From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Thu, 25 Jun 2026 08:05:50 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-qv1-f62.google.com (mail-qv1-f62.google.com [209.85.219.62]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 65P65lQ3001703 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 25 Jun 2026 08:05:48 +0200 Received: by mail-qv1-f62.google.com with SMTP id 6a1803df08f44-8db6a7471basf36382326d6.0 for ; Wed, 24 Jun 2026 23:05:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1782367542; x=1782972342; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-sender:mime-version :subject:references:in-reply-to:message-id:to:from:date:sender:from :to:cc:subject:date:message-id:reply-to; bh=DduRVxa9WPP9zkscxg4EAXEEr+xlI1RsFqFtPmGZqj0=; b=S2vZ1hmR697WcDxKj2Fz2LDLU+VUxStieXTswjr2MuOeIyXdGLlWVFWyFCBuvapF/3 iFNigrP9iGSAxWWys9ENMp4Y1KtjZ5zQHg62THbcWquYBBw0sG8/rm6a8nPDwecHSAhM TbxZ9PdKd5x3VKcOBmzacRMX8g21DkccXYI2bTUE+FkgLo+nkcL/WAWhjXbIk+Jmxm/7 B1QOrsYisUhYoFiCyCcKKbUXtrQjHIn8SBFPzOFBxUkSNf8xVdisadRzs9ZUWgFGFd4h K+AtqD58fpilCExRuudwOj8KXALAd2WzLlKszLXtYvYzHFEKC/k8M0hs1AU18E4D1x2n sX4A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782367542; x=1782972342; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-sender:mime-version :subject:references:in-reply-to:message-id:to:from:date:from:to:cc :subject:date:message-id:reply-to; bh=DduRVxa9WPP9zkscxg4EAXEEr+xlI1RsFqFtPmGZqj0=; b=pB7oA6XQuj+ENHTzB7I5L1PQne1yPogiosNLey6Y4Kp6r/cNdRI/WTzz/YB0AmeaIb ODY28g25kJgcwVK+YI/yqeegKI4zT/86+AxniWgVzvuHetLeERO4ndkgXcJquDPsyAUP BcL/SpVMN3h76AUuN2opDQqlPMCv65Nu6UVvAR+fM1FTeHg0RNHRD6ujTKsfMVYpkr5V e6hn7gzNrMpNnAylocsKmqi6BRFmybW0d95muIgeWIIYlb/susj8RdeVYNxn7lpnBXCy 7sXrlljCo7vRuZK8QnVPzrhxnKiNe1c34aER46sjzuEd1jXX7+9lAUw7i5otm37zza4m +oUA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782367542; x=1782972342; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :x-original-sender:mime-version:subject:references:in-reply-to :message-id:to:from:date:x-beenthere:x-gm-message-state:sender:from :to:cc:subject:date:message-id:reply-to; bh=DduRVxa9WPP9zkscxg4EAXEEr+xlI1RsFqFtPmGZqj0=; b=B1Q9xGOsst3I2/xPpRzbaRcgmQ79eGC6TowgjjKHzv6xbi6Oc6XNpVk3RaFGKpAzI+ KEcc6Cswb7GxCCsD3CacS9FfAObYy0dtni09hSJcmorGFIDqrvUF9obmGNtbTjYOD03X EwVCQLi4Pm/ggXrX4avUqh7LAGlZI53MrVp2EYvsluHH2F/1obrn8ixszisqrmJsorpC waoOO/nBNBiqIN4bNxuQRUGI7kIVqv5FHIV7K7mjjPwr4+hrNJ8naeAdPci6XVbQUOl/ a5hyLAEwrhhylpWh2ccYwpW0o06dsdzUs6jYFhJD3KtCWknNOZAUbGePfRvYkKDLZFd4 8L5A== Sender: isar-users@googlegroups.com X-Forwarded-Encrypted: i=1; AFNElJ+k5I1m+5d2znSXAH6GA+kyDAWl4vd8ZJSOGTGHLihRwJSxzrc/CTItM5kQ3aD94t/bkrVs@ilbers.de X-Gm-Message-State: AOJu0YzcMCN4wFMAo5H+WTXrUfkTi/1WnFxhbmTvLBTivSmbYKBan0yS HlJFshwdRzydN2HqxUaL/EhI7ANM8r19KLdeB3a0NsiygUmEaLEG89Ro X-Received: by 2002:ac8:5f85:0:b0:517:83e5:7859 with SMTP id d75a77b69052e-51a72a8d81fmr13827261cf.53.1782367541972; Wed, 24 Jun 2026 23:05:41 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="AX0PUUebhyu6bzAkwJGKiP3tXERmaA6VW1uOb4+XINJCmlNOZw==" Received: by 2002:a05:6214:1c4b:b0:8c7:2c9d:13b with SMTP id 6a1803df08f44-8dcdfc1cee6ls76717706d6.2.-pod-prod-03-us; Wed, 24 Jun 2026 23:05:40 -0700 (PDT) X-Received: by 2002:a05:620a:1713:b0:911:9e67:44cb with SMTP id af79cd13be357-9293cae69e7mr139468585a.38.1782367540473; Wed, 24 Jun 2026 23:05:40 -0700 (PDT) Date: Wed, 24 Jun 2026 23:05:39 -0700 (PDT) From: Srinuvasan Arjunan To: isar-users Message-Id: In-Reply-To: <20260625060100.121265-1-srinuvasan.a@siemens.com> References: <20260625060100.121265-1-srinuvasan.a@siemens.com> Subject: Re: [PATCH] Update kas-container to 5.4 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_88716_726348700.1782367539621" X-Original-Sender: srinuvasanasv@gmail.com Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-3.7 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DKIM_VALID_EF,FORGED_GMAIL_RCVD, FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS, HTML_MESSAGE,MAILING_LIST_MULTI,RCVD_IN_DNSWL_BLOCKED, RCVD_IN_MSPIKE_H2,RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE, SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: kXGWuATZIjFp ------=_Part_88716_726348700.1782367539621 Content-Type: multipart/alternative; boundary="----=_Part_88717_2054454135.1782367539621" ------=_Part_88717_2054454135.1782367539621 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thursday, June 25, 2026 at 11:31:23=E2=80=AFAM UTC+5:30 srinuv...@siemen= s.com=20 wrote: From: Srinuvasan A =20 Update kas-container to 5.4 to bring support for=20 the Isar rootless build system and incorporate various=20 fixes and improvements.=20 Signed-off-by: Srinuvasan A =20 ---=20 kas/kas-container | 300 +++++++++++++++++++++++++---------------------=20 1 file changed, 161 insertions(+), 139 deletions(-)=20 diff --git a/kas/kas-container b/kas/kas-container=20 index 993f0bb8..631e40c3 100755=20 --- a/kas/kas-container=20 +++ b/kas/kas-container=20 @@ -27,7 +27,7 @@=20 set -e=20 -KAS_CONTAINER_SCRIPT_VERSION=3D"5.2"=20 +KAS_CONTAINER_SCRIPT_VERSION=3D"5.4"=20 KAS_IMAGE_VERSION_DEFAULT=3D"${KAS_CONTAINER_SCRIPT_VERSION}"=20 KAS_CONTAINER_IMAGE_DISTRO_DEFAULT=3D""=20 KAS_CONTAINER_IMAGE_PATH_DEFAULT=3D"ghcr.io/siemens/kas"=20 @@ -49,9 +49,10 @@ usage()=20 printf "%b" "\nPositional arguments:\n"=20 printf "%b" "build\t\t\tCheck out repositories and build target.\n"=20 printf "%b" "checkout\t\tCheck out repositories but do not build.\n"=20 + printf "%b" "diff\t\t\tCompare two kas configurations.\n"=20 printf "%b" "dump\t\t\tCheck out repositories and write flat version\n"=20 printf "%b" " \t\t\tof config to stdout.\n"=20 - printf "%b" "lock\t\t\tCreate and update kas project lockfiles\n"=20 + printf "%b" "lock\t\t\tCreate and update kas project lockfiles.\n"=20 printf "%b" "shell\t\t\tRun a shell in the build environment.\n"=20 printf "%b" "for-all-repos\t\tRun specified command in each repository.\n"= =20 printf "%b" "clean\t\t\tClean build artifacts, keep sstate cache and " \=20 @@ -61,20 +62,19 @@ usage()=20 printf "%b" "cleanall\t\tClean build artifacts, sstate cache and " \=20 "downloads.\n"=20 printf "%b" "purge\t\t\tRemove all data managed by kas. Run with=20 '--dry-run'\n"=20 - printf "%b" " \t\t\tto check what would be removed\n"=20 + printf "%b" " \t\t\tto check what would be removed.\n"=20 printf "%b" "menu\t\t\tProvide configuration menu and trigger " \=20 "configured build.\n"=20 printf "%b" "\nOptional arguments:\n"=20 - printf "%b" "--isar\t\t\tUse kas-isar container to build Isar image. To= =20 force\n"=20 - printf "%b" " \t\t\tthe use of run0 over sudo, set KAS_SUDO_CMD=3Drun0.\n= "=20 - printf "%b" "--with-loop-dev Pass a loop device to the " \=20 - "container. Only required if\n"=20 - printf "%b" "\t\t\tloop-mounting is used by recipes.\n"=20 + printf "%b" "--isar-privileged\tRun an Isar build in privileged mode. " \= =20 + "To force the use\n"=20 + printf "%b" "\t\t\tof run0 over sudo, set KAS_SUDO_CMD=3Drun0.\n"=20 + printf "%b" "--isar-rootless\t\tRun an Isar build in rootless mode.\n"=20 printf "%b" "--runtime-args\t\tAdditional arguments to pass to the " \=20 - "container runtime\n"=20 + "container runtime.\n"=20 printf "%b" "\t\t\tfor running the build.\n"=20 printf "%b" "-l, --log-level\t\tSet log level (default=3Dinfo).\n"=20 - printf "%b" "--version\t\tprint program version.\n"=20 + printf "%b" "--version\t\tPrint program version.\n"=20 printf "%b" "--ssh-dir\t\tDirectory containing SSH configurations.\n"=20 printf "%b" "\t\t\tAvoid \$HOME/.ssh unless you fully trust the " \=20 "container.\n"=20 @@ -83,13 +83,15 @@ usage()=20 printf "%b" "\t\t\tAvoid \$HOME/.aws unless you fully trust the " \=20 "container.\n"=20 printf "%b" "--git-credential-store\tFile path to the git credential " \=20 - "store\n"=20 + "store.\n"=20 + printf "%b" "--git-credential-socket\tPath to the git credential cache "= =20 \=20 + "socket.\n"=20 printf "%b" "--no-proxy-from-env\tDo not inherit proxy settings from " \=20 "environment.\n"=20 printf "%b" "--repo-ro\t\tMount current repository read-only\n" \=20 - "\t\t\t(default for build command)\n"=20 + "\t\t\t(default for build command).\n"=20 printf "%b" "--repo-rw\t\tMount current repository writable\n" \=20 - "\t\t\t(default for shell command)\n"=20 + "\t\t\t(default for shell command).\n"=20 printf "%b" "-h, --help\t\tShow this help message and exit.\n"=20 printf "%b" "\n"=20 printf "%b" "You can force the use of podman over docker using " \=20 @@ -143,11 +145,6 @@ prepare_sudo_cmd()=20 enable_isar_mode()=20 {=20 - if [ -n "${ISAR_MODE}" ]; then=20 - return=20 - fi=20 - ISAR_MODE=3D1=20 -=20 KAS_CONTAINER_IMAGE_NAME_DEFAULT=3D"kas-isar"=20 KAS_ISAR_ARGS=3D"--privileged"=20 @@ -159,14 +156,38 @@ enable_isar_mode()=20 export PATH=3D"${PATH}:/usr/sbin"=20 elif [ "${KAS_DOCKER_ROOTLESS}" =3D "1" ]; then=20 prepare_sudo_cmd=20 - export DOCKER_HOST=3D"${DOCKER_HOST:-unix:///var/run/docker.sock}"=20 - debug "kas-isar does not support rootless docker. Using system docker"=20 + DOCKER_HOST_DEFAULT=3D"$(docker context inspect default --format=20 '{{.Endpoints.docker.Host}}')"=20 + export DOCKER_HOST=3D"${DOCKER_HOST:-$DOCKER_HOST_DEFAULT}"=20 + debug "kas-isar does not support rootless docker. Using system docker in= =20 $DOCKER_HOST"=20 # force use of well-known system docker socket=20 KAS_CONTAINER_COMMAND=3D"${_KAS_SUDO_CMD} ${KAS_CONTAINER_COMMAND}"=20 KAS_DOCKER_ROOTLESS=3D0=20 fi=20 }=20 +enable_isar_rootless_mode()=20 +{=20 + KAS_CONTAINER_IMAGE_NAME_DEFAULT=3D"kas-isar"=20 +=20 + # Use --privileged to pass the ambient capabilities into the container.= =20 + # When calling from the user session (podman or docker-rootless), this=20 + # is fundamentally different from the system docker run --privileged=20 + if [ "${KAS_CONTAINER_ENGINE}" =3D "podman" ]; then=20 + KAS_RUNTIME_ARGS=3D"${KAS_RUNTIME_ARGS} --userns=3Dkeep-id --privileged"= =20 + elif [ "${KAS_DOCKER_ROOTLESS}" =3D "1" ]; then=20 + KAS_ISAR_ARGS=3D"--privileged"=20 + else=20 + # we don't need --privileged, but we need to run with SYS_ADMIN=20 + # to be able to unshare.=20 + KAS_ISAR_ARGS=3D" \=20 + --security-opt seccomp=3Dunconfined \=20 + --security-opt apparmor=3Dunconfined \=20 + --security-opt systempaths=3Dunconfined \=20 + --cap-add=3DSYS_ADMIN \=20 + "=20 + fi=20 +}=20 +=20 enable_oe_mode()=20 {=20 if [ "${KAS_CONTAINER_ENGINE}" =3D "podman" ]; then=20 @@ -174,6 +195,7 @@ enable_oe_mode()=20 # calling "podman run" has a 1:1 mapping=20 KAS_RUNTIME_ARGS=3D"${KAS_RUNTIME_ARGS} --userns=3Dkeep-id"=20 fi=20 + BUILD_SYSTEM=3D"openembedded"=20 }=20 enable_unpriv_userns_docker()=20 @@ -210,6 +232,19 @@ check_and_expand()=20 realpath -e "$_varval"=20 }=20 +# SC2034: DIR appears unused (ignore, as they are used inside eval)=20 +# shellcheck disable=3D2034=20 +setup_kas_dirs()=20 +{=20 + KAS_WORK_DIR=3D"${KAS_WORK_DIR:-$(pwd)}"=20 + KAS_WORK_DIR=3D"$(check_and_expand KAS_WORK_DIR required)"=20 + KAS_BUILD_DIR=3D"$(check_and_expand KAS_BUILD_DIR create)"=20 + KAS_REPO_REF_DIR=3D"$(check_and_expand KAS_REPO_REF_DIR required)"=20 + DL_DIR=3D"$(check_and_expand DL_DIR createrec)"=20 + SSTATE_DIR=3D"$(check_and_expand SSTATE_DIR createrec)"=20 + KAS_BUILDTOOLS_DIR=3D"$(check_and_expand KAS_BUILDTOOLS_DIR createrec)"= =20 +}=20 +=20 # Params: FILE=20 # Returns: root repo dir of file=20 repo_path_of_file()=20 @@ -260,14 +295,6 @@ forward_dir()=20 fi=20 }=20 -check_docker_rootless()=20 -{=20 - KAS_DOCKER_ROOTLESS=3D0=20 - if [ "$(docker context show)" =3D "rootless" ]; then=20 - KAS_DOCKER_ROOTLESS=3D1=20 - fi=20 -}=20 -=20 enable_docker_rootless()=20 {=20 warning "Rootless docker used, only limited functionality available."=20 @@ -281,118 +308,44 @@ enable_docker_rootless()=20 KAS_RUNTIME_ARGS=3D"${KAS_RUNTIME_ARGS} -e KAS_DOCKER_ROOTLESS=3D1"=20 }=20 -KAS_GIT_OVERLAY_FILE=3D""=20 -kas_container_cleanup()=20 -{=20 - if [ -f "${KAS_GIT_OVERLAY_FILE}" ]; then=20 - trace rm -f "${KAS_GIT_OVERLAY_FILE}"=20 - fi=20 -}=20 -trap kas_container_cleanup EXIT INT TERM=20 -=20 set_container_image_var()=20 {=20 + # if the image is explicitly set, use that=20 + if [ -n "${KAS_CONTAINER_IMAGE}" ]; then=20 + return=20 + fi=20 KAS_IMAGE_VERSION=3D"${KAS_IMAGE_VERSION:-${KAS_IMAGE_VERSION_DEFAULT}}"=20 KAS_CONTAINER_IMAGE_DISTRO=3D"${KAS_CONTAINER_IMAGE_DISTRO:-${KAS_CONTAINER= _IMAGE_DISTRO_DEFAULT}}"=20 KAS_CONTAINER_IMAGE_NAME=3D"${KAS_CONTAINER_IMAGE_NAME:-${KAS_CONTAINER_IMA= GE_NAME_DEFAULT}}"=20 KAS_CONTAINER_IMAGE_PATH=3D"${KAS_CONTAINER_IMAGE_PATH:-${KAS_CONTAINER_IMA= GE_PATH_DEFAULT}}"=20 -=20 KAS_CONTAINER_IMAGE_DEFAULT=3D"${KAS_CONTAINER_IMAGE_PATH}/${KAS_CONTAINER_= IMAGE_NAME}:${KAS_IMAGE_VERSION}"=20 -=20 KAS_CONTAINER_IMAGE=3D"${KAS_CONTAINER_IMAGE:-${KAS_CONTAINER_IMAGE_DEFAULT= }}"=20 +=20 KAS_CONTAINER_IMAGE=3D"${KAS_CONTAINER_IMAGE_PATH}/${KAS_CONTAINER_IMAGE_NA= ME}:${KAS_IMAGE_VERSION}"=20 if [ -n "${KAS_CONTAINER_IMAGE_DISTRO}" ]; then=20 KAS_CONTAINER_IMAGE=3D"${KAS_CONTAINER_IMAGE}-${KAS_CONTAINER_IMAGE_DISTRO}= "=20 fi=20 }=20 -# SC2034: DIR appears unused (ignore, as they are used inside eval)=20 -# shellcheck disable=3D2034=20 -setup_kas_dirs()=20 -{=20 - KAS_WORK_DIR=3D"${KAS_WORK_DIR:-$(pwd)}"=20 - KAS_WORK_DIR=3D"$(check_and_expand KAS_WORK_DIR required)"=20 - KAS_BUILD_DIR=3D"$(check_and_expand KAS_BUILD_DIR create)"=20 - KAS_REPO_REF_DIR=3D"$(check_and_expand KAS_REPO_REF_DIR required)"=20 - DL_DIR=3D"$(check_and_expand DL_DIR createrec)"=20 - SSTATE_DIR=3D"$(check_and_expand SSTATE_DIR createrec)"=20 - KAS_BUILDTOOLS_DIR=3D"$(check_and_expand KAS_BUILDTOOLS_DIR createrec)"= =20 -}=20 -setup_kas_dirs=20 -=20 -KAS_CONTAINER_ENGINE=3D"${KAS_CONTAINER_ENGINE:-${KAS_DOCKER_ENGINE}}"=20 -if [ -z "${KAS_CONTAINER_ENGINE}" ]; then=20 - # Try to auto-detect a container engine=20 - if command -v docker >/dev/null; then=20 - case $(docker -v 2>/dev/null) in=20 - podman*)=20 - # The docker command is an alias for podman=20 - KAS_CONTAINER_ENGINE=3Dpodman=20 - ;;=20 - Docker*)=20 - # The docker command is the real docker=20 - KAS_CONTAINER_ENGINE=3Ddocker=20 - ;;=20 - *)=20 - # The docker command is an unknown engine=20 - fatal_error "docker command found, but unknown engine detected"=20 - esac=20 - elif command -v podman >/dev/null; then=20 - KAS_CONTAINER_ENGINE=3Dpodman=20 - else=20 - fatal_error "no container engine found, need docker or podman"=20 - fi=20 -fi=20 -=20 -KAS_RUNTIME_ARGS=3D"--log-driver=3Dnone --user=3Droot"=20 -=20 -case "${KAS_CONTAINER_ENGINE}" in=20 -docker)=20 - KAS_CONTAINER_COMMAND=3D"docker"=20 - enable_unpriv_userns_docker=20 - check_docker_rootless=20 - ;;=20 -podman)=20 - KAS_CONTAINER_COMMAND=3D"podman"=20 - KAS_RUNTIME_ARGS=3D"${KAS_RUNTIME_ARGS} --security-opt label=3Ddisable"= =20 - ;;=20 -*)=20 - fatal_error "unknown container engine '${KAS_CONTAINER_ENGINE}'"=20 - ;;=20 -esac=20 -=20 -# parse kas-container options=20 +# parse kas-container options, leave build system empty to distinguish=20 between=20 +# explicitly set via flag and implicitly via config.=20 +BUILD_SYSTEM=3D""=20 +KAS_OPTIONS_DIRECT=3D""=20 +KAS_EXTRA_RUNTIME_ARGS=3D""=20 while [ $# -gt 0 ]; do=20 case "$1" in=20 - --isar)=20 - enable_isar_mode=20 + --isar | --isar-privileged)=20 + if [ "$1" =3D "--isar" ]; then=20 + warning "The semantic of '--isar' might change in the" \=20 + "future. Please use '--isar-privileged' instead."=20 + fi=20 + BUILD_SYSTEM=3D"isar-privileged"=20 shift 1=20 ;;=20 - --with-loop-dev)=20 - if ! KAS_LOOP_DEV=3D$(/sbin/losetup -f 2>/dev/null); then=20 - if [ "$(id -u)" -eq 0 ]; then=20 - fatal_error "loop device not available!"=20 - fi=20 - prepare_sudo_cmd=20 - if ! [ "$KAS_SUDO_CMD" =3D "sudo" ]; then=20 - fatal_error '--with-loop-dev requires sudo for device setup.'=20 - fi=20 - sudo_command=3D"/sbin/losetup -f"=20 - sudo_message=3D"[sudo] enter password to setup loop"=20 - sudo_message=3D"$sudo_message devices by calling"=20 - sudo_message=3D"$sudo_message '$sudo_command': "=20 - # SC2086: Double quote to prevent globbing and word splitting.=20 - # shellcheck disable=3D2086=20 - if ! KAS_LOOP_DEV=3D$(sudo -p "$sudo_message" $sudo_command \=20 - 2>/dev/null); then=20 - fatal_error "loop device setup unsuccessful!" \=20 - "try calling '$sudo_command' with root" \=20 - "permissions manually."=20 - fi=20 - fi=20 - KAS_WITH_LOOP_DEV=3D"--device ${KAS_LOOP_DEV}"=20 + --isar-rootless)=20 + BUILD_SYSTEM=3D"isar-rootless"=20 shift 1=20 ;;=20 - --runtime-args|--docker-args)=20 + --runtime-args | --docker-args)=20 [ $# -gt 0 ] || usage=20 - KAS_RUNTIME_ARGS=3D"${KAS_RUNTIME_ARGS} $2"=20 + KAS_EXTRA_RUNTIME_ARGS=3D" $2"=20 shift 2=20 ;;=20 --ssh-dir)=20 @@ -417,6 +370,13 @@ while [ $# -gt 0 ]; do=20 KAS_GIT_CREDENTIAL_STORE=3D"$2"=20 shift 2=20 ;;=20 +=20 + --git-credential-socket)=20 + [ $# -gt 2 ] || usage=20 + KAS_GIT_CREDENTIAL_SOCKET=3D"$2"=20 + shift 2=20 + ;;=20 +=20 --no-proxy-from-env)=20 KAS_NO_PROXY_FROM_ENV=3D1=20 shift 1=20 @@ -446,19 +406,19 @@ while [ $# -gt 0 ]; do=20 --*)=20 usage=20 ;;=20 - clean|cleansstate|cleanall|purge)=20 + clean | cleansstate | cleanall | purge)=20 KAS_REPO_MOUNT_OPT_DEFAULT=3D"ro"=20 KAS_CMD=3D$1=20 shift 1=20 break=20 ;;=20 - shell|lock)=20 + shell | lock)=20 KAS_REPO_MOUNT_OPT_DEFAULT=3D"rw"=20 KAS_CMD=3D$1=20 shift 1=20 break=20 ;;=20 - build|checkout|for-all-repos|menu)=20 + build | checkout | for-all-repos | menu)=20 KAS_REPO_MOUNT_OPT_DEFAULT=3D"ro"=20 KAS_CMD=3D$1=20 shift 1=20 @@ -486,6 +446,10 @@ while [ $# -gt 0 ]; do=20 esac=20 done=20 +KAS_RUNTIME_ARGS=3D"--log-driver=3Dnone --user=3Droot"=20 +=20 +setup_kas_dirs=20 +=20 [ -n "${KAS_CMD}" ] || usage=20 KAS_EXTRA_BITBAKE_ARGS=3D0=20 @@ -494,17 +458,17 @@ KAS_FILES=3D=20 # parse kas sub-command options=20 while [ $# -gt 0 ] && [ $KAS_EXTRA_BITBAKE_ARGS -eq 0 ]; do=20 case "$1" in=20 - --format|--indent|--provenance|--skip|--target|--task)=20 + --format | --indent | --provenance | --skip | --target | --task)=20 KAS_OPTIONS=3D"${KAS_OPTIONS} $1 $2"=20 shift 1=20 shift 1 || KAS_OPTIONS=3D"--help"=20 ;;=20 - -c|--cmd|--command)=20 + -c | --cmd | --command)=20 KAS_BITBAKE_C_OPTION_ARGS=3D"$2"=20 shift 1=20 shift 1 || KAS_OPTIONS=3D"--help"=20 ;;=20 - -E|--preserve-env)=20 + -E | --preserve-env)=20 fatal_error "$1 is not supported with ${KAS_CONTAINER_SELF_NAME}"=20 ;;=20 --)=20 @@ -563,10 +527,10 @@ if [ "${KAS_CMD}" =3D "menu" ]; then=20 if [ "$(echo "${KAS_FIRST_FILES}" | wc -w)" -ne "1" ]; then=20 fatal_error "menu plugin only supports a single Kconfig file"=20 fi=20 - BUILD_SYSTEM=3D$(tr '\n' '\f' 2>/dev/null < "${KAS_FIRST_FILES}" | \=20 + BUILD_SYSTEM=3D${BUILD_SYSTEM:-$(tr '\n' '\f' 2>/dev/null <=20 "${KAS_FIRST_FILES}" |=20 sed -e 's/\(.*\fconfig KAS_BUILD_SYSTEM\f\(.*\)\|.*\)/\2/' \=20 -e 's/\f\([[:alpha:]].*\|$\)//' \=20 - -e 's/.*default \"\(.*\)\".*/\1/')=20 + -e 's/.*default \"\(.*\)\".*/\1/')}=20 else=20 if [ -z "${KAS_FIRST_FILES}" ]; then=20 KAS_FIRST_FILES=3D"${KAS_WORK_DIR}/.config.yaml"=20 @@ -574,20 +538,60 @@ else=20 # We only get the first build system and let kas check if mixed=20 _KAS_FIRST_FILE=3D$(echo "${KAS_FIRST_FILES}" | awk '{print $1}')=20 - BUILD_SYSTEM=3D$(grep -e "^build_system: " "${_KAS_FIRST_FILE}" 2>/dev/nu= ll=20 | \=20 - sed 's/build_system:[ ]\+//')=20 + BUILD_SYSTEM=3D${BUILD_SYSTEM:-$(grep -e "^build_system: "=20 "${_KAS_FIRST_FILE}" 2>/dev/null |=20 + sed 's/build_system:[ ]\+//')}=20 +fi=20 +=20 +KAS_CONTAINER_ENGINE=3D"${KAS_CONTAINER_ENGINE:-${KAS_DOCKER_ENGINE}}"=20 +if [ -z "${KAS_CONTAINER_ENGINE}" ]; then=20 + # Try to auto-detect a container engine=20 + # Defaults if there are multiple options:=20 + # podman if build system is isar-rootless, docker otherwise=20 + if [ "${BUILD_SYSTEM}" =3D "isar-rootless" ] && command -v podman=20 >/dev/null 2>&1; then=20 + KAS_CONTAINER_ENGINE=3Dpodman=20 + elif command -v docker >/dev/null 2>&1 && docker -v 2>/dev/null | grep -q= =20 '^Docker'; then=20 + KAS_CONTAINER_ENGINE=3Ddocker=20 + elif command -v podman >/dev/null 2>&1; then=20 + KAS_CONTAINER_ENGINE=3Dpodman=20 + else=20 + fatal_error "no container engine found, need docker or podman"=20 + fi=20 fi=20 -if [ "${BUILD_SYSTEM}" =3D "isar" ]; then=20 +KAS_DOCKER_ROOTLESS=3D0=20 +case "${KAS_CONTAINER_ENGINE}" in=20 +docker)=20 + KAS_CONTAINER_COMMAND=3D"docker"=20 + enable_unpriv_userns_docker=20 + if [ "$(docker context show)" =3D "rootless" ]; then=20 + KAS_DOCKER_ROOTLESS=3D1=20 + fi=20 + ;;=20 +podman)=20 + KAS_CONTAINER_COMMAND=3D"podman"=20 + KAS_RUNTIME_ARGS=3D"${KAS_RUNTIME_ARGS} --security-opt label=3Ddisable"= =20 + ;;=20 +*)=20 + fatal_error "unknown container engine '${KAS_CONTAINER_ENGINE}'"=20 + ;;=20 +esac=20 +=20 +if [ "${BUILD_SYSTEM}" =3D "isar" ] || [ "${BUILD_SYSTEM}" =3D=20 "isar-privileged" ]; then=20 enable_isar_mode=20 -elif [ -z "${ISAR_MODE}" ]; then=20 +elif [ "${BUILD_SYSTEM}" =3D "isar-rootless" ]; then=20 + enable_isar_rootless_mode=20 +else=20 enable_oe_mode=20 fi=20 # clean can be executed without config, hence manually forward the build=20 system=20 -if [ "${ISAR_MODE}" =3D "1" ] && echo "${KAS_CMD}" | grep -qe=20 "^clean\|purge"; then=20 - KAS_OPTIONS=3D"${KAS_OPTIONS} --isar"=20 -fi=20 +case "${BUILD_SYSTEM}" in=20 +isar*)=20 + if echo "${KAS_CMD}" | grep -qe "^clean\|purge"; then=20 + KAS_OPTIONS=3D"${KAS_OPTIONS} --${BUILD_SYSTEM}"=20 + fi=20 + ;;=20 +esac=20 set_container_image_var=20 @@ -632,6 +636,16 @@ forward_dir KAS_BUILDTOOLS_DIR "/buildtools" "rw"=20 if git_com_dir=3D$(git -C "${KAS_REPO_DIR}" rev-parse --git-common-dir=20 2>/dev/null) \=20 && [ "$git_com_dir" !=3D "$(git -C "${KAS_REPO_DIR}" rev-parse --git-dir)" = ];=20 then=20 +=20 + KAS_GIT_OVERLAY_FILE=3D""=20 + kas_container_cleanup()=20 + {=20 + if [ -f "${KAS_GIT_OVERLAY_FILE}" ]; then=20 + trace rm -f "${KAS_GIT_OVERLAY_FILE}"=20 + fi=20 + }=20 + trap kas_container_cleanup EXIT INT TERM=20 +=20 # If (it's a git repo) and the common dir isn't the git-dir, it is shared= =20 worktree and=20 # we have to mount the common dir in the container to make git work=20 # The mount path inside the container is different from the host path.=20 Hence, we over-mount=20 @@ -685,6 +699,14 @@ if [ -n "${KAS_GIT_CREDENTIAL_STORE}" ] ; then=20 set -- "$@" -v "$(realpath -e=20 "${KAS_GIT_CREDENTIAL_STORE}")":/var/kas/userdata/.git-credentials:ro=20 fi=20 +if [ -n "${KAS_GIT_CREDENTIAL_SOCKET}" ] ; then=20 + if [ ! -S "${KAS_GIT_CREDENTIAL_SOCKET}" ]; then=20 + fatal_error "passed KAS_GIT_CREDENTIAL_SOCKET=20 '${KAS_GIT_CREDENTIAL_SOCKET}' is not a socket"=20 + fi=20 + KAS_GIT_CREDENTIAL_HELPER_DEFAULT=3D"cache=20 --socket=3D/var/kas/userdata/.git-cache-socket"=20 + set -- "$@" -v "$(realpath -e=20 "${KAS_GIT_CREDENTIAL_SOCKET}")":/var/kas/userdata/.git-cache-socket=20 +fi=20 +=20 GIT_CREDENTIAL_HELPER=3D"${GIT_CREDENTIAL_HELPER:-${KAS_GIT_CREDENTIAL_HELP= ER_DEFAULT}}"=20 if [ -n "${GIT_CREDENTIAL_HELPER}" ] ; then=20 @@ -739,7 +761,7 @@ done=20 # propagate only supported SHELL settings=20 case "$SHELL" in=20 -/bin/sh|/bin/bash|/bin/dash)=20 +/bin/sh | /bin/bash | /bin/dash)=20 set -- "$@" -e "SHELL=3D$SHELL"=20 ;;=20 *)=20 @@ -757,7 +779,7 @@ fi=20 # SC2086: Double quote to prevent globbing and word splitting.=20 # shellcheck disable=3D2086=20 -set -- "$@" ${KAS_ISAR_ARGS} ${KAS_WITH_LOOP_DEV} ${KAS_RUNTIME_ARGS} \=20 +set -- "$@" ${KAS_ISAR_ARGS} ${KAS_RUNTIME_ARGS} ${KAS_EXTRA_RUNTIME_ARGS}= =20 \=20 ${KAS_CONTAINER_IMAGE} ${KAS_OPTIONS_DIRECT} ${KAS_CMD} ${KAS_OPTIONS}=20 if [ -n "${KAS_BITBAKE_C_OPTION_ARGS}" ]; then=20 set -- "$@" -c "${KAS_BITBAKE_C_OPTION_ARGS}"=20 --=20 2.34.1 Sorry, I missed that this had already been sent by Flex just before.=20 Please ignore this one. =20 Many thanks, Srinu =20 --=20 You received this message because you are subscribed to the Google Groups "= isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/= eecda5b2-25b4-4a8e-8aa6-e4edc6fcb6adn%40googlegroups.com. ------=_Part_88717_2054454135.1782367539621 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Thursday, June 25, 2026 at 11:31:23= =E2=80=AFAM UTC+5:30 srinuv...@siemens.com wrote:
From: Srinuvasan A <= srinuv...@siemens.com>

Update kas-container to 5.4 to bring support for
the Isar rootless build system and incorporate various
fixes and improvements.

Signed-off-by: Srinuvasan A <srinuv.= ..@siemens.com>
---
kas/kas-container | 300 +++++++++++++++++++++++++-------------------= --
1 file changed, 161 insertions(+), 139 deletions(-)

diff --git a/kas/kas-container b/kas/kas-container
index 993f0bb8..631e40c3 100755
--- a/kas/kas-container
+++ b/kas/kas-container
@@ -27,7 +27,7 @@
=20
set -e
=20
-KAS_CONTAINER_SCRIPT_VERSION=3D"5.2"
+KAS_CONTAINER_SCRIPT_VERSION=3D"5.4"
KAS_IMAGE_VERSION_DEFAULT=3D"${KAS_CONTAINER_SCRIPT_VERSION}"
KAS_CONTAINER_IMAGE_DISTRO_DEFAULT=3D""
KAS_CONTAINER_IMAGE_PATH_DEFAULT=3D"ghcr.io/siemens/kas"
@@ -49,9 +49,10 @@ usage()
printf "%b" "\nPositional arguments:\n"
printf "%b" "build\t\t\tCheck out repositories and build target.\n"
printf "%b" "checkout\t\tCheck out repositories but do not build.\n= "
+ printf "%b" "diff\t\t\tCompare two kas configurations.\n"
printf "%b" "dump\t\t\tCheck out repositories and write flat versio= n\n"
printf "%b" " \t\t\tof config to stdout.\n"
- printf "%b" "lock\t\t\tCreate and update kas project lockfiles\n"
+ printf "%b" "lock\t\t\tCreate and update kas project lockfiles.\n"
printf "%b" "shell\t\t\tRun a shell in the build environment.\n"
printf "%b" "for-all-repos\t\tRun specified command in each reposit= ory.\n"
printf "%b" "clean\t\t\tClean build artifacts, keep sstate cache an= d " \
@@ -61,20 +62,19 @@ usage()
printf "%b" "cleanall\t\tClean build artifacts, sstate cache and " = \
"downloads.\n"
printf "%b" "purge\t\t\tRemove all data managed by kas. Run with '-= -dry-run'\n"
- printf "%b" " \t\t\tto check what would be removed\n"
+ printf "%b" " \t\t\tto check what would be removed.\n"
printf "%b" "menu\t\t\tProvide configuration menu and trigger " \
"configured build.\n"
printf "%b" "\nOptional arguments:\n"
- printf "%b" "--isar\t\t\tUse kas-isar container to build Isar image= . To force\n"
- printf "%b" " \t\t\tthe use of run0 over sudo, set KAS_SUDO_CM= D=3Drun0.\n"
- printf "%b" "--with-loop-dev Pass a loop device to the " \
- "container. Only required if\n"
- printf "%b" "\t\t\tloop-mounting is used by recipes.\n"
+ printf "%b" "--isar-privileged\tRun an Isar build in privileged mod= e. " \
+ "To force the use\n"
+ printf "%b" "\t\t\tof run0 over sudo, set KAS_SUDO_CMD=3Drun0.\n"
+ printf "%b" "--isar-rootless\t\tRun an Isar build in rootless mode.= \n"
printf "%b" "--runtime-args\t\tAdditional arguments to pass to the = " \
- "container runtime\n"
+ "container runtime.\n"
printf "%b" "\t\t\tfor running the build.\n"
printf "%b" "-l, --log-level\t\tSet log level (default=3Dinfo).\n"
- printf "%b" "--version\t\tprint program version.\n"
+ printf "%b" "--version\t\tPrint program version.\n"
printf "%b" "--ssh-dir\t\tDirectory containing SSH configurations.\= n"
printf "%b" "\t\t\tAvoid \$HOME/.ssh unless you fully trust the " \
"container.\n"
@@ -83,13 +83,15 @@ usage()
printf "%b" "\t\t\tAvoid \$HOME/.aws unless you fully trust the " \
"container.\n"
printf "%b" "--git-credential-store\tFile path to the git credentia= l " \
- "store\n"
+ "store.\n"
+ printf "%b" "--git-credential-socket\tPath to the git credential ca= che " \
+ "socket.\n"
printf "%b" "--no-proxy-from-env\tDo not inherit proxy settings fro= m " \
"environment.\n"
printf "%b" "--repo-ro\t\tMount current repository read-only\n" \
- "\t\t\t(default for build command)\n"
+ "\t\t\t(default for build command).\n"
printf "%b" "--repo-rw\t\tMount current repository writable\n" \
- "\t\t\t(default for shell command)\n"
+ "\t\t\t(default for shell command).\n"
printf "%b" "-h, --help\t\tShow this help message and exit.\n"
printf "%b" "\n"
printf "%b" "You can force the use of podman over docker using " \
@@ -143,11 +145,6 @@ prepare_sudo_cmd()
=20
enable_isar_mode()
{
- if [ -n "${ISAR_MODE}" ]; then
- return
- fi
- ISAR_MODE=3D1
-
KAS_CONTAINER_IMAGE_NAME_DEFAULT=3D"kas-isar"
KAS_ISAR_ARGS=3D"--privileged"
=20
@@ -159,14 +156,38 @@ enable_isar_mode()
export PATH=3D"${PATH}:/usr/sbin"
elif [ "${KAS_DOCKER_ROOTLESS}" =3D "1" ]; then
prepare_sudo_cmd
- export DOCKER_HOST=3D"${DOCKER_HOST:-unix:///var/run/docker.sock}"
- debug "kas-isar does not support rootless docker. Using system doc= ker"
+ DOCKER_HOST_DEFAULT=3D"$(docker context inspect default --format '= {{.Endpoints.docker.Host}}')"
+ export DOCKER_HOST=3D"${DOCKER_HOST:-$DOCKER_HOST_DEFAULT}"
+ debug "kas-isar does not support rootless docker. Using system doc= ker in $DOCKER_HOST"
# force use of well-known system docker socket
KAS_CONTAINER_COMMAND=3D"${_KAS_SUDO_CMD} ${KAS_CONTAINER_COMMAND}= "
KAS_DOCKER_ROOTLESS=3D0
fi
}
=20
+enable_isar_rootless_mode()
+{
+ KAS_CONTAINER_IMAGE_NAME_DEFAULT=3D"kas-isar"
+
+ # Use --privileged to pass the ambient capabilities into the contai= ner.
+ # When calling from the user session (podman or docker-rootless), t= his
+ # is fundamentally different from the system docker run --privilege= d
+ if [ "${KAS_CONTAINER_ENGINE}" =3D "podman" ]; then
+ KAS_RUNTIME_ARGS=3D"${KAS_RUNTIME_ARGS} --userns=3Dkeep-id --privi= leged"
+ elif [ "${KAS_DOCKER_ROOTLESS}" =3D "1" ]; then
+ KAS_ISAR_ARGS=3D"--privileged"
+ else
+ # we don't need --privileged, but we need to run with SYS_ADMIN
+ # to be able to unshare.
+ KAS_ISAR_ARGS=3D" \
+ --security-opt seccomp=3Dunconfined \
+ --security-opt apparmor=3Dunconfined \
+ --security-opt systempaths=3Dunconfined \
+ --cap-add=3DSYS_ADMIN \
+ "
+ fi
+}
+
enable_oe_mode()
{
if [ "${KAS_CONTAINER_ENGINE}" =3D "podman" ]; then
@@ -174,6 +195,7 @@ enable_oe_mode()
# calling "podman run" has a 1:1 mapping
KAS_RUNTIME_ARGS=3D"${KAS_RUNTIME_ARGS} --userns=3Dkeep-id"
fi
+ BUILD_SYSTEM=3D"openembedded"
}
=20
enable_unpriv_userns_docker()
@@ -210,6 +232,19 @@ check_and_expand()
realpath -e "$_varval"
}
=20
+# SC2034: DIR appears unused (ignore, as they are used inside eval)
+# shellcheck disable=3D2034
+setup_kas_dirs()
+{
+ KAS_WORK_DIR=3D"${KAS_WORK_DIR:-$(pwd)}"
+ KAS_WORK_DIR=3D"$(check_and_expand KAS_WORK_DIR required)"
+ KAS_BUILD_DIR=3D"$(check_and_expand KAS_BUILD_DIR create)"
+ KAS_REPO_REF_DIR=3D"$(check_and_expand KAS_REPO_REF_DIR required)"
+ DL_DIR=3D"$(check_and_expand DL_DIR createrec)"
+ SSTATE_DIR=3D"$(check_and_expand SSTATE_DIR createrec)"
+ KAS_BUILDTOOLS_DIR=3D"$(check_and_expand KAS_BUILDTOOLS_DIR creater= ec)"
+}
+
# Params: FILE
# Returns: root repo dir of file
repo_path_of_file()
@@ -260,14 +295,6 @@ forward_dir()
fi
}
=20
-check_docker_rootless()
-{
- KAS_DOCKER_ROOTLESS=3D0
- if [ "$(docker context show)" =3D "rootless" ]; then
- KAS_DOCKER_ROOTLESS=3D1
- fi
-}
-
enable_docker_rootless()
{
warning "Rootless docker used, only limited functionality available= ."
@@ -281,118 +308,44 @@ enable_docker_rootless()
KAS_RUNTIME_ARGS=3D"${KAS_RUNTIME_ARGS} -e KAS_DOCKER_ROOTLESS=3D1"
}
=20
-KAS_GIT_OVERLAY_FILE=3D""
-kas_container_cleanup()
-{
- if [ -f "${KAS_GIT_OVERLAY_FILE}" ]; then
- trace rm -f "${KAS_GIT_OVERLAY_FILE}"
- fi
-}
-trap kas_container_cleanup EXIT INT TERM
-
set_container_image_var()
{
+ # if the image is explicitly set, use that
+ if [ -n "${KAS_CONTAINER_IMAGE}" ]; then
+ return
+ fi
KAS_IMAGE_VERSION=3D"${KAS_IMAGE_VERSION:-${KAS_IMAGE_VERSION_DEFAU= LT}}"
KAS_CONTAINER_IMAGE_DISTRO=3D"${KAS_CONTAINER_IMAGE_DISTRO:-${KAS_C= ONTAINER_IMAGE_DISTRO_DEFAULT}}"
KAS_CONTAINER_IMAGE_NAME=3D"${KAS_CONTAINER_IMAGE_NAME:-${KAS_CONTA= INER_IMAGE_NAME_DEFAULT}}"
KAS_CONTAINER_IMAGE_PATH=3D"${KAS_CONTAINER_IMAGE_PATH:-${KAS_CONTA= INER_IMAGE_PATH_DEFAULT}}"
- KAS_CONTAINER_IMAGE_DEFAULT=3D"${KAS_CONTAINER_IMAGE_PATH}/${KAS_CO= NTAINER_IMAGE_NAME}:${KAS_IMAGE_VERSION}"
- KAS_CONTAINER_IMAGE=3D"${KAS_CONTAINER_IMAGE:-${KAS_CONTAINER_IMAGE= _DEFAULT}}"
+ KAS_CONTAINER_IMAGE=3D"${KAS_CONTAINER_IMAGE_PATH}/${KAS_CONTAINER_= IMAGE_NAME}:${KAS_IMAGE_VERSION}"
if [ -n "${KAS_CONTAINER_IMAGE_DISTRO}" ]; then
KAS_CONTAINER_IMAGE=3D"${KAS_CONTAINER_IMAGE}-${KAS_CONTAINER_IMAG= E_DISTRO}"
fi
}
=20
-# SC2034: DIR appears unused (ignore, as they are used inside eval)
-# shellcheck disable=3D2034
-setup_kas_dirs()
-{
- KAS_WORK_DIR=3D"${KAS_WORK_DIR:-$(pwd)}"
- KAS_WORK_DIR=3D"$(check_and_expand KAS_WORK_DIR required)"
- KAS_BUILD_DIR=3D"$(check_and_expand KAS_BUILD_DIR create)"
- KAS_REPO_REF_DIR=3D"$(check_and_expand KAS_REPO_REF_DIR required)"
- DL_DIR=3D"$(check_and_expand DL_DIR createrec)"
- SSTATE_DIR=3D"$(check_and_expand SSTATE_DIR createrec)"
- KAS_BUILDTOOLS_DIR=3D"$(check_and_expand KAS_BUILDTOOLS_DIR creater= ec)"
-}
-setup_kas_dirs
-
-KAS_CONTAINER_ENGINE=3D"${KAS_CONTAINER_ENGINE:-${KAS_DOCKER_ENGINE}= }"
-if [ -z "${KAS_CONTAINER_ENGINE}" ]; then
- # Try to auto-detect a container engine
- if command -v docker >/dev/null; then
- case $(docker -v 2>/dev/null) in
- podman*)
- # The docker command is an alias for podman
- KAS_CONTAINER_ENGINE=3Dpodman
- ;;
- Docker*)
- # The docker command is the real docker
- KAS_CONTAINER_ENGINE=3Ddocker
- ;;
- *)
- # The docker command is an unknown engine
- fatal_error "docker command found, but unknown engine detected"
- esac
- elif command -v podman >/dev/null; then
- KAS_CONTAINER_ENGINE=3Dpodman
- else
- fatal_error "no container engine found, need docker or podman"
- fi
-fi
-
-KAS_RUNTIME_ARGS=3D"--log-driver=3Dnone --user=3Droot"
-
-case "${KAS_CONTAINER_ENGINE}" in
-docker)
- KAS_CONTAINER_COMMAND=3D"docker"
- enable_unpriv_userns_docker
- check_docker_rootless
- ;;
-podman)
- KAS_CONTAINER_COMMAND=3D"podman"
- KAS_RUNTIME_ARGS=3D"${KAS_RUNTIME_ARGS} --security-opt label=3Ddisa= ble"
- ;;
-*)
- fatal_error "unknown container engine '${KAS_CONTAINER_ENGINE}'"
- ;;
-esac
-
-# parse kas-container options
+# parse kas-container options, leave build system empty to distingui= sh between
+# explicitly set via flag and implicitly via config.
+BUILD_SYSTEM=3D""
+KAS_OPTIONS_DIRECT=3D""
+KAS_EXTRA_RUNTIME_ARGS=3D""
while [ $# -gt 0 ]; do
case "$1" in
- --isar)
- enable_isar_mode
+ --isar | --isar-privileged)
+ if [ "$1" =3D "--isar" ]; then
+ warning "The semantic of '--isar' might change in the" \
+ "future. Please use '--isar-privileged' instead."
+ fi
+ BUILD_SYSTEM=3D"isar-privileged"
shift 1
;;
- --with-loop-dev)
- if ! KAS_LOOP_DEV=3D$(/sbin/losetup -f 2>/dev/null); then
- if [ "$(id -u)" -eq 0 ]; then
- fatal_error "loop device not available!"
- fi
- prepare_sudo_cmd
- if ! [ "$KAS_SUDO_CMD" =3D "sudo" ]; then
- fatal_error '--with-loop-dev requires sudo for device setup.'
- fi
- sudo_command=3D"/sbin/losetup -f"
- sudo_message=3D"[sudo] enter password to setup loop"
- sudo_message=3D"$sudo_message devices by calling"
- sudo_message=3D"$sudo_message '$sudo_command': "
- # SC2086: Double quote to prevent globbing and word splitting.
- # shellcheck disable=3D2086
- if ! KAS_LOOP_DEV=3D$(sudo -p "$sudo_message" $sudo_command \
- 2>/dev/null); then
- fatal_error "loop device setup unsuccessful!" \
- "try calling '$sudo_command' with root" \
- "permissions manually."
- fi
- fi
- KAS_WITH_LOOP_DEV=3D"--device ${KAS_LOOP_DEV}"
+ --isar-rootless)
+ BUILD_SYSTEM=3D"isar-rootless"
shift 1
;;
- --runtime-args|--docker-args)
+ --runtime-args | --docker-args)
[ $# -gt 0 ] || usage
- KAS_RUNTIME_ARGS=3D"${KAS_RUNTIME_ARGS} $2"
+ KAS_EXTRA_RUNTIME_ARGS=3D" $2"
shift 2
;;
--ssh-dir)
@@ -417,6 +370,13 @@ while [ $# -gt 0 ]; do
KAS_GIT_CREDENTIAL_STORE=3D"$2"
shift 2
;;
+
+ --git-credential-socket)
+ [ $# -gt 2 ] || usage
+ KAS_GIT_CREDENTIAL_SOCKET=3D"$2"
+ shift 2
+ ;;
+
--no-proxy-from-env)
KAS_NO_PROXY_FROM_ENV=3D1
shift 1
@@ -446,19 +406,19 @@ while [ $# -gt 0 ]; do
--*)
usage
;;
- clean|cleansstate|cleanall|purge)
+ clean | cleansstate | cleanall | purge)
KAS_REPO_MOUNT_OPT_DEFAULT=3D"ro"
KAS_CMD=3D$1
shift 1
break
;;
- shell|lock)
+ shell | lock)
KAS_REPO_MOUNT_OPT_DEFAULT=3D"rw"
KAS_CMD=3D$1
shift 1
break
;;
- build|checkout|for-all-repos|menu)
+ build | checkout | for-all-repos | menu)
KAS_REPO_MOUNT_OPT_DEFAULT=3D"ro"
KAS_CMD=3D$1
shift 1
@@ -486,6 +446,10 @@ while [ $# -gt 0 ]; do
esac
done
=20
+KAS_RUNTIME_ARGS=3D"--log-driver=3Dnone --user=3Droot"
+
+setup_kas_dirs
+
[ -n "${KAS_CMD}" ] || usage
=20
KAS_EXTRA_BITBAKE_ARGS=3D0
@@ -494,17 +458,17 @@ KAS_FILES=3D
# parse kas sub-command options
while [ $# -gt 0 ] && [ $KAS_EXTRA_BITBAKE_ARGS -eq 0 ]; do
case "$1" in
- --format|--indent|--provenance|--skip|--target|--task)
+ --format | --indent | --provenance | --skip | --target | --task)
KAS_OPTIONS=3D"${KAS_OPTIONS} $1 $2"
shift 1
shift 1 || KAS_OPTIONS=3D"--help"
;;
- -c|--cmd|--command)
+ -c | --cmd | --command)
KAS_BITBAKE_C_OPTION_ARGS=3D"$2"
shift 1
shift 1 || KAS_OPTIONS=3D"--help"
;;
- -E|--preserve-env)
+ -E | --preserve-env)
fatal_error "$1 is not supported with ${KAS_CONTAINER_SELF_NAME}"
;;
--)
@@ -563,10 +527,10 @@ if [ "${KAS_CMD}" =3D "menu" ]; then
if [ "$(echo "${KAS_FIRST_FILES}" | wc -w)" -ne "1" ]; then
fatal_error "menu plugin only supports a single Kconfig file"
fi
- BUILD_SYSTEM=3D$(tr '\n' '\f' 2>/dev/null < "${KAS_FIRST_FILE= S}" | \
+ BUILD_SYSTEM=3D${BUILD_SYSTEM:-$(tr '\n' '\f' 2>/dev/null < "= ${KAS_FIRST_FILES}" |
sed -e 's/\(.*\fconfig KAS_BUILD_SYSTEM\f\(.*\)\|.*\)/\2/' \
-e 's/\f\([[:alpha:]].*\|$\)//' \
- -e 's/.*default \"\(.*\)\".*/\1/')
+ -e 's/.*default \"\(.*\)\".*/\1/')}
else
if [ -z "${KAS_FIRST_FILES}" ]; then
KAS_FIRST_FILES=3D"${KAS_WORK_DIR}/.config.yaml"
@@ -574,20 +538,60 @@ else
=20
# We only get the first build system and let kas check if mixed
_KAS_FIRST_FILE=3D$(echo "${KAS_FIRST_FILES}" | awk '{print $1}')
- BUILD_SYSTEM=3D$(grep -e "^build_system: " "${_KAS_FIRST_FILE}" 2&g= t;/dev/null | \
- sed 's/build_system:[ ]\+//')
+ BUILD_SYSTEM=3D${BUILD_SYSTEM:-$(grep -e "^build_system: " "${_KAS_= FIRST_FILE}" 2>/dev/null |
+ sed 's/build_system:[ ]\+//')}
+fi
+
+KAS_CONTAINER_ENGINE=3D"${KAS_CONTAINER_ENGINE:-${KAS_DOCKER_ENGINE}= }"
+if [ -z "${KAS_CONTAINER_ENGINE}" ]; then
+ # Try to auto-detect a container engine
+ # Defaults if there are multiple options:
+ # podman if build system is isar-rootless, docker otherwise
+ if [ "${BUILD_SYSTEM}" =3D "isar-rootless" ] && command -v = podman >/dev/null 2>&1; then
+ KAS_CONTAINER_ENGINE=3Dpodman
+ elif command -v docker >/dev/null 2>&1 && docker = -v 2>/dev/null | grep -q '^Docker'; then
+ KAS_CONTAINER_ENGINE=3Ddocker
+ elif command -v podman >/dev/null 2>&1; then
+ KAS_CONTAINER_ENGINE=3Dpodman
+ else
+ fatal_error "no container engine found, need docker or podman"
+ fi
fi
=20
-if [ "${BUILD_SYSTEM}" =3D "isar" ]; then
+KAS_DOCKER_ROOTLESS=3D0
+case "${KAS_CONTAINER_ENGINE}" in
+docker)
+ KAS_CONTAINER_COMMAND=3D"docker"
+ enable_unpriv_userns_docker
+ if [ "$(docker context show)" =3D "rootless" ]; then
+ KAS_DOCKER_ROOTLESS=3D1
+ fi
+ ;;
+podman)
+ KAS_CONTAINER_COMMAND=3D"podman"
+ KAS_RUNTIME_ARGS=3D"${KAS_RUNTIME_ARGS} --security-opt label=3Ddisa= ble"
+ ;;
+*)
+ fatal_error "unknown container engine '${KAS_CONTAINER_ENGINE}'"
+ ;;
+esac
+
+if [ "${BUILD_SYSTEM}" =3D "isar" ] || [ "${BUILD_SYSTEM}" =3D "isar= -privileged" ]; then
enable_isar_mode
-elif [ -z "${ISAR_MODE}" ]; then
+elif [ "${BUILD_SYSTEM}" =3D "isar-rootless" ]; then
+ enable_isar_rootless_mode
+else
enable_oe_mode
fi
=20
# clean can be executed without config, hence manually forward the b= uild system
-if [ "${ISAR_MODE}" =3D "1" ] && echo "${KAS_CMD}" | grep -q= e "^clean\|purge"; then
- KAS_OPTIONS=3D"${KAS_OPTIONS} --isar"
-fi
+case "${BUILD_SYSTEM}" in
+isar*)
+ if echo "${KAS_CMD}" | grep -qe "^clean\|purge"; then
+ KAS_OPTIONS=3D"${KAS_OPTIONS} --${BUILD_SYSTEM}"
+ fi
+ ;;
+esac
=20
set_container_image_var
=20
@@ -632,6 +636,16 @@ forward_dir KAS_BUILDTOOLS_DIR "/buildtools" "rw= "
=20
if git_com_dir=3D$(git -C "${KAS_REPO_DIR}" rev-parse --git-common-d= ir 2>/dev/null) \
&& [ "$git_com_dir" !=3D "$(git -C "${KAS_REPO_DIR}" rev-pa= rse --git-dir)" ]; then
+
+ KAS_GIT_OVERLAY_FILE=3D""
+ kas_container_cleanup()
+ {
+ if [ -f "${KAS_GIT_OVERLAY_FILE}" ]; then
+ trace rm -f "${KAS_GIT_OVERLAY_FILE}"
+ fi
+ }
+ trap kas_container_cleanup EXIT INT TERM
+
# If (it's a git repo) and the common dir isn't the git-dir, it is = shared worktree and
# we have to mount the common dir in the container to make git work
# The mount path inside the container is different from the host pa= th. Hence, we over-mount
@@ -685,6 +699,14 @@ if [ -n "${KAS_GIT_CREDENTIAL_STORE}" ] ; then
set -- "$@" -v "$(realpath -e "${KAS_GIT_CREDENTIAL_STORE}")":/var/= kas/userdata/.git-credentials:ro
fi
=20
+if [ -n "${KAS_GIT_CREDENTIAL_SOCKET}" ] ; then
+ if [ ! -S "${KAS_GIT_CREDENTIAL_SOCKET}" ]; then
+ fatal_error "passed KAS_GIT_CREDENTIAL_SOCKET '${KAS_GIT_CREDENTIA= L_SOCKET}' is not a socket"
+ fi
+ KAS_GIT_CREDENTIAL_HELPER_DEFAULT=3D"cache --socket=3D/var/kas/user= data/.git-cache-socket"
+ set -- "$@" -v "$(realpath -e "${KAS_GIT_CREDENTIAL_SOCKET}")":/var= /kas/userdata/.git-cache-socket
+fi
+
GIT_CREDENTIAL_HELPER=3D"${GIT_CREDENTIAL_HELPER:-${KAS_GIT_CREDENTI= AL_HELPER_DEFAULT}}"
=20
if [ -n "${GIT_CREDENTIAL_HELPER}" ] ; then
@@ -739,7 +761,7 @@ done
=20
# propagate only supported SHELL settings
case "$SHELL" in
-/bin/sh|/bin/bash|/bin/dash)
+/bin/sh | /bin/bash | /bin/dash)
set -- "$@" -e "SHELL=3D$SHELL"
;;
*)
@@ -757,7 +779,7 @@ fi
=20
# SC2086: Double quote to prevent globbing and word splitting.
# shellcheck disable=3D2086
-set -- "$@" ${KAS_ISAR_ARGS} ${KAS_WITH_LOOP_DEV} ${KAS_RUNTIME_ARGS= } \
+set -- "$@" ${KAS_ISAR_ARGS} ${KAS_RUNTIME_ARGS} ${KAS_EXTRA_RUNTIME= _ARGS} \
${KAS_CONTAINER_IMAGE} ${KAS_OPTIONS_DIRECT} ${KAS_CMD} ${KAS_OP= TIONS}
if [ -n "${KAS_BITBAKE_C_OPTION_ARGS}" ]; then
set -- "$@" -c "${KAS_BITBAKE_C_OPTION_ARGS}"
--=20
2.34.1


=C2=A0 =C2= =A0 Sorry, I missed that this had already been sent by Flex just before. Please= ignore this one. =C2=A0

=C2=A0 =C2=A0 Many thanks,
=C2= =A0 =C2=A0 Srinu=C2=A0=C2=A0

--
You received this message because you are subscribed to the Google Groups &= quot;isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e= mail to isar-use= rs+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-use= rs/eecda5b2-25b4-4a8e-8aa6-e4edc6fcb6adn%40googlegroups.com.
------=_Part_88717_2054454135.1782367539621-- ------=_Part_88716_726348700.1782367539621--