Let's not rely on tools not writing logs or errors to /dev/stdout
and instead use workdir() as well to mount the required parent
directory into the expected location so the output can be written
there.
Use more directories of sandbox trees in the sandbox
Previously, we only picked up /usr and /etc from the sandbox trees.
Let's make this more generic and pick up a bunch of extra directories
as well. To avoid any changes persisting outside of the sandbox, let's
use overlayfs with a temporary writable directory as the upperdir of the
overlayfs (and make sure we use a tmpfs as the upperdir for /tmp and /run).
Stop using sandbox tree to shovel out list of essential packages
We don't want to persist changes to the sandbox tree so in preparation
for that let's stop using the sandbox tree as a channel to shovel out
the list of essential packages when building debian images.
Now that we don't have to worry anymore about various operations
conflicting with other sandbox mounts, let's always add /var/tmp
to the sandbox again (we originally stopped doing this to make sure
rmtree() could remove directories in /var/tmp).
When we do something where we need to mount the parent directory
because we're creating or deleting a file or directory, let's operate
under /work in the sandbox. Otherwise there's a good chance we'll
end up interfering with regular mounts in the sandbox e.g /var/tmp
when the workspace directory is in /var/tmp.
/etc/pacman.d/gnupg is already made available by mkosi's internal
logic so we don't need to copy it in. This prevents failures when
running unprivileged as /etc/pacman.d/gnupg can have rather strict
permissions.
mkosi-initrd: Only set --cacheonly=metadata when running as root
If we're not running as root, we don't use the host's package cache,
but we still use the host's repositories. It's very unlikely that the
user's default package cache directory will have an up-to-date repository
metadata snapshot, so let's update the repository metadata if we're not
running as root.
The login package as provided by util-linux is 'Protected' but no
longer 'Essential' and that's intentional, so it will not be pulled
in by default. Add it to the list.
For the existing verbs, those are the same. But for a verb with
a dash, which I want to add next, the name has the underscore,
which will not match the verb on the commandline.
Daan De Meyer [Wed, 28 Aug 2024 06:53:57 +0000 (08:53 +0200)]
Don't mount stuff twice from different sources in sandbox
We were mounting /var/tmp and /etc/resolv.conf twice in chroot_cmd(),
let's make sure we avoid doing that by moving the CLI options into
the respective _script_cmd() functions.
Daan De Meyer [Tue, 27 Aug 2024 12:57:48 +0000 (14:57 +0200)]
Use python3 in sandbox if host interpreter is not in /usr
We only mount /usr into the sandbox, so if mkosi is invoked from a
venv we'll fail to execute the apivfs script or chroot script in the
sandbox as it will try to use an interpreter that isn't available.
Let's check if the used interpreter is relative to /usr and only use
it to execute the chroot and apivfs scripts in the sandbox if it is.
The autogenerated help for --distribution/--format/… looks like {a,b,…,} (with
an emtpy arg at the end), and it is not obvious what this means. Describe the
empty args in the man page.
Daan De Meyer [Fri, 23 Aug 2024 18:34:23 +0000 (20:34 +0200)]
Make more trees required
- Tools tree is a universal setting and has to be available at the start
- Sandbox trees are a universal setting and have to be available at the start
- Skeleton trees should be available at the start to make sure caching works
properly
Daan De Meyer [Fri, 23 Aug 2024 17:01:46 +0000 (19:01 +0200)]
Rework repository metadata handling
- Stop copying repository metadata into the image.
This is too fragile to ever work properly. If the image is ever
used as a base tree, the caller would also need the exact same package
manager configuration for this to be remotely useful, as well as constantly
rebuild the image to keep the repository metadata up to date.
- Stop picking up repository metadata from the image
For the same reason, we can't use repository metadata from any
base trees automatically. It should be explicitly provided by the user
along with the required package manager configuration.
- Share the same repository metadata snapshot between the main and subimage
builds
Let's ensure that the main image and all subimages are built of the
exact same repository metadata snapshot. Now that we enforce that all
subimages use the same distro, release, architecture, repositories and
everything else that's package manager related, we can use the same
metadata snapshot for every build.
- Rename package_cache_dir in Context to metadata_dir as there's only
metadata in this directory and never any packages.
Daan De Meyer [Fri, 23 Aug 2024 17:00:09 +0000 (19:00 +0200)]
Do not allow configuring universal collection based settings in subimages
For the next commit, we want to enforce all subimages to use the same
package manager trees, repositories and package directories, so let's
not allow adding any extra of those in subimages anymore.
Daan De Meyer [Fri, 23 Aug 2024 16:44:04 +0000 (18:44 +0200)]
Simplify run_verb() logic
- Handle Verb.clean separately from builds
- Move most checks to the front before we clean up the previous results.
- Get rid of check_outputs()
- If main image needs a build, clean all subimages as well
Daan De Meyer [Thu, 22 Aug 2024 10:10:50 +0000 (12:10 +0200)]
fedora: Get rawhide GPG key from github
fedora.gpg is always out-of-date when rawhide branches, so let's
instead fetch the rawhide key from distribution-gpg-keys on Github
which does seem to get updated before rawhide branches.
Daan De Meyer [Thu, 22 Aug 2024 11:42:20 +0000 (13:42 +0200)]
Move creation of context.root out of Context()
On btrfs systems, we're unnecessarily creating a subvolume only to
remove it again immediately afterwards if we're building from a cached
image. So let's move the creation of root outside of Context() so
we can only create it as a subvolume after we've potentially checked
caches first.
Daan De Meyer [Thu, 22 Aug 2024 11:18:30 +0000 (13:18 +0200)]
Optimize copy_tree() a little
Only run cp_version() if we absolutely need to. If we do a btrfs
snapshot or the destination does not exist or is empty, there's no
need to add --keep-directory-symlink and thus we don't need to run
cp_version() either.
Azure Linux looks a lot like Fedora Linux so we opt to share configuration
between Azure and Fedora/CentOS and inherit the Azure definition from
Fedora.
projects / thirdparty / mkosi.git / log
