[v8 00/14] Improving base-apt usage

[Aliaksei Karpovich]

`base-apt` is a local apt repository containing all upstream (Debian, Raspberry
Pi OS, Ubuntu...) packages needed for a particular build. This series implements
upfront repository downloading. This is the first step towards local partial
mirror management.

The current approach in `next`:

- On the first build, mmdebstrap and sbuild are used for building Isar
artifacts. The packages downloaded from the Internet are cached in local
directories.
- On the next build:
- Analyze the logs from the previous build, save packages downloaded by the
bootstraps, sbuilds and imagers into `base-apt`.
- Use `base-apt` for bootstrapping, building and image creation.

Some issues with the current approach:

1. Different policies must be followed for the first and the subsequent builds.
2. As we have multiple versions of the same package from the main and security
repositories and rely on build logs and `find` for populating `base-apt`, extra
care must be taken to ensure that the right package version lands in `base-apt`.
3. We rely on internal implementation of `mmdebstrap` and `sbuild` for saving
and reusing the packages.
4. Source packages are stored in a different flat directory, `apt-get source`
for upstream packages is not possible.
5. At the moment of `base-apt` creation all we have is the package name. The
knowledge about the upstream repositories is lost and no local repository
policy implementation is possible (e.g., for the "multiple products, multiple
distros" use case).
6. For implementing further use cases like "fetch all sources necessary for
bootstrapping the base system itself", additional logic is necessary.

The new approach:

- On the first build:
- All packages necessary for bootstrapping and building are identified and
downloaded upfront.
- `base-apt` is used for bootstrapping, building and image creation.
- On the next build:
- `base-apt` is used for bootstrapping, building and image creation.

This series addresses issues 1-5 and provides the architecture for
implementing further use cases.

The new approach is enabled by default. Setting `ISAR_PREFETCH_BASE_APT` to
zero falls back to the old approach.

The implementation uses `debrepo` script which can also be called manually for
pre-fetching packages to the local 'base-apt' repository. It requires
`python3-apt` to be installed on the build host. Some examples of its usage in
standalone mode:

```
# Create local `/build/ba` repository sufficient to bootstrap Debian system with
`armhf` architecture:
debrepo --init --workdir=/build/dr --repodir=/build/ba --arch=armhf

# Add some packages to this repo (e.g., build deps for some recipe):
debrepo --workdir=/build/dr locales gnupg

# Add srcpackages for some package to the repo:
debrepo --workdir=/build/dr --srcmode tzdata
```

Changes since v7:
- Rebased on latest next (70661c40)
- Fixed url parsing in rootfs_install_pkgs_isar_download()
- Added version and arch for downloaded package in
rootfs_install_pkgs_isar_download()
- Workaround for base-apt to force to install python3-apt amd64
- Added using override for reprepro to fix offline build

Known issues:
- Didn't pass the testsuite CI - 50% of fast tests are failed

Aliaksei Karpovich (4):
rootfs: Fix URL parsing
rootfs: Add version and arch for downloaded package
sbom-chroot: Fix python3-apt dependency
debrepo: Add using override for reprepro

Uladzimir Bely (10):
scripts: Add debrepo python script handling base-apt
meta: Add debrepo bbclass handling base-apt prefetching
meta: Always use base-apt repo in local mode
meta: Use cached base-apt repo to bootstrap
base-apt: Predownload packages to base-apt before install
meta: Add cache-deb-src functionality in base-apt mode
testsuite: Set ISAR_PREFETCH_BASE_APT by default
Disable deb-dl-dir in base-apt prefetch mode
kas: Add PREFETCH_BASE_APT config entry
ci_build.sh: Install python3-apt if not installed

RECIPE-API-CHANGELOG.md | 10 +
doc/user_manual.md | 1 +
kas/opt/Kconfig | 12 +
kas/opt/prefetch-base-apt.yaml | 9 +
meta-test/conf/local.conf.sample | 3 +
meta/classes-recipe/bootstrap.bbclass | 50 +-
meta/classes-recipe/crossvars.bbclass | 1 +
meta/classes-recipe/deb-dl-dir.bbclass | 47 ++
meta/classes-recipe/dpkg-base.bbclass | 1 +
meta/classes-recipe/dpkg.bbclass | 8 +
.../image-locales-extension.bbclass | 5 +
.../image-tools-extension.bbclass | 13 +
meta/classes-recipe/rootfs.bbclass | 21 +-
meta/classes-recipe/sbuild.bbclass | 3 +-
meta/classes/debrepo.bbclass | 90 +++
meta/conf/bitbake.conf | 5 +
meta/lib/aptsrc_fetcher.py | 22 +
.../isar-mmdebstrap/isar-mmdebstrap-host.bb | 2 +
.../isar-mmdebstrap/isar-mmdebstrap.inc | 10 +-
meta/recipes-devtools/base-apt/base-apt.bb | 21 +-
.../sbom-chroot/sbom-chroot.bb | 2 +-
.../sbuild-chroot/sbuild-chroot-host.bb | 2 +
scripts/ci_build.sh | 8 +-
scripts/debrepo | 659 ++++++++++++++++++
testsuite/cibase.py | 4 +
testsuite/cibuilder.py | 7 +
26 files changed, 998 insertions(+), 18 deletions(-)
create mode 100644 kas/opt/prefetch-base-apt.yaml
create mode 100644 meta/classes/debrepo.bbclass
create mode 100755 scripts/debrepo

--
2.43.0

[Aliaksei Karpovich]

From: Uladzimir Bely <ub...@ilbers.de>

This means only local URLs in apt sources.list* are present during
the build. Any installation of packages is done from local base-apt.
So, base-apt should be always mounted in *_do_mounts since now.

Signed-off-by: Uladzimir Bely <ub...@ilbers.de>
Signed-off-by: Aliaksei Karpovich <akarp...@ilbers.de>
---
meta/classes-recipe/bootstrap.bbclass | 6 ++++--
meta/classes-recipe/rootfs.bbclass | 3 ++-
meta/classes-recipe/sbuild.bbclass | 3 ++-
.../isar-mmdebstrap/isar-mmdebstrap.inc | 5 ++++-
meta/recipes-devtools/base-apt/base-apt.bb | 21 ++++++++++++-------
5 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/meta/classes-recipe/bootstrap.bbclass b/meta/classes-recipe/bootstrap.bbclass
index c1a59fd2..f853a932 100644
--- a/meta/classes-recipe/bootstrap.bbclass
+++ b/meta/classes-recipe/bootstrap.bbclass
@@ -39,7 +39,8 @@ python () {
# installation afterwards. However, bootstrap will include the key into
# the rootfs automatically thus the right place is distro_bootstrap_keys.

- if bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')):
+ if bb.utils.to_boolean(d.getVar('ISAR_PREFETCH_BASE_APT')) or \
+ bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')) :
own_pub_key = d.getVar("BASE_REPO_KEY")
if own_pub_key:
distro_bootstrap_keys += own_pub_key.split()
@@ -121,7 +122,8 @@ def get_apt_source_mirror(d, aptsources_entry_list):
# this is executed during parsing. No error checking possible
use_snapshot = bb.utils.to_boolean(d.getVar('ISAR_USE_APT_SNAPSHOT'))
snapshot_mirror = d.getVar('DISTRO_APT_SNAPSHOT_PREMIRROR')
- if bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')):
+ if bb.utils.to_boolean(d.getVar('ISAR_PREFETCH_BASE_APT')) or \
+ bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')) :
premirrors = "\S* file://${REPO_BASE_DIR}/${BOOTSTRAP_BASE_DISTRO}\n"
elif use_snapshot and snapshot_mirror:
premirrors = snapshot_mirror
diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index 77e6aefc..80731c49 100644
--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -61,7 +61,8 @@ ROOTFS_MOUNTS ??= "${REPO_ISAR_DIR}/${DISTRO}:/isar-apt ${WORKDIR}:/isar-work"

python () {
mounts = d.getVar('ROOTFS_MOUNTS', False)
- if bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')) and not ':/base-apt' in mounts:
+ if (bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')) or
+ bb.utils.to_boolean(d.getVar('ISAR_PREFETCH_BASE_APT'))) and not ':/base-apt' in mounts:
base_apt = '{}:/base-apt'.format(d.getVar('REPO_BASE_DIR'))
d.setVar('ROOTFS_MOUNTS', '{} {}'.format(mounts, base_apt))
}
diff --git a/meta/classes-recipe/sbuild.bbclass b/meta/classes-recipe/sbuild.bbclass
index 6db29251..29a8dd71 100644
--- a/meta/classes-recipe/sbuild.bbclass
+++ b/meta/classes-recipe/sbuild.bbclass
@@ -44,7 +44,8 @@ EOF
cp -rf "${SCHROOT_CONF}/sbuild" "${SBUILD_CONF_DIR}"
sbuild_fstab="${SBUILD_CONF_DIR}/fstab"

- if [ "${ISAR_USE_CACHED_BASE_REPO}" = "1" ]; then
+ if [ "${ISAR_USE_CACHED_BASE_REPO}" = "1" ] || \
+ [ "${ISAR_PREFETCH_BASE_APT}" = "1" ]; then
fstab_baseapt="${REPO_BASE_DIR} /base-apt none rw,bind,private 0 0"
grep -qxF "${fstab_baseapt}" ${sbuild_fstab} || echo "${fstab_baseapt}" >> ${sbuild_fstab}
fi
diff --git a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
index 994da174..6f2e47ac 100644
--- a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
+++ b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
@@ -153,7 +153,8 @@ do_bootstrap() {
fi
E="${@ isar_export_proxies(d)}"

- if [ "${ISAR_USE_CACHED_BASE_REPO}" = "1" ]; then
+ if [ "${ISAR_PREFETCH_BASE_APT}" = "1" ] || \
+ [ "${ISAR_USE_CACHED_BASE_REPO}" = "1" ]; then
base_apt_tmp="$(mktemp -d /tmp/isar-base-aptXXXXXXXXXX)"
bootstrap_list="${WORKDIR}/sources.list.d/base-apt.list"
line="copy://$base_apt_tmp/${BOOTSTRAP_BASE_DISTRO} ${BASE_DISTRO_CODENAME} main"
@@ -183,6 +184,8 @@ do_bootstrap() {
\$1/etc/apt/sources.list.d/*.list && \
mkdir -p \$1/base-apt && \
mount -o bind,private '${REPO_BASE_DIR}' \$1/base-apt && \
+ chroot \$1 mv /etc/apt/sources.list.d/0000base-apt.list \
+ /etc/apt/sources.list.d/base-apt.list
chroot \$1 apt-get update -y \
-o APT::Update::Error-Mode=any \
${@'-o APT::Sandbox::User=root' if d.getVar('ISAR_CHROOT_MODE') == 'unshare' else ''} && \
diff --git a/meta/recipes-devtools/base-apt/base-apt.bb b/meta/recipes-devtools/base-apt/base-apt.bb
index 06b1f6c8..05ef9741 100644
--- a/meta/recipes-devtools/base-apt/base-apt.bb
+++ b/meta/recipes-devtools/base-apt/base-apt.bb
@@ -59,9 +59,12 @@ repo() {
"${BASE_DISTRO_CODENAME}" \
"${WORKDIR}/distributions.in" \
"${KEYFILES}"
- populate_base_apt "${BASE_DISTRO}"
- repo_sanity_test "${REPO_BASE_DIR}"/"${BASE_DISTRO}" \
- "${REPO_BASE_DB_DIR}"/"${BASE_DISTRO}"
+ if [ "${ISAR_USE_CACHED_BASE_REPO}" = "1" ] && \
+ [ "${ISAR_PREFETCH_BASE_APT}" != "1" ]; then
+ populate_base_apt "${BASE_DISTRO}"
+ repo_sanity_test "${REPO_BASE_DIR}"/"${BASE_DISTRO}" \
+ "${REPO_BASE_DB_DIR}"/"${BASE_DISTRO}"
+ fi

if [ '${BASE_DISTRO}' != '${HOST_BASE_DISTRO}' ]; then
repo_create "${REPO_BASE_DIR}"/"${HOST_BASE_DISTRO}" \
@@ -69,14 +72,18 @@ repo() {
"${BASE_DISTRO_CODENAME}" \
"${WORKDIR}/distributions.in" \
"${KEYFILES}"
- populate_base_apt "${HOST_BASE_DISTRO}"
- repo_sanity_test "${REPO_BASE_DIR}"/"${HOST_BASE_DISTRO}" \
- "${REPO_BASE_DB_DIR}"/"${HOST_BASE_DISTRO}"
+ if [ "${ISAR_USE_CACHED_BASE_REPO}" = "1" ] && \
+ [ "${ISAR_PREFETCH_BASE_APT}" != "1" ]; then
+ populate_base_apt "${HOST_BASE_DISTRO}"
+ repo_sanity_test "${REPO_BASE_DIR}"/"${HOST_BASE_DISTRO}" \
+ "${REPO_BASE_DB_DIR}"/"${HOST_BASE_DISTRO}"
+ fi
fi
}

python do_cache() {
- if not bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')):
+ if not bb.utils.to_boolean(d.getVar('ISAR_PREFETCH_BASE_APT')) and \
+ not bb.utils.to_boolean(d.getVar('ISAR_USE_CACHED_BASE_REPO')):
return 0

for key in d.getVar('BASE_REPO_KEY').split():
--
2.43.0

[Aliaksei Karpovich]

From: Uladzimir Bely <ub...@ilbers.de>

This is the main utility responsible for prefetching packages
into local `base-apt` repo from external Debian mirrors. It uses
python-apt module and requires some kind of minimal `rootfs` to work
(let's call it "debrepo context").

Once initialized with `--init --workdir=<path>`, it stores the initial
configuration in `repo.opts` file inside the context and uses it at
futher calls.

In future, the logic `debrepo` script implements could be directly
implemented inside bitbake classes.

Signed-off-by: Uladzimir Bely <ub...@ilbers.de>
---
scripts/debrepo | 589 ++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 589 insertions(+)
create mode 100755 scripts/debrepo

diff --git a/scripts/debrepo b/scripts/debrepo
new file mode 100755
index 00000000..81056c3a
--- /dev/null
+++ b/scripts/debrepo
@@ -0,0 +1,589 @@
+#!/usr/bin/env python3
+
+"""
+# This software is a part of Isar.
+# Copyright (C) 2026 ilbers GmbH
+
+# debrepo: build Debian-like repo using "python3-apt" library.
+
+When building the image, Isar downloads required Debian packages from external
+mirrors. After build completed, it can pick all downloaded packages from DL_DIR
+and build local 'base-apt' Debian-like repo from them.
+
+This tool allows to download packages and create local repo in advance. So,
+Isar just uses this local repository and does not interact with external
+mirrors. Such approach makes deb-dl import/export functionality redundant.
+
+Script `debrepo` works in so-called "context" directory. It means some
+rootfs-like directory with bare minimum of directories/files required for
+python3-apt to work.
+
+Context directory path is passed with "--workdir <dir>" command-line option.
+On context creating, all passed parameters are stored in the context directory
+and picked every time the context is used again.
+
+1. Repo for building Debian system
+```
+debrepo --workdir=d12 --init locales gnupg
+```
+Initialize the context in "d12" directory and create a repository in
+"d12/repo/apt" directory sufficient to debootstrap default system
+(e.g., debian-bookworm-amd64). Additionally, packages "locales" and "gnupg"
+with all their dependencies will be available in this repo.
+
+```
+debrepo --workdir=d12 docbook-to-man
+```
+Adds "docbook-to-man" packages with its dependencies to earlier created repo.
+
+```
+debrepo --workdir=d12 --srcmode docbook-to-man
+```
+Downloads source package for "docbook-to-man" and adds it to the repo
+
+2. Repo for building Ubuntu system
+```
+debrepo --init --workdir=uf \
+--distro=ubuntu --codename=focal --arch=arm64 \
+--aptsrcsfile=/work/isar/meta-isar/conf/distro/ubuntu-focal-ports.list \
+--repodir=repo/apt --repodbdir=repo/db \
+--mirror=http://ports.ubuntu.com/ubuntu-ports \
+locales gnupg
+```
+Initialize the context in "uf" directory and create a repository in "repo/apt"
+directory sufficient deboostraup ubuntu-focal arm64 system. Mirror to use and
+source list are specified by corresponding arguments. Packages "locales" and
+" gnupg" with the dependencies will be also placed to the repo.
+
+```
+debrepo --workdir=uf gnupg,locales
+```
+Add "gnupg" and "locales" packages with their dependencies to earlier created
+ubuntu repo. Other parameters (distro, codename, arch) are ommited since they
+are picked from the context.
+
+3. Repo for cross-building Debian system
+```
+debrepo --init --workdir=d11 --codename=bullseye--arch=amd64 --crossarch=armhf
+```
+Initialize the context in "d11" directory sufficient to deboostrap Debian
+Bullseye (amd64) with foreign "armhf" architecture support
+
+```
+debrepo --workdir=d11 gcc
+```
+Add "gcc" package (amd64 version) to earlier created repo.
+
+```
+debrepo --workdir=d11 --crossbuild gcc
+```
+Add "gcc" package (armhf version) to earlier created repo.
+"""
+
+import os
+import sys
+import fcntl
+
+import argparse
+import shutil
+import subprocess
+import pickle
+import urllib.parse
+
+import apt_pkg
+import apt.progress.base
+
+
+REPREPRO_TIMEOUT = 1200
+
+
+class DebRepo(object):
+ class DebRepoCtx(object):
+ def __init__(self, workdir):
+ self.distro = "debian"
+ self.codename = "bullseye"
+ self.arch = "amd64"
+ self.mirror = "http://deb.debian.org/debian"
+
+ self.repodir = f"{workdir}/repo/apt"
+ self.repodbdir = f"{workdir}/repo/db"
+
+ self.crossarch = self.arch
+ self.compatarch = None
+ self.keydir = "/etc/apt/trusted.gpg.d"
+
+ def __init__(self, args):
+ self.workdir = os.path.abspath(args.workdir)
+ self.ctx = self.DebRepoCtx(self.workdir)
+
+ self.cache = None
+ self.depcache = None
+ self.sr = None
+ self.extrarepo = None
+
+ self.ctx_load()
+ self.ctx_update(args)
+ self.ctx_save()
+
+ print(
+ f"ctx workdir: {self.workdir}\n"
+ f" distro: {self.ctx.distro}\n"
+ f" codename: {self.ctx.codename}\n"
+ f" arch: {self.ctx.arch}\n"
+ f" mirror: {self.ctx.mirror}\n"
+ f" repodir: {self.ctx.repodir}\n"
+ f" repodbdir: {self.ctx.repodbdir}\n"
+ f" crossarch: {self.ctx.crossarch}\n"
+ f" compatarch: {self.ctx.compatarch}\n"
+ f" keydir: {self.ctx.keydir}"
+ )
+
+ if args.extrarepo:
+ self.extrarepo = os.path.abspath(args.extrarepo)
+
+ def ctx_load(self):
+ ctxfile = f"{self.workdir}/debrepo.ctx"
+
+ if os.path.isfile(ctxfile):
+ with open(ctxfile, 'rb') as f:
+ self.ctx = pickle.load(f)
+
+ def ctx_save(self):
+ ctxfile = f"{self.workdir}/debrepo.ctx"
+
+ with open(ctxfile, 'wb') as f:
+ pickle.dump(self.ctx, f)
+
+ def ctx_update(self, args):
+ if args.distro:
+ self.ctx.distro = args.distro
+ if args.codename:
+ self.ctx.codename = args.codename
+ if args.arch:
+ self.ctx.arch = args.arch
+ if args.mirror:
+ self.ctx.mirror = args.mirror
+
+ if args.repodir:
+ self.ctx.repodir = os.path.abspath(args.repodir)
+ if args.repodbdir:
+ self.ctx.repodbdir = os.path.abspath(args.repodbdir)
+
+ if args.crossarch:
+ self.ctx.crossarch = args.crossarch
+ if args.compatarch:
+ self.ctx.compatarch = args.compatarch
+ if args.keydir:
+ self.ctx.keydir = args.keydir
+
+ def create_rootfs(self, aptsrcsfile):
+ os.makedirs(f"{self.workdir}/var/lib/dpkg", exist_ok=True)
+ with open(f"{self.workdir}/var/lib/dpkg/status", "w"):
+ pass
+
+ os.makedirs(f"{self.workdir}/etc/apt/sources.list.d", exist_ok=True)
+
+ srcfile = f"{self.workdir}/etc/apt/sources.list.d/bootstrap.list"
+ if aptsrcsfile and os.path.exists(aptsrcsfile):
+ shutil.copy(aptsrcsfile, srcfile)
+ else:
+ with open(srcfile, "w") as f:
+ repo = f"{self.ctx.mirror} {self.ctx.codename} main"
+ f.write(f"deb {repo}\n")
+ f.write(f"deb-src {repo}\n")
+
+ dir_cache = f"../apt_cache/{self.ctx.distro}-{self.ctx.codename}"
+ os.makedirs(f"{self.workdir}/{dir_cache}/archives/partial",
+ exist_ok=True)
+
+ os.makedirs(f"{self.workdir}/tmp", exist_ok=True)
+
+ def create_repo_dist(self):
+ conf_dir = f"{self.ctx.repodir}/{self.ctx.distro}/conf"
+ os.makedirs(conf_dir, exist_ok=True)
+ if not os.path.exists(f"{conf_dir}/distributions"):
+ with open(f"{conf_dir}/distributions", "w") as f:
+ f.write(f"Codename: {self.ctx.codename}\n")
+ f.write(
+ "Architectures: "
+ "i386 armhf arm64 amd64 mipsel riscv64 source\n")
+ f.write("Components: main\n")
+
+ def apt_config(self, init, crossbuild):
+ if not init and self.ctx.compatarch:
+ apt_pkg.config["APT::Architectures::"] = self.ctx.compatarch
+
+ if not init and self.ctx.arch != self.ctx.crossarch:
+ apt_pkg.config["APT::Architectures::"] = self.ctx.crossarch
+ apt_pkg.config["APT::Architectures::"] = self.ctx.arch
+
+ apt_pkg.config.set("APT::Architecture", self.ctx.arch)
+
+ apt_pkg.config.set("Dir", self.workdir)
+
+ dir_cache = f"../apt_cache/{self.ctx.distro}-{self.ctx.codename}"
+ apt_pkg.config.set("Dir::Cache", f"{self.workdir}/{dir_cache}")
+ apt_pkg.config.set("Dir::State::status",
+ f"{self.workdir}/var/lib/dpkg/status")
+
+ apt_pkg.config.set("APT::Install-Recommends", "0")
+ apt_pkg.config.set("APT::Install-Suggests", "0")
+
+ # Use host keys for authentification
+ apt_pkg.config.set("Dir::Etc::TrustedParts", self.ctx.keydir)
+
+ # Allow using repositories without keys
+ apt_pkg.config.set("Acquire::AllowInsecureRepositories", "1")
+
+ def mark_essential(self):
+ for pkg in self.cache.packages:
+ if pkg.architecture == self.ctx.arch:
+ if pkg.essential:
+ self.depcache.mark_install(pkg)
+
+ def mark_by_prio(self, priority):
+ for pkg in self.cache.packages:
+ if pkg.architecture == self.ctx.arch:
+ ver = self.depcache.get_candidate_ver(pkg)
+ if ver and ver.priority <= priority:
+ self.depcache.mark_install(pkg)
+
+ def mark_pkg(self, name, crossbuild):
+ pkgname = name
+
+ if pkgname and (pkgname not in self.cache):
+ # Try for cross arch
+ if (pkgname, self.ctx.crossarch) in self.cache:
+ pkgname += f":{self.ctx.crossarch}"
+
+ if pkgname not in self.cache:
+ print(f"Error: package '{name}' not found")
+ return False
+
+ pkg = self.cache[pkgname]
+
+ if (not crossbuild) or (':' in pkgname) or (not pkg.has_versions):
+ if (pkg.has_provides) and (not pkg.has_versions):
+ print("pkgname is virtual package, selecting best provide")
+ # Select first provide
+ pkg_provide = pkg.provides_list[0][2]
+ # Find better provide with higher version
+ for provide in pkg.provides_list:
+ if apt_pkg.version_compare(provide[2].ver_str,
+ pkg_provide.ver_str) > 0:
+ pkg_provide = provide[2]
+ self.depcache.mark_install(pkg_provide.parent_pkg)
+ else:
+ self.depcache.mark_install(pkg)
+ else:
+ version = pkg.version_list[0]
+ if version.arch == "all":
+ self.depcache.mark_install(pkg)
+ else:
+ if version.multi_arch == version.MULTI_ARCH_FOREIGN:
+ if (pkgname, self.ctx.arch) in self.cache:
+ nativepkg = self.cache[pkgname, self.ctx.arch]
+ self.depcache.mark_install(nativepkg)
+ else:
+ return False
+ else:
+ if (pkgname, self.ctx.crossarch) in self.cache:
+ crosspkg = self.cache[pkgname, self.ctx.crossarch]
+ self.depcache.mark_install(crosspkg)
+ else:
+ return False
+
+ return True
+
+ def mark_list(self, pkglist, crossbuild):
+ ret = True
+ if pkglist:
+ for pkgname in pkglist:
+ ret = ret and self.mark_pkg(pkgname, crossbuild)
+
+ return ret
+
+ def handle_deb(self, item):
+ fd = open(f"{self.ctx.repodir}/repo.lock", 'w')
+ fcntl.flock(fd, fcntl.LOCK_EX)
+ subprocess.run([
+ "reprepro",
+ "--dbdir", f"{self.ctx.repodbdir}/{self.ctx.distro}",
+ "--outdir", f"{self.ctx.repodir}/{self.ctx.distro}",
+ "--confdir", f"{self.ctx.repodir}/{self.ctx.distro}/conf",
+ "-C", "main",
+ "includedeb",
+ self.ctx.codename,
+ item.destfile
+ ], timeout=REPREPRO_TIMEOUT)
+ fd.close()
+
+ def handle_repo(self, fetcher):
+ dir_cache = f"../apt_cache/{self.ctx.distro}-{self.ctx.codename}"
+ fd = open(f"{self.workdir}/{dir_cache}.lock", "w")
+ fcntl.flock(fd, fcntl.LOCK_EX)
+ fetcher.run()
+ fd.close()
+ for item in fetcher.items:
+ if item.status == item.STAT_ERROR:
+ print("Some error ocured: '%s'" % item.error_text)
+ pass
+ else:
+ self.handle_deb(item)
+
+ def get_filename(self, uri):
+ path = urllib.parse.urlparse(uri).path
+ unquoted_path = urllib.parse.unquote(path)
+ basename = os.path.basename(unquoted_path)
+ return basename
+
+ def fetch_file(self, uri):
+ filename = self.get_filename(uri)
+ subprocess.run([
+ "wget",
+ "-H",
+ "--timeout=30",
+ "--tries=3",
+ "-nv",
+ uri,
+ "-O",
+ f"{self.workdir}/tmp/{filename}"
+ ],
+ stdout=subprocess.PIPE)
+
+ def handle_dsc(self, uri):
+ filename = self.get_filename(uri)
+ fd = open(f"{self.ctx.repodir}/repo.lock", 'w')
+ fcntl.flock(fd, fcntl.LOCK_EX)
+ subprocess.run([
+ "reprepro",
+ "--dbdir", f"{self.ctx.repodbdir}/{self.ctx.distro}",
+ "--outdir", f"{self.ctx.repodir}/{self.ctx.distro}",
+ "--confdir", f"{self.ctx.repodir}/{self.ctx.distro}/conf",
+ "-C", "main",
+ "-S", "-", "-P" "source",
+ "--delete",
+ "includedsc",
+ self.ctx.codename,
+ os.path.realpath(f"{self.workdir}/tmp/{filename}")
+ ], timeout=REPREPRO_TIMEOUT)
+ fd.close()
+
+ def handle_src_list(self, pkgs):
+ if pkgs:
+ fetched_files = []
+ for pkg in pkgs:
+ pkgname = pkg
+ pkgver = ""
+ if '=' in pkg:
+ pkgname = pkg.split("=")[0]
+ pkgver = pkg.split("=")[1]
+
+ self.sr.restart()
+ while self.sr.lookup(pkgname):
+ if pkgver and pkgver != self.sr.version:
+ continue
+
+ for sr_file in self.sr.files:
+ print(self.sr.index.archive_uri(sr_file[2]))
+ filename = os.path.basename(sr_file.path)
+ if filename not in fetched_files:
+ self.fetch_file(self.sr.index.archive_uri(sr_file[2]))
+ fetched_files.append(filename)
+
+ dsc_uri = self.sr.index.archive_uri(self.sr.files[0][2])
+ self.handle_dsc(dsc_uri)
+ break
+
+ def apt_run(self, init, srcmode, pkgs, dscfile, crossbuild):
+ apt_pkg.init()
+
+ extrarepo_list = f"{self.workdir}/etc/apt/sources.list.d/extrarepo.list"
+ if self.extrarepo:
+ extrarepo_list = f"{self.workdir}/etc/apt/sources.list.d/extrarepo.list"
+ with open(extrarepo_list, "w") as f:
+ distdir=os.path.join(self.extrarepo, "dists")
+ if os.path.isdir(distdir):
+ for dist in os.listdir(distdir):
+ repodir = os.path.join(distdir,dist)
+ if os.path.isdir(repodir):
+ for repo in os.listdir(repodir):
+ if os.path.isdir(os.path.join(repodir, repo)):
+ f.write(f"deb file://{self.extrarepo} "
+ f"{dist} {repo}\n")
+
+ sources = apt_pkg.SourceList()
+ sources.read_main_list()
+
+ progress = apt.progress.text.AcquireProgress()
+
+ self.cache = apt_pkg.Cache()
+ if init:
+ self.cache.update(progress, sources)
+ self.cache = apt_pkg.Cache()
+
+ if self.extrarepo:
+ apt_pkg.config.set("Dir::Etc::SourceList", extrarepo_list)
+ apt_pkg.config.set("APT::Get::List-Cleanup", "0")
+ self.cache.update(progress, sources)
+ self.cache = apt_pkg.Cache()
+ os.remove(extrarepo_list)
+
+ self.depcache = apt_pkg.DepCache(self.cache)
+ self.sr = apt_pkg.SourceRecords()
+
+ ret = True
+
+ if init:
+ self.mark_essential()
+ # 1(required), 2(important), 3(standard), 4(optional), 5(extra)
+ self.mark_by_prio(1)
+
+ pkgs = list(filter(None, ','.join(pkgs).split(',')))
+ if srcmode:
+ self.handle_src_list(set(pkgs))
+ else:
+ ret = self.mark_list(pkgs, crossbuild)
+
+ if dscfile:
+ fobj = open(dscfile, "r")
+
+ try:
+ tagfile = apt_pkg.TagFile(fobj)
+ while tagfile.step() == 1:
+ deps = tagfile.section.get("Build-Depends", "")
+ # Remove extra commas and spaces - apt_pkg.parse_src_depends
+ # doesnt like lines like ", device-tree-compiler"
+ deps = ', '.join(
+ [s.strip() for s in deps.split(',') if s.strip()]
+ )
+ print(f"parsed deps: {deps}")
+ for item in apt_pkg.parse_src_depends(deps, False):
+ pkgname = item[0][0]
+ self.mark_pkg(pkgname, crossbuild)
+
+ finally:
+ fobj.close()
+
+ if not ret:
+ sys.exit("Some of requested packages not found")
+
+ if init or not srcmode:
+ fetcher = apt_pkg.Acquire(progress)
+ pm = apt_pkg.PackageManager(self.depcache)
+
+ recs = apt_pkg.PackageRecords(self.cache)
+ pm.get_archives(fetcher, sources, recs)
+
+ self.handle_repo(fetcher)
+
+
+def parse_arguments():
+ parser = argparse.ArgumentParser()
+ parser.add_argument(
+ "--init",
+ default=False, action="store_true",
+ help="initialize context in WORKDIR")
+ parser.add_argument(
+ "--workdir",
+ type=str, required=True,
+ help="work directory storing debrepo context")
+ parser.add_argument(
+ "--aptsrcsfile",
+ type=str, metavar="PATH",
+ help="sources.list file to use when init")
+ parser.add_argument(
+ "--srcmode",
+ default=False, action="store_true",
+ help="add source packages instead of debs")
+ parser.add_argument(
+ "--repodir",
+ type=str, metavar="REPO",
+ help="repository directory")
+ parser.add_argument(
+ "--repodbdir",
+ type=str, metavar="REPODB",
+ help="repository database directory")
+ parser.add_argument(
+ "--extrarepo",
+ type=str, metavar="REPO",
+ help="extra repository to consider")
+ parser.add_argument(
+ "--mirror",
+ type=str,
+ help="use custom distro mirror")
+ parser.add_argument(
+ "--distro",
+ type=str,
+ help="select distro to use")
+ parser.add_argument(
+ "--codename",
+ type=str,
+ help="distro codename")
+ parser.add_argument(
+ "--arch",
+ type=str,
+ help="distro arch")
+ parser.add_argument(
+ "--compatarch",
+ type=str, metavar="ARCH",
+ help="compat arch to use")
+ parser.add_argument(
+ "--crossarch",
+ type=str, metavar="ARCH",
+ help="cross-build arch")
+ parser.add_argument(
+ "--keydir",
+ type=str,
+ help="directory with distro keys")
+ parser.add_argument(
+ "--no-check-gpg",
+ default=False, action="store_true",
+ help="allow insecure repositories")
+ parser.add_argument(
+ "--dscfile",
+ type=str, metavar="PATH",
+ help="Debian source file to parse")
+ parser.add_argument(
+ "--crossbuild",
+ default=False, action="store_true",
+ help="add packages with cross arch")
+
+ parser.add_argument(
+ "packages",
+ nargs='*', type=str,
+ help="space- or comma-separated list of packages to add")
+
+ args = parser.parse_args()
+
+ return args
+
+
+def main():
+ args = parse_arguments()
+
+ if not (args.init or args.packages or args.dscfile):
+ sys.exit("Nothing to do")
+
+ workdir = os.path.abspath(args.workdir)
+ os.makedirs(workdir, exist_ok=True)
+
+ with open(f"{workdir}/debrepo.lock", "a") as file:
+ fcntl.flock(file.fileno(), fcntl.LOCK_EX)
+
+ debrepo = DebRepo(args)
+
+ if args.init:
+ debrepo.create_rootfs(args.aptsrcsfile)
+ debrepo.create_repo_dist()
+
+ debrepo.apt_config(args.init, args.crossbuild)
+ debrepo.apt_run(args.init, args.srcmode, args.packages,
+ args.dscfile, args.crossbuild)
+
+ #Unlock debrepo context
+ fcntl.flock(file.fileno(), fcntl.LOCK_UN)
+
+
+if __name__ == "__main__":
+ main()
--
2.43.0

[Aliaksei Karpovich]

From: Uladzimir Bely <ub...@ilbers.de>

This patch uses debrepo script to predownload packages to base-apt
repository before they are installed in rootfs.

Signed-off-by: Uladzimir Bely <ub...@ilbers.de>
---

meta/classes-recipe/crossvars.bbclass | 1 +
meta/classes-recipe/dpkg-base.bbclass | 1 +
meta/classes-recipe/dpkg.bbclass | 8 +++++++
.../image-locales-extension.bbclass | 5 +++++
.../image-tools-extension.bbclass | 13 +++++++++++
meta/classes-recipe/rootfs.bbclass | 5 ++++-
meta/lib/aptsrc_fetcher.py | 22 +++++++++++++++++++
.../sbuild-chroot/sbuild-chroot-host.bb | 2 ++
8 files changed, 56 insertions(+), 1 deletion(-)

diff --git a/meta/classes-recipe/crossvars.bbclass b/meta/classes-recipe/crossvars.bbclass
index 7cf2d660..6f070714 100644
--- a/meta/classes-recipe/crossvars.bbclass
+++ b/meta/classes-recipe/crossvars.bbclass
@@ -30,6 +30,7 @@ python __anonymous() {
schroot_dir = d.getVar('SCHROOT_HOST_DIR', False)
sbuild_dep = "sbuild-chroot-host" + flavor_suffix + ":do_build"
sdk_toolchain = "crossbuild-essential-" + distro_arch
+ d.setVar('DEBREPO_WORKDIR', d.getVar('DEBREPO_HOST_DIR'))
else:
d.setVar('BUILD_ARCH', distro_arch)
schroot_dir = d.getVar('SCHROOT_TARGET_DIR', False)
diff --git a/meta/classes-recipe/dpkg-base.bbclass b/meta/classes-recipe/dpkg-base.bbclass
index e2ed4dfb..cda3bd2b 100644
--- a/meta/classes-recipe/dpkg-base.bbclass
+++ b/meta/classes-recipe/dpkg-base.bbclass
@@ -11,6 +11,7 @@ inherit terminal
inherit repository
inherit deb-dl-dir
inherit essential
+inherit debrepo

DEPLOYDIR = "${WORKDIR}/deploy"

diff --git a/meta/classes-recipe/dpkg.bbclass b/meta/classes-recipe/dpkg.bbclass
index 1b2616db..e885a743 100644
--- a/meta/classes-recipe/dpkg.bbclass
+++ b/meta/classes-recipe/dpkg.bbclass
@@ -111,6 +111,12 @@ dpkg_runbuild() {
echo '$stalled_pkg_timeout = ${DPKG_BUILD_TIMEOUT};' >> ${SBUILD_CONFIG}

DSC_FILE=$(find ${WORKDIR} -maxdepth 1 -name "${DEBIAN_SOURCE}_*.dsc" -print)
+ debrepo_parse_dscfile "${DSC_FILE}"
+
+ locked_update_cmd=":"
+ if [ "${ISAR_PREFETCH_BASE_APT}" = "1" ]; then
+ locked_update_cmd="flock -x /base-apt/repo.lock -c 'apt-get -y update'"
+ fi

sbuild -n -c ${SBUILD_CHROOT} \
--chroot-mode=${ISAR_CHROOT_MODE} \
@@ -124,9 +130,11 @@ dpkg_runbuild() {
--chroot-setup-commands="rm -f /var/log/dpkg.log" \
--chroot-setup-commands="mkdir -p ${deb_dir}" \
--chroot-setup-commands="find ${ext_deb_dir} -maxdepth 1 -name '*.deb' -exec ln -t ${deb_dir}/ -sf {} +" \
+ --chroot-setup-commands="${locked_update_cmd}" \
--chroot-setup-commands="apt-get update -o Dir::Etc::SourceList=\"sources.list.d/isar-apt.list\" -o Dir::Etc::SourceParts=\"-\" -o APT::Get::List-Cleanup=\"0\"" \
--finished-build-commands="rm -f ${deb_dir}/sbuild-build-depends-*-dummy_*.deb" \
--finished-build-commands="find ${deb_dir} -maxdepth 1 -type f -name '*.deb' -print -exec cp ${CP_FLAGS} -t ${ext_deb_dir}/ {} +" \
+ --finished-build-commands="mkdir -p ${ext_root}" \
${@ '--finished-build-commands="cp /var/log/dpkg.log $ext_root/dpkg_partial.log"' if d.getVar('ISAR_CHROOT_MODE') == 'schroot' else '' } \
--build-path="" --build-dir=${WORKDIR} --dist="${DEBDISTRONAME}" ${DSC_FILE}

diff --git a/meta/classes-recipe/image-locales-extension.bbclass b/meta/classes-recipe/image-locales-extension.bbclass
index c03f34c0..32b5e19c 100644
--- a/meta/classes-recipe/image-locales-extension.bbclass
+++ b/meta/classes-recipe/image-locales-extension.bbclass
@@ -6,6 +6,8 @@
# This class extends the image.bbclass for setting locales and purging unneeded
# ones.

+inherit debrepo
+
LOCALE_GEN ?= "en_US.UTF-8 UTF-8\n\
en_US ISO-8859-1\n"
LOCALE_DEFAULT ?= "en_US.UTF-8"
@@ -29,6 +31,9 @@ ROOTFS_INSTALL_COMMAND_BEFORE_EXPORT += "image_install_localepurge_download"
image_install_localepurge_download[weight] = "40"
image_install_localepurge_download[network] = "${TASK_USE_NETWORK_AND_SUDO}"
image_install_localepurge_download() {
+ debrepo_add_packages "${DEBREPO_WORKDIR}" "localepurge"
+ debrepo_update_apt_source_list "${ROOTFSDIR}" "base-apt"
+
run_privileged_heredoc <<'EOF'
set -e
${@insert_isar_mounts(d, d.getVar('ROOTFSDIR'), d.getVar('ROOTFS_MOUNTS') if d.getVar('ISAR_CHROOT_MODE') == 'unshare' else '')}
diff --git a/meta/classes-recipe/image-tools-extension.bbclass b/meta/classes-recipe/image-tools-extension.bbclass
index c75025ca..78118e8b 100644
--- a/meta/classes-recipe/image-tools-extension.bbclass
+++ b/meta/classes-recipe/image-tools-extension.bbclass
@@ -6,6 +6,11 @@
# This file extends the image.bbclass to supply tools for futher imager functions

inherit sbuild
+inherit debrepo
+
+python __anonymous() {
+ d.setVar('DEBREPO_WORKDIR', d.getVar('DEBREPO_TARGET_DIR'))
+}

IMAGER_INSTALL ??= ""
IMAGER_BUILD_DEPS ??= ""
@@ -50,12 +55,20 @@ imager_run_schroot() {
echo "Installing imager deps: ${local_install}"

distro="${BASE_DISTRO}-${BASE_DISTRO_CODENAME}"
+ debrepo_workdir=${DEBREPO_TARGET_DIR}
if [ ${ISAR_CROSS_COMPILE} -eq 1 ]; then
distro="${HOST_BASE_DISTRO}-${BASE_DISTRO_CODENAME}"
+ if [ ${HOST_ARCH} != ${DISTRO_ARCH} ]; then
+ debrepo_workdir=${DEBREPO_HOST_DIR}
+ fi

fi

E="${@ isar_export_proxies(d)}"

deb_dl_dir_import ${schroot_dir} ${distro}
+
+ debrepo_add_packages --isarapt "${debrepo_workdir}" "${local_install}"
+ debrepo_update_apt_source_list "${schroot_dir}" "base-apt"
+
${SCRIPTSDIR}/lockrun.py -r -f "${REPO_ISAR_DIR}/isar.lock" -s <<EOAPT
schroot -r -c ${session_id} -d / -u root -- sh -c " \
apt-get update \
diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index 80731c49..3ca46bb6 100644
--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -2,7 +2,7 @@
# Copyright (c) Siemens AG, 2020

inherit deb-dl-dir
-
+inherit debrepo
inherit sbom

ROOTFS_ARCH ?= "${DISTRO_ARCH}"
@@ -343,6 +343,9 @@ rootfs_install_pkgs_download[progress] = "custom:rootfs_progress.PkgsDownloadPro
rootfs_install_pkgs_download[isar-apt-lock] = "release-after"
rootfs_install_pkgs_download[network] = "${TASK_USE_NETWORK}"
rootfs_install_pkgs_download() {
+ debrepo_add_packages --isarapt "${DEBREPO_WORKDIR}" "${ROOTFS_PACKAGES}"
+ debrepo_update_apt_source_list "${ROOTFSDIR}" "base-apt"
+
# download packages using apt in a non-privileged namespace
rootfs_cmd --bind "${ROOTFSDIR}/var/cache/apt/archives" /var/cache/apt/archives \
${ROOTFSDIR} \
diff --git a/meta/lib/aptsrc_fetcher.py b/meta/lib/aptsrc_fetcher.py
index 49f12075..ce9631dc 100644
--- a/meta/lib/aptsrc_fetcher.py
+++ b/meta/lib/aptsrc_fetcher.py
@@ -43,9 +43,21 @@ class AptSrcSchroot(AptSrc):
repo_isar_dir = d.getVar('REPO_ISAR_DIR')
lockfile = bb.utils.lockfile(f'{repo_isar_dir}/isar.lock')

+ debrepo_target_dir = d.getVar('DEBREPO_TARGET_DIR')
+ isar_prefetch_base_apt = d.getVar('ISAR_PREFETCH_BASE_APT')
+ repo_base_dir = d.getVar('REPO_BASE_DIR')
+ scriptsdir = d.getVar('SCRIPTSDIR')
+
try:
runfetchcmd(f'''
set -e
+ if [ "{isar_prefetch_base_apt}" = "1" ]; then
+ {scriptsdir}/debrepo --workdir={debrepo_target_dir} --srcmode "{ud.src_package}"
+ flock -x "{repo_base_dir}/repo.lock" -c "
+ schroot -r -c {session_id} -d / -u root -- \
+ sh -c 'apt-get -y update -o Dir::Etc::SourceList=\"sources.list.d/base-apt.list\" -o Dir::Etc::SourceParts=\"-\" '
+ "
+ fi
schroot -r -c {session_id} -d / -u root -- \
rm /etc/apt/sources.list.d/isar-apt.list /etc/apt/preferences.d/isar-apt
schroot -r -c {session_id} -d / -- \
@@ -72,9 +84,19 @@ class AptSrcSchroot(AptSrc):

pp = d.getVar('PP')
pps = d.getVar('PPS')
+
+ isar_prefetch_base_apt = d.getVar('ISAR_PREFETCH_BASE_APT')
+ repo_base_dir = d.getVar('REPO_BASE_DIR')
+
try:
runfetchcmd(f'''
set -e
+ if [ "{isar_prefetch_base_apt}" = "1" ]; then
+ flock -x "{repo_base_dir}/repo.lock" -c "
+ schroot -r -c {session_id} -d / -u root -- \
+ sh -c 'apt-get -y update -o Dir::Etc::SourceList=\"sources.list.d/base-apt.list\" -o Dir::Etc::SourceParts=\"-\" '
+ "
+ fi
schroot -r -c {session_id} -d / -u root -- \
rm /etc/apt/sources.list.d/isar-apt.list /etc/apt/preferences.d/isar-apt
schroot -r -c {session_id} -d / -- \
diff --git a/meta/recipes-devtools/sbuild-chroot/sbuild-chroot-host.bb b/meta/recipes-devtools/sbuild-chroot/sbuild-chroot-host.bb
index 3e66a7f4..85688551 100644
--- a/meta/recipes-devtools/sbuild-chroot/sbuild-chroot-host.bb
+++ b/meta/recipes-devtools/sbuild-chroot/sbuild-chroot-host.bb
@@ -18,3 +18,5 @@ SBUILD_CHROOT_PREINSTALL ?= " \
crossbuild-essential-${DISTRO_ARCH} \
apt-utils \
"
+
+DEBREPO_WORKDIR = "${DEBREPO_HOST_DIR}"
--
2.43.0

[Aliaksei Karpovich]

From: Uladzimir Bely <ub...@ilbers.de>

Fill base-apt repo with source packages.

Signed-off-by: Uladzimir Bely <ub...@ilbers.de>
Signed-off-by: Aliaksei Karpovich <akarp...@ilbers.de>
---

meta/classes-recipe/deb-dl-dir.bbclass | 45 ++++++++++++++++++++++++++
meta/classes-recipe/rootfs.bbclass | 7 ++++
2 files changed, 52 insertions(+)

diff --git a/meta/classes-recipe/deb-dl-dir.bbclass b/meta/classes-recipe/deb-dl-dir.bbclass
index 60e2fecc..39c77151 100644
--- a/meta/classes-recipe/deb-dl-dir.bbclass
+++ b/meta/classes-recipe/deb-dl-dir.bbclass
@@ -27,6 +27,51 @@ debsrc_source_version_filter() {
| sort -u
}

+debsrc_fill_base_apt() {
+ export rootfs="$1"
+ export rootfs_distro="$2"
+ mkdir -p "${DEBSRCDIR}"/"${rootfs_distro}"
+
+ debsrc_do_mounts "${rootfs}"
+
+ trap 'exit 1' INT HUP QUIT TERM ALRM USR1
+ trap 'debsrc_undo_mounts "${rootfs}"' EXIT
+
+ ( flock 9
+ set -e
+ printenv | grep -q BB_VERBOSE_LOGS && set -x
+
+ # We need temporary files for our lists of source packages
+ # trap exit of this sub-shell to remove them (this script may exit abruptly
+ # since "set -e" is used)
+ avail=$(mktemp)
+ wanted=$(mktemp)
+ trap "rm -f ${avail} ${wanted}" EXIT
+
+ # List all packages known to apt
+ run_privileged chroot --userspec=$( id -u ):$( id -g ) ${rootfs} \
+ apt-cache dumpavail \
+ | debsrc_source_version_filter > ${avail}
+
+ # Use apt-ftparchive to scan all .deb files found in the download directory
+ # and get the <source> <version> pairs that we wish to download
+ apt-ftparchive --md5=no --sha1=no --sha256=no --sha512=no \
+ -a "${DISTRO_ARCH}" packages \
+ "${REPO_BASE_DIR}" \
+ | debsrc_source_version_filter > ${wanted}
+
+ # We now have two sorted lists: source packages we want and those known to
+ # apt. We will only consider source packages that may be found in both.
+ comm -12 ${wanted} ${avail} \
+ | while read src version; do
+ debrepo_add_packages --srcmode "${DEBREPO_TARGET_DIR}" "${src}=${version}"
+ done
+
+ ) 9>"${DEBSRCDIR}/${rootfs_distro}.lock"
+
+ debsrc_undo_mounts "${rootfs}"
+}
+
debsrc_download() {
export rootfs="$1"
export rootfs_distro="$2"
diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index 3ca46bb6..5a66b4ca 100644
--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -495,6 +495,13 @@ do_cache_deb_src() {
run_privileged tar -xf "${BOOTSTRAP_SRC}" ./var/lib/apt/lists --one-top-level="${ROOTFSDIR}"

deb_dl_dir_import ${ROOTFSDIR} ${ROOTFS_BASE_DISTRO}-${BASE_DISTRO_CODENAME}
+
+ debsrc_fill_base_apt ${ROOTFSDIR} ${ROOTFS_BASE_DISTRO}-${BASE_DISTRO_CODENAME}
+
+ rootfs_do_mounts

+ debrepo_update_apt_source_list "${ROOTFSDIR}" "base-apt"

+ rootfs_do_umounts
+
debsrc_download ${ROOTFSDIR} ${ROOTFS_BASE_DISTRO}-${BASE_DISTRO_CODENAME}

run_privileged rm -f "${ROOTFSDIR}"/etc/resolv.conf
--
2.43.0

[Aliaksei Karpovich]

From: Uladzimir Bely <ub...@ilbers.de>

This makes Isar use `base-apt` repo in different way. Any package
installation is done from `base-apt` repo which is prepopulated
from external mirrors.

This behaviour is disabled by default for downstreams. To enable it,
set the variable to "1", like isar does in local.conf.sample.

In order to be able to run CI in old mode, allow CI read the option
from the environment. Also, adjust some tests (like repro one) to
make them work with ISAR_PREFETCH_BASE_APT set.

Signed-off-by: Uladzimir Bely <ub...@ilbers.de>
---

meta-test/conf/local.conf.sample | 3 +++
testsuite/cibase.py | 4 ++++
testsuite/cibuilder.py | 7 +++++++
3 files changed, 14 insertions(+)

diff --git a/meta-test/conf/local.conf.sample b/meta-test/conf/local.conf.sample
index 2dbe28f1..74ee90b1 100644
--- a/meta-test/conf/local.conf.sample
+++ b/meta-test/conf/local.conf.sample
@@ -27,6 +27,9 @@ BB_DISKMON_DIRS = "\
MIRRORS ?= "git?://salsa\.debian\.org/debian/.* git://github.com/ilbers/BASENAME"
MIRRORS += "https?://cdn\.kernel\.org/.* https://mirrors.edge.kernel.org/PATH"

+# Use new base-apt behaviour
+ISAR_PREFETCH_BASE_APT ?= "1"
+
# Users and groups
USERS += "root"
USER_root[password] ??= "$6$rounds=10000$RXeWrnFmkY$DtuS/OmsAS2cCEDo0BF5qQsizIrq6jPgXnwv3PHqREJeKd1sXdHX/ayQtuQWVDHe0KIO0/sVH8dvQm1KthF0d/"
diff --git a/testsuite/cibase.py b/testsuite/cibase.py
index 4a6308d0..348b8cde 100755
--- a/testsuite/cibase.py
+++ b/testsuite/cibase.py
@@ -71,10 +71,14 @@ class CIBaseTest(CIBuilder):
self.fail("GPG import failed")

try:
+ self.move_in_build_dir('tmp', 'tmp_before_repro')
self.bitbake(targets, **kwargs)

repro_type = 'signed' if signed else 'unsigned'
self.move_in_build_dir('tmp', f"tmp_middle_repro_{repro_type}")
+
+ os.makedirs(f"{self.build_dir}/tmp/deploy/")
+ self.move_in_build_dir(f"tmp_middle_repro_{repro_type}/deploy/base-apt", 'tmp/deploy/base-apt')
self.configure(
gpg_pub_key=gpg_pub_key if signed else None,
offline=True,
diff --git a/testsuite/cibuilder.py b/testsuite/cibuilder.py
index d42e8631..34aed471 100755
--- a/testsuite/cibuilder.py
+++ b/testsuite/cibuilder.py
@@ -161,6 +161,10 @@ class CIBuilder(Test):
fail_on_cleanup = os.getenv('ISAR_FAIL_ON_CLEANUP')

strlines = None if lines is None else '\\n'.join(lines)
+
+ # get prefetch base apt mode from environment
+ prefetch_base_apt = os.getenv('ISAR_PREFETCH_BASE_APT')
+
self.log.info(
f"===================================================\n"
f"Configuring build_dir {self.build_dir}\n"
@@ -184,6 +188,7 @@ class CIBuilder(Test):
f" generate_sbom = {generate_sbom}\n"
f" rootless = {rootless}\n"
f" lines = {strlines}\n"
+ f" prefetch_base_apt = {prefetch_base_apt}\n"
f"==================================================="
)

@@ -288,6 +293,8 @@ class CIBuilder(Test):
f.write('ISAR_ROOTLESS = "1"\n')
if lines is not None:
f.writelines((line + '\n' if not line.endswith('\n') else line) for line in lines)
+ if prefetch_base_apt == "0":
+ f.write('ISAR_PREFETCH_BASE_APT = "0"\n')

# include ci_build.conf in local.conf
with open(self.build_dir + '/conf/local.conf', 'r+') as f:
--
2.43.0

[Aliaksei Karpovich]

From: Uladzimir Bely <ub...@ilbers.de>

This patch makes local base-apt repo to be created before
bootstrap task. So, bootstrap is then done from it.

The required packages are downloaded via python-apt and
reprepro creates debian-like repository from .deb files.

For debian targets host keyring is used while ubuntu/raspbian
targets use keys specified by DISTRO_BOOTSTRAP_KEYS variable.

The goal is have workable base-apt repo before first build completed.

Signed-off-by: Uladzimir Bely <ub...@ilbers.de>
Signed-off-by: Aliaksei Karpovich <akarp...@ilbers.de>
---

meta/classes-recipe/bootstrap.bbclass | 44 +++++++++++++++++++
.../isar-mmdebstrap/isar-mmdebstrap-host.bb | 2 +
.../isar-mmdebstrap/isar-mmdebstrap.inc | 2 +
3 files changed, 48 insertions(+)

diff --git a/meta/classes-recipe/bootstrap.bbclass b/meta/classes-recipe/bootstrap.bbclass
index f853a932..21948742 100644
--- a/meta/classes-recipe/bootstrap.bbclass
+++ b/meta/classes-recipe/bootstrap.bbclass
@@ -16,6 +16,7 @@ BOOTSTRAP_FOR_HOST ?= "0"

APTPREFS = "${WORKDIR}/apt-preferences"
APTSRCS = "${WORKDIR}/apt-sources"
+APTSRCS_INIT = "${WORKDIR}/apt-sources-init"
DISTRO_BOOTSTRAP_KEYFILES = ""
THIRD_PARTY_APT_KEYFILES = ""
DISTRO_BOOTSTRAP_KEYS ?= ""
@@ -223,8 +224,51 @@ python do_apt_config_prepare() {
aggregate_files(d, apt_preferences_list, apt_preferences_out)

apt_sources_out = d.getVar("APTSRCS")
+ apt_sources_init_out = d.getVar("APTSRCS_INIT")
apt_sources_list = get_aptsources_list(d)

+ aggregate_files(d, apt_sources_list, apt_sources_init_out)
aggregate_aptsources_list(d, apt_sources_list, apt_sources_out)
}
addtask apt_config_prepare before do_bootstrap after do_unpack
+
+inherit debrepo
+
+debrepo_bootstrap_prepare() {
+ [ "${ISAR_PREFETCH_BASE_APT}" != "1" ] && return
+ [ "${ISAR_USE_CACHED_BASE_REPO}" = "1" ] && return
+
+ debrepo_args=""
+ if [ "${BASE_DISTRO}" != "debian" ]; then
+ if [ "${BASE_DISTRO}" != "raspbian" ] && [ "${BASE_DISTRO}" != "raspios" ] || [ "${BOOTSTRAP_FOR_HOST}" = "0" ]; then
+ debrepo_args="$debrepo_args --keydir=${WORKDIR}"
+ fi
+ else
+ if [ "${BASE_DISTRO_CODENAME}" = "sid" ]; then
+ debrepo_args="$debrepo_args --keydir=${WORKDIR}"
+ fi
+ fi
+ if [ "${ISAR_ENABLE_COMPAT_ARCH}" = "1" ]; then
+ debrepo_args="$debrepo_args --compatarch=${COMPAT_DISTRO_ARCH}"
+ fi
+
+ if [ "${BOOTSTRAP_FOR_HOST}" = "1" ]; then
+ debrepo_args="$debrepo_args --crossarch=${DISTRO_ARCH}"
+ fi
+
+ if [ -n "${GNUPGHOME}" ]; then
+ export GNUPGHOME="${GNUPGHOME}"
+ fi
+
+ ${SCRIPTSDIR}/debrepo --init \
+ --workdir="${DEBREPO_WORKDIR}" \
+ --aptsrcsfile="${APTSRCS_INIT}" \
+ --repodir="${REPO_BASE_DIR}" \
+ --repodbdir="${REPO_BASE_DB_DIR}" \
+ --mirror="${@get_distro_source(d)}" \
+ --arch="${BOOTSTRAP_DISTRO_ARCH}" \
+ --distro="${BOOTSTRAP_BASE_DISTRO}" \
+ --codename="${BASE_DISTRO_CODENAME}" \
+ ${debrepo_args} \
+ ${DISTRO_BOOTSTRAP_BASE_PACKAGES}
+}
diff --git a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap-host.bb b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap-host.bb
index fa4b76a6..52563d33 100644
--- a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap-host.bb
+++ b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap-host.bb
@@ -17,3 +17,5 @@ require isar-mmdebstrap.inc

HOST_DISTRO_BOOTSTRAP_KEYS ?= ""
DISTRO_BOOTSTRAP_KEYS = "${HOST_DISTRO_BOOTSTRAP_KEYS}"

+
+DEBREPO_WORKDIR = "${DEBREPO_HOST_DIR}"

diff --git a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
index 6f2e47ac..8220d15e 100644
--- a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
+++ b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
@@ -147,6 +147,8 @@ do_bootstrap() {
fi
fi
bootstrap_args="--verbose --variant=minbase --include=${@','.join(d.getVar('DISTRO_BOOTSTRAP_BASE_PACKAGES').split())}"
+ debrepo_bootstrap_prepare
+
if [ -f "${DISTRO_BOOTSTRAP_KEYRING}" ]; then
bootstrap_args="$bootstrap_args --keyring=${DISTRO_BOOTSTRAP_KEYRING}"
cp "${DISTRO_BOOTSTRAP_KEYRING}" "${WORKDIR}/trusted.gpg.d/"
--
2.43.0

[Aliaksei Karpovich]

From: Uladzimir Bely <ub...@ilbers.de>

Since all packages and source packages are placed to base-apt repo
during build, there is no need to have them in one more place.

Signed-off-by: Uladzimir Bely <ub...@ilbers.de>
Signed-off-by: Aliaksei Karpovich <akarp...@ilbers.de>
---

meta/classes-recipe/deb-dl-dir.bbclass | 2 ++
meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc | 3 ++-
2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/meta/classes-recipe/deb-dl-dir.bbclass b/meta/classes-recipe/deb-dl-dir.bbclass
index 39c77151..29ed7822 100644
--- a/meta/classes-recipe/deb-dl-dir.bbclass
+++ b/meta/classes-recipe/deb-dl-dir.bbclass
@@ -178,6 +178,7 @@ deb_dl_dir_import() {

# nothing to copy if download directory does not exist just yet
[ ! -d "${pc}" ] && return 0
+ [ "${ISAR_PREFETCH_BASE_APT}" = "1" ] && return 0

# attempt to create hard-links for .deb files from downloads/ into
# /var/cache/apt/archives/ so apt will only download packages we
@@ -200,6 +201,7 @@ deb_dl_dir_export() {
export rootfs="${1}"
export owner=$(id -u):$(id -g)
mkdir -p "${pc}"
+ [ "${ISAR_PREFETCH_BASE_APT}" = "1" ] && return 0

export isar_debs=$(${SCRIPTSDIR}/lockrun.py -r -f '${REPO_ISAR_DIR}/isar.lock' -c \
"find '${REPO_ISAR_DIR}/${DISTRO}' -name '*.deb' -print")
diff --git a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
index 8220d15e..d98db7fc 100644
--- a/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
+++ b/meta/recipes-core/isar-mmdebstrap/isar-mmdebstrap.inc
@@ -270,7 +270,8 @@ do_bootstrap() {
- \
"$bootstrap_list" > ${DEPLOYDIR}/${DEPLOY_ISAR_BOOTSTRAP}.tar.zst

- if [ "${ISAR_USE_CACHED_BASE_REPO}" != "1" ]; then
+ if [ "${ISAR_USE_CACHED_BASE_REPO}" != "1" ] && \
+ [ "${ISAR_PREFETCH_BASE_APT}" != "1" ]; then
deb_dl_dir_export "${WORKDIR}/dl_dir" "${BOOTSTRAP_BASE_DISTRO}-${BASE_DISTRO_CODENAME}"
run_privileged find ${WORKDIR}/dl_dir -maxdepth 1 -mindepth 1 -exec rm -rf --one-file-system "{}" \;
rmdir ${WORKDIR}/dl_dir
--
2.43.0

[Aliaksei Karpovich]

From: Uladzimir Bely <ub...@ilbers.de>

This class uses 'scripts/debrepo' python script to prefetch given
packages or sources to local base-apt repository.

Signed-off-by: Uladzimir Bely <ub...@ilbers.de>
---

RECIPE-API-CHANGELOG.md | 10 ++++
doc/user_manual.md | 1 +
meta/classes/debrepo.bbclass | 90 ++++++++++++++++++++++++++++++++++++
meta/conf/bitbake.conf | 5 ++
4 files changed, 106 insertions(+)
create mode 100644 meta/classes/debrepo.bbclass

diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md
index f5b84c84..7f89d121 100644
--- a/RECIPE-API-CHANGELOG.md
+++ b/RECIPE-API-CHANGELOG.md
@@ -1137,3 +1137,13 @@ targeting Microsoft Hyper-V virtual machines on amd64.
The machine produces a `.vhdx` disk image using the WIC image type
and GRUB as the bootloader. It supports Debian bullseye, bookworm
and trixie.
+
+### "Prefetch" mode for base-apt
+
+Originally, `base-apt` repo is created only during second build when variable
+ISAR_USE_CACHED_BASE_REPO is set. The repo is populated with every package that
+took part in the first build and was cached in DL_DIR.
+
+New ISAR_PREFETCH_BASE_APT variable changes the way `base-apt` is populated.
+Packages added to the repo before running any task that need them. Separate
+`debrepo` script is used for populating base-apt repo.
diff --git a/doc/user_manual.md b/doc/user_manual.md
index dcc3f560..aa2b68b9 100644
--- a/doc/user_manual.md
+++ b/doc/user_manual.md
@@ -86,6 +86,7 @@ apt install \
gettext-base \
git \
python3 \
+ python3-apt \
quilt \
qemu-user-static \
reprepro \
diff --git a/meta/classes/debrepo.bbclass b/meta/classes/debrepo.bbclass
new file mode 100644
index 00000000..b4db9219
--- /dev/null
+++ b/meta/classes/debrepo.bbclass
@@ -0,0 +1,90 @@

+# This software is a part of Isar.
+# Copyright (C) 2026 ilbers GmbH

+#
+# SPDX-License-Identifier: MIT
+
+# Prefetch to base-apt repo by default
+ISAR_PREFETCH_BASE_APT ??= "1"
+
+DEBREPO_WORKDIR ??= "${DEBREPO_TARGET_DIR}"
+
+debrepo_update_apt_source_list() {
+ [ "${ISAR_PREFETCH_BASE_APT}" != "1" ] && return
+
+ chroot_dir=${1}
+ apt_list=${2}
+
+ flock -x "${REPO_BASE_DIR}/repo.lock" -c "
+ sudo -E chroot ${chroot_dir} /usr/bin/apt-get update \
+ -o Dir::Etc::SourceList=\"sources.list.d/${apt_list}.list\" \
+ -o Dir::Etc::SourceParts=\"-\" \
+ -o APT::Get::List-Cleanup=\"0\"
+ "
+}
+
+debrepo_add_packages() {

+ [ "${ISAR_PREFETCH_BASE_APT}" != "1" ] && return
+ [ "${ISAR_USE_CACHED_BASE_REPO}" = "1" ] && return
+

+ args=""
+ if [ "${1}" = "--srcmode" ]; then
+ args="${args} --srcmode"
+ shift
+ fi
+
+ if [ "${1}" = "--isarapt" ]; then
+ args="${args} --extrarepo=${REPO_ISAR_DIR}/${DISTRO}"
+ shift
+ fi
+
+ workdir="${1}"
+ args="${args} ${2}"

+
+ if [ -n "${GNUPGHOME}" ]; then
+ export GNUPGHOME="${GNUPGHOME}"

+ else
+ export GNUPGHOME="${WORKDIR}/gpghome"
+ fi
+
+ ${SCRIPTSDIR}/debrepo \
+ --workdir="${workdir}" \
+ ${args}
+}
+
+debrepo_parse_dscfile() {

+ [ "${ISAR_PREFETCH_BASE_APT}" != "1" ] && return
+ [ "${ISAR_USE_CACHED_BASE_REPO}" = "1" ] && return
+

+ dscfile="${1}"
+ args=""
+
+ build_arch=${DISTRO_ARCH}
+ if [ "${ISAR_CROSS_COMPILE}" = "1" ]; then
+ build_arch=${HOST_ARCH}
+ fi
+ if [ "${PACKAGE_ARCH}" != "${build_arch}" ]; then
+ args="--crossbuild \
+ crossbuild-essential-${PACKAGE_ARCH}:${build_arch} \
+ dose-distcheck:${build_arch} \
+ libc-dev:${PACKAGE_ARCH} \
+ libstdc++-dev:${PACKAGE_ARCH} \
+ "
+ fi
+
+ args="${args} --extrarepo=${WORKDIR}/isar-apt/${DISTRO}-${DISTRO_ARCH}/apt/${DISTRO}"

+
+ if [ -n "${GNUPGHOME}" ]; then
+ export GNUPGHOME="${GNUPGHOME}"

+ else
+ export GNUPGHOME="${WORKDIR}/gpghome"
+ fi
+
+ if [ -n "${DEB_BUILD_PROFILES}" ]; then
+ export DEB_BUILD_PROFILES="${DEB_BUILD_PROFILES}"
+ fi
+
+ ${SCRIPTSDIR}/debrepo \
+ --workdir="${DEBREPO_WORKDIR}" \
+ --dscfile="${dscfile}" \
+ ${args}
+}
diff --git a/meta/conf/bitbake.conf b/meta/conf/bitbake.conf
index 0f35a7fe..3f94392d 100644
--- a/meta/conf/bitbake.conf
+++ b/meta/conf/bitbake.conf
@@ -67,6 +67,11 @@ SDKCHROOT_DIR = "${DEPLOY_DIR_SDKCHROOT}/${BPN}-${DISTRO}-${MACHINE}"
CACHE = "${TMPDIR}/cache"
KERNEL_FILE ?= "${@ 'vmlinux' if d.getVar('DISTRO_ARCH') in ['mipsel', 'riscv64', 'arm64'] else 'vmlinuz'}"

+# debrepo config
+DEBREPO_DIR = "${TOPDIR}/debrepo"
+DEBREPO_HOST_DIR = "${DEBREPO_DIR}/${HOST_DISTRO}-${HOST_ARCH}_${DISTRO}-${DISTRO_ARCH}"
+DEBREPO_TARGET_DIR = "${DEBREPO_DIR}/${DISTRO}-${DISTRO_ARCH}"
+
MACHINEOVERRIDES ?= "${MACHINE}"
DISTROOVERRIDES ?= "${DISTRO}"
OVERRIDES = "${PACKAGE_ARCH}:${MACHINEOVERRIDES}:${DISTROOVERRIDES}:${BASE_DISTRO_CODENAME}::${BASE_DISTRO}:${ISAR_CHROOT_MODE}:forcevariable"
--
2.43.0

[Aliaksei Karpovich]

From: Uladzimir Bely <ub...@ilbers.de>

This is mostly related to gitlab CI that migth use an image without
preinstalled python3-apt.

Also, make system python packages available in virtualenv.

Signed-off-by: Uladzimir Bely <ub...@ilbers.de>
---

scripts/ci_build.sh | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/scripts/ci_build.sh b/scripts/ci_build.sh
index 241ff8c8..71f62111 100755
--- a/scripts/ci_build.sh
+++ b/scripts/ci_build.sh
@@ -19,7 +19,7 @@ if ! command -v avocado > /dev/null; then
sudo apt-get update -qq
sudo apt-get install -y virtualenv
rm -rf /tmp/avocado_venv
- virtualenv --python python3 /tmp/avocado_venv
+ virtualenv --python python3 /tmp/avocado_venv --system-site-packages
# shellcheck source=/dev/null
source /tmp/avocado_venv/bin/activate
pip install setuptools==81.0.0
@@ -138,6 +138,12 @@ if echo "$TAGS" | grep -Fqive "-startvm"; then
fi
fi

+# install python3-apt
+if [ ! -f /usr/share/doc/python3-apt/copyright ]; then
+ sudo apt-get update -qq
+ sudo apt-get install -y python3-apt
+fi
+
# Provide working path
mkdir -p .config/avocado
cat <<EOF > .config/avocado/avocado.conf
--
2.43.0

[Aliaksei Karpovich]

From: Uladzimir Bely <ub...@ilbers.de>

This option allows to set ISAR_PREFETCH_BASE_APT to "0" or "1" and
choose between old and new base-apt behaviour.

Docker image kas uses should have "python3-apt" preinstalled
in order to have new functionality working.

Signed-off-by: Uladzimir Bely <ub...@ilbers.de>
---

kas/opt/Kconfig | 12 ++++++++++++
kas/opt/prefetch-base-apt.yaml | 9 +++++++++
2 files changed, 21 insertions(+)
create mode 100644 kas/opt/prefetch-base-apt.yaml

diff --git a/kas/opt/Kconfig b/kas/opt/Kconfig
index bc4ed997..cb3f0d0c 100644
--- a/kas/opt/Kconfig
+++ b/kas/opt/Kconfig
@@ -213,3 +213,15 @@ config KAS_INCLUDE_USE_DRACUT
string
default "kas/opt/dracut.yaml"
depends on USE_DRACUT
+
+config PREFETCH_BASE_APT
+ bool "Prefetch base-apt repo"
+ default y
+ help
+ This makse Isar always take packages from base-apt repository where they
+ are prefetched by debrepo script before requested.
+
+config KAS_INCLUDE_PREFETCH_BASE_APT
+ string
+ default "kas/opt/prefetch-base-apt.yaml"
+ depends on PREFETCH_BASE_APT
diff --git a/kas/opt/prefetch-base-apt.yaml b/kas/opt/prefetch-base-apt.yaml
new file mode 100644
index 00000000..0cbdb93f
--- /dev/null
+++ b/kas/opt/prefetch-base-apt.yaml
@@ -0,0 +1,9 @@

+# This software is a part of Isar.

+# Copyright (C) 2024 ilbers GmbH
+
+header:
+ version: 14
+
+local_conf_header:
+ prefetch-base-apt: |
+ ISAR_PREFETCH_BASE_APT = "1"
--
2.43.0

[Aliaksei Karpovich]

Error:
| DEBUG: Executing shell function rootfs_install_pkgs_isar_download
| Starting pkgProblemResolver with broken count: 0
| Starting 2 pkgProblemResolver with broken count: 0
| Done
| E: Unable to locate package libstdc%2b%2b-12-dev
| E: Unable to locate package g%2b%2b-12
| E: Unable to locate package g%2b%2b

The apt uses the percent-encoding in URI and print it with
replacing of some symbols (f.e. '+' -> '%2b'). Current
implementation extracts package name from URL and gets it with
percent-encoding which leads to error above.

Format of output is following:
http://security.ubuntu.com/ubuntu/pool/universe/g/gcc-12/libstdc%2b%2b-12-dev_12.4.0-2ubuntu1%7e24.04.1_amd64.deb' libstdc++-12-dev_12.4.0-2ubuntu1~24.04.1_amd64.deb 2194756 MD5Sum:47b73d6b9f0aa4f0e115b1898ca80455

Fix: use second field (the name itself) instead of URL.

Signed-off-by: Aliaksei Karpovich <akarp...@ilbers.de>
---

meta/classes-recipe/rootfs.bbclass | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index 5a66b4ca..2ffbbca7 100644
--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -379,8 +379,8 @@ rootfs_install_pkgs_isar_download() {
--bind "${WORKDIR}/dpkg/lock-frontend" /var/lib/dpkg/lock-frontend \
--chdir "/var/cache/apt/archives" \
${ROOTFSDIR} \
- -- /usr/bin/sh -c "apt-get ${ROOTFS_APT_ARGS} --print-uris ${ROOTFS_PACKAGES} | \
- sed -n \"s|^.*/\\(.*\\)_[^_]*_[^_]*\\.deb'.*|\\1|p\" | \
+ -- /usr/bin/sh -c "apt-get ${ROOTFS_APT_ARGS} --print-uris ${ROOTFS_PACKAGES} | \
+ sed -n \"s|^[^ ]* \([^_]*\)_[^_]*_[^_]*\\.deb .*|\1|p\" | \
xargs -r apt-get download"
}

--
2.43.0

[Aliaksei Karpovich]

It fixes following error:
| E: Internal Error, Pathname to install is not absolute 'gcc-14-base_14.2.0-19_arm64.deb'

In case of cross compile the arch of package is lost. F.e. the
gcc-14-base_14.2.0-19_arm64.deb will be transformed in
gcc-14-base name and amd64 version will be downloaded instead of
arm64. We should take into account arch and version.
After this fix package name will be extracted in following way:
gcc-14-base_14.2.0-19_arm64.deb -> gcc-14-base:arm64=14.2.0-19

Signed-off-by: Aliaksei Karpovich <akarp...@ilbers.de>
---

meta/classes-recipe/rootfs.bbclass | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index 2ffbbca7..f6913cff 100644
--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -374,13 +374,15 @@ rootfs_install_pkgs_isar_download() {
# Command apt-get install do not cache packages from local repos
# We can obtain non cached package URIs by recalling install command here
# No need in export those files to dl_dir, so we can run it right after
+ # Package name extraction from URI for download : libmagic-mgc_1%3a5.46-5_amd64.deb -> libmagic-mgc:amd64=1:5.46-5

rootfs_cmd --bind "${ROOTFSDIR}/var/cache/apt/archives" /var/cache/apt/archives \

--bind "${WORKDIR}/dpkg/lock" /var/lib/dpkg/lock \

--bind "${WORKDIR}/dpkg/lock-frontend" /var/lib/dpkg/lock-frontend \
--chdir "/var/cache/apt/archives" \
${ROOTFSDIR} \

-- /usr/bin/sh -c "apt-get ${ROOTFS_APT_ARGS} --print-uris ${ROOTFS_PACKAGES} | \

- sed -n \"s|^[^ ]* \([^_]*\)_[^_]*_[^_]*\\.deb .*|\1|p\" | \
+ sed -n 's|^[^ ]* \([^_]*\)_\(.*\)_\([^_]*\)\.deb .*|\1:\3=\2|p' | \
+ sed 's/%3a/:/g' | \

[Aliaksei Karpovich]

It fixes an issue when bootstrap image in case of offline build
is different than online. It happens because some packages has
different Priority field because of override.
F.e. libtext-wrapi18n-perl in trixie:
- inside deb package: 'Priority: required'
- inside Packages from deb repo: 'Priority: optional'

Solution: download the override file from repo and pass it to
reprepro.

Signed-off-by: Aliaksei Karpovich <akarp...@ilbers.de>
---

scripts/debrepo | 88 ++++++++++++++++++++++++++++++++++++++++++++-----
1 file changed, 79 insertions(+), 9 deletions(-)

diff --git a/scripts/debrepo b/scripts/debrepo
index 81056c3a..4a74be33 100755
--- a/scripts/debrepo
+++ b/scripts/debrepo
@@ -89,6 +89,8 @@ import shutil
import subprocess
import pickle
import urllib.parse
+import urllib.request
+import gzip

import apt_pkg
import apt.progress.base
@@ -96,8 +98,38 @@ import apt.progress.base

REPREPRO_TIMEOUT = 1200

+def parse_aptsources_list_line(source_list_line):
+ import re
+
+ s = source_list_line.strip()
+
+ if not s or s.startswith("#"):
+ return None
+
+ type, s = re.split("\s+", s, maxsplit=1)
+ if type not in ["deb", "deb-src"]:
+ return None
+
+ options = ""
+ options_match = re.match("\[\s*(\S+=\S+(?=\s))*\s*(\S+=\S+)\s*\]\s+", s)
+ if options_match:
+ options = options_match.group(0).strip()
+ s = s[options_match.end():]
+
+ source, s = re.split("\s+", s, maxsplit=1)
+
+ if s.startswith("/"):
+ suite = ""
+ else:
+ suite, s = re.split("\s+", s, maxsplit=1)
+
+ components = " ".join(s.split())
+
+ return [type, options, source, suite, components]

class DebRepo(object):
+ BOOTSTRAP_LIST = "/etc/apt/sources.list.d/bootstrap.list"
+
class DebRepoCtx(object):
def __init__(self, workdir):
self.distro = "debian"
@@ -181,9 +213,9 @@ class DebRepo(object):

with open(f"{self.workdir}/var/lib/dpkg/status", "w"):

pass

- os.makedirs(f"{self.workdir}/etc/apt/sources.list.d", exist_ok=True)
+ srcfile = f"{self.workdir}{self.BOOTSTRAP_LIST}"
+ os.makedirs(os.path.dirname(srcfile), exist_ok=True)

- srcfile = f"{self.workdir}/etc/apt/sources.list.d/bootstrap.list"
if aptsrcsfile and os.path.exists(aptsrcsfile):
shutil.copy(aptsrcsfile, srcfile)
else:
@@ -201,13 +233,51 @@ class DebRepo(object):
def create_repo_dist(self):

conf_dir = f"{self.ctx.repodir}/{self.ctx.distro}/conf"

os.makedirs(conf_dir, exist_ok=True)
- if not os.path.exists(f"{conf_dir}/distributions"):
- with open(f"{conf_dir}/distributions", "w") as f:
- f.write(f"Codename: {self.ctx.codename}\n")
- f.write(
- "Architectures: "
- "i386 armhf arm64 amd64 mipsel riscv64 source\n")
- f.write("Components: main\n")
+ override_fname = "override"
+ self.create_override(f"{conf_dir}/{override_fname}")

+ with open(f"{conf_dir}/distributions", "w") as f:
+ f.write(f"Codename: {self.ctx.codename}\n")
+ f.write(
+ "Architectures: "
+ "i386 armhf arm64 amd64 mipsel riscv64 source\n")
+ f.write("Components: main\n")

+ f.write(f"DebOverride: {override_fname}\n")
+
+ def create_override(self, override_file):
+ deb_override_name = f"override.{self.ctx.codename}.main.gz"
+ deb_override_file = f"{self.workdir}/tmp/{deb_override_name}"
+ if (not os.path.exists(deb_override_file) or
+ os.path.getsize(deb_override_file) < 1):
+ # Extract source URL
+ srcfile = f"{self.workdir}{self.BOOTSTRAP_LIST}"
+ with open(srcfile, "r") as f:
+ for line in f:
+ entry = parse_aptsources_list_line(line)
+ if entry:
+ source_url = entry[2]
+ # Download deb override file
+ self.fetch_file(f"{source_url}/indices/{deb_override_name}")
+ break
+
+ with open(override_file, "w") as f_out:
+ # Unpack deb override file
+ with gzip.open(deb_override_file, "rt", encoding="utf-8") as f:
+ # Convert deb override to reprepro override
+ for line in f:
+ fields = line.strip().split()
+
+ if len(fields) < 3:
+ continue
+
+ package = fields[0]
+ priority = fields[1]
+ section = fields[2]
+
+ f_out.write(f"{package} Priority {priority}\n")
+ f_out.write(f"{package} Section {section}\n")
+
+ if f_out.tell() < 1:
+ print("WARNING: override file is empty!")

def apt_config(self, init, crossbuild):

if not init and self.ctx.compatarch:

--
2.43.0

[Aliaksei Karpovich]

Fix error:
| E: Unable to correct problems, you have held broken packages.
| E: The following information from --solver 3.0 may provide additional context:
| Unable to satisfy dependencies. Reached two conflicting decisions:
| 1. python3-debsbom:amd64=0.8.1 is selected for install
| 2. python3-debsbom:amd64 Depends python3-apt

Workaround for base-apt to force to install python3-apt amd64

version in case of cross build.

Signed-off-by: Aliaksei Karpovich <akarp...@ilbers.de>
---

meta/recipes-devtools/sbom-chroot/sbom-chroot.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb b/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb
index f347327b..d23a62b6 100644
--- a/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb
+++ b/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb
@@ -21,7 +21,7 @@ DEPENDS:append:bookworm = " python3-cyclonedx-lib"
DEPENDS:append:noble = " python3-cyclonedx-lib"
DEPENDS += "python3-debsbom python3-spdx-tools"

-SBOM_IMAGE_INSTALL = "python3-debsbom python3-spdx-tools python3-cyclonedx-lib"
+SBOM_IMAGE_INSTALL = "python3-debsbom python3-spdx-tools python3-cyclonedx-lib python3-apt:${ROOTFS_ARCH}"

ROOTFSDIR = "${WORKDIR}/rootfs"
ROOTFS_PACKAGES = "${SBOM_IMAGE_INSTALL}"
--
2.43.0

[Jan Kiszka]

Is this a fix for an issue that is independent of this series? Then move
it to the front, possibly even outside of the series.

Or is the fix only relevant with the changes coming after this? Then
clarify the impact, when the issue can hit and when not.

Jan

--
Siemens AG, Foundational Technologies
Linux Expert Center

[Jan Kiszka]

On 27.07.26 13:26, Aliaksei Karpovich wrote:

> It fixes following error:
> | E: Internal Error, Pathname to install is not absolute 'gcc-14-base_14.2.0-19_arm64.deb'
>

Again the question when this is relevant. Do we want it earlier,
independent of this series?

Jan

[Jan Kiszka]

On 27.07.26 13:26, Aliaksei Karpovich wrote:

> Fix error:
> | E: Unable to correct problems, you have held broken packages.
> | E: The following information from --solver 3.0 may provide additional context:
> | Unable to satisfy dependencies. Reached two conflicting decisions:
> | 1. python3-debsbom:amd64=0.8.1 is selected for install
> | 2. python3-debsbom:amd64 Depends python3-apt
>
> Workaround for base-apt to force to install python3-apt amd64
> version in case of cross build.
>

"Workaround" sounds weird. Either there is an issue in the packaging, or
there is a bug in this series. But then explain why this is just a
workaround, why it can't be addressed cleanly?

Jan

> Signed-off-by: Aliaksei Karpovich <akarp...@ilbers.de>
> ---
> meta/recipes-devtools/sbom-chroot/sbom-chroot.bb | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb b/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb
> index f347327b..d23a62b6 100644
> --- a/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb
> +++ b/meta/recipes-devtools/sbom-chroot/sbom-chroot.bb
> @@ -21,7 +21,7 @@ DEPENDS:append:bookworm = " python3-cyclonedx-lib"
> DEPENDS:append:noble = " python3-cyclonedx-lib"
> DEPENDS += "python3-debsbom python3-spdx-tools"
>
> -SBOM_IMAGE_INSTALL = "python3-debsbom python3-spdx-tools python3-cyclonedx-lib"
> +SBOM_IMAGE_INSTALL = "python3-debsbom python3-spdx-tools python3-cyclonedx-lib python3-apt:${ROOTFS_ARCH}"
>
> ROOTFSDIR = "${WORKDIR}/rootfs"
> ROOTFS_PACKAGES = "${SBOM_IMAGE_INSTALL}"


--

[Jan Kiszka]

On 27.07.26 13:26, Aliaksei Karpovich wrote:

> From: Uladzimir Bely <ub...@ilbers.de>
>
> This option allows to set ISAR_PREFETCH_BASE_APT to "0" or "1" and
> choose between old and new base-apt behaviour.
>
> Docker image kas uses should have "python3-apt" preinstalled
> in order to have new functionality working.
>

...which kas doesn't so far. Will you provide a patch for it?

Until we have it, the new default will be broken with current kas, no?
Should the default stay with the old model then, at least until there is
a new kas version available, and Isar has also updated to it?

Jan

[Quirin Gylstorff]

On 7/27/26 1:26 PM, Aliaksei Karpovich wrote:
> It fixes an issue when bootstrap image in case of offline build
> is different than online. It happens because some packages has
> different Priority field because of override.
> F.e. libtext-wrapi18n-perl in trixie:
> - inside deb package: 'Priority: required'
> - inside Packages from deb repo: 'Priority: optional'
>
> Solution: download the override file from repo and pass it to
> reprepro.

should this not be folded into patch 1?

Quirin

[Quirin Gylstorff]

On 7/27/26 1:26 PM, Aliaksei Karpovich wrote:

> From: Uladzimir Bely <ub...@ilbers.de>
>
> This is the main utility responsible for prefetching packages
> into local `base-apt` repo from external Debian mirrors. It uses
> python-apt module and requires some kind of minimal `rootfs` to work
> (let's call it "debrepo context").

This has a naming clash with https://github.com/filiprojek/debrepo. I
would suggest another name.

Does this work with newer releases of apt as it uses the host apt?

I would call it create_context_rootfs like in the description.

This adds the new dependency wget.

Please add to the user_manual.md
Quirin

What happen if deb822 is mandatory?

[MOESSBAUER, Felix]

Hi, as we use --print-uris, the result should be something that can
directly be downloaded with curl (and a specific user-agent). Is there
any particular reason to use apt for the download? If not, the whole
reformatting could be avoided.

Anyways, to me it looks like this is fix independent of the series.

Felix

>  }
>  
> --
> 2.43.0
>
> --
> You received this message because you are subscribed to the Google Groups "isar-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260727112812.2255297-13-akarpovich%40ilbers.de.

[Aliaksei Karpovich]

Will be moved into separate patch.

[Aliaksei Karpovich]

Thank for idea.
This fix will be redone with curl and moved into separate patch.

[Aliaksei Karpovich]

On 7/27/26 14:53, Jan Kiszka wrote:
> On 27.07.26 13:26, Aliaksei Karpovich wrote:
>> From: Uladzimir Bely <ub...@ilbers.de>
>>
>> This option allows to set ISAR_PREFETCH_BASE_APT to "0" or "1" and
>> choose between old and new base-apt behaviour.
>>
>> Docker image kas uses should have "python3-apt" preinstalled
>> in order to have new functionality working.
>>
> ...which kas doesn't so far. Will you provide a patch for it?
>
> Until we have it, the new default will be broken with current kas, no?
> Should the default stay with the old model then, at least until there is
> a new kas version available, and Isar has also updated to it?
>
> Jan

This patchset is still under development (V9 will  be released) and
patch for kas will be required.

[Aliaksei Karpovich]

On 7/27/26 15:36, Quirin Gylstorff wrote:
>
>
> On 7/27/26 1:26 PM, Aliaksei Karpovich wrote:
>> From: Uladzimir Bely <ub...@ilbers.de>
>>
>> This is the main utility responsible for prefetching packages
>> into local `base-apt` repo from external Debian mirrors. It uses
>> python-apt module and requires some kind of minimal `rootfs` to work
>> (let's call it "debrepo context").
>
> This has a naming clash with https://github.com/filiprojek/debrepo. I
> would suggest another name.

What about "deb_repo" ?

[Jan Kiszka]

This change is critical due to [1]. Please address this independently of
the series soon so that we can resolve the "regression" of disabling
local "downloads". It's blocking downstream updates to rootless builds,
thus further testing. Maybe even fix the url parsing first and then
refactor to curl/wget fetching on top, whatever is faster.

Jan

[1]
https://groups.google.com/d/msgid/isar-users/4f230241-bb11-42ab-873d-d011b87c7e92%40siemens.com

[MOESSBAUER, Felix]

I have a patch for the same error, which just relies on copy (as the
.debs are anyways all local).

Will send it out by today.

Felix