestamp=2022-10-04T16:21:22Z -X github.com/open-policy-agent/opa/version.Hostname=yv.noip.me"
# github.com/open-policy-agent/opa
/usr/local/go119/pkg/tool/freebsd_amd64/link: running cc failed: exit status 1
ld: error: unable to find library -lwasmtime
cc: error: linker command failed with exit code 1 (use -v to see invocation)

gmake: *** [Makefile:121: go-build] Error 2
srenatus commented 1 year ago

Ah, right. There's no wasmtime lib for freebsd in wasmtime-go (because there's none in wasmtime's release artifacts). Bummer! Can you try this instead, please?

WASM_ENABLED=0 CGO_ENABLED=0 gmake build

We should fix the Makefile here to include more targets, so that make build just works on *BSD: https://sourcegraph.com/github.com/open-policy-agent/opa@f3c0630ea50b921630ae5a8ebddf17ae89b28ff1/-/blob/Makefile?L21-23

yurivict commented 1 year ago

make attempts to use git:

gmake[1]: git: No such file or directory

Downloads during package build aren't allowed in virtually all packaging systems (except Arch).

Is there a way not to download anything?

srenatus commented 1 year ago

It just fails looking up the ref. I'll look into fixing that tomorrow.

srenatus commented 1 year ago

So, here's what I get running this locally in a docker container without git (or bash or glibc) available:

$ docker run -v $(pwd):/w -w /w -it --rm --entrypoint sh distroless.dev/ko
/w $ CGO_ENABLED=0 WASM_ENABLED=0 make build
env: can't execute 'bash': No such file or directory
env: can't execute 'bash': No such file or directory
make: git: No such file or directory
Docker not installed or not running. Skipping OPA-WASM library build.
CGO_ENABLED=0 GOFLAGS="-buildmode=exe" go generate
CGO_ENABLED=0 GOFLAGS="-buildmode=exe" go build -tags= -o opa_linux_amd64 -ldflags " -X github.com/open-policy-agent/opa/version.Hostname="

so, we get some annoying warnings, but nonetheless there's a working binary at the end:

/w $ ./opa_linux_amd64 version
Version: 0.45.0-dev
Build Commit: 
Build Timestamp: 
Build Hostname: 
Go Version: go1.19.1
Platform: linux/amd64
WebAssembly: unavailable
/w $ ./opa_linux_amd64 eval -fpretty 'opa.runtime()'
{
  "commit": "",
  "env": {
    "HOME": "/home/nonroot",
    "HOSTNAME": "e1729f7cad5f",
    "PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
    "PWD": "/w",
    "SHLVL": "1",
    "SSL_CERT_FILE": "/etc/ssl/certs/ca-certificates.crt",
    "TERM": "xterm"
  },
  "version": "0.45.0-dev"
}

Do you not end up with a working binary for FreeBSD?

srenatus commented 1 year ago

OK I'm fairly sure the git failure is from this line:

ifneq (,$(or $(findstring rc,$(VERSION)), $(findstring release-,$(shell git branch --contains HEAD))))

so while it's annoying and noisy, it should not affect the build at all.

srenatus commented 1 year ago

Did this resolve the issue for you? 👀

srenatus commented 1 year ago

Please reopen if this keeps being an issue for you!