From 1938d4b8f869b00fa23e665bac85809c1f56fe4c Mon Sep 17 00:00:00 2001 From: James Le Cuirot Date: Tue, 27 Oct 2026 14:15:29 +0000 Subject: [PATCH 1/5] build_image_util: Don't chroot to run semodule This requires QEMU for non-native boards, but we want to avoid the implicit use of QEMU. Use semodule's -p option instead, which restricts writes to within the given directory. Some data is read from /etc/selinux on the host, but I think this is okay. Signed-off-by: James Le Cuirot --- build_library/build_image_util.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh index d942857eab0..cfa85c639e3 100755 --- a/build_library/build_image_util.sh +++ b/build_library/build_image_util.sh @@ -647,7 +647,7 @@ EOF # Build the selinux policy if pkg_use_enabled coreos-base/coreos selinux; then - sudo chroot "${root_fs_dir}" bash -c "cd /usr/share/selinux/mcs && semodule -s mcs -i *.pp" + sudo semodule -n -s mcs -p "${root_fs_dir}" -i "${root_fs_dir}"/usr/share/selinux/mcs/*.pp fi # Run tmpfiles once to make sure that /etc has everything in place before From 99f77c905345f0511fa479ae1ea924f6c39bb1e5 Mon Sep 17 00:00:00 2001 From: James Le Cuirot Date: Tue, 27 Oct 2026 14:25:02 +0000 Subject: [PATCH 2/5] coreos-devel/sdk-depends: Update SELinux dependencies policycoreutils was outdated, and these shouldn't be limited to non-arm64. Perhaps they weren't keyworded at the time. Signed-off-by: James Le Cuirot --- ...57.ebuild => sdk-depends-0.0.1-r58.ebuild} | 0 .../sdk-depends/sdk-depends-0.0.1.ebuild | 22 +++++++------------ 2 files changed, 8 insertions(+), 14 deletions(-) rename sdk_container/src/third_party/coreos-overlay/coreos-devel/sdk-depends/{sdk-depends-0.0.1-r57.ebuild => sdk-depends-0.0.1-r58.ebuild} (100%) diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-devel/sdk-depends/sdk-depends-0.0.1-r57.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-devel/sdk-depends/sdk-depends-0.0.1-r58.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/coreos-devel/sdk-depends/sdk-depends-0.0.1-r57.ebuild rename to sdk_container/src/third_party/coreos-overlay/coreos-devel/sdk-depends/sdk-depends-0.0.1-r58.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-devel/sdk-depends/sdk-depends-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-devel/sdk-depends/sdk-depends-0.0.1.ebuild index 8063335f421..f339285cfbc 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos-devel/sdk-depends/sdk-depends-0.0.1.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/coreos-devel/sdk-depends/sdk-depends-0.0.1.ebuild @@ -2,16 +2,14 @@ # Distributed under the terms of the GNU General Public License v2 # $Header: $ -EAPI=7 +EAPI=9 DESCRIPTION="Meta ebuild for everything that needs to be in the SDK." HOMEPAGE="http://coreos.com/docs/sdk/" -SRC_URI="" LICENSE="GPL-2" SLOT="0" KEYWORDS="amd64 arm64" -IUSE="" DEPEND=" app-admin/sudo @@ -29,15 +27,19 @@ DEPEND=" coreos-base/hard-host-depends coreos-base/coreos-sb-keys dev-libs/gobject-introspection-common + dev-perl/Parse-Yapp + >=dev-python/gpep517-15 dev-python/setuptools dev-python/six dev-util/catalyst dev-util/pahole dev-util/patchelf + dev-util/pkgcheck net-dns/bind >=net-dns/dnsmasq-2.72[dhcp,ipv6] net-libs/rpcsvc-proto net-misc/curl + sys-apps/bubblewrap sys-apps/debianutils sys-apps/iproute2 amd64? ( sys-apps/iucode_tool ) @@ -47,21 +49,13 @@ DEPEND=" sys-fs/btrfs-progs sys-fs/cryptsetup sys-fs/erofs-utils - dev-perl/Parse-Yapp - dev-util/pkgcheck " # Must match the build-time dependencies listed in selinux-policy-2.eclass DEPEND="${DEPEND} - !arm64? ( - >=sys-apps/checkpolicy-2.0.21 - >=sys-apps/policycoreutils-2.0.82 - ) - sys-devel/m4" - -DEPEND="${DEPEND} - sys-apps/bubblewrap - >=dev-python/gpep517-15 + >=sys-apps/checkpolicy-2.0.21 + >=sys-apps/policycoreutils-2.5 + sys-devel/m4 " # These packages are pulled indirectly during the multi-stage SDK From 5a11ae8717e4bb363d4b0f80b6a11ae2c4cf150a Mon Sep 17 00:00:00 2001 From: James Le Cuirot Date: Tue, 27 Oct 2026 18:42:33 +0000 Subject: [PATCH 3/5] setup_board: Fix the bwrap wrapper script when QEMU is needed If we are to not rely on binfmt_misc, then we must explicitly invoke the given command with QEMU, not just bind mount the QEMU binary. Signed-off-by: James Le Cuirot --- setup_board | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup_board b/setup_board index 51e07902c33..cd6aec87c4e 100755 --- a/setup_board +++ b/setup_board @@ -127,7 +127,7 @@ EOF #!/bin/sh -e _ROOT=\${1?Pass a root directory as the first argument} shift -exec bwrap --bind "\${_ROOT}" / --tmpfs /tmp --dev-bind /dev /dev --proc /proc --bind /sys /sys ${qemu+--ro-bind ${qemu} ${qemu}} -- "\$@" +exec bwrap --bind "\${_ROOT}" / --tmpfs /tmp --dev-bind /dev /dev --proc /proc --bind /sys /sys ${qemu+--ro-bind ${qemu} ${qemu}} -- ${qemu} "\$@" EOF wrappers+=( "${wrapper}" ) From 880b2cd9b11e74526f6259b51973f1eaaf16b563 Mon Sep 17 00:00:00 2001 From: James Le Cuirot Date: Tue, 27 Oct 2026 18:45:13 +0000 Subject: [PATCH 4/5] build_image_util: Don't invoke localedef with bwrap and QEMU The bwrap wrapper is limited in that it only invokes QEMU for the given command and does not invoke it for any subprocesses. There is sadly no way to do that when you're not relying on binfmt_misc. localedef invokes gzip, so it doesn't work with this wrapper. We don't need to use the non-native localedef anyway. The host's copy is sufficient if you point it at the right locations. Endianness is the only potential compatibility issue, but all our boards are currently little endian. Signed-off-by: James Le Cuirot --- build_library/build_image_util.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh index cfa85c639e3..bfd82eba430 100755 --- a/build_library/build_image_util.sh +++ b/build_library/build_image_util.sh @@ -116,8 +116,9 @@ run_localedef() { [[ -f "${i18n}/charmaps/UTF-8.gz" ]] || die [[ -f "${i18n}/locales/C" ]] || die sudo mkdir -p "${root_fs_dir}/usr/lib/locale" - sudo I18NPATH="${i18n}" "bwrap-${BOARD}" "${root_fs_dir}" /usr/bin/localedef \ - --charmap=UTF-8 --inputfile=C C.UTF-8 + # We could detect board endianness, but just assume little for now. + sudo env I18NPATH="${i18n}" localedef --prefix="${root_fs_dir}" \ + --little-endian --charmap=UTF-8 --inputfile=C C.UTF-8 } # Basic command to emerge binary packages into the target image. From 15cc22f6772024e465476d36dec6848e3b3066e1 Mon Sep 17 00:00:00 2001 From: James Le Cuirot Date: Tue, 27 Oct 2026 12:02:29 +0000 Subject: [PATCH 5/5] .github: Don't install QEMU on the Ubuntu systems This is now failing due to Ubuntu changes, but we no longer rely on implicit QEMU usage anyway, so the SDK's copy will always be used. Signed-off-by: James Le Cuirot --- .github/workflows/ci.yaml | 2 +- .github/workflows/setup-flatcar-sdk.sh | 3 +-- .github/workflows/update-sdk.yaml | 2 +- 3 files changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index f56f7701137..c6e627b67d1 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -51,7 +51,7 @@ jobs: sudo rm /bin/sh sudo ln -s /bin/bash /bin/sh sudo apt-get update - sudo apt-get install -y ca-certificates curl git gnupg lsb-release python3 python3-packaging qemu-user-static zstd + sudo apt-get install -y ca-certificates curl git gnupg lsb-release python3 python3-packaging zstd - name: Set up Docker uses: docker/setup-docker-action@v4 diff --git a/.github/workflows/setup-flatcar-sdk.sh b/.github/workflows/setup-flatcar-sdk.sh index d362ba23594..9c0545fd065 100755 --- a/.github/workflows/setup-flatcar-sdk.sh +++ b/.github/workflows/setup-flatcar-sdk.sh @@ -8,8 +8,7 @@ fi sudo ln -sfn /bin/bash /bin/sh sudo apt-get update -sudo apt-get install -y ca-certificates curl git gnupg lbzip2 lsb-release \ - qemu-user-static zstd +sudo apt-get install -y ca-certificates curl git gnupg lbzip2 lsb-release zstd sudo mkdir -p /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/ubuntu/gpg \ | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg diff --git a/.github/workflows/update-sdk.yaml b/.github/workflows/update-sdk.yaml index bc4dd5e32a6..76d9e3f278b 100644 --- a/.github/workflows/update-sdk.yaml +++ b/.github/workflows/update-sdk.yaml @@ -58,7 +58,7 @@ jobs: run: | sudo rm /bin/sh sudo ln -s /bin/bash /bin/sh - sudo apt-get install -y ca-certificates curl gnupg lsb-release qemu-user-static git jq openssh-client rsync zstd + sudo apt-get install -y ca-certificates curl gnupg lsb-release git jq openssh-client rsync zstd - name: Set up Docker uses: docker/setup-docker-action@v4