Daan De Meyer [Wed, 9 Oct 2024 11:51:51 +0000 (13:51 +0200)]
Run various cleanup operations without the base trees mounted
When running cleanup operations just before we finish the build and
we're building with Overlay=yes, we only want the cleanup to apply
to the overlay, not the base trees, so it makes sense to run the
final cleanup operations and the finalize scripts without the base
trees mounted.
This makes using chroot finalize scripts for overlay images impossible
but this shouldn't be a huge issue.
Package removals and selinux relabelling still run with the base trees
mounted because those operations rely on various files included in the
base trees.
Daan De Meyer [Sun, 6 Oct 2024 13:30:57 +0000 (15:30 +0200)]
Define our own config for PE addons and UKI profiles
ukify's config parser uses python's configparser module and as such
suffers from all its issues just like we used to in mkosi. Having ukify
parse the config file also means that we have to make sure any paths
configured in the profile are available in the sandbox.
Instead, let's define our own configs for the PE addons and UKI profiles
so we get to take advantage of our own config file parser and have full
knowledge of all the configured settings so we can mount extra stuff into
the sandbox if needed.
It also gets rid of the hack where we parse ukify's config file to figure
out the command line.
Daan De Meyer [Fri, 4 Oct 2024 14:23:11 +0000 (16:23 +0200)]
Relax read-only mounts even more
Turns out having home directories as a subdirectory of /usr is a thing.
Let's relax the readonly mount requirements even more to make this use
case work as well.
Daan De Meyer [Fri, 4 Oct 2024 12:13:41 +0000 (14:13 +0200)]
Rename Profile= match to Profiles=
Matches related to settings are named after their setting so this
should be Profiles= similarly to the Repositories= match. The old
name will still work as well but we use the new one in docs.
on current Debian stable on gets an error that the package 'ubuntu-keyring'
doesn't have any installable candidates. Moving the inclusion of the package
out of the purview of apt and back into mkosi's fixes this issue.
Daan De Meyer [Wed, 2 Oct 2024 10:26:23 +0000 (12:26 +0200)]
Don't store default kernel command line and credentials in Config
Let's delay calculation of these until the last moment instead of
storing them in the Config object. This makes the summary more succinct
and reduces the amount of work we do to parse the configuration.
OpenSUSE's rpm is not built with the sqlite db backend so let's make
sure the rpm DB can be read inside the image by OpenSUSE's rpm by
forcing the ndb backend to be used.
/var will always be writable in the sandbox so no need to precreate
the sandbox. This also saves us from using an overlayfs mount from
/var in the sandbox as it will be completely empty now.
Unprivileged overlayfs isn't available everywhere (see #3054). So
let's try to accomodate this a little by not using overlayfs for /etc
and /opt from the sandbox tree and instead mounting them read-only
into the sandbox. If required, scripts can still mount an overlayfs
onto these if needed, we just don't do it by default anymore.
This does mean we need to set up /etc with mountpoints and symlinks
beforehand in install_sandbox_trees(), but this shouldn't be a huge
problem.
Don't explicitly bind mount in keyrings from host into sandbox
These are automatically mounted in as part of the tools tree. This
change means they'll always be picked up from the tools tree and won't
take ToolsTreeCertificates= into account anymore, but then keyrings weren't
exactly certificates in the first place, and can still be picked up from
the host by using SandboxTrees=.
This allows users to provide their own keyrings using sandbox trees. Currently
we just overmount the user provided ones with the ones from the host.
We need to make sure /run/pcscd/pcscd.comm is available to make
signing work so let's mount /run/pcscd into the sandbox every time
we're going to sign something if it exists.
The generated root partition needs to be resized on first boot for
the A/B update setup so we have to make sure it's the last one and
give it the same size requirements as the B partition in the image
so it's grown to the same size.
Similarly, we make sure to leave sufficient space for verity hash
data updates. Because this is not the last partition, we can't grow
it on first boot so we leave sufficient room inside the image itself
when building it.
While we're at it we also reorder the settings a bit so things are
more consistent.
Separate the PROFILES variables with spaces instead of commas
Space-separated strings strings are the shell programmers array and therefore
easier to consume. Since profile names are supposed to be space-free, this is a
safe change and for languages with smaller footgun potential it does not make a
difference.
projects / thirdparty / mkosi.git / log
