Running on pytest < 7 causes an AttributeError:
module 'pytest' has no attribute 'Config'. Quoting
the type hint argument to be a string and accessing
the elements of pytestconfig via getattr() and a
default value workarounds the issue for older pytest
versions
Added new <environment> section to the existing <bootloadersettings>
section which allows to specify environment variables for setting
up an environment blob for the selected loader. With this commit
we add support for grub by using grub2-editenv. Other loaders
do not yet have an implementation or does not support environment
blobs. Settings will be ignored for unsupported loaders.
This Fixes#2922
Co-authored-by: Rhys Oxenham <rhys.oxenham@suse.com>
The early boot script and also the ISO template should only
set this option if the conditions to set it are met. Conditions
for this option are if btrfs is in use and a default subvolume
and/or a snapper based snapshot is requested by the image
description. This Fixes#2919
This commit adds support for providing custom CA certificates
during the build process. It allows a user to specify one ore
more CA file(s) via the new <certificates> section and/or
via the command line. The certificate files will be imported
directly after the image bootstrap has finished (where the
required CA update tools are available), but before any
further packages are retrieved, solving for situations where
the chroot environment needs certificates, e.g. when there's
a proxy server in the build environment.
Co-authored-by: Marcus Schaefer <marcus.schaefer@gmail.com>
This commit introduces the SnapshotManager factory to abstract Snapper
specific logic into its own class.
It also updates unit tests to reach full coverage. It essentially
adds a new snapper unit tests suite and it refactors the volume manager
tests suite.
Signed-off-by: David Cassany <dcassany@suse.com>
This commit makes use of snapper helpers to install a new
system where frist root is already a snapshot. Requires snapper
higher or equal to v0.12.1.
It also keeps old logic for backward compatibility with OSes including
older versions of snapper. The execution path is split based on the
snapper version included within the image being built.
Signed-off-by: David Cassany <dcassany@suse.com>
Chroot manager class can be used to setup
a chroot enviroment including an arbitrary
list of bind mounts. The provided paths to bind
are mounted in the chroot to the same actual root
path they are bound from.
This class is useful to setup a chroot envirment
based on the root-tree created on prepare step.
Signed-off-by: David Cassany <dcassany@suse.com>
With dracut-ng the output file format is a configuration
option. The detection mechanics must be extended by also
looking at the combined configuration settings which can
be obtained via the new --printconfig dracut option.
This commit adds the additional check if the used dracut
command supports that option. This Fixes#2918
efipart_id, rootpart_id, bootpart_id in <type> and
part_id in <partition>. Allow to specify a custom partition
number instead of the default numbering schema 1-N
Allow to specify a custom partition ID in the Disk
class interface and API. As of today the new parameter
partition_id in the ptable_entry_type record is not
in use by the current kiwi image description schema.
This change will be a followup to the API change and
needs further conversation upstream first. The code
changes here are based on the work from:
Co-authored-by: Caleb Wolfe <cwolfe651@gmail.com>
Co-authored-by: Caleb Wolfe (Amazon) <xcawolfe@amazon.com>
Assisted-by: Claude Opus 4.5 <noreply@anthropic.com>
This is related to #2917
Allow to specify a custom partition ID in the Partitioner
class interface and API. The code changes here are based
on the work from:
Co-authored-by: Caleb Wolfe <cwolfe651@gmail.com>
Co-authored-by: Caleb Wolfe (Amazon) <xcawolfe@amazon.com>
Assisted-by: Claude Opus 4.5 <noreply@anthropic.com>
This is related to #2917
The new root directory (/) for an image build is created
by taking the current system umask into account. However,
if that umask setting is not appropriate for the needs
of the image root directory some hard to debug after
effects can appear on the later run of the image binary.
As such this commit changes the permissions for the root
directory explicitly to the expected value.
This Fixes#2920
If root is not a snapshot and the root volume is
not (/) we forgot to self bind mount the root volume.
This must happen in the volume manager because if
done later it would shadow any other mountpoint
Add optional root_is_mountpoint parameter to the _call_script
method. When set the provided root path is turned into a bind
mount such that it appears as / being a mountpoint in the
chrooted call. Apply the argument to the call_disk_script
method such that is becomes effective for the disk.sh
script hook.
Some OS don't support the way systemd is dealing with keymaps (e.g.
Debian, see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=790955).
If we try to set the keymap using `systemd-firstboot --keymap`, this
will fail, and the error message from `systemd-firstboot` is misleading:
it states that the keymap is not installed.
I couldn't find out how to reliably detect if systemd's keymap
management is supported, so instead, we provide a hint in the error
message if `systemd-firstboot --keymap` fails that the reason could be
that it's unsupported.
Fixes#2904
More generic keymap/systemd error message + dedent
Adds test of warning if keymap setting unsupported
Fix linter complaints about formatting
Run keymap check under chroot
We're interested in the capabilities of the target system, since we also
run `systemd-firstboot --keymap` in there.
Fixup for setup_test after chroot'ing localectl
Remove localectl call
It talks to systemd.
Fix tests for keymap
The console attribute in the bootloader section was used to
target both, output and input console setup using a space separator.
However, there can be multiple consoles specified for output
and input consoles and that turns the idea to handle both in
one attribute into a mess. This commit drops the console attribute
and offers two new attributes output_console and input_console which
can define multiple consoles each using space as a separator.
For example:
<bootloader ... output_console="console serial" input_console="console"/>
This change comes with a schema version bump to v8.4
An automatic XSL transformation template for the old console
attribute into the new output_console and input_console
attributes is also part of this commit.
This Fixes#2886
So far setting the luks= attribute on a live image build had
no impact to the generated ISO image. This commit adds the
encryption capability also for live ISO images. The read-only
part of the rootfs gets encrypted using the provided luks
passphrase. An eventual persistent storage area gets encrypted
at boot time if the rd.live.encrypt kernel cmdline parameters
is passed. encryption/decryption requires to interactively
set/provide passhphrase information at boot time. Please note
due to the read-only restrictions of an ISO image there is no
way to apply the standard re-encryption process as it is
usually performed by kiwi encrypted systems. As such the
specified luks passphrase in the kiwi image descriptions
becomes sensitive information that needs to be protected
Using --add-repo/--set-repo options on the commandline
allows to skip the repotype setting by passing in an empty
value. That empty value however caused the type attribute
in a repository section to be set to an empty string which
is not allowed by the schema. Instead an empty type should
lead to no type attribute set at all. This commit fixes it
To run pvattest perform an attestation request binary as
well as the corresponding attestation key and the secure
execution header is required. This data should be created
as part of the image build. In this commit we are adding
support for creating the attestation data when building
a secure execution enabled image
Update check_dracut_module_versions_compatible_to_kiwi to match
with new dracut module dirs which have changed due to recommended
dracut module ordering for out-of-tree modules.
When specifying a filesystem attribute for a live image build,
the rootfs gets build directly into this filesystem instead of
being a squashfs wraped ext4 which is the default layout for
compatibility reasons. In this direct filesystem mode the
exclude list was not passed along to the filesystem creation
and causes unwanted metadata to be part of the final image.
This Fixes#2873
In case the kiwi-repart module is explicitly requested in a
dracut.conf file and the image is also configured to build an
install ISO image this leads the install ISO to contain the
kiwi-repart module as well which is unwanted. This commit
explicitly omits the kiwi-repart when creating the initrd
for the install image
`_create_solvables` assumes metadata files are gzip-compressed,
but modern Fedora ones are not, they are zstd-compressed.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
The partition id metadata file is used in the kiwi-repart
module. If a user wants to use the kiwi repart module
permanently, this metadata file needs to stay in the system.
Therefore it should not be automatically deleted by the
cleanup. A disk.sh hook script can be used to force the
deletion of the file though. This is related #2851
A recent commit changed the way these are looked up and
accidentally broke image building on riscv64, with
KiwiBootLoaderGrubSecureBootError: Signed grub2 efi loader not found
now being raised for kiwi recipes that worked just fine
before that moment.
Fixes: 197572378c
Thanks: David Abdurachmanov <davidlt@rivosinc.com>
Thanks: Marcus Schäfer <marcus.schaefer@gmail.com>
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
For reproducible builds the calculation of the filesystem UUID
should be persistent with each rebuild of the image. To achieve
this the UUID is calculated using the SOURCE_DATE_EPOCH from
the environment plus a char-number representation of the filesystem
label name as random seed. In kiwi every filesystem is created
with a label, thus only in case there is no SOURCE_DATE_EPOCH
available we continue to create the UUID as random data.
This Fixes#2761
Allow to specify a filesystem label as part of a <partition>
definition. So far the label was set by the name of the
partition. With the new label attribute, a filesystem label
different from the partition name can be set. This commit
also updates/fixes the documentation in this regard.
Log the value of SDE so it is available to review,
even if the build system does not tell about it.
Update the tests to cover the new code-path.
Co-Authored-By: Marcus Schäfer <marcus.schaefer@gmail.com>
This helps a bit with issue #2358
Add reproducible flag for UKI too
Update tests accordingly
Co-Authored-By: Marcus Schäfer <marcus.schaefer@gmail.com>
Add missing search path for shim binary on arm based SUSE
systems. Also update the tumbleweed/test-image-live-disk
integration test for arm to build with secure boot enabled
to actually test a secure boot enabled ISO build.
This Fixes#2842
