```
todo += [m for m in depinfo.modules if m not in mods and m in nametofile]
```
`mods` only accumulates modules from previous iterations of the outer while
loop. Within a single iteration, modules in the current batch are added to
mods one at a time as `moddep.items()` is iterated. This means two distinct
failure modes:
1. Cross-dependency within a batch: if modules A and B are both in the current
todo and both depend on X, X passes the m not in mods check when processing
A's deps and again when processing B's (since X hasn't been added to mods
yet). X ends up in todo twice.
2. Intra-batch back-edge: if A depends on B and both are already in the current
todo/moddep, B still passes m not in mods when processing A's dep list,
queuing B for a redundant second modinfo call in the next iteration.
Both boil down to the same root cause: the check doesn't account for modules
currently being processed.
The fix addresses both issues:
1. `m not in moddep.keys()` prevents modules from the current batch being
re-queued into the next iteration's `todo`.
2. Turning`todo` into a set prevents a module from appearing *multiple times*
in the same next `todo`, when two modules in the current batch share a
dependency
Because these duplicates frequently occur in practice, eliminating them
provides an incremental speedup on top of the original optimization
made in GH4092/GH4017.
util: don't drop single-character variable names in read_env_file
The regexp used to parse environment/os-release files required the variable
name to consist of at least two characters ([a-zA-Z_][a-zA-Z_0-9]+), so a line
with a single-character name such as "A=1" or "_=3" did not match and was
silently discarded as a bad line.
Single-character names are valid both in os-release files and in the shell, so
allow them by using '*' instead of '+' for the trailing character class.
Add a regression test for read_env_file covering both single-character and
multi-character variable names.
distribution: report the actual architecture in unsupported-arch errors
When an architecture is not supported by a distribution, the error message
interpolated 'a', which is the result of dict.get(arch) and is therefore always
None on this code path (we only get here when the lookup missed). As a result
the message always read "Architecture None is not supported by ..." instead of
naming the architecture the user actually requested.
Interpolate 'arch' instead, matching what debian.py and kali.py already do.
Affects arch, azure, centos, fedora, mageia, openmandriva, opensuse and
postmarketos.
Sebastian Wick [Mon, 6 Jul 2026 20:41:09 +0000 (22:41 +0200)]
sandbox: handle case where dev node for tty doesn't exist better
In cec6ae1d ("sandbox: handle case where dev node for tty doesn't exist"),
code was added to try to deal with a device node not existing. For whatever
reason, a FileNotFoundError with errno=2 was raised back then, and I get
a more generic OSError with errno=19.
$ python3 -c "import os; os.ttyname(2)"
Traceback (most recent call last):
File "<string>", line 1, in <module>
import os; os.ttyname(2)
~~~~~~~~~~^^^
OSError: [Errno 19] No such device
Martin Pitt [Fri, 26 Jun 2026 09:14:33 +0000 (11:14 +0200)]
tests: Pass --output-directory to vm() and boot()
The integration tests build into a per-test `--output-directory`, but
the verbs that consume the build (vm, boot) did not pass it, so they
recovered the build's configuration from the history in the config
directory. This breaks parallel tests, as they read the history file
from current global file (i.e. whichever build happened to finish last).
This is the tests/__init__.py half of the reverted commit da49fe976.
(That wasn't problematic.)
Martin Pitt [Fri, 26 Jun 2026 08:36:25 +0000 (10:36 +0200)]
config: Isolate build history per output directory
When building into separate output directories (e.g. the integration
test suite running in parallel), all builds shared a single build
history in the config directory. A verb that consumes a previous build
(vm, boot, summary, …) then read back whichever build ran last instead
of the one for the output directory it was pointed at.
To fix that and keep an output directory isolated, store the history in
it as well, and prefer it when given `--output-directory`.
The config directory copy is kept and is still used when no `-O` is
passed, so a consumer that gets the output directory from
`OutputDirectory=` in the configuration keeps working (and the
output-dir lookup falls back to it, status quo ante). This is what
commit da49fe976c73 tried to do, but it stored the history *only* in the
output directory keyed on the CLI value, which broke consumers that take
the output directory from the configuration.
Keying the read on the CLI value and keeping the config-dir copy avoids
that regression. Cover this in the new
`test_history_found_via_configured_output_directory()`.
Martin Pitt [Fri, 26 Jun 2026 08:21:33 +0000 (10:21 +0200)]
tests: Add regression test for build history lookup via configured output dir
A build can be told its output directory on the command line (`-O`) while a
later verb that consumes the build (vm, boot, summary, …) only knows it from
`OutputDirectory=` in the configuration. As long as both point at the same
directory, the consumer must still find the build history the build wrote.
This is what systemd does: its meson build passes `--output-dir`
explicitly, while a developer running `mkosi vm` (without
`--output-dir`) afterwards relies on `OutputDirectory=`. Capture this
behaviour so we don't regress it again.
This broke once in commit da49fe976c ("Put build history into the output
directory"), which keyed the history location on the CLI value only, and
was reverted in commit 582eadee343.
Dara Adib [Fri, 3 Jul 2026 00:52:47 +0000 (20:52 -0400)]
Fix tar exclude patterns for apivfs paths
Add `--anchored` and non-prefixed variants of exclude patterns so
apivfs directories are properly excluded regardless of whether
tar
entries are prefixed with `./`.
Adopt systemd's policy: only human beings can be credited within commit
messages. Drop the previous AI Contribution Disclosure section that
required a Co-Authored-By trailer.
Port the improvements from systemd's claude-review workflow:
- Review the PR through multiple concurrent lenses (correctness, resource
lifetimes, security, API/style, plus PR-specific lenses) instead of one
subagent per commit, with the lenses adapted to mkosi (Python, sandboxing,
package managers, config parsing).
- Add a commit-order.txt manifest so commits are reviewed oldest-first.
- Drop the base64 encoding of summary/comment bodies and collect the result
in a single StructuredOutput call.
- Bump the review model to opus-4-8 at xhigh effort and pin the opus alias.
- Refresh pinned action SHAs and set persist-credentials: false on checkout.
Martin Pitt [Thu, 25 Jun 2026 09:45:27 +0000 (11:45 +0200)]
action: Make apk installation configurable and reliable again
Commit 5ef262bc53c was a quick-fix to unbreak systemd's CI, but it's not
a long-term fix: it makes the apk installation unreliable and
unpredictable.
Revert it, and instead add an explicit `apk` action option to install it
explicitly. As 5ef262bc53c landed, let it default to false (as arguably
it's not needed for most test runs).
Enable it in the test matrix when building a postmarketos tools tree, as
we need `apk` on the Ubuntu host to bootstrap it. For any other test
scenario, apk will be installed into and run from the tools tree.
Daan De Meyer [Wed, 24 Jun 2026 21:08:50 +0000 (21:08 +0000)]
sandbox: Preserve net caps across user namespace before unsharing net
We might not have CAP_NET_ADMIN in the current user namespace, but
acquire_privileges() may set up a new user namespace in which we do.
Pass along the intent to unshare the network namespace so the network
capabilities are preserved, then decide whether we can actually unshare
the network namespace after privileges have been acquired.
Luca Boccassi [Wed, 24 Jun 2026 22:33:53 +0000 (23:33 +0100)]
Revert "Put build history into the output directory"
Breaks the systemd CI, and also seems to make passing --output-directory
mandatory on the command line if it is defined in the config, which is
just horrible UX:
‣ /home/runner/work/systemd/systemd/mkosi/mkosi.local.conf: Setting OutputDirectory specified by specifier '%O' in %O/ovmf_vars_shim.fd is not yet set, ignoring
‣ /home/runner/work/systemd/systemd/mkosi/mkosi.local.conf: Setting OutputDirectory specified by specifier '%O' in %O/ovmf_vars_shim.fd is not yet set, ignoring
‣ Firmware variables file /ovmf_vars_shim.fd does not exist
Martin Pitt [Sun, 14 Jun 2026 12:43:06 +0000 (14:43 +0200)]
Lock the package cache during package manager invocations
The package cache directory is shared between all mkosi builds of the same
distribution (see `Config.package_cache_dir_or_default()`) and is bind mounted
read-write into every package manager sandbox by `mounts()`. When multiple builds
run in parallel, they download packages into it concurrently, which corrupts
in-flight cache files: dnf's rpm gets truncated mid-unpack ("Errors occurred
during transaction"), zypper can't hardlink its preloaded rpm into place ("Can't
hardlink/copy ... .preload/..."), etc.
Observed when running `test_addon` and `test_confext` in parallel: both
build extension images with `--incremental=no --package=lsof`, so they
download lsof into the shared cache at the same time and clobber each
other.
Lock the package cache directory for the duration of every package
manager invocation to serialize writes. Every package manager operation
goes through `sandbox()`, so locking there covers install, sync, and
remove across all package managers.
Builds of different distributions use different cache directories and so
don't contend, and cached/incremental builds that don't invoke the
package manager never take the lock, so parallelism is preserved where
it matters.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Martin Pitt [Sat, 13 Jun 2026 06:31:08 +0000 (08:31 +0200)]
Put build history into the output directory
Running e.g. `test_initrd` and `test_initrd_luks` in parallel fails one of
them with "Image 'main' has not been built yet". The integration tests build
into a per-test `--output-directory`, but `vm()`/`boot()` did not pass it, so
those verbs recovered the build configuration from the *shared* global history
in `<configdir>/.mkosi-private/history/latest.json`. With concurrent builds
that file holds whatever the last build wrote, so a verb reads back another
build's config (e.g. the wrong `Format=`).
Tie the build history to the output directory: when an output directory is
given on the CLI, store and read the history under it instead of in the config
directory. Each build's history is then isolated, and a verb pointed at a
given `--output-directory` reads back exactly that build's configuration. In
the tests, pass `--output-directory` to `vm()` and `boot()` as well.
As a consequence, `mkosi vm` (and the other verbs that consume a previous
build) now require `-O`/`--output-directory` when the build used one. This is
a behaviour change, but unbreaks having more than one output dir.
Note: If a config file sets `OutputDirectory=`, the history continues to
be in the config dir, as before. The computation of the history
directory (necessarily) happens before parsing the config
files/includes. This *only* applies to the CLI option.
Rejected alternatives:
* This cannot be worked around with `--history=no` in the tests': that
only disables *writing* history, not *reading* it, so vm/boot still
pick up a stale (in our setup, empty) `latest.json` and fall back to
the wrong config.
* A dedicated `--history-dir` option would just be redundant with
`--output-dir`.
Martin Pitt [Sat, 13 Jun 2026 05:58:11 +0000 (07:58 +0200)]
tests: Use unique machine names
Without `--machine`, mkosi defaults to name "mkosi". This breaks
parallel test runs. The vsock CID name is derived from the machine
name, so this automatically becomes unique as well.
Martin Pitt [Sat, 13 Jun 2026 03:08:08 +0000 (05:08 +0200)]
tests: Reduce VM RAM size
Run VMs with 1.5 GiB of RAM by default, which is enough for most tests.
This doubles the test density for parallel runs, as GitHub's default
runners have a little less than 4 GiB in total, which could not even fit
two parallel runs before.
The only exception is `test_initrd_luks`: repart's default LUKS2 KDF
(Argon2id) is memory-hard and needs ~1 GiB of RAM just to derive the
key. Run that with 2 GiB as before.
Martin Pitt [Thu, 11 Jun 2026 10:43:25 +0000 (12:43 +0200)]
Don't leak gpg-agent when signing with gpg
mkosi signs SHA256SUMS by running gpg, which autostarts a gpg-agent if none is
running. As mkosi's sandbox has no PID namespace, that agent daemonizes and is
leaked when the sandbox goes away.
This is even worse when running unprivileged, as the leaked agents hold
systemd-nsresourced dynamic UID ranges and eventually exhaust the pool
(`io.systemd.NamespaceResource.NoDynamicRange`). But the process is
leaked either way.
Shut the agent down after signing. Note that this will also kill a
"real" user agent if one was running already; but that is hard/racy to
avoid, and gpg auto-starts a new one anyway.
Martin Pitt [Fri, 19 Jun 2026 04:34:59 +0000 (06:34 +0200)]
ci: Pin openSUSE to second-to-last Tumbleweed snapshot
openSUSE Tumbleweed US mirrors frequently lag behind freshly published
snapshots. On US-based GitHub action runners the geo-redirector routes
to US mirrors that haven't rsync'd the latest snapshot yet, so
zypper/dnf get 404s and timeouts on every mirror and abort. (This never
reproduces in Germany, as the primary mirrors in Nürnberg sync very
quickly.)
Pin the second-to-last published snapshot for openSUSE image builds,
which should have had time to propagate to all mirrors.
Martin Pitt [Sat, 20 Jun 2026 05:13:42 +0000 (07:13 +0200)]
test: Use the main build's snapshot for extension builds
If tests build an image with a particular `Snapshot=` (as the next
commit will do), we need extension builds to
use the same snapshot, so that (1) they match the base image, and (2)
avoid trying to download newer packages from mirrors which don't have
these yet.
Read the snapshot from the main mkosi.local.conf and pass it along in
`ImageConfig`, for the `--directory ...` extension builds in
tests/test_extension.py.
Martin Pitt [Thu, 18 Jun 2026 04:52:39 +0000 (06:52 +0200)]
tests: ignore masked units in check-and-shutdown
Masking lvm2-monitor.service in 899dfbd45 did not actually stop it from
tripping the boot check: a masked unit that udev pulls in when scanning a
disk image's partitions still fails to start and is listed by
`systemctl --failed` with ACTIVE=failed. Masking only changed the LOAD
column from `not-found` to `masked`.
A masked unit failing to start is noise, not a real service failure in the
image, so filter masked units out of the failed-services check.
Also explain mkosi.postinst *why* lvm2-monitor.service even fails in the
first place: It's only installed in the initrd, not the main image. That
may or may not be a bug, but it's uninteresting for the "failed
services?" check.
Martin Pitt [Thu, 18 Jun 2026 04:38:44 +0000 (06:38 +0200)]
curl: Retry on failures
`curl()` is being used for things like fetching Fedora rawhide's GPG
key, opensuse's `/history/latest` or CentOS' `.composeinfo`. These are
all volatile and thus hard to pre-download/cache. But we've seen several
transient download failures like
> curl: (35) Recv failure: Connection reset by peer
Make these more robust with curl's retry (with exponential back-off)
mechanism.
Clayton Craft [Mon, 15 Jun 2026 23:31:47 +0000 (16:31 -0700)]
action: install apk to /usr/bin
/usr/local is cleaned up by ci.yml immediately after actions.yaml adds
apk into that dir, which leads to job that try to use apk to fail with
"apk not found"
Clayton Craft [Mon, 11 May 2026 21:27:14 +0000 (14:27 -0700)]
mkosi-vm: add systemd-efistub to postmarketOS config
On Alpine/pmOS, the EFI stub is split into a separate systemd-efistub
package rather than being bundled with systemd-boot, so it needs to
be added to the tools tree so mkosi can find it when building UKI/ESP
images.
Martin Pitt [Mon, 15 Jun 2026 08:52:44 +0000 (10:52 +0200)]
dnf: Work around librepo rejecting valid repomd signatures cross-distro
librepo 1.20 rejects valid repository metadata GPG signatures with gpgme
2.1 ("Bad GPG signature") [1]. This happens a lot when building a distro
which signs its repos (CentOS) on newer distros like Arch, Debian
testing, or openSUSE Tumbleweed, with their newer gpgme.
Thus until this is fixed, only validate repo GPG signatures when the
distributions match. We can assume that distros test their own dnf repos :-)
Revert once librepo gets fixed and into the distros.
mkosi only ever set `gpgcheck=1` (package signature verification) in the
generated dnf repository files and left `repo_gpgcheck` (repository
*metadata* signature verification) at the dnf default.
That default is not repository-aware. It is a global default of the dnf5
build doing the work, i.e. of the tools tree, not of the distribution
being built: Fedora's dnf5 defaults it to off, openSUSE's defaults it to
on. So whether repomd.xml.asc was verified depended on the tools tree
rather than on whether the repository actually publishes a signature,
and it ended up enabled for repositories that can never satisfy it.
Fedora and EPEL don't publish a repomd.xml.asc at all, and the CentOS
extras-common SIG repository signs it with the SIG key rather than the
main key we configure.
This stayed invisible because skip_if_unavailable was on by default too:
a repository that failed metadata verification was silently disabled and
makecache still succeeded. Now that we set `skip_if_unavailable=0`, those
failures are fatal, so the inherited default has to go.
Set `repo_gpgcheck` explicitly per repository instead. Default it to
"on", as repositories that do sign their metadata (e.g. CentOS BaseOS,
AppStream, CRB) benefit from it, and it should be an explicit opt-out
for new distros.
Explicitly turn it off for the ones that don't publish a verifiable
signature (Fedora, EPEL, CentOS extras-common). This makes the behaviour
deterministic regardless of the tools tree.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Martin Pitt [Mon, 15 Jun 2026 05:53:00 +0000 (07:53 +0200)]
dnf: Don't skip unavailable repositories during makecache
`sync()` currently often fails to retrieve the GPG signature and writes
a warning, but still returns successfully:
> Status code: 404 for https://.../fedora/../repodata/repomd.xml.asc
> GPG verification is enabled, but GPG signature is not available
The subsequent package installation then fails with something like
> Failed to resolve the transaction:
> No match for argument: basesystem
This is confusing. Let's rather fail early at the root cause. Some
distributions seem to enable `skip_if_unavailable=1` by default, so
disable that option.
This was even worse for repositories that publish metadata GPG
signatures (e.g. CentOS Stream): a transient failure to retrieve or
verify repomd.xml.asc would make dnf silently skip the entire repository
and return success with an unusable cache, which made the whole build
unreproducible and unreliable.
Jörg Behrmann [Sat, 13 Jun 2026 12:51:29 +0000 (14:51 +0200)]
tree: check for root when copying SELinux attributes as well
A user complained that the previous check
statfs(os.fspath(dst.parent)) != OVERLAYFS_SUPER_MAGIC or not tree_has_selinux_xattr(src)
worked for them when changing the or to and and
statfs(os.fspath(dst.parent)) != OVERLAYFS_SUPER_MAGIC and not tree_has_selinux_xattr(src)
thus always excluding extended attributes when the tree contained SELinux
attributes, implying that not being root was the issue. Therefore this commit
pulls our the check for not being root out of the IMA attribute check.
It's only conjecture, but it seems unlikely that copying IMA attributes to
overlayfs would work, when SELinux doesn't. This allows to make the whole
handling more symmetrical.
Luca Boccassi [Mon, 1 Jun 2026 22:16:40 +0000 (23:16 +0100)]
obs: enable PR CI workflow
Build packages on OBS against the PR and reports status back
to Github. This just builds the mkosi package for now, next
step is to also build particleos images.
Martin Pitt [Tue, 2 Jun 2026 09:21:17 +0000 (11:21 +0200)]
tests: Mark install tests and run them separately
The unit tests also run during package builds, but test_install.py
requires network access (venv creation) and is generally not necessary
for most code changes. This also speeds up running the unit tests
considerably.
Luca Boccassi [Mon, 1 Jun 2026 21:37:29 +0000 (22:37 +0100)]
Fix linter unit tests at package build time
Unit tests are broken as they expect a CI environment, but they are also
ran at package build time. Skip gracefully when the git or the
make-man-page.sh scripts are not available.
Martin Pitt [Mon, 1 Jun 2026 12:34:07 +0000 (14:34 +0200)]
Don't add El Torito boot catalog for BIOS/grub images by default
systemd-repart v261 adds an El Torito boot catalog, which writes an
ISO9660 header to the image. grub-bios-setup interprets that header as a
filesystem on the bare disk and fails:
> warning: Attempting to install GRUB to a disk with multiple partition labels. This is not supported yet
> Embedding is not possible. GRUB can only be installed in this setup by
. using blocklists. However, blocklists are UNRELIABLE and their use is
. discouraged
> error: will not proceed with blocklists
Adjust auto mode to only add the El Torito catalog when grub is not
installed as the BIOS bootloader (`Explicit ElTorito=yes` still forces
it on). This goes back to the status quo ante until systemd 260 for
grub/BIOS.
Martin Pitt [Thu, 28 May 2026 16:19:23 +0000 (18:19 +0200)]
tests: Move unit tests from GitHub workflow into pytest
Extract all CI linter/formatter/install checks from the GitHub workflow
into pytest tests. Workflows are hard to reproduce locally, and it's
much more convenient to reproduce what CI does with a simple `pytest`
command. Update the documentation and also stop recommending locally
installed `mypy` and friends -- let's always use the version from
`mkosi box` to get something halfway reproducible.
Keep the `sudo mkosi -h` test in the workflow, though -- it cannot run
inside `mkosi box` as that doesn't have `sudo`.
Some people like to run mypy and other linters from their own dev
environment. Skip tests whose tools aren't installed, but only if they
don't run in `mkosi box` -- in the latter (and in CI) we want to fail
tests, to avoid silently skipping tests due to accidentally dropping a
tool.
When building the box with Fedora instead of Arch, pyright fails:
> mkosi/sandbox.py:889:50 - error: "parent" is possibly unbound (reportPossiblyUnboundVariable)
> mkosi/sandbox.py:889:59 - error: "base" is possibly unbound (reportPossiblyUnboundVariable)
> mkosi/sandbox.py:899:52 - error: "parent" is possibly unbound (reportPossiblyUnboundVariable)
> mkosi/sandbox.py:899:61 - error: "base" is possibly unbound (reportPossiblyUnboundVariable)
This isn't a bug: The variables are only used when nofollow=True, but
pyright cannot infer this from the control flow. Just quiesce this by
initializing the variables.
Martin Pitt [Thu, 28 May 2026 16:04:36 +0000 (18:04 +0200)]
pytest: Restrict discovery to tests/
Configure pytest to only look in tests/ directory. That will prevent
picking up test files inside of built artifacts (like mkosi.output/ or mkosi.tools/).
Fixes this failure of `bin/mkosi box -- python3 -m pytest`:
> ImportError while importing test module 'mkosi/mkosi.tools/usr/lib/python3.14/site-packages/mypyc/test/test_run.py'.
> E ModuleNotFoundError: No module named 'distutils'
Paul Meyer [Fri, 22 May 2026 07:21:51 +0000 (09:21 +0200)]
finalize_scripts: tighten the PATH-strip condition to actual self-exec
The PATH-strip prelude exists to prevent `/scripts/<name>` from
recursing into itself when the script execs a binary named `<name>` via
PATH lookup. The current heuristic, `config.find_binary(name)`, checks a
broader condition: whether *some* binary called `<name>` exists in the
search path. That produces false positives for scripts that exec a
different binary entirely.
In particular, `mkosi-install` execs `dnf install $@`, expecting `dnf`
to resolve to the wrapped `/scripts/dnf` (which adds `--installroot=…`,
`--use-host-config`, `--setopt=…`). When the prelude gets emitted for
`mkosi-install` too, it strips `/scripts` from PATH before the exec, so
`dnf` resolves to the raw system binary and is invoked with none of the
wrapper's overrides.
Tighten the check: emit the prelude only when one of the exec'd argv
tokens is the unqualified string `name`, which is the only case where
PATH lookup could resolve back to `/scripts/<name>`.
Daan De Meyer [Tue, 26 May 2026 10:58:04 +0000 (10:58 +0000)]
Mount /etc/resolv.conf symlink into sandbox
Currently, if /etc/resolv.conf is a symlink, we
bind mount the actual file it points to into the
sandbox. Problem with this approach is that if the
file it points to is replaced on the host, creating
nested sandboxes will fail because bind mounting a
file whose source does not exist anymore fails with
ENOENT when you call mount.
To fix this (partially), make sure we bind mount the
/etc/resolv.conf symlink if it one. That way, on
resolved systems, we'll bind mount the /etc/resolv.conf
symlink and the /run/systemd/resolve directory into the
sandbox, with the latter containing the symlink target of
/etc/resolv.conf. Because we don't mount the target file
directly but its parent directory, if the file is replaced,
the sandbox will see the new file.
To make this work we add new --bind-nofollow and
--ro-bind-nofollow options to mkosi-sandbox.
Luca Boccassi [Tue, 26 May 2026 16:36:29 +0000 (17:36 +0100)]
nspawn: do not fail if --forward-journal is not available
--forward-journal is only available in 261, which means we cannot use the
current mkosi main in the systemd stable branches. Check the version and
fallback to the previous implementation if it's older.
Luca Boccassi [Tue, 26 May 2026 10:58:36 +0000 (11:58 +0100)]
tools: move grub-pc-bin to arch-specific drop-in
2026-05-26T09:06:43.9842316Z Package grub-pc-bin is not available, but is referred to by another package.
2026-05-26T09:06:43.9842760Z This may mean that the package is missing, has been obsoleted, or
2026-05-26T09:06:43.9843062Z is only available from another source
2026-05-26T09:06:43.9843221Z
2026-05-26T09:06:43.9867449Z E: Package 'grub-pc-bin' has no installation candidate
Michael Vogt [Wed, 13 May 2026 16:03:13 +0000 (18:03 +0200)]
fedora: allow Snapshot= for any kojipkgs-style mirror
The Snapshot= setting was gated to Release=rawhide and
Mirror=https://kojipkgs.fedoraproject.org with two hard die() checks,
but the URL builder underneath works for any release and any mirror
that mimics the koji compose layout.
So this commit drops the restrictions and just assuems a koji style
layout when snapshot is used. With that any koji style snapshot
can be used.
Daan De Meyer [Tue, 19 May 2026 20:15:49 +0000 (20:15 +0000)]
postmarketos: Persist fetched keyring across Contexts
Extract the fetched alpine-keys/postmarketos-keys apks straight into
context.keyring_dir so the trusted keys survive between Contexts (e.g.
when building an image after sync_repository_metadata). The per-Context
sandbox_tree is discarded between phases, so writing only there would
cause the keys to disappear before setup() needs them. setup() now does
all the arch-specific key selection, reading from
context.keyring_dir/usr/share/apk/keys/<arch>/ as well as the tools tree.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Daan De Meyer [Tue, 19 May 2026 14:33:21 +0000 (14:33 +0000)]
sandbox: split CLI and library entry points to fix console-script execution
When installed via pip/pipx/Nix, the mkosi-sandbox console-script calls
main() with __name__ == "mkosi.sandbox" rather than "__main__", so the
old is_main() check returned False and refused to execvp a trailing
command. Fix this by separating the two responsibilities: enter() is the
library function that sets up the sandbox in the current process and
returns any trailing argv, while main() is the CLI wrapper that calls
enter(), prints friendly error messages carried on a new SandboxOSError,
and execvp's the command. The console-script entry point points at
main() and works regardless of how it is invoked.
Fixes: https://github.com/systemd/mkosi/issues/4303 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Daan De Meyer [Tue, 19 May 2026 12:43:46 +0000 (12:43 +0000)]
Make full $PATH available when building tools tree
There's no risk of issues where stuff from $PATH expects
/usr from the host when building the tools tree or not using
it at all, so make the full $PATH available in that case.
This allows stuff like downloading apk to ~/.local/bin and
building postmarketos images.
To make this work we also have to mount /home into the sandbox.
This shouldn't be an issue generally. We don't expect tools to
accidentally pick stuff up from /home unless actually intended.
Daan De Meyer [Tue, 19 May 2026 13:01:15 +0000 (13:01 +0000)]
apk: Implement repository_key_fetch for the postmarketOS distribution
When repository_key_fetch is enabled, fetch the alpine-keys and postmarketos-keys
packages with --allow-untrusted, extract them, and copy the trusted public keys
into /etc/apk/keys/ in the sandbox tree so subsequent installs verify normally.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Daan De Meyer [Sun, 17 May 2026 14:03:59 +0000 (14:03 +0000)]
mkosi-initrd: Trim orphaned GPU/audio modules, add ACPI platform attrs
The DRM and sound helpers (drm_buddy, drm_display_helper, ttm, intel-gtt,
mxm-wmi, snd-intel-dspcfg, snd-soc-hda-codec) had no actual KMS/audio
driver in the include list to pull them in, and there is no audio/GPU
userspace running in the initrd anyway. uvc and videobuf2-* are USB
webcam plumbing, also unused. Add firmware_attributes_class and
platform_profile so udev does not log autoload failures for those on
modern laptops.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Daan De Meyer [Thu, 14 May 2026 07:46:44 +0000 (09:46 +0200)]
mkosi-tools: Add fish to misc profile
Now that fish supports SHELL_PROMPT_PREFIX, it becomes more
viable again to run mkosi box -- /bin/fish since it will now
properly show that a box environment was entered. Hence let's
put it in the misc profile so that it is easily available in the
box environment.
Daan De Meyer [Thu, 14 May 2026 08:17:01 +0000 (08:17 +0000)]
box: Drop background tinting
Now that we have $SHELL_PROMPT_PREFIX integration,
let's drop the background tinting. Especially since it
doesn't quite nest all that well yet and we often invoke
nspawn and such from within mkosi box which does its own
background tinting.
Daan De Meyer [Mon, 11 May 2026 19:43:56 +0000 (21:43 +0200)]
vmspawn: Forward journal-remote settings to vmspawn
Pass the same MaxUse/KeepFree/MaxFileSize/MaxFiles settings to vmspawn
via its new --forward-journal-* options that we configure in
systemd-journal-remote.conf for qemu.
Daan De Meyer [Mon, 11 May 2026 19:47:19 +0000 (21:47 +0200)]
nspawn: Use --forward-journal instead of running journal-remote ourselves
systemd-nspawn now supports --forward-journal with matching
--forward-journal-max-use, --forward-journal-keep-free,
--forward-journal-max-file-size and --forward-journal-max-files options,
so let it run systemd-journal-remote itself instead of doing it ourselves
via a bind-mounted unix socket.
projects / thirdparty / mkosi.git / log
