From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Fri, 31 Jul 2026 10:29:16 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-wr1-f60.google.com (mail-wr1-f60.google.com [209.85.221.60]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 66V8TFlZ030539 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 31 Jul 2026 10:29:15 +0200 Received: by mail-wr1-f60.google.com with SMTP id ffacd0b85a97d-47d81cf0c4csf519571f8f.2 for ; Fri, 31 Jul 2026 01:29:15 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1785486550; cv=pass; d=google.com; s=arc-20260327; b=kplelP4Dnw0B2e8pruIZeVbqy7kLZI1BSAhqo4LaQNzrZjgZEkXqGe+0XXpqXt85Tg 5hdES/MwCp5qM31eT2PucOnlWM77LtONvb1KQYUMtxKaPMVDz9eR4WiX8lq7bmdObPtL 78CcoI69IO32lLlhU8xXOwAPZZiqOl8wJd137pHxpMYk2AdhY1KCrAlujFOqHJNj3JLM VxFIP+UvRnl9Oh6pp+A/j9edMuTScsEsEEpzbUUgXK5bUciAivUtITAM4oFzSpYStWvP aQE/pfFk2fNpmSM58iEeabBObUkIx+EtyXCiPQETZSutVm5o5gLvqM2xCXmBlhE0eXm3 blCw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:content-transfer-encoding :in-reply-to:from:content-language:references:cc:to:subject :user-agent:mime-version:date:message-id:sender:dkim-signature; bh=8OY7XFMkqOJri6o8cW2rXpiUt85DTaux8V/XvMUdBi0=; fh=PabGfrcT0cxxTmykeVGM8YQyQKMsn1gNxcRNGFYWYPI=; b=gQRBJerGE3hFREilky+gYJa/97kWwWlpaXQj+8DolI1go0VrN4Oq5bKuP5Dbh3p0bi MNnKl2SAPL4gECd+Qd46XLwilcIrg/+0z2lL5hgL6gDcWRD9rKDqY8U+xR3DB29eOe1c MLI9jSkpScJmrSi4gCeiuHa+Ca5lW6MME4MIta0FXuzkrRyStkZ+P7cxXmEpBJRNhq2R rufY+wphKFOlaa5SNAEIdU37z7rkIOTJ8ypGs3kNOygMovOS8TrPX0ZlYRMJsM8BLEdw bPK4OpCBfM34jme5qIrxigb+u1T3zx7Zxn7H3mQYVCBjZKdw15nmYL7fkpRMJgfZ6GgB nSiQ==; darn=ilbers.de ARC-Authentication-Results: i=2; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1785486550; x=1786091350; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:content-transfer-encoding:content-type :in-reply-to:from:content-language:references:cc:to:subject :user-agent:mime-version:date:message-id:sender:from:to:cc:subject :date:message-id:reply-to:content-type; bh=8OY7XFMkqOJri6o8cW2rXpiUt85DTaux8V/XvMUdBi0=; b=bzZ+E37BrZ7CuBXAn4jWc6lgBz7w6gxStGZp11yu/1xtKn6cnAYmm1Rrb67NB0THPl uWC6h8/A/VkaiZJ/CIwEK5b92XZzCBt2Bjz1bE4DxsJcS7VAx/xp6mNXZwZ82qtI3t2t zWXsKjqaG5lDaUem94+40kUwn71b8mjQpZssbLItPz9pkia53QyjQmZlwlZ6MfTEz3VG mKTgCEtbTZd80q/VsgPnbV0pj7LDWu2VqVKJNUPjAVxh+8O4XOLy3vIN0fD5V4vPm8iK SlAwjCUkO9a6OnzcBP9T8B/ehQRGgAvOAlQHozMEFXqa2RNKUOcrTGoaoOaSTEShb20J CJIQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785486550; x=1786091350; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :x-original-authentication-results:x-original-sender :content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-beenthere:x-gm-message-state:sender:from:to:cc :subject:date:message-id:reply-to:content-type; bh=8OY7XFMkqOJri6o8cW2rXpiUt85DTaux8V/XvMUdBi0=; b=elufjK3QrX2TTsXyHJFaQII91wYVxgHGlfExNkZImhCkNWa14VRzgN7x8TrHrRUf0z meFk6DXYMSeIkmdO1QexqYtQoImkhX+UwZX9NWStBw1/8ORyPvFAj8KRm5IACe97T/JT QQoMKRYEm9OL1j3L8Nv0p45H/23g/AEn/MKYkDxCmD9ZTlLwtAvcAtwUY3AoDl0XpMZR FjcQ6RrC0g7IKNnQHrJ57aPwfRD9b6f5i9EmlrIlnt/fsuSZsLGvrr9y7ubVz3GaJQkp onFdtPZ32Zf2ZL58Xs6C88A8cWLZ0s9fcGiVd1LUm2Dt3m0zbqaVJyb67PIdZKhIcPW+ HWPw== Sender: isar-users@googlegroups.com X-Forwarded-Encrypted: i=2; AHgh+Rp9iJ18tyDLJ2uNlCpkaC8fE4aSvW20hfMw2YK056F++aOTXhjhkoaOqhgUDRT1ago/iYNc@ilbers.de X-Gm-Message-State: AOJu0YwVFzkZBNMbgRBiP1pyU1YWBj16vh+ANARbjXCgVUbfIHogAC80 P31GWezkOINnJHg58eb3703tnuLLgo1tCql4AyXrVA4GgPG86qNUZ7aF X-Received: by 2002:a05:6000:250a:b0:47f:9cc2:ddd2 with SMTP id ffacd0b85a97d-47fd2b2cab8mr2659637f8f.35.1785486549751; Fri, 31 Jul 2026 01:29:09 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="Aa7YSPT9tzglOzK3npyRyYUF7lHwyTURQneU6d45uIyfElnOJg==" Received: by 2002:adf:e752:0:b0:460:1131:73dd with SMTP id ffacd0b85a97d-47fc6137e13ls1698568f8f.1.-pod-prod-01-eu; Fri, 31 Jul 2026 01:29:07 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+Rp/MI52VT5jwledEMAy8RtiXLTcYNBuM4Bhi/B4IFhVVqKEC85QTFbsFpYIl7CT9llrS2o308dFr0JH@googlegroups.com X-Received: by 2002:a05:6000:2c02:b0:475:f0f0:9ef7 with SMTP id ffacd0b85a97d-47fd2b653e6mr2893699f8f.60.1785486547501; Fri, 31 Jul 2026 01:29:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1785486547; cv=none; d=google.com; s=arc-20260327; b=mHcO3QLr6Npki4eCeefAua9T3Kf0v1FCYd3869H8e8sAISJAROAbQDYb8sV0S5Cu86 jDICwuZYJY7vqtLGQsOk0PRkpww7I2FOIL33KeXXdsZPt6U17Cr1f/5XBYbonbsA1fL2 adQKaQqpzwxMvo4jk1D2zLHdW3c1/3lu4Q6q1Sq40rY1NIl0vL+WG28cWdd+ZnYJi0d3 jz9ea4BNck++gtIgTh+tO92oi/9+1Plx18vpo2qjXqu1NzWwqiE8ruSAC5dX7Vkz98rM ylCWSD6QWd8v4KPcA4obnPjY41XRAbLg/Ve107Am+VTTKku3rCFMp3dlm3DtDCxjIHWC TlLA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id; bh=O/5lcqZN9V0hEBJhIVDCMd2QIXHWT5V03T7DfCUqIi4=; fh=twdt7iNwKHA0z8UGpC9Czl1othSv8SnrMv1shTGXQfE=; b=P1Kk76kdPZA4e+6lmC4UPKn1AkWiuWDDJ2YGvzAFKOYEEbdR5vQxBTO3+la04N5A8R nneN6fW2c46u+QSRzkNklLErtnRYS2m2YSTzcH0lzYUue7o31yUTrtOPbDfTOKoXyIgL HIK8gzApykTGOVifIsPH4voy4b4T3xa1Bvm3ujDA5ocFGuY++p4WmpZLFye63tv0LZV7 Otp7HfDIdxDxz9mT2xsMOsp4oUkEMrGj1hO30D6WQknIIvfVYex7g4ST3F/eacp6+SM2 Do9wrvOuGpVAk0rump+VCf/U/hypd0I90RM5vN6mht7lXpd6qBzf6TbLUVj2Q9zmF5Gm hY5Q==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Received: from shymkent.ilbers.de (shymkent.ilbers.de. [85.214.156.166]) by gmr-mx.google.com with ESMTPS id ffacd0b85a97d-47fd45e9136si11507f8f.7.2026.07.31.01.29.07 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 31 Jul 2026 01:29:07 -0700 (PDT) Received-SPF: pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) client-ip=85.214.156.166; Received: from [192.168.178.139] ([88.130.203.42]) (authenticated bits=0) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPSA id 66V8T6M5030525 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 31 Jul 2026 10:29:06 +0200 Message-ID: <28f68548-861d-41b2-96dc-941064b2c1ac@ilbers.de> Date: Fri, 31 Jul 2026 10:29:06 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 1/1] sbuild: allow to override enforcement of no-network policy To: Felix Moessbauer , isar-users@googlegroups.com Cc: jan.kiszka@siemens.com, michael.adler@siemens.com References: <20260728102838.962383-1-felix.moessbauer@siemens.com> Content-Language: en-US From: Zhihang Wei In-Reply-To: <20260728102838.962383-1-felix.moessbauer@siemens.com> Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: quoted-printable X-Spam-Status: No, score=-4.6 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-Original-Sender: wzh@ilbers.de X-Original-Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-TUID: MyI0X6Mq1Kha Applied to next, thanks. Zhihang On 7/28/26 12:28, 'Felix Moessbauer' via isar-users wrote: > In accordance with Debian Policy =C2=A74.9, sbuild disables network > access while running `dpkg-buildpackage` (from trixie on). For > technical reasons, this was not enforced on the schroot backend, > leading to silent policy violations. On the unshare backend > (rootless), this is enforced, which might break some downstream > builds. By providing a variable to override this, we restore > compatibility with the privileged mode. > > Pre 0.89 versions of sbuild (e.g. on bookworm), always allow network > access, independent of the backend. > > Signed-off-by: Felix Moessbauer > --- > RECIPE-API-CHANGELOG.md | 9 +++++++++ > meta/classes-recipe/dpkg.bbclass | 15 +++++++++++++++ > 2 files changed, 24 insertions(+) > > diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md > index f5b84c84..69560e9f 100644 > --- a/RECIPE-API-CHANGELOG.md > +++ b/RECIPE-API-CHANGELOG.md > @@ -1129,6 +1129,15 @@ environment and cannot be deleted from the outside= by the calling user. To simpl > the cleanup, we provide the `isar-clean-builddir` script that helps pur= ging > directories with mixed ownerships (without requiring root privileges). > =20 > +### Network access during package builds (on rootless) > + > +In accordance with Debian Policy =C2=A74.9, sbuild disables network acce= ss while running > +`dpkg-buildpackage`. For technical reasons, this is only enforced on the= unshare > +backend (and on sbuild versions > 0.89). The schroot backend retains its= existing > +network access. Recipes that still require network access during the bui= ld can set > +`DPKG_BUILD_ENABLE_NETWORK =3D "1"` to explicitly enable it when using a= n sbuild > +version newer than 0.89. > + > ### Add Hyper-V machine support > =20 > A new machine `hyper-v` has been introduced for building images > diff --git a/meta/classes-recipe/dpkg.bbclass b/meta/classes-recipe/dpkg.= bbclass > index 1b2616db..d8e129bb 100644 > --- a/meta/classes-recipe/dpkg.bbclass > +++ b/meta/classes-recipe/dpkg.bbclass > @@ -15,6 +15,12 @@ DPKG_PREBUILD_ENV_FILE=3D"${WORKDIR}/dpkg_prebuild.env= " > # Note: must not have any logical influence on the generated package > SBUILD_PASSTHROUGH_ADDITIONS ?=3D "" > =20 > +# Debian Policy =C2=A74.9 forbids network access during build. However, = this can only > +# be enforced on unshare backend. For schroot backend, network access wa= s still possible, > +# resulting in builds needing it. To override this, the variable DPKG_BU= ILD_ENABLE_NETWORK > +# can be set to "1" in the recipe. > +DPKG_BUILD_ENABLE_NETWORK ??=3D "0" > + > def expand_sbuild_pt_additions(d): > cmds =3D '' > for var in d.getVar('SBUILD_PASSTHROUGH_ADDITIONS').split(): > @@ -112,10 +118,19 @@ dpkg_runbuild() { > =20 > DSC_FILE=3D$(find ${WORKDIR} -maxdepth 1 -name "${DEBIAN_SOURCE}_*.= dsc" -print) > =20 > + # networking is automatically enabled on older versions of sbuild > + sbuild_network_option=3D"" > + sbuild_version=3D"$(dpkg-query --showformat=3D'${source:Upstream-Ver= sion}' --show sbuild)" > + if [ "${DPKG_BUILD_ENABLE_NETWORK}" =3D "1" ] && \ > + dpkg --compare-versions "$sbuild_version" ge "0.89"; then > + sbuild_network_option=3D"--enable-network" > + fi > + > sbuild -n -c ${SBUILD_CHROOT} \ > --chroot-mode=3D${ISAR_CHROOT_MODE} \ > --host=3D${PACKAGE_ARCH} --build=3D${BUILD_ARCH} ${profiles} \ > ${@'--no-arch-all' if 'cross' in isar_deb_build_profiles(d).spl= it() else '--arch-all'} \ > + ${sbuild_network_option} \ > --no-run-lintian --no-run-piuparts --no-run-autopkgtest --resol= ve-alternatives \ > --bd-uninstallable-explainer=3Dapt \ > --no-apt-update --apt-distupgrade \ --=20 You received this message because you are subscribed to the Google Groups "= isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/= 28f68548-861d-41b2-96dc-941064b2c1ac%40ilbers.de.