from mkosi.kmod import gen_required_kernel_modules, process_kernel_modules
from mkosi.log import ARG_DEBUG, complete_step, die, log_step
from mkosi.manifest import Manifest
-from mkosi.mounts import mount_overlay, mount_passwd, mount_usr
+from mkosi.mounts import mount, mount_overlay, mount_passwd, mount_usr
from mkosi.pager import page
from mkosi.qemu import copy_ephemeral, run_qemu, run_ssh
from mkosi.run import become_root, bwrap, chroot_cmd, init_mount_namespace, run
return new
+@contextlib.contextmanager
+def mount_tools(tree: Optional[Path]) -> Iterator[None]:
+ if not tree:
+ yield
+ return
+
+ with contextlib.ExitStack() as stack:
+ stack.enter_context(mount_usr(tree))
+
+ # On recent Fedora versions, rpm has started doing very strict checks on GPG certificate validity. To
+ # make these checks pass, we need to make sure a few directories from /etc in the tools tree are
+ # mounted into the host as well. Because the directories might not exist on the host, we mount a
+ # writable directory on top of /etc in an overlay so we can create these mountpoints without running
+ # into permission errors.
+
+ tmp = stack.enter_context(tempfile.TemporaryDirectory(dir="/var/tmp"))
+ stack.enter_context(mount_overlay([Path("/etc")], Path(tmp), Path("/etc"), read_only=False))
+
+ for subdir in ("etc/pki", "etc/ssl", "etc/crypto-policies", "etc/ca-certificates"):
+ if not (tree / subdir).exists():
+ continue
+
+ (Path("/") / subdir).mkdir(parents=True, exist_ok=True)
+ stack.enter_context(mount(what=tree / subdir, where=Path("/") / subdir, operation="--bind", read_only=True))
+
+ yield
+
+
def run_verb(args: MkosiArgs, presets: Sequence[MkosiConfig]) -> None:
if args.verb.needs_root() and os.getuid() != 0:
die(f"Must be root to run the {args.verb} command")
continue
with complete_step(f"Building {config.preset or 'default'} image"),\
- mount_usr(config.tools_tree),\
+ mount_tools(config.tools_tree),\
prepend_to_environ_path(config):
# Create these as the invoking user to make sure they're owned by the user running mkosi.
projects / thirdparty / mkosi.git / commitdiff
