Re: [PATCH v2 1/3] fix(rootfs): copy isar-apt packages instead of downloading

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Mon, 2026-08-10 at 14:06 +0300, Aliaksei Karpovich wrote:
> On 7/30/26 14:19, Felix Moessbauer wrote:
> > Previously, the arch part was stripped, hence on multiarch or compat
> > scenarios the wrong package might have been downloaded. We fix this by
> > considering the whole filename. For that, we switch to cp, as we
> > otherwise would have to reconstruct the package name from the filename.
> > As the whole path is urlencoded, we cannot directly pass the url to cp.
> > Instead, we reconstruct it based on the base-path (which is taken as-is,
> > as it does not have any special characters) and the second field emitted
> > on --print-uris, which provides the decoded filename.
> > 
> > As we now use cp, we also don't need any locking anymore (technically we
> > did not need it before either, but apt was called in a way that required
> > it).
> > 
> > Fixes: b90b722f ("rootfs: Deny packages download during install")
> > Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> > ---
> >   meta/classes-recipe/rootfs.bbclass | 16 ++++------------
> >   1 file changed, 4 insertions(+), 12 deletions(-)
> > 
> > diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
> > index 77e6aefc..2ce8cee3 100644
> > --- a/meta/classes-recipe/rootfs.bbclass
> > +++ b/meta/classes-recipe/rootfs.bbclass
> > @@ -361,23 +361,15 @@ ROOTFS_INSTALL_COMMAND += "rootfs_install_pkgs_isar_download"
> >   rootfs_install_pkgs_isar_download[weight] = "50"
> >   rootfs_install_pkgs_isar_download[isar-apt-lock] = "acquire-before release-after"
> >   rootfs_install_pkgs_isar_download() {
> > -    mkdir -p "${WORKDIR}/dpkg"
> > -
> > -    # Use our own dpkg lock files rather than those in the rootfs since we are not root
> > -    # (this is safe as there are no concurrent apt/dpkg operations for that rootfs)
> > -    touch "${WORKDIR}/dpkg/lock" "${WORKDIR}/dpkg/lock-frontend"
> > -
> >       # Command apt-get install do not cache packages from local repos
> >       # We can obtain non cached package URIs by recalling install command here
> > -    # No need in export those files to dl_dir, so we can run it right after
> > +    # No need to export those files to dl_dir, so we can run it right after
> >       rootfs_cmd --bind "${ROOTFSDIR}/var/cache/apt/archives" /var/cache/apt/archives \
> > -               --bind "${WORKDIR}/dpkg/lock" /var/lib/dpkg/lock \
> > -               --bind "${WORKDIR}/dpkg/lock-frontend" /var/lib/dpkg/lock-frontend \
> >                  --chdir "/var/cache/apt/archives" \
> >                  ${ROOTFSDIR} \
> > -               -- /usr/bin/sh -c "apt-get ${ROOTFS_APT_ARGS} --print-uris ${ROOTFS_PACKAGES} | \
> > -                                  sed -n \"s|^.*/\\(.*\\)_[^_]*_[^_]*\\.deb'.*|\\1|p\" | \
> > -                                  xargs -r apt-get download"
> > +               -- /usr/bin/sh -c 'apt-get ${ROOTFS_APT_ARGS} --print-uris ${ROOTFS_PACKAGES} | \
> > +                                  sed -n "s|^.file:\(/[^'\'']*/\)[^'\'']*\.deb. \([^ ]*\.deb\) .*|\1\2|p" | \
> > +                                  while read -r path; do cp -n "$path" ./ ; done'
> 
> I rebased the 'base-apt improvement' onto new next (which contains this 
> fix) and faced with following error:
> "cp: cannot stat 
> '///base-apt/debian/pool/main/f/file/libmagic-mgc_1%3a5.39-3+deb11u1_amd64.deb': 
> No such file or directory". It's from 
> mc:qemuarm-bullseye:isar-image-base target build.
> It happens because this fix doesn't take into account that the name of 
> package can be different in case of package has 'epoch version".
> For example (output from apt-get with --print-uris):
> 'file:///base-apt/debian/pool/main/f/file/libmagic-mgc_5.39-3%2bdeb11u1_amd64.deb' 
> libmagic-mgc_1%3a5.39-3+deb11u1_amd64.deb 273104 
> MD5Sum:3794ad03799b25e843a8174af498e779
> 'file:///base-apt/debian/pool/main/f/file/file_5.39-3%2bdeb11u1_amd64.deb' 
> file_1%3a5.39-3+deb11u1_amd64.deb 69164 
> MD5Sum:7722574e511cd65659d95042e3099fa8
> 
> file_5.39-3+bdeb11u1_amd64.deb - name in pool
> file_1%3a5.39-3+deb11u1_amd64.deb - name for downloading

... another corner case, but valid finding. Thanks!

How about url-unescaping the URI and passing the result to cp?
As debian only allows a limited set of characters in package names,
this should be rather straight forward (and it avoids needing curl as
base package).

Felix

> 
> Aliaksei
> 
> >   }
> >   
> >   ROOTFS_INSTALL_COMMAND += "${@ 'rootfs_install_clean_files' if (d.getVar('ROOTFS_CLEAN_FILES') or '').strip() else ''}"

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/004e80955a2b7f1e5682008599637f1495e7ea7c.camel%40siemens.com.