From patchwork Tue Jul 28 10:28:38 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Felix Moessbauer X-Patchwork-Id: 5302 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Tue, 28 Jul 2026 12:29:04 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-pg1-f187.google.com (mail-pg1-f187.google.com [209.85.215.187]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 66SAT1Yh008790 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 28 Jul 2026 12:29:02 +0200 Received: by mail-pg1-f187.google.com with SMTP id 41be03b00d2f7-cb11535e6a1sf2807326a12.0 for ; Tue, 28 Jul 2026 03:29:02 -0700 (PDT) ARC-Seal: i=3; a=rsa-sha256; t=1785234536; cv=pass; d=google.com; s=arc-20260327; b=VuOCY480AmcVavPIbWnckXRvJVMBCMVAoKTGmM4SlIJNexwy4ZCxkj+TerlX8CRGcZ YORSL9Kd5lWAK3VWQwHxqB2FIiAYmn0KUfuGJugyxGXz20ICfpyyt7MfAxZRvm3KveS1 EhIQgAyFyPdcGtQY/uTF/ea/8bdR30kXMtLxTEJYMLHiDs4LtexGmei88/hEpbEBVKHG 2ZaSZvjiMD1yuT0TqJ2jpp+IxS97SIUmb6H1OgXwH+F8DalFwedD085wAU5dDVCP7FZg FnyC3f7861lqpZ0e3RMV6xn7s3aoqHWbVRd6+CLejQbedcnK0f2Nr2udNBI7VZhht3jq mtmA== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version :content-transfer-encoding:message-id:date:subject:cc:to:from :dkim-signature; bh=L+/3h/AmBkBqKn3QH75D38+8VCYmHiAfkdhGta5CZgI=; fh=DkDBo+Pfj31LJjyWIOrIts0oAN/aOWYKpfRTgyYPTk0=; b=K9ZSR1NPxRcr2UNHzd3JM2hhcG2KCc9A4LTiYKvkZvtmMMxV0w5UJO52Sm8AQA02Cs sPmXuwtaXMgPAoMCWHxeyUkkeYIqX7YrPjRLVe9TnyLoGi3NMCZKK+aL7fmxYb2K2ZTh n/jOY/JBEJguXP8MrwwrlFoPw3tMU5R2sZr8+Mk13bvr83zziOlOD+rSmV6F9OQZt5Yj NFimtK3TUWYnWOCYczjK466D7Ak5Js6KS65NUPi54yjXZ/AAjUntS97DFgTxkF3aDxpO ZK/r7tDr7wamc1zP4vTQ8S8ky0Yq1iqyzPdV0qVx0y9AZpD6aQYnft1aXewn/OOCQFKn uKXQ==; darn=isar-build.org ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=ZajZNZkX; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c20f::7 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1785234536; x=1785839336; darn=isar-build.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-transfer-encoding:content-type:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=L+/3h/AmBkBqKn3QH75D38+8VCYmHiAfkdhGta5CZgI=; b=p29zVmnTZVmysl74+vnFsBipRhjw8scVIkuFZUHEAzYo+SKZlFSQttC8KxsHmI4eiN pE7RRQdfafekaqrhj3zejlvFa2RboE9HN87/JBZFzeRfZKezpJIzHg8zmDH0cqbNOC1Z Yr3aU8Iy0ij+t89OlnLFjD/urWLMR5Q1HhCURVG0A7fQWvWbPAHCGFlph6e7YWQTM5/n uhrgLv8mGdLUsT9O6DaDkRr8pJtoR18NWUC/5oFr6BouZ2WpUswjvJzvKxo3bf/tqzS1 6ceL7ZdbiQD4PY4RMwBzFkI1wyah8oHgsrVR7eM8nmUP6VS7bwWPizForIz/6bOzONIH NRFA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785234536; x=1785839336; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-transfer-encoding:content-type:message-id:date:subject:cc :to:from:x-beenthere:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=L+/3h/AmBkBqKn3QH75D38+8VCYmHiAfkdhGta5CZgI=; b=dHPpb6qnvVQ3FqeSalWFDoa//9yTtePP63QUjjWUFG9sH7SPB94W/Aqo1TQ0uMCzN1 Y6PO5RO2vbg8Dtyd2Cv9taFZkkpzUOFPZGm9UmKpm6g7NWGiPA1bVy2L0Wyk2TszI4pe /5VgIIoEL6xwJjldQiMACq9mJOHC+JDTASqy4dlJu4EFPnAWDGY2DyeL4YqwywqynSYx nDvijwfPcCPVnxwMY+2N+6IU88aqURNGlo0cZvHyQL82f7sSw/LQ57EEwUi/Jv7I/WwF cEdQYfLwX4d4RgPq4P7Z72jMUPPSJkFL9DAY9L30TooY6cQMO5xZQUBTn2J1L7HQNNHB qKuA== X-Forwarded-Encrypted: i=3; AHgh+Ro6HynfUKrd9ojiSjsPVXi7UUgKcmpun5xj320HFzK5YAggURq5w7dpEU1EEvnaW9qicxTcsaQ=@isar-build.org X-Gm-Message-State: AOJu0YzioLbgHaZqGjCJLY8cvrRtoFAuezDpBtzUymqc9Q2bdFSDK9zb 9SdyQKNN4gU0aMEtUooKEvcZEHlIpINl/C0q6DfbntBOcmqJFloWEiPr X-Received: by 2002:a05:6a00:98c:b0:848:827b:70f8 with SMTP id d2e1a72fcca58-84e9338acc9mr1719410b3a.67.1785234535373; Tue, 28 Jul 2026 03:28:55 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="Aa7YSPT1+re1oNj0DgISIAu9E84YbH+76e8mwRg18C6pjec/7Q==" Received: by 2002:a05:6a00:6f5c:b0:847:8a64:2995 with SMTP id d2e1a72fcca58-84e2984d4f8ls6858016b3a.2.-pod-prod-04-us; Tue, 28 Jul 2026 03:28:53 -0700 (PDT) X-Received: by 2002:a05:6a00:1390:b0:848:82f0:679a with SMTP id d2e1a72fcca58-84e9335980emr1952320b3a.52.1785234533504; Tue, 28 Jul 2026 03:28:53 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1785234533; cv=pass; d=google.com; s=arc-20260327; b=LOQ4Hfwgecz4l2uLidC6Xy8z/TuR0Y+KmF6LjeQ3i/z8GY1rohLZiqFpcHJIiAy4aF vlGEYSXePF+5LqeClOI8yIwcuSzObU2N5ZzYV3KmeZabCInKyI6vU150p6ABdru0thh9 J2mnG/aThecS02uz/6ksU8pPQuxPyxo6PA61o4TZSd/ZI4vWAz0pMLRYGV7BARkRCxy5 sCJeh8FGUT8Qz7uHWJfKfklN9k1/mR3ubJBE23bsxyyBNinwdqopliOT4S/amIVK35aC w6D/k6U51SQR6YwJorttDG3PCSsPuHz6JJnb7Auqv9fzUoPePpVpotmOlLPT0SFVkpPr ipKA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:content-transfer-encoding:message-id:date:subject:cc :to:from:dkim-signature; bh=Dy/12t23uuv3oczZsEOtpLl7O8/GicRg7z4MQ67xfWw=; fh=akEDxqCx8SXNfng4/80otlrEVebDroEzjSeLu6ZY87w=; b=mxc8mUH4YmuN3rcXUA8geZoj2JqESGqaVdUQmogyYdKj+L0pnEPBc54vSXZucHENjd u3WuBq5MstdJYRgKqL33YaF/WMUc1oHovCXAO+hfBycMcHuDShDw1JC3z1PArOJqIAKA aoeR676O1D2bipdiUgrxTMKjwOXHO1L31Yo6OBh7PHM6s7aPAt2CUxVaHecLxZzdWjLK vpCN90Jzu2X1Umb9oPa8m0R3MYwwsWm3zNaVFjwUN2opVzesHSqPl0Oq6X+U+geGnZkS LUG2+P3H4DqpVnxc4bz4M4LlUvpAfZdhKdmzQv3LRIiRcovr8ycsrqVi3kkZ9X5XfyKq fPqA==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=ZajZNZkX; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c20f::7 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from OSPPR02CU001.outbound.protection.outlook.com (mail-norwayeastazlp170130007.outbound.protection.outlook.com. [2a01:111:f403:c20f::7]) by gmr-mx.google.com with ESMTPS id d2e1a72fcca58-84e533ede29si337701b3a.5.2026.07.28.03.28.53 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 28 Jul 2026 03:28:53 -0700 (PDT) Received-SPF: pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c20f::7 as permitted sender) client-ip=2a01:111:f403:c20f::7; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=HrRDAufwJgxDKJr97kjOaRw4yQiu2TTF+1iJI4zn+s1QhiwlnEbxH7Pm2pSAnkVa6Aa9iiGTz3vFQW9AX6+C3JNPxuTrvvBKbq2F/MOAcBRS0QjyitgNCqA5S5IrWGHtPKTGd12NpMMf/r6sqZUE5S5WGb2GK40dYpTGGsW18ZPZODpn077Fi6BgN2ahGZXeee3QlmJ9rsY7An8qCtDqacE8sISbshJn4y/wxJkpjQAindsnx34QLNHEuBdsXZCk1hvwumYYN+0e0qzE3wFgaOuuhGy7CifR82YOKBcUSPTTLPMgBCikJ6hFO8KCGPHXsQy4lfnL954gZXxPwTydlw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Dy/12t23uuv3oczZsEOtpLl7O8/GicRg7z4MQ67xfWw=; b=IT7zmvvw37IfRcoci2XES5nkiPSJo4cV8CBXgxTCxlTOJcD/8+HpDg4GGlDgZC5tHdPZ7Su8kMot5g8jInYbX+A3/1BvyKCk32c+PcLYRT8l3Vm2ofUzvQy/1eMjl6yQJnqMpLnUgBdPyChsPiXrwn9EA9a175eUTwJF11EXbVgrk959S1YzAcxcG4L8UIMS7fPmZk0G0v33B9iLlRHC2gDVhSenhkntA5hpz6H7nSGUZI+K4HL3/WzdgUd1fhEv+AXTFF3Ar7GBFS+SRcFTOo33HOqHONsjgFlnfdZ0W+o+CxpGUOBvAz5mOTzdO7aBUmCFZRUPSL6f7SaWP+Yqpw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:17e::10) by DU0PR10MB6130.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:3e5::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Tue, 28 Jul 2026 10:28:48 +0000 Received: from AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM ([fe80::c54c:ccd8:ebbf:477c]) by AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM ([fe80::c54c:ccd8:ebbf:477c%5]) with mapi id 15.21.0245.012; Tue, 28 Jul 2026 10:28:48 +0000 X-Patchwork-Original-From: "'Felix Moessbauer' via isar-users" From: Felix Moessbauer To: isar-users@googlegroups.com Cc: jan.kiszka@siemens.com, michael.adler@siemens.com, Felix Moessbauer Subject: [PATCH 1/1] sbuild: allow to override enforcement of no-network policy Date: Tue, 28 Jul 2026 12:28:38 +0200 Message-ID: <20260728102838.962383-1-felix.moessbauer@siemens.com> X-Mailer: git-send-email 2.53.0 X-ClientProxiedBy: BN0PR04CA0157.namprd04.prod.outlook.com (2603:10b6:408:eb::12) To AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:17e::10) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM7PR10MB3956:EE_|DU0PR10MB6130:EE_ X-MS-Office365-Filtering-Correlation-Id: 8d8aad4e-a251-49f6-c8ab-08deec9302b2 X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|23010399003|1800799024|376014|56012099006|11063799006|10067099003|3023799007|55112099003|18002099003; X-Microsoft-Antispam-Message-Info: HIzGXvnA7URjPQ2Z3Ke1p1NYztsfikYf7CHkPJBOV0ToNBZlZxr9JsqXqm1W6XPl/QJNoNqWCnHPlDgvZ5zSA7WfRciDNybFgzByseXj8Zcy84CPbBK+QRKaHszHYfgT3B/+hoxku6DNdVJDuTwf/50rwTclvuYE7ENeYLy+rQMnW/LyIYpwG+o0uSbbClqvrrTzYAVtQoogsFL9FlgkeB99qVOqTKHuHoSwV/PrAxiEWBzCE8PXufw+KSD41K+2e4Z20vwq2KzPK+2Meann1TpcRFbx4BcXdCr+Y+ELlUN9j3a/y9dNsjdrlk9J2zxVaVPTVfRwDxsvLqaLiR+vteM1TAsiaOURdg5esP1S77FrQeUmd7ghNak0NieizoRIzVLtcxkWiW9ZFEm/OyUnXvbFSVYuw+Ds3IJWKMcWV90Gh+nzarV0zHtD6Gqx8boWoCVAHifjGcmIop/yAwllVRWeD0K7SiKV2+vz935sFhIbZC80edWnFhRija1q3VEsyAOGD6EkOXt9qrGGRsOUTTaKBHJKELK7AQVDdzu0BZ7Xwjt4EAjQ0/QGgl97WBUhPi0or7DubTu2zP3kU5cDnB0XeBAlHWgRxzK5HNHf/rQCBtswMh9BIv33of9jVw6x4Dm5FBPj8D8HDhNxuK4sflHHjUf+BFz9TCWYSo9CXCo= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(1800799024)(376014)(56012099006)(11063799006)(10067099003)(3023799007)(55112099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?q?ZPwuvcjIm7TqOhJCDCIp8Lb5UMM3?= =?utf-8?q?icbZiCxSYGYxM9zU+bHDuKSsoJW6Z3Qd9ZbH9c54yH4bxLw7PKhiMOgt3Bs6t6Yfv?= =?utf-8?q?KGs6MC7ZhG0IS0zRRxAe1MSJ52I4rSFW23ndh4xeRMAkCVwEUHPBsS8471L7sfecC?= =?utf-8?q?n9Bmupj0ZVDWxBtyd7z56E+7J27AQq2C7wgOwQqHJGMr/IAe+PquxQd/hXAUA/pfh?= =?utf-8?q?/NmjJ5x0s+X8lDjUlWJEpumAg/UoCGZ0ftbYRn5Y4FhxpgRaOIrIV8Yenz+n718An?= =?utf-8?q?XeeYW/NqxhAynhxseI9kLBibx5pdn67gpDaQ+98/qvPGuBzVBgR4dN4e+LtMyK+UR?= =?utf-8?q?dvmoYPH0tWv/VDM1/xYKRolKVoUBDOgpzU58j7LH4H8znDCDoQfWf6j1dFEvazMry?= =?utf-8?q?szS/BRI+QQaWnyBVmwKYdn5c0MoXJjqSUNPT71lJaYkh07KykQGhePJaNozQRx9V1?= =?utf-8?q?PlLSYWRj+AiDQDQvFdKibHhQpc1FObRByXHEYwq5pA2CGIQuBVZm7bJvEsVzWrUkI?= =?utf-8?q?CH36uCZ9mYqUsByuTSNA9TALiFWqdL4uB1LdL62CgsCl73BsLEgm5QWqLEXGySlqe?= =?utf-8?q?/B890cTqLUQ1pIsP0ltwdpzPU+OPjMrdSouq2jT+vwSaE3noH+jU/o8PB6+i2DL9B?= =?utf-8?q?jJnzyccrlFuvQJ9lC+sbClsH13fNQ3i6T38QNK/LPsV6G2vtwr20fCPopApeNiE2w?= =?utf-8?q?Ghwb812dkSiNwhwVW35t7amRozztv42ocgXJZLTlyz/UdTN2wxtepqv4QXxJSdb7Y?= =?utf-8?q?k9RBuKWJbw3OLB1xaIOB2XK7OHjapnAZbS2yR9yEUG9FdomfRxHqYqndQEEvrbykw?= =?utf-8?q?RXf7agpbZmY5pm49r9QcWJEr9b2KKYuSe79aRrgfq0XS7A+LmiCk8O3pRmND+JxWy?= =?utf-8?q?MNFGGgSOyAbhBcWe+/EzYZmLaWlyBrip8KdBr43n7lHn7j9ux7XIZgz81fsqcbk3x?= =?utf-8?q?wimd76w5mt8hsqYpwcbZv/ocoOrz7rYio+Sq5LjhSIQmvRZwgkdULtcv4uF1w2Cf5?= =?utf-8?q?/P7JzSNc1HlWMnoNTi1fBksFSABCXQObuGx8wv61VhYJfBjdWhe9QCdntQ8znFKNw?= =?utf-8?q?8n34lHajyJzuPzE44+zxdXSpuL7RfFD2FVtey4KYjfGqa5gDCEU7sYPqYjkVsdKD+?= =?utf-8?q?dpp+f185xH6H0gtSHGCHLEdt3dOdrs3hGpF683dBZ9WRBwSSYhLjHrlPT1z9Cp8lM?= =?utf-8?q?I6JN2+PvxKphYH7ymZuTwB9/ZCLERyEdEvBf7O+C5kdpuKPMA3QGVMzjnGhcm5mpj?= =?utf-8?q?lgH583sSegSO9Ebc20RJkqsqb3B4VzyCE+pKsK5zwQCSR80uKfptV4gMsg1YqjTcI?= =?utf-8?q?vwB6drJVgezG0ExWDNKPIUlSD7ci/kLwYWQ5bOTZ78DZ5dp+k0qitbMHQxGmXXlQP?= =?utf-8?q?fGfJAuV7SZlf0q/pRfmWefEPk+gHJ2TgTtJ/df0zeu14WcDJKU6Afd129caTyYAur?= =?utf-8?q?z37kKn54iUGICNlTk4qM71JxZe09ugfMM43Fhp+P6IHJFY3RfhcGFFmv6lJbkIfV9?= =?utf-8?q?S4T2EYfMPwSbm1h7DbJpjaydqaaOjnWJ89JYNg6TZoeVrDO5kGxZYaYjYNhAbsIcJ?= =?utf-8?q?g4emNCk7rUOn1mPBNw9X6HjpqODZe6WVdcWHKgHLG9BWg4mhMLA1F/lQWEdBU8i61?= =?utf-8?q?5bUAAkF/ET2qp54hOjuhmmbP2LVo9Ky9zj7KmMY/ifFAHd7TpwBu8=3D?= X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8d8aad4e-a251-49f6-c8ab-08deec9302b2 X-MS-Exchange-CrossTenant-AuthSource: AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Jul 2026 10:28:48.5441 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: FgyI+l9MmCmWGdTIGbqkDNYfvRrSXKmiVYNTsfJ4o56/pNbKk7AHt01K6T1OgvqQAMy2D6l9j2DE1aJ2yN/H3+DIZXNgDUP5hY/ZLiCkkWk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0PR10MB6130 X-Original-Sender: felix.moessbauer@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=ZajZNZkX; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c20f::7 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Felix Moessbauer Reply-To: Felix Moessbauer Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= In accordance with Debian Policy §4.9, sbuild disables network access while running `dpkg-buildpackage` (from trixie on). For technical reasons, this was not enforced on the schroot backend, leading to silent policy violations. On the unshare backend (rootless), this is enforced, which might break some downstream builds. By providing a variable to override this, we restore compatibility with the privileged mode. Pre 0.89 versions of sbuild (e.g. on bookworm), always allow network access, independent of the backend. Signed-off-by: Felix Moessbauer Tested-by: Michael Adler --- RECIPE-API-CHANGELOG.md | 9 +++++++++ meta/classes-recipe/dpkg.bbclass | 15 +++++++++++++++ 2 files changed, 24 insertions(+) diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md index f5b84c84..69560e9f 100644 --- a/RECIPE-API-CHANGELOG.md +++ b/RECIPE-API-CHANGELOG.md @@ -1129,6 +1129,15 @@ environment and cannot be deleted from the outside by the calling user. To simpl the cleanup, we provide the `isar-clean-builddir` script that helps purging directories with mixed ownerships (without requiring root privileges). +### Network access during package builds (on rootless) + +In accordance with Debian Policy §4.9, sbuild disables network access while running +`dpkg-buildpackage`. For technical reasons, this is only enforced on the unshare +backend (and on sbuild versions > 0.89). The schroot backend retains its existing +network access. Recipes that still require network access during the build can set +`DPKG_BUILD_ENABLE_NETWORK = "1"` to explicitly enable it when using an sbuild +version newer than 0.89. + ### Add Hyper-V machine support A new machine `hyper-v` has been introduced for building images diff --git a/meta/classes-recipe/dpkg.bbclass b/meta/classes-recipe/dpkg.bbclass index 1b2616db..d8e129bb 100644 --- a/meta/classes-recipe/dpkg.bbclass +++ b/meta/classes-recipe/dpkg.bbclass @@ -15,6 +15,12 @@ DPKG_PREBUILD_ENV_FILE="${WORKDIR}/dpkg_prebuild.env" # Note: must not have any logical influence on the generated package SBUILD_PASSTHROUGH_ADDITIONS ?= "" +# Debian Policy §4.9 forbids network access during build. However, this can only +# be enforced on unshare backend. For schroot backend, network access was still possible, +# resulting in builds needing it. To override this, the variable DPKG_BUILD_ENABLE_NETWORK +# can be set to "1" in the recipe. +DPKG_BUILD_ENABLE_NETWORK ??= "0" + def expand_sbuild_pt_additions(d): cmds = '' for var in d.getVar('SBUILD_PASSTHROUGH_ADDITIONS').split(): @@ -112,10 +118,19 @@ dpkg_runbuild() { DSC_FILE=$(find ${WORKDIR} -maxdepth 1 -name "${DEBIAN_SOURCE}_*.dsc" -print) + # networking is automatically enabled on older versions of sbuild + sbuild_network_option="" + sbuild_version="$(dpkg-query --showformat='${source:Upstream-Version}' --show sbuild)" + if [ "${DPKG_BUILD_ENABLE_NETWORK}" = "1" ] && \ + dpkg --compare-versions "$sbuild_version" ge "0.89"; then + sbuild_network_option="--enable-network" + fi + sbuild -n -c ${SBUILD_CHROOT} \ --chroot-mode=${ISAR_CHROOT_MODE} \ --host=${PACKAGE_ARCH} --build=${BUILD_ARCH} ${profiles} \ ${@'--no-arch-all' if 'cross' in isar_deb_build_profiles(d).split() else '--arch-all'} \ + ${sbuild_network_option} \ --no-run-lintian --no-run-piuparts --no-run-autopkgtest --resolve-alternatives \ --bd-uninstallable-explainer=apt \ --no-apt-update --apt-distupgrade \