[PATCH 1/1] sbuild: allow to override enforcement of no-network policy

["'Felix Moessbauer' via isar-users" <isar-users@googlegroups.com>]

In accordance with Debian Policy §4.9, sbuild disables network
access while running `dpkg-buildpackage` (from trixie on). For
technical reasons, this was not enforced on the schroot backend,
leading to silent policy violations. On the unshare backend
(rootless), this is enforced, which might break some downstream
builds. By providing a variable to override this, we restore
compatibility with the privileged mode.

Pre 0.89 versions of sbuild (e.g. on bookworm), always allow network
access, independent of the backend.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 RECIPE-API-CHANGELOG.md          |  9 +++++++++
 meta/classes-recipe/dpkg.bbclass | 15 +++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md
index f5b84c84..69560e9f 100644
--- a/RECIPE-API-CHANGELOG.md
+++ b/RECIPE-API-CHANGELOG.md
@@ -1129,6 +1129,15 @@ environment and cannot be deleted from the outside by the calling user. To simpl
 the cleanup, we provide the `isar-clean-builddir` script that helps purging
 directories with mixed ownerships (without requiring root privileges).
 
+### Network access during package builds (on rootless)
+
+In accordance with Debian Policy §4.9, sbuild disables network access while running
+`dpkg-buildpackage`. For technical reasons, this is only enforced on the unshare
+backend (and on sbuild versions > 0.89). The schroot backend retains its existing
+network access. Recipes that still require network access during the build can set
+`DPKG_BUILD_ENABLE_NETWORK = "1"` to explicitly enable it when using an sbuild
+version newer than 0.89.
+
 ### Add Hyper-V machine support
 
 A new machine `hyper-v` has been introduced for building images
diff --git a/meta/classes-recipe/dpkg.bbclass b/meta/classes-recipe/dpkg.bbclass
index 1b2616db..d8e129bb 100644
--- a/meta/classes-recipe/dpkg.bbclass
+++ b/meta/classes-recipe/dpkg.bbclass
@@ -15,6 +15,12 @@ DPKG_PREBUILD_ENV_FILE="${WORKDIR}/dpkg_prebuild.env"
 # Note: must not have any logical influence on the generated package
 SBUILD_PASSTHROUGH_ADDITIONS ?= ""
 
+# Debian Policy §4.9 forbids network access during build. However, this can only
+# be enforced on unshare backend. For schroot backend, network access was still possible,
+# resulting in builds needing it. To override this, the variable DPKG_BUILD_ENABLE_NETWORK
+# can be set to "1" in the recipe.
+DPKG_BUILD_ENABLE_NETWORK ??= "0"
+
 def expand_sbuild_pt_additions(d):
     cmds = ''
     for var in d.getVar('SBUILD_PASSTHROUGH_ADDITIONS').split():
@@ -112,10 +118,19 @@ dpkg_runbuild() {
 
     DSC_FILE=$(find ${WORKDIR} -maxdepth 1 -name "${DEBIAN_SOURCE}_*.dsc" -print)
 
+    # networking is automatically enabled on older versions of sbuild
+    sbuild_network_option=""
+    sbuild_version="$(dpkg-query --showformat='${source:Upstream-Version}' --show sbuild)"
+    if [ "${DPKG_BUILD_ENABLE_NETWORK}" = "1" ] && \
+        dpkg --compare-versions "$sbuild_version" ge "0.89"; then
+        sbuild_network_option="--enable-network"
+    fi
+
     sbuild -n -c ${SBUILD_CHROOT} \
         --chroot-mode=${ISAR_CHROOT_MODE} \
         --host=${PACKAGE_ARCH} --build=${BUILD_ARCH} ${profiles} \
         ${@'--no-arch-all' if 'cross' in isar_deb_build_profiles(d).split() else '--arch-all'} \
+        ${sbuild_network_option} \
         --no-run-lintian --no-run-piuparts --no-run-autopkgtest --resolve-alternatives \
         --bd-uninstallable-explainer=apt \
         --no-apt-update --apt-distupgrade \
-- 
2.53.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260728102838.962383-1-felix.moessbauer%40siemens.com.