From c0c2ad23d1006fc9fffa08411c15c2c4b55d3e89 Mon Sep 17 00:00:00 2001 From: Tobias Jungel <1773291+toanju@users.noreply.github.com> Date: Mon, 24 Aug 2026 16:05:56 +0200 Subject: [PATCH] Update to 1877.23.0 Signed-off-by: Tobias Jungel <1773291+toanju@users.noreply.github.com> --- .github/workflows/dev.yml | 2 +- .github/workflows/nightly.yaml | 4 +- .github/workflows/upload_oci.yml | 2 +- Containerfile | 2 +- VERSION | 2 +- build | 68 ++++++++++++++++++++++++++++---- gardenlinux | 2 +- requirements.defs | 1 + 8 files changed, 68 insertions(+), 15 deletions(-) create mode 120000 requirements.defs diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml index cbf70f8..a05a165 100644 --- a/.github/workflows/dev.yml +++ b/.github/workflows/dev.yml @@ -39,7 +39,7 @@ jobs: build: needs: [set_version] if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }} - uses: gardenlinux/gardenlinux/.github/workflows/build.yml@5a713d37923e67b7fbf6745a92344c6e1ea73595 + uses: gardenlinux/gardenlinux/.github/workflows/build.yml@5f5b3a9e04f5c44c7126be185ccc78e8938a4adb with: version: ${{ needs.set_version.outputs.VERSION }} # to set target to "release" or "nightly" we need proper KMS secrets diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index 2c7c768..26e5b75 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -19,7 +19,7 @@ jobs: submodules: recursive build: needs: [checkout] - uses: gardenlinux/gardenlinux/.github/workflows/build.yml@5a713d37923e67b7fbf6745a92344c6e1ea73595 + uses: gardenlinux/gardenlinux/.github/workflows/build.yml@5f5b3a9e04f5c44c7126be185ccc78e8938a4adb with: version: ${{ inputs.version || 'now' }} # to set target to "release" or "nightly" we need proper KMS secrets @@ -50,7 +50,7 @@ jobs: name: Run glcli to publish to OCI needs: [build] # use custom upload_oci.yml as we do not sign the images - # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@5a713d37923e67b7fbf6745a92344c6e1ea73595 + # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@5f5b3a9e04f5c44c7126be185ccc78e8938a4adb uses: ./.github/workflows/upload_oci.yml with: version: ${{ needs.build.outputs.version }} diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml index 4a213d8..e41e3a8 100644 --- a/.github/workflows/upload_oci.yml +++ b/.github/workflows/upload_oci.yml @@ -14,7 +14,7 @@ on: jobs: generate_matrix_publish: name: Generate flavors matrix to publish - uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@5a713d37923e67b7fbf6745a92344c6e1ea73595 + uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@5f5b3a9e04f5c44c7126be185ccc78e8938a4adb with: flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test' upload_gl_artifacts: diff --git a/Containerfile b/Containerfile index edd1ecc..3d210fe 100644 --- a/Containerfile +++ b/Containerfile @@ -1,3 +1,3 @@ -FROM ghcr.io/gardenlinux/builder:d6d24ba1aec66889a2acab83aedcb00e869abfcd@sha256:3dc78daebb56605baf105d2f20a6e8b94137237c1c2587b80d571fbb5c9f49ab +FROM ghcr.io/gardenlinux/builder:0196add0ce875ac0b7721c19b2ee3ac37cf84387 RUN sed 's/version="$2"/version=\$(echo \$2 | cut -d. -f 1-2)/' -i /builder/bootstrap diff --git a/VERSION b/VERSION index 3cabfd3..2e20e7f 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1877.22.0 +1877.23.0 diff --git a/build b/build index cc890cd..39567e0 100755 --- a/build +++ b/build @@ -6,7 +6,6 @@ shopt -s nullglob exec 3>&1 exec 1>&2 -#container_image=ghcr.io/gardenlinux/builder:d6d24ba1aec66889a2acab83aedcb00e869abfcd container_image=localhost/builder container_engine=podman target_dir=.build @@ -23,9 +22,15 @@ container_cmd=() use_kms=0 resolve_cname=0 +allow_frankenstein=1 +apparmor_profile= while [ $# -gt 0 ]; do case "$1" in + --allow-frankenstein) # https://xkcd.com/1589/ + allow_frankenstein=1 + shift + ;; --container-image) container_image="$2" shift 2 @@ -59,6 +64,10 @@ while [ $# -gt 0 ]; do target_dir="$2" shift 2 ;; + --apparmor-profile) + apparmor_profile="$2" + shift 2 + ;; *) break ;; @@ -72,11 +81,10 @@ container_mount_opts=( -v "$(realpath "$target_dir"):/builder/.build" ) -for feature in features/*; do - if [ -d "$feature" ]; then - container_mount_opts+=(-v "$(realpath -- "$feature"):/builder/$feature:ro") - fi -done +# mount all features to enable dynamic discovery of requirements.mod files +container_mount_opts+=(-v "$(realpath -- "features"):/builder/features:ro") +container_mount_opts+=(-v "$(realpath -- "gardenlinux"):/builder/gardenlinux:ro") +container_mount_opts+=(-v "$(realpath -- "requirements.defs"):/builder/requirements.defs:ro") if [ "$container_image" = localhost/builder ]; then dir="$(dirname -- "$(realpath -- "${BASH_SOURCE[0]}")")" @@ -91,7 +99,7 @@ default_version="$(./get_version)" if [ "$resolve_cname" = 1 ]; then arch="$("$container_engine" run --rm "${container_run_opts[@]}" "${container_mount_opts[@]}" "$container_image" dpkg --print-architecture)" - cname="$("$container_engine" run --rm "${container_run_opts[@]}" "${container_mount_opts[@]}" "$container_image" /builder/parse_features --feature-dir /builder/features --default-arch "$arch" --default-version "$default_version" --cname "$1")" + cname="$("$container_engine" run --rm "${container_run_opts[@]}" "${container_mount_opts[@]}" "$container_image" /builder/parse_features --allow-frankenstein --feature-dir /builder/features --default-arch "$arch" --default-version "$default_version" --cname "$1")" short_commit="$(head -c 8 <<< "$commit")" echo "$cname-$short_commit" >&3 exit 0 @@ -102,8 +110,13 @@ make_opts=( COMMIT="$commit" TIMESTAMP="$timestamp" DEFAULT_VERSION="$default_version" + LOG_WITH_TIMESTAMP="${LOG_WITH_TIMESTAMP:-true}" ) +if [ "$allow_frankenstein" = 1 ]; then + make_opts+=("ALLOW_FRANKENSTEIN=1") +fi + if [ "$use_kms" = 1 ]; then for e in AWS_DEFAULT_REGION AWS_REGION AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN; do if [ -n "${!e-}" ]; then @@ -112,7 +125,7 @@ if [ "$use_kms" = 1 ]; then done fi -# Default values which can be overriden via 'build.config' file +# Default values which can be overridden via 'build.config' file tempfs_size=2G if [[ -f "$PWD"/build.config ]]; then @@ -125,4 +138,43 @@ if [ -d cert ]; then container_mount_opts+=(-v "$PWD/cert:/builder/cert:ro") fi +# Check if builder apparmor profile has to be created or selected +if [ "$container_engine" = "docker" ] \ + && [ ! "$apparmor_profile" ] \ + && out=$(sysctl kernel.apparmor_restrict_unprivileged_userns 2> /dev/null) \ + && [[ $out = "kernel.apparmor_restrict_unprivileged_userns = 1" ]]; then + if [ ! -f /etc/apparmor.d/builder ]; then + echo "You are using Docker on a system restricting unprivileged user namespaces with apparmor, which prevents a successful build. For more information please refer to the #Usage section in the README." + read -r -p "Do you want to permanently create a new apparmor profile at /etc/apparmor.d/builder to solve the issue? [Y/n] " response + response=${response,,} + if [[ "$response" =~ ^(yes|y)$ ]]; then + if [ ! -f /etc/apparmor.d/builder ]; then + profile="abi , include profile builder flags=(unconfined) {userns, }" + echo "$profile" | sudo tee /etc/apparmor.d/builder > /dev/null + sudo apparmor_parser -r -W /etc/apparmor.d/builder + fi + echo "Created profile builder at /etc/apparmor.d/builder" + else + echo Abort. + exit 1 + fi + fi + apparmor_profile=builder +fi + +# Apply apparmor profile if selected +if [ "$apparmor_profile" ]; then + replaced=false + for i in "${!container_run_opts[@]}"; do + if [ "${container_run_opts[$i]}" = "apparmor=unconfined" ]; then + container_run_opts["$i"]="apparmor=$apparmor_profile" + replaced=true + fi + done + + if ! $replaced; then + container_run_opts+=(--security-opt "apparmor=$apparmor_profile") + fi +fi + "$container_engine" run --rm "${container_run_opts[@]}" "${container_mount_opts[@]}" "$container_image" ${container_cmd[@]+"${container_cmd[@]}"} fake_xattr make --no-print-directory -C /builder "${make_opts[@]}" "$@" >&3 diff --git a/gardenlinux b/gardenlinux index 409e9b6..5f5b3a9 160000 --- a/gardenlinux +++ b/gardenlinux @@ -1 +1 @@ -Subproject commit 409e9b640087ade203321a8d63bd1651f4677205 +Subproject commit 5f5b3a9e04f5c44c7126be185ccc78e8938a4adb diff --git a/requirements.defs b/requirements.defs new file mode 120000 index 0000000..fcbe494 --- /dev/null +++ b/requirements.defs @@ -0,0 +1 @@ +gardenlinux/requirements.defs \ No newline at end of file