From 6dfaf9cc43198e7f0d0f87b7bcc1d78525662882 Mon Sep 17 00:00:00 2001
From: Zuhayr Elahi <zelahi@users.noreply.github.com>
Date: Mon, 21 Oct 2019 13:49:33 -0700
Subject: [PATCH 01/22] [TAR-1162][ce-nightly] Backport changes for adding
 verify script (#435)

* * Verification scripts for rpm
* Verification scripts for deb
* Integrated verify step in release-packaging Jenkinsfile

Signed-off-by: Zuhayr Elahi <elahi.zuhayr@gmail.com>

* Merge pull request #439 from seemethere/remove_f31

[ce-19.03] ci: Remove fedora 31 arm64

* Revert "Merge pull request #439 from seemethere/remove_f31"

This reverts commit 700e7a6b75938d96ab587b889077ec6a3dec9963, reversing
changes made to caa1930f1f60c52afccd1ff06882c6e7c2200440.

* [ce-19.03] ci: Re-add saveS3 (#437)

[ce-19.03] ci: Re-add saveS3
---
 install-containerd-helpers | 34 +++++++++++++++
 verify                     | 84 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 118 insertions(+)
 create mode 100644 install-containerd-helpers
 create mode 100755 verify

diff --git a/install-containerd-helpers b/install-containerd-helpers
new file mode 100644
index 0000000000..dd6ea9646e
--- /dev/null
+++ b/install-containerd-helpers
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+###
+# Script Name:  install-containerd-helpers
+#
+# Description: A library that containers helpers to install containerd on different
+#              distributions based on a package manager
+###
+set -x extglob
+
+# Steps taken from: https://docs.docker.com/install/linux/docker-ce/centos/
+function install_rpm_containerd() {
+    # Install containerd dependency for non-zypper dependecies
+    echo "[DEBUG] Installing engine dependencies"
+    ${pkg_config_manager} \
+    --add-repo \
+    https://download.docker.com/linux/centos/docker-ce.repo
+}
+
+# Steps taken from: https://docs.docker.com/install/linux/docker-ce/ubuntu/
+function install_debian_containerd() {
+    echo "[DEBUG] Installing containerd"
+    curl -fsSL https://download.docker.com/linux/${DIST_ID}/gpg | apt-key add -
+
+
+    if [[ ${DIST_VERSION}  == "sid" ]]; then
+        DIST_VERSION='buster'
+    fi
+    echo "deb [arch=${ARCH}] https://download.docker.com/linux/${DIST_ID} \
+        ${DIST_VERSION} \
+        stable" > /etc/apt/sources.list.d/docker.list
+
+    apt-get update
+}
\ No newline at end of file
diff --git a/verify b/verify
new file mode 100755
index 0000000000..fdee28e6f7
--- /dev/null
+++ b/verify
@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+
+###
+# Script Name:  verify
+#
+# Description: This runs a smoke test to verify that the packages can be installed corrected
+###
+
+# packaging/build/${DIST_ID}/${DIST_VERSION}/${ARCH} - location of all packages
+# Manually Testing: docker run --rm -it -v $(pwd):/v -w /v "centos:7" ./verify
+
+set -e
+
+source install-containerd-helpers
+
+function verify() {
+    if dpkg --version > /dev/null 2> /dev/null; then
+        verify_deb
+    elif rpm --version > /dev/null 2> /dev/null; then
+        verify_rpm
+    else
+        echo "[ERROR] Unable to determine base os:"
+        cat /etc/os-release
+        exit 1
+    fi
+}
+
+function verify_deb() {
+    apt-get update
+    apt-get -y install lsb-release software-properties-common curl apt-transport-https gnupg2
+
+    DIST_ID=$(source /etc/os-release; echo "$ID")
+    DIST_VERSION=$(lsb_release -sc)
+    ARCH=$(dpkg --print-architecture)
+
+    install_debian_containerd
+
+    packages=$(find "docker-ce/components/packaging/deb/debbuild/${DIST_ID}-${DIST_VERSION}/" -type f -name "*.deb")
+    # All local packages need to be prefixed with `./` or else apt-get doesn't understand where to pull from
+    packages=$(echo "${packages}" | awk '$0="./"$0' | xargs)
+
+    (
+        set -x
+        apt-get -y install --no-install-recommends ${packages}
+    )
+}
+
+function verify_rpm() {
+    DIST_ID=$(. /etc/os-release; echo "${ID}")
+    DIST_VERSION=$(. /etc/os-release; echo "${VERSION_ID}" | cut -d'.' -f1)
+    ARCH=$(uname -m)
+
+    pkg_manager="yum"
+    pkg_config_manager="yum-config-manager"
+    if dnf --version; then
+        pkg_manager="dnf"
+        pkg_config_manager="dnf config-manager"
+        dnf clean all && dnf upgrade -y
+        ${pkg_manager} install -y 'dnf-command(config-manager)'
+    fi
+
+    case ${DIST_ID}:${DIST_VERSION} in
+        ol:7*)
+            # Needed for container-selinux
+            yum-config-manager --enable ol7_addons
+            ;;
+        fedora*)
+            dnf install -y findutils
+    esac
+
+    install_rpm_containerd
+
+    # find all rpm packages, exclude src package
+    echo "[DEBUG] Installing engine rpms"
+    packages=$(find "docker-ce/components/packaging/rpm/rpmbuild/RPMS/" -type f -name "*.rpm" | sed '/src/d')
+
+    # install all non-source packages
+    (
+        set -x
+        ${pkg_manager} install -y ${packages}
+    )
+}
+
+verify

From 5c12ba8d7a06a2bfac69c95d579bc4cff374db8f Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Fri, 20 Dec 2019 14:31:34 +0100
Subject: [PATCH 02/22] Fix verify to not depend on download.docker.com

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 3880335d06a5960bc5754d4dc9c5c796ae06885b)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 verify | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/verify b/verify
index fdee28e6f7..5eef85a157 100755
--- a/verify
+++ b/verify
@@ -41,7 +41,8 @@ function verify_deb() {
 
     (
         set -x
-        apt-get -y install --no-install-recommends ${packages}
+        dpkg --ignore-depends=containerd.io,iptables,libdevmapper,libdevmapper1.02.1  -i ${packages}
+        apt-get install -y -f
     )
 }
 

From 8dac84e9ecc4c3337e1defd030e02659a0edc2e0 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Mon, 23 Dec 2019 11:50:33 +0100
Subject: [PATCH 03/22] verify: use --force-depends to be more future proof

Use the --force-depends in case other dependencies are
added in future, which would make dpkg -i fail.

Also bring back --no-install-recommmends to make install
slightly faster, and document the steps we're doing in
this script:

    Install the locally built packages using 'dpkg' because installing with
    'apt-get' would attempt to install dependency packages (such as the CLI)
    from download.docker.com instead of the locally built CLI package. Given
    that 'dpkg -i' does not install any dependency (but will fail if depen-
    dencies are missing), we use the '--ignore-depends' option to ignore
    packages we know to be missing at this stage, and '--force-depends' to
    only warn about any other missing dependency.

    Afterwards, we run 'apt-get install' with the '--fix-broken' option to
    trigger installation of the dependencies, which should succceed succesfully.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 7da772e08ba12a09471650dc5b6d311c39470668)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 verify | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/verify b/verify
index 5eef85a157..0e3563694b 100755
--- a/verify
+++ b/verify
@@ -41,8 +41,21 @@ function verify_deb() {
 
     (
         set -x
-        dpkg --ignore-depends=containerd.io,iptables,libdevmapper,libdevmapper1.02.1  -i ${packages}
-        apt-get install -y -f
+        # Install the locally built packages using 'dpkg' because installing with
+        # 'apt-get' would attempt to install dependency packages (such as the CLI)
+        # from download.docker.com instead of the locally built CLI package. Given
+        # that 'dpkg -i' does not install any dependency (but will fail if depen-
+        # dencies are missing), we use the '--ignore-depends' option to ignore
+        # packages we know to be missing at this stage, and '--force-depends' to
+        # only warn about any other missing dependency.
+        #
+        # Afterwards, we run 'apt-get install' with the '--fix-broken' option to
+        # trigger installation of the dependencies, which should succceed succesfully.
+        dpkg \
+            --ignore-depends=containerd.io,iptables,libdevmapper,libdevmapper1.02.1 \
+            --force-depends \
+            -i ${packages}
+        apt-get -y install --no-install-recommends --fix-broken ${packages}
     )
 }
 

From 72fe7e112facf5cf453085fa16a9153267bdc077 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Thu, 20 Feb 2020 12:54:40 +0100
Subject: [PATCH 04/22] install-containerd-helpers: use tabs for indentation

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 install-containerd-helpers | 29 +++++++++++++----------------
 1 file changed, 13 insertions(+), 16 deletions(-)

diff --git a/install-containerd-helpers b/install-containerd-helpers
index dd6ea9646e..9cfd5a9a6b 100644
--- a/install-containerd-helpers
+++ b/install-containerd-helpers
@@ -10,25 +10,22 @@ set -x extglob
 
 # Steps taken from: https://docs.docker.com/install/linux/docker-ce/centos/
 function install_rpm_containerd() {
-    # Install containerd dependency for non-zypper dependecies
-    echo "[DEBUG] Installing engine dependencies"
-    ${pkg_config_manager} \
-    --add-repo \
-    https://download.docker.com/linux/centos/docker-ce.repo
+	# Install containerd dependency for non-zypper dependecies
+	echo "[DEBUG] Installing engine dependencies"
+	${pkg_config_manager} \
+		--add-repo \
+		https://download.docker.com/linux/centos/docker-ce.repo
 }
 
 # Steps taken from: https://docs.docker.com/install/linux/docker-ce/ubuntu/
 function install_debian_containerd() {
-    echo "[DEBUG] Installing containerd"
-    curl -fsSL https://download.docker.com/linux/${DIST_ID}/gpg | apt-key add -
+	echo "[DEBUG] Installing containerd"
+	curl -fsSL https://download.docker.com/linux/${DIST_ID}/gpg | apt-key add -
 
+	if [[ ${DIST_VERSION} == "sid" ]]; then
+		DIST_VERSION='buster'
+	fi
+	echo "deb [arch=${ARCH}] https://download.docker.com/linux/${DIST_ID} ${DIST_VERSION} stable" >/etc/apt/sources.list.d/docker.list
 
-    if [[ ${DIST_VERSION}  == "sid" ]]; then
-        DIST_VERSION='buster'
-    fi
-    echo "deb [arch=${ARCH}] https://download.docker.com/linux/${DIST_ID} \
-        ${DIST_VERSION} \
-        stable" > /etc/apt/sources.list.d/docker.list
-
-    apt-get update
-}
\ No newline at end of file
+	apt-get update
+}

From 849e2db93d0ebcede47823aea1dda235b4f6f094 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Thu, 20 Feb 2020 12:55:02 +0100
Subject: [PATCH 05/22] verify: use tabs for indentation

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 verify | 152 ++++++++++++++++++++++++++++++---------------------------
 1 file changed, 79 insertions(+), 73 deletions(-)

diff --git a/verify b/verify
index 0e3563694b..0cf7daab6b 100755
--- a/verify
+++ b/verify
@@ -14,85 +14,91 @@ set -e
 source install-containerd-helpers
 
 function verify() {
-    if dpkg --version > /dev/null 2> /dev/null; then
-        verify_deb
-    elif rpm --version > /dev/null 2> /dev/null; then
-        verify_rpm
-    else
-        echo "[ERROR] Unable to determine base os:"
-        cat /etc/os-release
-        exit 1
-    fi
+	if dpkg --version >/dev/null 2>/dev/null; then
+		verify_deb
+	elif rpm --version >/dev/null 2>/dev/null; then
+		verify_rpm
+	else
+		echo "[ERROR] Unable to determine base os:"
+		cat /etc/os-release
+		exit 1
+	fi
 }
 
 function verify_deb() {
-    apt-get update
-    apt-get -y install lsb-release software-properties-common curl apt-transport-https gnupg2
-
-    DIST_ID=$(source /etc/os-release; echo "$ID")
-    DIST_VERSION=$(lsb_release -sc)
-    ARCH=$(dpkg --print-architecture)
-
-    install_debian_containerd
-
-    packages=$(find "docker-ce/components/packaging/deb/debbuild/${DIST_ID}-${DIST_VERSION}/" -type f -name "*.deb")
-    # All local packages need to be prefixed with `./` or else apt-get doesn't understand where to pull from
-    packages=$(echo "${packages}" | awk '$0="./"$0' | xargs)
-
-    (
-        set -x
-        # Install the locally built packages using 'dpkg' because installing with
-        # 'apt-get' would attempt to install dependency packages (such as the CLI)
-        # from download.docker.com instead of the locally built CLI package. Given
-        # that 'dpkg -i' does not install any dependency (but will fail if depen-
-        # dencies are missing), we use the '--ignore-depends' option to ignore
-        # packages we know to be missing at this stage, and '--force-depends' to
-        # only warn about any other missing dependency.
-        #
-        # Afterwards, we run 'apt-get install' with the '--fix-broken' option to
-        # trigger installation of the dependencies, which should succceed succesfully.
-        dpkg \
-            --ignore-depends=containerd.io,iptables,libdevmapper,libdevmapper1.02.1 \
-            --force-depends \
-            -i ${packages}
-        apt-get -y install --no-install-recommends --fix-broken ${packages}
-    )
+	apt-get update
+	apt-get -y install \
+		apt-transport-https \
+		curl \
+		gnupg2 \
+		lsb-release \
+		software-properties-common
+
+	DIST_ID=$(source /etc/os-release; echo "$ID")
+	DIST_VERSION=$(lsb_release -sc)
+	ARCH=$(dpkg --print-architecture)
+
+	install_debian_containerd
+
+	packages=$(find "docker-ce/components/packaging/deb/debbuild/${DIST_ID}-${DIST_VERSION}/" -type f -name "*.deb")
+	# All local packages need to be prefixed with `./` or else apt-get doesn't understand where to pull from
+	packages=$(echo "${packages}" | awk '$0="./"$0' | xargs)
+
+	(
+		set -x
+		# Install the locally built packages using 'dpkg' because installing with
+		# 'apt-get' would attempt to install dependency packages (such as the CLI)
+		# from download.docker.com instead of the locally built CLI package. Given
+		# that 'dpkg -i' does not install any dependency (but will fail if depen-
+		# dencies are missing), we use the '--ignore-depends' option to ignore
+		# packages we know to be missing at this stage, and '--force-depends' to
+		# only warn about any other missing dependency.
+		#
+		# Afterwards, we run 'apt-get install' with the '--fix-broken' option to
+		# trigger installation of the dependencies, which should succceed succesfully.
+		dpkg \
+			--ignore-depends=containerd.io,iptables,libdevmapper,libdevmapper1.02.1 \
+			--force-depends \
+			-i ${packages}
+		apt-get -y install --no-install-recommends --fix-broken ${packages}
+	)
 }
 
 function verify_rpm() {
-    DIST_ID=$(. /etc/os-release; echo "${ID}")
-    DIST_VERSION=$(. /etc/os-release; echo "${VERSION_ID}" | cut -d'.' -f1)
-    ARCH=$(uname -m)
-
-    pkg_manager="yum"
-    pkg_config_manager="yum-config-manager"
-    if dnf --version; then
-        pkg_manager="dnf"
-        pkg_config_manager="dnf config-manager"
-        dnf clean all && dnf upgrade -y
-        ${pkg_manager} install -y 'dnf-command(config-manager)'
-    fi
-
-    case ${DIST_ID}:${DIST_VERSION} in
-        ol:7*)
-            # Needed for container-selinux
-            yum-config-manager --enable ol7_addons
-            ;;
-        fedora*)
-            dnf install -y findutils
-    esac
-
-    install_rpm_containerd
-
-    # find all rpm packages, exclude src package
-    echo "[DEBUG] Installing engine rpms"
-    packages=$(find "docker-ce/components/packaging/rpm/rpmbuild/RPMS/" -type f -name "*.rpm" | sed '/src/d')
-
-    # install all non-source packages
-    (
-        set -x
-        ${pkg_manager} install -y ${packages}
-    )
+	DIST_ID=$(. /etc/os-release; echo "${ID}")
+	DIST_VERSION=$(. /etc/os-release; echo "${VERSION_ID}" | cut -d'.' -f1)
+	ARCH=$(uname -m)
+
+	pkg_manager="yum"
+	pkg_config_manager="yum-config-manager"
+	if dnf --version; then
+		pkg_manager="dnf"
+		pkg_config_manager="dnf config-manager"
+		dnf clean all && dnf upgrade -y
+		${pkg_manager} install -y 'dnf-command(config-manager)'
+	fi
+
+	case ${DIST_ID}:${DIST_VERSION} in
+	ol:7*)
+		# Needed for container-selinux
+		yum-config-manager --enable ol7_addons
+		;;
+	fedora*)
+		dnf install -y findutils
+		;;
+	esac
+
+	install_rpm_containerd
+
+	# find all rpm packages, exclude src package
+	echo "[DEBUG] Installing engine rpms"
+	packages=$(find "docker-ce/components/packaging/rpm/rpmbuild/RPMS/" -type f -name "*.rpm" | sed '/src/d')
+
+	# install all non-source packages
+	(
+		set -x
+		${pkg_manager} install -y ${packages}
+	)
 }
 
 verify

From 533897891bf4199d21f0be93e8f412a579169109 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Thu, 20 Feb 2020 13:05:26 +0100
Subject: [PATCH 06/22] fix some linting warnings

Move the `ARCH` variable to the containerd script, as that's where it's
used

use the `pkg_config_manager` variable, which is not strictly nescessary
(main use of the variable looks to be for `install_rpm_containerd`),
but using the variable prevents linting warnings.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 install-containerd-helpers | 9 ++++++++-
 verify                     | 4 +---
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/install-containerd-helpers b/install-containerd-helpers
index 9cfd5a9a6b..8b79571f9b 100644
--- a/install-containerd-helpers
+++ b/install-containerd-helpers
@@ -12,6 +12,12 @@ set -x extglob
 function install_rpm_containerd() {
 	# Install containerd dependency for non-zypper dependecies
 	echo "[DEBUG] Installing engine dependencies"
+
+	pkg_config_manager="yum-config-manager"
+	if dnf --version; then
+		pkg_config_manager="dnf config-manager"
+	fi
+
 	${pkg_config_manager} \
 		--add-repo \
 		https://download.docker.com/linux/centos/docker-ce.repo
@@ -20,11 +26,12 @@ function install_rpm_containerd() {
 # Steps taken from: https://docs.docker.com/install/linux/docker-ce/ubuntu/
 function install_debian_containerd() {
 	echo "[DEBUG] Installing containerd"
-	curl -fsSL https://download.docker.com/linux/${DIST_ID}/gpg | apt-key add -
+	curl -fsSL "https://download.docker.com/linux/${DIST_ID}/gpg" | apt-key add -
 
 	if [[ ${DIST_VERSION} == "sid" ]]; then
 		DIST_VERSION='buster'
 	fi
+	ARCH=$(dpkg --print-architecture)
 	echo "deb [arch=${ARCH}] https://download.docker.com/linux/${DIST_ID} ${DIST_VERSION} stable" >/etc/apt/sources.list.d/docker.list
 
 	apt-get update
diff --git a/verify b/verify
index 0cf7daab6b..73d20ee7ec 100755
--- a/verify
+++ b/verify
@@ -36,7 +36,6 @@ function verify_deb() {
 
 	DIST_ID=$(source /etc/os-release; echo "$ID")
 	DIST_VERSION=$(lsb_release -sc)
-	ARCH=$(dpkg --print-architecture)
 
 	install_debian_containerd
 
@@ -67,7 +66,6 @@ function verify_deb() {
 function verify_rpm() {
 	DIST_ID=$(. /etc/os-release; echo "${ID}")
 	DIST_VERSION=$(. /etc/os-release; echo "${VERSION_ID}" | cut -d'.' -f1)
-	ARCH=$(uname -m)
 
 	pkg_manager="yum"
 	pkg_config_manager="yum-config-manager"
@@ -81,7 +79,7 @@ function verify_rpm() {
 	case ${DIST_ID}:${DIST_VERSION} in
 	ol:7*)
 		# Needed for container-selinux
-		yum-config-manager --enable ol7_addons
+		${pkg_config_manager} --enable ol7_addons
 		;;
 	fedora*)
 		dnf install -y findutils

From 68e8179685e799cf6f9bd3586f35585fc0beb356 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Thu, 20 Feb 2020 12:59:19 +0100
Subject: [PATCH 07/22] verify: install ca-certs, and use
 "--no-install-recommends"

ca-certs was not installed (or outdated) in the raspbian
images, so explicitly install it.

Also adding "--no-install-recommends" flag, to force explicitly
including packages we need, instead of the implicitly
being installed.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 verify | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/verify b/verify
index 73d20ee7ec..605467b195 100755
--- a/verify
+++ b/verify
@@ -27,8 +27,9 @@ function verify() {
 
 function verify_deb() {
 	apt-get update
-	apt-get -y install \
+	apt-get -y install --no-install-recommends \
 		apt-transport-https \
+		ca-certificates \
 		curl \
 		gnupg2 \
 		lsb-release \

From dfd278c8b3e7f7770a3873c12015b3cc24a75f3f Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Fri, 21 Feb 2020 13:11:39 +0100
Subject: [PATCH 08/22] install-containerd-helpers: make sure ca-certificates
 are up-to-date

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 install-containerd-helpers | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/install-containerd-helpers b/install-containerd-helpers
index 8b79571f9b..e00de86be9 100644
--- a/install-containerd-helpers
+++ b/install-containerd-helpers
@@ -26,6 +26,11 @@ function install_rpm_containerd() {
 # Steps taken from: https://docs.docker.com/install/linux/docker-ce/ubuntu/
 function install_debian_containerd() {
 	echo "[DEBUG] Installing containerd"
+
+	#TODO include this step in the get.docker.com installation script
+	# Make sure ca-certificates are up-to-date
+	update-ca-certificates -f
+
 	curl -fsSL "https://download.docker.com/linux/${DIST_ID}/gpg" | apt-key add -
 
 	if [[ ${DIST_VERSION} == "sid" ]]; then

From 24b21073aab1773972f7fbc2ebc204a78cde0dc7 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Mon, 24 Feb 2020 18:27:51 +0100
Subject: [PATCH 09/22] install-containerd-helpers: fix hard-coded repository
 for RPMs

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 install-containerd-helpers | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/install-containerd-helpers b/install-containerd-helpers
index e00de86be9..c1b9eab42b 100644
--- a/install-containerd-helpers
+++ b/install-containerd-helpers
@@ -20,7 +20,7 @@ function install_rpm_containerd() {
 
 	${pkg_config_manager} \
 		--add-repo \
-		https://download.docker.com/linux/centos/docker-ce.repo
+		"https://download.docker.com/linux/${DIST_ID}/docker-ce.repo"
 }
 
 # Steps taken from: https://docs.docker.com/install/linux/docker-ce/ubuntu/

From 6d241dc8cdbc369f19a8acef9816e1e38b620bbf Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Wed, 11 Mar 2020 10:27:22 +0100
Subject: [PATCH 10/22] Remove "components" subdirectory

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 verify | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/verify b/verify
index 605467b195..6659fc1f76 100755
--- a/verify
+++ b/verify
@@ -40,7 +40,7 @@ function verify_deb() {
 
 	install_debian_containerd
 
-	packages=$(find "docker-ce/components/packaging/deb/debbuild/${DIST_ID}-${DIST_VERSION}/" -type f -name "*.deb")
+	packages=$(find "docker-ce/packaging/deb/debbuild/${DIST_ID}-${DIST_VERSION}/" -type f -name "*.deb")
 	# All local packages need to be prefixed with `./` or else apt-get doesn't understand where to pull from
 	packages=$(echo "${packages}" | awk '$0="./"$0' | xargs)
 
@@ -91,7 +91,7 @@ function verify_rpm() {
 
 	# find all rpm packages, exclude src package
 	echo "[DEBUG] Installing engine rpms"
-	packages=$(find "docker-ce/components/packaging/rpm/rpmbuild/RPMS/" -type f -name "*.rpm" | sed '/src/d')
+	packages=$(find "docker-ce/packaging/rpm/rpmbuild/RPMS/" -type f -name "*.rpm" | sed '/src/d')
 
 	# install all non-source packages
 	(

From acd86124798600b033a2482f6110b42a25a9683a Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Thu, 14 May 2020 16:31:30 +0200
Subject: [PATCH 11/22] Verify: use "download-stage.docker.com" as default for
 deps

This allows running the verify step in situations where containerd.io
has not yet been pushed to the production package repo.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 install-containerd-helpers | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/install-containerd-helpers b/install-containerd-helpers
index c1b9eab42b..5c5479035b 100644
--- a/install-containerd-helpers
+++ b/install-containerd-helpers
@@ -10,34 +10,44 @@ set -x extglob
 
 # Steps taken from: https://docs.docker.com/install/linux/docker-ce/centos/
 function install_rpm_containerd() {
+	if [ "${PACKAGE_REPO}" = "stage" ]; then
+		REPO_URL="https://download-stage.docker.com/linux/${DIST_ID}/docker-ce-staging.repo"
+	else
+		REPO_URL="https://download.docker.com/linux/${DIST_ID}/docker-ce.repo"
+	fi
+
 	# Install containerd dependency for non-zypper dependecies
-	echo "[DEBUG] Installing engine dependencies"
+	echo "[DEBUG] Installing engine dependencies from ${REPO_URL}"
 
 	pkg_config_manager="yum-config-manager"
 	if dnf --version; then
 		pkg_config_manager="dnf config-manager"
 	fi
 
-	${pkg_config_manager} \
-		--add-repo \
-		"https://download.docker.com/linux/${DIST_ID}/docker-ce.repo"
+	${pkg_config_manager} --add-repo "${REPO_URL}"
 }
 
 # Steps taken from: https://docs.docker.com/install/linux/docker-ce/ubuntu/
 function install_debian_containerd() {
-	echo "[DEBUG] Installing containerd"
+	if [ "${PACKAGE_REPO}" = "stage" ]; then
+		REPO_URL="https://download-stage.docker.com/linux/${DIST_ID}"
+	else
+		REPO_URL="https://download.docker.com/linux/${DIST_ID}"
+	fi
+
+	echo "[DEBUG] Installing engine dependencies from ${REPO_URL}"
 
 	#TODO include this step in the get.docker.com installation script
 	# Make sure ca-certificates are up-to-date
 	update-ca-certificates -f
 
-	curl -fsSL "https://download.docker.com/linux/${DIST_ID}/gpg" | apt-key add -
+	curl -fsSL "${REPO_URL}/gpg" | apt-key add -
 
 	if [[ ${DIST_VERSION} == "sid" ]]; then
 		DIST_VERSION='buster'
 	fi
 	ARCH=$(dpkg --print-architecture)
-	echo "deb [arch=${ARCH}] https://download.docker.com/linux/${DIST_ID} ${DIST_VERSION} stable" >/etc/apt/sources.list.d/docker.list
+	echo "deb [arch=${ARCH}] ${REPO_URL} ${DIST_VERSION} stable" >/etc/apt/sources.list.d/docker.list
 
 	apt-get update
 }

From a3064417d64d84cc1be7b8b37da6ab1a6cdf2001 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Thu, 30 Jul 2020 17:27:10 +0200
Subject: [PATCH 12/22] Remove "docker-ce" prefix/sub-directory

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 verify | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/verify b/verify
index 6659fc1f76..d89dc1a747 100755
--- a/verify
+++ b/verify
@@ -40,7 +40,7 @@ function verify_deb() {
 
 	install_debian_containerd
 
-	packages=$(find "docker-ce/packaging/deb/debbuild/${DIST_ID}-${DIST_VERSION}/" -type f -name "*.deb")
+	packages=$(find "packaging/deb/debbuild/${DIST_ID}-${DIST_VERSION}/" -type f -name "*.deb")
 	# All local packages need to be prefixed with `./` or else apt-get doesn't understand where to pull from
 	packages=$(echo "${packages}" | awk '$0="./"$0' | xargs)
 
@@ -91,7 +91,7 @@ function verify_rpm() {
 
 	# find all rpm packages, exclude src package
 	echo "[DEBUG] Installing engine rpms"
-	packages=$(find "docker-ce/packaging/rpm/rpmbuild/RPMS/" -type f -name "*.rpm" | sed '/src/d')
+	packages=$(find "packaging/rpm/rpmbuild/RPMS/" -type f -name "*.rpm" | sed '/src/d')
 
 	# install all non-source packages
 	(

From c839f4e6ff0ee181471edb4384d8db07a67737c6 Mon Sep 17 00:00:00 2001
From: Tibor Vass <tibor@docker.com>
Date: Thu, 22 Oct 2020 21:06:11 +0000
Subject: [PATCH 13/22] Always use test channel when installing containerd

Signed-off-by: Tibor Vass <tibor@docker.com>
---
 install-containerd-helpers | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/install-containerd-helpers b/install-containerd-helpers
index 5c5479035b..d2a0d68e0b 100644
--- a/install-containerd-helpers
+++ b/install-containerd-helpers
@@ -19,12 +19,22 @@ function install_rpm_containerd() {
 	# Install containerd dependency for non-zypper dependecies
 	echo "[DEBUG] Installing engine dependencies from ${REPO_URL}"
 
-	pkg_config_manager="yum-config-manager"
+	# Note: we enable test channel to be able to test non-stable containerd packages as well.
+	# Once a containerd package becomes stable it will also be available in the test channel,
+	# so this logic works for both cases.
+	# (See also same logic in install_debian_containerd)
+
 	if dnf --version; then
-		pkg_config_manager="dnf config-manager"
+		dnf config-manager --add-repo "${REPO_URL}"
+		dnf config-manager --set-disabled docker-ce-*
+		dnf config-manager --set-enabled docker-ce-test
+		dnf makecache
+	else
+		yum-config-manager --add-repo "${REPO_URL}"
+		yum-config-manager --disable docker-ce-*
+		yum-config-manager --enable docker-ce-test
+		yum makecache
 	fi
-
-	${pkg_config_manager} --add-repo "${REPO_URL}"
 }
 
 # Steps taken from: https://docs.docker.com/install/linux/docker-ce/ubuntu/
@@ -47,7 +57,12 @@ function install_debian_containerd() {
 		DIST_VERSION='buster'
 	fi
 	ARCH=$(dpkg --print-architecture)
-	echo "deb [arch=${ARCH}] ${REPO_URL} ${DIST_VERSION} stable" >/etc/apt/sources.list.d/docker.list
+
+	# Note: we enable test channel to be able to test non-stable containerd packages as well.
+	# Once a containerd package becomes stable it will also be available in the test channel,
+	# so this logic works for both cases.
+	# (See also same logic in install_rpm_containerd)
+	echo "deb [arch=${ARCH}] ${REPO_URL} ${DIST_VERSION} test" > /etc/apt/sources.list.d/docker.list
 
 	apt-get update
 }

From 9d9ebb04b525308c2ba6cda2e0c75c652d6ddf10 Mon Sep 17 00:00:00 2001
From: Tibor Vass <tibor@docker.com>
Date: Tue, 30 Mar 2021 16:40:17 +0000
Subject: [PATCH 14/22] deb/rpm: reuse bundles targets from docker-ce-packaging

This is to avoid duplicate codepaths.
Note that this completes the move of the tar.gz logic from
release-packaging to docker-ce-packaging only for the deb/rpm cases.

Static Linux, Windows and Mac were not touched.

Also I still think this whole bundles tar.gz thing is useless,
but this is what release-repo is currently consuming.

This also makes rpms work, as the path structure changed in docker-ce-packaging
to include distro.

Signed-off-by: Tibor Vass <tibor@docker.com>
---
 verify | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/verify b/verify
index d89dc1a747..9b613ee7ae 100755
--- a/verify
+++ b/verify
@@ -91,7 +91,7 @@ function verify_rpm() {
 
 	# find all rpm packages, exclude src package
 	echo "[DEBUG] Installing engine rpms"
-	packages=$(find "packaging/rpm/rpmbuild/RPMS/" -type f -name "*.rpm" | sed '/src/d')
+	packages=$(find "packaging/rpm/rpmbuild/${DIST_ID}-${DIST_VERSION}/RPMS/" -type f -name "*.rpm" | sed '/src/d')
 
 	# install all non-source packages
 	(

From 70e213c757b823f2b1d5c4b4debb86167e4d7d7d Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Wed, 31 Mar 2021 15:07:22 +0200
Subject: [PATCH 15/22] verify: run --version on installed binaries

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 verify | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/verify b/verify
index 9b613ee7ae..896333c9e3 100755
--- a/verify
+++ b/verify
@@ -62,6 +62,13 @@ function verify_deb() {
 			-i ${packages}
 		apt-get -y install --no-install-recommends --fix-broken ${packages}
 	)
+	docker --version
+	if [ "$(uname -m)" = "x86_64" ]; then
+		docker scan --accept-license --version;
+	fi
+	dockerd --version
+	containerd --version
+	runc --version
 }
 
 function verify_rpm() {
@@ -98,6 +105,15 @@ function verify_rpm() {
 		set -x
 		${pkg_manager} install -y ${packages}
 	)
+
+	docker --version
+	if [ "$(uname -m)" = "x86_64" ]; then
+		docker scan --accept-license --version;
+	fi
+	dockerd --version
+	containerd --version
+	runc --version
+
 }
 
 verify

From 52cf182c3809a083137da344b499dd07f9834a63 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Wed, 31 Mar 2021 16:15:24 +0200
Subject: [PATCH 16/22] verify: temporarily disable docker scan --version

It tries to make a daemon connection, which fails in this case;

        docker scan --accept-license --version
        Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
        Makefile:193: recipe for target 'verify' failed

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 verify | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/verify b/verify
index 896333c9e3..4b4f4b3e06 100755
--- a/verify
+++ b/verify
@@ -63,9 +63,10 @@ function verify_deb() {
 		apt-get -y install --no-install-recommends --fix-broken ${packages}
 	)
 	docker --version
-	if [ "$(uname -m)" = "x86_64" ]; then
-		docker scan --accept-license --version;
-	fi
+	# FIXME this tries to connect to the docker daemon, which isn't started
+	#if [ "$(uname -m)" = "x86_64" ]; then
+	#	docker scan --accept-license --version;
+	#fi
 	dockerd --version
 	containerd --version
 	runc --version
@@ -107,9 +108,10 @@ function verify_rpm() {
 	)
 
 	docker --version
-	if [ "$(uname -m)" = "x86_64" ]; then
-		docker scan --accept-license --version;
-	fi
+	# FIXME this tries to connect to the docker daemon, which isn't started
+	#if [ "$(uname -m)" = "x86_64" ]; then
+	#	docker scan --accept-license --version;
+	#fi
 	dockerd --version
 	containerd --version
 	runc --version

From 960961e76b8dbeca308b63bb301cb5bf481d40fd Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Thu, 1 Apr 2021 16:36:44 +0200
Subject: [PATCH 17/22] verify: fix verify to account for scan-plugin on
 download.docker.com

Verify was failing, because we did a test-build to staging:

        docker-ce is already the newest version (5:0.0.0-20210401100358-59fd6f0-0~ubuntu-xenial).
        docker-ce-rootless-extras is already the newest version (5:0.0.0-20210401100358-59fd6f0-0~ubuntu-xenial).
        docker-ce-cli is already the newest version (5:0.0.0-20210401100358-59fd6f0-0~ubuntu-xenial).
        The following additional packages will be installed:
          containerd.io iptables libnfnetlink0 libxtables11
        The following NEW packages will be installed:
          containerd.io iptables libnfnetlink0 libxtables11
        The following packages will be DOWNGRADED:
          docker-scan-plugin

What's happening is that;

- first, we `dpkg-install` docker-ce, docker-ce-cli, and docker-scan-plugin
  from the packages we just built
- then, we `apt-get install` to verify that dependencies (`containerd`)
  are installed

However, we have `docker-scan-plugin` 0.7 on staging, which it then tries to
install, but sees it's an older build, so a _downgrade_

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 verify | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/verify b/verify
index 4b4f4b3e06..e7a0421ba5 100755
--- a/verify
+++ b/verify
@@ -44,6 +44,16 @@ function verify_deb() {
 	# All local packages need to be prefixed with `./` or else apt-get doesn't understand where to pull from
 	packages=$(echo "${packages}" | awk '$0="./"$0' | xargs)
 
+	# For apt-get install, we don't want to install docker-scan-plugin, as it would
+	# downgrade the already installed local package with an older version from
+	# download.docker.com.
+	# We search for packages starting with "docker-ce", which excludes "docker-scan-plugin"
+	# as it doesn't have the "docker-ce" prefix. We match on "docker-c" so that we also
+	# match "docker-ce.deb"
+	apt_packages=$(find "packaging/deb/debbuild/${DIST_ID}-${DIST_VERSION}/" -type f -name "docker-c*.deb")
+	# All local packages need to be prefixed with `./` or else apt-get doesn't understand where to pull from
+	apt_packages=$(echo "${apt_packages}" | awk '$0="./"$0' | xargs)
+
 	(
 		set -x
 		# Install the locally built packages using 'dpkg' because installing with
@@ -56,11 +66,14 @@ function verify_deb() {
 		#
 		# Afterwards, we run 'apt-get install' with the '--fix-broken' option to
 		# trigger installation of the dependencies, which should succceed succesfully.
+		# shellcheck disable=SC2086
 		dpkg \
 			--ignore-depends=containerd.io,iptables,libdevmapper,libdevmapper1.02.1 \
 			--force-depends \
 			-i ${packages}
-		apt-get -y install --no-install-recommends --fix-broken ${packages}
+
+		# shellcheck disable=SC2086
+		apt-get -y install --no-install-recommends --fix-broken ${apt_packages}
 	)
 	docker --version
 	# FIXME this tries to connect to the docker daemon, which isn't started

From 60abadbc04ea19161fddd89b5eeb78f031b5b82b Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Tue, 6 Apr 2021 21:26:30 +0200
Subject: [PATCH 18/22] verify: don't attempt to upgrade packages

If download-stage.docker.com already contains a previous build
of docker-ce/docker-ce-cli, apt attempts to install that version,
only to discover that it's an older build (and considered a "downgrade")

This patch (hopefully) fixes that case, by not attempting to upgrade.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 verify | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/verify b/verify
index e7a0421ba5..333e62fde2 100755
--- a/verify
+++ b/verify
@@ -73,7 +73,7 @@ function verify_deb() {
 			-i ${packages}
 
 		# shellcheck disable=SC2086
-		apt-get -y install --no-install-recommends --fix-broken ${apt_packages}
+		apt-get -y install --no-install-recommends --no-upgrade --fix-broken ${apt_packages}
 	)
 	docker --version
 	# FIXME this tries to connect to the docker daemon, which isn't started

From fa57144c1d18779d591ec1761f95c080f696fc6a Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Wed, 7 Apr 2021 10:55:31 +0200
Subject: [PATCH 19/22] verify: remove old hack, and update comments to
 describe the process

- now that we added the '--no-upgrades' option in 60abadbc04ea19161fddd89b5eeb78f031b5b82b,
  we no longer need the hack from 960961e76b8dbeca308b63bb301cb5bf481d40fd
- add more comments, describing each step of the verify script, because
  it may not be obvious why we do some steps.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 verify | 30 +++++++++++++++++-------------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/verify b/verify
index 333e62fde2..6a72caf9ba 100755
--- a/verify
+++ b/verify
@@ -26,6 +26,9 @@ function verify() {
 }
 
 function verify_deb() {
+	# First install prerequisites for our script and dpkg and apt to run correctly.
+	# This list SHOULD NOT include dependencies of docker itself, otherwise we would
+	# not be able to verify that our packages specify all the required dependencies.
 	apt-get update
 	apt-get -y install --no-install-recommends \
 		apt-transport-https \
@@ -44,16 +47,6 @@ function verify_deb() {
 	# All local packages need to be prefixed with `./` or else apt-get doesn't understand where to pull from
 	packages=$(echo "${packages}" | awk '$0="./"$0' | xargs)
 
-	# For apt-get install, we don't want to install docker-scan-plugin, as it would
-	# downgrade the already installed local package with an older version from
-	# download.docker.com.
-	# We search for packages starting with "docker-ce", which excludes "docker-scan-plugin"
-	# as it doesn't have the "docker-ce" prefix. We match on "docker-c" so that we also
-	# match "docker-ce.deb"
-	apt_packages=$(find "packaging/deb/debbuild/${DIST_ID}-${DIST_VERSION}/" -type f -name "docker-c*.deb")
-	# All local packages need to be prefixed with `./` or else apt-get doesn't understand where to pull from
-	apt_packages=$(echo "${apt_packages}" | awk '$0="./"$0' | xargs)
-
 	(
 		set -x
 		# Install the locally built packages using 'dpkg' because installing with
@@ -64,16 +57,27 @@ function verify_deb() {
 		# packages we know to be missing at this stage, and '--force-depends' to
 		# only warn about any other missing dependency.
 		#
-		# Afterwards, we run 'apt-get install' with the '--fix-broken' option to
-		# trigger installation of the dependencies, which should succceed succesfully.
 		# shellcheck disable=SC2086
 		dpkg \
 			--ignore-depends=containerd.io,iptables,libdevmapper,libdevmapper1.02.1 \
 			--force-depends \
 			-i ${packages}
 
+		# After installing the local packages, we run 'apt-get install' with the
+		# '--fix-broken' option to trigger installation of the dependencies, which
+		# should succeed successfully. This step is to verify that not only the
+		# packages can be installed, but also that all dependencies (including
+		# containerd.io) can be resolved correctly for the distro that we built for,
+		# before going through the whole pipeline and publishing the packages.
+		#
+		# The '--no-upgrade' option is set to prevent apt from attempting to install
+		# packages from download(-stage).docker.com that we already installed using
+		# the local packages above. Without this, installing (e.g.) ./docker-ce-cli
+		# would result in apt installing "docker-ce" from the package repository and
+		# produce a "the following packages will be DOWNGRADED" error.
+		#
 		# shellcheck disable=SC2086
-		apt-get -y install --no-install-recommends --no-upgrade --fix-broken ${apt_packages}
+		apt-get -y install --no-install-recommends --no-upgrade --fix-broken ${packages}
 	)
 	docker --version
 	# FIXME this tries to connect to the docker daemon, which isn't started

From 5f157ebdd9473ebf46dfa7547257ffd82bfd3a59 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Wed, 7 Apr 2021 10:23:03 +0200
Subject: [PATCH 20/22] verify: fix hard-coded distro name for "sid" (Debian
 unstable)

Debian "sid" is not an actual distro version. Sid represents the "unstable"
channel ("next stable in-progress"). Currently, it is equivalent to "bullseye",
but once "bullseye" is stable, it becomes "bookworm", "trixy", etc (see the
list of Debian releases at https://wiki.debian.org/DebianReleases).

We should fix this hard-coded override, and instead try to get this name from
information in /var/lib/apt/lists/.

Also see https://github.com/docker/containerd-packaging/pull/219 for details.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 install-containerd-helpers | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/install-containerd-helpers b/install-containerd-helpers
index d2a0d68e0b..cf68fc1ba5 100644
--- a/install-containerd-helpers
+++ b/install-containerd-helpers
@@ -54,7 +54,15 @@ function install_debian_containerd() {
 	curl -fsSL "${REPO_URL}/gpg" | apt-key add -
 
 	if [[ ${DIST_VERSION} == "sid" ]]; then
-		DIST_VERSION='buster'
+		# Debian "sid" is not an actual distro version. Sid represents the "unstable"
+		# channel ("next stable in-progress"). Currently, it is equivalent to "bullseye",
+		# but once "bullseye" is stable, it becomes "bookworm", "trixy", etc (see the
+		# list of Debian releases at https://wiki.debian.org/DebianReleases).
+		#
+		# FIXME: this override should not be hard-coded, but instead we should try to
+		#        get this name from information in /var/lib/apt/lists/. Also see
+		#        https://github.com/docker/containerd-packaging/pull/219 for details.
+		DIST_VERSION='bullseye'
 	fi
 	ARCH=$(dpkg --print-architecture)
 

From 12187a5f9d6652c9734adbacb69b3902e18e5bc3 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Wed, 7 Apr 2021 10:46:21 +0200
Subject: [PATCH 21/22] verify: fail if we try to use debian "sid" as distro
 name

We should never build packages for "sid", which is a codename for "unstable",
and instead use the codename that it's currently referring to (codename of
next stable release).

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 install-containerd-helpers | 13 +++----------
 verify                     |  4 ++++
 2 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/install-containerd-helpers b/install-containerd-helpers
index cf68fc1ba5..631ad57938 100644
--- a/install-containerd-helpers
+++ b/install-containerd-helpers
@@ -53,16 +53,9 @@ function install_debian_containerd() {
 
 	curl -fsSL "${REPO_URL}/gpg" | apt-key add -
 
-	if [[ ${DIST_VERSION} == "sid" ]]; then
-		# Debian "sid" is not an actual distro version. Sid represents the "unstable"
-		# channel ("next stable in-progress"). Currently, it is equivalent to "bullseye",
-		# but once "bullseye" is stable, it becomes "bookworm", "trixy", etc (see the
-		# list of Debian releases at https://wiki.debian.org/DebianReleases).
-		#
-		# FIXME: this override should not be hard-coded, but instead we should try to
-		#        get this name from information in /var/lib/apt/lists/. Also see
-		#        https://github.com/docker/containerd-packaging/pull/219 for details.
-		DIST_VERSION='bullseye'
+	if [ "${DIST_VERSION}" = "sid" ]; then
+		echo 'Debian sid ("unstable") cannot be used for packaging: replace with the actual codename'
+		exit 1
 	fi
 	ARCH=$(dpkg --print-architecture)
 
diff --git a/verify b/verify
index 6a72caf9ba..b5c8597cef 100755
--- a/verify
+++ b/verify
@@ -40,6 +40,10 @@ function verify_deb() {
 
 	DIST_ID=$(source /etc/os-release; echo "$ID")
 	DIST_VERSION=$(lsb_release -sc)
+	if [ "${DIST_VERSION}" = "sid" ]; then
+		echo 'Debian sid ("unstable") cannot be used for packaging: replace with the actual codename'
+		exit 1
+	fi
 
 	install_debian_containerd
 

From 69781548e249acf10d5c49fdf704c92f76ac6972 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Thu, 19 May 2022 16:29:28 +0200
Subject: [PATCH 22/22] Makefile: add "verify" target to test install of
 packages

This verify step is primarily intended to verify that dependencies
are defined correctly, and available on the given distro.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 Jenkinsfile | 12 ++++++------
 Makefile    | 10 ++++++++++
 common.mk   |  7 +++++++
 verify      |  6 +++---
 4 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/Jenkinsfile b/Jenkinsfile
index 6e05c556fc..e96a994427 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -44,12 +44,12 @@ def genBuildStep(LinkedHashMap pkg, String arch) {
                 sh 'docker info'
             }
             stage("build") {
-                try {
-                    checkout scm
-                    sh "make REF=$branch ${pkg.target}"
-                } finally {
-                    sh "make clean"
-                }
+                checkout scm
+                sh "make clean"
+                sh "make REF=$branch ${pkg.target}"
+            }
+            stage("verify") {
+                sh "make IMAGE=${pkg.image} verify"
             }
         }
     }
diff --git a/Makefile b/Makefile
index 3d77c151cd..80cdae1386 100644
--- a/Makefile
+++ b/Makefile
@@ -97,3 +97,13 @@ static: checkout ## build static-compiled packages
 	for p in $(DOCKER_BUILD_PKGS); do \
 		$(MAKE) -C $@ VERSION=$(VERSION) GO_VERSION=$(GO_VERSION) TARGETPLATFORM=$(TARGETPLATFORM) CONTAINERD_VERSION=$(CONTAINERD_VERSION) RUNC_VERSION=$(RUNC_VERSION) $${p}; \
 	done
+
+.PHONY: verify
+verify: ## verify installation of packages
+# to verify using packages from staging, use: make VERIFY_PACKAGE_REPO=stage IMAGE=ubuntu:focal verify
+	docker run $(VERIFY_PLATFORM) --rm -i \
+		-v "$$(pwd):/v" \
+		-e DEBIAN_FRONTEND=noninteractive \
+		-e PACKAGE_REPO=$(VERIFY_PACKAGE_REPO) \
+		-w /v \
+		$(IMAGE) ./verify
diff --git a/common.mk b/common.mk
index 08890fbfc0..9ee597c2b0 100644
--- a/common.mk
+++ b/common.mk
@@ -43,6 +43,13 @@ DOCKER_SCAN_REF    ?= v0.17.0
 DOCKER_COMPOSE_REF ?= v2.5.1
 DOCKER_BUILDX_REF  ?= v0.8.2
 
+# Use "stage" to install dependencies from download-stage.docker.com during the
+# verify step. Leave empty or use any other value to install from download.docker.com
+VERIFY_PACKAGE_REPO ?= staging
+
+# Optional flags like --platform=linux/armhf
+VERIFY_PLATFORM ?=
+
 export BUILDTIME
 export DEFAULT_PRODUCT_LICENSE
 export PACKAGER_NAME
diff --git a/verify b/verify
index b5c8597cef..e7b9b59f41 100755
--- a/verify
+++ b/verify
@@ -6,7 +6,7 @@
 # Description: This runs a smoke test to verify that the packages can be installed corrected
 ###
 
-# packaging/build/${DIST_ID}/${DIST_VERSION}/${ARCH} - location of all packages
+# build/${DIST_ID}/${DIST_VERSION}/${ARCH} - location of all packages
 # Manually Testing: docker run --rm -it -v $(pwd):/v -w /v "centos:7" ./verify
 
 set -e
@@ -47,7 +47,7 @@ function verify_deb() {
 
 	install_debian_containerd
 
-	packages=$(find "packaging/deb/debbuild/${DIST_ID}-${DIST_VERSION}/" -type f -name "*.deb")
+	packages=$(find "deb/debbuild/${DIST_ID}-${DIST_VERSION}/" -type f -name "*.deb")
 	# All local packages need to be prefixed with `./` or else apt-get doesn't understand where to pull from
 	packages=$(echo "${packages}" | awk '$0="./"$0' | xargs)
 
@@ -120,7 +120,7 @@ function verify_rpm() {
 
 	# find all rpm packages, exclude src package
 	echo "[DEBUG] Installing engine rpms"
-	packages=$(find "packaging/rpm/rpmbuild/${DIST_ID}-${DIST_VERSION}/RPMS/" -type f -name "*.rpm" | sed '/src/d')
+	packages=$(find "rpm/rpmbuild/${DIST_ID}-${DIST_VERSION}/RPMS/" -type f -name "*.rpm" | sed '/src/d')
 
 	# install all non-source packages
 	(