There's really nothing to hide here, and installation might fail
if the cache is not readable:
W: Can't drop privileges for downloading as file '/var/cache/apt/archives/partial/libexpat1_2.2.0-1_amd64.deb' couldn't be accessed by user '_apt'. - pkgAcquire::Run (13: Permission denied)
We need to do some buffering here, because the files we are hashing can be gigabytes
in size, but Python loops are slow, so it's better to use a larger buffer.
mkosi: extend complete_step with customizable end message
A context manager cannot see any values from the block directly, so
a mutable object (list) is used to pass the state to format the final message.
This isn't entirely elegant, but I think it is worth it, because it allows
the opening and closing messages to be specified next to one another and makes
things a bit more concise and consistent.
This adds a new switch --verity. When passed the root partition will be
complemented by a dm-verity partition, and the root hash is written to a
<image>.roothash file, as well as printed to the status output.
If this mode is enabled the partition UUID of the root partition is
changed to the first 128bit of the top-level hash, and the partition
UUID of the verity partition is changed to the second (and final) 128bit
of the top-level hash (assuming sha256 is used as hash algorithm, which
is the default). This means the two partitions can be easily determined
from the specification of the roothash alone. Since both the root
partition and the verity partition in this case are read-only and the
roothash describes both it's a good candidate for using as partition
UUID.
The partition type UUID of the verity partition is initialized to a new
set of UUIDs that match the existing per-architecture root partition
type UUIDs, that I generated randomly.
mkosi: if we build a read-only image, use nspawn's --overlay= switch to make /root/src writable
This way, we can build on the source tree even if the disk image is
read-only. This primarily useful for squashfs where the file system
can#t be made writable even if we wanted to. We turn this on for all
kind of read-only images however, to keep the codepaths similar, and to
isolate the build artifacts from the disk image we build from.
This makes use of the new nspawn --overlay=+/root/src::/root/src syntax
added by #4694.
When the commands fail, it is useful to see the their error output.
In the normal case they don't print anything, so it should be OK
to just remove the redirection.
THis adds a new type raw_squashfs that refers to a GPT disk image with a
compressed root file system as squashfs. Note that directories such as
/home and /srv are left ext4, as they generally are supposed to be
writable, if configured.
Images made like this are particularly useful with nspawn's --volatile=
switch which permits ready-only root images, with writable /var.
mkosi: make sure to create /root/dest when prepping image
if we create a read-only image we might not be able to rely on nspawn's
automatic creation of the dir due to --bind=. Hence, let's create the
dir early on, so that --bind= can just mount things there, and doesn't
have to create the dir explicitly.
mkosi: make sure /run and /tmp are empty in the disk image
Let's mount a tmpfs to /run and /tmp while we put together the image, so
that anything the install scripts install there does not end up in the
disk image.
Jonathan Groth [Tue, 25 Oct 2016 23:45:36 +0000 (19:45 -0400)]
README: ensure fedora is distro used in directory example (#33)
If "-d" is not used, distribution is autodetected. This line was supposed to install Fedora though,
so add "-d Fedora" so no autodetection is performed.
Felipe Sateler [Wed, 12 Oct 2016 13:58:02 +0000 (10:58 -0300)]
debian: Use apt for installing extra packages
Debootstrap does not have a proper dependency resolver, so installing
extra stuff with it will cause conflicts. For example, installing
libpam-systemd will bring in systemd-shim as first preference, which
conflicts with systemd-sysv. Instead, only install the base system with
debootstrap, and then use apt to install the extra packages.
Fix argument parsing for --boolean and --use-git-files
bool('0') evaluates to True, so type=bool does not work as expected.
It is necessary to use a helper function which converts strings to
True/False as expected.
README: tweak qemu invocation to avoid warning, recommend edk2-ovmf
WARNING: Image format was not specified for 'image.raw' and probing
guessed raw. Automatically detecting the format is dangerous
for raw images, write operations on block 0 will be restricted.
Specify the 'raw' format explicitly to remove the restrictions.
In a git repo, do not copy files that git itself would ignore
The file list to copy is generated using git ls-files --other --cached,
i.e. anything in git ignore lists is ignored.
Without that, mkosi chokes on the test/sys directory in systemd source
tree that is generated as part of tests. I think the new behaviour is
a good default, since most of the times people are going to be running
this from a git tree anyway.
Also skip .git directory by default.
This requires mkosi.build to be updated to remove 'git clean …'.
- no spaces around parameter assignment in function calls
- avoid unneeded concatenation in subprocess.run calls
- division operator always uses floats, no need to cast
- use os.makedirs(…, exist_ok=True) instead of catching exception
- use .get instead of catching exception
Fixed a few identation patterns by adding/removing new lines here and there.
There were a lot of cases where I didn't know how to proceed in order to make indentation more consistent. I'd like to suggest
keeping to a coding standard. For python, there is pip8.
You could use a tox.ini to configure it and run it. Maybe, even, add a git-hook to run it and prevent non-compilant code from making
it into the repo.
projects / thirdparty / mkosi.git / log
