This change was inspired by a change done on Fedora's livecd-tools
from here: livecd-tools/livecd-tools#236. The patch corrects issues
with the setfiles SELinux relabel command. The issues become apparent
when the host and guest policies differ. Thus it becomes required
to explicitly set the policy to decouple from eventual unwanted
host settings.
Allow to specify the group id in the groups list a user
should belong to. The group id can be placed as part of
the group name separated by a colon like in the following
example:
<users>
<user groups="kiwi,admin:42,users" password="..." name="kiwi"/>
</users>
Please note kiwi checks if the provided group already
exists and only creates a group if it is not already present in
the system. As default groups are usually provided by the OS
itself including its preferred group id, you will intentionally
not be able to overwrite group id for existing groups.
This Fixes#2064
When using the apt packagemanager kiwi required the use of
debootstrap to create the initial rootfs. This works as long
as there is always a main distribution repository available
which follows the structure of the official debian mirrors.
However if such a main distribution is not present or an
alternative layout like e.g OBS repos is used, debootstrap
will refuse to work. To allow for an alternative and without
the dependency to debootstrap kiwi supports using a prebuilt
bootstrap package providing the mini rootfs to serve as
the bootstrap result. As all other package managers properly
supports installation into an empty new root, this feature
was only added when using the apt packagemanager
Added check_partuuid_persistency_type_used_with_mbr(). Not
every partition table type supports UUIDs. We don't want to
make use of the artifical values created by Linux if the
partition table doesn't support it natively
Added new luksformat element which allows to pass
along options to the luksFormat call. This allows users to
switch between LUKS and LUKS2 via e.g
<luksformat>
<option name="--type" value="luks2"/>
</luksformat>
It also allows to pass along a set of options only available
to LUKS2, e.g
<luksformat>
<option name="--type" value="luks2"/>
<option name="--cipher" value="aes-gcm-random"/>
<option name="--integrity" value="aead"/>
</luksformat>
In addition to the new attribute the existing luks attribute
can also be specified to read credentials from a keyfile by
using the file:// source locator, e.g
<type ... luks="file:///path/to/a/keyfile"/>
This Fixes#1898
Docker containers used to support the attribute `additionaltags` which
was used to provide multiple tags for the same image. Since only tags
were supported this commit renames the attribute to `additionalnames`
and now supports tags and names witht he following syntax:
* '<name>:<tag>' -> adds a full docker image reference including name
and tag
* ':<tag>' -> adds an additional tag while reusing the former name
* '<name>' -> adds an additional name while reusing the former tag
Fixes#2045
Signed-off-by: David Cassany <dcassany@suse.com>
In CentOS Stream 8 and Red Hat Enterprise Linux 8, there are
Application Streams that are offered in the form of modules
(using Fedora Modularity technology). To build images that use
this content KIWI needs to support to enable/disable various
modules. This commit allows to configure collection modules
in a new element as shown below
<packages type="bootstrap">
<collectionModule name="module" stream="stream" enable="true|false"/>
</packages>
This Fixes Issue #1999
Currently the release version is not set or set to '0'
for package managers which requires a value to operate.
However, in order to support leveraging the same description
across different releases it is important to have the
opportunity to specify a setting for the release version.
This commit adds a new optional attribute to the preferences
section which allows to specify a custom value which
serves as the release version:
<preferences>
<release-version>TEXT</release-version>
</preferences>
If not specified the default setting as before applies.
Please note the release version information is currently
used in dnf and microdnf package managers only. It might
happen that it gets applied to the other package manager
backends as well. This will happen on demand though.
Related to Issue #1918. This Fixes#1927
This commit changes the stage at which container images are compressed
to match the criteria applied to other image types. Instead of
compressing the image in OCI devoted classes now it is happening
in builder class by setting Result instance properties.
Fixes#1996
Signed-off-by: David Cassany <dcassany@suse.com>
This commit adds a new URI type called this://... The
this:// part will be resolved into the absolute path to
the image description. A source path like the following:
<source path="this://my_repo"/>
is resolved to
<source path="dir:///path/to/image/description/my_repo"/>
This change provides the requested opportunity to reference
repos provided as part of the image description and
Fixes#1964
For resolver operations through libsolv the 'kiwi image info'
module exists. So far it could not read the repos from
metalink repo definitions. This Fixes#1890
This commit adds a new and optional child element <signing>
to the repository/source element as shown in the following
example:
<repository>
<source path="...">
<signing key="keyfile"/>
</source>
</repository>
The collection of all keyfiles from all repositories will be
added to the keyring as used by the selected package manager.
Signing keys specified on the commandline and signing keys
specified in the image description will be combined.
This Fixes#1883
This commit fixes several issue connected with the use of
the <include> directive:
First and foremost the XSLT chain was broken in a way that
the include XSLT in combination with the PrettyPrinter XSLT
were called not in the chain of stylesheets but together.
This results in XML descriptions which duplicated the content
and went invalid
Another change is, when the include XSLT is called in the chain.
This commit moves it to become the very first processing
instruction such that the included data is part of all subsequent
XSLT stylesheets. This also allows to use older schema versions
in included XML data and they get automatically converted through
the chain of XSLT stylesheets.
Last change is the evaluation of the from= attribute value. This
value is now interpreted as an URI. Currently only local URIs are
supported. The reason to do this is because XSLT when processing
a document resolves relative paths according to the file path
of the master document. As kiwi does not change the original
content that path with will be a /var/tmp location if one of
the XSLT stylesheets were used. The documentation for this change
was updated as well
Tools like mkisofs, genisoimage and friends are all unmaintained
and have found their substitute in xorriso for quite some time.
This commit deletes the code from kiwi which supported creation
of ISO images using the obsolete cdrtools collection. In addition
all hack code associated with these tools like mbr insertion via
isohybrid and things like that got dropped as well.
This Fixes#1908
In addition to the volume volume management settings also
allow to setup low level table entries like in the following
example:
<partitions>
<partition name="var" size="100" mountpoint="/var" filesystem="ext3"/>
</partitions>
For initial provisioning of LUKS encrypted disk images an
empty passphrase key is handy to avoid interaction in the
deployment process. However, the dracut kiwi modules were
lacking the information that the luks keyfile could be an
empty passphrase key which must not be opened with the
potential risk to get prompted for input. This commit
introduces a new profile environment variable evaluated
by the dracut kiwi lib code to open the LUKS pool and
allows to distinguish the situation on key files with
or without a passphrase
On the toplevel of an image description you can now
specify include directive(s) like in the following
example
<image ...>
...
<include from="filename_a.xml"/>
...
<include from="filename_b.xml"/>
</image>
At the place of their occurrence the include statement
will be replaced with the contents of the given filename.
The implementation is based on a XSLT stylesheet and
applies very early in the process. The stylesheet reads
the contents of the given file as XML document().
Thus only valid XML documents gets accepted by this
include concept. This Fixes#1929 and is related to
Issue #1918
repo files allows for several customization options
which could not be set by kiwi through the current
repository schema. As the options used do not follow
any standard and are not compatible between package
managers and distributions the only generic way to
handle this is through a script which is invoked
with the repo file as parameter for each file created
to describe a repo for the selected package manager.
This allows users to update/change the repo file content
on their individual needs. In the kiwi description the
path to the custom script can be specified as follows
<repository ... customize="/path/to/custom_script">
<source path="..."/>
</repository>
This Fixes#1896
The new optional metadata file image/exclude_files.yaml can
be placed inside of the local image root tree. At creation time of
the image binary the file contents are used to extend the default
exclude list with additional information. The structure of the
file must be as follows:
```yaml
exclude:
- exclude-name-used-in-rsync
```
The new attribute <volume ... filesystem_check="true|false"/>
allows to change the default value for the fs_passno field in
the generated fstab file. By default kiwi sets "0" in this
field and leaves it up to the user to customize this as
appropriate via script code. Coding changes to the fstab file
via scripts are not very user friendly and with respect that
systemd takes over control and generates checkers depending on
the value of fs_passno it would be good if there is a way to
explicitly specify if checks to the filesystem are wanted or
not. Therefore the new attribute now exists. If set to: true
this results in a value of "2" for the fs_passno field. Please
note the root/boot and efi entries are excluded from this
setup. This Fixes#1728
Add support to create SAT solvables from Debian repos via
deb2solv tool from libsolv. This allows image info --resolve-package-list
to work with Debian/Ubuntu image descriptions. Please note
by default libsolv is not compiled with support for Debian.
Therefore the following compile flags must be set on libsolv
* -DENABLE_DEBIAN=1
* -DMULTI_SEMANTICS=1
If libsolv does not provide the needed capabilities kiwi will
fail on either the repository solvable creation due to missing
deb2solv or on call of setdisttype() due to missing MULTI_SEMANTICS
feature in libsolv
In preparation to the new obs kiwi plugin this commit adds
an opportunity to store obs credentials such that the plugin
could also be used in a non-interactive way
The former implementation read the runtime config file every
time a new RuntimeConfig instance was created. The runtime
config is however static during the runtime of an image build
process and not supposed to change. Therefore the file should
be read in once and any new instance of RuntimConfig should
just use what has been read in at the first invocation. This
commit refactors the RuntimeConfig class to hold an application
global RUNTIME_CONFIG variable and allows to reread the
config on explicit request.
This commit adds the `<installinitrd>` element in kiwi schema to
facilitate the dracut modules configuration for the installation initrds
on OEM images. Within installinitrd element is possible list the dracut
modules to append, to omit or to just set an static list of dracut
modules to include.
Fixes#1676Fixes#1683
This commits adds the attribute 'arch' to preferences. It works
as any other 'arch' attribute within the schema. Preferences defined
with architectures that do not match the host are ignored. If no 'arch'
is provided it matches all any host architecture.
Fixes#1640
The optional oem-swapname is only effective if used together
with the LVM volume manager. A name for the swap space can
only be set if it is created as a LVM volume. In any other
case the name does not apply to the system. This condition
should be checked to avoid useless settings in the image
description.
Added a new element <oem-swapname> below the <oemconfig>
section which allows to specify a name for the swap volume
in case the LVM volume manager is used. The default if
not specified continuous to stay at: LVSwap. This
Fixes#1638
In addition to the custom size of the root volume it's now
also possible to setup the name of the root volume as follows:
<volume name="@root=rootlv"/>
If no name for the root volume is specified the default
name: LVRoot applies as before. This Fixes#1530
This changes the s390 support on several stages:
1) On s390 the boot process is based on zipl which boots into an
initrd from which a userspace grub process is started to support
the grub capabilities. The implementation of this concept is
provided via the grub2-s390x-emu package. Once installed the
setup of the bootloader is done via the grub2-mkconfig and
grub2-install commands and therefore from a caller perspective
the same as with any other grub2 setup process. For kiwi this
means no extra zipl bootloader target code is needed. Therefore
this commit deletes the zipl setup from kiwi and puts on
the standard grub2 process. This Fixes bsc#1170863
2) To support different targettypes the grub2-s390x-emu provided
zipl template must be adapted. Parts of the former zipl bootloader
setup therefore now applies to an update of the zipl2grub
template file
3) Support for CDL/LDL DASD targets has been disabled in the schema
When testing 4k devices and a respective zipl2grub template
setup for CDL/LDL targettype it has turned out that grub2-install
is not able to run on such a device. My assumption is that
the device code in grub2-install does not work for 4k devices
with an fdasd created partition table. As this needs further
investigations and most probably adaptions on the grub toolchain
for s390, we disabled the setup of these modes for now.
emulated DASD (FBA) and SCSI targets stays supported.
multiple type sections within one preferences section is allowed
in a kiwi image description. However, if multiple type sections
for the same image attribute are configured only the last type
configuration will be ever reachable. The proposed runtime check
in this commit detects this situation and raises an exception
showing the conflicting types including a solution suggestion
which needs to be based on profiles to distinguish between
types of the same image type name.
A vmx image is the same disk as an oem just without the dracut
repart/resize feature. This difference is better handled with
an oemconfig parameter <oem-resize> which allows to switch resize
on or off. The extra image type vmx will be dropped and an XSLT
stylesheet automatically transforms a vmx description to be a
oem image with the resize feature switched off.
This Fixes#1425
Before this commit an oem image still had the kiwi initrd_system
set as default. As we are decommission the custom kiwi initrd
concept the default should be changed. It is still possible to
use a custom kiwi initrd but it needs to be explicitly requested
via the initrd_system="kiwi" attribute. In addition to the
changed default a runtime check was introduced that checks
the presence of the boot= attribute which only makes sense
in combination with the kiwi initrd_system. If boot= is
set but initrd_system="kiwi" is not, a message is raised that
explains the situation and either requests setting initrd_system
properly or deleting the boot attribute. The change only
affects people who still use oem with a boot="oemboot/..."
setting and no explicit selection of kiwi as the initrd_system.
As these image type configurations should not be in use anyway
because this is all legacy and announced to go away, we
need to make the next step and enforce a new default in
code. This is related to Issue #1299
The bootloader settings are handled through attributes in the
type element. Over the years some attributes were added and
there are requests for more settings. Therefore the bootloader
setup deservers its own section. With this commit the schema
changes from v7.1 to v7.2 and moves bootloader, bootloader_console
boottimeout and zipl_targettype into a new bootloader subsection
below type. The commit also adds an auto transformation template
such that customers don't have to change their image descriptions.
This is related to Issue #1401
The kiwi template for vagrant images assumes the box files to
be used in non graphics mode and for the purpose of automation
or server deployment. Thus by default we disable Audio.
For details see the API reference:
https://www.virtualbox.org/sdkref/interface_i_audio_adapter.html
This Fixes#1322
With the new Fstab class from prior pull request there is an
opportunity to handle all fstab related actions to be done
by that class. This commit extends the Fstab class with an
add_entry method such that we can avoid the extra lists
holding raw fstab lines in e.g the disk builder. In the end
all fstab related data is stored in an instance of the Fstab
class. This also extends the KIWI api by an fstab management
class. Related to #1329 and #1349
Handling of fstab should be done in its own namespace and class.
The current handling of fstab entries is spread at several places.
There should be only one code that writes the fstab entries and
that code should also care for the correct canonical order of
the mountpoints
Added new type attribute:
```xml
<type ... spare_part_fs_attributes="..."/>
```
which can be a comma separated list of the following currently
supported filesystem attributes:
* no-copy-on-write
* synchronous-updates
See chattr and filesystem manual pages for details on those
attributes. More attributes for the spare part context can be
added on request. This Fixes#1233
