rootfs: Fail in case attestation-agent fails to build

Today I learned, I must say.

When running a basic script, such as:
```bash
 #/usr/bin/env bash

 set -o errexit
 set -o pipefail
 set -o errtrace

 cat junk && echo "hello"
 echo "didn't fail"

 cat junk
 echo "hello"
 echo "didn't fail"
```

One will get as a result:
```bash
cat: junk: No such file or directory
didn't fail
cat: junk: No such file or directory
```

Meaning that although there was an error on `cat junk && echo "hello"`,
and the `echo "hello"` part was not executed, an error was not reported
for that failure.

On the second part, though, it just breaks and returns an error as
expected.

Small scripts aside, this is exactly what was happening with the
attestation-agent, where a `make ... && make install ...` was being
called, make was failing but not actually breaking the script.

Let's change the logic and avoid such situations in the future, as it
caused our CI to be broken for quite some time without a simple way to
detect that line in the huge amount of logs left behind.

Here goes a reference to the documentation:
```
-e      Exit immediately if a pipeline (which may consist
        of a single simple command), a list, or a compound
        command (see SHELL GRAMMAR above), exits with a
        non-zero status.  The shell does not exit if the
        command that fails is part of the command list
        immediately following a while or until keyword,
        part of the test following the if or elif reserved
        words, part of any command executed in a && or ||
        list except the command following the final && or
        ||, any command in a pipeline but the last, or if
        the command's return value is being inverted with
        !.  If a compound command other than a subshell
        returns a non-zero status because a command failed
        while -e was being ignored, the shell does not
        exit.  A trap on ERR, if set, is executed before
        the shell exits.  This option applies to the shell
        environment and each subshell environment
        separately (see COMMAND EXECUTION ENVIRONMENT
        above), and may cause subshells to exit before
        executing all the commands in the subshell.

        If a compound command or shell function executes
        in a context where -e is being ignored, none of
        the commands executed within the compound command
        or function body will be affected by the -e
        setting, even if -e is set and a command returns a
        failure status.  If a compound command or shell
        function sets -e while executing in a context
        where -e is ignored, that setting will not have
        any effect until the compound command or the
        command containing the function call completes.
```

This comes from https://www.man7.org/linux/man-pages/man1/bash.1.html

Fixes: #7793

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
This commit is contained in:
Fabiano Fidêncio 2023-08-30 17:10:48 +02:00
parent de1fe7bed0
commit badba8058c

View File

@ -689,7 +689,8 @@ EOF
git fetch --depth=1 origin "${attestation_agent_version}"
git checkout FETCH_HEAD
( [ "${AA_KBC}" == "eaa_kbc" ] || [ "${AA_KBC}" == "cc_kbc_tdx" ] ) && [ "${ARCH}" == "x86_64" ] && LIBC="gnu"
make KBC=${AA_KBC} ttrpc=true && make install DESTDIR="${ROOTFS_DIR}/usr/local/bin/"
make KBC=${AA_KBC} ttrpc=true
make install DESTDIR="${ROOTFS_DIR}/usr/local/bin/"
popd
fi