diff mbox series

[1/1] bootstrap: fix building from isar checkout with strict file permissions

Message ID 20260911075941.1175172-1-felix.moessbauer@siemens.com
State Priority Review
Headers show
Series [1/1] bootstrap: fix building from isar checkout with strict file permissions | expand

Commit Message

Felix Moessbauer Sept. 11, 2026, 7:59 a.m. UTC 
When cloning the isar repository under a umask of 0007, the
chroot-setup.sh file is not world readable. In unshare mode, the
setup-hook of mmdebstrap runs in the unprivileged namespace under a
different user, unable to read the chroot-setup.sh file. By that, the
install <...> fails. For cases like this, mmdebstrap provides the upload
helper, which internally handles the copy in of the file. As this does
not provide a way to set the permissions (in contrast to install), we
chmod the file afterwards.

Fixes: 4fedb1ae ("add support for fully rootless builds")
Reported-by: Clara Kowalsky <clara.kowalsky@siemens.com>
Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
index ee6eda3c..5d4ca1ef 100644
--- a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
+++ b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
@@ -248,7 +248,8 @@  do_bootstrap() {
                    --setup-hook='mkdir -p "$1/etc/apt/trusted.gpg.d"' \
                    --setup-hook='sync-in "${WORKDIR}/trusted.gpg.d" /etc/apt/trusted.gpg.d' \
                    --setup-hook='chown -R root:root "$1/etc/apt/trusted.gpg.d"' \
-                   --setup-hook='install -v -m755 "${WORKDIR}/chroot-setup.sh" "$1/chroot-setup.sh"' \
+                   --setup-hook='upload "${WORKDIR}/chroot-setup.sh" "/chroot-setup.sh"' \
+                   --setup-hook='chmod a+rx "$1/chroot-setup.sh"' \
                    --extract-hook="$extra_extract" \
                    --essential-hook="$extra_essential" \
                    --customize-hook="$extra_customize" \