.dir-locals specifies "fill-column" as 99 for .py files.
This seems resonable, because then the comments mostly match the
general width of the surrounding code.
dissect: do not attempt to load verity for just-built images
Verity is useful to establish trust at runtime in production
environments where we don't know if a payload is trusted in advance,
but we can implicitly trust the image we just built ourselves, so set
the env vars to disable loading images using verity when building
sub-images
Currently, to boot an image with mkosi qemu after building it with
mkosi build, various settings have to be identical to when mkosi build
was invoked to make sure that mkosi can find the outputs of the previous
build. Because this is rather error prone and annoying, let's introduce
a History= setting to allow mkosi to remember the configuration of the
last build which can then be read again when running a verb that operates
on a built image.
Another case where this is extremely useful is when some part of the
configuration changes every single time, for example if mkosi.version
is an executable script that outputs the current time, which is then
encoded in the output name, we have to remember the previous config,
otherwise mkosi wouldn't be able to find the outputs of the previous
build.
Note that while we load the configuration of the previous build, we
ignore all settings from the [Host] section which we read again from
the configuration files, as the user should be able to change these
without rebuilding the image.
Make JSON loading methods more robust against changes in Config and Args
We don't want failures to load JSON every time we add a new field, so let's
consider every JSON object we read as potentially partial and merge it with
a default instance of Config/Args. Also, sometimes we drop or rename fields
so let's show a proper error in the case that happens.
Let's not rely on tools not writing logs or errors to /dev/stdout
and instead use workdir() as well to mount the required parent
directory into the expected location so the output can be written
there.
Use more directories of sandbox trees in the sandbox
Previously, we only picked up /usr and /etc from the sandbox trees.
Let's make this more generic and pick up a bunch of extra directories
as well. To avoid any changes persisting outside of the sandbox, let's
use overlayfs with a temporary writable directory as the upperdir of the
overlayfs (and make sure we use a tmpfs as the upperdir for /tmp and /run).
Stop using sandbox tree to shovel out list of essential packages
We don't want to persist changes to the sandbox tree so in preparation
for that let's stop using the sandbox tree as a channel to shovel out
the list of essential packages when building debian images.
Now that we don't have to worry anymore about various operations
conflicting with other sandbox mounts, let's always add /var/tmp
to the sandbox again (we originally stopped doing this to make sure
rmtree() could remove directories in /var/tmp).
When we do something where we need to mount the parent directory
because we're creating or deleting a file or directory, let's operate
under /work in the sandbox. Otherwise there's a good chance we'll
end up interfering with regular mounts in the sandbox e.g /var/tmp
when the workspace directory is in /var/tmp.
/etc/pacman.d/gnupg is already made available by mkosi's internal
logic so we don't need to copy it in. This prevents failures when
running unprivileged as /etc/pacman.d/gnupg can have rather strict
permissions.
mkosi-initrd: Only set --cacheonly=metadata when running as root
If we're not running as root, we don't use the host's package cache,
but we still use the host's repositories. It's very unlikely that the
user's default package cache directory will have an up-to-date repository
metadata snapshot, so let's update the repository metadata if we're not
running as root.
The login package as provided by util-linux is 'Protected' but no
longer 'Essential' and that's intentional, so it will not be pulled
in by default. Add it to the list.
For the existing verbs, those are the same. But for a verb with
a dash, which I want to add next, the name has the underscore,
which will not match the verb on the commandline.
Daan De Meyer [Wed, 28 Aug 2024 06:53:57 +0000 (08:53 +0200)]
Don't mount stuff twice from different sources in sandbox
We were mounting /var/tmp and /etc/resolv.conf twice in chroot_cmd(),
let's make sure we avoid doing that by moving the CLI options into
the respective _script_cmd() functions.
Daan De Meyer [Tue, 27 Aug 2024 12:57:48 +0000 (14:57 +0200)]
Use python3 in sandbox if host interpreter is not in /usr
We only mount /usr into the sandbox, so if mkosi is invoked from a
venv we'll fail to execute the apivfs script or chroot script in the
sandbox as it will try to use an interpreter that isn't available.
Let's check if the used interpreter is relative to /usr and only use
it to execute the chroot and apivfs scripts in the sandbox if it is.
The autogenerated help for --distribution/--format/… looks like {a,b,…,} (with
an emtpy arg at the end), and it is not obvious what this means. Describe the
empty args in the man page.
projects / thirdparty / mkosi.git / log
