ostree/ci
Ondrej Mosnacek edb4f38934 deploy: Try to rebuild policy in new deployment if needed
Whenever the user has SELinux enabled and has any local
modules/modifications installed, it is necessary to rebuild the policy
in the final deployment, otherwise ostree will leave the binary policy
files unchanged from last deployment as it detects difference against
the base content (in rpm-ostree case this is the RPM content).

To avoid the situation where the policy binaries go stale once any local
customization of the policy is made, try to rebuild the policy as part
of sysroot_finalize_deployment(). Use the special
--rebuild-if-modules-changed switch, which detects if the input module
files have changed relative to last time the policy was built and skips
the most time-consuming part of the rebuild process if modules are
unchanged (thus making this a relatively cheap operation if the user
hasn't made any modifications to the shipped policy).

As suggested by Jonathan Lebon, this uses bubblewrap (via
g_spawn_sync()) to perform the rebuild inside the deployment's
filesystem tree, which also means that ostree will have a runtime
dependency on bubblewrap.

Partially addresses: https://github.com/coreos/fedora-coreos-tracker/issues/701

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
2022-03-28 17:18:03 -04:00
..
prow ci: Add prow/ subdirectory with Dockerfile 2019-08-29 05:43:11 +00:00
build-check-sanitized.sh Add --enable-sanitizers, fix make check with it 2021-02-03 20:33:19 +00:00
build-check.sh ci: Remove libpaprci/ directory 2020-06-17 15:48:31 -04:00
build-rpm.sh ci: Remove libpaprci/ directory 2020-06-17 15:48:31 -04:00
build.sh ci: Enable -fanalyzer 2021-10-15 15:44:04 -04:00
ci-commitmessage-submodules.sh *: rename master branch to main 2021-05-07 16:55:03 +02:00
ci-release-build.sh ci/release-build: evaluate package_version from m4 definition 2021-07-09 16:17:31 +00:00
fah29-insttests.sh ci: Use Fedora 29 artifacts 2019-06-21 13:17:10 +00:00
flatpak-1.4.1-ostree-gpg-errors.patch ci/flatpak: Patch GPG error assertions from OSTree 2020-01-24 13:03:30 -07:00
flatpak.sh ci: Remove libpaprci/ directory 2020-06-17 15:48:31 -04:00
gh-build.sh tests: Unset SOURCE_DATE_EPOCH 2021-07-26 11:48:45 +01:00
gh-install.sh deploy: Try to rebuild policy in new deployment if needed 2022-03-28 17:18:03 -04:00
installdeps.sh installdeps: Drop PyYAML 2021-03-31 15:11:34 -04:00
libbuild.sh ci/libbuild.sh: drop yum/CentOS support 2022-02-03 13:17:56 -05:00
make-git-snapshot.sh ci/make-git-snapshot.sh: xz the archive 2022-02-03 13:23:43 -05:00
Makefile.dist-packaging ci: Remove libpaprci/ directory 2020-06-17 15:48:31 -04:00
provision-prep.sh ci: Remove libpaprci/ directory 2020-06-17 15:48:31 -04:00
rpmbuild-cwd ci: Remove libpaprci/ directory 2020-06-17 15:48:31 -04:00
rpmostree.sh ci: Remove libpaprci/ directory 2020-06-17 15:48:31 -04:00