[ARVADOS-DEV] updated: d595a42fa570533d50e6468ee9bfa2a905358f41

[git at public.curoverse.com]

Summary of changes:
 jenkins/run-library.sh | 39 +++++++++++++++------------------------
 1 file changed, 15 insertions(+), 24 deletions(-)

  discards  8e7691e8a2a278a797dd4a28c196f4243a7d592d (commit)
       via  d595a42fa570533d50e6468ee9bfa2a905358f41 (commit)

This update added new revisions after undoing existing revisions.  That is
to say, the old revision is not a strict subset of the new revision.  This
situation occurs when you --force push a change and generate a repository
containing something like this:

 * -- * -- B -- O -- O -- O (8e7691e8a2a278a797dd4a28c196f4243a7d592d)
            \
             N -- N -- N (d595a42fa570533d50e6468ee9bfa2a905358f41)

When this happens we assume that you've already had alert emails for all
of the O revisions, and so we here report only the revisions in the N
branch from the common base, B.

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.


commit d595a42fa570533d50e6468ee9bfa2a905358f41
Author: Brett Smith <brett at curoverse.com>
Date:   Sat Jan 2 12:15:53 2016 -0500

    8014, 8059: Unify Rails package building.
    
    * Introduce a handle_rails_package function, and helpers, to build a
      Rails package.
    * Generalize all the support scripts into unified postinst, prerm, and
      postrm scripts.  handle_rails_package builds these into the
      packages.  See jenkins/rails-package-scripts/README.md for details.
    * More error checking throughout (e.g., check for failure when doing
      any prep work for Rails packages, or the Workbench packages
      specifically, using `set -e` in a subshell).
    
    One behavior change from this unification: before this,
    run-build-packages treated --build-bundle-packages to mean "*also*
    build bundle packages", while run-build-packages-sso treated the
    switch to mean "*only* build bundle packages".  This commit declares
    run-build-packages to be the winner, and makes run-build-packages-sso
    consistent with it.

diff --git a/jenkins/arvados-api-server-extras/arvados-api-server-upgrade.sh b/jenkins/arvados-api-server-extras/arvados-api-server-upgrade.sh
deleted file mode 100755
index 2fff1e7..0000000
--- a/jenkins/arvados-api-server-extras/arvados-api-server-upgrade.sh
+++ /dev/null
@@ -1,118 +0,0 @@
-#!/bin/bash
-
-set -e
-
-if [ -e /etc/redhat-release ]; then
-    WWW_OWNER=nginx:nginx
-else
-    # Assume we're on a Debian-based system for now.
-    WWW_OWNER=www-data:www-data
-fi
-
-NGINX_SERVICE=${NGINX_SERVICE:-$(service --status-all 2>/dev/null \
-    | grep -Eo '\bnginx[^[:space:]]*' || true)}
-if [ -z "$NGINX_SERVICE" ]; then
-    cat >&2 <<EOF
-Error: nginx service not found. Aborting.
-Set NGINX_SERVICE to the name of the service hosting the Rails server.
-EOF
-    exit 1
-elif [ "$NGINX_SERVICE" != "$(echo "$NGINX_SERVICE" | head -n 1)" ]; then
-    cat >&2 <<EOF
-Error: multiple nginx services found. Aborting.
-Set NGINX_SERVICE to the name of the service hosting the Rails server.
-EOF
-    exit 1
-fi
-
-RELEASE_PATH=/var/www/arvados-api/current
-SHARED_PATH=/var/www/arvados-api/shared
-CONFIG_PATH=/etc/arvados/api/
-
-echo "Assumption: $NGINX_SERVICE is configured to serve your API server URL from"
-echo "            /var/www/arvados-api/current"
-echo "Assumption: configuration files are in /etc/arvados/api/"
-echo "Assumption: $NGINX_SERVICE and passenger run as $WWW_OWNER"
-echo
-
-echo "Copying files from $CONFIG_PATH"
-cp -f $CONFIG_PATH/database.yml $RELEASE_PATH/config/database.yml
-cp -f $RELEASE_PATH/config/environments/production.rb.example $RELEASE_PATH/config/environments/production.rb
-cp -f $CONFIG_PATH/application.yml $RELEASE_PATH/config/application.yml
-if [ -e $CONFIG_PATH/omniauth.rb ]; then
-    cp -f $CONFIG_PATH/omniauth.rb $RELEASE_PATH/config/initializers/omniauth.rb
-fi
-echo "Done."
-
-# Before we do anything else, make sure some directories and files are in place
-if [[ ! -e $SHARED_PATH/log ]]; then mkdir -p $SHARED_PATH/log; fi
-if [[ ! -e $RELEASE_PATH/tmp ]]; then mkdir -p $RELEASE_PATH/tmp; fi
-if [[ ! -e $RELEASE_PATH/log ]]; then ln -s $SHARED_PATH/log $RELEASE_PATH/log; fi
-if [[ ! -e $SHARED_PATH/log/production.log ]]; then touch $SHARED_PATH/log/production.log; fi
-
-cd "$RELEASE_PATH"
-export RAILS_ENV=production
-
-echo "Making sure bundle is installed"
-set +e
-which bundle > /dev/null
-if [[ "$?" != "0" ]]; then
-  gem install bundle
-fi
-set -e
-echo "Done."
-
-echo "Running bundle install"
-bundle install --path $SHARED_PATH/vendor_bundle
-echo "Done."
-
-echo "Precompiling assets"
-# precompile assets; thankfully this does not take long
-bundle exec rake assets:precompile
-echo "Done."
-
-echo "Ensuring directory and file permissions"
-# Ensure correct ownership of a few files
-chown "$WWW_OWNER" $RELEASE_PATH/config/environment.rb
-chown "$WWW_OWNER" $RELEASE_PATH/config.ru
-chown "$WWW_OWNER" $RELEASE_PATH/config/database.yml
-chown "$WWW_OWNER" $RELEASE_PATH/Gemfile.lock
-chown -R "$WWW_OWNER" $RELEASE_PATH/tmp
-chown -R "$WWW_OWNER" $SHARED_PATH/log
-chown "$WWW_OWNER" $RELEASE_PATH/db/structure.sql
-chmod 644 $SHARED_PATH/log/*
-# Rails creates the cache directory if it doesn't exist
-if [[ -d $RELEASE_PATH/tmp/cache/ ]]; then
-  chmod -R 2775 $RELEASE_PATH/tmp/cache/
-fi
-echo "Done."
-
-echo "Running sanity check"
-bundle exec rake config:check
-SANITY_CHECK_EXIT_CODE=$?
-echo "Done."
-
-if [[ "$SANITY_CHECK_EXIT_CODE" != "0" ]]; then
-  echo "Sanity check failed, aborting. Please roll back to the previous version of the package."
-  echo "The database has not been migrated yet, so reinstalling the previous version is safe."
-  exit $SANITY_CHECK_EXIT_CODE
-fi
-
-echo "Checking database status"
-# If we use `grep -q`, rake will write a backtrace on EPIPE.
-if bundle exec rake db:migrate:status | grep '^database: ' >/dev/null; then
-    echo "Starting db:migrate"
-    bundle exec rake db:migrate
-elif [ 0 -eq ${PIPESTATUS[0]} ]; then
-    # The database exists, but the migrations table doesn't.
-    echo "Setting up database"
-    bundle exec rake db:structure:load db:seed
-else
-    echo "Error: Database is not ready to set up. Aborting." >&2
-    exit 1
-fi
-echo "Done."
-
-echo "Restarting nginx"
-service "$NGINX_SERVICE" restart
-echo "Done."
diff --git a/jenkins/arvados-api-server-extras/postinst.sh b/jenkins/arvados-api-server-extras/postinst.sh
deleted file mode 100644
index 1aeffe9..0000000
--- a/jenkins/arvados-api-server-extras/postinst.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/bash
-
-cd /var/www/arvados-api
-
-chown -R www-data:www-data tmp >/dev/null 2>&1
-chown -R www-data:www-data log >/dev/null 2>&1
-chown www-data:www-data db/structure.sql >/dev/null 2>&1
-chmod 644 log/* >/dev/null 2>&1
-
-# Errors above are not serious
-exit 0
-
diff --git a/jenkins/arvados-workbench-extras/arvados-workbench-upgrade.sh b/jenkins/arvados-workbench-extras/arvados-workbench-upgrade.sh
deleted file mode 100755
index e981517..0000000
--- a/jenkins/arvados-workbench-extras/arvados-workbench-upgrade.sh
+++ /dev/null
@@ -1,90 +0,0 @@
-#!/bin/bash
-
-set -e
-
-if [ -e /etc/redhat-release ]; then
-    WWW_OWNER=nginx:nginx
-else
-    # Assume we're on a Debian-based system for now.
-    WWW_OWNER=www-data:www-data
-fi
-
-NGINX_SERVICE=${NGINX_SERVICE:-$(service --status-all 2>/dev/null \
-    | grep -Eo '\bnginx[^[:space:]]*' || true)}
-if [ -z "$NGINX_SERVICE" ]; then
-    cat >&2 <<EOF
-Error: nginx service not found. Aborting.
-Set NGINX_SERVICE to the name of the service hosting the Rails server.
-EOF
-    exit 1
-elif [ "$NGINX_SERVICE" != "$(echo "$NGINX_SERVICE" | head -n 1)" ]; then
-    cat >&2 <<EOF
-Error: multiple nginx services found. Aborting.
-Set NGINX_SERVICE to the name of the service hosting the Rails server.
-EOF
-    exit 1
-fi
-
-RELEASE_PATH=/var/www/arvados-workbench/current
-SHARED_PATH=/var/www/arvados-workbench/shared
-CONFIG_PATH=/etc/arvados/workbench/
-
-echo "Assumption: $NGINX_SERVICE is configured to serve your workbench URL from "
-echo "            /var/www/arvados-workbench/current"
-echo "Assumption: configuration files are in /etc/arvados/workbench/"
-echo "Assumption: $NGINX_SERVICE and passenger run as $WWW_OWNER"
-echo
-
-echo "Copying files from $CONFIG_PATH"
-cp -f $CONFIG_PATH/application.yml $RELEASE_PATH/config/application.yml
-cp -f $RELEASE_PATH/config/environments/production.rb.example $RELEASE_PATH/config/environments/production.rb
-echo "Done."
-
-# Before we do anything else, make sure some directories and files are in place
-if [[ ! -e $SHARED_PATH/log ]]; then mkdir -p $SHARED_PATH/log; fi
-if [[ ! -e $RELEASE_PATH/tmp ]]; then mkdir -p $RELEASE_PATH/tmp; fi
-if [[ ! -e $RELEASE_PATH/log ]]; then ln -s $SHARED_PATH/log $RELEASE_PATH/log; fi
-if [[ ! -e $SHARED_PATH/log/production.log ]]; then touch $SHARED_PATH/log/production.log; fi
-
-echo "Making sure bundle is installed"
-set +e
-which bundle > /dev/null
-if [[ "$?" != "0" ]]; then
-  gem install bundle
-fi
-set -e
-echo "Done."
-
-echo "Running bundle install"
-(cd $RELEASE_PATH && RAILS_ENV=production bundle install --path $SHARED_PATH/vendor_bundle)
-echo "Done."
-
-# We do not need to precompile assets, they are already part of the package.
-
-echo "Ensuring directory and file permissions"
-chown "$WWW_OWNER" $RELEASE_PATH/config/environment.rb
-chown "$WWW_OWNER" $RELEASE_PATH/config.ru
-chown "$WWW_OWNER" $RELEASE_PATH/config/database.yml
-chown "$WWW_OWNER" $RELEASE_PATH/Gemfile.lock
-chown -R "$WWW_OWNER" $RELEASE_PATH/tmp
-chown -R "$WWW_OWNER" $SHARED_PATH/log
-chown "$WWW_OWNER" $RELEASE_PATH/db/schema.rb
-chmod 644 $SHARED_PATH/log/*
-echo "Done."
-
-echo "Running sanity check"
-(cd $RELEASE_PATH && RAILS_ENV=production bundle exec rake config:check)
-SANITY_CHECK_EXIT_CODE=$?
-echo "Done."
-
-if [[ "$SANITY_CHECK_EXIT_CODE" != "0" ]]; then
-  echo "Sanity check failed, aborting. Please roll back to the previous version of the package."
-  exit $SANITY_CHECK_EXIT_CODE
-fi
-
-# We do not need to run db:migrate because Workbench is stateless
-
-echo "Restarting nginx"
-service "$NGINX_SERVICE" restart
-echo "Done."
-
diff --git a/jenkins/arvados-workbench-extras/postinst.sh b/jenkins/arvados-workbench-extras/postinst.sh
deleted file mode 100644
index d0aa9b0..0000000
--- a/jenkins/arvados-workbench-extras/postinst.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/bash
-
-cd /var/www/arvados-workbench
-
-chown -R www-data:www-data tmp >/dev/null 2>&1
-chown -R www-data:www-data log >/dev/null 2>&1
-chown www-data:www-data db/schema.rb >/dev/null 2>&1
-chmod 644 log/* >/dev/null 2>&1
-
-# Errors above are not serious
-exit 0
-
diff --git a/jenkins/rails-package-scripts/README.md b/jenkins/rails-package-scripts/README.md
new file mode 100644
index 0000000..6779fb4
--- /dev/null
+++ b/jenkins/rails-package-scripts/README.md
@@ -0,0 +1,13 @@
+When run-build-packages.sh builds a Rails package, it generates the package's pre/post-inst/rm scripts by concatenating:
+
+1. package_name.sh, which defines variables about where package files live and some human-readable names about them.
+2. step2.sh, which uses those to define some utility variables and set defaults for things that aren't set.
+3. stepname.sh, like postinst.sh, prerm.sh, etc., which uses all this information to do the actual work.
+
+Since our build process is a tower of shell scripts, concatenating files seemed like the least worst option to share code between these files and packages.  More advanced code generation would've been too much trouble to integrate into our build process at this time.  Trying to inject portions of files into other files seemed error-prone and likely to introduce bugs to the end result.
+
+postinst.sh lets the early parts define a few hooks to control behavior:
+
+* After it installs the core configuration files (database.yml, application.yml, and production.rb) to /etc/arvados/server, it calls setup_extra_conffiles.  By default this is a noop function (in step2.sh).  API server defines this to set up the old omniauth.rb conffile.
+* $RAILSPKG_DATABASE_LOAD_TASK defines the Rake task to load the database.  API server uses db:structure:load.  SSO server uses db:schema:load.  Workbench doesn't set this, which causes the postinst to skip all database work.
+* If $RAILSPKG_SUPPORTS_CONFIG_CHECK != 1, it won't run the config:check rake task.  SSO clears this flag (it doesn't have that task code).
diff --git a/jenkins/rails-package-scripts/arvados-api-server.sh b/jenkins/rails-package-scripts/arvados-api-server.sh
new file mode 100644
index 0000000..4df87eb
--- /dev/null
+++ b/jenkins/rails-package-scripts/arvados-api-server.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+# This file declares variables common to all scripts for one Rails package.
+
+PACKAGE_NAME=arvados-api-server
+INSTALL_PATH=/var/www/arvados-api
+CONFIG_PATH=/etc/arvados/api
+DOC_URL="http://doc.arvados.org/install/install-api-server.html#configure"
+
+RAILSPKG_DATABASE_LOAD_TASK=db:structure:load
+setup_extra_conffiles() {
+    setup_conffile initializers/omniauth.rb
+}
diff --git a/jenkins/rails-package-scripts/arvados-sso-server.sh b/jenkins/rails-package-scripts/arvados-sso-server.sh
new file mode 100644
index 0000000..10b2ee2
--- /dev/null
+++ b/jenkins/rails-package-scripts/arvados-sso-server.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+# This file declares variables common to all scripts for one Rails package.
+
+PACKAGE_NAME=arvados-sso-server
+INSTALL_PATH=/var/www/arvados-sso
+CONFIG_PATH=/etc/arvados/sso
+DOC_URL="http://doc.arvados.org/install/install-sso.html#configure"
+RAILSPKG_DATABASE_LOAD_TASK=db:schema:load
+RAILSPKG_SUPPORTS_CONFIG_CHECK=0
diff --git a/jenkins/rails-package-scripts/arvados-workbench.sh b/jenkins/rails-package-scripts/arvados-workbench.sh
new file mode 100644
index 0000000..f2b8a56
--- /dev/null
+++ b/jenkins/rails-package-scripts/arvados-workbench.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+# This file declares variables common to all scripts for one Rails package.
+
+PACKAGE_NAME=arvados-workbench
+INSTALL_PATH=/var/www/arvados-workbench
+CONFIG_PATH=/etc/arvados/workbench
+DOC_URL="http://doc.arvados.org/install/install-workbench-app.html#configure"
diff --git a/jenkins/arvados-sso-server-extras/arvados-sso-server.postinst b/jenkins/rails-package-scripts/postinst.sh
old mode 100755
new mode 100644
similarity index 82%
rename from jenkins/arvados-sso-server-extras/arvados-sso-server.postinst
rename to jenkins/rails-package-scripts/postinst.sh
index e72d9b8..96e687c
--- a/jenkins/arvados-sso-server-extras/arvados-sso-server.postinst
+++ b/jenkins/rails-package-scripts/postinst.sh
@@ -1,15 +1,8 @@
-#!/bin/bash
+#!/bin/sh
+# This code runs after package variable definitions and step2.sh.
 
 set -e
 
-INSTALL_PATH=/var/www/arvados-sso
-RELEASE_PATH=$INSTALL_PATH/current
-RELEASE_CONFIG_PATH=$RELEASE_PATH/config
-SHARED_PATH=$INSTALL_PATH/shared
-CONFIG_PATH=/etc/arvados/sso
-PACKAGE_NAME=arvados-sso-server
-DOC_URL="http://doc.arvados.org/install/install-sso.html#configure"
-
 DATABASE_READY=1
 APPLICATION_READY=1
 
@@ -20,8 +13,8 @@ else
 fi
 
 report_not_ready() {
-    local ready_flag=$1; shift
-    local config_file=$1; shift
+    local ready_flag="$1"; shift
+    local config_file="$1"; shift
     if [ "1" != "$ready_flag" ]; then cat >&2 <<EOF
 
 PLEASE NOTE:
@@ -39,7 +32,7 @@ EOF
 }
 
 report_web_service_warning() {
-    local warning=$1; shift
+    local warning="$1"; shift
     cat >&2 <<EOF
 
 WARNING: $warning.
@@ -59,7 +52,7 @@ run_and_report() {
     # This is the usual wrapper that prints ACTION_MSG, runs CMD, then writes
     # a message about whether CMD succeeded or failed.  Returns the exit code
     # of CMD.
-    local action_message=$1; shift
+    local action_message="$1"; shift
     local retcode=0
     echo -n "$action_message..."
     if "$@"; then
@@ -79,10 +72,10 @@ setup_conffile() {
     # If SOURCE_PATH is given, this function will try to install that file as
     # the configuration file in CONFIG_PATH, and return 1 if the file in
     # CONFIG_PATH is unmodified from the source.
-    local conffile_relpath=$1; shift
-    local conffile_source=$1; shift
-    local release_conffile=$RELEASE_CONFIG_PATH/$conffile_relpath
-    local etc_conffile=$CONFIG_PATH/$(basename "$conffile_relpath")
+    local conffile_relpath="$1"; shift
+    local conffile_source="$1"
+    local release_conffile="$RELEASE_CONFIG_PATH/$conffile_relpath"
+    local etc_conffile="$CONFIG_PATH/$(basename "$conffile_relpath")"
 
     # Note that -h can return true and -e will return false simultaneously
     # when the target is a dangling symlink.  We're okay with that outcome,
@@ -109,6 +102,27 @@ setup_conffile() {
     fi
 }
 
+prepare_database() {
+  DB_MIGRATE_STATUS=`$COMMAND_PREFIX bundle exec rake db:migrate:status 2>&1 || true`
+  if echo $DB_MIGRATE_STATUS | grep -qF 'Schema migrations table does not exist yet.'; then
+      # The database exists, but the migrations table doesn't.
+      run_and_report "Setting up database" $COMMAND_PREFIX bundle exec \
+                     rake "$RAILSPKG_DATABASE_LOAD_TASK" db:seed
+  elif echo $DB_MIGRATE_STATUS | grep -q '^database: '; then
+      run_and_report "Running db:migrate" \
+                     $COMMAND_PREFIX bundle exec rake db:migrate
+  elif echo $DB_MIGRATE_STATUS | grep -q 'database .* does not exist'; then
+      if ! run_and_report "Running db:setup" \
+           $COMMAND_PREFIX bundle exec rake db:setup 2>/dev/null; then
+          echo "Warning: unable to set up database." >&2
+          DATABASE_READY=0
+      fi
+  else
+    echo "Warning: Database is not ready to set up. Skipping database setup." >&2
+    DATABASE_READY=0
+  fi
+}
+
 configure_version() {
   WEB_SERVICE=${WEB_SERVICE:-$(service --status-all 2>/dev/null \
       | grep -Eo '\bnginx|httpd[^[:space:]]*' || true)}
@@ -134,18 +148,20 @@ configure_version() {
   fi
 
   echo
-  echo "Assumption: $WEB_SERVICE is configured to serve your SSO server URL from"
+  echo "Assumption: $WEB_SERVICE is configured to serve Rails from"
   echo "            $RELEASE_PATH"
-  echo "Assumption: configuration files are in $CONFIG_PATH"
   echo "Assumption: $WEB_SERVICE and passenger run as $WWW_OWNER"
   echo
 
-  echo -n "Symlinking files from $CONFIG_PATH ..."
+  echo -n "Creating symlinks to configuration in $CONFIG_PATH ..."
   mkdir -p $CONFIG_PATH
-  setup_conffile database.yml database.yml.example || DATABASE_READY=0
   setup_conffile environments/production.rb environments/production.rb.example \
       || true
   setup_conffile application.yml application.yml.example || APPLICATION_READY=0
+  if [ -n "$RAILSPKG_DATABASE_LOAD_TASK" ]; then
+      setup_conffile database.yml database.yml.example || DATABASE_READY=0
+  fi
+  setup_extra_conffiles
   echo "... done."
 
   # Before we do anything else, make sure some directories and files are in place
@@ -168,31 +184,25 @@ configure_version() {
   # Ensure correct ownership of a few files
   chown "$WWW_OWNER" $RELEASE_PATH/config/environment.rb
   chown "$WWW_OWNER" $RELEASE_PATH/config.ru
-  chown "$WWW_OWNER" $RELEASE_PATH/config/database.yml
   chown "$WWW_OWNER" $RELEASE_PATH/Gemfile.lock
   chown -R "$WWW_OWNER" $RELEASE_PATH/tmp
   chown -R "$WWW_OWNER" $SHARED_PATH/log
-  chown "$WWW_OWNER" $RELEASE_PATH/db/schema.rb
+  case "$RAILSPKG_DATABASE_LOAD_TASK" in
+      db:schema:load) chown "$WWW_OWNER" $RELEASE_PATH/db/schema.rb ;;
+      db:structure:load) chown "$WWW_OWNER" $RELEASE_PATH/db/structure.sql ;;
+  esac
   chmod 644 $SHARED_PATH/log/*
+  chmod -R 2775 $RELEASE_PATH/tmp
   echo "... done."
 
-  DB_MIGRATE_STATUS=`$COMMAND_PREFIX bundle exec rake db:migrate:status 2>&1 || true`
-  if echo $DB_MIGRATE_STATUS | grep -qF 'Schema migrations table does not exist yet.'; then
-      # The database exists, but the migrations table doesn't.
-      run_and_report "Setting up database" \
-                     $COMMAND_PREFIX bundle exec rake db:schema:load db:seed
-  elif echo $DB_MIGRATE_STATUS | grep -q '^database: '; then
-      run_and_report "Running db:migrate" \
-                     $COMMAND_PREFIX bundle exec rake db:migrate
-  elif echo $DB_MIGRATE_STATUS | grep -q 'database .* does not exist'; then
-      if ! run_and_report "Running db:setup" \
-           $COMMAND_PREFIX bundle exec rake db:setup 2>/dev/null; then
-          echo "Warning: unable to set up database." >&2
-          DATABASE_READY=0
-      fi
-  else
-    echo "Warning: Database is not ready to set up. Skipping database setup." >&2
-    DATABASE_READY=0
+  if [ -n "$RAILSPKG_DATABASE_LOAD_TASK" ]; then
+      chown "$WWW_OWNER" $RELEASE_PATH/config/database.yml
+      prepare_database
+  fi
+
+  if [ 11 = "$RAILSPKG_SUPPORTS_CONFIG_CHECK$APPLICATION_READY" ]; then
+      run_and_report "Checking application.yml for completeness" \
+          $COMMAND_PREFIX bundle exec rake config:check || APPLICATION_READY=0
   fi
 
   # precompile assets; thankfully this does not take long
diff --git a/jenkins/arvados-sso-server-extras/arvados-sso-server.postrm b/jenkins/rails-package-scripts/postrm.sh
old mode 100755
new mode 100644
similarity index 79%
rename from jenkins/arvados-sso-server-extras/arvados-sso-server.postrm
rename to jenkins/rails-package-scripts/postrm.sh
index 070c90e..8c45d2f
--- a/jenkins/arvados-sso-server-extras/arvados-sso-server.postrm
+++ b/jenkins/rails-package-scripts/postrm.sh
@@ -1,15 +1,12 @@
 #!/bin/sh
+# This code runs after package variable definitions and step2.sh.
 
 set -e
 
-INSTALL_PATH=/var/www/arvados-sso
-RELEASE_PATH=$INSTALL_PATH/current
-SHARED_PATH=$INSTALL_PATH/shared
-CONFIG_PATH=/etc/arvados/sso
-
 purge () {
   rm -rf $SHARED_PATH/vendor_bundle
   rm -rf $SHARED_PATH/log
+  rm -rf $CONFIG_PATH
   rmdir $SHARED_PATH || true
   rmdir $INSTALL_PATH || true
 }
diff --git a/jenkins/arvados-sso-server-extras/arvados-sso-server.prerm b/jenkins/rails-package-scripts/prerm.sh
old mode 100755
new mode 100644
similarity index 71%
rename from jenkins/arvados-sso-server-extras/arvados-sso-server.prerm
rename to jenkins/rails-package-scripts/prerm.sh
index 1a43fa2..4ef5904
--- a/jenkins/arvados-sso-server-extras/arvados-sso-server.prerm
+++ b/jenkins/rails-package-scripts/prerm.sh
@@ -1,20 +1,16 @@
 #!/bin/sh
-
-set -e
-
-INSTALL_PATH=/var/www/arvados-sso
-RELEASE_PATH=$INSTALL_PATH/current
-SHARED_PATH=$INSTALL_PATH/shared
-CONFIG_PATH=/etc/arvados/sso
+# This code runs after package variable definitions and step2.sh.
 
 remove () {
   rm -f $RELEASE_PATH/config/database.yml
   rm -f $RELEASE_PATH/config/environments/production.rb
   rm -f $RELEASE_PATH/config/application.yml
+  # Old API server configuration file.
+  rm -f $RELEASE_PATH/config/initializers/omniauth.rb
   rm -rf $RELEASE_PATH/public/assets/
   rm -rf $RELEASE_PATH/tmp
   rm -rf $RELEASE_PATH/.bundle
-  rm $RELEASE_PATH/log || true
+  rm -rf $RELEASE_PATH/log
 }
 
 if [ "$1" = 'remove' ]; then
diff --git a/jenkins/rails-package-scripts/step2.sh b/jenkins/rails-package-scripts/step2.sh
new file mode 100644
index 0000000..6678d49
--- /dev/null
+++ b/jenkins/rails-package-scripts/step2.sh
@@ -0,0 +1,25 @@
+#!/bin/sh
+# This code runs after package variable definitions, before the actual
+# pre/post package work, to set some variable and function defaults.
+
+if [ -z "$INSTALL_PATH" ]; then
+    cat >&2 <<EOF
+
+PACKAGE BUILD ERROR: $0 is missing package metadata.
+
+This package is buggy.  Please mail <support at curoverse.com> to let
+us know the name and version number of the package you tried to
+install, and we'll get it fixed.
+
+EOF
+    exit 3
+fi
+
+RELEASE_PATH=$INSTALL_PATH/current
+RELEASE_CONFIG_PATH=$RELEASE_PATH/config
+SHARED_PATH=$INSTALL_PATH/shared
+
+RAILSPKG_SUPPORTS_CONFIG_CHECK=${RAILSPKG_SUPPORTS_CONFIG_CHECK:-1}
+if ! type setup_extra_conffiles >/dev/null 2>&1; then
+    setup_extra_conffiles() { return; }
+fi
diff --git a/jenkins/run-build-packages-sso.sh b/jenkins/run-build-packages-sso.sh
index 2cee17f..eedb77b 100755
--- a/jenkins/run-build-packages-sso.sh
+++ b/jenkins/run-build-packages-sso.sh
@@ -169,73 +169,9 @@ if [[ ! -d "$WORKSPACE/packages/$TARGET" ]]; then
 fi
 
 # Build the SSO server package
-
-cd "$WORKSPACE"
-
-SSO_VERSION=$(version_from_git)
-PACKAGE_NAME=arvados-sso-server
-
-if [[ ! -d "$WORKSPACE/tmp" ]]; then
-  mkdir $WORKSPACE/tmp
-fi
-
-if [[ "$BUILD_BUNDLE_PACKAGES" != 0 ]]; then
-  bundle install --path vendor/bundle >"$STDOUT_IF_DEBUG"
-fi
-
-/usr/bin/git rev-parse HEAD > git-commit.version
-
-cd $WORKSPACE/packages/$TARGET
-
-# Annoyingly, we require a database.yml file for rake assets:precompile to work.
-
-# TODO: add bogus database.yml file so we can precompile the assets and put them in the
-# package. Then remove that database.yml file again. It has to be a valid file though.
-#RAILS_ENV=production RAILS_GROUPS=assets bundle exec rake assets:precompile
-
-# There are just 2 excludes left here, all the others are pulled in via fpm-info.sh, which
-# takes .gitignore into account via a call to git status:
-#
-# 1. The .git directory is excluded by git implicitly, so we can't pick it up from .gitignore.
-# 2. The packages directory needs to be explictly excluded here because it will only be listed
-# if it exists at the time fpm-info.sh runs. If it does not exist at that time, this script
-# will create it and when fpm runs, it will include the directory. So we add it to the exclude
-# list explicitly here, just in case.
-declare -a COMMAND_ARR=("fpm" "--maintainer=Ward Vandewege <ward at curoverse.com>" "--vendor='Curoverse, Inc.'" "--url='https://arvados.org'" "--description='Arvados SSO server - Arvados is a free and open source platform for big data science.'" "--license='Expat License'" "-s" "dir" "-t" "$FORMAT" "-v" "$SSO_VERSION" "-x" "var/www/arvados-sso/current/.git" "-x" "var/www/arvados-sso/current/packages" "--after-install=$RUN_BUILD_PACKAGES_PATH/arvados-sso-server-extras/arvados-sso-server.postinst" "--before-remove=$RUN_BUILD_PACKAGES_PATH/arvados-sso-server-extras/arvados-sso-server.prerm" "--after-remove=$RUN_BUILD_PACKAGES_PATH/arvados-sso-server-extras/arvados-sso-server.postrm" )
-
-if [[ "$BUILD_BUNDLE_PACKAGES" != 0 ]]; then
-  # This is the complete package with vendor/bundle included.
-  # It's big, so we do not build it by default.
-  COMMAND_ARR+=("-n" "${PACKAGE_NAME}-with-bundle")
-else
-  # The default package excludes vendor/bundle
-  COMMAND_ARR+=("-n" "${PACKAGE_NAME}" "-x" "var/www/arvados-sso/current/vendor/bundle")
-fi
-
-# Append --depends X and other arguments specified by fpm-info.sh in
-# the package source dir. These are added last so they can override
-# the arguments added by this script.
-# `--iteration 2` accommodates a postinst change on 2015-12-10.
-declare -a fpm_args=(--iteration 2)
-declare -a fpm_depends=()
-FPM_INFO="$WORKSPACE/fpm-info.sh"
-if [[ -e "$FPM_INFO" ]]; then
-  debug_echo "Loading fpm overrides from $FPM_INFO"
-  source "$FPM_INFO"
-fi
-
-for i in "${fpm_depends[@]}"; do
-  COMMAND_ARR+=('--depends' "$i")
-done
-COMMAND_ARR+=("${fpm_args[@]}")
-COMMAND_ARR+=("$WORKSPACE/=/var/www/arvados-sso/current")
-debug_echo -e "\n${COMMAND_ARR[@]}\n"
-
-FPM_RESULTS=$("${COMMAND_ARR[@]}")
-FPM_EXIT_CODE=$?
-
-fpm_verify $FPM_EXIT_CODE $FPM_RESULTS
-
-# SSO server package build done
+handle_rails_package arvados-sso-server "$WORKSPACE" \
+    "$WORKSPACE/LICENCE" --url="https://arvados.org" \
+    --description="Arvados SSO server - Arvados is a free and open source platform for big data science." \
+    --license="Expat license"
 
 exit $EXITCODE
diff --git a/jenkins/run-build-packages.sh b/jenkins/run-build-packages.sh
index 6369087..768bec2 100755
--- a/jenkins/run-build-packages.sh
+++ b/jenkins/run-build-packages.sh
@@ -401,114 +401,47 @@ for deppkg in "${PYTHON3_BACKPORTS[@]}"; do
 done
 
 # Build the API server package
-
-cd "$WORKSPACE/services/api"
-
-API_VERSION=$(version_from_git)
-PACKAGE_NAME=arvados-api-server
-
-if [[ ! -d "$WORKSPACE/services/api/tmp" ]]; then
-  mkdir $WORKSPACE/services/api/tmp
-fi
-
-
-if [[ "$BUILD_BUNDLE_PACKAGES" != 0 ]]; then
-  bundle install --path vendor/bundle >"$STDOUT_IF_DEBUG"
-fi
-
-/usr/bin/git rev-parse HEAD > git-commit.version
-
-cd $WORKSPACE/packages/$TARGET
-
-# Annoyingly, we require a database.yml file for rake assets:precompile to work. So for now,
-# we do that in the upgrade script.
-# TODO: add bogus database.yml file so we can precompile the assets and put them in the
-# package. Then remove that database.yml file again. It has to be a valid file though.
-#RAILS_ENV=production RAILS_GROUPS=assets bundle exec rake assets:precompile
-
-# This is the complete package with vendor/bundle included.
-# It's big, so we do not build it by default.
-if [[ "$BUILD_BUNDLE_PACKAGES" != 0 ]]; then
-  declare -a COMMAND_ARR=("fpm" "--maintainer=Ward Vandewege <ward at curoverse.com>" "--vendor='Curoverse, Inc.'" "--url='https://arvados.org'" "--description='Arvados API server - Arvados is a free and open source platform for big data science.'" "--license='GNU Affero General Public License, version 3.0'" "-s" "dir" "-t" "$FORMAT" "-n" "${PACKAGE_NAME}-with-bundle" "-v" "$API_VERSION" "--iteration" "$(default_iteration "$PACKAGE_NAME" "$API_VERSION")" "-x" "var/www/arvados-api/current/tmp" "-x" "var/www/arvados-api/current/log" "-x" "var/www/arvados-api/current/vendor/cache/*" "-x" "var/www/arvados-api/current/coverage" "-x" "var/www/arvados-api/current/Capfile*" "-x" "var/www/arvados-api/current/config/deploy*" "--after-install=$RUN_BUILD_PACKAGES_PATH/arvados-api-server-extras/postinst.sh" "$WORKSPACE/services/api/=/var/www/arvados-api/current" "$RUN_BUILD_PACKAGES_PATH/arvados-api-server-extras/arvados-api-server-upgrade.sh=/usr/local/bin/arvados-api-server-upgrade.sh" "$WORKSPACE/agpl-3.0.txt=/var/www/arvados-api/current/agpl-3.0.txt")
-
-  debug_echo -e "\n${COMMAND_ARR[@]}\n"
-
-  FPM_RESULTS=$("${COMMAND_ARR[@]}")
-  FPM_EXIT_CODE=$?
-  fpm_verify $FPM_EXIT_CODE $FPM_RESULTS
-fi
-
-# Build the 'bare' package without vendor/bundle.
-declare -a COMMAND_ARR=("fpm" "--maintainer=Ward Vandewege <ward at curoverse.com>" "--vendor='Curoverse, Inc.'" "--url='https://arvados.org'" "--description='Arvados API server - Arvados is a free and open source platform for big data science.'" "--license='GNU Affero General Public License, version 3.0'" "-s" "dir" "-t" "$FORMAT" "-n" "${PACKAGE_NAME}" "-v" "$API_VERSION" "--iteration" "$(default_iteration "$PACKAGE_NAME" "$API_VERSION")" "-x" "var/www/arvados-api/current/tmp" "-x" "var/www/arvados-api/current/log" "-x" "var/www/arvados-api/current/vendor/bundle" "-x" "var/www/arvados-api/current/vendor/cache/*" "-x" "var/www/arvados-api/current/coverage" "-x" "var/www/arvados-api/current/Capfile*" "-x" "var/www/arvados-api/current/config/deploy*" "--after-install=$RUN_BUILD_PACKAGES_PATH/arvados-api-server-extras/postinst.sh" "$WORKSPACE/services/api/=/var/www/arvados-api/current" "$RUN_BUILD_PACKAGES_PATH/arvados-api-server-extras/arvados-api-server-upgrade.sh=/usr/local/bin/arvados-api-server-upgrade.sh" "$WORKSPACE/agpl-3.0.txt=/var/www/arvados-api/current/agpl-3.0.txt")
-
-debug_echo -e "\n${COMMAND_ARR[@]}\n"
-
-FPM_RESULTS=$("${COMMAND_ARR[@]}")
-FPM_EXIT_CODE=$?
-fpm_verify $FPM_EXIT_CODE $FPM_RESULTS
-
-# API server package build done
+handle_rails_package arvados-api-server "$WORKSPACE/services/api" \
+    "$WORKSPACE/agpl-3.0.txt" --url="https://arvados.org" \
+    --description="Arvados API server - Arvados is a free and open source platform for big data science." \
+    --license="GNU Affero General Public License, version 3.0"
 
 # Build the workbench server package
+(
+    set -e
+    cd "$WORKSPACE/apps/workbench"
 
-cd "$WORKSPACE/apps/workbench"
-
-WORKBENCH_VERSION=$(version_from_git)
-PACKAGE_NAME=arvados-workbench
-
-if [[ ! -d "$WORKSPACE/apps/workbench/tmp" ]]; then
-  mkdir $WORKSPACE/apps/workbench/tmp
-fi
-
-# We need to bundle to be ready even when we build a package without vendor directory
-# because asset compilation requires it.
-bundle install --path vendor/bundle >"$STDOUT_IF_DEBUG"
+    # We need to bundle to be ready even when we build a package without vendor directory
+    # because asset compilation requires it.
+    bundle install --path vendor/bundle >"$STDOUT_IF_DEBUG"
 
-/usr/bin/git rev-parse HEAD > git-commit.version
+    # clear the tmp directory; the asset generation step will recreate tmp/cache/assets,
+    # and we want that in the package, so it's easier to not exclude the tmp directory
+    # from the package - empty it instead.
+    rm -rf tmp
+    mkdir tmp
 
-# clear the tmp directory; the asset generation step will recreate tmp/cache/assets,
-# and we want that in the package, so it's easier to not exclude the tmp directory
-# from the package - empty it instead.
-rm -rf $WORKSPACE/apps/workbench/tmp/*
+    # Set up application.yml and production.rb so that asset precompilation works
+    \cp config/application.yml.example config/application.yml -f
+    \cp config/environments/production.rb.example config/environments/production.rb -f
+    sed -i 's/secret_token: ~/secret_token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/' config/application.yml
 
-# Set up application.yml and production.rb so that asset precompilation works
-\cp config/application.yml.example config/application.yml -f
-\cp config/environments/production.rb.example config/environments/production.rb -f
-sed -i 's/secret_token: ~/secret_token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/' config/application.yml
+    RAILS_ENV=production RAILS_GROUPS=assets bundle exec rake assets:precompile >/dev/null
 
-RAILS_ENV=production RAILS_GROUPS=assets bundle exec rake assets:precompile >/dev/null
+    # Remove generated configuration files so they don't go in the package.
+    rm config/application.yml config/environments/production.rb
+)
 
 if [[ "$?" != "0" ]]; then
   echo "ERROR: Asset precompilation failed"
   EXITCODE=1
+else
+  handle_rails_package arvados-workbench "$WORKSPACE/apps/workbench" \
+      "$WORKSPACE/agpl-3.0.txt" --url="https://arvados.org" \
+      --description="Arvados Workbench - Arvados is a free and open source platform for big data science." \
+      --license="GNU Affero General Public License, version 3.0"
 fi
 
-cd $WORKSPACE/packages/$TARGET
-
-# This is the complete package with vendor/bundle included.
-# It's big, so we do not build it by default.
-if [[ "$BUILD_BUNDLE_PACKAGES" != 0 ]]; then
-
-  declare -a COMMAND_ARR=("fpm" "--maintainer=Ward Vandewege <ward at curoverse.com>" "--vendor='Curoverse, Inc.'" "--url='https://arvados.org'" "--description='Arvados Workbench - Arvados is a free and open source platform for big data science.'" "--license='GNU Affero General Public License, version 3.0'" "-s" "dir" "-t" "$FORMAT" "-n" "${PACKAGE_NAME}-with-bundle" "-v" "$WORKBENCH_VERSION" "--iteration" "$(default_iteration "$PACKAGE_NAME" "$WORKBENCH_VERSION")" "-x" "var/www/arvados-workbench/current/log" "-x" "var/www/arvados-workbench/current/vendor/cache/*" "-x" "var/www/arvados-workbench/current/coverage" "-x" "var/www/arvados-workbench/current/Capfile*" "-x" "var/www/arvados-workbench/current/config/deploy*" "--after-install=$RUN_BUILD_PACKAGES_PATH/arvados-workbench-extras/postinst.sh" "$WORKSPACE/apps/workbench/=/var/www/arvados-workbench/current" "$RUN_BUILD_PACKAGES_PATH/arvados-workbench-extras/arvados-workbench-upgrade.sh=/usr/local/bin/arvados-workbench-upgrade.sh" "$WORKSPACE/agpl-3.0.txt=/var/www/arvados-workbench/current/agpl-3.0.txt")
-
-  debug_echo -e "\n${COMMAND_ARR[@]}\n"
-
-  FPM_RESULTS=$("${COMMAND_ARR[@]}")
-  FPM_EXIT_CODE=$?
-  fpm_verify $FPM_EXIT_CODE $FPM_RESULTS
-fi
-
-# Build the 'bare' package without vendor/bundle.
-
-declare -a COMMAND_ARR=("fpm" "--maintainer=Ward Vandewege <ward at curoverse.com>" "--vendor='Curoverse, Inc.'" "--url='https://arvados.org'" "--description='Arvados Workbench - Arvados is a free and open source platform for big data science.'" "--license='GNU Affero General Public License, version 3.0'" "-s" "dir" "-t" "$FORMAT" "-n" "${PACKAGE_NAME}" "-v" "$WORKBENCH_VERSION" "--iteration" "$(default_iteration "$PACKAGE_NAME" "$WORKBENCH_VERSION")" "-x" "var/www/arvados-workbench/current/log" "-x" "var/www/arvados-workbench/current/vendor/bundle" "-x" "var/www/arvados-workbench/current/vendor/cache/*" "-x" "var/www/arvados-workbench/current/coverage" "-x" "var/www/arvados-workbench/current/Capfile*" "-x" "var/www/arvados-workbench/current/config/deploy*" "--after-install=$RUN_BUILD_PACKAGES_PATH/arvados-workbench-extras/postinst.sh" "$WORKSPACE/apps/workbench/=/var/www/arvados-workbench/current" "$RUN_BUILD_PACKAGES_PATH/arvados-workbench-extras/arvados-workbench-upgrade.sh=/usr/local/bin/arvados-workbench-upgrade.sh" "$WORKSPACE/agpl-3.0.txt=/var/www/arvados-workbench/current/agpl-3.0.txt")
-
-debug_echo -e "\n${COMMAND_ARR[@]}\n"
-
-FPM_RESULTS=$("${COMMAND_ARR[@]}")
-FPM_EXIT_CODE=$?
-fpm_verify $FPM_EXIT_CODE $FPM_RESULTS
-
-# Workbench package build done
 # clean up temporary GOPATH
 rm -rf "$GOPATH"
 
diff --git a/jenkins/run-library.sh b/jenkins/run-library.sh
index 32a6099..623e844 100755
--- a/jenkins/run-library.sh
+++ b/jenkins/run-library.sh
@@ -114,6 +114,64 @@ default_iteration() {
     echo $iteration
 }
 
+_build_rails_package_scripts() {
+    local pkgname="$1"; shift
+    local destdir="$1"; shift
+    local srcdir="$RUN_BUILD_PACKAGES_PATH/rails-package-scripts"
+    for scriptname in postinst prerm postrm; do
+        cat "$srcdir/$pkgname.sh" "$srcdir/step2.sh" "$srcdir/$scriptname.sh" \
+            >"$destdir/$scriptname" || return $?
+    done
+}
+
+handle_rails_package() {
+    local pkgname="$1"; shift
+    local srcdir="$1"; shift
+    local license_path="$1"; shift
+    local scripts_dir="$(mktemp --tmpdir -d "$pkgname-XXXXXXXX.scripts")" && \
+    local version_file="$(mktemp --tmpdir "$pkgname-XXXXXXXX.version")" && (
+        set -e
+        _build_rails_package_scripts "$pkgname" "$scripts_dir"
+        cd "$srcdir"
+        mkdir -p tmp
+        version_from_git >"$version_file"
+        git rev-parse HEAD >git-commit.version
+        if [[ "$BUILD_BUNDLE_PACKAGES" != 0 ]]; then
+            bundle install --path vendor/bundle >"$STDOUT_IF_DEBUG"
+        fi
+    )
+    if [[ 0 != "$?" ]] || ! cd "$WORKSPACE/packages/$TARGET"; then
+        echo "ERROR: $pkgname package prep failed" >&2
+        rm -rf "$scripts_dir" "$version_file"
+        EXITCODE=1
+        return 1
+    fi
+    local railsdir="/var/www/${pkgname%-server}/current"
+    local -a pos_args=("$srcdir/=$railsdir" "$pkgname" "Curoverse, Inc." dir
+                       "$(cat "$version_file")")
+    local license_arg="$license_path=$railsdir/$(basename "$license_path")"
+    # --iteration=3 accommodates the package scripts change from #8014.
+    local -a switches=(--iteration=3
+                       --after-install "$scripts_dir/postinst"
+                       --before-remove "$scripts_dir/prerm"
+                       --after-remove "$scripts_dir/postrm")
+    # For some reason fpm excludes need to not start with /.
+    local exclude_root="${railsdir#/}"
+    # .git and packages are for the SSO server, which is built from its
+    # repository root.
+    for exclude in .git packages tmp log coverage \
+                        vendor/cache/\* Capfile\* config/deploy\*; do
+        switches+=(-x "$exclude_root/$exclude")
+    done
+    fpm_build "${pos_args[@]}" "${switches[@]}" \
+              -x "$exclude_root/vendor/bundle" "$@" "$license_arg"
+    if [[ "$BUILD_BUNDLE_PACKAGES" != 0 ]]; then
+        posargs[1]="$pkgname-with-bundle"
+        fpm_build "${pos_args[@]}" "${switches[@]}" "$@" "$license_arg"
+    fi
+    rm -rf "$scripts_dir" "$version_file"
+}
+
 # Build packages for everything
 fpm_build () {
   # The package source.  Depending on the source type, this can be a

-----------------------------------------------------------------------


hooks/post-receive
--