[PATCH 1/1] sbuild: allow to override enforcement of no-network policy

[Felix Moessbauer]

In accordance with Debian Policy §4.9, sbuild disables network
access while running `dpkg-buildpackage` (from trixie on). For
technical reasons, this was not enforced on the schroot backend,
leading to silent policy violations. On the unshare backend
(rootless), this is enforced, which might break some downstream
builds. By providing a variable to override this, we restore
compatibility with the privileged mode.

Pre 0.89 versions of sbuild (e.g. on bookworm), always allow network
access, independent of the backend.

Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
---
RECIPE-API-CHANGELOG.md | 9 +++++++++
meta/classes-recipe/dpkg.bbclass | 15 +++++++++++++++
2 files changed, 24 insertions(+)

diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md
index f5b84c84..69560e9f 100644
--- a/RECIPE-API-CHANGELOG.md
+++ b/RECIPE-API-CHANGELOG.md
@@ -1129,6 +1129,15 @@ environment and cannot be deleted from the outside by the calling user. To simpl
the cleanup, we provide the `isar-clean-builddir` script that helps purging
directories with mixed ownerships (without requiring root privileges).

+### Network access during package builds (on rootless)
+
+In accordance with Debian Policy §4.9, sbuild disables network access while running
+`dpkg-buildpackage`. For technical reasons, this is only enforced on the unshare
+backend (and on sbuild versions > 0.89). The schroot backend retains its existing
+network access. Recipes that still require network access during the build can set
+`DPKG_BUILD_ENABLE_NETWORK = "1"` to explicitly enable it when using an sbuild
+version newer than 0.89.
+
### Add Hyper-V machine support

A new machine `hyper-v` has been introduced for building images
diff --git a/meta/classes-recipe/dpkg.bbclass b/meta/classes-recipe/dpkg.bbclass
index 1b2616db..d8e129bb 100644
--- a/meta/classes-recipe/dpkg.bbclass
+++ b/meta/classes-recipe/dpkg.bbclass
@@ -15,6 +15,12 @@ DPKG_PREBUILD_ENV_FILE="${WORKDIR}/dpkg_prebuild.env"
# Note: must not have any logical influence on the generated package
SBUILD_PASSTHROUGH_ADDITIONS ?= ""

+# Debian Policy §4.9 forbids network access during build. However, this can only
+# be enforced on unshare backend. For schroot backend, network access was still possible,
+# resulting in builds needing it. To override this, the variable DPKG_BUILD_ENABLE_NETWORK
+# can be set to "1" in the recipe.
+DPKG_BUILD_ENABLE_NETWORK ??= "0"
+
def expand_sbuild_pt_additions(d):
cmds = ''
for var in d.getVar('SBUILD_PASSTHROUGH_ADDITIONS').split():
@@ -112,10 +118,19 @@ dpkg_runbuild() {

DSC_FILE=$(find ${WORKDIR} -maxdepth 1 -name "${DEBIAN_SOURCE}_*.dsc" -print)

+ # networking is automatically enabled on older versions of sbuild
+ sbuild_network_option=""
+ sbuild_version="$(dpkg-query --showformat='${source:Upstream-Version}' --show sbuild)"
+ if [ "${DPKG_BUILD_ENABLE_NETWORK}" = "1" ] && \
+ dpkg --compare-versions "$sbuild_version" ge "0.89"; then
+ sbuild_network_option="--enable-network"
+ fi
+
sbuild -n -c ${SBUILD_CHROOT} \
--chroot-mode=${ISAR_CHROOT_MODE} \
--host=${PACKAGE_ARCH} --build=${BUILD_ARCH} ${profiles} \
${@'--no-arch-all' if 'cross' in isar_deb_build_profiles(d).split() else '--arch-all'} \
+ ${sbuild_network_option} \
--no-run-lintian --no-run-piuparts --no-run-autopkgtest --resolve-alternatives \
--bd-uninstallable-explainer=apt \
--no-apt-update --apt-distupgrade \
--
2.53.0

[Michael Adler]

> In accordance with Debian Policy §4.9, sbuild disables network
> access while running `dpkg-buildpackage` (from trixie on). For
> technical reasons, this was not enforced on the schroot backend,
> leading to silent policy violations. On the unshare backend
> (rootless), this is enforced, which might break some downstream
> builds. By providing a variable to override this, we restore
> compatibility with the privileged mode.
>
> Pre 0.89 versions of sbuild (e.g. on bookworm), always allow network
> access, independent of the backend.

Thanks a lot, works for me (podman, unprivileged).

Tested-by: Michael Adler <michae...@siemens.com>

Kind regards,
Michael

--
Michael Adler

Siemens AG
Technology
Connectivity & Edge
Open Source Embedded Systems
FT RPD CED OES-DE
Friedrich-Ludwig-Bauer-Str. 3
85748 Garching, Germany

Siemens Aktiengesellschaft: Chairman of the Supervisory Board: Jim Hagemann
Snabe; Managing Board: Roland Busch, Chairman, President and Chief Executive
Officer; Cedrik Neike, Matthias Rebellius, Ralf P. Thomas, Judith Wiese;
Registered offices: Berlin and Munich, Germany; Commercial registries:
Berlin-Charlottenburg, HRB 12300, Munich, HRB 6684; WEEE-Reg.-No. DE 23691322

[Zhihang Wei]

Applied to next, thanks.

Zhihang