Mount over /etc/passwd when building an image and running build script
Various tools parse /etc/passwd, so let's make sure it contains the
expected lines when building an image. Also, when running the build
script, mount over /etc/passwd in the image as various build tools
will also query the current user in /etc/passwd (e.g. the kernel's
build script runs "whoami"). Also add a root entry to the /etc/passwd
we generate so both the user running mkosi and root are covered.
Currently we only clean up /work if the build script succeeds.
However, we have to always clean up /work since we don't make a
copy of the build overlay so let's make sure we do that by using
a trap instead of only cleaning up if a script succeeds.
Let's also make sure that we don't fail if /work already exists and
make sure that if gets the right permissions, even if it already
exists.
We want to allow all users to access /work, so let's create it with
relaxed permissions. Let's also make sure we clean up the /work
directory after bwrap exits, so that whatever we do in bwrap doesn't
affect the cleanup of /work.
Don't skip UKI generation when building a directory image
When building a cpio/UKI image, it doesn't generally make sense to
generate a UKI to put inside the cpio/UKI. This isn't entirely true
for directory images though, it could be that the directory image
is intended to be packed up as some kind of disk image later, so
let's not skip UKI generation automatically when building a directory
image.
Pass split initrd as -initrd if it exists with directory image
When we're booting a directory image, direct boot only works if the
kernel has the virtiofs driver builtin. Since this is not the case
for distribution kernels, let's make sure we pass the initrd to qemu
as well if one exists so that booting straight into a virtiofs can
also work with distro kernels provided an initrd is available.
Using virtiofsd, we can boot straight into a virtiofs instance of
a directory image. This does require the virtiofsd instance to run
as (fake) root so we can't switch to the user running mkosi anymore
when running unprivileged but that shouldn't be a problem.
This also only works with kernels that have the virtiofs driver
builtin which I don't think is the case in any major distros yet.
- ip= is also parsed by the kernel and can cause significant boot
delays. We can avoid these delays by passing ip=none as the final
value which doesn't affect network-generator but does disable the
kernel auto-probing.
- Pull in network.target instead of network-online.target. This
makes sure that systemd-networkd is started without introducing
boot delays because we're waiting for an IP address to appear.
Let's allow mounting various directories into containers/VMs that
we run using a new RuntimeTrees= option. For containers, we use
nspawn's --bind option. For VMs, we use virtiofs along with the
virtiofsd project.
When using a packaged mkosi with its resources in /usr, using a
tools tree breaks setting up autologin as the resources can't be loaded
anymore after mounting the tools tree. Let's fix the problem by inlining
the resources so they're immediately loaded. This isn't a problem
for the mkosi.md resource as it is never loaded after mounting a
tools tree.
ruff [1] is a new very fast linter that combines rules from many commonly used
linters like pyflakes, isort or pyupgrade.
This commit uses the rules from pycodestyle (enabeled by default), pyflakes,
isort and pyupgrade and reintroduces the 119 character line length limit that
was used in the past with black and flake8, but was lost when black was disabled.
Georges Discry [Fri, 15 Sep 2023 20:01:26 +0000 (22:01 +0200)]
Warn when a setting is in the wrong section
Except for the `[Match]` section, a setting can be set in any of the
valid sections because the actual section is ignored. This fuzziness
works because each setting is used in only one section so there is not
conflict.
Instead of silently parsing such a file, a warning is now displayed with
a hint on how to fix it. In the future, this could become an error.
Make sure the root directory is a regular directory if Overlay= is enabled
overlayfs combined with a btrfs subvolume as the upperdir results in
EXDEV when trying to access files from a lowerdir, so let's make sure
we use a regular directory when Overlay= is enabled.
If we replace /tmp, we'll also make any directories located in /tmp
inaccessible, e.g. the workspace directory. Work around the problem
by reusing the host's /tmp.
207af68047ce22777b06878b7efe77491a7c4108 broke backwards-compat. mkosi-initrd
used a call like this:
mkosi --default /usr/lib/mkosi-initrd/fedora.mkosi --finalize-script=/usr/lib/mkosi-initrd/mkosi.finalize --image-version=6.5.0-0.rc7.20230821gitf7757129e3de.50.fc39.x86_64 --environment=KERNEL_VERSION=6.5.0-0.rc7.20230821gitf7757129e3de.50.fc39.x86_64 -o /tmp/kernel-install.staging.JEzApD/initrd
which is now refused with:
/tmp/initrd is not a valid filename
which is not very clear, because "/tmp/initrd" is an OK filename.
Let's make the error message very clear about what is wrong.
Since we are defaulting to testing for Debian tools trees, we will always fight
testing being occasionally broken, e.g. when packages disappear because their
newer versions can't transition from unstable.
ToolsTreePackages= adds the ability to keep using a default tools tree, but add
custom packages on top.
This matches against the systemd version on the host. This is
useful for conditionally using a tools tree if the systemd version
on the host is too old.
This requires two things:
1. We need to generate a split initrd again to pass to -initrd
2. We need to synthesize a root= argument as we can't rely on
gpt-auto-generator since we're not using EFI.
We move the partition and root= specific stuff to a new file
partition.py so we can access it from qemu.py as well.
We also introduce extract_pe_section() since we now use the logic
twice.
Let's introduce a new "auto" mode where we decide the firmware
based on whether we built a cpio image or a disk image. Let's also
use this as the new default.
Install ca-certificates in tools tree and make sure it's used
Too old ca-certificates on the host can cause package manager failures
when using a tools tree, so let's install ca-certificates into the
tools tree and make sure it is used.
Make the empty string reset settings to their default value
If the empty string is assigned, we should make sure the setting
is assigned its default value so let's make sure we return None in
that case after all
We also simplify the match callbacks to not take optional values
anymore. If the value is set to None, then we automatically fail
the match.
This causes issues on CentOS Stream 8 with errors about not being
able to find builtin modules.
Aside from the issues, running modinfo on builtin modules also does
not make a lot of sense. We run modinfo to fetch module and firmware
dependencies, but a builtin module that has non-builtin module
dependencies is not really valuable because the dependent module has
to be loaded from disk then. The same goes for firmware dependencies.
Instead of requiring users to always set up a tools tree preset, let's
allow specifying "default" as the tools tree to have mkosi build a default
tools tree itself. This default tools tree includes all the software that
might be necessary to build an image (excluding software that might be
required by various user scripts).
For distributions that do not have a rolling release variant, we use the
closest matching distribution. e.g. for CentOS, we use Fedora and for
Ubuntu we use Debian.
Only pass extra tools to ukify when not using tools tree
If we're using a tools tree, we don't want to use any binaries
specifed in extra search paths as they will very likely be incompatible
with the tools tree being used.
projects / thirdparty / mkosi.git / log
