From patchwork Fri Oct 2 14:49:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Felix Moessbauer X-Patchwork-Id: 5532 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Fri, 02 Oct 2026 16:50:04 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-yx1-f59.google.com (mail-yx1-f59.google.com [74.125.224.59]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 692Eo2sS006635 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 2 Oct 2026 16:50:02 +0200 Received: by mail-yx1-f59.google.com with SMTP id 956f58d0204a3-67692931213sf4203847d50.0 for ; Fri, 02 Oct 2026 07:50:02 -0700 (PDT) ARC-Seal: i=3; a=rsa-sha256; t=1790952596; cv=pass; d=google.com; s=arc-20260327; b=eqAann9P3UwuRDoVqmDvXKYRM+IDmcE4doJdPxOFKu9Kcfi5xFJhnso4+339WgJ87f NAYEJ7r6kh6H68rWM01xEfnwyPU4exfvGGRH5fM58/UxUFdeULVj20vfc9oJCJuPCqUU xK8pfLnMhkCBYkHoC+qFDBLEE2ufQeJgRkmdLh8TBKh0iD8vPLzhfTIZ5zVy3FdNWhvJ 0LbPfRr86KQK8CgKuVpoP8oEsJAe3cG7XHRGsDcWX0nMd2FQnU5ERsrLvtuIV0JDPgFj IYVUjH4Yg+UHGhSpotZEjaDW6ek5PvfbwOzNbW92ekklffPWPIp+PbYfQONmwedqwShK Hg4Q== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:dkim-signature; bh=lLCjftH72k/oQJcSzV4SysbH5qnxT09MTTGnm4jfSsM=; fh=PCM07FPsOhQI+PnAEOTalrdSojpeXy0WXF4k/fCHBFI=; b=ezxO3yEC2Pk/sWcxqL204senerhgNoW1B7kHH4WqvtUZAuuEx3alLG4L7NY5N9Hgw/ nqP8E4F4b+STibHRM9xHAeYnbTmkYnlUd2DwTpF5NrtJO7eHpylYcJG9nnugFzh+MTka iAH7AB9rodud/N2mAJm+P2im2AX4m5FSIJI9XMR4BYiDn5fktUGMqDvTBOsny8lW9XDM 2lNuc7G/r492yZH3UPdBaD8262qM6gZzxY/O/XsEZtFOo1uC7cy6EySo/zwXkpeKc7AR YWi9OVvI4XDrDybRZHNxOgiNQLmVDMOKKFZcMZ/0gyWVGr/NIH67xLkbltgDWDikv8iD Blog==; darn=isar-build.org ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=JU5B9qfz; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::1 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1790952596; x=1791557396; darn=isar-build.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-type:references:in-reply-to:message-id:date:subject:cc:to :from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=lLCjftH72k/oQJcSzV4SysbH5qnxT09MTTGnm4jfSsM=; b=LpKPac9rHxL8CUc/6jc5gb/I8PdeldgBuJ+ltGdIkukriT6zL/sO1XeYy8qVbvsuUT BPEoBvHAbHFM3oe7O4NsPQUzBCuXXDkLtt1N8HCrxXKzM4/tgb1UO74j+FaP/iwnvftd ygNAT7m8QO22Iqb3D8mgW8YEgNmihZCZF6wdD/szy+oH2/PRu13uWEfvklgmryCNnSuI dpPL0hTrKktTUjxds4at1BKxkedeUpcI7+SysnDJx/ogqurzIdWqmNWVFgst950nfgXR j2PmHFu7iO8XuO5Uj/0EyK9WH1xHJMZD1nL3eA31bPEI2tLBh7yVA9+e5yvfomri6uNQ htYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790952596; x=1791557396; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-type:references:in-reply-to:message-id:date:subject:cc:to :from:x-beenthere:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=lLCjftH72k/oQJcSzV4SysbH5qnxT09MTTGnm4jfSsM=; b=LXqWxfjaz4nXkdebMIowrSqVKZCkcqrx/F7sOEvlDO5T9XxKcw2bF7t/eWzKnywUoa x15XtJwUJVLITJzk0xBn2cjxdjO6LZnKrPoGw5HevA0UbN8xzjbY4lhCu0Wsogyee91c 5tQRPWDjWI7GNq9erkL3/NS8S3q3/fr5Im7LM8M1l7E/1tUA54SezyiD2Es2MEse7kc7 pWPsJtnV5g1eVjEeG45Tr2nGNjg3sr9B/Ft7Z+X1Rl0VgJ/e7DNXPC55Ttm9bJqzaDJC Bdk06bhWGljFjHW2f7kQIekS5fGKVbYw9fuvHWdcp9q4DT563ym9DqE61wSK4EN+d3pv BkTw== X-Forwarded-Encrypted: i=3; AKwUvBzZnxBGqX6R5nRyNlQkrl+3+a5ooXqjpntKiRwb0axcT0IukQRYV1YL9qB/tMZvJ9sUM6MMpa0=@isar-build.org X-Gm-Message-State: AFq9FYKM4XNZn3JzyuBcqn9X2ikgyrHnGzt3fJTKSkannUPedBdmq9Lj jDGQEvXkVBrU3wm25b/q1OoKcIzvVK5AwCEk7cG4WEifHy+uY7QcoWvr X-Received: by 2002:a05:690e:d08:b0:675:d561:1edc with SMTP id 956f58d0204a3-677ac118e65mr1245688d50.85.1790952596340; Fri, 02 Oct 2026 07:49:56 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="ATskLddMhQ03ZHtuNq53N5Km0Ubgi6DP6gri/kC6zjMbBNLUZA==" Received: by 2002:a05:690e:1c9:b0:66f:aef4:103e with SMTP id 956f58d0204a3-677acfe81c6ls952722d50.1.-pod-prod-05-us; Fri, 02 Oct 2026 07:49:55 -0700 (PDT) X-Received: by 2002:a05:690e:400c:b0:676:8b17:77bd with SMTP id 956f58d0204a3-677ac02d70cmr1428574d50.46.1790952595321; Fri, 02 Oct 2026 07:49:55 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1790952595; cv=pass; d=google.com; s=arc-20260327; b=I3jPvD4s/w0PTQkwEt1krbF65BnA88IGzS+5AAuK4CPH7f+TQ/7RSgyy4jDYUZtqD7 LXzL7x/pCn7eoZzg0jTPCoyIOvbm59JmwWphvBxTiEN4wMbS0hkSQLgQwdygG07CKSBf E35JfWFQhJBYAbr8vOnl/iJ50/j3GoUr8IU+pjrX0QvUq6hb6X9W6cMUTlchAnuRDDuA yTnT78t5Q3x1FC4o/rZsnJwq3GIYjrOQN5vTtwS5KmnK8eIS1oe3LybnnvCffj75unvi KsXtJxk4Ss9Qv03RomYw8XJ1JidMP4sWgL6kEHEn26GcUuMMB6OK24EO8zLQLU/AXQvM DPPA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:content-transfer-encoding:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=A4MPoCzuyOZGqxGrkf6C+CZnkRfxi+CBUXTS0ejd7pc=; fh=8dBW2IRCVdGsmrD2hdAVDsJaRF/dLexRtANCwaOHVZk=; b=k7MjUxk7l6SC4SD/5qFmoYZqiZonELXxgE6VInxWy8ZVoC3B9uNh/moD6uJcqm5Jvp iycDuZaxa4i2uLsHvorooyO6+KHhlzcn5xI7VD+3z0dZccHBA3ScsQjf3DfeCnilhHdq Kqwc8QMC4EDv5QCpsVrRXzVO8kZdmWEt2TJTUipdOZvImNra2RqBGlUfUBu79jZxO+Mh uXg4Bpl6Pdf+mEQ5ElJM7tCrAdR+EIO6rC2k4nGc5pj6SVRcl4qJ79BOgnCbyxdQHuBv JH3jJLow0j1YmUqs2pwOUlHAvTNapYPgRKuAACt2K4H2cTqKPG6rhhVzzylpdsVr2M5f kQDw==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=JU5B9qfz; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::1 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from AM0PR83CU005.outbound.protection.outlook.com (mail-westeuropeazlp170100001.outbound.protection.outlook.com. [2a01:111:f403:c201::1]) by gmr-mx.google.com with ESMTPS id 956f58d0204a3-677ac54f4c8si93667d50.5.2026.10.02.07.49.55 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 02 Oct 2026 07:49:55 -0700 (PDT) Received-SPF: pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::1 as permitted sender) client-ip=2a01:111:f403:c201::1; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ov34XrNhUSrhm3gnRPV6R2i9lVOhyJ8OHv5qx+iH3697/BkrGvCpiEujoylS4UdvWPybjWeClBcp+RAx68oeM0huInqdz7PJM5Bdygbjy0T0ZRCUizjZcHVKwGl8Lt5/Ha19bCy6OxoZFz1E5CbIMYlNLFDiuw8FAL5Wc4jHoalAV+2luXhyYFCNx7nwmd9BcNJWdE+LBgLZye+A8zy+emDOYMmqRfrDz7mUstw5mQAH+0ap6hgG+tYlkRaLQ+aFWNHfKqJ4o1hjEFJGsSwC5EMJlUCDmzmrf0Q1bL/WVk0VHjBVAh65sCnDzzjJV0SQqIbRy0vf7sAbD4J0wkVriA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=A4MPoCzuyOZGqxGrkf6C+CZnkRfxi+CBUXTS0ejd7pc=; b=nRy4bXtPOesdQn9is54AsLByWzL+zlfyaTRrKP4PPLOh1sFuH/98gxiV4bQQrKcIF93/ke+ywlj7/UBZZ4Dj6Bb2FUnljB4CETrWVIKDhourL/NXOGS/dWP/OxQhsnncMH+RdQyjQJfoa/q5DURaZPQZV0PWRevvM/kavimIs+iPyHzvGdah731q1uIcJ69p/apCZhNgAxTiR+LrSpxH09qzmVJ5NIYm2TffWx9y3NNv0f2m9B734f2EuHCMS2oRE7cA5PEgS1uRwS+sphnLOtQgoI+KS8drLYggOIIRw81rEOtOFnTVXJofmnufYn0/ObqJ5C9KwMQyvJxTkmuVqA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:17e::10) by DB8PR10MB3737.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:119::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.18; Fri, 2 Oct 2026 14:49:50 +0000 Received: from AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM ([fe80::c54c:ccd8:ebbf:477c]) by AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM ([fe80::c54c:ccd8:ebbf:477c%3]) with mapi id 15.21.0472.016; Fri, 2 Oct 2026 14:49:50 +0000 X-Patchwork-Original-From: "'Felix Moessbauer' via isar-users" From: Felix Moessbauer To: isar-users@googlegroups.com Cc: cedric.hombourger@siemens.com, jan.kiszka@siemens.com, quirin.gylstorff@siemens.com, Felix Moessbauer Subject: [PATCH 11/13] rootfs: use host apt to install packages into rootfs Date: Fri, 2 Oct 2026 16:49:34 +0200 Message-ID: <20261002144936.246628-12-felix.moessbauer@siemens.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261002144936.246628-1-felix.moessbauer@siemens.com> References: <20261002144936.246628-1-felix.moessbauer@siemens.com> X-ClientProxiedBy: FR0P281CA0205.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:ad::19) To AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:17e::10) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM7PR10MB3956:EE_|DB8PR10MB3737:EE_ X-MS-Office365-Filtering-Correlation-Id: 75d6127c-6e05-4c02-e161-08df20946924 X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|23010399003|366016|10070799003|1800799024|22082099003|18002099003|55112099003|56012099006|3023799007|6133799003|10067099003|11063799006; X-Microsoft-Antispam-Message-Info: 2+nvcUA1xsEdl4LcxALBRbyMec13Oh4yfU/Dvx4rpaYYDXPIpw8IZyE+yH7Az+zbCRyyypkthA2mewO33Igy8QQ2XVLWbzgZfI1Vjp8hLMRr8QpbiMoOLLu5JV7yTR9+u7R46WYvmZ0k3eTmsOTRdln5f3QxeOnRnSUouk2y8AamcB08ND2lMAaWEL2XrNeEAJSdQJHW645xbOJ8lleDeyIcbbVGFGjRINp7a2y/jyJxBVI/KR+0R6sVGxAEERB82SYOioTvL0hQkJM0Xiys93LWmN5csmYYGR7EXUDS8DYGXr5ttPlcVO8PhQE7bsD+5blZCbzhWsFZz0al3DwscdceKxUmAKiv2jfF8JgodqFeszKAbKx+iDM3BA5AhEdimcWyCwJOy4TfnBMClAKAVDoFoFg7yets3jK7k/KUqyHepVOvJRaiIUTgGU45kjLK2hh93hp5IilJSZYRejFUxKvzuAs6KqHYJSwNVOXTIvnosKBZxCP/UZjip+CiJqGqZj6NfH1TL227ftMNai8/CVvSAqrti2oW9cqpIzRLLV+5do2SAFbwqnNHtTRdGaxGl8dQvGnuawTfeGgSMFvcItAEVkVGNpLUEsZcsJgFNkMW9G1CX+8d+rf8qdaF8w9Qrtpf/mWQTY11j34/UyTSEi+u1O4DDjsxlYvlpC9FEsk= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(366016)(10070799003)(1800799024)(22082099003)(18002099003)(55112099003)(56012099006)(3023799007)(6133799003)(10067099003)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: 9gEYx0edpNaR0M43Azt43Gcc/mzTf7TSs+5HGTeeeQ3E7jmGPjGLcVk5HPk0B7nXvPOTUzI0ZqHkcAv7rlQAjw1O4ewTmCYWWhKGXo8goWlEIf18nupw19mhitGUDz8kUUGhajJd01+xqZYM4I3O5ppVKFYVCKgbnAPkBAglrRqYPmYo+eJxhGJdqM80QbMoOo1aQYZmMOyRqF9k81wM4BxghCi5JXxQ6Uo15pG7hfjPV9tBoghZ4eG2dSN/8U2tNIuvOoNSwVx+JVoR7BrekEF9P5mvre6ARwvjxVYD9aJNLzj6DYzSu7F6wM3TrDjgJTN74Z0caBm3QDXuk5EOHoH/otbZJ5m7I2zvtpGp7la+EuURK5W1gGrwcJckUgrlynEKg5habLmEPaqdeHMf8fuE8RbBv3aPOIWKVEs3czbJH7I3u2nSybeOtwtThRJr/pLEalTck94fl8ftH9D397JxrkG0qRmhPHQXG7NGlC6YUPnS8UH+pqX+NBuSNvkKZXPSp0MIjkv+5EpYSL1sDYEnC8Svw9zVJTMYUlB/YalugZZZ2QOQTPuayHJAZp3l8/MSTqyQOSmS1YxChMsRFrKtML7P9BTKhj8ON869SUQoHmsRD6ShhjYgP4vgZCAsmKYP1uxuPdAS9Ie9tjbbFEQk62u4HHxTxfvlEBI5qPIJz9pS3dUkOO9w+XMZ2xqsFTqZ7NAGeAGGw+Yb7Zmk0plHyJ39j1qwDc4177AfcRFocsSmCVK4DgPhdf/xCn7Gz0TDn3sEEw/9wZVu+E1KzN8PduV03oc1uy3jlxF503xZx3SQEdm7prHSs2rEGZEmYWOXkYboDt5h3yU0cPSCIWI+SxC9uHJhFqg04Unmc1D0fM5fR0l8VAGGlsZQFL1wr7dGcXn7WNhqwimPYaWPZT3ZqURe5mQtE6wBOMF1Ij80bUYIdjWyXlteg66jEHzwgfxlrI6KhGDkmxx6tyeywS3FvI/RxdGoRs+27KAQ4Y8cHzbjuiUGw0O1coOSLRZmHVqmJAlme+WeJnAew1BKR2TzXR+T+Ee/MnOGSq56rnNeDjlPMIX4gVhFeSQLxvz28sGWlUfolQiDfpuXr+Twq2QGEEaRslrJyiC29b9G3JEL8iWFQGZxsOIylbYa9RboA1EsZBpdL4UBtKY7W6DWF9hpQXUlNyUcbNzVHBiUly4x+NHO0C5nNNCXLktsP2Cp2oUdGEphNiLqoHDYwIJJZktS1TefW3UwUMY2nn+lRAe8VLrtCS+nnkiqsVq/C7vGvbmWCIaBVr4g5zalAn4cf/bv5L2YcChglkRRxviVw7f/rLjF8ncIt9sNiyZCtq8otVr8TJX1PLtU14J50L/jFI21acLnKhwd5CjMlPrA9pOklGT0/E20SnZVWbMt7A2ElWkP4YzFFwU4huHBHJwZoDczTtoxtli0nYdBOQc3srq+W3wge1HIjsL5JjeIMhlfOriEXD11TVDLJom0m0JIBpc9Md2WFfMQtoe+GyY/mmjLny+ZS6X9QIxLELx7v4Ko2+2xkZnIizmyoTInVFdmXbRRb5A6eFqY+/5Fgmcz0IOofQ17nlaApaho3yFD5T4UoM14wt7luwDBwJJWVJ49UKeE6lZpVcmTOVT7f5ZG9yoaE2pBSt0OYnBcuLVVJfyUE6bZmt0KWSB3CyKUx628c0TPC6A4Mc+m9dTgkY8NoeodHMCecMaadHCTodnZz/XJlsoXmnZ8rMUCdY5HGG2saHvagriiezb1pig4McbcOUOrUTrcQIDsmY8huBJVIhQDcT33yiwk X-MS-Exchange-AntiSpam-MessageData-1: lVhALVvL7Vq9e+sSQrc0jxVjSZ2s/xYW3e0= X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-Network-Message-Id: 75d6127c-6e05-4c02-e161-08df20946924 X-MS-Exchange-CrossTenant-AuthSource: AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Oct 2026 14:49:50.2248 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ZDxltONZ1DWJE0PeCC+J+UgptGEGqiLa3mPorY/wOpRmnzXF8ej3eXQlIFB2vvRJfeNvyTzJ+YsdFzjwAEum5jNI6JOyRvQVla++S8WrdH0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8PR10MB3737 X-Original-Sender: felix.moessbauer@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=JU5B9qfz; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::1 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Felix Moessbauer Reply-To: Felix Moessbauer Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2,RCVD_IN_RP_CERTIFIED, RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= We currently use the apt inside the rootfs to operate on the rootfs. This has two major disadvantages: 1. on non-native, the apt invocations are emulated (including the extraction of the packages and downloading) 2. apt must be installed in the rootfs (which makes the rootfs larger and pulls in a lot of static-build-using dependencies related to the rust parts, which is relevant for license clearing) We change that similar to how mmdebstrap is doing it: Use the host apt to operate on the chroot, whereby dpkg itself runs inside the chroot to have proper support for the maintainer scripts. By that, apt is not emulated and the generated chroots can be much smaller. Signed-off-by: Felix Moessbauer --- meta/classes-recipe/deb-dl-dir.bbclass | 34 ++++++ meta/classes-recipe/rootfs.bbclass | 145 ++++++++++--------------- 2 files changed, 89 insertions(+), 90 deletions(-) diff --git a/meta/classes-recipe/deb-dl-dir.bbclass b/meta/classes-recipe/deb-dl-dir.bbclass index bafe3a63..3f41f9e1 100644 --- a/meta/classes-recipe/deb-dl-dir.bbclass +++ b/meta/classes-recipe/deb-dl-dir.bbclass @@ -178,3 +178,37 @@ deb_dl_dir_export() { done EOF } + +# Point isar-apt at its real build-path location so host apt can access it. +# The reproducible 'file:///isar-apt' encodes to the apt list prefix '_isar-apt', +# the real repo path encodes to the same path with '/' replaced by '_'. +deb_dl_dir_isar_apt_to_host() { + export rootfs=$1 + export host_prefix="$(printf '%s' '${REPO_ISAR_DIR}/${DISTRO}' | tr '/' '_')" + run_privileged_heredoc << ' EOSUDO' + set -e + sed -i 's|file:///isar-apt|file://${REPO_ISAR_DIR}/${DISTRO}|g' \ + "${rootfs}/etc/apt/sources.list.d/isar-apt.list" + for f in "${rootfs}/var/lib/apt/lists/"_isar-apt*; do + [ -e "$f" ] || continue + suffix="$(basename "$f" | sed 's|^_isar-apt||')" + mv "$f" "${rootfs}/var/lib/apt/lists/${host_prefix}${suffix}" + done + EOSUDO +} + +# Revert the deb_dl_dir_isar_apt_to_host changes. +deb_dl_dir_isar_apt_to_target() { + export rootfs=$1 + export host_prefix="$(printf '%s' '${REPO_ISAR_DIR}/${DISTRO}' | tr '/' '_')" + run_privileged_heredoc << ' EOSUDO' + set -e + sed -i 's|file://${REPO_ISAR_DIR}/${DISTRO}|file:///isar-apt|g' \ + "${rootfs}/etc/apt/sources.list.d/isar-apt.list" + for f in "${rootfs}/var/lib/apt/lists/${host_prefix}"*; do + [ -e "$f" ] || continue + suffix="$(basename "$f" | sed "s|^${host_prefix}||")" + mv "$f" "${rootfs}/var/lib/apt/lists/_isar-apt${suffix}" + done + EOSUDO +} diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass index 4fd627c2..994e8662 100644 --- a/meta/classes-recipe/rootfs.bbclass +++ b/meta/classes-recipe/rootfs.bbclass @@ -65,6 +65,16 @@ ROOTFS_FEATURES:remove:focal = "generate-sbom" # Capture all information needed for sbom generation ROOTFS_APT_STATE = "apt-state.tar.zst" ROOTFS_APT_ARGS="install --yes -o Debug::pkgProblemResolver=yes" +ROOTFS_HOST_APT_OPTS = "-o Dir=${ROOTFSDIR} -o APT::Architecture=${ROOTFS_ARCH} -o DPkg::Chroot-Directory=${ROOTFSDIR}" + +# The host apt-get used to populate the rootfs must honor the rootfs' own apt +# configuration fragments instead of the host's /etc/apt. A command-line '-o' is +# applied too late (after apt has already read its config parts), so point apt at +# the chroot via APT_CONFIG, which is parsed during apt initialization - before +# the config parts directory is read. No host file is touched. +ROOTFS_HOST_APT_CONFIG = "${WORKDIR}/isar-host-apt.conf" +# Wrapper to run the host apt-get with that configuration. +HOST_APT_CMD = "env APT_CONFIG=${ROOTFS_HOST_APT_CONFIG} /usr/bin/apt-get ${ROOTFS_HOST_APT_OPTS}" ROOTFS_CLEAN_FILES="/etc/hostname /etc/resolv.conf" @@ -76,7 +86,7 @@ ROOTFS_INITRD_STUBS = "update-initramfs" ROOTFS_INITRD_STUBS += "${@ ' dracut' if bb.utils.to_boolean(d.getVar('ROOTFS_USE_DRACUT')) else '' }" # list of : or mount entries -ROOTFS_MOUNTS ??= "${REPO_ISAR_DIR}/${DISTRO}:/isar-apt ${WORKDIR}:/isar-work" +ROOTFS_MOUNTS ??= "${WORKDIR}:/isar-work" python () { mounts = d.getVar('ROOTFS_MOUNTS', False) @@ -102,75 +112,6 @@ export LANG ??= "C" export LANGUAGE ??= "C" export LC_ALL ??= "C" -# Execute a command against a rootfs and with isar-apt bind-mounted. -# Additional mounts may be specified using --bind and a -# custom directory for the command to be executed with --chdir . The -# command is assumed to follow the special "--" argument. This would replace -# "sudo chroot" calls especially when a native command may be used instead of -# chroot'ed command and without elevated privileges (the command will likely -# take the rootfs as argument; e.g. apt-get -o Dir=${ROOTFSDIR}). If the -# optional rootfs argument is omitted, the host rootfs will be used (e.g. to -# run native commands): this should be used with care. -# -# Usage: rootfs_cmd [options] [rootfs] -- command -# -rootfs_cmd() { - set -- "$@" - bwrap_args="--bind ${REPO_ISAR_DIR}/${DISTRO} /isar-apt" - bwrap_binds="" - bwrap_rootfs="" - - while [ "${#}" -gt "0" ] && [ "$1" != "--" ]; do - case "$1" in - --bind) - if [ "${#}" -lt "3" ]; then - bbfatal "--bind requires two arguments" - fi - bwrap_binds="${bwrap_binds} --bind $2 $3" - shift 3 - ;; - --chdir) - if [ "${#}" -lt "2" ]; then - bbfatal "$1 requires an argument" - fi - bwrap_args="${bwrap_args} $1 $2" - shift 2 - ;; - -*) - bbfatal "$1 is not a supported option!" - ;; - *) - if [ -z "${bwrap_rootfs}" ]; then - bwrap_rootfs="$1" - shift - else - bbfatal "unexpected argument '$1'" - fi - ;; - esac - done - - if [ -n "${bwrap_rootfs}" ]; then - bwrap_args="${bwrap_args} --bind ${bwrap_rootfs} /" - fi - - if [ "${#}" -le "1" ] || [ "$1" != "--" ]; then - bbfatal "no command specified (missing --)" - fi - shift # remove "--", command and its arguments follows - - # bin, lib and lib64 are only real directories on unmerged-usr rootfs - for ro_d in bin etc lib lib64 sys usr var; do - [ -d ${bwrap_rootfs}/${ro_d} ] && [ ! -L ${bwrap_rootfs}/${ro_d} ] || continue - bwrap_args="${bwrap_args} --ro-bind ${bwrap_rootfs}/${ro_d} /${ro_d}" - done - - bwrap --unshare-user --unshare-pid ${bwrap_args} \ - --dev-bind /dev /dev --proc /proc --tmpfs /tmp \ - ${@'--bind "${REPO_ISAR_DIR}/${DISTRO}" /isar-apt' if d.getVar('ISAR_CHROOT_MODE') == 'unshare' else ''} \ - ${bwrap_binds} -- "${@}" -} - rootfs_do_mounts[weight] = "3" python rootfs_do_mounts() { if d.getVar('ISAR_CHROOT_MODE') == 'schroot': @@ -293,6 +234,20 @@ EOF EOSUDO } +ROOTFS_CONFIGURE_COMMAND += "rootfs_redirect_isar_apt_to_host" +rootfs_redirect_isar_apt_to_host() { + if [ -f "${ROOTFSDIR}/etc/apt/sources.list.d/isar-apt.list" ]; then + deb_dl_dir_isar_apt_to_host "${ROOTFSDIR}" + fi +} + +# restore by latest before capturing the apt state and before sstate caching +rootfs_redirect_isar_apt_to_target() { + if [ -f "${ROOTFSDIR}/etc/apt/sources.list.d/isar-apt.list" ]; then + deb_dl_dir_isar_apt_to_target "${ROOTFSDIR}" + fi +} + ROOTFS_CONFIGURE_COMMAND += "rootfs_configure_apt" rootfs_configure_apt[weight] = "2" rootfs_configure_apt() { @@ -315,6 +270,14 @@ rootfs_configure_apt() { EOSUDO } +# Point the host apt-get at the rootfs' apt.conf.d (see ROOTFS_HOST_APT_CONFIG). +ROOTFS_CONFIGURE_COMMAND =+ "rootfs_configure_host_apt_config" +rootfs_configure_host_apt_config[weight] = "1" +rootfs_configure_host_apt_config() { + echo 'Dir::Etc::parts "${ROOTFSDIR}/etc/apt/apt.conf.d";' \ + > '${ROOTFS_HOST_APT_CONFIG}' +} + rootfs_exclude_docs_drop() { if [ -d '${ROOTFSDIR}/usr/share/man' ]; then find '${ROOTFSDIR}/usr/share/man/' -mindepth 1 ! -type d -delete @@ -371,7 +334,7 @@ rootfs_install_pkgs_update() { run_privileged_heredoc <<'EOF' set -e ${@insert_isar_mounts(d, d.getVar('ROOTFSDIR'), d.getVar('ROOTFS_MOUNTS')) if d.getVar('ISAR_CHROOT_MODE') == 'unshare' else ''} - chroot '${ROOTFSDIR}' /usr/bin/apt-get update \ + ${HOST_APT_CMD} update \ -o Dir::Etc::SourceList="sources.list.d/isar-apt.list" \ -o Dir::Etc::SourceParts="-" \ -o APT::Get::List-Cleanup="0" @@ -402,10 +365,14 @@ rootfs_install_pkgs_download[progress] = "custom:rootfs_progress.PkgsDownloadPro rootfs_install_pkgs_download[isar-apt-lock] = "release-after" rootfs_install_pkgs_download[network] = "${TASK_USE_NETWORK}" rootfs_install_pkgs_download() { - # download packages using apt in a non-privileged namespace - rootfs_cmd --bind "${ROOTFSDIR}/var/cache/apt/archives" /var/cache/apt/archives \ - ${ROOTFSDIR} \ - -- /usr/bin/apt-get ${ROOTFS_APT_ARGS} -o Debug::NoLocking=1 --download-only ${ROOTFS_PACKAGES} + run_privileged_heredoc <<'EOF' + set -e + ${@insert_isar_mounts(d, d.getVar('ROOTFSDIR'), d.getVar('ROOTFS_MOUNTS')) if d.getVar('ISAR_CHROOT_MODE') == 'unshare' else ''} + ${HOST_APT_CMD} \ + ${ROOTFS_APT_ARGS} \ + -o Debug::NoLocking=1 \ + --download-only ${ROOTFS_PACKAGES} +EOF } ROOTFS_INSTALL_COMMAND_BEFORE_EXPORT ??= "" @@ -421,16 +388,15 @@ ROOTFS_INSTALL_COMMAND += "rootfs_install_pkgs_isar_download" rootfs_install_pkgs_isar_download[weight] = "50" rootfs_install_pkgs_isar_download[isar-apt-lock] = "acquire-before release-after" rootfs_install_pkgs_isar_download() { - # Command apt-get install do not cache packages from local repos - # We can obtain non cached package URIs by recalling install command here - # No need to export those files to dl_dir, so we can run it right after - rootfs_cmd --bind "${ROOTFSDIR}/var/cache/apt/archives" /var/cache/apt/archives \ - --chdir "/var/cache/apt/archives" \ - ${ROOTFSDIR} \ - -- /usr/bin/sh -c 'apt-get ${ROOTFS_APT_ARGS} --print-uris ${ROOTFS_PACKAGES} | \ - sed -n "s|^.file:\(/[^'\'']*\.deb\). \([^ ]*\.deb\).*|\1 \2|p" | \ - sed ":a; s|^\([^ ]*\)%|\1\\\\x|; ta" | \ - while read -r path name; do cp -n "$(/usr/bin/printf "%b" "$path")" "$name" ; done' + run_privileged_heredoc <<'EOF' + set -e + ${@insert_isar_mounts(d, d.getVar('ROOTFSDIR'), d.getVar('ROOTFS_MOUNTS')) if d.getVar('ISAR_CHROOT_MODE') == 'unshare' else ''} + ${HOST_APT_CMD} \ + ${ROOTFS_APT_ARGS} --print-uris ${ROOTFS_PACKAGES} | \ + sed -n "s|^.file:\(/[^'\'']*\.deb\). \([^ ]*\.deb\).*|\1 \2|p" | \ + sed ":a; s|^\([^ ]*\)%|\1\\\\x|; ta" | \ + while read -r path name; do cp -n "$(/usr/bin/printf "%b" "$path")" "${ROOTFSDIR}/var/cache/apt/archives/$name" ; done +EOF } ROOTFS_INSTALL_COMMAND += "${@ 'rootfs_install_clean_files' if (d.getVar('ROOTFS_CLEAN_FILES') or '').strip() else ''}" @@ -451,8 +417,7 @@ rootfs_install_pkgs_install() { run_privileged_heredoc <<'EOF' set -e ${@insert_isar_mounts(d, d.getVar('ROOTFSDIR'), d.getVar('ROOTFS_MOUNTS')) if d.getVar('ISAR_CHROOT_MODE') == 'unshare' else ''} - chroot "${ROOTFSDIR}" \ - /usr/bin/apt-get ${ROOTFS_APT_ARGS} --no-download ${ROOTFS_PACKAGES} + ${HOST_APT_CMD} ${ROOTFS_APT_ARGS} --no-download ${ROOTFS_PACKAGES} EOF } @@ -472,7 +437,7 @@ rootfs_clear_initrd_symlinks() { run_privileged rm -f ${ROOTFSDIR}/initrd.img.old } -ROOTFS_INSTALL_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'generate-sbom', 'rootfs_capture_apt_state', '', d)}" +ROOTFS_POSTPROCESS_COMMAND:prepend = "${@bb.utils.contains('ROOTFS_FEATURES', 'generate-sbom', 'rootfs_capture_apt_state', '', d)} " rootfs_capture_apt_state() { ( cd ${ROOTFSDIR} && find usr/share/doc -name copyright -print0 ) | \ tar -cf ${WORKDIR}/${ROOTFS_APT_STATE} --zstd --sort=name \ @@ -485,6 +450,7 @@ rootfs_capture_apt_state() { var/lib/apt/extended_states \ var/lib/dpkg/status } +ROOTFS_POSTPROCESS_COMMAND:prepend = "rootfs_redirect_isar_apt_to_target " ROOTFS_INSTALL_DEPENDS ?= "" @@ -583,8 +549,7 @@ cache_dbg_pkgs() { ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'clean-package-cache', 'rootfs_postprocess_clean_package_cache', '', d)}" rootfs_postprocess_clean_package_cache() { - run_in_chroot '${ROOTFSDIR}' \ - /usr/bin/apt-get clean + run_privileged ${HOST_APT_CMD} clean # remove apt-cache folder itself (required in case rootfs is provided by sstate cache) run_privileged find "${ROOTFSDIR}/var/cache/apt" -type f \ \( -name '*.deb' -o -name '*.bin' \) -delete