From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Tue, 26 May 2026 11:43:33 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-qv1-f58.google.com (mail-qv1-f58.google.com [209.85.219.58]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 64Q9hWbT024988 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 26 May 2026 11:43:32 +0200 Received: by mail-qv1-f58.google.com with SMTP id 6a1803df08f44-8c9e99fcd15sf309182146d6.0 for ; Tue, 26 May 2026 02:43:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1779788607; x=1780393407; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-id:user-agent:content-language:accept-language:in-reply-to :references:message-id:date:thread-index:thread-topic:subject:cc:to :from:from:to:cc:subject:date:message-id:reply-to; bh=XprSt9/qCGNQvNjWefjAQOmkk/8AScIaPt6ryu6Z0SI=; b=ElChSpEep3RCvb5AVeHtyTBjvEzB0JObB56yYYUxQgfaJw1jX8aG1fRSww4osjfpsw 9hmWzUBB6xt7vJaKHY5F/bX+MTPkSBN5bgivGxOeQWHns7urWv7JC6oPz0nDuEcTX3eg 4HxsXI905Vfp+QvGoO4vADTBejdWzGPCI++JBVlzx0W83cbANeJdm0yzdsukQ/xKLZEp gYNU7jIcOm1NwZqFJbRQ51G61rq3NYizzeNo8Y2Sella/fZm9DVWSo6aJNGJhwhVcwsk Vhw8iRl3Qy7REyz3PwAhTB7NuEsF9UMcsA1U4ZGYLYEwe2tvxE503NR7FP9V7H+4JGwQ 0jUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779788607; x=1780393407; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-id:user-agent:content-language:accept-language:in-reply-to :references:message-id:date:thread-index:thread-topic:subject:cc:to :from:x-beenthere:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=XprSt9/qCGNQvNjWefjAQOmkk/8AScIaPt6ryu6Z0SI=; b=b6GiZIBWyXr1wOzzImtP33Z8pAVlAp9+mic89+5anCflAhHU6TlyvwUzIeQ2mbcBNI bRXyMUswCwoHrQS/XrItVwK8YwI8u1dNiQytjF4cILJ8w878AXwEXua/VSHYoX4fxUA4 lH39PvhSocUJDHVXEODsz1rYesxS80I6La7C2a2HWB6TDKLYXakc5DmIuZJkyMhBwwBx 1/AhqdGaRxZJqicDjq+2RDyfV/wC3cRL1Tt5/MmQXETqY0/jjcgf448W9xZ3Z24haISj ZJP+PHc5Sb6o7lvLxniwX8W5i3rmDd/JxDOyCNaaHLIaGOHTYVXhLhG3QbqZ3Kz3G583 8big== X-Forwarded-Encrypted: i=2; AFNElJ8off5357OfgbVeSez+mqQCsmJvEs/gGL12JBoUwyZ/b393w8MzeVwJWLVmgy+Z63K1XHJc@ilbers.de X-Gm-Message-State: AOJu0Yzw7U1+2D5e0AbdaX0FITR1mRCSndh2e8xg7KmkXdXFyIyBOpaU QsjBf0mLdpsVTn81y6aoy6cT7yyUbGw83tUshLIeDMr4IgBwQrAMrUPs X-Received: by 2002:a05:6214:3d97:b0:8ad:d530:34b9 with SMTP id 6a1803df08f44-8cc7b5d0d7bmr275982916d6.34.1779788606721; Tue, 26 May 2026 02:43:26 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="AUV6zMPVm/3WZCTONzK/vY7hEdhtgSOZN7Vzfe6VJsRvM+90Tw==" Received: by 2002:a05:6214:2486:b0:890:5973:709e with SMTP id 6a1803df08f44-8c9413bb247ls143269776d6.0.-pod-prod-02-us; Tue, 26 May 2026 02:43:25 -0700 (PDT) X-Received: by 2002:a05:6122:2206:b0:567:4e8a:fb13 with SMTP id 71dfb90a1353d-58661070825mr9139176e0c.8.1779788605665; Tue, 26 May 2026 02:43:25 -0700 (PDT) Received: from GVXPR05CU001.outbound.protection.outlook.com (mail-swedencentralazlp170130007.outbound.protection.outlook.com. [2a01:111:f403:c202::7]) by gmr-mx.google.com with ESMTPS id 71dfb90a1353d-586f889d32esi443286e0c.6.2026.05.26.02.43.25 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 26 May 2026 02:43:25 -0700 (PDT) Received-SPF: pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c202::7 as permitted sender) client-ip=2a01:111:f403:c202::7; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Xu2pKPop7OqVJ99WCYFbJoac3WNal1vHWUdCcK0HoAsFdfJtCwfyy8CBfB+my5rzdNFH06q+phZ5oyh6AuG0husUChTYDq3oN0mn8ENUvOxA7svltFmhGYPcHL+IjfmeRHFJJ7gIXR3JoAHMN+yFTAWXemAs+AbRbRDO5MKDfPTb6vJaL/xI4h96UutzzqtLSbqyv3SAH7HxbQX4LuQVaQlyVgm3dGmHxgv7/ahG+s6912nh9A+SvY2MRltBE7+M3eCe3RtGAc0CpS1H2jPpuu2Eh05UK3FgWV/JKQQ/mqLC6/gyWf9n4Rz98ryVJ72vhxcUoEFKjK9jE2dQDcd3Jw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=SmtmYhnbNV3+FMcxtMAu6Fvu85OaICcKD2BLH3MCkyg=; b=W5PWPtRFHfEsh0FC7CTcUKWqLcg8VxFUH0RIhTVqRYkBa/MGLmW+sDdTl48RulQKRm7QzB9+TUlY0RdyJ4iS+7JHGnbSAzZGszS/wwwiKRRQK7Kcd5HLqjdUsKbVbgiwvwl4FaO7NGaR63OWWJCvXbogvgBHt1x5/ZyIH5Kr8d6boF7MQrZAFHuNo6Vb5qBONU5hN0czkUPEBjHzkyW/0+ki2S1IFpCIFcC9AqRueer9wZedP4WHhdslR5LJ2g/NUcxhnNTm1GGoJXYJyjRQvJLj42d7GyJPw8amnq6x96htbTZN+qUbD141SGwVMRVw/bI7kn3pFsPFrGHa6lqfcQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from GVXPR10MB5936.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:150:1::5) by AS8PR10MB6149.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:573::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.48.17; Tue, 26 May 2026 09:43:22 +0000 Received: from GVXPR10MB5936.EURPRD10.PROD.OUTLOOK.COM ([fe80::9d92:3275:c0fd:8e39]) by GVXPR10MB5936.EURPRD10.PROD.OUTLOOK.COM ([fe80::9d92:3275:c0fd:8e39%4]) with mapi id 15.21.0048.019; Tue, 26 May 2026 09:43:22 +0000 From: "'MOESSBAUER, Felix' via isar-users" To: "isar-users@googlegroups.com" CC: "Kiszka, Jan" , "Gylstorff, Quirin" Subject: Re: [PATCH v3 00/16] add support to build isar unprivileged Thread-Topic: [PATCH v3 00/16] add support to build isar unprivileged Thread-Index: AQHcxpoUqrGtSm3Ub0eOFZAq1Hv7kbYgWvmA Date: Tue, 26 May 2026 09:43:21 +0000 Message-ID: <88aa53960d349c6679345286a5bed59113b0661d.camel@siemens.com> References: <20260407142310.2327696-1-felix.moessbauer@siemens.com> In-Reply-To: <20260407142310.2327696-1-felix.moessbauer@siemens.com> Accept-Language: de-DE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Evolution 3.56.2-9 x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GVXPR10MB5936:EE_|AS8PR10MB6149:EE_ x-ms-office365-filtering-correlation-id: a2e5134a-9bc2-4100-13be-08debb0b39c6 x-ms-exchange-atpmessageproperties: SA x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|366016|1800799024|376014|55112099003|38070700021|6133799003|11063799006|18002099003|56012099003|22082099003; x-microsoft-antispam-message-info: BlR3wLomBGV+BeZAZWq+SznegfHKLjEmIgKlxEwjzqHf715+Sm4vlMixCYOJNPe4BMs6rtbIfNYU6oJJ9xUD/Y+WTCj2NEbZslJ8duF8K4FDs44b9wHJUkno3+f6VFlf3dcdey70EbZZ5qbRqliF9aSvB8gKvw4qqFom55p9WcDVmFO1dhkA8gC/nbhP5xINHfSi0SxlpRRNmwSS1uDDYSh/+aqyoGc/dhKTMqThQQakDn4YvBeuKIdSlheiALl/opsj608exm/k8FFYQ4r9Xc9q9Ni7OFCkAWDpkSfGuZCSpQmGLyH8PN8rmSuiHOZ2Qn6xXQ2BB5ZGL8m8etz3NKrBhEChw6IHdudAQqMe2xNiKGsobNcxEzZLX5G4SyxHFQoUgpg7avIHwS73Vsx2Y30ogaCnwJZ/kNQimuuNjYlaFFnSZda1gac0fmFNnILHeqvCJSl6DMwVmHc/kek+FG7n7uUGwSRFo3sq0Ygi9EmHfKcGsQWJ2avFJO7U5m43JaMRqgVgeTkzpum/dibuTXF5FNwUGs4C1sBjqQl4xTqdIxlQ4pgjJsyMFYLO8FvIGaUqR5M0CNdmv54zhqAKcdJP7Va1yUlvaFn7JVkbfz7/jv+cg5VFLY9e5gb88FMsVXeZ2QfjpX3HYMHVywR+04IygmBFZTCw0kNWX8cLuNd/jkh9YSsFx1GuxOfea/DU4G4smnUUCINRxSv56JbFuw== x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GVXPR10MB5936.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(1800799024)(376014)(55112099003)(38070700021)(6133799003)(11063799006)(18002099003)(56012099003)(22082099003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?dnV4b3NtcFlKYWErUjYrN2Q4L2tSak5vcS9neW1VeWRPSGY1QzRSNjF5NjVu?= =?utf-8?B?M3Y0YzRSSTBKVzRIaGdjNzdpbDBVTm9UbVlJeGtmT0t6RUJ5V0h1YjVqZHpE?= =?utf-8?B?bDlyQW43Qlg3QnAvZm1WcE16SFg4VElQUk1PbE02cEtKODROaVRQOUlvcHF2?= =?utf-8?B?UGtVa1NqV1VSSG40U1c0UFN0SzRRTDc1UGpwUWFoR3MrZHFUOTVQWVhyd290?= =?utf-8?B?eVFXdWZRMkloM2xpOWYzalBjSkRiNkRyeklJTHNaRkY2ZEw3bmZUSStscEpi?= =?utf-8?B?V3JySWJ6SW5oVTVPWWEwOWNrN29PbUV6T0tYWmFKOXQxZG5iUFIvNHJodW52?= =?utf-8?B?cWMzcjlTeUFrWloxQ0g1MEhnQzBjYzc0WXIzZHJZSlJVMktVMTZxNDNHLzN5?= =?utf-8?B?NTNIWkdaQWhBWERkTDJlNFhvcDY1RC9nakdjT0RKZzBMenZuVE9wS3lrMG4v?= =?utf-8?B?ZGlITFFLSUFkQjJnNnFJckhYRTlqZlFiVWVLT2dhN0JBZWRHVEkzT0ZUaWE1?= =?utf-8?B?aVowODJOTUJJM0w2TjNwRWttTE1Cb29vZFpFaUJLMXpLRmlJamNPeUdGRHUw?= =?utf-8?B?dUR6QWV2b0xZR1NrdmkzbFltYkNQQ1VEMlJEYVVIbXRnQzZMQzJobjM5bVUv?= =?utf-8?B?OTQ1V1A1d3l0V1lYNm4vWjNXNFhVaXFOZDhyYjFzZlAxVmJtdnV4TSs4MlYr?= =?utf-8?B?NS85RE9lRXN1VHNTcjRqRVBVbmZudDl5ZEZ2K2YwK2wxdDl1U2RibERIVTcr?= =?utf-8?B?WVRmaGhydmZJZDNtK0RRbm9zbGRBaWlWakF0UEU5OHN1TEpFeS9VYnZUbS9q?= =?utf-8?B?K0psVXBobi9WQThaaHZNbGwwRFgzTWFzUGgvbFV2dXkxU0libVdPc2ZnZVk0?= =?utf-8?B?NzNMMjk3OTFXSXlsMWljVTFra1F1d0NnRlJPcVZlQjMyVUR0UWpXdVl3MHY3?= =?utf-8?B?ZWR0aExsMG1DYkxaK0F0RGZURDN3ZWdSa2VDTmplZWhaeDBUVkxlbTYveTAx?= =?utf-8?B?bTM2bjBycnNmSlhTbGJkSFNkaDFsQ2pFT0JXRHhabG9TRjk4YmFpSjd0bHA2?= =?utf-8?B?ZmJBeUVMOFdpcFB3eDU2ZitpRE9YUW1JaXJXcmJMTE9BNFhGZjlYNTNTbGNB?= =?utf-8?B?NUFXNlFoTWs1cE53enBTbDV5aExwVjRBelA2UUE0KzArOEpsUWp1QzJjOUlt?= =?utf-8?B?M3pxRlFVa2RTSkJESEFzLzV0VmNLWmd0RDN1UlBsZUZORDI5R1crV21KSmQy?= =?utf-8?B?VUN2L04xMDlKVENkWTNaeVlqbDZSdzIreUZ1UXNwamhpVjVZSUJ3cnAxaWF1?= =?utf-8?B?dzhndHVUcVhrc1lXenc0RmQrV0tISXNIS1VMNEg2OTJTU0FOL2FmL0Y2SCtZ?= =?utf-8?B?dXQrK0JrYS83UnRFMVJrMk11Z0VWMFdvVnB6bmZOdnRPakowcEh2bUZMaEZD?= =?utf-8?B?L21CYlJXck9KZDNjZWxhdVd1QVdPMC92YS9panNLTHFPdFpNMm5FbGNVeFlP?= =?utf-8?B?OEZxcG9ib0hidmdkQWxsdmNOVDh5L0xKNnhrVzhmOVRFb0x1S1REang5ZGhZ?= =?utf-8?B?ZFh4QU1jWU44WWhyYWNqVkY1YVp1OTRhSGZHZFhCNlVibXBFSjR0UGFTM3Ra?= =?utf-8?B?ekFUOElIV2xCL0xaOWdKUURpRE1lQmNyWWcyNVlvVDdBOXhFQ3FPb1FyTkxF?= =?utf-8?B?aFZybmM5V3FjdTU2cnpVdkRCb3BJOWRlWDhIVStGY1U1RTlGQ0dmTzJZNzkr?= =?utf-8?B?ZTEzODF2S0o1cUNtaWdEUHN4N0lMajREbEhKWksvNzlJMFdUZ20xcjBlOTli?= =?utf-8?B?Z2NGRjA4OFNkRTBlQjZpamdyWkYvMTN0SXVZQUJNbmowSExWNGRDaWtvNktq?= =?utf-8?B?aXVNb3VPYVdHUklCQnFrVXlWSUVVN3daS1ZzVVdjMEZRUTUyWmdoYllpRmhB?= =?utf-8?B?N2N0V0pMZTlJRHovbjVsVFZvcCtDTlJiQXdONkN4dVByWWFCb20wckJROE1x?= =?utf-8?B?T3FYejFqS1k2V3VURW51Q28zM0Q4VlVLZU5XVFVBeEUzNHpxT1ZEY1NJZDA1?= =?utf-8?B?SG84eWlMQXhpaVJ0NFFFZDN5d1hQYWprRnlQbmJqR1NOVDlyQ0RRVmVEMTdH?= =?utf-8?B?cEZkT2IySlFZZVl3UDlkSzUySjFEZEZBbXRzSnF2VjFnby9pZVF4cHhZejVS?= =?utf-8?B?WlFwYlVFNlpDZVFSRGxwUzlUVERSbmgrWnRPL2lHSnpKb2xLN0JWalQvRm1C?= =?utf-8?B?QmRrSG5ITWVwUWlEQ3VWYTVjY3lEV2xiU3Izam93K1Z4aTBMWlB0T2RjMUM2?= =?utf-8?B?NlNFSnE3UDUwZ296Ni9CT2xkMy9NWHBmZlhvOHdZSTFTcHppeXBYQT09?= Content-Type: text/plain; charset="UTF-8" Content-ID: <655D7F5BF3A33E42BF1EA7BF5AA4A9D1@EURPRD10.PROD.OUTLOOK.COM> MIME-Version: 1.0 X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GVXPR10MB5936.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: a2e5134a-9bc2-4100-13be-08debb0b39c6 X-MS-Exchange-CrossTenant-originalarrivaltime: 26 May 2026 09:43:22.0315 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: CUPMz9f1JlnAfa0/ql3Npqqfb2ZwLClvJyrga6TxCKlRNM6HDoEjarx/uLfvVNOTNbJC6OMbDBAeYWrdtcZDLos7UyDGpKkgizvC/Ux4RkI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR10MB6149 X-Original-Sender: felix.moessbauer@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=RCHssbep; arc=fail (signature failed); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c202::7 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: "MOESSBAUER, Felix" Reply-To: "MOESSBAUER, Felix" Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2,RCVD_IN_RP_CERTIFIED, RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: +ZCMdEPsf5FV On Tue, 2026-04-07 at 16:22 +0200, Felix Moessbauer wrote: > Dear isar-users, > > currently isar requires password-less sudo and an environment > where mounting file systems is possible. This has proven problematic > for security reasons, both when running in a privileged container or > locally. > > To solve this, we implement fully rootless builds that rely on the > unshare syscall which allows us to avoid sudo and instead operate in > temporary kernel namespaces as a user that is just privileged within > that namespace. This comes with some challenges regarding the handling > of mounts (they are cleared when leaving the namespace), as well as > cross namespace deployments (the outer user might not be able to access > the inner data). For that, we rework the handling of mounts and artifact > passing to make it compatible with both chroot modes (schroot and > unshare). Any news on this one? Do you want me to send a rebase? I did not receive any objections regarding the proposed interface on the kas side. By that, I would like to move forward with this. I'm also fine with scheduling this behind the testsuite execution series ("Improve testsuite executability, basic GitHub CI"), as this significantly simplifies testing. Just let me know. Best regards, Felix > > Note, that this series can be tested on a custom kas-container build > provided in [1]. Hints how to migrate downstream layers are provided > in the API changelog. > > Changes since PATCH v2: > > - add support for cached base apt > - rootfs sstate: do not rely on fd3 for copy out, as not always available > - sbom: use local copy of sbom rootfs to not leave shared instance behind > - testsuite: add parameter to run in rootless mode > - rebased onto v1.0 > > Changes since PATCH v1: > > - fixed broken rebase onto next > - fix root_cleandirs implementation > > NOTE: This requires the kas series (v3) from [1] for rootless building. > > Changes since RFC 2: > > - rebased onto next > - fix usage of root_cleandirs > - simplify file permission handling by mapping caller user to > root inside the namespace. By that, in most cases no changes > to the imager are needed anymore. > - implement support for devshell under rootless > - switch to getpass.getuser() to query user (needed for dynamically > created / remapped kas builder user) > - rework mapping to be more similar to mapping used by mmdebstrap > - sbuild: only copy-out of dpkg.log on schroot (unclear if needed > on unshare. To be clarified) > - imager-sbom: ensure sbom is extracted before entering the chroot > > Changes since RFC 1: > > - switch build_type to isar-rootless in isar.yaml (Note: switch back > if testing locally in a unprepared kas container) > - complete overhaul of the mounting in unshared namespaces > - fixes the systemd presetting > - fixes hangs when pulling from snapshot mirrors > - rename the run_privileged_here to run_privileged_heredoc to clarify its intention > - add support for > - dpkg-source with do_fetch_common_source > - vm images > - container images > - discoverable disk images > - add helper script to clean build dir in unprivileged mode > - reduce clutter we leave after finishing a build > - fix issues when running in a privileged environment without sub user ids > - bugfixes > > Note, that the rootless build dir must not reside in a git worktree (a normal git > dir is fine). This is probably a bug in combination with kas-container. > > [1] https://groups.google.com/g/kas-devel/c/NWQFCU2aUHg > > Best regards, > Felix Moessbauer > Siemens AG > > Felix Moessbauer (16): > refactor bootstrap: store rootfs tar with user permissions > deb-dl-dir: export without root privileges > download debs without locking > introduce wrappers for privileged execution > bootstrap: move cleanup trap to function > rootfs: rework sstate caching of rootfs artifact > rootfs_generate_initramfs: rework deployment to avoid chowning > use bitbake function to generate mounting scripts > apt-fetcher: prepare for chroot specific fetching > add support for fully rootless builds > add helper script to clean artifacts in build dir > apt-fetcher: implement support for unshare backend > dpkg-source: implement multiarch support for unshare backend > use copy of sbom-chroot for sbom creation > add support for devshell on unshare backend > testsuite: add parameter to run tests in rootless mode > > Kconfig | 2 +- > RECIPE-API-CHANGELOG.md | 42 ++++ > doc/user_manual.md | 2 + > kas/isar.yaml | 2 +- > meta/classes-global/base.bbclass | 124 ++++++++++- > meta/classes-recipe/deb-dl-dir.bbclass | 24 ++- > meta/classes-recipe/dpkg-base.bbclass | 94 ++++++-- > meta/classes-recipe/dpkg-source.bbclass | 40 +++- > meta/classes-recipe/dpkg.bbclass | 19 +- > .../image-account-extension.bbclass | 4 +- > .../image-locales-extension.bbclass | 13 +- > .../image-postproc-extension.bbclass | 30 +-- > .../image-tools-extension.bbclass | 114 +++++++++- > meta/classes-recipe/image.bbclass | 21 +- > .../imagetypes_container.bbclass | 28 +-- > meta/classes-recipe/imagetypes_wic.bbclass | 10 +- > meta/classes-recipe/rootfs.bbclass | 203 +++++++++--------- > meta/classes-recipe/sbuild.bbclass | 34 ++- > meta/classes-recipe/sdk.bbclass | 22 +- > meta/classes/sbom.bbclass | 28 ++- > meta/conf/bitbake.conf | 7 +- > meta/lib/aptsrc_fetcher.py | 87 +++++++- > .../isar-mmdebstrap/isar-mmdebstrap.inc | 55 +++-- > .../sbom-chroot/sbom-chroot.bb | 11 +- > .../sbuild-chroot/sbuild-chroot.inc | 24 ++- > scripts/isar-clean-builddir | 73 +++++++ > testsuite/cibuilder.py | 6 + > .../unittests/test_image_account_extension.py | 9 +- > 28 files changed, 882 insertions(+), 246 deletions(-) > create mode 100755 scripts/isar-clean-builddir > > -- > 2.53.0 -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/88aa53960d349c6679345286a5bed59113b0661d.camel%40siemens.com.