Re: [PATCH v2 00/16] add support to build isar unprivileged

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Wed, 2026-03-18 at 07:02 +0100, Jan Kiszka wrote:
> On 17.03.26 19:41, Moessbauer, Felix (FT RPD CED OES-DE) wrote:
> > On Fri, 2026-02-27 at 15:57 +0100, Felix Moessbauer wrote:
> > > Dear isar-users,
> > > 
> > > currently isar requires password-less sudo and an environment
> > > where mounting file systems is possible. This has proven problematic
> > > for security reasons, both when running in a privileged container or
> > > locally.
> > > 
> > > To solve this, we implement fully rootless builds that rely on the
> > > unshare syscall which allows us to avoid sudo and instead operate in
> > > temporary kernel namespaces as a user that is just privileged within
> > > that namespace. This comes with some challenges regarding the handling
> > > of mounts (they are cleared when leaving the namespace), as well as
> > > cross namespace deployments (the outer user might not be able to access
> > > the inner data). For that, we rework the handling of mounts and artifact
> > > passing to make it compatible with both chroot modes (schroot and
> > > unshare).
> > > 
> > > Note, that this series can be tested on a custom kas-container build
> > > provided in [1]. Hints how to migrate downstream layers are provided
> > > in the API changelog.
> > > 
> > 
> > Dear isar-users,
> > 
> > I'm currently waiting for the isar release and then plan to send out a
> > v3 that adds support for the cached-base-repo and src / dbg package
> > downloading. By that, the series should be feature complete.
> > 
> > The last remaining aspect I don't have a solution to (yet) is the
> > sbuild_dpkg_log_export in dpkg.bbclass. To me it looks like the dpkg
> > dump is generated but never consumed anywhere. If someone could guide
> > me how this is processed, I'll implement support for this as well.
> > 
> 
> You read 03c0c7154d1632b92c9420ceb23706cc959b7cb3? Adding Uladzimir.

Yes, of course. But as I said, the file is not consumed anywhere.

A deeper investigation shows that this originally happened in deb-dl-
dir "is_not_part_of_current_build", but was removed in
f0da749f265e38d803da6566d680649d18f10c1f ("deb-dl-dir: remove excessive
calls to dpkg-deb in debsrc_download") by Cedric (now added as well).

Either the new implementation in f0da749f does not need the
dpkg_common.log file anymore (but forgot to remove the creation logic),
or the fix from 03c0c7154d is not working anymore.

Felix


-- 
Siemens AG
Linux Expert Center
Friedrich-Ludwig-Bauer-Str. 3
85748 Garching, Germany

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/7bce6b810199e96e8c68439b3e5d9121ad9f36ec.camel%40siemens.com.