[PATCH 1/2] sbuild: place tmpdir below WORKDIR on rootless

[PATCH 1/2] sbuild: place tmpdir below WORKDIR on rootless

['Felix Moessbauer' via isar-users]

When running sbuild in rootless mode, it needs some scratch space to
extract the rootfs. If not configured otherwise, a tmpdir below /tmp is
used. In case of isar builds this is not desired, as /tmp could be too
small (e.g. on a tmpfs) and it also breaks the rule of only operating
below bitbakes TMPDIR.

We fix this by explicitly setting the TMPDIR env var to a dir below the
recipes WORKDIR. By that, each sbuild chroot is extracted to a tmpdir
below the recipe that needs it (it is automatically cleanded up by
sbuild after the build).

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/classes-recipe/dpkg.bbclass | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/meta/classes-recipe/dpkg.bbclass b/meta/classes-recipe/dpkg.bbclass
index a42703d5..35408495 100644
--- a/meta/classes-recipe/dpkg.bbclass
+++ b/meta/classes-recipe/dpkg.bbclass
@@ -21,6 +21,8 @@ SBUILD_PASSTHROUGH_ADDITIONS ?= ""
 # can be set to "1" in the recipe.
 DPKG_BUILD_ENABLE_NETWORK ??= "0"
 
+SBUILD_TMPDIR ?= "${WORKDIR}/tmpdir"
+
 def expand_sbuild_pt_additions(d):
     cmds = ''
     for var in d.getVar('SBUILD_PASSTHROUGH_ADDITIONS').split():
@@ -41,6 +43,7 @@ CP_FLAGS:sid ?= "-L --update=none --no-preserve=owner"
 
 # Build package from sources using build script
 dpkg_runbuild[root_cleandirs] += "${WORKDIR}/rootfs"
+dpkg_runbuild[cleandirs] += "${SBUILD_TMPDIR}"
 dpkg_runbuild[vardepsexclude] += "${SBUILD_PASSTHROUGH_ADDITIONS}"
 dpkg_runbuild() {
     E="${@ isar_export_proxies(d)}"
@@ -126,6 +129,7 @@ dpkg_runbuild() {
         sbuild_network_option="--enable-network"
     fi
 
+    TMPDIR=${SBUILD_TMPDIR} \
     sbuild -n -c ${SBUILD_CHROOT} \
         --chroot-mode=${ISAR_CHROOT_MODE} \
         --host=${PACKAGE_ARCH} --build=${BUILD_ARCH} ${profiles} \
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260907114136.3946468-1-felix.moessbauer%40siemens.com.

[PATCH 2/2] bootstrap: place gnupg home below workdir instead of /tmp

['Felix Moessbauer' via isar-users]

We should not place any build artifacts below /tmp but place all
artifacts somewhere below TMPDIR.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
index ee6eda3c..11706b71 100644
--- a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
+++ b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
@@ -59,7 +59,7 @@ do_generate_keyrings[cleandirs] = "${WORKDIR}/trusted.gpg.d"
 do_generate_keyrings[dirs] = "${DEBDIR}"
 do_generate_keyrings[vardeps] += "DISTRO_BOOTSTRAP_KEYS THIRD_PARTY_APT_KEYS"
 do_generate_keyrings() {
-    export GNUPGHOME="$(mktemp -td gpghomeXXXXXXXXXX)"
+    export GNUPGHOME="$(mktemp -d ${BOOTSTRAP_TMPDIR}/gpghomeXXXXXXXXXX)"
     if [ -n "${@d.getVar("THIRD_PARTY_APT_KEYFILES") or ""}" ]; then
         for keyfile in ${@d.getVar("THIRD_PARTY_APT_KEYFILES")}; do
            gpg --no-autostart --keyring "gnupg-ring:${DISTRO_BOOTSTRAP_KEYRING}" \
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260907114136.3946468-2-felix.moessbauer%40siemens.com.

Re: [PATCH 1/2] sbuild: place tmpdir below WORKDIR on rootless

[Zhihang Wei]

Applied to next, thanks.

Zhihang

On 9/7/26 13:41, 'Felix Moessbauer' via isar-users wrote:
> When running sbuild in rootless mode, it needs some scratch space to
> extract the rootfs. If not configured otherwise, a tmpdir below /tmp is
> used. In case of isar builds this is not desired, as /tmp could be too
> small (e.g. on a tmpfs) and it also breaks the rule of only operating
> below bitbakes TMPDIR.
>
> We fix this by explicitly setting the TMPDIR env var to a dir below the
> recipes WORKDIR. By that, each sbuild chroot is extracted to a tmpdir
> below the recipe that needs it (it is automatically cleanded up by
> sbuild after the build).
>
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
>   meta/classes-recipe/dpkg.bbclass | 4 ++++
>   1 file changed, 4 insertions(+)
>
> diff --git a/meta/classes-recipe/dpkg.bbclass b/meta/classes-recipe/dpkg.bbclass
> index a42703d5..35408495 100644
> --- a/meta/classes-recipe/dpkg.bbclass
> +++ b/meta/classes-recipe/dpkg.bbclass
> @@ -21,6 +21,8 @@ SBUILD_PASSTHROUGH_ADDITIONS ?= ""
>   # can be set to "1" in the recipe.
>   DPKG_BUILD_ENABLE_NETWORK ??= "0"
>   
> +SBUILD_TMPDIR ?= "${WORKDIR}/tmpdir"
> +
>   def expand_sbuild_pt_additions(d):
>       cmds = ''
>       for var in d.getVar('SBUILD_PASSTHROUGH_ADDITIONS').split():
> @@ -41,6 +43,7 @@ CP_FLAGS:sid ?= "-L --update=none --no-preserve=owner"
>   
>   # Build package from sources using build script
>   dpkg_runbuild[root_cleandirs] += "${WORKDIR}/rootfs"
> +dpkg_runbuild[cleandirs] += "${SBUILD_TMPDIR}"
>   dpkg_runbuild[vardepsexclude] += "${SBUILD_PASSTHROUGH_ADDITIONS}"
>   dpkg_runbuild() {
>       E="${@ isar_export_proxies(d)}"
> @@ -126,6 +129,7 @@ dpkg_runbuild() {
>           sbuild_network_option="--enable-network"
>       fi
>   
> +    TMPDIR=${SBUILD_TMPDIR} \
>       sbuild -n -c ${SBUILD_CHROOT} \
>           --chroot-mode=${ISAR_CHROOT_MODE} \
>           --host=${PACKAGE_ARCH} --build=${BUILD_ARCH} ${profiles} \

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/ad39c359-7c63-47d5-a5ae-6b554ae24de6%40ilbers.de.