[1/1] sbuild: allow to override enforcement of no-network policy

Message ID 20260728102838.962383-1-felix.moessbauer@siemens.com
State Under Review
Headers show
Series [1/1] sbuild: allow to override enforcement of no-network policy | expand

Commit Message

Felix Moessbauer July 28, 2026, 10:28 a.m. UTC
In accordance with Debian Policy §4.9, sbuild disables network
access while running `dpkg-buildpackage` (from trixie on). For
technical reasons, this was not enforced on the schroot backend,
leading to silent policy violations. On the unshare backend
(rootless), this is enforced, which might break some downstream
builds. By providing a variable to override this, we restore
compatibility with the privileged mode.

Pre 0.89 versions of sbuild (e.g. on bookworm), always allow network
access, independent of the backend.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 RECIPE-API-CHANGELOG.md          |  9 +++++++++
 meta/classes-recipe/dpkg.bbclass | 15 +++++++++++++++
 2 files changed, 24 insertions(+)

Comments

Michael Adler July 28, 2026, 10:53 a.m. UTC | #1
> In accordance with Debian Policy §4.9, sbuild disables network
> access while running `dpkg-buildpackage` (from trixie on). For
> technical reasons, this was not enforced on the schroot backend,
> leading to silent policy violations. On the unshare backend
> (rootless), this is enforced, which might break some downstream
> builds. By providing a variable to override this, we restore
> compatibility with the privileged mode.
> 
> Pre 0.89 versions of sbuild (e.g. on bookworm), always allow network
> access, independent of the backend.

Thanks a lot, works for me (podman, unprivileged).

Tested-by: Michael Adler <michael.adler@siemens.com>

Kind regards,
Michael

Patch

diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md
index f5b84c84..69560e9f 100644
--- a/RECIPE-API-CHANGELOG.md
+++ b/RECIPE-API-CHANGELOG.md
@@ -1129,6 +1129,15 @@  environment and cannot be deleted from the outside by the calling user. To simpl
 the cleanup, we provide the `isar-clean-builddir` script that helps purging
 directories with mixed ownerships (without requiring root privileges).
 
+### Network access during package builds (on rootless)
+
+In accordance with Debian Policy §4.9, sbuild disables network access while running
+`dpkg-buildpackage`. For technical reasons, this is only enforced on the unshare
+backend (and on sbuild versions > 0.89). The schroot backend retains its existing
+network access. Recipes that still require network access during the build can set
+`DPKG_BUILD_ENABLE_NETWORK = "1"` to explicitly enable it when using an sbuild
+version newer than 0.89.
+
 ### Add Hyper-V machine support
 
 A new machine `hyper-v` has been introduced for building images
diff --git a/meta/classes-recipe/dpkg.bbclass b/meta/classes-recipe/dpkg.bbclass
index 1b2616db..d8e129bb 100644
--- a/meta/classes-recipe/dpkg.bbclass
+++ b/meta/classes-recipe/dpkg.bbclass
@@ -15,6 +15,12 @@  DPKG_PREBUILD_ENV_FILE="${WORKDIR}/dpkg_prebuild.env"
 # Note: must not have any logical influence on the generated package
 SBUILD_PASSTHROUGH_ADDITIONS ?= ""
 
+# Debian Policy §4.9 forbids network access during build. However, this can only
+# be enforced on unshare backend. For schroot backend, network access was still possible,
+# resulting in builds needing it. To override this, the variable DPKG_BUILD_ENABLE_NETWORK
+# can be set to "1" in the recipe.
+DPKG_BUILD_ENABLE_NETWORK ??= "0"
+
 def expand_sbuild_pt_additions(d):
     cmds = ''
     for var in d.getVar('SBUILD_PASSTHROUGH_ADDITIONS').split():
@@ -112,10 +118,19 @@  dpkg_runbuild() {
 
     DSC_FILE=$(find ${WORKDIR} -maxdepth 1 -name "${DEBIAN_SOURCE}_*.dsc" -print)
 
+    # networking is automatically enabled on older versions of sbuild
+    sbuild_network_option=""
+    sbuild_version="$(dpkg-query --showformat='${source:Upstream-Version}' --show sbuild)"
+    if [ "${DPKG_BUILD_ENABLE_NETWORK}" = "1" ] && \
+        dpkg --compare-versions "$sbuild_version" ge "0.89"; then
+        sbuild_network_option="--enable-network"
+    fi
+
     sbuild -n -c ${SBUILD_CHROOT} \
         --chroot-mode=${ISAR_CHROOT_MODE} \
         --host=${PACKAGE_ARCH} --build=${BUILD_ARCH} ${profiles} \
         ${@'--no-arch-all' if 'cross' in isar_deb_build_profiles(d).split() else '--arch-all'} \
+        ${sbuild_network_option} \
         --no-run-lintian --no-run-piuparts --no-run-autopkgtest --resolve-alternatives \
         --bd-uninstallable-explainer=apt \
         --no-apt-update --apt-distupgrade \