From patchwork Thu Sep 10 10:07:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Felix Moessbauer X-Patchwork-Id: 5449 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Thu, 10 Sep 2026 12:07:26 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-lj1-f186.google.com (mail-lj1-f186.google.com [209.85.208.186]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 68AA7PEG006340 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 10 Sep 2026 12:07:25 +0200 Received: by mail-lj1-f186.google.com with SMTP id 38308e7fff4ca-3a202ac1011sf35389671fa.1 for ; Thu, 10 Sep 2026 03:07:25 -0700 (PDT) ARC-Seal: i=3; a=rsa-sha256; t=1789034839; cv=pass; d=google.com; s=arc-20260327; b=jk+eoPI20ZHY9g5RDCS0cbO0vAKXY1LwKdDjr1coKRCoSlpPRkd/k85fTmCkdEkZhU k/GxZdK8vCA5YyNUPAkO3qZQ3UnkGL4XyAtWLKlg8kkyOi/eBesnpRCUli5LWrjasWKa HhdMV0bPys6eEOUj4XEPAjGg55tIOMpwKXbzUp9uiUr2NzTN6sA7lrLUfo4Rw1hUGboX ZnGpGBjrYCICLIrpXRYIPAaxhwz8MWCskkovpmmIPLgdeoHBLBxwq0GIfmR3zYrTjBBJ P7rB7jmp62cgvkqdtJnh+u4AhJrEW9ZNm8fKTd6SQYw1hsBfHKrazVntpK9658QTisMf F40A== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:dkim-signature; bh=s0VXq+LyC7GYZVkTv2iWl/eTsnem4vejP0SXjO95eWk=; fh=tJYgt4rC3v1iwJseyT95jf2s/IQsOR34wasVj6J6MMw=; b=XsjXtKv1+rVJC5vozHe49w7fTM1JSIwRVjBRbNi08KmW38V+bkYKSO+24GygBYbetC bH9w6pzq1mS5vn+zp7NCcgSj8bRSBCwrl8UyykJJN4dodxuNvVjJec6YhFwz+6DEyP8z QLpFGk7nJOOc1OLvk2gixJNEgdmBWYgIOv0KM4px58qccx9DMvmjS1sNtceMRRiKXsqo fb6h4b/W8V2r4/TJYB9Zv+uwaDjqKDEX2N3ud3Z9XT2pNd50w/Q4bOSQWz9CR/Naa6H0 KmqEQUXRjZoTUQEdj6Pe3p6oNZnGrrXX1yDepVzCf4hkpITAOM+nWGj0ZbCfJKvbeIZ1 HRlA==; darn=isar-build.org ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=XSIJ45ig; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::3 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1789034839; x=1789639639; darn=isar-build.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-type:references:in-reply-to:message-id:date:subject:cc:to :from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=s0VXq+LyC7GYZVkTv2iWl/eTsnem4vejP0SXjO95eWk=; b=IZMNnqPcrWeY0lHjMZyR3b0Meb43N+jygyt+ydqqFcdTmt7kuSORfybCissT9B6lTj bEX8ubSu+CkK1jNZZnkFK2rse1pu8jTtWe3rzktLYz8qjtoe9vKLbq0bsWwg9LahkOjd q5VkvFGp57p57F/eLyWp9589KlYruVQUIKSXsjSar1LosdSOYJpX4qxyuppYRq75fCLb bFNc7YouIhQQwoYVV3MnTnh8s2HfvHnmfnqT975/IG9iUKR6RsCDjvqwXRZVj1LYh/YS QNc+aOJNCrWZX3du9P+tfh9lSimudhVbenDXk9RoHQPBeadZYLRtyqjD/rZPGGk4y0ve 0q8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1789034839; x=1789639639; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-type:references:in-reply-to:message-id:date:subject:cc:to :from:x-beenthere:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=s0VXq+LyC7GYZVkTv2iWl/eTsnem4vejP0SXjO95eWk=; b=QVZobqSnCrOlYwWDqgGm0v+9xeTY15A2evffkCpllu495/FCU+O5okp7qz3E6MkF6d p3UYmepBZp7dUF8F6DnnP35YZtOVKteLEdnGZaMoHitP1mxX3KPd+FFDVq9DC7Bq7fOy QC37swYNJ7ueNngRKMxsWJtBEqpTaRlc8ovljbT6MrgmXXZBgnwNHZvZpXyILOozE6Nq +FnN41ix8Ax+5+6FfLwmPnMRCmvr1DYj5LYkhH78rYI/ma5lHKkg6KUQx8UnjJqNnLd+ QbIfH6LZOmyVnqOjrZxajCXsfZdRrDappZN3WnpfArQFYUOPbNLevAQVW6/GmlwsvcbW VlWg== X-Forwarded-Encrypted: i=3; AKwUvBxLsQfJXF2ahEDY3g+2JG3yXdu5EyXSBw4+/mbrxJkiuNdXusO4HCMIhI+vz6fbBxOrHvyZDiM=@isar-build.org X-Gm-Message-State: AFuF++miMSwYjcGNAm2ShYcYu4XbkU3ZOQ/bKktfJ9l3lAnppSCOm1VU bXJdT3Q7o7DOhhQU6LpxIPJ8kGB4r9FLfV+B4Pe4TzHIl1z9DSMJa/e8 X-Received: by 2002:a05:651c:4206:b0:3a3:7682:49a8 with SMTP id 38308e7fff4ca-3a376824cc0mr41935821fa.29.1789034839107; Thu, 10 Sep 2026 03:07:19 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="ATskLdeZ8km2P7/uUJ9R06MzPuHm/AqZ5YUV+2YzEX7YdUKQVw==" Received: by 2002:a05:651c:418a:b0:3a1:dff3:dc95 with SMTP id 38308e7fff4ca-3a5913e5220ls2092421fa.0.-pod-prod-08-eu; Thu, 10 Sep 2026 03:07:15 -0700 (PDT) X-Received: by 2002:a05:6512:3e09:b0:5b6:1a7c:fd83 with SMTP id 2adb3069b0e04-5b61a7cfe9emr7259308e87.41.1789034834842; Thu, 10 Sep 2026 03:07:14 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1789034834; cv=pass; d=google.com; s=arc-20260327; b=DCYvEASdTZ2PP/4Q5RajUXJRrTevmyRCwy8BKAlWHsc3WNbKhflw7CFb672b9oKIo8 qdrcmdm3p0mleOiHzD4kFop1uXu/LO3C5i2a7ePzJgPIjiIpYd02LEv3dXcu+UpY0qhY mT0eN1SweVsmlpjqPetmUa5wIlrMcTRkqjcLvTAjKSEyDwgNOpcJI6WCiN1xjuv5L9sP 5RCW9sgh+B/YeonNEGP59DVt5T+VLB1EvVuIKo5cjdK0kN8S6MoQjU/L0PBhlU8bnFLT 44TbsYhAi1fhhJOuToVsRJY+zUycLPLT8FdTpj0SERUPN0Appz7AcsWn/GFuMmJx024n KL4g== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:content-transfer-encoding:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=3UEYtkaYGCetX4dOeHkZlTR/tALAbw9MvAD+PuEtdT0=; fh=uGs0oauz4so1TC+tpaI5Rx4pUM+DpREVLnYpm0bwgQU=; b=WrXu0JsNsXAvQLZ0zNuGBd2PzgKI7JXsNRm/i+KwWPocWR0BxmXwWa7pu/+Wgd2P0C jOH2dSUASStdtnTosN7vX20kCJ5VcA3X9Mp61vGWTJNreoQnb4FrQBjcGmOEOR8Vtg8l D4vdoQM4shZoltxl9TY/bX+7y1I49VN0ccm/RWuMSPuLdd04zdsMeK+z+Uw2BbseVwd4 4P1ys7GB9nLus+uqisXWeKLasxbIr3l9VewZBIw5HVjcTKAS235Q1bWXOw5LMP83ZVC7 ZwQTYlCXpWs+Qm2Zw2farCnBErFAO5hgL8bFytxYrDQ5pyzLUY8CxwHpu102hQ0ZapNi 9pjw==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=XSIJ45ig; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::3 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from AS8PR04CU009.outbound.protection.outlook.com (mail-westeuropeazlp170110003.outbound.protection.outlook.com. [2a01:111:f403:c201::3]) by gmr-mx.google.com with ESMTPS id 2adb3069b0e04-5b61665671esi345477e87.1.2026.09.10.03.07.14 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 10 Sep 2026 03:07:14 -0700 (PDT) Received-SPF: pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::3 as permitted sender) client-ip=2a01:111:f403:c201::3; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=bBX1krCar7r6fK76maq7NEycowVe+K7o5ccd/x+pAN8fSUwb7/ajTgU1nuTyzra43jJRHKyHDFY6eOuzeFSKLv9QaM2EYZ14qwOO0vUyQnL94J8/9n5iK33OqtqEFxZtshZCtX683C1kmmMI4P8t26VzKo0pCafmVvuVI8x8W4nD99Eg163mUvSv4a++2hBxYv9EfoLgmjTDX2DtVfbFD3MUyJt392JwgqwBzIROjc6FePg7NHc0KGymccGL+QELH5SFdDrDEJUTUvsu01lqXIaWoH6PXqzSEGgYFiAjCSB7JJXuvPbxWyLAVm/kD2NdCiamHzvJ0thoJXQ3qq6zAQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=3UEYtkaYGCetX4dOeHkZlTR/tALAbw9MvAD+PuEtdT0=; b=vLEXDzwoqa5xFmAZtVjosY+FDGNcuh5woWx4S10b5qFT8b7o+BHxifc8fRUdIzX3cOi8MEWjOXfFZBKlo+oaK54sNCwwtn2oTPY5SZ3MmH2RNactV8vcD4ksCWuVVDz2SftrHr7W07Y4XccABs3gTwQudby3852O2BbgMfGjrytrZxmUnLElt5s+SsQ0tEey0pGy9eIej2N5Sv3CRa35fOFyFJoy/Y1C8jkzC0cUdKeMBDoTHPeDfSpIHHhEPVxeg2vAmrVw+oIphOM0fnzrseA9z03hIA8DV+EpoZw535KkCa2CJ88Ma+ANiTdxBr9yHhv59DCq8HfUrCu0hPEITw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:17e::10) by GV2PR10MB6066.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:150:aa::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.9; Thu, 10 Sep 2026 10:07:10 +0000 Received: from AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM ([fe80::c54c:ccd8:ebbf:477c]) by AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM ([fe80::c54c:ccd8:ebbf:477c%6]) with mapi id 15.21.0406.007; Thu, 10 Sep 2026 10:07:10 +0000 X-Patchwork-Original-From: "'Felix Moessbauer' via isar-users" From: Felix Moessbauer To: isar-users@googlegroups.com Cc: cedric.hombourger@siemens.com, jan.kiszka@siemens.com, akarpovich@ilbers.de, Felix Moessbauer Subject: [RFC 1/1] rootfs: use host apt to install packages into rootfs Date: Thu, 10 Sep 2026 12:07:00 +0200 Message-ID: <20260910100700.3998213-2-felix.moessbauer@siemens.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260910100700.3998213-1-felix.moessbauer@siemens.com> References: <20260910100700.3998213-1-felix.moessbauer@siemens.com> X-ClientProxiedBy: FR3P281CA0142.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:95::16) To AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:17e::10) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM7PR10MB3956:EE_|GV2PR10MB6066:EE_ X-MS-Office365-Filtering-Correlation-Id: 5f38c315-0385-40f2-fb30-08df0f234637 X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|10070799003|366016|1800799024|23010399003|376014|10067099003|6133799003|3023799007|18002099003|22082099003|55112099003|56012099006|11063799006|5023799004; X-Microsoft-Antispam-Message-Info: IUpD40Q9lnwsbizkPHFyXo/UN8YfxukSOnHSZky9w/ibWCzx0wvczcok5pNVa5en9+pgA6DClbRAqHtfb9cMY4r6HczCXVH1sPio7AWU1p5d+Jb3/ohxrAscNqiIZr8tgnBvTy13U8itF2n5X0seAc7NuMKpZod5imizS73ArFV6AgrPZZLrwMsiPJOZjqGB0ckr2ttynLvZedn38MnOtaBkTkQ/eOaHhO3sizN7u4kH7p9ArbVZAk+QhQkylB16KAqGNgE0tCATTU91hizoFTzNUeO19+s5mV59KDa9Eke/WRTys6r/rdANINoB1DaV0AuOv9rKLEaAc+/mtOYBzx5mwf5colf6LGvUExUReJgv/ZPzjTLYVtatIae/hHv71rtwQpZcsEA4ZW1F8xcxjc0NdppkuiTPzD40MBJRqwZHwtndhoV7X+uzvGAh8iAbg/IXXA1eTcSp1/Z6bWQIl4tn26nAkZqfGvXhwK6RqHHPC9qMNZ6rEPDThnUWe/6NwwUJaSvGJGkTbSzPZ/ECKQ2+SXVEku4vSVYPOMVzayDOTMEZrTOVoX76h1bMD1W3qmgsAtKZexOqhZKJw632vfTbIVZTqZq8CT8TS7RQoFg= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(10070799003)(366016)(1800799024)(23010399003)(376014)(10067099003)(6133799003)(3023799007)(18002099003)(22082099003)(55112099003)(56012099006)(11063799006)(5023799004);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: eGjwo+akFi50TC5vqcTn3S3qWGJJazpvu6gC+HDWrZAYwtgECKKzyDWtaBzoJRwvGNuOImW3PJvd+x0sQPU5vqoRQg5ibI5LOVa8+JVrgg9EhBKl6OvYCAr6XMyBgWFUt81pWwW4QxsO903rba1r6IiDh9LxtOlz3ZdDPWJ8GysD1ICIDhT0y6NtzQVW00MzC1cgPnDt/1t9LojQNAwIf7PQWw6p4b6Myv8NQeuxL/yKwEpS8f+4rBMTPGAWPhS4zgiHmYEWiGkERbncD3WQpDYAy+cTXMTzgr8F3v0TTpcnshC6D3a+bJ5uHm67MGz0J/etXwqLRthAN6zzGMPvuJhsfil6hy0ujaZntRCHajXSyUZ1pIiQAYPVj33zhObj7k2LtS4fckd5OoGBGHuBgMEtMdaqyUrBoHcm6M7u0Y5Tx2nEC3BWzkzqCnJ25nwypepcUbYg7ZKnhgvVE9i9KjzyhGfdksZeGWJ3e/HmT4rqESpYspNJ79YXGrS1b8LB1nInX9uxUv17vLjvzWPOcN+0vYDc47OVs76zN34BR2mY9WE995zMz9yWwOwlA8IuiKVB1E+c/PDFDvSFrgnFNtjQEu0w9zSRgze9DrxTgcYagJMwegUXc6onlGoJC6Z8kyct1UzuI5Of41MHGgnw16ZFrddeb86FIn1R40vc9zG0DPwSCl7Ly7kTyTucVIzUeNJOFSDxfXFCSHUlwQUhmLxPCCw6ddysL4fPNkkrM4XTXdsLISnybBJzHTUGFb8qzvnRV4xxxFtg/mBdgfWHG3mBp+gSk+q47DzKdEpGd0MvkNAS8dPrTeka3kcN/T6RxDtCAV6wyYcQhjTXOGuySNV5lK9vgujMCsjLyxO2hWNEA+msRujEerl2aWdrbIGW0sEnWpynr9JJB1hDytFLACJHEH9ZowgsQnFaQ3slHDG2vKVfs5+roY/LgoZuu/Gpeji+zq8ss0YOATmC0dPytPFMesizfAoDU7a1g2ZOJ+bfGY6F2IL6jKcs/rcF0mJADjP+k36UKXpJqQQSDSfw6DcJAdY3CDawE4wxzH0D/EycBs4vwAcaO/61zwEAG63gWWcGNpWazmR267Omnd3U2f5m2gzSuoeUUtpWIcEHwOIYbaWISuEu8RaSS2EuqUVdmgslF2BhmRE6ZukWbHgRri59h64Ba369faNOBX3L9rwIIx1ug/Olq2oMmuNxRJhnD+PBX/kbjlVJENq+cf3KJuWI/JJ0qo+2IIPzEwesOYfEHF1Va+jrN50kbRKExEIWMCDIh8a/cYGZ0e5jgDVBpBP07UCetQRlm8Go4zpOHRRhVQWuygxQizbgf3OvL4DwfSXs6yN+ihEyP6Ob1nMwuQRxsBKoIyScUJ1LkkULKY43P54q/inE3mk3q96BwWOdWGyHR00+mvYMZxGE/0PNrFxUrNR5Nh747qslaNEzjco2FOWGwRBgXh0vxSY9ZilvVPgjWilBQ8evAizenijoqGYPtn0ZGE9RNRaHztpeUfFX9DxI7HmHpcTZuik8gqgEozbOfhd7dtpi1SX45Cuxxq9asaj18os9exv1EeZBGAGrA0D4yWRYXuwA16AG7YLI4Mq8352IXGga0LQbyZqmT5lKfRr45ajaWUPk66Q8jc2GQxS8z9rq9SPmxJadXBnlfuCBNED6IZIZWj7+jkdAbzIoz02wHERqWoBqhD3dU1OgoyyYJ7+m8Mm3fL8VsRS7pP5Uzc3Y71qNnFVsaODlkLpacm/ZbXbtPW1cMpZ/HanM6HZTrC/X4WVfp9PiuLpXaw3Cw790 X-MS-Exchange-AntiSpam-MessageData-1: vMlvKjqJc2TeoA2cl3QdiPN4oI6w6gWIF8k= X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5f38c315-0385-40f2-fb30-08df0f234637 X-MS-Exchange-CrossTenant-AuthSource: AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Sep 2026 10:07:08.8505 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: RWDDjFLcdmnUrK7OLkpy9u7JFGl8OuBoJUxxal5JZUheKyGjs89ZWc+UdJDS+dKRz3H8lY0l0U9R7JfWN91KvfLwXVEVRe+zKyeyHX1PuUw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV2PR10MB6066 X-Original-Sender: felix.moessbauer@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=XSIJ45ig; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::3 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Felix Moessbauer Reply-To: Felix Moessbauer Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2,RCVD_IN_RP_CERTIFIED, RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= We currently use the apt inside the rootfs to operate on the rootfs. This has two major disadvantages: 1. on non-native, the apt invocations are emulated (including the extraction of the packages and downloading) 2. apt must be installed in the rootfs (which makes the rootfs larger and pulls in a lot of static-build-using dependencies related to the rust parts, which is relevant for license clearing) We change that similar to how mmdebstrap is doing it: Use the host apt to operate on the chroot, whereby dpkg itself runs inside the chroot to have proper support for the maintainer scripts. By that, apt is not emulated and the generated chroots can be much smaller. Not having apt inside the chroot exposes packaging bugs that assume that it (or any of its dependencies) is available. To work around these, we explicitly install the needed packages on a case-by-case decision. As of now, this series is only CI tested for rootless and also does not support the base-apt case. Signed-off-by: Felix Moessbauer --- meta-isar/conf/distro/raspios-bullseye.conf | 2 + meta-isar/conf/distro/ubuntu-focal.conf | 3 + meta/classes-recipe/deb-dl-dir.bbclass | 34 ++++ meta/classes-recipe/dpkg-source.bbclass | 30 ++-- .../image-account-extension.bbclass | 1 + .../image-locales-extension.bbclass | 13 +- meta/classes-recipe/rootfs.bbclass | 145 +++++++----------- meta/classes-recipe/sdk.bbclass | 5 +- .../isar-mmdebstrap/isar-mmdebstrap.inc | 19 +-- .../sbom-chroot/sbom-chroot.bb | 2 +- .../sbuild-chroot/sbuild-chroot.inc | 1 + 11 files changed, 129 insertions(+), 126 deletions(-) diff --git a/meta-isar/conf/distro/raspios-bullseye.conf b/meta-isar/conf/distro/raspios-bullseye.conf index a8b59c09..39b0bc8e 100644 --- a/meta-isar/conf/distro/raspios-bullseye.conf +++ b/meta-isar/conf/distro/raspios-bullseye.conf @@ -20,6 +20,8 @@ DISTRO_MM_OPTS += "${MMAPTOPT_NOEXPKEYSIGN}" DISTRO_BOOTSTRAP_KEYS = "http://raspbian.raspberrypi.org/raspbian.public.key;sha256sum=ca59cd4f2bcbc3a1d41ba6815a02a8dc5c175467a59bd87edeac458f4a5345de" DISTRO_BOOTSTRAP_KEYS:arm64 = "" DISTRO_BOOTSTRAP_BASE_PACKAGES:append = " usrmerge" +# workaround for missing depends to apt in raspbian-archive-keyring +DISTRO_BOOTSTRAP_BASE_PACKAGES:append = " apt" DISTRO_KERNELS ?= "kernel kernel7 kernel7l kernel8" diff --git a/meta-isar/conf/distro/ubuntu-focal.conf b/meta-isar/conf/distro/ubuntu-focal.conf index 155644c1..b6c3e442 100644 --- a/meta-isar/conf/distro/ubuntu-focal.conf +++ b/meta-isar/conf/distro/ubuntu-focal.conf @@ -12,3 +12,6 @@ DISTRO_GCC = "9" DEBIAN_COMPAT = "12" DEBIAN_STANDARDS_VERSION ?= "4.5.0" + +# workaround for missing depends in /usr/share/initramfs-tools/hooks/fixrtc +IMAGE_PREINSTALL:append = " e2fsprogs" diff --git a/meta/classes-recipe/deb-dl-dir.bbclass b/meta/classes-recipe/deb-dl-dir.bbclass index 60e2fecc..40e1f763 100644 --- a/meta/classes-recipe/deb-dl-dir.bbclass +++ b/meta/classes-recipe/deb-dl-dir.bbclass @@ -178,3 +178,37 @@ deb_dl_dir_export() { done EOF } + +# Point isar-apt at its real build-path location so host apt can access it. +# The reproducible 'file:///isar-apt' encodes to the apt list prefix '_isar-apt', +# the real repo path encodes to the same path with '/' replaced by '_'. +deb_dl_dir_isar_apt_to_host() { + export rootfs="${1}" + export host_prefix="$(printf '%s' '${REPO_ISAR_DIR}/${DISTRO}' | tr '/' '_')" + run_privileged_heredoc << ' EOSUDO' + set -e + sed -i 's|file:///isar-apt|file://${REPO_ISAR_DIR}/${DISTRO}|g' \ + "${rootfs}/etc/apt/sources.list.d/isar-apt.list" + for f in "${rootfs}/var/lib/apt/lists/"_isar-apt*; do + [ -e "$f" ] || continue + suffix="$(basename "$f" | sed 's|^_isar-apt||')" + mv "$f" "${rootfs}/var/lib/apt/lists/${host_prefix}${suffix}" + done + EOSUDO +} + +# Revert the deb_dl_dir_isar_apt_to_host changes. +deb_dl_dir_isar_apt_to_target() { + export rootfs="${1}" + export host_prefix="$(printf '%s' '${REPO_ISAR_DIR}/${DISTRO}' | tr '/' '_')" + run_privileged_heredoc << ' EOSUDO' + set -e + sed -i 's|file://${REPO_ISAR_DIR}/${DISTRO}|file:///isar-apt|g' \ + "${rootfs}/etc/apt/sources.list.d/isar-apt.list" + for f in "${rootfs}/var/lib/apt/lists/${host_prefix}"*; do + [ -e "$f" ] || continue + suffix="$(basename "$f" | sed "s|^${host_prefix}||")" + mv "$f" "${rootfs}/var/lib/apt/lists/_isar-apt${suffix}" + done + EOSUDO +} diff --git a/meta/classes-recipe/dpkg-source.bbclass b/meta/classes-recipe/dpkg-source.bbclass index 97cf9714..9b712741 100644 --- a/meta/classes-recipe/dpkg-source.bbclass +++ b/meta/classes-recipe/dpkg-source.bbclass @@ -104,20 +104,26 @@ fetch_common_source_unshare() { set -e mkdir -p ${UNSHARE_DPKG_SOURCE_CHROOT} tar -xf "${SBUILD_CHROOT}" -C ${UNSHARE_DPKG_SOURCE_CHROOT} +EOF - ${@insert_isar_mounts(d, d.getVar('UNSHARE_DPKG_SOURCE_CHROOT'), d.getVar('SCHROOT_MOUNTS'))} - chroot ${UNSHARE_DPKG_SOURCE_CHROOT} /bin/bash -s <<'EOAPT' - set -e - apt-get update \ - -o Dir::Etc::SourceList="sources.list.d/isar-apt.list" \ - -o Dir::Etc::SourceParts="-" \ - -o APT::Get::List-Cleanup="0" + deb_dl_dir_isar_apt_to_host ${UNSHARE_DPKG_SOURCE_CHROOT} - cd /work - apt-get -y --download-only --only-source \ - -o Debug::NoLocking=1 -o Acquire::Source-Symlinks="false" \ - source ${DEBIAN_SOURCE} -EOAPT + run_privileged_heredoc <<'EOF' + ${@insert_isar_mounts(d, d.getVar('UNSHARE_DPKG_SOURCE_CHROOT'), d.getVar('SCHROOT_MOUNTS'))} + apt-get update \ + -o Dir="${UNSHARE_DPKG_SOURCE_CHROOT}" \ + -o APT::Architecture="${HOST_ARCH}" \ + -o Dir::Etc::SourceList="sources.list.d/isar-apt.list" \ + -o Dir::Etc::SourceParts="-" \ + -o APT::Get::List-Cleanup="0" + + cd /work + apt-get \ + -o Dir="${UNSHARE_DPKG_SOURCE_CHROOT}" \ + -o APT::Architecture="${HOST_ARCH}" \ + -y --download-only --only-source \ + -o Debug::NoLocking=1 -o Acquire::Source-Symlinks="false" \ + source ${DEBIAN_SOURCE} EOF # run cleanup in separate session to ensure nothing is mounted diff --git a/meta/classes-recipe/image-account-extension.bbclass b/meta/classes-recipe/image-account-extension.bbclass index dd70f2a3..8c7a3270 100644 --- a/meta/classes-recipe/image-account-extension.bbclass +++ b/meta/classes-recipe/image-account-extension.bbclass @@ -140,6 +140,7 @@ def image_create_users(d: "DataSmart") -> None: bb.process.run([*chroot, "/usr/bin/passwd", "--expire", entry]) +ROOTFS_PACKAGES += "passwd" ROOTFS_POSTPROCESS_COMMAND += "image_postprocess_accounts" image_postprocess_accounts[vardeps] += "USERS GROUPS" python image_postprocess_accounts() { diff --git a/meta/classes-recipe/image-locales-extension.bbclass b/meta/classes-recipe/image-locales-extension.bbclass index c03f34c0..a8a3201b 100644 --- a/meta/classes-recipe/image-locales-extension.bbclass +++ b/meta/classes-recipe/image-locales-extension.bbclass @@ -32,8 +32,10 @@ image_install_localepurge_download() { run_privileged_heredoc <<'EOF' set -e ${@insert_isar_mounts(d, d.getVar('ROOTFSDIR'), d.getVar('ROOTFS_MOUNTS') if d.getVar('ISAR_CHROOT_MODE') == 'unshare' else '')} - chroot ${ROOTFSDIR} \ - /usr/bin/apt-get ${ROOTFS_APT_ARGS} -o Debug::NoLocking=1 --download-only localepurge + /usr/bin/apt-get ${ROOTFS_APT_ARGS} \ + -o Dir="${ROOTFSDIR}" \ + -o APT::Architecture="${ROOTFS_ARCH}" \ + -o Debug::NoLocking=1 --download-only localepurge EOF } @@ -78,8 +80,9 @@ __EOF__ echo 'localepurge was not installed (removing it later)' # track additional packages that will be installed, as these packages might be # in the suggested set of other packages and by that need to be explicitly removed - localepurge_pkgs=$(chroot '${ROOTFSDIR}' apt-get ${ROOTFS_APT_ARGS} -s localepurge 2>&1 | sed -n 's/^Inst \([^ ]*\) .*/\1/p') - chroot '${ROOTFSDIR}' apt-get ${ROOTFS_APT_ARGS} localepurge + localepurge_pkgs=$(/usr/bin/apt-get \ + ${ROOTFS_HOST_APT_OPTS} ${ROOTFS_APT_ARGS} -s localepurge 2>&1 | sed -n 's/^Inst \([^ ]*\) .*/\1/p') + /usr/bin/apt-get ${ROOTFS_HOST_APT_OPTS} ${ROOTFS_APT_ARGS} localepurge fi cat '${WORKDIR}/locale.gen' >> '${ROOTFSDIR}/etc/locale.gen' @@ -115,7 +118,7 @@ EOSH if [ "$localepurge_state" = 'p' ] then echo removing localepurge... - chroot '${ROOTFSDIR}' apt-get purge --yes $localepurge_pkgs + /usr/bin/apt-get ${ROOTFS_HOST_APT_OPTS} purge --yes $localepurge_pkgs fi EOSUDO } diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass index cf996f5c..136a8861 100644 --- a/meta/classes-recipe/rootfs.bbclass +++ b/meta/classes-recipe/rootfs.bbclass @@ -59,6 +59,16 @@ ROOTFS_FEATURES:remove:focal = "generate-sbom" # Capture all information needed for sbom generation ROOTFS_APT_STATE = "apt-state.tar.zst" ROOTFS_APT_ARGS="install --yes -o Debug::pkgProblemResolver=yes" +ROOTFS_HOST_APT_OPTS = "-o Dir=${ROOTFSDIR} -o APT::Architecture=${ROOTFS_ARCH} -o DPkg::Chroot-Directory=${ROOTFSDIR}" + +# The host apt-get used to populate the rootfs must honor the rootfs' own apt +# configuration fragments instead of the host's /etc/apt. A command-line '-o' is +# applied too late (after apt has already read its config parts), so point apt at +# the chroot via APT_CONFIG, which is parsed during apt initialization - before +# the config parts directory is read. No host file is touched. +ROOTFS_HOST_APT_CONFIG = "${WORKDIR}/isar-host-apt.conf" +# Wrapper to run the host apt-get with that configuration. +HOST_APT_CMD = "env APT_CONFIG=${ROOTFS_HOST_APT_CONFIG} /usr/bin/apt-get ${ROOTFS_HOST_APT_OPTS}" ROOTFS_CLEAN_FILES="/etc/hostname /etc/resolv.conf" @@ -68,7 +78,7 @@ ROOTFS_PACKAGE_SUFFIX ?= "${PN}-${DISTRO}-${DISTRO_ARCH}" ROOTFS_STUBS_DIR = "/usr/local/isar-sbin" # list of : or mount entries -ROOTFS_MOUNTS ??= "${REPO_ISAR_DIR}/${DISTRO}:/isar-apt ${WORKDIR}:/isar-work" +ROOTFS_MOUNTS ??= "${WORKDIR}:/isar-work" python () { mounts = d.getVar('ROOTFS_MOUNTS', False) @@ -95,75 +105,6 @@ export LANG = "${LOCALE_DEFAULT}" export LANGUAGE = "${LOCALE_DEFAULT}" export LC_ALL = "${LOCALE_DEFAULT}" -# Execute a command against a rootfs and with isar-apt bind-mounted. -# Additional mounts may be specified using --bind and a -# custom directory for the command to be executed with --chdir . The -# command is assumed to follow the special "--" argument. This would replace -# "sudo chroot" calls especially when a native command may be used instead of -# chroot'ed command and without elevated privileges (the command will likely -# take the rootfs as argument; e.g. apt-get -o Dir=${ROOTFSDIR}). If the -# optional rootfs argument is omitted, the host rootfs will be used (e.g. to -# run native commands): this should be used with care. -# -# Usage: rootfs_cmd [options] [rootfs] -- command -# -rootfs_cmd() { - set -- "$@" - bwrap_args="--bind ${REPO_ISAR_DIR}/${DISTRO} /isar-apt" - bwrap_binds="" - bwrap_rootfs="" - - while [ "${#}" -gt "0" ] && [ "${1}" != "--" ]; do - case "${1}" in - --bind) - if [ "${#}" -lt "3" ]; then - bbfatal "--bind requires two arguments" - fi - bwrap_binds="${bwrap_binds} --bind ${2} ${3}" - shift 3 - ;; - --chdir) - if [ "${#}" -lt "2" ]; then - bbfatal "${1} requires an argument" - fi - bwrap_args="${bwrap_args} ${1} ${2}" - shift 2 - ;; - -*) - bbfatal "${1} is not a supported option!" - ;; - *) - if [ -z "${bwrap_rootfs}" ]; then - bwrap_rootfs="${1}" - shift - else - bbfatal "unexpected argument '${1}'" - fi - ;; - esac - done - - if [ -n "${bwrap_rootfs}" ]; then - bwrap_args="${bwrap_args} --bind ${bwrap_rootfs} /" - fi - - if [ "${#}" -le "1" ] || [ "${1}" != "--" ]; then - bbfatal "no command specified (missing --)" - fi - shift # remove "--", command and its arguments follows - - # bin, lib and lib64 are only real directories on unmerged-usr rootfs - for ro_d in bin etc lib lib64 sys usr var; do - [ -d ${bwrap_rootfs}/${ro_d} ] && [ ! -L ${bwrap_rootfs}/${ro_d} ] || continue - bwrap_args="${bwrap_args} --ro-bind ${bwrap_rootfs}/${ro_d} /${ro_d}" - done - - bwrap --unshare-user --unshare-pid ${bwrap_args} \ - --dev-bind /dev /dev --proc /proc --tmpfs /tmp \ - ${@'--bind "${REPO_ISAR_DIR}/${DISTRO}" /isar-apt' if d.getVar('ISAR_CHROOT_MODE') == 'unshare' else ''} \ - ${bwrap_binds} -- "${@}" -} - rootfs_do_mounts[weight] = "3" python rootfs_do_mounts() { if d.getVar('ISAR_CHROOT_MODE') == 'schroot': @@ -277,6 +218,20 @@ EOF EOSUDO } +ROOTFS_CONFIGURE_COMMAND += "rootfs_redirect_isar_apt_to_host" +rootfs_redirect_isar_apt_to_host() { + if [ -f "${ROOTFSDIR}/etc/apt/sources.list.d/isar-apt.list" ]; then + deb_dl_dir_isar_apt_to_host "${ROOTFSDIR}" + fi +} + +# restore by latest before capturing the apt state and before sstate caching +rootfs_redirect_isar_apt_to_target() { + if [ -f "${ROOTFSDIR}/etc/apt/sources.list.d/isar-apt.list" ]; then + deb_dl_dir_isar_apt_to_target "${ROOTFSDIR}" + fi +} + ROOTFS_CONFIGURE_COMMAND += "rootfs_configure_apt" rootfs_configure_apt[weight] = "2" rootfs_configure_apt() { @@ -299,6 +254,14 @@ rootfs_configure_apt() { EOSUDO } +# Point the host apt-get at the rootfs' apt.conf.d (see ROOTFS_HOST_APT_CONFIG). +ROOTFS_CONFIGURE_COMMAND =+ "rootfs_configure_host_apt_config" +rootfs_configure_host_apt_config[weight] = "1" +rootfs_configure_host_apt_config() { + echo 'Dir::Etc::parts "${ROOTFSDIR}/etc/apt/apt.conf.d";' \ + > '${ROOTFS_HOST_APT_CONFIG}' +} + ROOTFS_CONFIGURE_COMMAND += "rootfs_disable_initrd_generation" rootfs_disable_initrd_generation[weight] = "1" rootfs_disable_initrd_generation() { @@ -323,7 +286,7 @@ rootfs_install_pkgs_update() { run_privileged_heredoc <<'EOF' set -e ${@insert_isar_mounts(d, d.getVar('ROOTFSDIR'), d.getVar('ROOTFS_MOUNTS')) if d.getVar('ISAR_CHROOT_MODE') == 'unshare' else ''} - chroot '${ROOTFSDIR}' /usr/bin/apt-get update \ + ${HOST_APT_CMD} update \ -o Dir::Etc::SourceList="sources.list.d/isar-apt.list" \ -o Dir::Etc::SourceParts="-" \ -o APT::Get::List-Cleanup="0" @@ -354,10 +317,14 @@ rootfs_install_pkgs_download[progress] = "custom:rootfs_progress.PkgsDownloadPro rootfs_install_pkgs_download[isar-apt-lock] = "release-after" rootfs_install_pkgs_download[network] = "${TASK_USE_NETWORK}" rootfs_install_pkgs_download() { - # download packages using apt in a non-privileged namespace - rootfs_cmd --bind "${ROOTFSDIR}/var/cache/apt/archives" /var/cache/apt/archives \ - ${ROOTFSDIR} \ - -- /usr/bin/apt-get ${ROOTFS_APT_ARGS} -o Debug::NoLocking=1 --download-only ${ROOTFS_PACKAGES} + run_privileged_heredoc <<'EOF' + set -e + ${@insert_isar_mounts(d, d.getVar('ROOTFSDIR'), d.getVar('ROOTFS_MOUNTS')) if d.getVar('ISAR_CHROOT_MODE') == 'unshare' else ''} + ${HOST_APT_CMD} \ + ${ROOTFS_APT_ARGS} \ + -o Debug::NoLocking=1 \ + --download-only ${ROOTFS_PACKAGES} +EOF } ROOTFS_INSTALL_COMMAND_BEFORE_EXPORT ??= "" @@ -373,16 +340,15 @@ ROOTFS_INSTALL_COMMAND += "rootfs_install_pkgs_isar_download" rootfs_install_pkgs_isar_download[weight] = "50" rootfs_install_pkgs_isar_download[isar-apt-lock] = "acquire-before release-after" rootfs_install_pkgs_isar_download() { - # Command apt-get install do not cache packages from local repos - # We can obtain non cached package URIs by recalling install command here - # No need to export those files to dl_dir, so we can run it right after - rootfs_cmd --bind "${ROOTFSDIR}/var/cache/apt/archives" /var/cache/apt/archives \ - --chdir "/var/cache/apt/archives" \ - ${ROOTFSDIR} \ - -- /usr/bin/sh -c 'apt-get ${ROOTFS_APT_ARGS} --print-uris ${ROOTFS_PACKAGES} | \ - sed -n "s|^.file:\(/[^'\'']*\.deb\). \([^ ]*\.deb\).*|\1 \2|p" | \ - sed ":a; s|^\([^ ]*\)%|\1\\\\x|; ta" | \ - while read -r path name; do cp -n "$(/usr/bin/printf "%b" "$path")" "$name" ; done' + run_privileged_heredoc <<'EOF' + set -e + ${@insert_isar_mounts(d, d.getVar('ROOTFSDIR'), d.getVar('ROOTFS_MOUNTS')) if d.getVar('ISAR_CHROOT_MODE') == 'unshare' else ''} + ${HOST_APT_CMD} \ + ${ROOTFS_APT_ARGS} --print-uris ${ROOTFS_PACKAGES} | \ + sed -n "s|^.file:\(/[^'\'']*\.deb\). \([^ ]*\.deb\).*|\1 \2|p" | \ + sed ":a; s|^\([^ ]*\)%|\1\\\\x|; ta" | \ + while read -r path name; do cp -n "$(/usr/bin/printf "%b" "$path")" "${ROOTFSDIR}/var/cache/apt/archives/$name" ; done +EOF } ROOTFS_INSTALL_COMMAND += "${@ 'rootfs_install_clean_files' if (d.getVar('ROOTFS_CLEAN_FILES') or '').strip() else ''}" @@ -403,8 +369,7 @@ rootfs_install_pkgs_install() { run_privileged_heredoc <<'EOF' set -e ${@insert_isar_mounts(d, d.getVar('ROOTFSDIR'), d.getVar('ROOTFS_MOUNTS')) if d.getVar('ISAR_CHROOT_MODE') == 'unshare' else ''} - chroot "${ROOTFSDIR}" \ - /usr/bin/apt-get ${ROOTFS_APT_ARGS} --no-download ${ROOTFS_PACKAGES} + ${HOST_APT_CMD} ${ROOTFS_APT_ARGS} --no-download ${ROOTFS_PACKAGES} EOF } @@ -424,7 +389,7 @@ rootfs_clear_initrd_symlinks() { run_privileged rm -f ${ROOTFSDIR}/initrd.img.old } -ROOTFS_INSTALL_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'generate-sbom', 'rootfs_capture_apt_state', '', d)}" +ROOTFS_POSTPROCESS_COMMAND:prepend = "${@bb.utils.contains('ROOTFS_FEATURES', 'generate-sbom', 'rootfs_capture_apt_state', '', d)} " rootfs_capture_apt_state() { ( cd ${ROOTFSDIR} && find usr/share/doc -name copyright -print0 ) | \ tar -cf ${WORKDIR}/${ROOTFS_APT_STATE} --zstd --sort=name \ @@ -437,6 +402,7 @@ rootfs_capture_apt_state() { var/lib/apt/extended_states \ var/lib/dpkg/status } +ROOTFS_POSTPROCESS_COMMAND:prepend = "rootfs_redirect_isar_apt_to_target " do_rootfs_install[root_cleandirs] = "${ROOTFSDIR}" do_rootfs_install[cleandirs] += "${DEPLOYDIR}" @@ -533,8 +499,7 @@ cache_dbg_pkgs() { ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'clean-package-cache', 'rootfs_postprocess_clean_package_cache', '', d)}" rootfs_postprocess_clean_package_cache() { - run_in_chroot '${ROOTFSDIR}' \ - /usr/bin/apt-get clean + run_privileged ${HOST_APT_CMD} clean # remove apt-cache folder itself (required in case rootfs is provided by sstate cache) run_privileged find "${ROOTFSDIR}/var/cache/apt" -type f \ \( -name '*.deb' -o -name '*.bin' \) -delete diff --git a/meta/classes-recipe/sdk.bbclass b/meta/classes-recipe/sdk.bbclass index ca38cfc3..eda1c92f 100644 --- a/meta/classes-recipe/sdk.bbclass +++ b/meta/classes-recipe/sdk.bbclass @@ -42,7 +42,10 @@ SDK_PREINSTALL += " \ apt \ automake \ devscripts \ - equivs" + equivs \ + apt \ + passwd \ +" # rootfs/image overrides for the SDK ROOTFS_ARCH:class-sdk = "${HOST_ARCH}" diff --git a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc index ee6eda3c..cb8334eb 100644 --- a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc +++ b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc @@ -9,7 +9,7 @@ inherit bootstrap inherit compat inherit deb-dl-dir -DISTRO_BOOTSTRAP_BASE_PACKAGES += "locales apt" +DISTRO_BOOTSTRAP_BASE_PACKAGES += "locales" DISTRO_BOOTSTRAP_BASE_PACKAGES:append:https-support = " ca-certificates" BOOTSTRAP_TMPDIR = "${WORKDIR}/tempdir" @@ -146,7 +146,7 @@ do_bootstrap() { bbfatal "${DISTRO_ARCH} does not have a compat arch" fi fi - bootstrap_args="--verbose --variant=minbase --include=${@','.join(d.getVar('DISTRO_BOOTSTRAP_BASE_PACKAGES').split())}" + bootstrap_args="--verbose --variant=essential --include=${@','.join(d.getVar('DISTRO_BOOTSTRAP_BASE_PACKAGES').split())}" if [ -f "${DISTRO_BOOTSTRAP_KEYRING}" ]; then bootstrap_args="$bootstrap_args --keyring=${DISTRO_BOOTSTRAP_KEYRING}" cp "${DISTRO_BOOTSTRAP_KEYRING}" "${WORKDIR}/trusted.gpg.d/" @@ -174,10 +174,6 @@ do_bootstrap() { syncout='echo skip sync-out' extra_setup="mount --bind '${REPO_BASE_DIR}' $base_apt_tmp" extra_extract="$syncout" - # save mmdebstrap tempdir for cleanup - extra_essential="mkdir -p \$1/$base_apt_tmp && \ - echo \$1 > ${WORKDIR}/mmtmpdir && \ - mount -o bind,private '${REPO_BASE_DIR}' \$1/$base_apt_tmp" # replace base-apt mount in tmp with /base-apt mount extra_customize="sed -i \"s|copy://$base_apt_tmp|file:///base-apt|g\" \ \$1/etc/apt/sources.list.d/*.list && \ @@ -206,15 +202,6 @@ do_bootstrap() { "${WORKDIR}/dl_dir/var/cache/apt/archives/"' extra_setup="$syncin" extra_extract="$syncout" - # prefetch apt debs because mmdebstrap will clean them on next stage - extra_essential='apt-get install apt -y -d \ - -o Dir::State="$1/var/lib/apt" \ - -o Dir::Etc="$1/etc/apt" \ - -o Dir::Cache="$1/var/cache/apt" \ - ${@'-o APT::Sandbox::User=root' if d.getVar('ISAR_CHROOT_MODE') == 'unshare' else ''} \ - -o Apt::Architecture="${BOOTSTRAP_DISTRO_ARCH}" \ - ${@get_apt_opts(d, '-o')}' - extra_essential="$extra_essential && $syncout" extra_customize="$syncout" fi @@ -250,11 +237,9 @@ do_bootstrap() { --setup-hook='chown -R root:root "$1/etc/apt/trusted.gpg.d"' \ --setup-hook='install -v -m755 "${WORKDIR}/chroot-setup.sh" "$1/chroot-setup.sh"' \ --extract-hook="$extra_extract" \ - --essential-hook="$extra_essential" \ --customize-hook="$extra_customize" \ --customize-hook='sed -i "/en_US.UTF-8 UTF-8/s/^#//g" "$1/etc/locale.gen"' \ --customize-hook='chroot "$1" /usr/sbin/locale-gen' \ - --customize-hook='chroot "$1" /usr/bin/apt-get -y clean' \ --customize-hook='echo nameserver 127.0.0.1 > "$1"/etc/resolv.conf' \ --customize-hook='echo isar > "$1"/etc/hostname' \ ${@'--skip=output/dev' if d.getVar('ISAR_CHROOT_MODE') == 'unshare' else ''} \ diff --git a/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb b/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb index f347327b..d0f848a8 100644 --- a/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb +++ b/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb @@ -21,7 +21,7 @@ DEPENDS:append:bookworm = " python3-cyclonedx-lib" DEPENDS:append:noble = " python3-cyclonedx-lib" DEPENDS += "python3-debsbom python3-spdx-tools" -SBOM_IMAGE_INSTALL = "python3-debsbom python3-spdx-tools python3-cyclonedx-lib" +SBOM_IMAGE_INSTALL = "python3-debsbom python3-spdx-tools python3-cyclonedx-lib lz4" ROOTFSDIR = "${WORKDIR}/rootfs" ROOTFS_PACKAGES = "${SBOM_IMAGE_INSTALL}" diff --git a/meta/recipes-devtools/sbuild-chroot/sbuild-chroot.inc b/meta/recipes-devtools/sbuild-chroot/sbuild-chroot.inc index 80c43d20..f0d79ad2 100644 --- a/meta/recipes-devtools/sbuild-chroot/sbuild-chroot.inc +++ b/meta/recipes-devtools/sbuild-chroot/sbuild-chroot.inc @@ -54,6 +54,7 @@ SBUILD_CHROOT_PREINSTALL_COMMON = " \ ${@ 'ccache' if bb.utils.to_boolean(d.getVar('USE_CCACHE')) else ''} \ devscripts \ equivs \ + apt \ " SBUILD_CHROOT_DIR = "${WORKDIR}/rootfs"