IF YOU WOULD LIKE TO GET AN ACCOUNT, please write an
email to Administrator. User accounts are meant only to access repo
and report issues and/or generate pull requests.
This is a purpose-specific Git hosting for
BaseALT
projects. Thank you for your understanding!
Только зарегистрированные пользователи имеют доступ к сервису!
Для получения аккаунта, обратитесь к администратору.
In mkosi.images/system/mkosi.conf, we configure the certificate as
an extra tree so it's available inside the image. However, we pick up
the certificate from the top level repository directory and not from the
build directory where it is generated by the genkey meson target.
We currently have no way to access the build directory that mkosi was
invoked from when parsing the configuration file. Thus we have no way to
specify the correct location to the certificate when it's located in the
build directory.
For now, let's look for the key and certificate in the top level repository
root directory and drop the genkey target.
We don't have to change the Github Actions CI because it already runs genkey
manually before the image build (which is something we forgot to remove when
introducing the genkey target and is the reason this didn't cause issues before).
(cherry picked from commit b00f44c3cff083972b0458359bbb5b80f0d10931)
We already have selinux=0 in the default kernel command line so
enforcing=0 is redundant. Instead, pass in enforcing=0 when we
enable selinux in TEST-06-SELINUX.
(cherry picked from commit f5c44df92922d74cfff40989d6617e3a9e4c5904)
It doesn't get pulled in as a dependency anyway and kernel command
line space is precious so let's remove apparmor=0 as it's a noop
anyway.
(cherry picked from commit 5319be5f0c68d7edb09438419ca4171e4692c859)
* fix: update docs since the default config uses a setting only available in v23
* fix: update docs to only refer to installing from the mkosi repo
(cherry picked from commit cb2d6214caa25b8297bde01bb8bb925957b04ba7)
$SYSTEMD_REPART_OVERRIDE_FSTYPE is too invasive. Often you want to
override the fstype only for a specific designator, so let's support
that as well.
(cherry picked from commit 90a255779d1f8e6697e08e91918df88bb52274ad)
These should already get pulled in as dependencies, but it doesn't
hurt to be explicit.
(cherry picked from commit b209fff3a51b8e57ea5970575bf8d4db4790b620)
Let's make things a little more consistent and build the initrd
explicitly as a subimage as well instead of relying on mkosi building
it as part of the main image build.
We drop the opensuse initrd postinst script as we don't use erofs by
default anymore. We can always reintroduce it again later if needed.
(cherry picked from commit 68ee9771145464949d36d62a0ec687ecfb39290a)
This is a universal setting and can only be configured in the main
image so let's drop it from the subimages.
(cherry picked from commit 244952b1ead7bb14058a873fded2cb9709c82a95)
Let's make sure we don't load libnss_systemd.so from bash as the
necessary environment variables aren't set to make that work when
we're running with sanitizers enabled.
We can't add a sanitizer wrapper for bash as the wrapper runs using
bash so you end up in a loop.
(cherry picked from commit 5ac0dc70ff330a531539a92552fbeb0f542edfb5)
We use -fdebug-prefix-map= because debugedit doesn't work for us (for
a currently unknown reason since it's the most obtuse code I've ever
had the pleasure of reading). With all the unique macros enabled, the
destination directory we pass to -fdebug-prefix-map= includes the package
release. The release is either the timestamp of the current commit or
the current time if the working tree is dirty. This means it generally
changes every time we rerun the build script. However, meson only reads
compiler arguments the first time it is invoked or if --wipe is specified.
This means that on a rerun -fdebug-prefix-map= will be configured wrong
and the build will fail.
Let's prevent this from happening by disabling the unique debug source
names by overriding the --unique-debug-src-base option that is passed to
find-debuginfo.sh by rpm via the _find_debuginfo_opts macro.
(cherry picked from commit 88221219a3290ee20de27aa030c2b23f03d8238a)
This is only possible since a recent kernel version, and fails otherwise,
like on CentOS 9
(cherry picked from commit ff8c89aa5a84733dd777f3e9113df33ce6c1ab1e)
We switch to the c10s-sig-hyperscale branch of the spec repository
as it will receive all the latest changes the earliest before they
end up in the c9s-sig-hyperscale branch.
(cherry picked from commit 8b32cc79ec028fa783072676346141821444b638)
CentOS Stream 10 does not have erofs-utils so let's add a fallback
to squashfs when building the sysext.
(cherry picked from commit 3cfb020cb9ce5958ac39a7fd586cc4e893a7b190)
This allows us to add CI for CentOS Stream 10 as EPEL 10 doesn't
exist yet and won't exist for quite some time.
CentOS Stream 10 will be enabled later as soon as
https://issues.redhat.com/browse/RHEL-46604 is resolved.
(cherry picked from commit 0e4a7ab6d5601785e326851b3f1b6a3367ec98ec)
We want the exitrd image to be built with the latest systemd as well.
As the exitrd image is built as part of mkosi.images, and all subimages
are built before the main image, this implies the packages must be built
as a subimage in mkosi.images/ as well. So we introduce the build image and
move all logic related to building distribution packages there.
This also has the nice side effect of slimming down the main image as the
build dependencies are not installed into the main image anymore. It also
makes sure the packages are built in a "clean" chroot without any of the
other packages which we install in the main image available.
(cherry picked from commit 7205fc7dc31eb2be3075ee6ba23ebe84324aa5cb)
* a3524fc837 Use a more precise Recommends for libkxbcommon
* 980ede8c0f Drop machined revert
* d569018a92 Rebuilt for the bin-sbin merge
* 8881fa94ee Version 256.2
* 1cc4f83002 Link systemd-executor statically
* 0319e62d9c Update dracut workaround
* c96f54de22 Fix ELN build
* 3f68c5d802 Only exclude dracut conflicts on non-fedora on upstream builds
* 7db154308b Conditionalize dracut Conflicts more
(cherry picked from commit 72a8f508e54188c64687633f96021c185a79938c)
The commits on src.opensuse.org keep disappearing so let's switch
back to code.opensuse.org.
(cherry picked from commit a86211b7cad84cde6c9e330e3bbba7b538fa7f1a)
Archlinux split out one ssh binary, install it in the legacy test
setup if present for the tests that need ssh
(cherry picked from commit aaa7b36bd15ca3a96a1e11a557482b0bc59c769f)
* 8c025c3bdf Accepting request 1184267 from Base:System
|\
| * 735f8c4ba4 - Import commit 5a8eadd0c021758337a020c423f25a353bdb9b3c (merge of v255.8) For a complete list of changes, visit: 603cd1d4d8...5a8eadd0c0 - Drop 5003-Revert-run-pass-the-pty-slave-fd-to-transient-servic.patch as v255.8 contains the workaround (commit 639c922ede9485) for the broken commit 28459ba1f4df.
* | 37853fecc3 Accepting request 1183029 from Base:System
|/
* 638de11012 - Don't automatically clean unmodified config files up (bsc#1226415)
* 369c023c24 reorder one more time...
* ffa9f0ac80 reorder the runtime deps of the testsuite package so the format_spec_file thingy stop screwing up the spec file...
* 12c1190a79 fix rev 1529: the devel packages are really needed by the testsuite script to install the dlopened libs into the image
* ca8e7f54ce - systemd.spec: move a misplaced %endif in the testsuite sub-package.
* b7944f5b14 - Merge systemd-coredump back into the main package (bsc#1091684)
* 3fa0dea84a - Don't pull the devel packages in when installing the testsuite package.
(cherry picked from commit eb6f177ae4ec25ba8efaab5268a7c36195f0bf62)
- Stop installing the policy in the initramfs as it's not really
supported anyway (https://github.com/fedora-selinux/selinux-policy/issues/2221)
- Stop relabeling on first boot and prefer to do it at image build time
- Disable mkosi relabeling by default but enable it in CI
- Build image as root in CI so the SELinux relabeling works properly
(cherry picked from commit dedd712dd9b4883678765b9bc1a8ac349cf24f3b)
stress-ng is available in OpenSUSE and in CentOS Stream without needing
EPEL so let's switch to it instead of stress.
(cherry picked from commit 3e3a15c06e03f1bec209066da5b1340e1dd03dc8)
Let's make use of mkosi ssh to give everyone a one liner to run instead
of having to execute two commands (one outside the VM, one inside).
(cherry picked from commit 00acdb314768fac76b563857e2ab4a8e33b7be23)
Otherwise trying to use --wipe might fail if the build directory
has not been configured but is not empty either.
(cherry picked from commit 73b3179a5375d3fe7a58b5686446dddd3a14a734)
In https://github.com/systemd/systemd/pull/33659 the commit was
updated to point to my fork without changing it back after the mkosi
PR was merged so let's change it back to point to the official
repository.
(cherry picked from commit c8ce41954be9eb06750a9302cbc1f80f1111e067)
In https://github.com/systemd/mkosi/pull/2847, the '@' specifier is
removed, CLI arguments take priority over configuration files again
and the "main" image is defined at the top level instead of in
mkosi.images/. Additionally, not every setting from the top level
configuration is inherited by the images in mkosi.images/ anymore,
only settings which make sense to be inherited are inherited.
This commit gets rid of all the usages of '@', moves the "main" image
configuration from mkosi.images/system to the top level and gets rid
of various hacks we had in place to deal with quirks of the old
configuration parsing logic.
We also remove usages of Images= and --append as these options are
removed by the mentioned PR.
(cherry picked from commit 20345a86b7157e229c1c7e3976005548bad159a4)
This ensures that even in case the distro repository has newer
versions, the locally built packages are preferred and installed,
even to the point of downgrading already installed ones.
This is needed especially for future stable branches, when the
distros will have a newer version.
(cherry picked from commit 1ee8e526d77cf8eb8ad39622848d87891b7ac13a)
The contents of this file are passed as arguments to fixfiles so
let's remove the comment as otherwise fixfiles just crashes.
(cherry picked from commit 5eab7c5097a830d6ac26485ec5b80e384f2044c7)
Let's not insist on btrfs everywhere. 93440db8b5eae1244aaf5fecfa68050a8b26f3e3
switched us back to btrfs as we wanted to rely on the fact it records
timestamps properly. Since we now prefer to do incremental builds on the host
with "mkosi -t none" we don't mind anymore that timestamps are not recorded
properly so we're not forced to use btrfs anymore.
This also increases test coverage as we'll now test with different root
filesystems.
(cherry picked from commit 5db8db5e346371c7f11805f1a07e7f3e1c48a96b)
The new link-executor-shared option is similar to the existing
link-udev-shared: when set to false, we link to the static versions of our
internal libraries.
The resulting exuctor binary is fairly large, about as large as libsystemd-core
(14 MB without lto, 8 with lto).
This is intended as a workaround for the fuckup with the pinned executor
binary:
when an upgrade is performed, the package manager will install new version of
the libraries and new version of the code, and some time later reexecute the
managers. This creates a window when the pinned executor binary will fail to
execute. There are two factors which make the issue easier to hit:
- when the distribution uses a finely-grained shared-lib-tag. E.g. Fedora
uses version-release as the tag, which means that the issue occurs on
every package upgrade. This is the right thing to do, because the
ABI of our internal libraries is not stable at all, so replacing the
library from a different version in place creates a window where our
programs may crash or misbehave.
- when the distribution doesn't immediately reexec all the managers after
upgrade. In early versions of systemd, we used to hammer the machine during
upgrade, doing daemon-reexecs repeatedly. This works, but is ugly and
wasteful. Doing the reexecs while the upgrade is in progres also creates a
window where a mix of old and new configs or both is loaded. Users are
particularly annoyed by those reloads if there is some issue in the
configuration causing us to emit warnings on every reexec. Doing the
reexecs once after the new configuration and libraries have been put
in place is nicer.
The pinning of the executor binary breaks upgrades and in particular
it penalizes the distributions which make use of the features which
were previously added to avoid bugs and inefficiency during upgrades.
When the executor is linked statically, there is a smaller chance that it'll
fail to load libraries. The issue can still occur because other libraries, not
our own, are linked dynamically.
(cherry picked from commit d59cae6cebd0fc25a16a020bd28e5303901f1b19)
By itself, this is not useful. I'm making this a separate commit to
make debugging easier. It turns out that meson does static libraries
using references, so the "static library" a tiny stub stub that refers
to the object files on disk and this has negligible cost:
$ ls -lhd build/src/core/libsystemd-core-257.{a,so}
-rw-r--r-- 1 zbyszek zbyszek 36K Jul 3 16:54 build/src/core/libsystemd-core-257.a
-rwxr-xr-x 1 zbyszek zbyszek 6.1M Jul 3 16:54 build/src/core/libsystemd-core-257.so
(cherry picked from commit d0689ee5fbfafa736e6eca89bc80cb2d372f2229)
