Makefile.toml

[config]
skip_core_tasks = true

[env]
BUILDSYS_ARCH = { script = ["uname -m"] }
BUILDSYS_ROOT_DIR = "${CARGO_MAKE_WORKING_DIRECTORY}"
BUILDSYS_BUILD_DIR = "${BUILDSYS_ROOT_DIR}/build"
BUILDSYS_PACKAGES_DIR = "${BUILDSYS_BUILD_DIR}/rpms"
BUILDSYS_STATE_DIR = "${BUILDSYS_BUILD_DIR}/state"
BUILDSYS_IMAGES_DIR = "${BUILDSYS_BUILD_DIR}/images"
BUILDSYS_TOOLS_DIR = "${BUILDSYS_ROOT_DIR}/tools"
BUILDSYS_SOURCES_DIR = "${BUILDSYS_ROOT_DIR}/sources"
BUILDSYS_TIMESTAMP = { script = ["date +%s"] }
BUILDSYS_VERSION_BUILD = { script = ["git describe --always --dirty --exclude '*' || echo 00000000"] }
# For now, release config path can't be overridden with -e, because it's used
# later in this section.  You have to edit the path here in Makefile.toml to
# use a different Release.toml.
BUILDSYS_RELEASE_CONFIG_PATH = "${BUILDSYS_ROOT_DIR}/Release.toml"
BUILDSYS_VERSION_IMAGE = { script = ["awk -F '[ =\"]+' '$1 == \"version\" {print $2}' ${BUILDSYS_RELEASE_CONFIG_PATH}"] }
# This can be overridden with -e to build a different variant from the variants/ directory
BUILDSYS_VARIANT = "aws-k8s-1.21"
# Product name used for file and directory naming
BUILDSYS_NAME = "bottlerocket"
# "Pretty" name used to identify OS in os-release, bootloader, etc.
# If you're building a Bottlerocket remix, you'd want to set this to something like
# "Bottlerocket Remix by ${CORP}" or "${CORP}'s Bottlerocket Remix"
BUILDSYS_PRETTY_NAME = "Bottlerocket OS"
# SDK name used for building
BUILDSYS_SDK_NAME="bottlerocket"
# SDK version used for building
BUILDSYS_SDK_VERSION="v0.25.1"
# Site for fetching the SDK
BUILDSYS_REGISTRY="public.ecr.aws/bottlerocket"

# These can be overridden with -e to change configuration for pubsys (`cargo
# make repo`).  In addition, you can set RELEASE_START_TIME to determine when
# update waves and repo metadata expiration times will start, instead of
# starting now.  (This can be an RFC3339 date, or an offset like "in X
# hours/days/weeks".)
PUBLISH_EXPIRATION_POLICY_PATH = "${BUILDSYS_ROOT_DIR}/tools/pubsys/policies/repo-expiration/2w-2w-1w.toml"
PUBLISH_WAVE_POLICY_PATH = "${BUILDSYS_ROOT_DIR}/sources/updater/waves/default-waves.toml"
PUBLISH_INFRA_CONFIG_PATH = "${BUILDSYS_ROOT_DIR}/Infra.toml"
# Default repo to read from PUBLISH_INFRA_CONFIG_PATH
PUBLISH_REPO = "default"
# The version of tuftool (without the 'v') that we will install and use for
# publishing-related steps
PUBLISH_TUFTOOL_VERSION="0.7.2"

# The size in GiB of the data volume in the block device mapping of registered
# AMIs.  (You can also specify PUBLISH_ROOT_VOLUME_SIZE to override the root
# volume size; by default it's the image size, rounded up.)
PUBLISH_DATA_VOLUME_SIZE = "20"

# For images using a "unified" layout where both OS and data partitions are in
# the same image, the root / data distinction doesn't make sense, but we still
# have an idea of how big the overall volume should be to have "enough" space.
PUBLISH_UNIFIED_VOLUME_SIZE = "22"

# This can be overridden with -e to change the path to the file containing SSM
# parameter templates.  This file determines the parameter names and values
# that will be published to SSM when you run `cargo make ssm`.  See
# tools/pubsys/policies/ssm/README.md for more information.
PUBLISH_SSM_TEMPLATES_PATH = "${BUILDSYS_ROOT_DIR}/tools/pubsys/policies/ssm/defaults.toml"

# This can be overriden with -e to change the source path
# for the Licenses.toml file
BUILDSYS_LICENSES_CONFIG_PATH = "${BUILDSYS_ROOT_DIR}/Licenses.toml"

# Specifies whether to validate all targets when validating TUF repositories
REPO_VALIDATE_TARGETS = "true"
# Specifies the timeframe to look for upcoming repository metadata expirations
REPO_METADATA_EXPIRING_WITHIN = "3 days"
# When refreshing repositories, you can set REPO_UNSAFE_REFRESH=true to refresh repositories that have expired metadata files.

# You can also set PUBLISH_REGIONS to override the list of regions from
# Infra.toml for AMI and SSM commands; it's a comma-separated list like
# "us-west-2,us-east-1".
# You can set NO_PROGRESS=true to not print progress bars during snapshot upload.
# You can use ALLOW_CLOBBER=true with the `ssm` task to make it overwrite existing values.
# (This is not required with `promote-ssm` because the intent of promotion is overwriting.)

# This can be overridden to provide a custom import spec for a VMware OVA.
# Using configuration from Infra.toml, we substitute the correct value for
# network, and whether or not to mark a VM as a template
VMWARE_IMPORT_SPEC_PATH = "${BUILDSYS_ROOT_DIR}/tools/pubsys/support/vmware/import_spec.template"

# You can set VMWARE_DATACENTERS to override the list of datacenters from
# Infra.toml for VMware commands; it's a comma-separated list like
# "datacenter1,datacenter2"

# Disallow pulling directly Upstream URLs when lookaside cache results in MISSes as a fallback.
# To use the upstream source as fallback, override this on the command line and set it to 'true'
BUILDSYS_UPSTREAM_SOURCE_FALLBACK = "false"

# We require license checks to pass to build an image.  If you're working on a
# local change and don't have license information yet, you can run with `-e
# BUILDSYS_ALLOW_FAILED_LICENSE_CHECK=true` to allow the build to continue even
# if the license check fails.
BUILDSYS_ALLOW_FAILED_LICENSE_CHECK = "false"

# Disallow pulling licenses from Upstream URLs. To fetch licenses from the upstream source,
# override this on the command line and set it to 'true'
BUILDSYS_UPSTREAM_LICENSE_FETCH= "false"

# This controls how many `docker build` commands we'll invoke at once.
BUILDSYS_JOBS = "8"

CARGO_HOME = "${BUILDSYS_ROOT_DIR}/.cargo"
GO_MOD_CACHE = "${BUILDSYS_ROOT_DIR}/.gomodcache"
GO_MODULES = "ecs-gpu-init host-ctr"
DOCKER_BUILDKIT = "1"

# This is the filename suffix for operations that write out AMI information to
# file.  It can be overridden with -e in situations where a user is using
# multiple `Infra.toml` files for publishing to different places, and wants to
# write AMI information to specifically named files.
AMI_DATA_FILE_SUFFIX = "amis.json"

[env.development]
# Certain variables are defined here to allow us to override a component value
# on the command line.

# Depends on ${BUILDSYS_ARCH}, ${BUILDSYS_REGISTRY}, ${BUILDSYS_SDK_NAME}, and
# ${BUILDSYS_SDK_VERSION}.
BUILDSYS_SDK_IMAGE = { script = [ "echo ${BUILDSYS_REGISTRY}/${BUILDSYS_SDK_NAME}-sdk-${BUILDSYS_ARCH}:${BUILDSYS_SDK_VERSION}" ] }
BUILDSYS_TOOLCHAIN = { script = [ "echo ${BUILDSYS_REGISTRY}/${BUILDSYS_SDK_NAME}-toolchain-${BUILDSYS_ARCH}:${BUILDSYS_SDK_VERSION}" ] }

# Depends on ${BUILDSYS_JOBS}.
CARGO_MAKE_CARGO_ARGS = "--jobs ${BUILDSYS_JOBS} --offline --locked"

# Depends on ${BUILDSYS_ARCH} and ${BUILDSYS_VARIANT}.
BUILDSYS_OUTPUT_DIR = "${BUILDSYS_IMAGES_DIR}/${BUILDSYS_ARCH}-${BUILDSYS_VARIANT}"

# Depends on a number of variables defined above, and each other.
BUILDSYS_VERSION_FULL="${BUILDSYS_VERSION_IMAGE}-${BUILDSYS_VERSION_BUILD}"
# These names are used as prefixes for build and repo steps.
BUILDSYS_NAME_VARIANT="${BUILDSYS_NAME}-${BUILDSYS_VARIANT}-${BUILDSYS_ARCH}"
BUILDSYS_NAME_VERSION="${BUILDSYS_NAME}-${BUILDSYS_VERSION_FULL}"
BUILDSYS_NAME_FULL="${BUILDSYS_NAME_VARIANT}-${BUILDSYS_VERSION_FULL}"
# Path to repo-specific root role.
PUBLISH_REPO_ROOT_JSON = "${BUILDSYS_ROOT_DIR}/roles/${PUBLISH_REPO}.root.json"
# If you don't specify a signing key in Infra.toml, we generate one at this path.
PUBLISH_REPO_KEY = "${BUILDSYS_ROOT_DIR}/keys/${PUBLISH_REPO}.pem"
# Repo directories have subdirectories for variant/arch, so we only want version here.
PUBLISH_REPO_BASE_DIR = "${BUILDSYS_BUILD_DIR}/repos"
PUBLISH_REPO_OUTPUT_DIR = "${PUBLISH_REPO_BASE_DIR}/${PUBLISH_REPO}/${BUILDSYS_NAME_VERSION}"
# The default name of registered AMIs; override by setting PUBLISH_AMI_NAME.
PUBLISH_AMI_NAME_DEFAULT = "${BUILDSYS_NAME}-${BUILDSYS_VARIANT}-${BUILDSYS_ARCH}-v${BUILDSYS_VERSION_IMAGE}-${BUILDSYS_VERSION_BUILD}"

# The name of the kmod kit archive, used to ease building out-of-tree kernel modules.
BUILDSYS_KMOD_KIT = "${BUILDSYS_VARIANT}-${BUILDSYS_ARCH}-kmod-kit-v${BUILDSYS_VERSION_IMAGE}.tar.xz"
BUILDSYS_KMOD_KIT_PATH = "${BUILDSYS_OUTPUT_DIR}/latest/${BUILDSYS_KMOD_KIT}"

# The name of the OVA bundle that will be built if the current variant builds VMDK artifacts
BUILDSYS_OVA = "${BUILDSYS_NAME_VARIANT}-v${BUILDSYS_VERSION_IMAGE}.ova"
BUILDSYS_OVA_PATH = "${BUILDSYS_OUTPUT_DIR}/latest/${BUILDSYS_OVA}"
BUILDSYS_OVF_TEMPLATE = "${BUILDSYS_ROOT_DIR}/variants/${BUILDSYS_VARIANT}/template.ovf"

# The default name of uploaded OVAs; override by setting VMWARE_VM_NAME
VMWARE_VM_NAME_DEFAULT = "${BUILDSYS_NAME}-${BUILDSYS_VARIANT}-${BUILDSYS_ARCH}-v${BUILDSYS_VERSION_IMAGE}-${BUILDSYS_VERSION_BUILD}"

[tasks.setup]
script = [
'''
# Ensure we use a supported architecture
case "${BUILDSYS_ARCH}" in
   x86_64|aarch64) ;;
   *)
      echo "Unrecognized architecture '${BUILDSYS_ARCH}'; please use 'x86_64 or 'aarch64'"
      exit 1
      ;;
esac

mkdir -p ${BUILDSYS_BUILD_DIR}
mkdir -p ${BUILDSYS_OUTPUT_DIR}
mkdir -p ${BUILDSYS_PACKAGES_DIR}
mkdir -p ${BUILDSYS_STATE_DIR}
mkdir -p ${GO_MOD_CACHE}
'''
]

[tasks.setup-build]
dependencies = ["setup"]
script = [
'''
for cmd in docker gzip lz4; do
  if ! command -v ${cmd} >/dev/null 2>&1 ; then
    echo "required program '${cmd}' not found" >&2
    exit 1
  fi
done
'''
]

[tasks.fetch]
dependencies = [
  "fetch-sdk",
  "fetch-toolchain",
  "fetch-sources",
  "fetch-vendored",
]

[tasks.fetch-sdk]
dependencies = ["setup-build"]
script_runner = "bash"
script = [
'''
if ! docker image inspect "${BUILDSYS_SDK_IMAGE}" >/dev/null 2>&1 ; then
  if ! docker pull "${BUILDSYS_SDK_IMAGE}" ; then
    echo "failed to pull '${BUILDSYS_SDK_IMAGE}'" >&2
    exit 1
  fi
fi
'''
]

[tasks.fetch-toolchain]
dependencies = ["setup-build"]
script_runner = "bash"
script = [
'''
if docker image inspect "${BUILDSYS_TOOLCHAIN}-${BUILDSYS_ARCH}" >/dev/null 2>&1 ; then
  exit 0
fi

case "${BUILDSYS_ARCH}" in
  x86_64) docker_arch="amd64" ;;
  aarch64) docker_arch="arm64" ;;
esac

# We want the image with the target's native toolchain, rather than one that matches the
# host architecture.
if ! docker pull --platform "${docker_arch}" "${BUILDSYS_TOOLCHAIN}" ; then
  echo "could not pull '${BUILDSYS_TOOLCHAIN}' for ${docker_arch}" >&2
  exit 1
fi

# Apply a tag to distinguish the image from other architectures.
if ! docker tag "${BUILDSYS_TOOLCHAIN}" "${BUILDSYS_TOOLCHAIN}-${BUILDSYS_ARCH}" ; then
  echo "could not tag '${BUILDSYS_TOOLCHAIN}-${BUILDSYS_ARCH}'" >&2
  exit 1
fi
'''
]

[tasks.fetch-sources]
dependencies = ["setup"]
script_runner = "bash"
script = [
'''
for ws in sources variants tools; do
  [ -d "${ws}" ] || continue
  cargo fetch --locked --manifest-path ${ws}/Cargo.toml
done
chmod -R o+r ${CARGO_HOME}
'''
]

[tasks.fetch-vendored]
dependencies = ["fetch-sdk"]
script = [
'''
go_fetch() {
  local module
  module="${1:?}"
  ${BUILDSYS_TOOLS_DIR}/docker-go \
    --module-path "${BUILDSYS_SOURCES_DIR}/${module}" \
    --sdk-image ${BUILDSYS_SDK_IMAGE} \
    --go-mod-cache ${GO_MOD_CACHE} \
    --command "go list -mod=readonly ./... >/dev/null && go mod vendor"
}

for m in ${GO_MODULES}; do
  go_fetch ${m}
done
'''
]

[tasks.unit-tests]
dependencies = ["fetch-sdk", "fetch-sources", "fetch-vendored"]
script = [
'''
export VARIANT="${BUILDSYS_VARIANT}"

cargo test \
  ${CARGO_BUILD_ARGS} \
  ${CARGO_MAKE_CARGO_ARGS} \
  --manifest-path ${BUILDSYS_SOURCES_DIR}/Cargo.toml \
  --all

# unit tests (go)
test_go_module() {
  local module
  module="${1:?}"
  ${BUILDSYS_TOOLS_DIR}/docker-go \
    --module-path "${BUILDSYS_SOURCES_DIR}/${module}" \
    --sdk-image ${BUILDSYS_SDK_IMAGE} \
    --go-mod-cache ${GO_MOD_CACHE} \
    --command "cd cmd/$module; go test -v"
}

for m in ${GO_MODULES}; do
  test_go_module ${m}
done
'''
]

[tasks.check-fmt]
script = [
'''
rc=0
# For golang first-party source code
go_fmt() {
  local module
  module="${1:?}"
  ${BUILDSYS_TOOLS_DIR}/docker-go \
    --module-path "${BUILDSYS_SOURCES_DIR}/${module}" \
    --sdk-image ${BUILDSYS_SDK_IMAGE} \
    --go-mod-cache ${GO_MOD_CACHE} \
    --command "gofmt -l cmd/$module"
}

for m in ${GO_MODULES}; do
  unformatted_files=$(go_fmt ${m})
  if [ -n "${unformatted_files}" ]; then
    echo "${unformatted_files}"
    rc=1
  fi
done

# For rust first-party source code
if ! cargo fmt \
  --manifest-path ${BUILDSYS_SOURCES_DIR}/Cargo.toml \
  --message-format short \
  --all \
  -- --check; then
  rc=1
fi

if ! cargo fmt \
  --manifest-path ${BUILDSYS_TOOLS_DIR}/Cargo.toml \
  --message-format short \
  --all \
  -- --check; then
  rc=1
fi

if [ "${rc}" -ne 0 ]; then
  echo "Found unformatted source files listed above. First-party source code is checked with gofmt and rustfmt." >&2
  exit $rc
fi
'''
]

[tasks.build-tools]
dependencies = ["fetch"]
script = [
'''
cargo install \
  ${CARGO_MAKE_CARGO_ARGS} \
  --path tools/buildsys \
  --root tools \
  --force \
  --quiet
'''
]

# Note: this is separate from publish-tools because publish-tools takes a while
# to build and isn't needed to build an image.
[tasks.publish-setup-tools]
dependencies = ["setup", "fetch-sources", "tuftool"]
script = [
'''
cargo install \
  ${CARGO_MAKE_CARGO_ARGS} \
  --path tools/pubsys-setup \
  --root tools \
  --force \
  --quiet
'''
]

[tasks.infra-tools]
dependencies = ["setup", "fetch-sources", "tuftool"]
script = [
'''
cargo install \
  ${CARGO_MAKE_CARGO_ARGS} \
  --path tools/infrasys \
  --root tools \
  --force \
  --quiet
'''
]

[tasks.publish-tools]
dependencies = ["setup", "fetch-sources"]
script = [
'''
cargo install \
  ${CARGO_MAKE_CARGO_ARGS} \
  --path tools/pubsys \
  --root tools \
  --force \
  --quiet
'''
]

# We need Cargo version 1.51 or higher in order to build a workspace's
# dependency during build-package
[tasks.check-cargo-version]
script_runner = "bash"
script = [
'''
set -euo pipefail
cargo_version=$(cargo --version | awk '{print $2}')
strarr=(${cargo_version//./ })
cargo_major="${strarr[0]}"
cargo_minor="${strarr[1]}"
if [ "${cargo_major}" -gt "1" ] ; then
  # cargo is version 2 or higher, so it's higher than 1.51
  exit 0
fi
if [ "${cargo_minor}" -lt "51" ] ; then
  echo "Error: Cargo 1.51.0 or greater is required, your version is ${cargo_version}" >&2
  exit 1
fi
'''
]

# Builds a package including its build-time and runtime dependency packages.
[tasks.build-package]
dependencies = ["check-cargo-version", "build-tools", "publish-setup", "fetch-licenses"]
script_runner = "bash"
script = [
'''
set -e
if [ -z "${PACKAGE}" ]; then
    echo "The PACKAGE environment variable must be set. For example:"
    echo "cargo make -e PACKAGE=kernel build-package"
    exit 1
fi

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

# Save built artifacts for each architecture.  We don't set this everywhere
# because we build host tools with cargo as well, like buildsys and pubsys.
export CARGO_TARGET_DIR=${BUILDSYS_ROOT_DIR}/variants/target/${BUILDSYS_ARCH}

cargo build \
  ${CARGO_BUILD_ARGS} \
  ${CARGO_MAKE_CARGO_ARGS} \
  --manifest-path "variants/Cargo.toml" \
  --package "${PACKAGE}"
'''
]

[tasks.build-variant]
dependencies = ["build-tools", "publish-setup"]
script = [
'''
export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

# Save built artifacts for each architecture.  We don't set this everywhere
# because we build host tools with cargo as well, like buildsys and pubsys.
export CARGO_TARGET_DIR=${BUILDSYS_ROOT_DIR}/variants/target/${BUILDSYS_ARCH}

cargo build \
  ${CARGO_BUILD_ARGS} \
  ${CARGO_MAKE_CARGO_ARGS} \
  --manifest-path variants/${BUILDSYS_VARIANT}/Cargo.toml
'''
]

[tasks.build-ova]
script_runner = "bash"
script = [
'''
set -e -o pipefail

cleanup() {
   [ -n "${ova_tmp_dir}" ] && rm -rf "${ova_tmp_dir}"
}
trap 'cleanup' EXIT

measure_image() {
   local image
   image="${1:?}"
   # Can't count on "realpath" availability, so assume an absolute image path underneath
   # our build root directory.
   image=".${image#${BUILDSYS_ROOT_DIR}}"
   docker run --rm \
      --network=none \
      --user "$(id -u):$(id -g)" \
      --security-opt label:disable \
      -v "${BUILDSYS_ROOT_DIR}/build":/tmp/build \
      "${BUILDSYS_SDK_IMAGE}" \
      bash -c "set -o pipefail ; cd /tmp; qemu-img measure ${image} | awk '/required size/{print \$NF}'"
}

root_vmdk_path="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}.vmdk"
data_vmdk_path="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-data.vmdk"
ova_tmp_dir="$(mktemp -d)"
ovf="${BUILDSYS_NAME_FULL}.ovf"
manifest="${BUILDSYS_NAME_FULL}.mf"

# Short circuit if no OVF template exists.
if [ ! -s "${BUILDSYS_OVF_TEMPLATE}" ] ; then
   if [ ! -s "${root_vmdk_path}" ]; then
      # If no VMDK exists either, there's nothing to do.
      echo "No OVF template or VMDK images, skipping OVA build"
      exit 0
   else
      # Warn the user if a VMDK exists but an OVF template does not.  Assume we do not
      # need to build an OVA in this case
      echo "VMDK image found, but OVF template '${BUILDSYS_OVF_TEMPLATE}' doesn't exist, skipping OVA build"
      exit 0
   fi
fi

# OVF templates all expect at least one disk.
if [ ! -s "${root_vmdk_path}" ] ; then
   echo "OVF template exists but VMDK root image doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL}." >&2
   echo "Unable to build an OVA" >&2
   exit 1
fi

# If the template expects a data disk, make sure the image exists - it might not if we
# built the variant with the "unified" layout.
if grep -Fq '{{DATA_DISK}}' ${BUILDSYS_OVF_TEMPLATE} && [ ! -s "${data_vmdk_path}" ] ; then
   echo "OVF template has data disk but VMDK data image doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL}." >&2
   echo "Unable to build an OVA" >&2
   exit 1
fi

# If the template doesn't expect a data disk, make sure the image doesn't exist - it
# might if we built the variant with the "split" layout.
if ! grep -Fq '{{DATA_DISK}}' ${BUILDSYS_OVF_TEMPLATE} && [ -s "${data_vmdk_path}" ] ; then
   echo "OVF template does not have data disk but VMDK data image exists for the current version/commit - ${BUILDSYS_VERSION_FULL}." >&2
   echo "Unable to build an OVA" >&2
   exit 1
fi

is_split="no"
if [ -s "${data_vmdk_path}" ] ; then
   is_split="yes"
fi

bytes_in_gib="$((1024 * 1024 * 1024))"
root_image_size_bytes="$(measure_image "${root_vmdk_path}")"
root_image_size_gib="$((root_image_size_bytes / bytes_in_gib))"
if [ "${is_split}" == "yes" ] ; then
   # If an optional root volume size is given, it must be larger than the root image.
   if [ -n "${PUBLISH_ROOT_VOLUME_SIZE}" ] ; then
      if [ "${PUBLISH_ROOT_VOLUME_SIZE}" -lt "${root_image_size_gib}" ] ; then
         echo "Root image is larger than the given volume size - pass '-e PUBLISH_ROOT_VOLUME_SIZE=${root_image_size_gib}' to fix" >&2
         exit 1
      fi
      root_image_size_bytes="$((PUBLISH_ROOT_VOLUME_SIZE * bytes_in_gib))"
   fi
   data_image_size_bytes="$(measure_image "${data_vmdk_path}")"
   data_image_size_gib="$((data_image_size_bytes / bytes_in_gib))"
   if [ "${PUBLISH_DATA_VOLUME_SIZE}" -lt "${data_image_size_gib}" ] ; then
      echo "Data image is larger than the given volume size - pass '-e PUBLISH_DATA_VOLUME_SIZE=${data_image_size_gib}' to fix" >&2
      exit 1
   fi
   data_image_size_bytes="$((PUBLISH_DATA_VOLUME_SIZE * bytes_in_gib))"
else # unified
   if [ "${PUBLISH_UNIFIED_VOLUME_SIZE}" -lt "${root_image_size_gib}" ] ; then
      echo "Unified image is larger than the given volume size - pass '-e PUBLISH_UNIFIED_VOLUME_SIZE=${root_image_size_gib}' to fix" >&2
      exit 1
   fi
   root_image_size_bytes="$((PUBLISH_UNIFIED_VOLUME_SIZE * bytes_in_gib))"
   data_image_size_bytes="0"
fi

# Create the OVF with the correct values
sed "${BUILDSYS_OVF_TEMPLATE}" \
   -e "s/{{ROOT_DISK}}/${root_vmdk_path##*/}/g" \
   -e "s/{{DATA_DISK}}/${data_vmdk_path##*/}/g" \
   -e "s/{{ROOT_DISK_BYTES}}/${root_image_size_bytes}/g" \
   -e "s/{{DATA_DISK_BYTES}}/${data_image_size_bytes}/g" \
   > "${ova_tmp_dir}/${ovf}"

# Make sure we replaced all the '{{...}}' fields with real values.
if grep -F -e '{{' -e '}}' "${ova_tmp_dir}/${ovf}" ; then
   echo "Failed to fully render the OVF template" >&2
   exit 1
fi

# Create the manifest file with the SHA's of the VMDK's and the OVF
root_sha256="$(sha256sum ${root_vmdk_path} | awk '{print $1}')"
if [ "${is_split}" == "yes" ] ; then
   data_sha256="$(sha256sum ${data_vmdk_path} | awk '{print $1}')"
fi

echo "SHA256(${root_vmdk_path##*/})= ${root_sha256}" > "${ova_tmp_dir}/${manifest}"
if [ "${is_split}" == "yes" ] ; then
   echo "SHA256(${data_vmdk_path##*/})= ${data_sha256}" >> "${ova_tmp_dir}/${manifest}"
fi

ovf_sha256="$(sha256sum ${ova_tmp_dir}/${ovf} | awk '{print $1}')"
echo "SHA256(${ovf})= ${ovf_sha256}" >> "${ova_tmp_dir}/${manifest}"

cp "${root_vmdk_path}" "${ova_tmp_dir}"
if [ "${is_split}" == "yes" ] ; then
   cp "${data_vmdk_path}" "${ova_tmp_dir}"
fi

# According to the OVF spec:
# https://www.dmtf.org/sites/default/files/standards/documents/DSP0243_2.1.1.pdf,
# the OVF must be first in the tar bundle.  Manifest is next, and then the
# files must fall in the same order as listed in the References section of the
# OVF file
tar -cf "${ova_tmp_dir}/${BUILDSYS_OVA}" -C "${ova_tmp_dir}" "${ovf}" "${manifest}" "${root_vmdk_path##*/}"
if [ "${is_split}" == "yes" ] ; then
   tar -rf "${ova_tmp_dir}/${BUILDSYS_OVA}" -C "${ova_tmp_dir}" "${data_vmdk_path##*/}"
fi

mv "${ova_tmp_dir}/${BUILDSYS_OVA}" "${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}.ova"
'''
]

[tasks.check-licenses]
dependencies = ["fetch"]
script = [
'''
run_cargo_deny="
(cd /tmp/sources && cargo deny --all-features check --disable-fetch licenses bans sources) &&
(cd /tmp/tools && cargo deny --all-features check --disable-fetch licenses bans sources)
"
set +e
docker run --rm \
  --network=none \
  --user "$(id -u):$(id -g)" \
  --security-opt label:disable \
  -e CARGO_HOME="/tmp/.cargo" \
  -v "${CARGO_HOME}":/tmp/.cargo \
  -v "${BUILDSYS_ROOT_DIR}/sources":/tmp/sources \
  -v "${BUILDSYS_ROOT_DIR}/tools":/tmp/tools \
  "${BUILDSYS_SDK_IMAGE}" \
  bash -c "${run_cargo_deny}"
[ "${?}" -eq 0 ] || [ "${BUILDSYS_ALLOW_FAILED_LICENSE_CHECK}" = "true" ]
'''
]

[tasks.fetch-licenses]
dependencies = ["fetch"]
script = [
'''
if [ "${BUILDSYS_UPSTREAM_LICENSE_FETCH}" = "false" ]; then
  echo "Skipping fetching licenses"
  exit 0
fi

# Attempt copy Licenses.toml
cp "${BUILDSYS_LICENSES_CONFIG_PATH}" "${BUILDSYS_ROOT_DIR}/Licenses.toml" 2>/dev/null \
  || echo "Skipping copying file from ${BUILDSYS_LICENSES_CONFIG_PATH}"

if [ ! -s "${BUILDSYS_ROOT_DIR}"/Licenses.toml ] ; then
  echo "Not fetching licenses since 'Licenses.toml' doesn't exist"
  exit 0
fi

mkdir -p "${BUILDSYS_ROOT_DIR}"/licenses

run_fetch_licenses="
bottlerocket-license-tool -l /tmp/Licenses.toml fetch /tmp/licenses
"
set +e

docker run --rm \
  --user "$(id -u):$(id -g)" \
  --security-opt label:disable \
  -e CARGO_HOME="/tmp/.cargo" \
  -v "${CARGO_HOME}":/tmp/.cargo \
  -v "${BUILDSYS_ROOT_DIR}/licenses:/tmp/licenses" \
  -v "${BUILDSYS_ROOT_DIR}/Licenses.toml:/tmp/Licenses.toml" \
  "${BUILDSYS_SDK_IMAGE}" \
  bash -c "${run_fetch_licenses}"
'''
]


[tasks.link-clean]
dependencies = ["fetch"]
script = [
'''
for link in \
    ${BUILDSYS_OUTPUT_DIR}/latest/${BUILDSYS_NAME_VARIANT}* \
    ${BUILDSYS_OUTPUT_DIR}/latest/*-kmod-kit-* \
    ${BUILDSYS_OUTPUT_DIR}/latest/*.ova ; do
  if [ -L "${link}" ]; then
    rm ${link}
  fi
done
'''
]

[tasks.link-variant]
dependencies = ["build-variant"]
script_runner = "bash"
script = [
'''
mkdir -p ${BUILDSYS_OUTPUT_DIR}/latest
for artifact in ${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}* ; do
  file_name="${artifact##*/}"
  link_name="${file_name/${BUILDSYS_NAME_FULL}/${BUILDSYS_NAME_VARIANT}}"
  ln -snf "../${file_name}" "${BUILDSYS_OUTPUT_DIR}/latest/${link_name}"
done
ln -snf "../${BUILDSYS_NAME_FULL}-kmod-kit.tar.xz" "${BUILDSYS_KMOD_KIT_PATH}"
if [ -s "${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}.ova" ] ; then
  ln -snf "../${BUILDSYS_NAME_FULL}.ova" "${BUILDSYS_OVA_PATH}"
fi
'''
]

[tasks.build]
dependencies = [
    "link-clean",
    "check-licenses",
    "fetch-licenses",
    "build-variant",
    "build-ova",
    "link-variant",
]

[tasks.tuftool]
script = [
'''
cargo install \
  --jobs ${BUILDSYS_JOBS} \
  --locked \
  --root tools \
  --quiet \
  --version ${PUBLISH_TUFTOOL_VERSION} \
  tuftool
'''
]

[tasks.create-infra]
dependencies = ["infra-tools"]
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

infrasys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}"  \
   \
   create-infra \
   --root-role-path "${PUBLISH_REPO_ROOT_JSON}"
'''
]

[tasks.publish-setup]
dependencies = ["publish-setup-tools"]
script = [
'''
set -e
export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

if [ "${ALLOW_MISSING_KEY}" = "true" ]; then
   ALLOW_MISSING_KEY_ARG="--allow-missing-key"
fi

pubsys-setup \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   --root-role-path "${PUBLISH_REPO_ROOT_JSON}" \
   --default-key-path "${PUBLISH_REPO_KEY}" \
   --repo "${PUBLISH_REPO}" \
   ${ALLOW_MISSING_KEY_ARG}
'''
]

[tasks.publish-setup-without-key]
env = { "ALLOW_MISSING_KEY" = "true" }
run_task = "publish-setup"

# Builds a local repository based on the 'latest' built targets.  Uses pubsys
# to create a repo under /build/repos, named after the arch/variant/version,
# containing subdirectories for the repo metadata and targets.
[tasks.repo]
# Rather than depend on "build", which currently rebuilds images each run, we
# check for the image files below to save time.  This does mean that `cargo
# make` must be run before `cargo make repo`.
dependencies = ["publish-setup", "publish-tools"]
script_runner = "bash"
script = [
'''
set -e

cleanup() {
   [ -n "${MIGRATIONS_DIR}" ] && rm -rf "${MIGRATIONS_DIR}"
}
trap 'cleanup' EXIT

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

bootlz4="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-boot.ext4.lz4"
rootlz4="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-root.ext4.lz4"
hashlz4="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-root.verity.lz4"
if [ ! -s "${bootlz4}" ] || [ ! -s "${rootlz4}" ] || [ ! -s "${hashlz4}" ]; then
   echo "Image files don't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make'" >&2
   exit 1
fi

COPY_REPO_TARGETS=()

# TODO: only add migrations from Release.toml, not all
MIGRATIONS_DIR="$(mktemp -d)"
tar xpf "${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-migrations.tar" -C "${MIGRATIONS_DIR}"
for file in ${MIGRATIONS_DIR}/*; do
   [ -e "${file}" ] || continue
   COPY_REPO_TARGETS+=("--copy-target ${file}")
done

# Include the kmod kit in the repo so it's easier to build out-of-tree kernel
# modules for a given release.
LINK_REPO_TARGETS=("--link-target ${BUILDSYS_KMOD_KIT_PATH}")

# Include the root and data disk images in the repo if they exist
os_disk_img="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}.img.lz4"
if [ -s "${os_disk_img}" ] ; then
   LINK_REPO_TARGETS+=("--link-target ${os_disk_img}")
fi

data_disk_img="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-data.img.lz4"
if [ -s "${data_disk_img}" ]; then
   LINK_REPO_TARGETS+=("--link-target ${data_disk_img}")
fi

# Ensure we link an OVA if an OVF template exists (in which case we should have
# built an OVA)
if [ -s "${BUILDSYS_OVF_TEMPLATE}" ]; then
   if [ -s "${BUILDSYS_OVA_PATH}" ]; then
      LINK_REPO_TARGETS+=("--link-target ${BUILDSYS_OVA_PATH}")
   else
      echo "An OVA doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL}. An OVA is required to build a repo" >&2
      exit 1
   fi
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   repo \
   \
   --repo "${PUBLISH_REPO}" \
   --arch "${BUILDSYS_ARCH}" \
   --version "${BUILDSYS_VERSION_IMAGE}" \
   --variant "${BUILDSYS_VARIANT}" \
   \
   --boot-image "${bootlz4}" \
   --root-image "${rootlz4}" \
   --hash-image "${hashlz4}" \
   ${LINK_REPO_TARGETS[*]} \
   ${COPY_REPO_TARGETS[*]} \
   \
   --repo-expiration-policy-path "${PUBLISH_EXPIRATION_POLICY_PATH}" \
   --release-config-path "${BUILDSYS_RELEASE_CONFIG_PATH}" \
   --wave-policy-path "${PUBLISH_WAVE_POLICY_PATH}" \
   \
   ${RELEASE_START_TIME:+--release-start-time ${RELEASE_START_TIME}} \
   \
   --root-role-path "${PUBLISH_REPO_ROOT_JSON}" \
   --default-key-path "${PUBLISH_REPO_KEY}" \
   \
   --outdir "${PUBLISH_REPO_OUTPUT_DIR}"

ln -sfn "${PUBLISH_REPO_OUTPUT_DIR##*/}" "${PUBLISH_REPO_OUTPUT_DIR%/*}/latest"
'''
]

[tasks.validate-repo]
dependencies = ["publish-setup-without-key", "publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

if [ "${REPO_VALIDATE_TARGETS}" = "true" ]; then
   REPO_VALIDATE_TARGETS_ARG="--validate-targets"
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   validate-repo \
   \
   --repo "${PUBLISH_REPO}" \
   --arch "${BUILDSYS_ARCH}" \
   --variant "${BUILDSYS_VARIANT}" \
   \
   --root-role-path "${PUBLISH_REPO_ROOT_JSON}" \
   ${REPO_VALIDATE_TARGETS_ARG}
'''
]

[tasks.check-repo-expirations]
dependencies = ["publish-setup-without-key", "publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   check-repo-expirations \
   \
   --repo "${PUBLISH_REPO}" \
   --arch "${BUILDSYS_ARCH}" \
   --variant "${BUILDSYS_VARIANT}" \
   \
   --root-role-path "${PUBLISH_REPO_ROOT_JSON}" \
   --expiration-limit "${REPO_METADATA_EXPIRING_WITHIN}"
'''
]

[tasks.refresh-repo]
dependencies = ["publish-setup", "publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

if [ "${REPO_UNSAFE_REFRESH}" = "true" ]; then
   REPO_UNSAFE_REFRESH_ARG="--unsafe-refresh"
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   refresh-repo \
   \
   --repo "${PUBLISH_REPO}" \
   --arch "${BUILDSYS_ARCH}" \
   --variant "${BUILDSYS_VARIANT}" \
   \
   --root-role-path "${PUBLISH_REPO_ROOT_JSON}" \
   --default-key-path "${PUBLISH_REPO_KEY}" \
   --repo-expiration-policy-path "${PUBLISH_EXPIRATION_POLICY_PATH}" \
   ${REPO_UNSAFE_REFRESH_ARG} \
   --outdir "${PUBLISH_REPO_OUTPUT_DIR}"
'''
]

[tasks.ami]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the image files below to save time.
# This does mean that `cargo make` must be run before `cargo make ami`.
dependencies = ["setup-build", "publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

cleanup() {
   ([ -f "${root_image}" ] && rm -f "${root_image}") ||:
   ([ -f "${data_image}" ] && rm -f "${data_image}") ||:
}
trap 'cleanup' EXIT

# Unlz4 the root image, and the data image if present
rootlz4="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}.img.lz4"
root_image="${rootlz4%.lz4}"
if [ ! -s "${rootlz4}" ]; then
   echo "Image file doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make'" >&2
   exit 1
fi
lz4 -df "${rootlz4}" "${root_image}"

datalz4="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-data.img.lz4"
data_image="${datalz4%.lz4}"

# We will only have a data image if the variant uses the "split" format.
is_split="no"
if [ -s "${datalz4}" ] ; then
   lz4 -df "${datalz4}" "${data_image}"
   is_split="yes"
fi

bytes_in_gib="$((1024 * 1024 * 1024))"
root_image_size_gib="$(($(stat -c %s "${root_image}") / bytes_in_gib))"
if [ "${is_split}" == "yes" ] ; then
   # If an optional root volume size is given, it must be larger than the root image.
   if [ -n "${PUBLISH_ROOT_VOLUME_SIZE}" ] && [ "${PUBLISH_ROOT_VOLUME_SIZE}" -lt "${root_image_size_gib}" ] ; then
      echo "Root image is larger than the given volume size - pass '-e PUBLISH_ROOT_VOLUME_SIZE=${root_image_size_gib}' to fix" >&2
      exit 1
   fi
   data_image_size_gib="$(($(stat -c %s "${data_image}") / bytes_in_gib))"
   if [ "${PUBLISH_DATA_VOLUME_SIZE}" -lt "${data_image_size_gib}" ] ; then
      echo "Data image is larger than the given volume size - pass '-e PUBLISH_DATA_VOLUME_SIZE=${data_image_size_gib}' to fix" >&2
      exit 1
   fi
else # unified
   if [ "${PUBLISH_UNIFIED_VOLUME_SIZE}" -lt "${root_image_size_gib}" ] ; then
      echo "Unified image is larger than the given volume size - pass '-e PUBLISH_UNIFIED_VOLUME_SIZE=${root_image_size_gib}' to fix" >&2
      exit 1
   fi
fi

root_volume_args=(--root-image "${root_image}")
data_volume_args=()
if [ "${is_split}" == "yes" ] ; then
   # Pass the root volume size if specified, otherwise it defaults to the size of the image.
   root_volume_args+=(${PUBLISH_ROOT_VOLUME_SIZE:+--root-volume-size "${PUBLISH_ROOT_VOLUME_SIZE}"})
   # Pass the data image to register as a snapshot, and its desired size.
   data_volume_args+=(--data-image "${data_image}" --data-volume-size "${PUBLISH_DATA_VOLUME_SIZE}")
else # unified
   root_volume_args+=(--root-volume-size "${PUBLISH_UNIFIED_VOLUME_SIZE}")
fi

ami_output="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-${AMI_DATA_FILE_SUFFIX}"
ami_output_latest="${BUILDSYS_OUTPUT_DIR}/latest/${BUILDSYS_NAME_VARIANT}-${AMI_DATA_FILE_SUFFIX}"

ami_name="${PUBLISH_AMI_NAME:-${PUBLISH_AMI_NAME_DEFAULT}}"

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   ami \
   \
   "${root_volume_args[@]}" \
   "${data_volume_args[@]}" \
   \
   --arch "${BUILDSYS_ARCH}" \
   --name "${ami_name}" \
   --description "${PUBLISH_AMI_DESCRIPTION:-${ami_name}}" \
   \
   --ami-output "${ami_output}" \
   \
   ${NO_PROGRESS:+--no-progress} \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"}

ln -snf "../${ami_output##*/}" "${ami_output_latest}"
'''
]

[tasks.ami-public]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the input file below to save time.
# This does mean that `cargo make ami` must be run before `cargo make ami-public`.
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

ami_input="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-${AMI_DATA_FILE_SUFFIX}"
if [ ! -s "${ami_input}" ]; then
   echo "AMI input file doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make ami'" >&2
   exit 1
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   publish-ami \
   --grant \
   --group-names all \
   \
   --ami-input "${ami_input}" \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"}
'''
]

[tasks.ami-private]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the input file below to save time.
# This does mean that `cargo make ami` must be run before `cargo make ami-private`.
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

ami_input="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-${AMI_DATA_FILE_SUFFIX}"
if [ ! -s "${ami_input}" ]; then
   echo "AMI input file doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make ami'" >&2
   exit 1
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   publish-ami \
   --revoke \
   --group-names all \
   \
   --ami-input "${ami_input}" \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"}
'''
]

[tasks.grant-ami]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the input file below to save time.
# This does mean that `cargo make ami` must be run before `cargo make grant-ami`.
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

if [ -z "${GRANT_TO_USERS}" ] && [ -z "${GRANT_TO_GROUPS}" ]; then
   echo "GRANT_TO_USERS and/or GRANT_TO_GROUPS is mandatory for grant-ami; please give a comma-separated list of user IDs or group names" >&2
   exit 1
fi

ami_input="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-${AMI_DATA_FILE_SUFFIX}"
if [ ! -s "${ami_input}" ]; then
   echo "AMI input file doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make ami'" >&2
   exit 1
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   publish-ami \
   --grant \
   ${GRANT_TO_USERS:+--user-ids "${GRANT_TO_USERS}"} \
   ${GRANT_TO_GROUPS:+--group-names "${GRANT_TO_GROUPS}"} \
   \
   --ami-input "${ami_input}" \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"}
'''
]

[tasks.revoke-ami]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the input file below to save time.
# This does mean that `cargo make ami` must be run before `cargo make revoke-ami`.
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

if [ -z "${REVOKE_FROM_USERS}" ] && [ -z "${REVOKE_FROM_GROUPS}" ]; then
   echo "REVOKE_FROM_USERS and/or REVOKE_FROM_GROUPS is mandatory for revoke-ami; please give a comma-separated list of user IDs or group names" >&2
   exit 1
fi

ami_input="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-${AMI_DATA_FILE_SUFFIX}"
if [ ! -s "${ami_input}" ]; then
   echo "AMI input file doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make ami'" >&2
   exit 1
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   publish-ami \
   --revoke \
   ${REVOKE_FROM_USERS:+--user-ids "${REVOKE_FROM_USERS}"} \
   ${REVOKE_FROM_GROUPS:+--group-names "${REVOKE_FROM_GROUPS}"} \
   \
   --ami-input "${ami_input}" \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"}
'''
]

[tasks.ssm]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the input file below to save time.
# This does mean that `cargo make ami` must be run before `cargo make ssm`.
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

ami_input="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-${AMI_DATA_FILE_SUFFIX}"
if [ ! -s "${ami_input}" ]; then
   echo "AMI input file doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make ami'" >&2
   exit 1
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   ssm \
   \
   --ami-input "${ami_input}" \
   --arch "${BUILDSYS_ARCH}" \
   --variant "${BUILDSYS_VARIANT}" \
   --version "${BUILDSYS_VERSION_FULL}" \
   --template-path "${PUBLISH_SSM_TEMPLATES_PATH}" \
   \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"} \
   ${ALLOW_CLOBBER:+--allow-clobber}
'''
]

[tasks.promote-ssm]
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

source="${SSM_SOURCE:-${BUILDSYS_VERSION_FULL}}"
target="${SSM_TARGET}"
if [ -z "${target}" ]; then
   echo "SSM_TARGET is mandatory for promote-ssm; please give the version (or pointer like "latest") to which you want to promote ${source}" >&2
   exit 1
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   promote-ssm \
   \
   --arch "${BUILDSYS_ARCH}" \
   --variant "${BUILDSYS_VARIANT}" \
   --source "${source}" \
   --target "${target}" \
   --template-path "${PUBLISH_SSM_TEMPLATES_PATH}" \
   \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"}
'''
]

[tasks._upload-ova-base]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the image files below to save time.
# This does mean that `cargo make` must be run before
# `cargo make _upload-ova-base`.
dependencies = ["setup-build", "publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

ova_path="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}.ova"
if [ ! -s "${ova_path}" ]; then
   echo "An OVA doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make'" >&2
   exit 1
fi

vm_name="${VMWARE_VM_NAME:-${VMWARE_VM_NAME_DEFAULT}}"

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   upload-ova \
   \
   --ova "${ova_path}" \
   --spec "${VMWARE_IMPORT_SPEC_PATH}" \
   --name "${vm_name}" \
   \
   ${MARK_OVA_AS_TEMPLATE:+--mark-as-template} \
   \
   ${VMWARE_DATACENTERS:+--datacenters "${VMWARE_DATACENTERS}"}
'''
]

# This task runs `_upload-ova-base` which will upload the OVA and *not* mark it
# as a template
[tasks.upload-ova]
script_runner = "bash"
extend = "_upload-ova-base"

# This task runs `_upload-ova-base` with the environment variable
# `MARK_OVA_AS_TEMPLATE` set, which will upload the OVA *and* mark it as a
# template
[tasks.vmware-template]
script_runner = "bash"
env = { "MARK_OVA_AS_TEMPLATE" = "true" }
extend = "_upload-ova-base"

[tasks.clean]
dependencies = [
  "clean-sources",
  "clean-packages",
  "clean-images",
  "clean-repos",
  "clean-state",
]

[tasks.clean-sources]
script_runner = "bash"
script = [
'''
for ws in sources variants/* tools/{buildsys,pubsys}; do
  [ -d "${ws}" ] || continue
  [ "${ws}" == "variants/shared" ] && continue
  cargo clean --manifest-path ${ws}/Cargo.toml
done
rm -f ${BUILDSYS_TOOLS_DIR}/bin/{buildsys,pubsys}
'''
]

[tasks.clean-packages]
script_runner = "bash"
script = [
'''
for ws in variants; do
  [ -d "${ws}" ] || continue
  cargo clean --manifest-path ${ws}/Cargo.toml
done
rm -rf ${BUILDSYS_PACKAGES_DIR}
'''
]

[tasks.clean-images]
script_runner = "bash"
script = [
'''
rm -rf ${BUILDSYS_IMAGES_DIR}
'''
]

[tasks.clean-repos]
script_runner = "bash"
script = [
'''
rm -rf ${PUBLISH_REPO_BASE_DIR}
'''
]

[tasks.clean-state]
script_runner = "bash"
script = [
'''
rm -rf ${BUILDSYS_STATE_DIR}
'''
]

[tasks.default]
alias = "build"