Daan De Meyer [Fri, 10 May 2024 10:55:23 +0000 (12:55 +0200)]
Chroot for depmod and modinfo
modinfo cannot always work with output from newer or different depmod.
Specifically, this fixes the case where modinfo sch_fq_codel fails with
"module not found" on CentOS Stream 9 images built from Fedora 40. When
depmod from Fedora 40 is used, modinfo in the image fails with "module
not found". When depmod from inside the image is used, modinfo succeeds
as expected.
We'd rather not do this but in this case there's no other option.
Daan De Meyer [Fri, 10 May 2024 09:27:50 +0000 (11:27 +0200)]
Only run configure scripts for verbs that need a build
In systemd, we want to use configure scripts to determine whether
qemu was built with support for specific devices and skip running
a test if it wasn't, or otherwise add the device to the qemu arguments.
To make this work, we need to run the configure scripts with the
default tools tree available if one is configured.
Let's change the behavior of configure scripts to only run for verbs
that need a build and run them after building the default tools tree
so that they can be run with the tools tree mounted.
Daan De Meyer [Wed, 8 May 2024 12:41:06 +0000 (14:41 +0200)]
Only use a single default tools tree per build
Currently, if multiple images are defined, each with a default tools
tree, if they use the same distribution, all the various ToolsTreeXXX=
settings for the later images will be ignored since we'll only build
one tools tree.
Also, if any of the images set Incremental=no, we will remove the default
tools tree outputs even if Incremental=yes is enabled for other images.
To keep ourselves sane, let's avoid dealing with multiple defaults tools
trees and only look at the last image to figure out whether we should
build a default tools tree and what to put in it.
Allow the update command to continue downloading data from a repository which changed its information of the release contained in the repository indicating e.g a new major release. APT will fail at the update command for such repositories until the change is confirmed to ensure the user is prepared for the change.
Jörg Behrmann [Tue, 7 May 2024 15:24:52 +0000 (17:24 +0200)]
doc: move [Match] and [Config] section further down
Both topics are more advanced and since the entries in the [Match] section have
the same names as the the things they match, they are the first hit when
searching the document.
Daan De Meyer [Mon, 6 May 2024 15:11:21 +0000 (17:11 +0200)]
Be more conservative in what we copy from package directories
Let's make sure we only copy packages from package directories so
that PackageDirectories= can be pointed at a directory containing
more than just packages without copying everything.
Daan De Meyer [Mon, 6 May 2024 07:05:40 +0000 (09:05 +0200)]
Don't use scopes for virtiofs when using older unshare
unshare 2.37 is still shipped in Ubuntu Jammy and CentOS Stream 9
which doesn't have --map-users= and --map-groups=. In this case, let's
not use scopes for virtiofsd to make sure that booting using virtiofsd
still works.
Also add a missing preexec_fn to become root if we're not using a scope.
To make this work we have to move all the logic to decide whether we use
a scope or not outside of run() as we need to conditionalize other arguments
we provide to run() based on whether we use a scope or not.
--map-users= and --map-groups= were added in util-linux 2.38 but
Ubuntu 22.04 and CentOS Stream 9 only ships util-linux 2.37 so
let's at least make sure --ephemeral keeps working on those
distributions.
Daan De Meyer [Fri, 3 May 2024 21:33:58 +0000 (23:33 +0200)]
qemu: Use systemd-run to allocate scopes
This doesn't drastically change behavior, but will open the way for
adding a RuntimeProperties= setting to allow configuring various
properties of the scope unit.
Since allocating a scope with systemd-run involves communicating with
a daemon running on the host, there's no point in running it from the
sandbox so we run it from the host instead.
Because systemd-run needs to run as the uid that started mkosi, we can't
use preexec_fn anymore to allocate the user namespace for virtiofsd.
Instead, we reimplement what become_root() does on top of unshare and
chain execute into that which then itself chain executes virtiofsd.
Daan De Meyer [Fri, 3 May 2024 14:24:50 +0000 (16:24 +0200)]
qemu: Configure caching properly
For the scratch device, we can use unsafe caching as it's thrown
away immediately after the machine shuts down. For the root disk,
we can use unsafe caching only if --ephemeral is enabled.
The default home directory for system users created with sysusers.d is /.
Which will automatically be mounted inside sync scripts, causing a lot of
headaches, since we're essentially trying to run on the host then.
E.g. /proxy.cacert cannot be created.
Don't look in --extra-search-paths for qemu and virt-fw-vars
These take as input a file that might be in or out of the tools tree.
Because find_ovmf_firmware() will return a file in the tools tree
regardless of whether virt-fw-vars and qemu will be executed on the
host or not, let's disable the --extra-search-paths= integration for
these two for now.
Tobias Fleig [Tue, 26 Mar 2024 12:46:00 +0000 (05:46 -0700)]
Call ukify with --ucode if supported
This is the companion change to https://github.com/systemd/systemd/pull/31872.
If both systemd-stub and ukify are version `256~devel` or greater, mkosi
will put the microcode initrd in the new `.ucode` UKI section by using
the `--ucode` flag in ukify. Otherwise it will put the microcode initrd
as first regular initrd (same as before).
In systemd we want to (optionally) make sure all mkosi output is
written to the meson build directory. To make this work, we want to
write a mkosi.conf to the meson build directory so that developers
can do "mkosi -C build". Currently this doesn't work because "build"
is interpreted as a verb. Let's make sure that doesn't happen.
We need a better solution for this hack but for now this is the best
I can come up with.
Don't build the image automatically for boot/qemu verbs without --force
Let's insist on --force to build the image if boot/qemu are used to
give users an easy way to insist that an image has already been built
when booting it.
mkosi might be invoked from a terminal but redirected to a file, in
that case we should ignore $TERM from the environment, so let's make
sure we handle that properly.
Let's make sure the limits are configured so we can always write at
least 4G of logs. We also enable compact mode again in all cases to
reduce the size used by journal files as for example Github Actions
machines aren't exactly swimming in free space.
(We pick 4G because that's the max journal file size when the compact
mode is used)
(We'll probably have to revisit this again at some point but for now
this should do the trick)
We want to support users writing to these directories from the host
so --cache=always is not an option as that assumes virtiofsd has
exclusive write access.
If we find a binary in any path configured with ExtraSearchPaths=,
we prefer using it over the tools tree.
This commit also gets rid of all the find_binary() for "btrfs" in
tree.py and stops passing in the tools tree to those functions.
Instead, we rely on the new behavior of run() to not fail hard
when check=False and the btrfs binary is not found.
Make check argument apply to whether the command exists
Let's not fail hard when check=False and the command is not found.
This will allow us to avoid having to pass the tools tree path around
in various places.
Let's drop this compat kludge for OpenMandriva. No other distro
does this and we should just assume gnu tar/cpio as the official
API of the tar/cpio binaries.
Switch to reprepro for generating local apt repositories
We don't install dpkg-dev in tools trees anymore to avoid pulling
in perl, which means we don't have access to dpkg-scanpackages in
tools trees anymore.
Instead of adding back dpkg-dev, let's instead switch to reprepro
for generating our local apt repository. It's written in C, packaged
everywhere and has hardly any dependencies.
Same as systemd. While in development we suffix with ~devel. Also
update the do-a-release script to add a second commit to switch back
to ~devel when we do a release.
We keep the old version in pyproject.toml because suffixing with
~devel conflicts with PEP 440 and python tools complain about that.
Add VolatilePackages= and InitrdVolatilePackages= settings
Let's allow configuring packages which should be installed after
running build scripts and which are not cached. This is useful for
installing packages which are built in a build script or which change
often and shouldn't invalidate the cache.
Every part of the default tools tree is cached. Thus, we can check
if the cache is out of date on incremental builds and if it isn't,
just reuse the previous tools tree instead of doing unnecessary work.
Only force repository metadata refresh if -ff was specified
Let's make sure we use the default metadata expiration checks unless
-ff was specified. Apt doesn't support anything like this so we don't
change anything there.
projects / thirdparty / mkosi.git / log
