From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Wed, 01 Jul 2026 11:05:17 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-lj1-f183.google.com (mail-lj1-f183.google.com [209.85.208.183]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 66195FcM004379 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 1 Jul 2026 11:05:16 +0200 Received: by mail-lj1-f183.google.com with SMTP id 38308e7fff4ca-39ada0874c0sf2463421fa.2 for ; Wed, 01 Jul 2026 02:05:16 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1782896710; cv=pass; d=google.com; s=arc-20260327; b=JY0B+ZrL53jrC8LF8wRP7CX0M+gS12yOpoDMCTCkLX32JUhkUfgQQYeLjQuPI2yH2P U1ah0+n2Vb/GIqDzCDKBXBR4Ye8qicZftAFSKYB9+/WtuQUsohqQ8KBoRoPyY8kh8kQ6 NJ6bXFbp6UeSO2A65o60+JEMX9wwnEEx4jJid3vjmKs8Zo7Zh6PEg25fmGCcfdOOce5M PDb7n+k6dFgL1D/Bm72iqHLdiYl9Kt1bXrvHRCeEhFihEqCSBZMcrtENwXsMjcl6p4pB hIoSSLslX+9H/iZPgjyTALFgqgg7Hy5b78lWploZApxofEq/mu+CuW7yYbnv1crrqDuE mkIg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:in-reply-to:from:content-language :references:to:subject:user-agent:mime-version:date:message-id :sender:dkim-signature; bh=9JwbPPutOaSxtWlyrkVDV9QkXLOvbhvkOpiPGYETrSQ=; fh=KH3m8dX3pA1Mxa66HFQLyd7kIcNCKj6UuNlP2yTfqQw=; b=Si5E3E3j0dwd3bh/3ox7/hqCU7kWjnJvBPcbHPhTi5jrSluM7TSo6eOO+7zVkaMj/C wjoAHyD0bicsLDDdqsrOqWO5zT+w2Povhh1AHzsTv9nITOyKELSjhCtx3e9Dm7WrQoxt ySXG3/49mpo9XA6zBNTFkv31JMGoAXmP7H1jkwam2ctKQKyQ4cT5RKf54Nv5yMUmjLgx XMEsbWQzI+BcloeltP/CCO4SBigge3vEt17xheeBfws/FIYPPslbkR3wmYNDg7lhoTEq a8uz47DVw6/OQ1DPNBeW+NHs7oUamWCLzTLE2ODjPKoRltjsbh9DIPnpejHjL+dNt4VY DyIw==; darn=ilbers.de ARC-Authentication-Results: i=2; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1782896710; x=1783501510; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:content-type:in-reply-to:from:content-language :references:to:subject:user-agent:mime-version:date:message-id :sender:from:to:cc:subject:date:message-id:reply-to:content-type; bh=9JwbPPutOaSxtWlyrkVDV9QkXLOvbhvkOpiPGYETrSQ=; b=ODix0aEo4grgoLLC3yiH1z2PdIlmfnSSmBwEUHvHopZ4BUDmC0sztCckcgiHGipY5n ZgMysho4vJXI5coHjLkkYAlo/0tbP5HUho7zufe2Ed4psaZoQFZYbZDtBLl93jHg683O Bp1zdA2jlbtV9YDrcQg3S9I3ftGXj1F3vkJ2jx2sFDzwwyOT60UOENOKfoFHjbe4tlSD Og+7mc94W1N+8yRtJ4CAOYR+mV+cm2IMydnJXUY3TZodXgKcIHL3xQoVpaf9+7O/EE7E 4ojs7EvwKFC/5PDcvUxCxJA+w6mzD47PQCsOajHJXOed3DEAmz3E4rjf0pfnC+s3gwbt TSnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782896710; x=1783501510; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :x-original-authentication-results:x-original-sender:content-type :in-reply-to:from:content-language:references:to:subject:user-agent :mime-version:date:message-id:x-beenthere:x-gm-message-state:sender :from:to:cc:subject:date:message-id:reply-to:content-type; bh=9JwbPPutOaSxtWlyrkVDV9QkXLOvbhvkOpiPGYETrSQ=; b=qh1Rhx/iMU2wf0ZR2Uq0/zBe9DjMvrLZlItSJN0ekKjSCbXPxcymR0Y74/p3koW3Ys YovZMFmrFHDCQnwhiByna+HUZCKfzr1DeuK7Gg9GLq4edZIK46+IwkaYCYYXUSoYlG5B WhaZkGlUgm5ouHLF2Jv/PPXlML5tDP5cmLZeFb/1Oo5nhtGampm1wyWaklxDHmojVxOQ I+CfKBWV1NgLQBdt6fLk3bgsCGlTfe+Z2nwly33MLNpzeuYTJYbyos/PzNfVNm5CZwHU VMC+Ep+sZpOyLfWq/fxmU5bhs5mDA/JJVKS6kbUC/gIg24phe1aOUdOcAq4CwzVCKZ9h TCrQ== Sender: isar-users@googlegroups.com X-Forwarded-Encrypted: i=2; AHgh+RohbSVT8Hefe05WxC60nftwwHqzzFzfJWP04uR7i/c1NVbg0N+50XdjH/N9UuLcapD6RgkZ@ilbers.de X-Gm-Message-State: AOJu0Yws1ZbQPnQJ/+xVu8bintN0RkkHbGtcqHrXJmLQxF8x5I6utRfW /zUL/LPQhEepN0AHr/wvozQRYilaejBF1R6p+LdCLwR3MncjWWwSYz4p X-Received: by 2002:a05:651c:19ab:b0:39b:164a:2208 with SMTP id 38308e7fff4ca-39b3412e3f9mr1539441fa.40.1782896709627; Wed, 01 Jul 2026 02:05:09 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="AX0PUUfL6aAD7a0rMwYBFVSntRb/NnTLUwIHOd/jUmYMNfAtlg==" Received: by 2002:a05:651c:31d9:b0:396:6761:b4ac with SMTP id 38308e7fff4ca-39b2d2b005dls2001621fa.0.-pod-prod-09-eu; Wed, 01 Jul 2026 02:05:07 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+RrwuFVB1X5jD0YC+XKOh8KUcC/n2ItSMrNY6/RdYEWOQp+B8MhBHMqA0w7cYciKpTrfZwATDr8R8gYI@googlegroups.com X-Received: by 2002:a05:6512:1150:b0:5ae:c3c1:8208 with SMTP id 2adb3069b0e04-5aec68b27camr205898e87.51.1782896707269; Wed, 01 Jul 2026 02:05:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1782896707; cv=none; d=google.com; s=arc-20260327; b=ln5uAEzPpmwW9ll4jaGywLbcWDuJX91yTcwqkRNZ95H1dXrGvksgwqxdpT6f3IIIbl I2c5P0Hzb/DN45qLspbZzKP2E2+M0TMc1Yq+kEodRfLnkhyt4PZkvjfpU3/QKRPycTBw 1yAzONRk8P9N3ri8LwgWFvyiyPpaGLolpi5Cu8GCkNpgM5tEqa55A2e1tsf1eLhgQtqJ qpiM5FBdml29wiDoyfmOgHDevgIYpqBNJgxyZZNWnwiD/tq09LPyMguGfKw/KEuwr5SX g4apK1l22gJTm/GgbZQPPpeLu8MXB+nXpU4lim8LtYhV9Hr8+OaLPtLM0/MxI5JIalK1 mYow== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:in-reply-to:from:content-language :references:to:subject:user-agent:mime-version:date:message-id; bh=cEOCZxGC/TjZfDBBe9BV8adiESm/FRlB8J0gkCpYXJ0=; fh=ez+yYIN2+t1/A1KtVD1essDQ6+anTTnZTbSXjuK9WaU=; b=F6zUSWGg9lB/h/NZPdFKeq5xP/xw4JiJkg7Rq/hzmES3xF35DqD+h2F1gOHr32e2PN 2In0+xG1a+tiPH/L2WgVx2uA2tfUfYKn92MudsaTPkxQ6FTGV2wvNh6CsWfmK/aeMlMu rVzFTzLU/hZPyezCfWuugfm2ElALNA1y6qwpmNPFGtG3s7g/MVB3xaAL76jjlvigmsCj V27wjxqEWJecK57cJQEnAOLgmpXMbXYQ5y/Q0dvwMwf5blhW/tbnH137Wx0sPAx9g1GQ CB8TTxcKJYDxrP28ejDhQzheZd1iLfmkHBnUxefyV5CYN04kjRS+C4HIXU936IHexfSh N9uA==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Received: from shymkent.ilbers.de (shymkent.ilbers.de. [85.214.156.166]) by gmr-mx.google.com with ESMTPS id 2adb3069b0e04-5aebe4810c2si113893e87.8.2026.07.01.02.05.07 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Wed, 01 Jul 2026 02:05:07 -0700 (PDT) Received-SPF: pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) client-ip=85.214.156.166; Received: from [192.168.178.148] ([88.130.203.42]) (authenticated bits=0) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPSA id 661956e8004368 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 1 Jul 2026 11:05:06 +0200 Message-ID: <2a3ca79a-56d2-4822-bc2c-67dd869c0e17@ilbers.de> Date: Wed, 1 Jul 2026 11:05:05 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 1/1] update kas to 5.4 To: Felix Moessbauer , isar-users@googlegroups.com References: <20260624134140.2846634-1-felix.moessbauer@siemens.com> Content-Language: en-US From: Zhihang Wei In-Reply-To: <20260624134140.2846634-1-felix.moessbauer@siemens.com> Content-Type: text/plain; charset="UTF-8"; format=flowed X-Spam-Status: No, score=-4.6 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-Original-Sender: wzh@ilbers.de X-Original-Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-TUID: leIhAJSH9DSw Applied to next, thanks. Zhihang On 6/24/26 15:41, 'Felix Moessbauer' via isar-users wrote: > This is the first release that splits the privileged and rootless > execution modes. By that, the build_system: isar is deprecated and > replaced by isar-privileged / isar-rootless. > > To preserve the old behavior, we change the build system to > isar-privileged. > > Signed-off-by: Felix Moessbauer > --- > Dear maintainers, > please also rebuild the test container as this allows us to directly > test the rootless mode in the CI. > > Best regards, > Felix > > .gitlab-ci.yml | 2 +- > Kconfig | 2 +- > kas/isar.yaml | 4 +- > kas/kas-container | 300 +++++++++++++----------- > meta-isar/test/sample_kas_config.yml | 4 +- > meta-isar/test/sample_kas_config_hw.yml | 4 +- > 6 files changed, 169 insertions(+), 147 deletions(-) > > diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml > index d997f73c..0711f200 100644 > --- a/.gitlab-ci.yml > +++ b/.gitlab-ci.yml > @@ -1,5 +1,5 @@ > default: > - image: ghcr.io/siemens/kas/kas-isar:4.8.2 > + image: ghcr.io/siemens/kas/kas-isar:5.4 > > variables: > GIT_STRATEGY: clone > diff --git a/Kconfig b/Kconfig > index 86a4aac3..8953fbad 100644 > --- a/Kconfig > +++ b/Kconfig > @@ -14,7 +14,7 @@ config KAS_INCLUDE_MAIN > > config KAS_BUILD_SYSTEM > string > - default "isar" > + default "isar-privileged" > > source "kas/machine/Kconfig" > source "kas/distro/Kconfig" > diff --git a/kas/isar.yaml b/kas/isar.yaml > index 16ce8b42..a5194fc8 100644 > --- a/kas/isar.yaml > +++ b/kas/isar.yaml > @@ -2,9 +2,9 @@ > # Copyright (C) 2023-2024 ilbers GmbH > > header: > - version: 14 > + version: 23 > > -build_system: isar > +build_system: isar-privileged > > repos: > isar: > diff --git a/kas/kas-container b/kas/kas-container > index 993f0bb8..631e40c3 100755 > --- a/kas/kas-container > +++ b/kas/kas-container > @@ -27,7 +27,7 @@ > > set -e > > -KAS_CONTAINER_SCRIPT_VERSION="5.2" > +KAS_CONTAINER_SCRIPT_VERSION="5.4" > KAS_IMAGE_VERSION_DEFAULT="${KAS_CONTAINER_SCRIPT_VERSION}" > KAS_CONTAINER_IMAGE_DISTRO_DEFAULT="" > KAS_CONTAINER_IMAGE_PATH_DEFAULT="ghcr.io/siemens/kas" > @@ -49,9 +49,10 @@ usage() > printf "%b" "\nPositional arguments:\n" > printf "%b" "build\t\t\tCheck out repositories and build target.\n" > printf "%b" "checkout\t\tCheck out repositories but do not build.\n" > + printf "%b" "diff\t\t\tCompare two kas configurations.\n" > printf "%b" "dump\t\t\tCheck out repositories and write flat version\n" > printf "%b" " \t\t\tof config to stdout.\n" > - printf "%b" "lock\t\t\tCreate and update kas project lockfiles\n" > + printf "%b" "lock\t\t\tCreate and update kas project lockfiles.\n" > printf "%b" "shell\t\t\tRun a shell in the build environment.\n" > printf "%b" "for-all-repos\t\tRun specified command in each repository.\n" > printf "%b" "clean\t\t\tClean build artifacts, keep sstate cache and " \ > @@ -61,20 +62,19 @@ usage() > printf "%b" "cleanall\t\tClean build artifacts, sstate cache and " \ > "downloads.\n" > printf "%b" "purge\t\t\tRemove all data managed by kas. Run with '--dry-run'\n" > - printf "%b" " \t\t\tto check what would be removed\n" > + printf "%b" " \t\t\tto check what would be removed.\n" > printf "%b" "menu\t\t\tProvide configuration menu and trigger " \ > "configured build.\n" > printf "%b" "\nOptional arguments:\n" > - printf "%b" "--isar\t\t\tUse kas-isar container to build Isar image. To force\n" > - printf "%b" " \t\t\tthe use of run0 over sudo, set KAS_SUDO_CMD=run0.\n" > - printf "%b" "--with-loop-dev Pass a loop device to the " \ > - "container. Only required if\n" > - printf "%b" "\t\t\tloop-mounting is used by recipes.\n" > + printf "%b" "--isar-privileged\tRun an Isar build in privileged mode. " \ > + "To force the use\n" > + printf "%b" "\t\t\tof run0 over sudo, set KAS_SUDO_CMD=run0.\n" > + printf "%b" "--isar-rootless\t\tRun an Isar build in rootless mode.\n" > printf "%b" "--runtime-args\t\tAdditional arguments to pass to the " \ > - "container runtime\n" > + "container runtime.\n" > printf "%b" "\t\t\tfor running the build.\n" > printf "%b" "-l, --log-level\t\tSet log level (default=info).\n" > - printf "%b" "--version\t\tprint program version.\n" > + printf "%b" "--version\t\tPrint program version.\n" > printf "%b" "--ssh-dir\t\tDirectory containing SSH configurations.\n" > printf "%b" "\t\t\tAvoid \$HOME/.ssh unless you fully trust the " \ > "container.\n" > @@ -83,13 +83,15 @@ usage() > printf "%b" "\t\t\tAvoid \$HOME/.aws unless you fully trust the " \ > "container.\n" > printf "%b" "--git-credential-store\tFile path to the git credential " \ > - "store\n" > + "store.\n" > + printf "%b" "--git-credential-socket\tPath to the git credential cache " \ > + "socket.\n" > printf "%b" "--no-proxy-from-env\tDo not inherit proxy settings from " \ > "environment.\n" > printf "%b" "--repo-ro\t\tMount current repository read-only\n" \ > - "\t\t\t(default for build command)\n" > + "\t\t\t(default for build command).\n" > printf "%b" "--repo-rw\t\tMount current repository writable\n" \ > - "\t\t\t(default for shell command)\n" > + "\t\t\t(default for shell command).\n" > printf "%b" "-h, --help\t\tShow this help message and exit.\n" > printf "%b" "\n" > printf "%b" "You can force the use of podman over docker using " \ > @@ -143,11 +145,6 @@ prepare_sudo_cmd() > > enable_isar_mode() > { > - if [ -n "${ISAR_MODE}" ]; then > - return > - fi > - ISAR_MODE=1 > - > KAS_CONTAINER_IMAGE_NAME_DEFAULT="kas-isar" > KAS_ISAR_ARGS="--privileged" > > @@ -159,14 +156,38 @@ enable_isar_mode() > export PATH="${PATH}:/usr/sbin" > elif [ "${KAS_DOCKER_ROOTLESS}" = "1" ]; then > prepare_sudo_cmd > - export DOCKER_HOST="${DOCKER_HOST:-unix:///var/run/docker.sock}" > - debug "kas-isar does not support rootless docker. Using system docker" > + DOCKER_HOST_DEFAULT="$(docker context inspect default --format '{{.Endpoints.docker.Host}}')" > + export DOCKER_HOST="${DOCKER_HOST:-$DOCKER_HOST_DEFAULT}" > + debug "kas-isar does not support rootless docker. Using system docker in $DOCKER_HOST" > # force use of well-known system docker socket > KAS_CONTAINER_COMMAND="${_KAS_SUDO_CMD} ${KAS_CONTAINER_COMMAND}" > KAS_DOCKER_ROOTLESS=0 > fi > } > > +enable_isar_rootless_mode() > +{ > + KAS_CONTAINER_IMAGE_NAME_DEFAULT="kas-isar" > + > + # Use --privileged to pass the ambient capabilities into the container. > + # When calling from the user session (podman or docker-rootless), this > + # is fundamentally different from the system docker run --privileged > + if [ "${KAS_CONTAINER_ENGINE}" = "podman" ]; then > + KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} --userns=keep-id --privileged" > + elif [ "${KAS_DOCKER_ROOTLESS}" = "1" ]; then > + KAS_ISAR_ARGS="--privileged" > + else > + # we don't need --privileged, but we need to run with SYS_ADMIN > + # to be able to unshare. > + KAS_ISAR_ARGS=" \ > + --security-opt seccomp=unconfined \ > + --security-opt apparmor=unconfined \ > + --security-opt systempaths=unconfined \ > + --cap-add=SYS_ADMIN \ > + " > + fi > +} > + > enable_oe_mode() > { > if [ "${KAS_CONTAINER_ENGINE}" = "podman" ]; then > @@ -174,6 +195,7 @@ enable_oe_mode() > # calling "podman run" has a 1:1 mapping > KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} --userns=keep-id" > fi > + BUILD_SYSTEM="openembedded" > } > > enable_unpriv_userns_docker() > @@ -210,6 +232,19 @@ check_and_expand() > realpath -e "$_varval" > } > > +# SC2034: DIR appears unused (ignore, as they are used inside eval) > +# shellcheck disable=2034 > +setup_kas_dirs() > +{ > + KAS_WORK_DIR="${KAS_WORK_DIR:-$(pwd)}" > + KAS_WORK_DIR="$(check_and_expand KAS_WORK_DIR required)" > + KAS_BUILD_DIR="$(check_and_expand KAS_BUILD_DIR create)" > + KAS_REPO_REF_DIR="$(check_and_expand KAS_REPO_REF_DIR required)" > + DL_DIR="$(check_and_expand DL_DIR createrec)" > + SSTATE_DIR="$(check_and_expand SSTATE_DIR createrec)" > + KAS_BUILDTOOLS_DIR="$(check_and_expand KAS_BUILDTOOLS_DIR createrec)" > +} > + > # Params: FILE > # Returns: root repo dir of file > repo_path_of_file() > @@ -260,14 +295,6 @@ forward_dir() > fi > } > > -check_docker_rootless() > -{ > - KAS_DOCKER_ROOTLESS=0 > - if [ "$(docker context show)" = "rootless" ]; then > - KAS_DOCKER_ROOTLESS=1 > - fi > -} > - > enable_docker_rootless() > { > warning "Rootless docker used, only limited functionality available." > @@ -281,118 +308,44 @@ enable_docker_rootless() > KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} -e KAS_DOCKER_ROOTLESS=1" > } > > -KAS_GIT_OVERLAY_FILE="" > -kas_container_cleanup() > -{ > - if [ -f "${KAS_GIT_OVERLAY_FILE}" ]; then > - trace rm -f "${KAS_GIT_OVERLAY_FILE}" > - fi > -} > -trap kas_container_cleanup EXIT INT TERM > - > set_container_image_var() > { > + # if the image is explicitly set, use that > + if [ -n "${KAS_CONTAINER_IMAGE}" ]; then > + return > + fi > KAS_IMAGE_VERSION="${KAS_IMAGE_VERSION:-${KAS_IMAGE_VERSION_DEFAULT}}" > KAS_CONTAINER_IMAGE_DISTRO="${KAS_CONTAINER_IMAGE_DISTRO:-${KAS_CONTAINER_IMAGE_DISTRO_DEFAULT}}" > KAS_CONTAINER_IMAGE_NAME="${KAS_CONTAINER_IMAGE_NAME:-${KAS_CONTAINER_IMAGE_NAME_DEFAULT}}" > KAS_CONTAINER_IMAGE_PATH="${KAS_CONTAINER_IMAGE_PATH:-${KAS_CONTAINER_IMAGE_PATH_DEFAULT}}" > - KAS_CONTAINER_IMAGE_DEFAULT="${KAS_CONTAINER_IMAGE_PATH}/${KAS_CONTAINER_IMAGE_NAME}:${KAS_IMAGE_VERSION}" > - KAS_CONTAINER_IMAGE="${KAS_CONTAINER_IMAGE:-${KAS_CONTAINER_IMAGE_DEFAULT}}" > + KAS_CONTAINER_IMAGE="${KAS_CONTAINER_IMAGE_PATH}/${KAS_CONTAINER_IMAGE_NAME}:${KAS_IMAGE_VERSION}" > if [ -n "${KAS_CONTAINER_IMAGE_DISTRO}" ]; then > KAS_CONTAINER_IMAGE="${KAS_CONTAINER_IMAGE}-${KAS_CONTAINER_IMAGE_DISTRO}" > fi > } > > -# SC2034: DIR appears unused (ignore, as they are used inside eval) > -# shellcheck disable=2034 > -setup_kas_dirs() > -{ > - KAS_WORK_DIR="${KAS_WORK_DIR:-$(pwd)}" > - KAS_WORK_DIR="$(check_and_expand KAS_WORK_DIR required)" > - KAS_BUILD_DIR="$(check_and_expand KAS_BUILD_DIR create)" > - KAS_REPO_REF_DIR="$(check_and_expand KAS_REPO_REF_DIR required)" > - DL_DIR="$(check_and_expand DL_DIR createrec)" > - SSTATE_DIR="$(check_and_expand SSTATE_DIR createrec)" > - KAS_BUILDTOOLS_DIR="$(check_and_expand KAS_BUILDTOOLS_DIR createrec)" > -} > -setup_kas_dirs > - > -KAS_CONTAINER_ENGINE="${KAS_CONTAINER_ENGINE:-${KAS_DOCKER_ENGINE}}" > -if [ -z "${KAS_CONTAINER_ENGINE}" ]; then > - # Try to auto-detect a container engine > - if command -v docker >/dev/null; then > - case $(docker -v 2>/dev/null) in > - podman*) > - # The docker command is an alias for podman > - KAS_CONTAINER_ENGINE=podman > - ;; > - Docker*) > - # The docker command is the real docker > - KAS_CONTAINER_ENGINE=docker > - ;; > - *) > - # The docker command is an unknown engine > - fatal_error "docker command found, but unknown engine detected" > - esac > - elif command -v podman >/dev/null; then > - KAS_CONTAINER_ENGINE=podman > - else > - fatal_error "no container engine found, need docker or podman" > - fi > -fi > - > -KAS_RUNTIME_ARGS="--log-driver=none --user=root" > - > -case "${KAS_CONTAINER_ENGINE}" in > -docker) > - KAS_CONTAINER_COMMAND="docker" > - enable_unpriv_userns_docker > - check_docker_rootless > - ;; > -podman) > - KAS_CONTAINER_COMMAND="podman" > - KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} --security-opt label=disable" > - ;; > -*) > - fatal_error "unknown container engine '${KAS_CONTAINER_ENGINE}'" > - ;; > -esac > - > -# parse kas-container options > +# parse kas-container options, leave build system empty to distinguish between > +# explicitly set via flag and implicitly via config. > +BUILD_SYSTEM="" > +KAS_OPTIONS_DIRECT="" > +KAS_EXTRA_RUNTIME_ARGS="" > while [ $# -gt 0 ]; do > case "$1" in > - --isar) > - enable_isar_mode > + --isar | --isar-privileged) > + if [ "$1" = "--isar" ]; then > + warning "The semantic of '--isar' might change in the" \ > + "future. Please use '--isar-privileged' instead." > + fi > + BUILD_SYSTEM="isar-privileged" > shift 1 > ;; > - --with-loop-dev) > - if ! KAS_LOOP_DEV=$(/sbin/losetup -f 2>/dev/null); then > - if [ "$(id -u)" -eq 0 ]; then > - fatal_error "loop device not available!" > - fi > - prepare_sudo_cmd > - if ! [ "$KAS_SUDO_CMD" = "sudo" ]; then > - fatal_error '--with-loop-dev requires sudo for device setup.' > - fi > - sudo_command="/sbin/losetup -f" > - sudo_message="[sudo] enter password to setup loop" > - sudo_message="$sudo_message devices by calling" > - sudo_message="$sudo_message '$sudo_command': " > - # SC2086: Double quote to prevent globbing and word splitting. > - # shellcheck disable=2086 > - if ! KAS_LOOP_DEV=$(sudo -p "$sudo_message" $sudo_command \ > - 2>/dev/null); then > - fatal_error "loop device setup unsuccessful!" \ > - "try calling '$sudo_command' with root" \ > - "permissions manually." > - fi > - fi > - KAS_WITH_LOOP_DEV="--device ${KAS_LOOP_DEV}" > + --isar-rootless) > + BUILD_SYSTEM="isar-rootless" > shift 1 > ;; > - --runtime-args|--docker-args) > + --runtime-args | --docker-args) > [ $# -gt 0 ] || usage > - KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} $2" > + KAS_EXTRA_RUNTIME_ARGS=" $2" > shift 2 > ;; > --ssh-dir) > @@ -417,6 +370,13 @@ while [ $# -gt 0 ]; do > KAS_GIT_CREDENTIAL_STORE="$2" > shift 2 > ;; > + > + --git-credential-socket) > + [ $# -gt 2 ] || usage > + KAS_GIT_CREDENTIAL_SOCKET="$2" > + shift 2 > + ;; > + > --no-proxy-from-env) > KAS_NO_PROXY_FROM_ENV=1 > shift 1 > @@ -446,19 +406,19 @@ while [ $# -gt 0 ]; do > --*) > usage > ;; > - clean|cleansstate|cleanall|purge) > + clean | cleansstate | cleanall | purge) > KAS_REPO_MOUNT_OPT_DEFAULT="ro" > KAS_CMD=$1 > shift 1 > break > ;; > - shell|lock) > + shell | lock) > KAS_REPO_MOUNT_OPT_DEFAULT="rw" > KAS_CMD=$1 > shift 1 > break > ;; > - build|checkout|for-all-repos|menu) > + build | checkout | for-all-repos | menu) > KAS_REPO_MOUNT_OPT_DEFAULT="ro" > KAS_CMD=$1 > shift 1 > @@ -486,6 +446,10 @@ while [ $# -gt 0 ]; do > esac > done > > +KAS_RUNTIME_ARGS="--log-driver=none --user=root" > + > +setup_kas_dirs > + > [ -n "${KAS_CMD}" ] || usage > > KAS_EXTRA_BITBAKE_ARGS=0 > @@ -494,17 +458,17 @@ KAS_FILES= > # parse kas sub-command options > while [ $# -gt 0 ] && [ $KAS_EXTRA_BITBAKE_ARGS -eq 0 ]; do > case "$1" in > - --format|--indent|--provenance|--skip|--target|--task) > + --format | --indent | --provenance | --skip | --target | --task) > KAS_OPTIONS="${KAS_OPTIONS} $1 $2" > shift 1 > shift 1 || KAS_OPTIONS="--help" > ;; > - -c|--cmd|--command) > + -c | --cmd | --command) > KAS_BITBAKE_C_OPTION_ARGS="$2" > shift 1 > shift 1 || KAS_OPTIONS="--help" > ;; > - -E|--preserve-env) > + -E | --preserve-env) > fatal_error "$1 is not supported with ${KAS_CONTAINER_SELF_NAME}" > ;; > --) > @@ -563,10 +527,10 @@ if [ "${KAS_CMD}" = "menu" ]; then > if [ "$(echo "${KAS_FIRST_FILES}" | wc -w)" -ne "1" ]; then > fatal_error "menu plugin only supports a single Kconfig file" > fi > - BUILD_SYSTEM=$(tr '\n' '\f' 2>/dev/null < "${KAS_FIRST_FILES}" | \ > + BUILD_SYSTEM=${BUILD_SYSTEM:-$(tr '\n' '\f' 2>/dev/null < "${KAS_FIRST_FILES}" | > sed -e 's/\(.*\fconfig KAS_BUILD_SYSTEM\f\(.*\)\|.*\)/\2/' \ > -e 's/\f\([[:alpha:]].*\|$\)//' \ > - -e 's/.*default \"\(.*\)\".*/\1/') > + -e 's/.*default \"\(.*\)\".*/\1/')} > else > if [ -z "${KAS_FIRST_FILES}" ]; then > KAS_FIRST_FILES="${KAS_WORK_DIR}/.config.yaml" > @@ -574,20 +538,60 @@ else > > # We only get the first build system and let kas check if mixed > _KAS_FIRST_FILE=$(echo "${KAS_FIRST_FILES}" | awk '{print $1}') > - BUILD_SYSTEM=$(grep -e "^build_system: " "${_KAS_FIRST_FILE}" 2>/dev/null | \ > - sed 's/build_system:[ ]\+//') > + BUILD_SYSTEM=${BUILD_SYSTEM:-$(grep -e "^build_system: " "${_KAS_FIRST_FILE}" 2>/dev/null | > + sed 's/build_system:[ ]\+//')} > +fi > + > +KAS_CONTAINER_ENGINE="${KAS_CONTAINER_ENGINE:-${KAS_DOCKER_ENGINE}}" > +if [ -z "${KAS_CONTAINER_ENGINE}" ]; then > + # Try to auto-detect a container engine > + # Defaults if there are multiple options: > + # podman if build system is isar-rootless, docker otherwise > + if [ "${BUILD_SYSTEM}" = "isar-rootless" ] && command -v podman >/dev/null 2>&1; then > + KAS_CONTAINER_ENGINE=podman > + elif command -v docker >/dev/null 2>&1 && docker -v 2>/dev/null | grep -q '^Docker'; then > + KAS_CONTAINER_ENGINE=docker > + elif command -v podman >/dev/null 2>&1; then > + KAS_CONTAINER_ENGINE=podman > + else > + fatal_error "no container engine found, need docker or podman" > + fi > fi > > -if [ "${BUILD_SYSTEM}" = "isar" ]; then > +KAS_DOCKER_ROOTLESS=0 > +case "${KAS_CONTAINER_ENGINE}" in > +docker) > + KAS_CONTAINER_COMMAND="docker" > + enable_unpriv_userns_docker > + if [ "$(docker context show)" = "rootless" ]; then > + KAS_DOCKER_ROOTLESS=1 > + fi > + ;; > +podman) > + KAS_CONTAINER_COMMAND="podman" > + KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} --security-opt label=disable" > + ;; > +*) > + fatal_error "unknown container engine '${KAS_CONTAINER_ENGINE}'" > + ;; > +esac > + > +if [ "${BUILD_SYSTEM}" = "isar" ] || [ "${BUILD_SYSTEM}" = "isar-privileged" ]; then > enable_isar_mode > -elif [ -z "${ISAR_MODE}" ]; then > +elif [ "${BUILD_SYSTEM}" = "isar-rootless" ]; then > + enable_isar_rootless_mode > +else > enable_oe_mode > fi > > # clean can be executed without config, hence manually forward the build system > -if [ "${ISAR_MODE}" = "1" ] && echo "${KAS_CMD}" | grep -qe "^clean\|purge"; then > - KAS_OPTIONS="${KAS_OPTIONS} --isar" > -fi > +case "${BUILD_SYSTEM}" in > +isar*) > + if echo "${KAS_CMD}" | grep -qe "^clean\|purge"; then > + KAS_OPTIONS="${KAS_OPTIONS} --${BUILD_SYSTEM}" > + fi > + ;; > +esac > > set_container_image_var > > @@ -632,6 +636,16 @@ forward_dir KAS_BUILDTOOLS_DIR "/buildtools" "rw" > > if git_com_dir=$(git -C "${KAS_REPO_DIR}" rev-parse --git-common-dir 2>/dev/null) \ > && [ "$git_com_dir" != "$(git -C "${KAS_REPO_DIR}" rev-parse --git-dir)" ]; then > + > + KAS_GIT_OVERLAY_FILE="" > + kas_container_cleanup() > + { > + if [ -f "${KAS_GIT_OVERLAY_FILE}" ]; then > + trace rm -f "${KAS_GIT_OVERLAY_FILE}" > + fi > + } > + trap kas_container_cleanup EXIT INT TERM > + > # If (it's a git repo) and the common dir isn't the git-dir, it is shared worktree and > # we have to mount the common dir in the container to make git work > # The mount path inside the container is different from the host path. Hence, we over-mount > @@ -685,6 +699,14 @@ if [ -n "${KAS_GIT_CREDENTIAL_STORE}" ] ; then > set -- "$@" -v "$(realpath -e "${KAS_GIT_CREDENTIAL_STORE}")":/var/kas/userdata/.git-credentials:ro > fi > > +if [ -n "${KAS_GIT_CREDENTIAL_SOCKET}" ] ; then > + if [ ! -S "${KAS_GIT_CREDENTIAL_SOCKET}" ]; then > + fatal_error "passed KAS_GIT_CREDENTIAL_SOCKET '${KAS_GIT_CREDENTIAL_SOCKET}' is not a socket" > + fi > + KAS_GIT_CREDENTIAL_HELPER_DEFAULT="cache --socket=/var/kas/userdata/.git-cache-socket" > + set -- "$@" -v "$(realpath -e "${KAS_GIT_CREDENTIAL_SOCKET}")":/var/kas/userdata/.git-cache-socket > +fi > + > GIT_CREDENTIAL_HELPER="${GIT_CREDENTIAL_HELPER:-${KAS_GIT_CREDENTIAL_HELPER_DEFAULT}}" > > if [ -n "${GIT_CREDENTIAL_HELPER}" ] ; then > @@ -739,7 +761,7 @@ done > > # propagate only supported SHELL settings > case "$SHELL" in > -/bin/sh|/bin/bash|/bin/dash) > +/bin/sh | /bin/bash | /bin/dash) > set -- "$@" -e "SHELL=$SHELL" > ;; > *) > @@ -757,7 +779,7 @@ fi > > # SC2086: Double quote to prevent globbing and word splitting. > # shellcheck disable=2086 > -set -- "$@" ${KAS_ISAR_ARGS} ${KAS_WITH_LOOP_DEV} ${KAS_RUNTIME_ARGS} \ > +set -- "$@" ${KAS_ISAR_ARGS} ${KAS_RUNTIME_ARGS} ${KAS_EXTRA_RUNTIME_ARGS} \ > ${KAS_CONTAINER_IMAGE} ${KAS_OPTIONS_DIRECT} ${KAS_CMD} ${KAS_OPTIONS} > if [ -n "${KAS_BITBAKE_C_OPTION_ARGS}" ]; then > set -- "$@" -c "${KAS_BITBAKE_C_OPTION_ARGS}" > diff --git a/meta-isar/test/sample_kas_config.yml b/meta-isar/test/sample_kas_config.yml > index f9b72d82..2eeaaf86 100644 > --- a/meta-isar/test/sample_kas_config.yml > +++ b/meta-isar/test/sample_kas_config.yml > @@ -1,7 +1,7 @@ > header: > - version: 14 > + version: 23 > > -build_system: isar > +build_system: isar-privileged > > distro: debian-bullseye > machine: qemuarm64 > diff --git a/meta-isar/test/sample_kas_config_hw.yml b/meta-isar/test/sample_kas_config_hw.yml > index 37c7bb31..02830238 100644 > --- a/meta-isar/test/sample_kas_config_hw.yml > +++ b/meta-isar/test/sample_kas_config_hw.yml > @@ -1,7 +1,7 @@ > header: > - version: 14 > + version: 23 > > -build_system: isar > +build_system: isar-privileged > > distro: raspios-bullseye > machine: rpi-arm-v7 -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/2a3ca79a-56d2-4822-bc2c-67dd869c0e17%40ilbers.de.