@@ -1129,6 +1129,15 @@ environment and cannot be deleted from the outside by the calling user. To simpl
the cleanup, we provide the `isar-clean-builddir` script that helps purging
directories with mixed ownerships (without requiring root privileges).
+### Network access during package builds (on rootless)
+
+In accordance with Debian Policy §4.9, sbuild disables network access while running
+`dpkg-buildpackage`. For technical reasons, this is only enforced on the unshare
+backend (and on sbuild versions > 0.89). The schroot backend retains its existing
+network access. Recipes that still require network access during the build can set
+`DPKG_BUILD_ENABLE_NETWORK = "1"` to explicitly enable it when using an sbuild
+version newer than 0.89.
+
### Add Hyper-V machine support
A new machine `hyper-v` has been introduced for building images
@@ -15,6 +15,12 @@ DPKG_PREBUILD_ENV_FILE="${WORKDIR}/dpkg_prebuild.env"
# Note: must not have any logical influence on the generated package
SBUILD_PASSTHROUGH_ADDITIONS ?= ""
+# Debian Policy §4.9 forbids network access during build. However, this can only
+# be enforced on unshare backend. For schroot backend, network access was still possible,
+# resulting in builds needing it. To override this, the variable DPKG_BUILD_ENABLE_NETWORK
+# can be set to "1" in the recipe.
+DPKG_BUILD_ENABLE_NETWORK ??= "0"
+
def expand_sbuild_pt_additions(d):
cmds = ''
for var in d.getVar('SBUILD_PASSTHROUGH_ADDITIONS').split():
@@ -112,10 +118,19 @@ dpkg_runbuild() {
DSC_FILE=$(find ${WORKDIR} -maxdepth 1 -name "${DEBIAN_SOURCE}_*.dsc" -print)
+ # networking is automatically enabled on older versions of sbuild
+ sbuild_network_option=""
+ sbuild_version="$(dpkg-query --showformat='${source:Upstream-Version}' --show sbuild)"
+ if [ "${DPKG_BUILD_ENABLE_NETWORK}" = "1" ] && \
+ dpkg --compare-versions "$sbuild_version" ge "0.89"; then
+ sbuild_network_option="--enable-network"
+ fi
+
sbuild -n -c ${SBUILD_CHROOT} \
--chroot-mode=${ISAR_CHROOT_MODE} \
--host=${PACKAGE_ARCH} --build=${BUILD_ARCH} ${profiles} \
${@'--no-arch-all' if 'cross' in isar_deb_build_profiles(d).split() else '--arch-all'} \
+ ${sbuild_network_option} \
--no-run-lintian --no-run-piuparts --no-run-autopkgtest --resolve-alternatives \
--bd-uninstallable-explainer=apt \
--no-apt-update --apt-distupgrade \
In accordance with Debian Policy §4.9, sbuild disables network access while running `dpkg-buildpackage` (from trixie on). For technical reasons, this was not enforced on the schroot backend, leading to silent policy violations. On the unshare backend (rootless), this is enforced, which might break some downstream builds. By providing a variable to override this, we restore compatibility with the privileged mode. Pre 0.89 versions of sbuild (e.g. on bookworm), always allow network access, independent of the backend. Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com> --- RECIPE-API-CHANGELOG.md | 9 +++++++++ meta/classes-recipe/dpkg.bbclass | 15 +++++++++++++++ 2 files changed, 24 insertions(+)