Deniz Adrian [Wed, 23 Jul 2025 20:04:53 +0000 (22:04 +0200)]
ensure builds with cache over device boundaries
when running mkosi with the default cache dir/XDG_CACHE_HOME on a
different device than the mkosi working directory, mkosi falls back to
trying to copy the cache using `copy_tree` from tree.py.
the cache contains symlinks which are pointing to files on the host:
e.g. `mkosi.cache/debian...cache/usr/bin/mt -> /etc/alternatives/mt`
`os.listxattr()` defaults to `follow_symlinks=True`, which leads to
`FileNotFoundError`s if the files don't exist on the host, which stops
the build.
this patch ignores symlinks, but feels like a workaround, as our
assumption would be that such absolute links should not be traversed
outside the chroot in the first place.
Change UnifiedKernelImages to enum and accept signed/unsigned
With custom firmware we enroll our keys in db, so local UKIs can be
built and there's no need to fail the build. Many distributions
ship signed bootloaders, but they still don't ship UKIs.
Add an enum and a parser (to keep backward compat), and if set to
unsigned build locally instead of failing when the bootloader is
signed.
hpet is an emulated clocksource that is generally discouraged in favor
of kvm-clock or tsc for virtual machines. While mkosi's virtual machines
already use kvm-clock, leaving hpet enabled causes qemu on the host to
consume a non-trivial amount of cpu, so let's disable the hpet feature since
we're not making use of it anyway.
EDK2 nowadays does provide secureboot for arm. Not only that, TPM2 support is
only enabled in builds that enable secure boot, probably because it's all
part of the TCG modules.
Default to uefi_secure_boot on arm too, like x86.
Also do not pass qemu x86-only configuration options that break booting
arm.
nfs-utils-2.8.4 will provide its own nfsroot-generator [1] to allow mounting the
real rootfs via NFSv4, so this initrd profile will enable this feature.
mkosi-tools: make sure p11-kit dir exists when configuring module
Fixes this failure, since I guess the dir may not exist:
‣ Running prepare script /tmp/tmphh1uwz2a/resources/mkosi-tools/mkosi.prepare…
/work/prepare: line 4: /buildroot/usr/share/p11-kit/modules/opensc.module: No such file or directory
Do not try to install packages that are listed in RemovePackages=
This allows using RemovePackages= in mkosi.local.conf to prevent
certain packages listed in the regular configuration from being
installed in the first place.
We also add RemovePackages= to the cache manifest because it now
affects the cached images.
opensuse: pull in grep/gzip/xz explicitly to avoid busybox in main image
Problem: 1: the installed busybox-xz-1.37.0-34.1.noarch conflicts with 'xz' provided by the to be installed xz-5.8.1-1.1.aarch64
Solution 1: deinstallation of busybox-xz-1.37.0-34.1.noarch
Solution 2: do not install xz-5.8.1-1.1.aarch64
It's both shorter, and doesn't give the wrong impression that this
is about security sandboxing, so let's rename the sandbox name to
just box. Keep the old name as well of course for compat.
Currently, if /work does not exist, we go into the exception handler which
doesn't do anything if the errno is ENOENT, even though we still need to
remove the parent directory.
If we're running inside mkosi sandbox, we don't parse the default
tools tree configuration, which this test depends on, so skip it
when running in the sandbox.
DaanDeMeyer [Mon, 30 Jun 2025 21:38:01 +0000 (23:38 +0200)]
mkosi-tools: Make sure opensc module is registered with p11-kit
Otherwise openssl will fail to load keys off a yubikey when using
pkcs11-provider. For more discussion and why this isn't the default
everywhere, see https://gitlab.archlinux.org/archlinux/packaging/packages/opensc/-/issues/2.
Daan De Meyer [Wed, 25 Jun 2025 10:47:56 +0000 (12:47 +0200)]
sandbox: Work around extra file descriptor opened by importing ctypes since python 3.14
Since python 3.14, importing ctypes opens an extra file descriptor which is used to allocate libffi
closures which are in turn used by ctypes to pass python functions as C callback function pointers. We
don't use this functionality, yet the file descriptor is still opened and messes with the file descriptor
packing logic since the file descriptor to libffi will be passed as a packed file descriptor to the
executable we're invoking. To avoid that from happening, we close libffi's file descriptor after importing
ctypes.
See https://github.com/python/cpython/issues/135893.
Luca Boccassi [Sat, 21 Jun 2025 16:54:48 +0000 (17:54 +0100)]
mkosi-obs: support splitting out and compressing partitions
Need to recompress the verity-sig partition after creating it,
and deleting the non-compressed split out partitions that are
already present as compressed but that sd-repart re-creates
when doing the signature attach operation.
Luca Boccassi [Sat, 21 Jun 2025 16:53:39 +0000 (17:53 +0100)]
compress: do not attempt to compress skipped partitions
When doing offline verity signing, split partitions and compression are
enabled, we attempt to compress a non-existing partition (verity-sig)
which will be created only later.
Do not attempt to compress partitions that are marked to be skipped by
repart.
Daan De Meyer [Fri, 20 Jun 2025 08:46:12 +0000 (10:46 +0200)]
Ensure directories exist before running sync scripts
run_sync_scripts() assumes the workspace directory exists but we only
create it later on at the moment. Let's create directories before running
sync scripts to fix this issue.
Daan De Meyer [Thu, 29 May 2025 14:20:54 +0000 (16:20 +0200)]
Bind mount /etc from tools tree into relaxed sandbox
Config from /etc often references stuff in /usr. Two examples I've
encountered are shell config from /etc/profile and dnf5 blowing up
when there's plugin configuration in /etc without the corresponding
plugin being installed.
To work around such issues, let's use /etc from the tools tree in the
relaxed sandbox instead of /etc from the host. This also saves the user
from having to create directories in their host's /etc to be able to use
mkosi sandbox.
systemd-boot-efi is only available for EFI architectures, but
we use mkosi to do the integration tests on all architectures,
so this commit breaks them:
5044s E: Package 'systemd-boot-efi' has no installation candidate
Xavier Moffett [Fri, 30 May 2025 00:34:06 +0000 (20:34 -0400)]
fix: Remove `erofs-utils` from initrd
No longer necessary, since fsck is no longer invoked by systemd for
read-only filesystems. This fixes a bug causing the initrd stage
of Ubuntu images to fail.
Daan De Meyer [Wed, 4 Jun 2025 14:04:33 +0000 (16:04 +0200)]
ci: Drop differential shellcheck
We already run shellcheck on all scripts as part of the main CI job,
so we don't really get any benefit of a differential shellcheck as all
our code is already checked by shellcheck so let's just drop it.
Jörg Behrmann [Wed, 4 Jun 2025 09:04:26 +0000 (11:04 +0200)]
resources: add systemd-boot-efi
Since
https://salsa.debian.org/systemd-team/systemd/-/commit/a4bdf87f03e06fe687f0bf7596af31d0f2ac80b1
systemd-boot is not pulled in automatically by systemd-boot anymore
Daan De Meyer [Thu, 29 May 2025 08:36:29 +0000 (10:36 +0200)]
mkosi-tools: Introduce debug profile and move perf to it
perf pulls in a ton of dependencies (> 100 extra packages on Fedora).
Let's introduce a separate debug profile and move perf to it to avoid
everyone having to pull in all these packages for a tool they most likely
won't use.
Daan De Meyer [Thu, 29 May 2025 18:01:16 +0000 (20:01 +0200)]
ci: Use ext4 temporarily
The commit causing https://lore.kernel.org/linux-fsdevel/20250115185608.GA2223535@zen.localdomain/T/#u
got backported to the ubuntu stable kernel. While it has been reverted
upstream, the revert still hasn't reached the ubuntu stable kernel,
so let's use ext4 temporarily until that's the case.
Daan De Meyer [Wed, 28 May 2025 11:27:10 +0000 (13:27 +0200)]
Check that commit exists in config_parse_minimum_version()
merge-base will blow up when given a commit that does not exist in
the checked out repository, so let's check that first before checking
whether the currently checked out commit has the minimum version one as
its ancestor.
Daan De Meyer [Tue, 27 May 2025 12:11:13 +0000 (14:11 +0200)]
mkosi-initrd: Optionally match t64 suffix for tss2 libraries
On debian, these libraries have a t64 suffix on arm for "reasons".
Let's take that into account by optionally matching a t64 suffix for
these libraries.
Daan De Meyer [Mon, 26 May 2025 21:02:10 +0000 (23:02 +0200)]
sandbox: Support using mkosi-sandbox as a library
Let's allow using mkosi-sandbox to create an in process sandbox by
not taking a command line to execute if mkosi-sandbox was itself
imported and not executed.
If we were imported, also don't do any print()'s to behave like a
proper library.
Daan De Meyer [Tue, 27 May 2025 09:00:07 +0000 (11:00 +0200)]
Enforce C.UTF-8 locale for all commands we run
So this is a shitty situation either way. We generally have no idea
which locales will be available in the tools tree. Most likely, it'll
just be the C.UTF-8 one. In that case, using the locale environment
variables from the host is pointless and leads to annoying errors from
lots of tools.
We could make sure all locales are installed but glibc-all-langpacks is
> 200M installed size on Fedora which feels like too much. So let's
instead always use C.UTF-8, it's not like mkosi itself is locale aware
anyway.
Daan De Meyer [Mon, 26 May 2025 15:01:25 +0000 (17:01 +0200)]
Serialize pid in state and check if still exists on load
It happens often enough that mkosi is SIGKILLed and doesn't get to
remove the state file, causing it to leak and cause issues. Let's
serialize the pid of the mkosi process to the state file and check
if it is still running on load.
projects / thirdparty / mkosi.git / log
