From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Fri, 03 Jul 2026 16:53:36 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-qv1-f58.google.com (mail-qv1-f58.google.com [209.85.219.58]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 663ErZUG017031 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 3 Jul 2026 16:53:35 +0200 Received: by mail-qv1-f58.google.com with SMTP id 6a1803df08f44-8f113592bf3sf10420826d6.2 for ; Fri, 03 Jul 2026 07:53:35 -0700 (PDT) ARC-Seal: i=3; a=rsa-sha256; t=1783090409; cv=pass; d=google.com; s=arc-20260327; b=YWnSjGqkx6+NeikdQcC1JUZyuNg8J8S+UxMtSPX31T8hgiOw8Cl5wXuO6T/vPzRwv3 25ijLv6WDHqQXjd8Vg1rDcbHT2y4dKFeoRz+sjVPB0TZdpRU87CsKPhQraUYEn5ANpzu vdDvM7x2B++2nfy7e5+3B/5itRsB34y/ntLqkEUFLmuIhSQ+imjYx1m5PY+hfYtfBw5K +bMJ6RB3IyXazKiSS6r4gVLGFSdKia2PEOD0JmVAO1/rp7Qjkb53CiLXdbIf8FPi84K4 cWkrwPCgGSey/DluCGj8I0SDTND53mNQTu7ybeUHGmxfNEAEUl6nQ7CXFF8FHwovKNJZ du7g== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:content-id :user-agent:content-language:accept-language:in-reply-to:references :message-id:date:thread-index:thread-topic:subject:cc:to:from :dkim-signature; bh=+nKeG/l8yZbyWuSH1Ydv4C2mwjy/6AuM0n5Ii1WlDYQ=; fh=VPAk7kf7BJ4WCaNu2aO9o31bPixFpTrF+4pLH8INJ3g=; b=ZnqRcjOekk/Tbt6fG9IaUA+dOgiE+cDjW73UmMtzmEjGKjpOYs5zXvgYLvUdI3VgHw ms+cfYQJFf01KpKXlFZSsnBgh9JbyueodSUVlWylsCJIheZmjZreSAmztZtePOItzVuE 8HIL2AK3L2CgKZW2Tz671EbBWfKm+VvvLFT1VgZW4o+/Ora6jEn51jLPp6w+AFBDrpdg IbrbE30OD9lS5fwcpDc9v+B+6w/aP0bfxyM2x1KOsy2M41D7umd/99TITpMm5xUmLjT5 1yRzQcO45SV+TVnC1eDvPVg17k8jJmxZMMPJencfH3YMi5VmANTIMBibqlZub19yLfx2 VS6w==; darn=ilbers.de ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b="lTaF4t7/"; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::3 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1783090409; x=1783695209; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-id:content-type:user-agent:content-language:accept-language :in-reply-to:references:message-id:date:thread-index:thread-topic :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=+nKeG/l8yZbyWuSH1Ydv4C2mwjy/6AuM0n5Ii1WlDYQ=; b=hU8Q1YaZOUBgLK3Wfy5St63Mj7HJ3UwVxqYGEqZ2hPrqB5LquKmy1MR6IFH3MoNtl+ WBZJyLmAAm/KGsk0BfAgLJTTnYlFlFzSkvgz9ov+DRCAwrwlRUz41pvW2fB8tgy8m1cN Ejo7sRdfQOscIBrNdp3QyoCena/hwk4FqIqkhILRy+OeOCoz9Foa8kV2CPfWXdxoXGm0 eXc9C6eDQJ/Vm2sL+9PKgGLDsmBQrn+bzg0a/3qGs5pL+w4IReSML5+ES3I5WTHXXUOs D44oIKjYBpYRZrEhoZ6qXilHj3INukO5HhXLWBOBoIoI48YER5mAFRiUOD7e2161WwQE Rhjw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783090409; x=1783695209; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-id:content-type:user-agent:content-language:accept-language :in-reply-to:references:message-id:date:thread-index:thread-topic :subject:cc:to:from:x-beenthere:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to:content-type; bh=+nKeG/l8yZbyWuSH1Ydv4C2mwjy/6AuM0n5Ii1WlDYQ=; b=LCKHFtMMd+fqe+IIK9VHkZlTjtDvqUsPRgOPYWWx5j8Ackm9KdvyP9Y12bPmUBjovJ t/iTyEsOaApbtMvXTS6GAp/KxQrk5YRZD8B5jBADOj/JNkHw8tFfCylfCSa4uNPhYtIR OjOYbWm7PBgntSOv1sql7BaokygaYfiYKUEazT00xrV49jBng1AlX9pcDFY0ajwhRJvH /u6EdzcATEJHdhRA7YYhqIO/x1PNUavdWq89NlxCjkq9w2qIu7NxkOMw44wMHR149TEv T7l9h1AsUO8YWZhw11tKvBvG4Taeptiew4DQDl7/EMKhU+2tgdrNtxpFGT8EAx6bBkhg YHWg== X-Forwarded-Encrypted: i=3; AHgh+RqAhFAndn5X2J8cMi31/7sHRTA2xAFLcpgQyOXnwdO078a+LZvkuRPXfArm0da3cr+X79hm@ilbers.de X-Gm-Message-State: AOJu0Yzyvu+Gzu+el8SQWKoidBseEJc5l+OhHMoLmX0VGTwsNQOOSpyy g6E/EAxTzkm1edUbFqtosx9q4ipN6h7DNCDIFzav/aN2VOFc9X0yKDMp X-Received: by 2002:a05:6214:c46:b0:8ef:33aa:94d7 with SMTP id 6a1803df08f44-8f423f09819mr136447476d6.40.1783090409272; Fri, 03 Jul 2026 07:53:29 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="AX0PUUe8M1c2EHZKzEV7U8LjsNk2Oec8hIte1buvVOqnEjz4cw==" Received: by 2002:a05:6214:518a:b0:8cc:fd6:fed with SMTP id 6a1803df08f44-8f33f182719ls24328536d6.0.-pod-prod-09-us; Fri, 03 Jul 2026 07:53:27 -0700 (PDT) X-Received: by 2002:a05:6122:338c:b0:5a3:3153:21c9 with SMTP id 71dfb90a1353d-5be0fba3fe9mr3420e0c.11.1783090407679; Fri, 03 Jul 2026 07:53:27 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1783090407; cv=pass; d=google.com; s=arc-20260327; b=R2Ve131rInqfKUbkDUJ0FGdWvTp1agwWSWPxYcHZFzFeFyRTfNFAv+vi5BdtZGV62o waDZM+RWAUsfHjipAwSh7UsflCIGllsTCRZEZYzFjS7zEyfCn9V6hIb0SzW8gfXdoQsn eB0lfab5tEBnoKirm6GmJJkD16t3EHzoR1sxLxRDhvXctJDEIzaqXVdvZpOddk+jxwVG acgupLhxyQ9z1aEsN4e6l+ZrScO5VTFXETSbRsIj5NeY5gxvAcr2D1ACgWu59NvnZd5s ktmADybEw1/AI+4zt9F+vVKyPbOkQ3KHi+rktNfEmbPRFQa37dRxNP9WxzqNfwgVf1DS gNNg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:content-transfer-encoding:content-id:user-agent :content-language:accept-language:in-reply-to:references:message-id :date:thread-index:thread-topic:subject:cc:to:from:dkim-signature; bh=Vr4JI1teoNF2sq4BmCsnzpVhw2cas7bS2e3uwvhs42A=; fh=+RXGdjuO8SPEGTTWrhBeZfVoVlQqfd6/VVFhdHITYy0=; b=YHPMhhOpGjTxfWreGgnY+RZ13Mmf4TopfTbu2qHJWZYyeI3jGigcJxrBR32PxNrJD0 qRUtlOTT+mVaGF9Z6nu/LDqg1nWhADwPEyddz7eeR3krnXwWFwGnrA329GM3ROy+t5Rr rNSpS6fBe5axfA4N5tDcnO1GNOI8mRnqkfAqLW6j+2zNimknrYvICaeEyTnpKgV5P+T5 Wxlcyd4SaWILIr9FyGXKdQBRGZvEcKY4mYVA+W/Z/E9TcwEbaAV8UWp1PmoLzPWhBt0G fGWCZSmG2R1/T0gsEJZvIn4Pcj3XWRIapzSwfHBiuKdhAbGVselzBDjbUTmzQNXrfYrM yzLQ==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b="lTaF4t7/"; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::3 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from DU2PR03CU002.outbound.protection.outlook.com (mail-northeuropeazlp170110003.outbound.protection.outlook.com. [2a01:111:f403:c200::3]) by gmr-mx.google.com with ESMTPS id 71dfb90a1353d-5be02be44ddsi58048e0c.8.2026.07.03.07.53.27 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 03 Jul 2026 07:53:27 -0700 (PDT) Received-SPF: pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::3 as permitted sender) client-ip=2a01:111:f403:c200::3; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=aS8SwN9aWn4aFsVh408ytW9ro3nssKWQKANDYeEq+OhJAFmFxpidlyApnkLscF9vn1+X+wJR+pIwWEsu4wnK92bVKn/8p8C17fktMTeIopy2PCbVYB2Q902FDyG5TTodPNtEClxp7ngkCPNuKnrPgSmWNk0q5soj7dTLDkHVgtdqh//0LolWr76KQu7bxErSW8/EEfa7fUCDmmSeINPaZCUWpi6rah23BqoeVs/G6zTpVA3HjK9lxhsIOWRSn3z/xAHWbN/1yZcY6cSfsrGSnDRfBQCo8WcCvCLBwOGkGG1QvJTqSNZYB5GEYdw/TYau3/uv4tJthL5wUCIIpJQ21A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Vr4JI1teoNF2sq4BmCsnzpVhw2cas7bS2e3uwvhs42A=; b=hSqxts+Kq1/ie9q1AJlwRHqeQNqH+iOZoszuRKgXWwci1lnXpWmykFUlnlqW7GEje/UCfaeA1Hii3b9lAHmU8l62Gg2qajaw9MhJIapaqATO6+QZpJlG79lNthg7MxZTquIZy6/glQBs4YU4uvNnJNzhHoDuJesPIFLFZsRwBshwSdcfzu+0y9vuse8WU9/9HAdZpgtvJao9jagsaLjJJcfC2km8GHXxcmIXCiD5Y6l91fPJVC76HN83QyGqXjFrieKFZVX2yZnpWJzZXQj3/PAd5uQEzZ8GF6BQzwrsF+Jm9vHgcRAKfu81hZHiX4nAkblyavxzIK5MGHlsa5GeGQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:17e::10) by AS4PR10MB5623.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:4f1::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.10; Fri, 3 Jul 2026 14:53:25 +0000 Received: from AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM ([fe80::c54c:ccd8:ebbf:477c]) by AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM ([fe80::c54c:ccd8:ebbf:477c%5]) with mapi id 15.21.0181.010; Fri, 3 Jul 2026 14:53:25 +0000 From: "'MOESSBAUER, Felix' via isar-users" To: "isar-users@googlegroups.com" CC: "Kiszka, Jan" , "Gylstorff, Quirin" Subject: Re: [PATCH v7 10/17] add support for fully rootless builds Thread-Topic: [PATCH v7 10/17] add support for fully rootless builds Thread-Index: AQHdBLh6MKBvzGpG8UCj6yUGgsC6obZb7fQA Date: Fri, 3 Jul 2026 14:53:25 +0000 Message-ID: <99b3c876bd27c5f7b2c895e3eb7a4e42bf7940e5.camel@siemens.com> References: <20260625153651.762936-1-felix.moessbauer@siemens.com> <20260625153651.762936-11-felix.moessbauer@siemens.com> In-Reply-To: <20260625153651.762936-11-felix.moessbauer@siemens.com> Accept-Language: de-DE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Evolution 3.56.2-10 x-ms-publictraffictype: Email x-ms-traffictypediagnostic: AM7PR10MB3956:EE_|AS4PR10MB5623:EE_ x-ms-office365-filtering-correlation-id: 4313eb9f-6b95-4056-75f8-08ded912d5bc x-ms-exchange-atpmessageproperties: SA x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|376014|23010399003|1800799024|366016|38070700021|22082099003|18002099003|4143699003|11063799006|56012099006|6133799003|55112099003; x-microsoft-antispam-message-info: 2WxOOFOwdXB6IZNvPp8W5Y035vuOK84lpW0EoqmzacTJOMnrrLDCa8THTP5V4CHyK3lHi+sfHYonztcLyBEU2PYn/m1DGafOO7OoUQsIqtgvWBTyTu4H3ukPC/ZP6DRFhXrI0gpDAC5S1r2u9lA2pZZL+xwbFPsFi42QAvoJfWRcdPJ9dMo+NcM1S0zQXgGj08XZn9AcFuRSnb1KHa0oC1lUclQ3iPuPbCowdJUrzo5nLUHDlImxS6MdzfC6lE4KxCW7OZQ0iRSKE9e8YFftqBa9r4SW+AbwJxqrE8nXtvy3DBxmZjyEQCIoG+iPkg69JsOzNlGrz2FvqFhuuqL3jIX+uY2v1WxmPPsX3+BrmDxJAaMYzd9Cn/u+gDq1NspgZg41FBGkqYEz9Xn4jgMs1zgv1gOe1cXBAnKjsnaUjSQVJBhdRP8G0J+MukqPsWeNGYCEwVHUjJrToM58HtX8N+4grY5vLLNiEAPoB4ipZ1u4iM67GMC9vgCVyfHPSDCmZGAyiJlPjN+IRUbUSi0OeKel9c3a4k+b7Kq2SZhlouIp2DCUj4Ozr3W3aHJW5zCt2LoQodVL2RjMWA10qfXDQtvzNmQM9P5PwjpTrGcpn14qk/J37Rb5+TP5DOqJsy63kAspaw2lOiKl/MM4HtQjQt4XaXdGmkgWzssAWFvxDRucExvofkRPD2HZ/Zs4Acj5SLz03I195VIkqLzvlPSIzfHL3qoOG+ukSMEWc3RpOCE= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(1800799024)(366016)(38070700021)(22082099003)(18002099003)(4143699003)(11063799006)(56012099006)(6133799003)(55112099003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?N25uSGV0NyswRFE1bXYyb3NQMi9FbHowZVVkSTBBbFFCcWxCaUp2SFVUSGZM?= =?utf-8?B?Z2grclV3ald2UGx2SmNiemRtOFNFV1pHdFhUNlpCTHYxd2JiU3l2VkdHTjBt?= =?utf-8?B?WWhwemg0eHZxN0dEOFF3YkFZK2dqODZpNUgzd093RThuanZ3d2FqMStzSk5n?= =?utf-8?B?V1hwMFkrR2hhUmhtR250cGY0R0x5ZkxpTHdTZ0YyTXJycjVLSFI2UUsxamk5?= =?utf-8?B?UWlQLzVwTjVhbGVlVjBkeGRqWStIYWZxR0VtTHJwRGppaExTOXVqd1gzUDk0?= =?utf-8?B?VDl4SFE4MEpnWkRHTFkxZW9wc2tkZUFwY051cG5lNUJvbytZQnRnWFkvcGdM?= =?utf-8?B?cjBlZU1zUjJCdlBHTjNCQmw0c0tjdDhZNEczOHowZzA1aVNQNHdVM0srOFFu?= =?utf-8?B?c05EclpEVWdLV0pCU3hjNGk2WDNrWWFFUWQvOXJWTmZpNUJoeDdveXJwNzAz?= =?utf-8?B?Q0lDNUgwVm9QMDk3T053KzAxbStrMnFPM2IyNFIxbmI4aHBKVCtubHlzeTEv?= =?utf-8?B?dWdJYURUYkNoeE11aXZ6U1FtMUJMMW5XaXNjRDlDRDhya3JMcklqZHpBaERE?= =?utf-8?B?bEZTVGZCSzdmWWFjL0xIVklQT0RVMkhXL2I3MTBGbWxOT2ZmT2VQNDRYcnQx?= =?utf-8?B?Mm9ZblN2SUpkQ080Y29MeVorZU5MdG5vKzM1cGpMUjQwMkI1UzlLU1Q4blpK?= =?utf-8?B?MUJrcTdSWmJOQVZWb0szNzBwQWZRbUlYYWpkOWNxY2hENzNqdjBzUmpFWEt3?= =?utf-8?B?b0ROQXJFc3ViMFRWYlhEZkk5Q2hoS3ltT1VMWXlpeU8wVmhsU3kzb29Wd004?= =?utf-8?B?Rm9KQnFnVHBCK01UbXc0QkFlNXdwcGg3Zkd6U3JvSTdVMEt3OWNGSThyQUU0?= =?utf-8?B?NmhjazcrdjVxeWpDTUhHMjZrdjJ4YVR6dDBoODVFUmlEU3kwbW5TY1NVa0du?= =?utf-8?B?cjJtaHhGVy92L2JaWlp6YjljS25XT1BUalh1cS9wblVrWkVFUnNiMVFVM0R1?= =?utf-8?B?WnlIbk5hcGd5WTlyeEJlNVJWVytPa283UHVDV2NqSmxlYlAzNHJJMHFicEJm?= =?utf-8?B?ZlJwaC9CUURsZ2twc1BFdXV2Nm1JOURjTlhVQUlRRHlEZzRqQkxvNlV5SkVC?= =?utf-8?B?MUVGKzRZY1l3a0VLa2Z6cm0zZFZXc20yMlJDNE5tLzNLVUQwcTFkTjJsTmZv?= =?utf-8?B?Q2o5K2krT01Gc0pxVGVIaUF6WS9YZmFwdllKejV6TktHTTRSUUVpbGJuWThP?= =?utf-8?B?Y3RzUVltdm1vNm9oZGdLSTlzdUNOMHl4MURBaXdCSWJvc0dkd3BuYjA1VWZD?= =?utf-8?B?S0gxVjhEWWQvUk9HWkM0dVpjMkZLREh6M202eHlvK1VCdDJVWHpPMWZwY3Vq?= =?utf-8?B?TktvWTJXeDB3ZmRGUm5lcnZ3UXFoZUlMcWgxYjBSS0V0a0xDQmNja0hJL0Yz?= =?utf-8?B?ZE0zWFhMVXhBNWs1OTVuZXpJVFprTExYSjR2NzFPbFJmR2UxSGtWMFQwYTJq?= =?utf-8?B?UmsrYlRxdmVaSnpmTm9jTU9HRzZEeTE3dHpiTWRmR05ZRHRyYzFrNnVPTmFD?= =?utf-8?B?c1RjMGV1c1p3QmgxKzRoR1NuSHhVc05FUWpVR09NQ3FlVndodkZJS1BkUmxO?= =?utf-8?B?R0t0UVVuUEJKTTlzL014U0Q0ckdTMU96VjN0NGx2dmExbUhMRERadloyYlA1?= =?utf-8?B?Q0dhL1VpR0J4eFlUK0R5MCtuT1phMjBJMVBRZW55L3I4OEd1SUxrWDdzampy?= =?utf-8?B?djY4aCt3bHJoVEgzcDEvaWRsK21leDZSQTFhWDNmSkhFZ0pDN2ZhR25WaDJ1?= =?utf-8?B?WDkrSFVIWjRhZElBeWFqcDNpeGxrM3M0WGJzaFdydEtqRkl2aHFaV3JQeGJZ?= =?utf-8?B?SERBb01iYXUwb25nVmJiaFZkZVNtQ3N6UFZWbTh0d2xsMCtQTmd2WG1qN3Ri?= =?utf-8?B?ZGZNNTZGTEIzNnB2NUJ1MzAvdk1BNGdvcUY2Z3lSblh4L1dtR05ra0ZtU01P?= =?utf-8?B?VFh4RVdGVVFBQjhGTnBEWkx6WEgzd1ZGamhHd01UaE9OdUZVaGdNa2xjSkdJ?= =?utf-8?B?NW1UUGR3VW1WeWV5ZzFIcDJQQWdzcUJEajdRTy9XbmJsZ0x5azhnRzNTOEZW?= =?utf-8?B?ME9kVTNscnBvaUszUE1rYnJuNU5ZS080TTFuTzF1YWUvd2JGZHZRVG04RXJE?= =?utf-8?B?VzhESFpKQWVXRks4dXB5K2NwMGhnR2E2cW1ETnVOQTRJMzhVTXd5M3puM0pj?= =?utf-8?B?SEtSTEdRRnlGUUR2cTk2aXdoZGc0ZlhoOWZRSHlvUWtIKzVKbkNiRHNtaDFx?= =?utf-8?B?N0lUZXpaQlJ1aGw3WjNuYTV5Q21Wemh3Z1p6eXk4WnZVRXJpYkVEQT09?= Content-Type: text/plain; charset="UTF-8" Content-ID: MIME-Version: 1.0 X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 4313eb9f-6b95-4056-75f8-08ded912d5bc X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Jul 2026 14:53:25.1288 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: DhVuoMMJMUAeTdZOtwS42rpWJU5GL1dWB7yFdd8MGrmLtZIhv/BdNkX9QNiE+mjBCn73+w/L/uATJ/FtMvjvaG6L0FHYndqXck1vZvTqKG4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS4PR10MB5623 X-Original-Sender: felix.moessbauer@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b="lTaF4t7/"; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::3 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: "MOESSBAUER, Felix" Reply-To: "MOESSBAUER, Felix" Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2,RCVD_IN_RP_CERTIFIED, RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: 2JKRVz6YSnL8 On Thu, 2026-06-25 at 17:36 +0200, Felix Moessbauer wrote: > Currently isar requires passwordless sudo and an environment > where mounting file systems is possible. This has proven problematic > for security reasons, both when running in a privileged container or > locally. > > To solve this, we implement fully rootless builds that rely on the > unshare syscall which allows us to avoid sudo and instead operate in > temporary kernel namespaces as a user that is just privileged within > that namespace. This comes with some challenges regarding the handling > of mounts (they are cleared when leaving the namespace), as well as > cross namespace deployments (the outer user might not be able to access > the inner data). For that, we rework the handling of mounts and artifact > passing to make it compatible with both chroot modes (schroot and > unshare). > > We intentionally do not switch the build_system in isar.yaml resp. the > KAS_BUILD_SYSTEM in the menu KConfig, as there is no kas release with > support for the new modes as of today. We further don't want to break > backward compatibility with older kas versions of the isar examples. > > Signed-off-by: Felix Moessbauer > --- > RECIPE-API-CHANGELOG.md | 20 +++++ > doc/user_manual.md | 2 + > meta/classes-global/base.bbclass | 86 ++++++++++++++++++- > meta/classes-recipe/deb-dl-dir.bbclass | 7 +- > meta/classes-recipe/dpkg-base.bbclass | 22 ++++- > meta/classes-recipe/dpkg.bbclass | 17 ++-- > .../image-locales-extension.bbclass | 9 +- > .../image-tools-extension.bbclass | 84 ++++++++++++++++++ > meta/classes-recipe/image.bbclass | 7 +- > .../imagetypes_container.bbclass | 4 +- > meta/classes-recipe/imagetypes_wic.bbclass | 6 +- > meta/classes-recipe/rootfs.bbclass | 45 ++++++++-- > meta/classes-recipe/sbuild.bbclass | 24 +++++- > meta/classes-recipe/sdk.bbclass | 10 ++- > meta/conf/bitbake.conf | 7 +- > .../isar-mmdebstrap/isar-mmdebstrap.inc | 18 ++-- > .../sbuild-chroot/sbuild-chroot.inc | 24 +++++- > 17 files changed, 354 insertions(+), 38 deletions(-) > [snip] > > ROOTFS_INSTALL_COMMAND += "rootfs_install_resolvconf" > @@ -368,8 +388,13 @@ rootfs_install_pkgs_install[weight] = "8000" > rootfs_install_pkgs_install[progress] = "custom:rootfs_progress.PkgsInstallProgressHandler" > rootfs_install_pkgs_install[network] = "${TASK_USE_SUDO}" > rootfs_install_pkgs_install() { > - run_in_chroot "${ROOTFSDIR}" \ > + run_privileged_heredoc <<'EOF' > + set -e > + ${@insert_isar_mounts(d, d.getVar('ROOTFSDIR'), d.getVar('ROOTFS_MOUNTS')) if d.getVar('ISAR_CHROOT_MODE') == 'unshare' else ''} > + find ${ROOTFSDIR}/isar-apt ^ This is a debugging leftover. Will be removed on next iteration. Are there any further findings I should fix before sending? Best regards, Felix -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/99b3c876bd27c5f7b2c895e3eb7a4e42bf7940e5.camel%40siemens.com.