22set -x
33mkdir -p /root/AzureCACertificates
44
5- # For Flatcar: systemd timer instead of cron, skip cloud-init/apt ops, chronyd service name).
65IS_FLATCAR=0
7- if [ -f /etc/os-release ] && grep -qi ' ^ID=flatcar' /etc/os-release; then
8- IS_FLATCAR=1
6+ IS_UBUNTU=0
7+ # shellcheck disable=SC3010
8+ if [[ -f /etc/os-release ]]; then
9+ . /etc/os-release
10+ # shellcheck disable=SC3010
11+ if [[ $NAME == * " Ubuntu" * ]]; then
12+ IS_UBUNTU=1
13+ elif [[ $ID == * " flatcar" * ]]; then
14+ IS_FLATCAR=1
15+ else
16+ echo " Unknown Linux distribution"
17+ exit 1
18+ fi
19+ else
20+ echo " Unsupported operating system"
21+ exit 1
922fi
1023
24+ echo " distribution is $distribution "
25+ echo " Running on $NAME "
26+
1127# http://168.63.129.16 is a constant for the host's wireserver endpoint
1228certs=$( curl " http://168.63.129.16/machine?comp=acmspackage&type=cacertificates&ext=json" )
1329IFS_backup=$IFS
@@ -41,13 +57,159 @@ if [ "$action" = "ca-refresh" ]; then
4157 exit
4258fi
4359
44- if [ " $IS_FLATCAR " -eq 0 ]; then
60+ function init_ubuntu_main_repo_depot {
61+ local repodepot_endpoint=" $1 "
62+ # Initialize directory for keys
63+ mkdir -p /etc/apt/keyrings
64+
65+ # This copies the updated bundle to the location used by OpenSSL which is commonly used
66+ echo " Copying updated bundle to OpenSSL .pem file..."
67+ cp /etc/ssl/certs/ca-certificates.crt /usr/lib/ssl/cert.pem
68+ echo " Updated bundle copied."
69+
70+ # Back up sources.list and sources.list.d contents
71+ mkdir -p /etc/apt/backup/
72+ if [ -f " /etc/apt/sources.list" ]; then
73+ mv /etc/apt/sources.list /etc/apt/backup/
74+ fi
75+ for sources_file in /etc/apt/sources.list.d/* ; do
76+ if [ -f " $sources_file " ]; then
77+ mv " $sources_file " /etc/apt/backup/
78+ fi
79+ done
80+
81+ # Set location of sources file
82+ . /etc/os-release
83+ aptSourceFile=" /etc/apt/sources.list.d/ubuntu.sources"
84+
85+ # Create main sources file
86+ cat << EOF > /etc/apt/sources.list.d/ubuntu.sources
87+
88+ Types: deb
89+ URIs: ${repodepot_endpoint} /ubuntu
90+ Suites: ${VERSION_CODENAME} ${VERSION_CODENAME} -updates ${VERSION_CODENAME} -backports ${VERSION_CODENAME} -security
91+ Components: main universe restricted multiverse
92+ Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
93+ EOF
94+
95+ # Update the apt sources file using the RepoDepot Ubuntu URL for this cloud. Update it by replacing
96+ # all urls with the RepoDepot Ubuntu url
97+ ubuntuUrl=${repodepot_endpoint} /ubuntu
98+ echo " Converting URLs in $aptSourceFile to RepoDepot URLs..."
99+ sed -i " s,https\?://.[^ ]*,$ubuntuUrl ,g" $aptSourceFile
100+ echo " apt source URLs converted, see new file below:"
101+ echo " "
102+ echo " -----"
103+ cat $aptSourceFile
104+ echo " -----"
105+ echo " "
106+ }
107+
108+ function check_url {
109+ local url=$1
110+ echo " Checking url: $url "
111+
112+ # Use curl to check the URL and capture both stdout and stderr
113+ curl_exit_code=$( curl -s --head --request GET $url )
114+ # Check the exit status of curl
115+ # shellcheck disable=SC3010
116+ if [[ $? -ne 0 ]] || echo " $curl_exit_code " | grep -E " 404 Not Found" > /dev/null; then
117+ echo " ERROR: $url is not available. Please manually check if the url is valid before re-running script"
118+ exit 1
119+ fi
120+ }
121+
122+ function write_to_sources_file {
123+ local sources_list_d_file=$1
124+ local source_uri=$2
125+ shift 2
126+ local key_paths=(" $@ " )
127+
128+ sources_file_path=" /etc/apt/sources.list.d/${sources_list_d_file} .sources"
129+ ubuntuDist=$( lsb_release -c | awk ' {print $2}' )
130+
131+ tee -a $sources_file_path << EOF
132+
133+ Types: deb
134+ URIs: $source_uri
135+ Suites: $ubuntuDist
136+ Components: main
137+ Arch: amd64
138+ Signed-By: ${key_paths[*]}
139+ EOF
140+ }
141+
142+ function add_key_ubuntu {
143+ local key_name=$1
144+
145+ key_url=" ${repodepot_endpoint} /keys/${key_name} "
146+ check_url $key_url
147+ echo " Adding $key_name key to keyring..."
148+ key_data=$( wget -O - $key_url )
149+ key_path=$( derive_key_paths $key_name )
150+ echo " $key_data " | gpg --dearmor | tee $key_path > /dev/null
151+ echo " $key_name key added to keyring."
152+ }
153+
154+ function derive_key_paths {
155+ local key_names=(" $@ " )
156+ local key_paths=()
157+
158+ for key_name in " ${key_names[@]} " ; do
159+ key_paths+=(" /etc/apt/keyrings/${key_name} .gpg" )
160+ done
161+
162+ echo " ${key_paths[*]} "
163+ }
164+
165+ function add_ms_keys {
166+ # Add the Microsoft package server keys to keyring.
167+ echo " Adding Microsoft keys to keyring..."
168+
169+ add_key_ubuntu microsoft.asc
170+ add_key_ubuntu msopentech.asc
171+ }
172+
173+ function aptget_update {
174+ echo " apt-get updating..."
175+ echo " note: depending on how many sources have been added this may take a couple minutes..."
176+ if apt-get update | grep -q " 404 Not Found" ; then
177+ echo " ERROR: apt-get update failed to find all sources. Please validate the sources or remove bad sources from your sources and try again."
178+ exit 1
179+ else
180+ echo " apt-get update complete!"
181+ fi
182+ }
183+
184+ function init_ubuntu_pmc_repo_depot {
185+ local repodepot_endpoint=" $1 "
186+ # Add Microsoft packages source to the azure specific sources.list.
187+ echo " Adding the packages.microsoft.com Ubuntu-$ubuntuRel repo..."
188+
189+ microsoftPackageSource=" $repodepot_endpoint /microsoft/ubuntu/$ubuntuRel /prod"
190+ check_url $microsoftPackageSource
191+ write_to_sources_file microsoft-prod $microsoftPackageSource $( derive_key_paths microsoft.asc msopentech.asc)
192+ write_to_sources_file microsoft-prod-testing $microsoftPackageSource $( derive_key_paths microsoft.asc msopentech.asc)
193+ echo " Ubuntu ($ubuntuRel ) repo added."
194+ echo " Adding packages.microsoft.com keys"
195+ add_ms_keys $repodepot_endpoint
196+ }
197+
198+ if [ " $IS_UBUNTU " -eq 1 ]; then
45199 (crontab -l ; echo " 0 19 * * * $0 ca-refresh" ) | crontab -
46200
47201 cloud-init status --wait
48- repoDepotEndpoint=" ${REPO_DEPOT_ENDPOINT} "
49- sudo sed -i " s,http://.[^ ]*,$repoDepotEndpoint ,g" /etc/apt/sources.list
50- else
202+ rootRepoDepotEndpoint=" $( echo " ${REPO_DEPOT_ENDPOINT} " | sed ' s/\/ubuntu//' ) "
203+ # logic taken from https://repodepot.azure.com/scripts/cloud-init/setup_repodepot.sh
204+ ubuntuRel=$( lsb_release --release | awk ' {print $2}' )
205+ ubuntuDist=$( lsb_release -c | awk ' {print $2}' )
206+ # initialize archive.ubuntu.com repo
207+ init_ubuntu_main_repo_depot ${rootRepoDepotEndpoint}
208+ init_ubuntu_pmc_repo_depot ${rootRepoDepotEndpoint}
209+ # update apt list
210+ echo " Running apt-get update"
211+ aptget_update
212+ elif [ " $IS_FLATCAR " -eq 1 ]; then
51213 script_path=" $( readlink -f " $0 " ) "
52214 svc=" /etc/systemd/system/azure-ca-refresh.service"
53215 tmr=" /etc/systemd/system/azure-ca-refresh.timer"
79241
80242# Disable systemd-timesyncd and install chrony and uses local time source
81243chrony_conf=" /etc/chrony/chrony.conf"
82- if [ " $IS_FLATCAR " -eq 0 ]; then
244+ if [ " $IS_UBUNTU " -eq 1 ]; then
83245 systemctl stop systemd-timesyncd
84246 systemctl disable systemd-timesyncd
85247
86248 if [ ! -e " $chrony_conf " ]; then
87249 apt-get update
88250 apt-get install chrony -y
89251 fi
90- else
252+ elif [ " $IS_FLATCAR " -eq 1 ] ; then
91253 rm -f ${chrony_conf}
92254fi
93255
@@ -139,10 +301,10 @@ refclock PHC /dev/ptp0 poll 3 dpoll -2 offset 0
139301makestep 1.0 -1
140302EOF
141303
142- if [ " $IS_FLATCAR " -eq 0 ]; then
304+ if [ " $IS_UBUNTU " -eq 1 ]; then
143305 systemctl restart chrony
144- else
306+ elif [ " $IS_FLATCAR " -eq 1 ] ; then
145307 systemctl restart chronyd
146308fi
147309
148- # EOF
310+ # EOF
0 commit comments