Re: [PATCH 1/1] sbuild: allow to override enforcement of no-network policy

[Zhihang Wei <wzh@ilbers.de>]

Applied to next, thanks.

Zhihang

On 7/28/26 12:28, 'Felix Moessbauer' via isar-users wrote:
> In accordance with Debian Policy §4.9, sbuild disables network
> access while running `dpkg-buildpackage` (from trixie on). For
> technical reasons, this was not enforced on the schroot backend,
> leading to silent policy violations. On the unshare backend
> (rootless), this is enforced, which might break some downstream
> builds. By providing a variable to override this, we restore
> compatibility with the privileged mode.
>
> Pre 0.89 versions of sbuild (e.g. on bookworm), always allow network
> access, independent of the backend.
>
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
>   RECIPE-API-CHANGELOG.md          |  9 +++++++++
>   meta/classes-recipe/dpkg.bbclass | 15 +++++++++++++++
>   2 files changed, 24 insertions(+)
>
> diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md
> index f5b84c84..69560e9f 100644
> --- a/RECIPE-API-CHANGELOG.md
> +++ b/RECIPE-API-CHANGELOG.md
> @@ -1129,6 +1129,15 @@ environment and cannot be deleted from the outside by the calling user. To simpl
>   the cleanup, we provide the `isar-clean-builddir` script that helps purging
>   directories with mixed ownerships (without requiring root privileges).
>   
> +### Network access during package builds (on rootless)
> +
> +In accordance with Debian Policy §4.9, sbuild disables network access while running
> +`dpkg-buildpackage`. For technical reasons, this is only enforced on the unshare
> +backend (and on sbuild versions > 0.89). The schroot backend retains its existing
> +network access. Recipes that still require network access during the build can set
> +`DPKG_BUILD_ENABLE_NETWORK = "1"` to explicitly enable it when using an sbuild
> +version newer than 0.89.
> +
>   ### Add Hyper-V machine support
>   
>   A new machine `hyper-v` has been introduced for building images
> diff --git a/meta/classes-recipe/dpkg.bbclass b/meta/classes-recipe/dpkg.bbclass
> index 1b2616db..d8e129bb 100644
> --- a/meta/classes-recipe/dpkg.bbclass
> +++ b/meta/classes-recipe/dpkg.bbclass
> @@ -15,6 +15,12 @@ DPKG_PREBUILD_ENV_FILE="${WORKDIR}/dpkg_prebuild.env"
>   # Note: must not have any logical influence on the generated package
>   SBUILD_PASSTHROUGH_ADDITIONS ?= ""
>   
> +# Debian Policy §4.9 forbids network access during build. However, this can only
> +# be enforced on unshare backend. For schroot backend, network access was still possible,
> +# resulting in builds needing it. To override this, the variable DPKG_BUILD_ENABLE_NETWORK
> +# can be set to "1" in the recipe.
> +DPKG_BUILD_ENABLE_NETWORK ??= "0"
> +
>   def expand_sbuild_pt_additions(d):
>       cmds = ''
>       for var in d.getVar('SBUILD_PASSTHROUGH_ADDITIONS').split():
> @@ -112,10 +118,19 @@ dpkg_runbuild() {
>   
>       DSC_FILE=$(find ${WORKDIR} -maxdepth 1 -name "${DEBIAN_SOURCE}_*.dsc" -print)
>   
> +    # networking is automatically enabled on older versions of sbuild
> +    sbuild_network_option=""
> +    sbuild_version="$(dpkg-query --showformat='${source:Upstream-Version}' --show sbuild)"
> +    if [ "${DPKG_BUILD_ENABLE_NETWORK}" = "1" ] && \
> +        dpkg --compare-versions "$sbuild_version" ge "0.89"; then
> +        sbuild_network_option="--enable-network"
> +    fi
> +
>       sbuild -n -c ${SBUILD_CHROOT} \
>           --chroot-mode=${ISAR_CHROOT_MODE} \
>           --host=${PACKAGE_ARCH} --build=${BUILD_ARCH} ${profiles} \
>           ${@'--no-arch-all' if 'cross' in isar_deb_build_profiles(d).split() else '--arch-all'} \
> +        ${sbuild_network_option} \
>           --no-run-lintian --no-run-piuparts --no-run-autopkgtest --resolve-alternatives \
>           --bd-uninstallable-explainer=apt \
>           --no-apt-update --apt-distupgrade \

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/28f68548-861d-41b2-96dc-941064b2c1ac%40ilbers.de.