Automated building of an image against an EMSRV with passwords enabled

Using the abt.cnf based technique documented in <a href="https://www.instantiations.com/docs/91/wwhelp/wwhimpl/js/html/wwhelp.htm#href=sg/stug515.html" target="_blank" rel="nofollow" onmousedown="this.href=&#39;https://www.google.com/url?q\x3dhttps%3A%2F%2Fwww.instantiations.com%2Fdocs%2F91%2Fwwhelp%2Fwwhimpl%2Fjs%2Fhtml%2Fwwhelp.htm%23href%3Dsg%2Fstug515.html\x26sa\x3dD\x26sntz\x3d1\x26usg\x3dAFQjCNEJxPFbmyUxGOXg46Vcmd8tQuOgBg&#39;;return true;" onclick="this.href=&#39;https://www.google.com/url?q\x3dhttps%3A%2F%2Fwww.instantiations.com%2Fdocs%2F91%2Fwwhelp%2Fwwhimpl%2Fjs%2Fhtml%2Fwwhelp.htm%23href%3Dsg%2Fstug515.html\x26sa\x3dD\x26sntz\x3d1\x26usg\x3dAFQjCNEJxPFbmyUxGOXg46Vcmd8tQuOgBg&#39;;return true;">https://www.instantiations.com/docs/91/wwhelp/wwhimpl/js/html/wwhelp.htm#href=sg/stug515.html, I've built all the logic to build the images for our applications automatically.  This takes a clean image, loads in the relevant config maps, creates XD images if necessary and fires off the packager.

The issue I have is that our EMSRV library has password validation enabled (as per <a href="https://www.instantiations.com/docs/91/wwhelp/wwhimpl/js/html/wwhelp.htm#href=ig/instgd38.html" target="_blank" rel="nofollow" onmousedown="this.href=&#39;https://www.google.com/url?q\x3dhttps%3A%2F%2Fwww.instantiations.com%2Fdocs%2F91%2Fwwhelp%2Fwwhimpl%2Fjs%2Fhtml%2Fwwhelp.htm%23href%3Dig%2Finstgd38.html\x26sa\x3dD\x26sntz\x3d1\x26usg\x3dAFQjCNH-rJFDPBgNQYRH3jAP8fruxy5Luw&#39;;return true;" onclick="this.href=&#39;https://www.google.com/url?q\x3dhttps%3A%2F%2Fwww.instantiations.com%2Fdocs%2F91%2Fwwhelp%2Fwwhimpl%2Fjs%2Fhtml%2Fwwhelp.htm%23href%3Dig%2Finstgd38.html\x26sa\x3dD\x26sntz\x3d1\x26usg\x3dAFQjCNH-rJFDPBgNQYRH3jAP8fruxy5Luw&#39;;return true;">https://www.instantiations.com/docs/91/wwhelp/wwhimpl/js/html/wwhelp.htm#href=ig/instgd38.html) to ensure the library records which user does each change.  When this is enabled, each user is prompted to enter their password when starting an image connected to this library.

However, I cannot find any (official) way to allow the abt.cnf file to supply a password and thus not cause the dialog to be displayed.  As the build is being done via Jenkins, there is no desktop to even show this dialog on!  Basically, the build stops at this point waiting for a user to enter a password into a dialog box that is not displayed anywhere.

Has anyone else hit this issue and come up with a solution?

My current solution involves creating a special starting image for the build where I've crippled EtTools to not show the dialog - but I don't like this solution as it means we have to use a special build image when using the automation - so thought I'd see if anyone else had come up with a better solution.

Hi David, 

In order to minimize the 1 day delay between our responses (14 hours of difference!) I will try to bunch a few things all together. 

Please find my responses below, inlined. 

On Thu, Dec 5, 2019 at 8:07 PM David Gregory <<a href="javascript:" target="_blank" gdf-obfuscated-mailto="rWN1SNcNAAAJ" rel="nofollow" onmousedown="this.href=&#39;javascript:&#39;;return true;" onclick="this.href=&#39;javascript:&#39;;return true;">david....@trapezegroup.com.au> wrote:

Once I can get my password prompt problem solved, I can give all the code for everyone else to leverage.

 

That would be terrific and I let me know if there is anything from our side we can do to help. I think the most important part (or at least very important) is to have a nice documentation/blog/readme explaining how to use it. Or build a small tutorial / hello world example. 

 

The basic gist of the process I want to do is 2 main steps: Take a ‘newimage’ image to a state that allows it to be used as the basis for the application builds.  Then use this image repeatedly for each application build (we have 10 all up to build – 3 windows, 7 linux).

 

Step 1 basically does

-          Copy the abt.icx from newimage

-          Install an abt.ini that connects it to the library

-          Install an abt.cnf that has EarlyStart logic to register the image to the build user and connect it to the library, and PostStartup logic to load in a config map containing all the VAST features we need, create an XD image and load into it the features we need and save this image

-          Run this via the command line

 

Step 2 basically does

-          Take the pre-prepared image

-          Install a ‘builder’ abt.cnf which parses the command line, loads in the requested version of the application specific config map and, if the application is an XD image, load the config map into the XD image, then run the packager with a command line supplied packaging instruction (along with error checking and stopping if there is a problem)

-          Sends this image off to the next build job to be included with all the rest of the application logic

 

Until I can get around the password problem, Step 1 is not currently automated.  Right now, I do Step 1 manually and add the extra hack to EtTools to disable the password dialog so that Step 2 is fully automated.  As I’m taking the clean newimage as the start of step 1, there is no opportunity to change EtTools before the password prompt comes up for it.

 

The EMSRV is running on windows using native authentication (-rn mode).  Each user is created in the library with a network name matching their active directory name (domain\username).  Each user then sets their image to be owned by their user and on startup, the image prompts them for their own password.  This way all changes are tracked to the user that makes them.  We are only using this for user identification rather than ‘security’ (ie all the application level security is set to World).

 

So each user has their own account (their network account), and the builder has been given its own network account (which is the account jenkins logs into Windows as).  I know the password for the builder account and can supply it to smalltalk.  I just cannot see a way to actually supply the password to EtTools so that it is happy and does not display the password modal dialog.

 

EtTools class>>#checkPassword:in: is what shows the dialog.

 

We have another customer which needs to do something similar. They kindly share with us more or less what they do. With below snippet you should be able to disable password authentication:

| replacementMethod |
    originalPasswordCheckingMethod := EmLibrary >> #isPasswordCheckingEnabled.
    replacementMethod :=
        EmLibrary
            basicCompile: 'isPasswordCheckingEnabled
                ^false'
            notifying: System errorLog
            ifFail: [Error signal: 'Method could not be compiled'].
    EmLibrary methodDictionary at: #isPasswordCheckingEnabled put: replacementMethod

Then, you have to wait for the GUI to finish activating itself:

[System errorLog class = TranscriptTTY] whileTrue: [Processor yield].
    (Delay forSeconds: 30) wait

Then, redirect to console, else you will have no information if something fails:

System errorLog: TranscriptTTY default.

Then you can log in a user like this:

EmUser classPool at: 'CurrentUser' put: (EmUser called: 'builder').

And all this code should be run in a separate fork with less priority than the main process, else it never starts... So..basically, it's to wrap all above code with something like:

[ 

"Above code" 

] forkAt: Processor userSchedulingPriority named: ('We are building')

-------------------------------

I don't know which version you are using, but I think in 9.0 or 9.1 we added the ability to abt.cnf file to have to sections, the pre-started and post-startup. So...all that code to wait until the GUI is finish, might be solved by simply using "post startup" actions rather than "pre-startup". Example:

TranscriptTTY default show: 'This is PRE STARTUP' !
PostStartUp !
TranscriptTTY default show: 'This is POST STARTUP' !

--------------------------------

Whenever you get it to work, we will be very willing to adapt VAST to make this easier. For example, making #isPasswordCheckingEnabled to rely on a class variable or something (just a random thought). But what I mean is that we are willing to make changes in VAST product to ease these kind of scripting. 

Finally, I know you have an active support contract, so if this doesn't resolve in the time frame needed, please send an email to  <a href="javascript:" target="_blank" gdf-obfuscated-mailto="rWN1SNcNAAAJ" rel="nofollow" onmousedown="this.href=&#39;javascript:&#39;;return true;" onclick="this.href=&#39;javascript:&#39;;return true;">vast-s...@instantiations.com and we will put engineering effort to help you. And then, obviously, we will come back with the results to the forum. 

Best regards,

Mariano

--

Mariano Martinez Peck
Software Engineer, Instantiations Inc.

Email: <a href="javascript:" target="_blank" gdf-obfuscated-mailto="rWN1SNcNAAAJ" rel="nofollow" onmousedown="this.href=&#39;javascript:&#39;;return true;" onclick="this.href=&#39;javascript:&#39;;return true;">mp...@instantiations.com

Twitter: <a href="https://twitter.com/MartinezPeck" target="_blank" rel="nofollow" onmousedown="this.href=&#39;https://www.google.com/url?q\x3dhttps%3A%2F%2Ftwitter.com%2FMartinezPeck\x26sa\x3dD\x26sntz\x3d1\x26usg\x3dAFQjCNFPV-7Bnc-U6phGEh-VZU0iUtY7vw&#39;;return true;" onclick="this.href=&#39;https://www.google.com/url?q\x3dhttps%3A%2F%2Ftwitter.com%2FMartinezPeck\x26sa\x3dD\x26sntz\x3d1\x26usg\x3dAFQjCNFPV-7Bnc-U6phGEh-VZU0iUtY7vw&#39;;return true;">https://twitter.com/MartinezPeck

LinkedIn: <a href="https://www.linkedin.com/in/mariano-mart%C3%ADnez-peck/" target="_blank" rel="nofollow" onmousedown="this.href=&#39;https://www.google.com/url?q\x3dhttps%3A%2F%2Fwww.linkedin.com%2Fin%2Fmariano-mart%25C3%25ADnez-peck%2F\x26sa\x3dD\x26sntz\x3d1\x26usg\x3dAFQjCNGyJTUAWXPstaw4J3OpFUYRyFAqmw&#39;;return true;" onclick="this.href=&#39;https://www.google.com/url?q\x3dhttps%3A%2F%2Fwww.linkedin.com%2Fin%2Fmariano-mart%25C3%25ADnez-peck%2F\x26sa\x3dD\x26sntz\x3d1\x26usg\x3dAFQjCNGyJTUAWXPstaw4J3OpFUYRyFAqmw&#39;;return true;">www.linkedin.com/in/mariano-martinez-peck

Blog: <a href="https://marianopeck.wordpress.com/" target="_blank" rel="nofollow" onmousedown="this.href=&#39;https://www.google.com/url?q\x3dhttps%3A%2F%2Fmarianopeck.wordpress.com%2F\x26sa\x3dD\x26sntz\x3d1\x26usg\x3dAFQjCNHAOaIsyMIYgmQWdQZRuKRdD6gBfw&#39;;return true;" onclick="this.href=&#39;https://www.google.com/url?q\x3dhttps%3A%2F%2Fmarianopeck.wordpress.com%2F\x26sa\x3dD\x26sntz\x3d1\x26usg\x3dAFQjCNHAOaIsyMIYgmQWdQZRuKRdD6gBfw&#39;;return true;">https://marianopeck.wordpress.com/