[PATCH v2] dpkg: Restore support for replacing pre-installed packages in sbuild-chroot

[Jan Kiszka]

From: Jan Kiszka <jan.k...@siemens.com>

During the migration to sbuild, support for using self-built packages in
the build environment was lost if those were already part of the
sbuild-chroot. This restores it by adding --apt-distupgrade to the
sbuild call. But that is not enough because sbuild will only upgrade
packages from already configured sources, not those specified via
--extra-repository. We therefore have to switch back to configuring
isar-apt during sbuild-chroot creation.

As rootfs_configure_isar_apt configures the isar repo under
/isar-apt, we bind-mount the one in /home/builder/${PN} to that folder.
Another difference is that we now need to run apt-get update explicitly,
but only for isar-apt.

Signed-off-by: Jan Kiszka <jan.k...@siemens.com>
---

Changes in v2:
- fix regressions caused by adding isar-apt to more schroots than
needed

meta/classes/dpkg-base.bbclass | 22 ++++++++++---------
meta/classes/dpkg.bbclass | 5 +++--
.../sbuild-chroot/sbuild-chroot.inc | 2 --
3 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/meta/classes/dpkg-base.bbclass b/meta/classes/dpkg-base.bbclass
index 7b054d3f..6a6964b2 100644
--- a/meta/classes/dpkg-base.bbclass
+++ b/meta/classes/dpkg-base.bbclass
@@ -19,8 +19,6 @@ DEPENDS:append:riscv64 = "${@' crossbuild-essential-riscv64' if d.getVar('ISAR_C
DEB_BUILD_PROFILES ?= ""
DEB_BUILD_OPTIONS ?= ""

-ISAR_APT_REPO ?= "deb [trusted=yes] file:///home/builder/${PN}/isar-apt/${DISTRO}-${DISTRO_ARCH}/apt/${DISTRO} ${DEBDISTRONAME} main"
-
python do_adjust_git() {
import subprocess

@@ -221,8 +219,17 @@ def isar_export_build_settings(d):
os.environ['DEB_BUILD_OPTIONS'] = isar_deb_build_options(d)
os.environ['DEB_BUILD_PROFILES'] = isar_deb_build_profiles(d)

+dpkg_schroot_create_configs() {
+ schroot_create_configs
+ sudo -s <<'EOSUDO'
+ sbuild_fstab="${SBUILD_CONF_DIR}/fstab"
+ fstab_isarapt="${WORKDIR}/isar-apt/${DISTRO}-${DISTRO_ARCH}/apt/${DISTRO} /isar-apt none rw,bind 0 0"
+ grep -qxF "${fstab_isarapt}" ${sbuild_fstab} || echo "${fstab_isarapt}" >> ${sbuild_fstab}
+EOSUDO
+}
+
python do_dpkg_build() {
- bb.build.exec_func('schroot_create_configs', d)
+ bb.build.exec_func('dpkg_schroot_create_configs', d)
try:
bb.build.exec_func("dpkg_runbuild", d)
finally:
@@ -297,11 +304,9 @@ python do_devshell() {
bb.build.exec_func('schroot_configure_ccache', d)

schroot = d.getVar('SBUILD_CHROOT')
- isar_apt = d.getVar('ISAR_APT_REPO')
pkg_arch = d.getVar('PACKAGE_ARCH')
build_arch = d.getVar('BUILD_ARCH')
pp_pps = os.path.join(d.getVar('PP'), d.getVar('PPS'))
- debdistroname = d.getVar('DEBDISTRONAME')

install_deps = ":" if d.getVar('BB_CURRENTTASK') == "devshell_nodeps" else f"mk-build-deps -i \
--host-arch {pkg_arch} --build-arch {build_arch} \
@@ -310,15 +315,12 @@ python do_devshell() {

termcmd = "schroot -d / -c {0} -u root -- sh -c ' \
cd {1}; \
- echo {2} > /etc/apt/sources.list.d/isar_apt.list; \
- echo \"Package: *\nPin: release n={3}\nPin-Priority: 1000\" > /etc/apt/preferences.d/isar-apt; \
- echo \"APT::Get::allow-downgrades 1;\" > /etc/apt/apt.conf.d/50isar-apt; \
apt-get -y -q update; \
- {4}; \
+ {2}; \
export PATH=$PATH_PREPEND:$PATH; \
$SHELL -i \
'"
- oe_terminal(termcmd.format(schroot, pp_pps, isar_apt, debdistroname, install_deps), "Isar devshell", d)
+ oe_terminal(termcmd.format(schroot, pp_pps, install_deps), "Isar devshell", d)

bb.build.exec_func('schroot_delete_configs', d)
}
diff --git a/meta/classes/dpkg.bbclass b/meta/classes/dpkg.bbclass
index 1d684e98..0cdb5792 100644
--- a/meta/classes/dpkg.bbclass
+++ b/meta/classes/dpkg.bbclass
@@ -110,16 +110,17 @@ dpkg_runbuild() {
DEB_SOURCE_NAME=$(dpkg-parsechangelog --show-field Source --file ${WORKDIR}/${PPS}/debian/changelog)
DSC_FILE=$(find ${WORKDIR} -name "${DEB_SOURCE_NAME}*.dsc" -maxdepth 1 -print)

- sbuild -A -n -c ${SBUILD_CHROOT} --extra-repository="${ISAR_APT_REPO}" \
+ sbuild -A -n -c ${SBUILD_CHROOT} \
--host=${PACKAGE_ARCH} --build=${BUILD_ARCH} ${profiles} \
--no-run-lintian --no-run-piuparts --no-run-autopkgtest --resolve-alternatives \
--bd-uninstallable-explainer=apt \
- --no-apt-update \
+ --no-apt-update --apt-distupgrade \
--chroot-setup-commands="echo \"Package: *\nPin: release n=${DEBDISTRONAME}\nPin-Priority: 1000\" > /etc/apt/preferences.d/isar-apt" \
--chroot-setup-commands="echo \"APT::Get::allow-downgrades 1;\" > /etc/apt/apt.conf.d/50isar-apt" \
--chroot-setup-commands="rm -f /var/log/dpkg.log" \
--chroot-setup-commands="mkdir -p ${deb_dir}" \
--chroot-setup-commands="ln -sf ${ext_deb_dir}/*.deb -t ${deb_dir}/" \
+ --chroot-setup-commands="apt-get update -o Dir::Etc::SourceList=\"sources.list.d/isar-apt.list\" -o Dir::Etc::SourceParts=\"-\" -o APT::Get::List-Cleanup=\"0\"" \
--finished-build-commands="rm -f ${deb_dir}/sbuild-build-depends-main-dummy_*.deb" \
--finished-build-commands="[ -z "$(find ${deb_dir} -maxdepth 1 -name '*.deb' -print -quit)" ] || cp ${CP_FLAGS} ${deb_dir}/*.deb -t ${ext_deb_dir}/" \
--finished-build-commands="cp /var/log/dpkg.log ${ext_root}/dpkg_partial.log" \
diff --git a/meta/recipes-devtools/sbuild-chroot/sbuild-chroot.inc b/meta/recipes-devtools/sbuild-chroot/sbuild-chroot.inc
index 39ced80b..2f07de82 100644
--- a/meta/recipes-devtools/sbuild-chroot/sbuild-chroot.inc
+++ b/meta/recipes-devtools/sbuild-chroot/sbuild-chroot.inc
@@ -56,8 +56,6 @@ SBUILD_CHROOT_DIR = "${WORKDIR}/rootfs"
ROOTFSDIR = "${SBUILD_CHROOT_DIR}"
ROOTFS_PACKAGES = "${SBUILD_CHROOT_PREINSTALL}"

-# We don't need /etc/apt/sources.list.d/isar-apt.list' while it's handled by sbuild
-ROOTFS_CONFIGURE_COMMAND:remove = "rootfs_configure_isar_apt"
ROOTFS_POSTPROCESS_COMMAND:remove = "rootfs_cleanup_isar_apt"

# Do not cleanup base-apt
--
2.35.3

[Jan Kiszka]

On 02.01.24 08:55, 'Jan Kiszka' via isar-users wrote:
> From: Jan Kiszka <jan.k...@siemens.com>
>
> During the migration to sbuild, support for using self-built packages in
> the build environment was lost if those were already part of the
> sbuild-chroot. This restores it by adding --apt-distupgrade to the

This patch does more than I originally expected: It is currently not
even possible to pull additional packages into an sbuild-chroot from
isar-apt. As that feature is a precondition for replacing packages, it
comes implicitly with these changes - widely obsoleting the approach
Srinu was taking in
https://groups.google.com/g/isar-users/c/TAtC1wA68mA/m/lI-ci5LrAgAJ.

Jan

Siemens AG, Technology
Linux Expert Center

[Jan Kiszka]

From: Jan Kiszka <jan.k...@siemens.com>

During the migration to sbuild, support for using self-built packages in
the build environment was lost if those were already part of the
sbuild-chroot. This restores it by adding --apt-distupgrade to the

sbuild call. But that is not enough because sbuild will only upgrade
packages from already configured sources, not those specified via
--extra-repository. We therefore have to switch back to configuring
isar-apt during sbuild-chroot creation.

As rootfs_configure_isar_apt configures the isar repo under
/isar-apt, we bind-mount the one in /home/builder/${PN} to that folder.
Another difference is that we now need to run apt-get update explicitly,
but only for isar-apt.

Signed-off-by: Jan Kiszka <jan.k...@siemens.com>
---

Changes in v3:
- improve devshell support so that upgrades are done there as well

meta/classes/dpkg-base.bbclass | 27 ++++++++++---------
meta/classes/dpkg.bbclass | 5 ++--
.../sbuild-chroot/sbuild-chroot.inc | 2 --
3 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/meta/classes/dpkg-base.bbclass b/meta/classes/dpkg-base.bbclass
index 7b054d3f..52baf169 100644

@@ -288,7 +295,7 @@ do_deploy_deb[lockfiles] = "${REPO_ISAR_DIR}/isar.lock"
do_deploy_deb[dirs] = "${S}"

python do_devshell() {

- bb.build.exec_func('schroot_create_configs', d)
+ bb.build.exec_func('dpkg_schroot_create_configs', d)

isar_export_proxies(d)
isar_export_ccache(d)

@@ -297,11 +304,9 @@ python do_devshell() {
bb.build.exec_func('schroot_configure_ccache', d)

schroot = d.getVar('SBUILD_CHROOT')
- isar_apt = d.getVar('ISAR_APT_REPO')
pkg_arch = d.getVar('PACKAGE_ARCH')
build_arch = d.getVar('BUILD_ARCH')
pp_pps = os.path.join(d.getVar('PP'), d.getVar('PPS'))
- debdistroname = d.getVar('DEBDISTRONAME')

install_deps = ":" if d.getVar('BB_CURRENTTASK') == "devshell_nodeps" else f"mk-build-deps -i \
--host-arch {pkg_arch} --build-arch {build_arch} \

@@ -310,15 +315,13 @@ python do_devshell() {

termcmd = "schroot -d / -c {0} -u root -- sh -c ' \
cd {1}; \
- echo {2} > /etc/apt/sources.list.d/isar_apt.list; \
- echo \"Package: *\nPin: release n={3}\nPin-Priority: 1000\" > /etc/apt/preferences.d/isar-apt; \
- echo \"APT::Get::allow-downgrades 1;\" > /etc/apt/apt.conf.d/50isar-apt; \

- apt-get -y -q update; \
- {4}; \
+ apt-get -y -q update -o Dir::Etc::SourceList=\"sources.list.d/isar-apt.list\" -o Dir::Etc::SourceParts=\"-\" -o APT::Get::List-Cleanup=\"0\"; \
+ apt-get -y upgrade; \

2.35.3

[Jan Kiszka]

From: Jan Kiszka <jan.k...@siemens.com>

During the migration to sbuild, support for using self-built packages in
the build environment was lost if those were already part of the
sbuild-chroot. This restores it by adding --apt-distupgrade to the
sbuild call. But that is not enough because sbuild will only upgrade
packages from already configured sources, not those specified via
--extra-repository. We therefore have to switch back to configuring
isar-apt during sbuild-chroot creation.

As rootfs_configure_isar_apt configures the isar repo under
/isar-apt, we bind-mount the one in /home/builder/${PN} to that folder.
Another difference is that we now need to run apt-get update explicitly,
but only for isar-apt.

And because the sbuild-chroots are now left behind with isar-apt
configured, the configuration in imager_run can be removed (credits to
Srinuvasan Arjunan).

Signed-off-by: Jan Kiszka <jan.k...@siemens.com>
---

Changes in v4:
- pick up cleanup of image-tool-extensions by Srinu

meta/classes/dpkg-base.bbclass | 27 ++++++++++---------
meta/classes/dpkg.bbclass | 5 ++--

meta/classes/image-tools-extension.bbclass | 13 ---------
.../sbuild-chroot/sbuild-chroot.inc | 2 --
4 files changed, 18 insertions(+), 29 deletions(-)

diff --git a/meta/classes/image-tools-extension.bbclass b/meta/classes/image-tools-extension.bbclass
index 58799fcf..46bdf78b 100644
--- a/meta/classes/image-tools-extension.bbclass
+++ b/meta/classes/image-tools-extension.bbclass
@@ -44,19 +44,6 @@ imager_run() {
distro="${HOST_BASE_DISTRO}-${BASE_DISTRO_CODENAME}"
fi

- # prepare isar-apt
- schroot -r -c ${session_id} -d / -u root -- sh -c " \
- mkdir -p '/etc/apt/sources.list.d'
- echo 'deb [trusted=yes] file:///isar-apt ${DEBDISTRONAME} main' > \
- '/etc/apt/sources.list.d/isar-apt.list'
-
- mkdir -p '/etc/apt/preferences.d'
- cat << EOF > '/etc/apt/preferences.d/isar-apt'
-Package: *
-Pin: release n=${DEBDISTRONAME}
-Pin-Priority: 1000
-EOF"
-
E="${@ isar_export_proxies(d)}"
deb_dl_dir_import ${schroot_dir} ${distro}
schroot -r -c ${session_id} -d / -u root -- sh -c " \

[Uladzimir Bely]

On Mon, 2024-01-08 at 07:50 +0100, 'Jan Kiszka' via isar-users wrote:
> From: Jan Kiszka <jan.k...@siemens.com>
>
> During the migration to sbuild, support for using self-built packages
> in
> the build environment was lost if those were already part of the
> sbuild-chroot. This restores it by adding --apt-distupgrade to the
> sbuild call. But that is not enough because sbuild will only upgrade
> packages from already configured sources, not those specified via
> --extra-repository. We therefore have to switch back to configuring
> isar-apt during sbuild-chroot creation.
>
> As rootfs_configure_isar_apt configures the isar repo under
> /isar-apt, we bind-mount the one in /home/builder/${PN} to that
> folder.
> Another difference is that we now need to run apt-get update
> explicitly,
> but only for isar-apt.
>
> And because the sbuild-chroots are now left behind with isar-apt
> configured, the configuration in imager_run can be removed (credits
> to
> Srinuvasan Arjunan).
>
> Signed-off-by: Jan Kiszka <jan.k...@siemens.com>
> ---
>

The patch for now doesn't pass full CI and fails with similar errors in
several tests (repro and container related). I've attached some log
files. In addition to the logs, I have to say that isar-apt copy in
workdir (e.g. "hello/1.0-r0/isar-apt/...") does not contain required
file in the pool (e.g. "/isar-apt/pool/main/h/hello/hello_2.10-
3+isar.dsc").


I'm still debugging it for the reason of the build issue, but probably
the logs attached could be useful for understanding what is wrong.

For now, the simplest way to reproduce the issue is running CI limited
to repro_unsigned test (target list can also be reduced up to
mc:qemuamd64-bullseye:isar-image-base only).

[Jan Kiszka]

From: Jan Kiszka <jan.k...@siemens.com>

During the migration to sbuild, support for using self-built packages in
the build environment was lost if those were already part of the
sbuild-chroot. This restores it by adding --apt-distupgrade to the
sbuild call. But that is not enough because sbuild will only upgrade
packages from already configured sources, not those specified via
--extra-repository. We therefore have to switch back to configuring
isar-apt during sbuild-chroot creation.

As rootfs_configure_isar_apt configures the isar repo under
/isar-apt, we bind-mount the one in /home/builder/${PN} to that folder.
Another difference is that we now need to run apt-get update explicitly,
but only for isar-apt.

And because the sbuild-chroots are now left behind with isar-apt
configured, the configuration in imager_run can be removed (credits to
Srinuvasan Arjunan).

Signed-off-by: Jan Kiszka <jan.k...@siemens.com>
---

Changes in v5:
- also use dpkg_schroot_create_configs for apt_fetch and apt_unpack
(while I wasn't able to reproduce the issue, I think this should
resolve the CI problems)

meta/classes/dpkg-base.bbclass | 66 ++++++++++---------
meta/classes/dpkg.bbclass | 5 +-
meta/classes/image-tools-extension.bbclass | 13 ----
.../sbuild-chroot/sbuild-chroot.inc | 2 -
4 files changed, 38 insertions(+), 48 deletions(-)

diff --git a/meta/classes/dpkg-base.bbclass b/meta/classes/dpkg-base.bbclass
index 7b054d3f..32494636 100644

--- a/meta/classes/dpkg-base.bbclass
+++ b/meta/classes/dpkg-base.bbclass
@@ -19,8 +19,6 @@ DEPENDS:append:riscv64 = "${@' crossbuild-essential-riscv64' if d.getVar('ISAR_C
DEB_BUILD_PROFILES ?= ""
DEB_BUILD_OPTIONS ?= ""

-ISAR_APT_REPO ?= "deb [trusted=yes] file:///home/builder/${PN}/isar-apt/${DISTRO}-${DISTRO_ARCH}/apt/${DISTRO} ${DEBDISTRONAME} main"
-
python do_adjust_git() {
import subprocess

@@ -105,9 +103,34 @@ python() {
bb.build.addtask('cleanall_apt', 'do_cleanall', '', d)

}

+dpkg_schroot_create_configs() {
+ schroot_create_configs
+ sudo -s <<'EOSUDO'
+ sbuild_fstab="${SBUILD_CONF_DIR}/fstab"
+ fstab_isarapt="${WORKDIR}/isar-apt/${DISTRO}-${DISTRO_ARCH}/apt/${DISTRO} /isar-apt none rw,bind 0 0"
+ grep -qxF "${fstab_isarapt}" ${sbuild_fstab} || echo "${fstab_isarapt}" >> ${sbuild_fstab}
+EOSUDO
+}
+

+# If Isar recipes depend on each other, they typically need the package
+# deployed to isar-apt
+addtask local_isarapt
+do_local_isarapt[depends] += "isar-apt:do_cache_config"
+do_local_isarapt[deptask] = "do_deploy_deb"
+do_local_isarapt[lockfiles] += "${REPO_ISAR_DIR}/isar.lock"
+do_local_isarapt() {
+ # Make a local copy of isar-apt repo that is not affected by other parallel builds
+ rm -rf "${WORKDIR}/isar-apt/${DISTRO}-${DISTRO_ARCH}/*"
+ mkdir -p "${WORKDIR}/isar-apt/${DISTRO}-${DISTRO_ARCH}/apt/${DISTRO}"
+ cp -Rf "${REPO_ISAR_DIR}/${DISTRO}/dists" "${WORKDIR}/isar-apt/${DISTRO}-${DISTRO_ARCH}/apt/${DISTRO}/"
+ if [ -d "${REPO_ISAR_DIR}/${DISTRO}/pool" ]; then
+ cp -Rlf "${REPO_ISAR_DIR}/${DISTRO}/pool" "${WORKDIR}/isar-apt/${DISTRO}-${DISTRO_ARCH}/apt/${DISTRO}/"
+ fi
+}
+
do_apt_fetch() {
E="${@ isar_export_proxies(d)}"
- schroot_create_configs
+ dpkg_schroot_create_configs

schroot_cleanup() {
schroot_delete_configs
@@ -122,7 +145,7 @@ do_apt_fetch() {
schroot_delete_configs
}

-addtask apt_fetch
+addtask apt_fetch after do_local_isarapt
do_apt_fetch[lockfiles] += "${REPO_ISAR_DIR}/isar.lock"
do_apt_fetch[network] = "${TASK_USE_NETWORK_AND_SUDO}"

@@ -131,7 +154,7 @@ do_apt_fetch[depends] += "${SCHROOT_DEP}"

do_apt_unpack() {
rm -rf ${S}
- schroot_create_configs
+ dpkg_schroot_create_configs

schroot_cleanup() {
schroot_delete_configs
@@ -184,21 +207,6 @@ do_prepare_build() {
}

addtask prepare_build after do_patch do_transform_template before do_dpkg_build
-# If Isar recipes depend on each other, they typically need the package
-# deployed to isar-apt
-do_local_isarapt[depends] += "isar-apt:do_cache_config"
-do_local_isarapt[deptask] = "do_deploy_deb"
-do_local_isarapt[lockfiles] += "${REPO_ISAR_DIR}/isar.lock"
-do_local_isarapt() {
- # Make a local copy of isar-apt repo that is not affected by other parallel builds
- rm -rf "${WORKDIR}/isar-apt/${DISTRO}-${DISTRO_ARCH}/*"
- mkdir -p "${WORKDIR}/isar-apt/${DISTRO}-${DISTRO_ARCH}/apt/${DISTRO}"
- cp -Rf "${REPO_ISAR_DIR}/${DISTRO}/dists" "${WORKDIR}/isar-apt/${DISTRO}-${DISTRO_ARCH}/apt/${DISTRO}/"
- if [ -d "${REPO_ISAR_DIR}/${DISTRO}/pool" ]; then
- cp -Rlf "${REPO_ISAR_DIR}/${DISTRO}/pool" "${WORKDIR}/isar-apt/${DISTRO}-${DISTRO_ARCH}/apt/${DISTRO}/"
- fi
-}
-addtask local_isarapt before do_dpkg_build

# Placeholder for actual dpkg_runbuild() implementation
dpkg_runbuild() {
@@ -222,7 +230,7 @@ def isar_export_build_settings(d):
os.environ['DEB_BUILD_PROFILES'] = isar_deb_build_profiles(d)

python do_dpkg_build() {
- bb.build.exec_func('schroot_create_configs', d)
+ bb.build.exec_func('dpkg_schroot_create_configs', d)
try:
bb.build.exec_func("dpkg_runbuild", d)
finally:

@@ -230,7 +238,7 @@ python do_dpkg_build() {
}
do_dpkg_build[network] = "${TASK_USE_NETWORK_AND_SUDO}"

-addtask dpkg_build
+addtask dpkg_build after do_local_isarapt

SSTATETASKS += "do_dpkg_build"
SSTATECREATEFUNCS += "dpkg_build_sstate_prepare"
@@ -288,7 +296,7 @@ do_deploy_deb[lockfiles] = "${REPO_ISAR_DIR}/isar.lock"

do_deploy_deb[dirs] = "${S}"

python do_devshell() {
- bb.build.exec_func('schroot_create_configs', d)
+ bb.build.exec_func('dpkg_schroot_create_configs', d)

isar_export_proxies(d)
isar_export_ccache(d)

@@ -297,11 +305,9 @@ python do_devshell() {

bb.build.exec_func('schroot_configure_ccache', d)

schroot = d.getVar('SBUILD_CHROOT')
- isar_apt = d.getVar('ISAR_APT_REPO')
pkg_arch = d.getVar('PACKAGE_ARCH')
build_arch = d.getVar('BUILD_ARCH')
pp_pps = os.path.join(d.getVar('PP'), d.getVar('PPS'))
- debdistroname = d.getVar('DEBDISTRONAME')

install_deps = ":" if d.getVar('BB_CURRENTTASK') == "devshell_nodeps" else f"mk-build-deps -i \
--host-arch {pkg_arch} --build-arch {build_arch} \

@@ -310,15 +316,13 @@ python do_devshell() {

termcmd = "schroot -d / -c {0} -u root -- sh -c ' \
cd {1}; \
- echo {2} > /etc/apt/sources.list.d/isar_apt.list; \
- echo \"Package: *\nPin: release n={3}\nPin-Priority: 1000\" > /etc/apt/preferences.d/isar-apt; \
- echo \"APT::Get::allow-downgrades 1;\" > /etc/apt/apt.conf.d/50isar-apt; \
- apt-get -y -q update; \
- {4}; \
+ apt-get -y -q update -o Dir::Etc::SourceList=\"sources.list.d/isar-apt.list\" -o Dir::Etc::SourceParts=\"-\" -o APT::Get::List-Cleanup=\"0\"; \
+ apt-get -y upgrade; \
+ {2}; \
export PATH=$PATH_PREPEND:$PATH; \
$SHELL -i \
'"
- oe_terminal(termcmd.format(schroot, pp_pps, isar_apt, debdistroname, install_deps), "Isar devshell", d)
+ oe_terminal(termcmd.format(schroot, pp_pps, install_deps), "Isar devshell", d)

bb.build.exec_func('schroot_delete_configs', d)
}
diff --git a/meta/classes/dpkg.bbclass b/meta/classes/dpkg.bbclass

index c699a84d..d1666f78 100644

[Uladzimir Bely]

Unfortunately, the picture in full CI didn't change. Even worse, one
more job (NoCrossTest.test_nocross has failed with the similar error.

tmp/work/debian-bullseye-amd64/hello/1.0-
r0/temp/log.do_apt_unpack.1785250:
```
DEBUG: Executing shell function do_apt_unpack
cp: cannot stat '/downloads/deb-src/debian-bullseye/hello/hello_2.10-
2+isar.debian.tar.xz': No such file or directory
cp: cannot stat '/downloads/deb-src/debian-bullseye/hello/hello_2.10-
2+isar.dsc': No such file or directory
```

I'm continuing debugging the issue.

[Uladzimir Bely]

Just one addition: previously (in v4) builds were failing in
hello:apt_fetch, not they fail in hello:apt_unpack.

Also, now repro tests failed earlier - during base_apt:do_cache. E.g:

tmp_repro_signed/work/debian-bullseye-arm64/base-apt/1.0-
r0/temp/log.do_cache.2901916:

```
...
Exporting indices...
Error opening '/build/isar_ub_devel/359/downloads/deb-src/debian-
bullseye/hello/hello_2.10-2+isar.dsc': No such file or directory
There have been errors!
WARNING: exit code 254 from a shell command.
DEBUG: Python function do_cache finished
```

[Jan Kiszka]

Logs? The pattern above looks rather different from the previous issue.

> Also, now repro tests failed earlier - during base_apt:do_cache. E.g:
>
> tmp_repro_signed/work/debian-bullseye-arm64/base-apt/1.0-
> r0/temp/log.do_cache.2901916:
>
> ```
> ...
> Exporting indices...
> Error opening '/build/isar_ub_devel/359/downloads/deb-src/debian-
> bullseye/hello/hello_2.10-2+isar.dsc': No such file or directory
> There have been errors!
> WARNING: exit code 254 from a shell command.
> DEBUG: Python function do_cache finished
> ```
>

How can this be reproduced locally in kas? That would be essential in
order to debug.

Jan

[Uladzimir Bely]

It's hard to reproduce the issue in some "short" form, but at least I
found one quite fast way - steps int it are similar to what is do in
unsigned repro test. In this test we do thre builds: normal build,
cached build (after tmp cleanup), one more normal build (without
cleanup).

The steps below do not fail with current 'next' branch of Isar, but
produce hello:apt_fetch error with 'next + patch v5':

```
./kas/kas-container menu
# Just save and exit
./kas/kas-container shell
# The rest done in kas shell
# 1st build:
bitbake hello
# Build is OK
# 2nd cached build:
sudo rm -rf sstate-cache/ tmp/
echo 'ISAR_USE_CACHED_BASE_REPO = "1"' >> conf/local.conf
echo 'BB_NO_NETWORK = "1"' >> conf/local.conf
bitbake hello
# Build is OK
# 3rd build with no cleanup
echo 'ISAR_USE_CACHED_BASE_REPO = "0"' >> conf/local.conf
echo 'BB_NO_NETWORK = "0"' >> conf/local.conf
bitbake hello
# Build fails in hello.bb:do_apt_fetch
```

I guess, other errors we observe in CI (e.g., in "do_apt_unpack") also
have the similar nature, coming from sharing working directories
between different tests that use the same targets but with different
local.conf settings.

[Jan Kiszka]

Thanks, will have a look at this later.

But if we have false-sharing here, than my patch is only surfacing a
sleeping issue, not causing it.

[Jan Kiszka]

Ok, here comes the issue:

The hello recipe is trying to consume its own, previously built, source
package here. That is in fact inside the central isar-apt, but the local
copy does not contain it (yet). And the dependency chain we have does
not ensure that after the previous do_deploy_deb do_local_isarapt is
invalidated to re-run it before a succeeding recipe run.

One may argue why the package should consume its sources from isar-apt
rather than from upstream. To achieve that, we would need to create
preferences that filter these cases out for isar-apt. Not sure if that
will be generically possible. So we really need to ensure that the
missing task invalidation from above is somehow achieved. Or we need to
clean the caches more aggressively.

This issue is in fact "created" by fixing sbuild-schroot /wrt the use
cases of this patch. As these are more important than this corner case,
I would argue that the latter has to step back when we can't resolve
things perfectly.

[Jan Kiszka]

From: Jan Kiszka <jan.k...@siemens.com>

During the migration to sbuild, support for using self-built packages in
the build environment was lost if those were already part of the
sbuild-chroot. This restores it by adding --apt-distupgrade to the
sbuild call. But that is not enough because sbuild will only upgrade
packages from already configured sources, not those specified via
--extra-repository. We therefore have to switch back to configuring
isar-apt during sbuild-chroot creation.

As rootfs_configure_isar_apt configures the isar repo under
/isar-apt, we bind-mount the one in /home/builder/${PN} to that folder.
Another difference is that we now need to run apt-get update explicitly,
but only for isar-apt.

For apt fetching, we neither need nor want isar-apt to be available.
Rebuilding self-generated apt packages is generally pointless as the
needs are better addressed in the generating recipe itself. Exposing
isar-apt to the fetch may furthermore lead to fetching a previously
built source package of the same recipe, rather than pulling the
external version.

And because the sbuild-chroots are now left behind with isar-apt
configured, the configuration in imager_run can be removed (credits to
Srinuvasan Arjunan).

Signed-off-by: Jan Kiszka <jan.k...@siemens.com>
---

Changes in v6:
- basically, going back to v4 but disabling isar-apt in do_apt_fetch

I was able to resolve the scenario that Uladzimir was sharing this way.
And I also realized that apt fetching as well as unpacking should have
no deal with isar-apt. So, v5 was taking a wrong turn.

meta/classes/dpkg-base.bbclass | 29 +++++++++++--------

meta/classes/dpkg.bbclass | 5 ++--
meta/classes/image-tools-extension.bbclass | 13 ---------
.../sbuild-chroot/sbuild-chroot.inc | 2 --

4 files changed, 20 insertions(+), 29 deletions(-)

diff --git a/meta/classes/dpkg-base.bbclass b/meta/classes/dpkg-base.bbclass
index 7b054d3f..80686677 100644

--- a/meta/classes/dpkg-base.bbclass
+++ b/meta/classes/dpkg-base.bbclass
@@ -19,8 +19,6 @@ DEPENDS:append:riscv64 = "${@' crossbuild-essential-riscv64' if d.getVar('ISAR_C
DEB_BUILD_PROFILES ?= ""
DEB_BUILD_OPTIONS ?= ""

-ISAR_APT_REPO ?= "deb [trusted=yes] file:///home/builder/${PN}/isar-apt/${DISTRO}-${DISTRO_ARCH}/apt/${DISTRO} ${DEBDISTRONAME} main"
-
python do_adjust_git() {
import subprocess

@@ -115,6 +113,8 @@ do_apt_fetch() {
trap 'exit 1' INT HUP QUIT TERM ALRM USR1
trap 'schroot_cleanup' EXIT

+ schroot -d / -u root -c ${SBUILD_CHROOT} -- \
+ rm /etc/apt/sources.list.d/isar-apt.list /etc/apt/preferences.d/isar-apt
for uri in "${SRC_APT}"; do
schroot -d / -c ${SBUILD_CHROOT} -- \
sh -c 'mkdir -p /downloads/deb-src/"$1"/"$2" && cd /downloads/deb-src/"$1"/"$2" && apt-get -y --download-only --only-source source "$2"' my_script "${BASE_DISTRO}-${BASE_DISTRO_CODENAME}" "${uri}"
@@ -221,8 +221,17 @@ def isar_export_build_settings(d):

os.environ['DEB_BUILD_OPTIONS'] = isar_deb_build_options(d)
os.environ['DEB_BUILD_PROFILES'] = isar_deb_build_profiles(d)

+dpkg_schroot_create_configs() {
+ schroot_create_configs
+ sudo -s <<'EOSUDO'
+ sbuild_fstab="${SBUILD_CONF_DIR}/fstab"
+ fstab_isarapt="${WORKDIR}/isar-apt/${DISTRO}-${DISTRO_ARCH}/apt/${DISTRO} /isar-apt none rw,bind 0 0"
+ grep -qxF "${fstab_isarapt}" ${sbuild_fstab} || echo "${fstab_isarapt}" >> ${sbuild_fstab}
+EOSUDO
+}
+

python do_dpkg_build() {
- bb.build.exec_func('schroot_create_configs', d)
+ bb.build.exec_func('dpkg_schroot_create_configs', d)
try:
bb.build.exec_func("dpkg_runbuild", d)
finally:

@@ -288,7 +297,7 @@ do_deploy_deb[lockfiles] = "${REPO_ISAR_DIR}/isar.lock"

do_deploy_deb[dirs] = "${S}"

python do_devshell() {
- bb.build.exec_func('schroot_create_configs', d)
+ bb.build.exec_func('dpkg_schroot_create_configs', d)

isar_export_proxies(d)
isar_export_ccache(d)

@@ -297,11 +306,9 @@ python do_devshell() {

bb.build.exec_func('schroot_configure_ccache', d)

schroot = d.getVar('SBUILD_CHROOT')
- isar_apt = d.getVar('ISAR_APT_REPO')
pkg_arch = d.getVar('PACKAGE_ARCH')
build_arch = d.getVar('BUILD_ARCH')
pp_pps = os.path.join(d.getVar('PP'), d.getVar('PPS'))
- debdistroname = d.getVar('DEBDISTRONAME')

install_deps = ":" if d.getVar('BB_CURRENTTASK') == "devshell_nodeps" else f"mk-build-deps -i \
--host-arch {pkg_arch} --build-arch {build_arch} \

@@ -310,15 +317,13 @@ python do_devshell() {

[Uladzimir Bely]

The issue is still reproducible with the steps I posted below, as well
as CI still fails with v6.
I think, the steps above are not sufficient to completely stop dealing
with isar-apt in do_apt_fetch() and we need some kind of 'apt update'
here to consider removed list and preferences. The question is how to
say apt to forget about isar-apt and do not run apt update for other
source lists... maybe, simply remove isar-apt files from
/var/lib/apt/lists/.

> apt ${DEBDISTRONAME} main' > \

[Uladzimir Bely]

An addition:

It seems that files are not really removed from the session for some
reason. I added some kind of "ls" near remove code:

```

+ schroot -d / -u root -c ${SBUILD_CHROOT} -- \

+ sh -c 'ls -la /etc/apt/sources.list.d/'

schroot -d / -u root -c ${SBUILD_CHROOT} -- \

rm /etc/apt/sources.list.d/isar-apt.list
/etc/apt/preferences.d/isar-apt

+ schroot -d / -u root -c ${SBUILD_CHROOT} -- \

+ sh -c 'ls -la /etc/apt/sources.list.d/'
```
, but still see the following in the log:
```
| DEBUG: Executing shell function do_apt_fetch
| total 16
| drwxr-xr-x 2 root root 4096 Jan 19 07:09 .
| drwxr-xr-x 8 root root 4096 Jan 19 07:09 ..
| -rw-r--r-- 1 root root 569 Jan 19 07:09 bootstrap.list
| -rw-r--r-- 1 root root 94 Jan 19 07:09 isar-apt.list
| total 16
| drwxr-xr-x 2 root root 4096 Jan 19 07:09 .
| drwxr-xr-x 8 root root 4096 Jan 19 07:09 ..
| -rw-r--r-- 1 root root 569 Jan 19 07:09 bootstrap.list
| -rw-r--r-- 1 root root 94 Jan 19 07:09 isar-apt.list
| Reading package lists...
```
Fith the apt_fetch failure followed, because of existing of previously
built hello source package in the isar-apt repo.

[Jan Kiszka]

OK... last-minute change of mine, splitting up the purging and the
actual fetching into two schroot runs to avoid having to run the latter
with "-u root". I didn't find a way to de-configure isar-apt
unprivileged. Back to the drawing board. :(

[Jan Kiszka]

Comparing the split run of schroot with image-tool-extension, I think
I'm just missing a proper session ID here.

[Jan Kiszka]

Before sending v7: can you try this on top?

diff --git a/meta/classes/dpkg-base.bbclass b/meta/classes/dpkg-base.bbclass
index 80686677..1a3333ac 100644
--- a/meta/classes/dpkg-base.bbclass
+++ b/meta/classes/dpkg-base.bbclass
@@ -113,10 +113,13 @@ do_apt_fetch() {

trap 'exit 1' INT HUP QUIT TERM ALRM USR1
trap 'schroot_cleanup' EXIT

- schroot -d / -u root -c ${SBUILD_CHROOT} -- \
+ session_id=$(schroot -q -b -c ${SBUILD_CHROOT})
+ echo "Started session: ${session_id}"
+
+ schroot -r -c ${session_id} -d / -u root -- \
rm /etc/apt/sources.list.d/isar-apt.list /etc/apt/preferences.d/isar-apt

for uri in "${SRC_APT}"; do

- schroot -d / -c ${SBUILD_CHROOT} -- \
+ schroot -r -c ${session_id} -d / -- \
sh -c 'mkdir -p /downloads/deb-src/"$1"/"$2" && cd /downloads/deb-src/"$1"/"$2" && apt-get -y --download-only --only-source source "$2"' my_script "${BASE_DISTRO}-${BASE_DISTRO_CODENAME}" "${uri}"
done
schroot_delete_configs

[Uladzimir Bely]

Yes, with persistent session it works, at least with reproduce steps I
used. I just added session cleanup (e.g, "schroot -e -c ${session_id}")
at the end.

Before sending v7 I could also check if it is not reproduced anymore in
CI.

Also, due to using schroot session we probably also need to care about
proper session removing in case commands under schroot fail, similar to
how it's done in image-tools-extention by imager_cleanup().

[Jan Kiszka]

Yeah, still need to check that - schroot is also still new to me,
learned a lot about it these days.

[Jan Kiszka]

diff --git a/meta/classes/dpkg-base.bbclass b/meta/classes/dpkg-base.bbclass
index 80686677..85d0a495 100644
--- a/meta/classes/dpkg-base.bbclass
+++ b/meta/classes/dpkg-base.bbclass
@@ -107,18 +107,24 @@ do_apt_fetch() {
E="${@ isar_export_proxies(d)}"
schroot_create_configs

+ session_id=$(schroot -q -b -c ${SBUILD_CHROOT})
+ echo "Started session: ${session_id}"
+

schroot_cleanup() {
+ schroot -q -f -e -c ${session_id} > /dev/null 2>&1
schroot_delete_configs

}
trap 'exit 1' INT HUP QUIT TERM ALRM USR1
trap 'schroot_cleanup' EXIT

- schroot -d / -u root -c ${SBUILD_CHROOT} -- \

+ schroot -r -c ${session_id} -d / -u root -- \

rm /etc/apt/sources.list.d/isar-apt.list /etc/apt/preferences.d/isar-apt
for uri in "${SRC_APT}"; do
- schroot -d / -c ${SBUILD_CHROOT} -- \
+ schroot -r -c ${session_id} -d / -- \

sh -c 'mkdir -p /downloads/deb-src/"$1"/"$2" && cd /downloads/deb-src/"$1"/"$2" && apt-get -y --download-only --only-source source "$2"' my_script "${BASE_DISTRO}-${BASE_DISTRO_CODENAME}" "${uri}"
done

+
+ schroot -e -c ${session_id}
schroot_delete_configs

[Uladzimir Bely]

> +
> +    schroot -e -c ${session_id}
>      schroot_delete_configs
>  }
>  
>
> Jan
>

Hello.

Checked in CI during the weekend - the issue seems not to be reproduced
anymore. So, v7 should be OK.

[Uladzimir Bely]

Since there is still no v7 on list, I'll send it on my own.

The patch is checked in CI as well as in the downstream that requires
downgrade for linux-libc-dev package. Everything looks OK.

[Uladzimir Bely]

From: Jan Kiszka <jan.k...@siemens.com>

During the migration to sbuild, support for using self-built packages in

the build environment was lost if those were already part of the

sbuild-chroot. This restores it by adding --apt-distupgrade to the

sbuild call. But that is not enough because sbuild will only upgrade
packages from already configured sources, not those specified via
--extra-repository. We therefore have to switch back to configuring
isar-apt during sbuild-chroot creation.

As rootfs_configure_isar_apt configures the isar repo under
/isar-apt, we bind-mount the one in /home/builder/${PN} to that folder.

Another difference is that we now need to run apt-get update explicitly,

but only for isar-apt.

For apt fetching, we neither need nor want isar-apt to be available.
Rebuilding self-generated apt packages is generally pointless as the
needs are better addressed in the generating recipe itself. Exposing
isar-apt to the fetch may furthermore lead to fetching a previously
built source package of the same recipe, rather than pulling the
external version.

And because the sbuild-chroots are now left behind with isar-apt
configured, the configuration in imager_run can be removed (credits to
Srinuvasan Arjunan).

Signed-off-by: Jan Kiszka <jan.k...@siemens.com>

Reviewed-by: Uladzimir Bely <ub...@ilbers.de>
---

Changes in v7: Merged v6 with fix disabling isar-apt for do_apt_fetch

meta/classes/dpkg-base.bbclass | 37 ++++++++++++-------
meta/classes/dpkg.bbclass | 5 ++-
meta/classes/image-tools-extension.bbclass | 13 -------
.../sbuild-chroot/sbuild-chroot.inc | 2 -
4 files changed, 27 insertions(+), 30 deletions(-)

diff --git a/meta/classes/dpkg-base.bbclass b/meta/classes/dpkg-base.bbclass
index 95ca3db8..86466b57 100644
--- a/meta/classes/dpkg-base.bbclass
+++ b/meta/classes/dpkg-base.bbclass
@@ -19,8 +19,6 @@ DEPENDS:append:riscv64 = "${@' crossbuild-essential-riscv64' if d.getVar('ISAR_C
DEB_BUILD_PROFILES ?= ""
DEB_BUILD_OPTIONS ?= ""

-ISAR_APT_REPO ?= "deb [trusted=yes] file:///home/builder/${PN}/isar-apt/${DISTRO}-${DISTRO_ARCH}/apt/${DISTRO} ${DEBDISTRONAME} main"

-
python do_adjust_git() {
import subprocess

@@ -109,16 +107,24 @@ do_apt_fetch() {

E="${@ isar_export_proxies(d)}"
schroot_create_configs

+ session_id=$(schroot -q -b -c ${SBUILD_CHROOT})
+ echo "Started session: ${session_id}"
+
schroot_cleanup() {
+ schroot -q -f -e -c ${session_id} > /dev/null 2>&1
schroot_delete_configs
}
trap 'exit 1' INT HUP QUIT TERM ALRM USR1
trap 'schroot_cleanup' EXIT

+ schroot -r -c ${session_id} -d / -u root -- \

+ rm /etc/apt/sources.list.d/isar-apt.list /etc/apt/preferences.d/isar-apt

for uri in "${SRC_APT}"; do
- schroot -d / -c ${SBUILD_CHROOT} -- \
+ schroot -r -c ${session_id} -d / -- \

sh -c 'mkdir -p /downloads/deb-src/"$1"/"$2" && cd /downloads/deb-src/"$1"/"$2" && apt-get -y --download-only --only-source source "$2"' my_script "${BASE_DISTRO}-${BASE_DISTRO_CODENAME}" "${uri}"

done
+
+ schroot -e -c ${session_id}
schroot_delete_configs
}

@@ -221,8 +227,17 @@ def isar_export_build_settings(d):

os.environ['DEB_BUILD_OPTIONS'] = isar_deb_build_options(d)
os.environ['DEB_BUILD_PROFILES'] = isar_deb_build_profiles(d)

+dpkg_schroot_create_configs() {
+ schroot_create_configs
+ sudo -s <<'EOSUDO'
+ sbuild_fstab="${SBUILD_CONF_DIR}/fstab"

+ fstab_isarapt="${WORKDIR}/isar-apt/${DISTRO}-${DISTRO_ARCH}/apt/${DISTRO} /isar-apt none rw,bind 0 0"

+ grep -qxF "${fstab_isarapt}" ${sbuild_fstab} || echo "${fstab_isarapt}" >> ${sbuild_fstab}
+EOSUDO
+}
+
python do_dpkg_build() {
- bb.build.exec_func('schroot_create_configs', d)
+ bb.build.exec_func('dpkg_schroot_create_configs', d)
try:
bb.build.exec_func("dpkg_runbuild", d)
finally:

@@ -288,7 +303,7 @@ do_deploy_deb[lockfiles] = "${REPO_ISAR_DIR}/isar.lock"

do_deploy_deb[dirs] = "${S}"

python do_devshell() {
- bb.build.exec_func('schroot_create_configs', d)
+ bb.build.exec_func('dpkg_schroot_create_configs', d)

isar_export_proxies(d)
isar_export_ccache(d)

@@ -297,11 +312,9 @@ python do_devshell() {

bb.build.exec_func('schroot_configure_ccache', d)

schroot = d.getVar('SBUILD_CHROOT')
- isar_apt = d.getVar('ISAR_APT_REPO')
pkg_arch = d.getVar('PACKAGE_ARCH')
build_arch = d.getVar('BUILD_ARCH')
pp_pps = os.path.join(d.getVar('PP'), d.getVar('PPS'))
- debdistroname = d.getVar('DEBDISTRONAME')

install_deps = ":" if d.getVar('BB_CURRENTTASK') == "devshell_nodeps" else f"mk-build-deps -i \
--host-arch {pkg_arch} --build-arch {build_arch} \

@@ -310,15 +323,13 @@ python do_devshell() {

termcmd = "schroot -d / -c {0} -u root -- sh -c ' \
cd {1}; \
- echo {2} > /etc/apt/sources.list.d/isar_apt.list; \
- echo \"Package: *\nPin: release n={3}\nPin-Priority: 1000\" > /etc/apt/preferences.d/isar-apt; \
- echo \"APT::Get::allow-downgrades 1;\" > /etc/apt/apt.conf.d/50isar-apt; \
- apt-get -y -q update; \
- {4}; \
+ apt-get -y -q update -o Dir::Etc::SourceList=\"sources.list.d/isar-apt.list\" -o Dir::Etc::SourceParts=\"-\" -o APT::Get::List-Cleanup=\"0\"; \
+ apt-get -y upgrade; \
+ {2}; \
export PATH=$PATH_PREPEND:$PATH; \
$SHELL -i \
'"
- oe_terminal(termcmd.format(schroot, pp_pps, isar_apt, debdistroname, install_deps), "Isar devshell", d)
+ oe_terminal(termcmd.format(schroot, pp_pps, install_deps), "Isar devshell", d)

bb.build.exec_func('schroot_delete_configs', d)
}
diff --git a/meta/classes/dpkg.bbclass b/meta/classes/dpkg.bbclass
index c699a84d..d1666f78 100644
--- a/meta/classes/dpkg.bbclass
+++ b/meta/classes/dpkg.bbclass
@@ -110,16 +110,17 @@ dpkg_runbuild() {

DEB_SOURCE_NAME=$(dpkg-parsechangelog --show-field Source --file ${WORKDIR}/${PPS}/debian/changelog)
DSC_FILE=$(find ${WORKDIR} -name "${DEB_SOURCE_NAME}*.dsc" -maxdepth 1 -print)

- sbuild -A -n -c ${SBUILD_CHROOT} --extra-repository="${ISAR_APT_REPO}" \

+ sbuild -A -n -c ${SBUILD_CHROOT} \
--host=${PACKAGE_ARCH} --build=${BUILD_ARCH} ${profiles} \
--no-run-lintian --no-run-piuparts --no-run-autopkgtest --resolve-alternatives \
--bd-uninstallable-explainer=apt \
- --no-apt-update \
+ --no-apt-update --apt-distupgrade \
--chroot-setup-commands="echo \"Package: *\nPin: release n=${DEBDISTRONAME}\nPin-Priority: 1000\" > /etc/apt/preferences.d/isar-apt" \
--chroot-setup-commands="echo \"APT::Get::allow-downgrades 1;\" > /etc/apt/apt.conf.d/50isar-apt" \
--chroot-setup-commands="rm -f /var/log/dpkg.log" \
--chroot-setup-commands="mkdir -p ${deb_dir}" \
--chroot-setup-commands="ln -sf ${ext_deb_dir}/*.deb -t ${deb_dir}/" \
+ --chroot-setup-commands="apt-get update -o Dir::Etc::SourceList=\"sources.list.d/isar-apt.list\" -o Dir::Etc::SourceParts=\"-\" -o APT::Get::List-Cleanup=\"0\"" \
--finished-build-commands="rm -f ${deb_dir}/sbuild-build-depends-main-dummy_*.deb" \

--finished-build-commands="[ -z \"\$(find ${deb_dir} -maxdepth 1 -name '*.deb' -print -quit)\" ] || cp ${CP_FLAGS} ${deb_dir}/*.deb -t ${ext_deb_dir}/" \

--finished-build-commands="cp /var/log/dpkg.log ${ext_root}/dpkg_partial.log" \
diff --git a/meta/classes/image-tools-extension.bbclass b/meta/classes/image-tools-extension.bbclass
index 58799fcf..46bdf78b 100644
--- a/meta/classes/image-tools-extension.bbclass
+++ b/meta/classes/image-tools-extension.bbclass
@@ -44,19 +44,6 @@ imager_run() {
distro="${HOST_BASE_DISTRO}-${BASE_DISTRO_CODENAME}"
fi

- # prepare isar-apt

- schroot -r -c ${session_id} -d / -u root -- sh -c " \
- mkdir -p '/etc/apt/sources.list.d'
- echo 'deb [trusted=yes] file:///isar-apt ${DEBDISTRONAME} main' > \

- '/etc/apt/sources.list.d/isar-apt.list'
-
- mkdir -p '/etc/apt/preferences.d'
- cat << EOF > '/etc/apt/preferences.d/isar-apt'
-Package: *
-Pin: release n=${DEBDISTRONAME}
-Pin-Priority: 1000
-EOF"
-
E="${@ isar_export_proxies(d)}"
deb_dl_dir_import ${schroot_dir} ${distro}
schroot -r -c ${session_id} -d / -u root -- sh -c " \
diff --git a/meta/recipes-devtools/sbuild-chroot/sbuild-chroot.inc b/meta/recipes-devtools/sbuild-chroot/sbuild-chroot.inc
index 39ced80b..2f07de82 100644
--- a/meta/recipes-devtools/sbuild-chroot/sbuild-chroot.inc
+++ b/meta/recipes-devtools/sbuild-chroot/sbuild-chroot.inc
@@ -56,8 +56,6 @@ SBUILD_CHROOT_DIR = "${WORKDIR}/rootfs"
ROOTFSDIR = "${SBUILD_CHROOT_DIR}"
ROOTFS_PACKAGES = "${SBUILD_CHROOT_PREINSTALL}"

-# We don't need /etc/apt/sources.list.d/isar-apt.list' while it's handled by sbuild
-ROOTFS_CONFIGURE_COMMAND:remove = "rootfs_configure_isar_apt"
ROOTFS_POSTPROCESS_COMMAND:remove = "rootfs_cleanup_isar_apt"

# Do not cleanup base-apt

--
2.20.1

[Jan Kiszka]

Thanks for sending - thought I did, but I only prepared locally, never
triggered the submission.

[Uladzimir Bely]

Applied to next, thanks.

[Anton Mikanovich]

> Thanks for sending - thought I did, but I only prepared locally, never
> triggered the submission.
>
> Jan
>

Hello Jan,

It looks like this change creates one more issue.
Here are simple steps to reproduce:

Prepare test recipe:

$ cat meta-isar/recipes-app/hello/pcre2.bb
inherit dpkg

SRC_URI = "apt://pcre2"

CHANGELOG_V = "<orig-version>+isar"

do_prepare_build() {
        deb_add_changelog
}

Go to kas shell (qemuamd64 bookworm):

$ kas-container shell

Perform those steps:

builder@b5422048da4a:/build$ bitbake -c local_isarapt cowsay
builder@b5422048da4a:/build$ bitbake -c build pcre2
builder@b5422048da4a:/build$ bitbake -c cleansstate sbuild-chroot-target
builder@b5422048da4a:/build$ bitbake -c build cowsay

Result:

| Reading package lists...
| Building dependency tree...
| Reading state information...
| Calculating upgrade...
| The following packages will be upgraded:
|   libpcre2-8-0
| 1 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
| Need to get 0 B/261 kB of archives.
| After this operation, 0 B of additional disk space will be used.
| Get:1 file:/isar-apt isar/main amd64 libpcre2-8-0 amd64 10.42-1+isar
[261 kB]
| Err:1 file:/isar-apt isar/main amd64 libpcre2-8-0 amd64 10.42-1+isar
|   File not found -
/isar-apt/pool/main/p/pcre2/libpcre2-8-0_10.42-1+isar_amd64.deb (2: No
such file or directory)
| E: Failed to fetch
file:/isar-apt/pool/main/p/pcre2/libpcre2-8-0_10.42-1%2bisar_amd64.deb
File not found -
/isar-apt/pool/main/p/pcre2/libpcre2-8-0_10.42-1+isar_amd64.deb (2: No
such file or directory)
| E: Unable to fetch some archives, maybe run apt-get update or try with
--fix-missing?
| E: apt-get dist-upgrade failed

Cowsay do not depend on libpcre2-8-0, but dist-upgrade makes apt to install
updated packages.

The reason is /var/lib/apt/lists in sbuild chroot rootfs has the information
about newer libpcre2-8-0_10.42-1+isar_amd64.deb while it is not exists
in local
isar-apt copy of cowsay package.
And even calling apt-get update of isar-apt do not help.

And now I have the question about which use case does your commit fix?

I've tried 2 scenarios:
1) Upgraded package needed.

meta-isar/recipes-app/hello/pcre2.bb:

CHANGELOG_V = "<orig-version>+isar"

meta-isar/recipes-app/example-raw/example-raw_0.3.bb:

DEBIAN_BUILD_DEPENDS = "libpcre2-8-0 (= 10.42-1+isar)"
DEPENDS += "pcre2"

2) Downgraded package needed.

meta-isar/recipes-app/hello/pcre2.bb:

CHANGELOG_V = "10.40-1"

meta-isar/recipes-app/example-raw/example-raw_0.3.bb:

DEBIAN_BUILD_DEPENDS = "libpcre2-8-0 (= 10.40-1)"
DEPENDS += "pcre2"

And with your commit reverted both scenarios work ok (example-raw is
built ok).
Am I missing something?

[Jan Kiszka]

The outcome is expected: local_isarapt is incorrectly run prior to
deploy_deb of pcre2. This won't happen during a normal build when cowsay
DEPENDS on pcre2, though, because of do_local_isarapt[deptask] =
"do_deploy_deb".

Now, if you used ISAR_REBUILD_ESSENTIAL_PKGS in your actual scenario, we
do have problem because your patch 21a05608d85b forgot to adjust
meta/classes/essential.bbclass. I'll send a fix.

Jan

--
Siemens AG, Foundational Technologies
Linux Expert Center

[Anton Mikanovich]

But cowsay doesn't depend on pcre2, libpcre2 got installed before
dependencies
installation but during distupgrade stage. So DEPENDS is not an option
(or how can we depend on every package?).
Probably ISAR_REBUILD_ESSENTIAL_PKGS with your fix will resolve it.

Speaking about ISAR_REBUILD_ESSENTIAL_PKGS, we should add a testcase (or
better
even a real usage in meta-isar/meta-test) for this feature.

[Jan Kiszka]

That is why we introduced ISAR_REBUILD_ESSENTIAL_PKGS.

>
> Speaking about ISAR_REBUILD_ESSENTIAL_PKGS, we should add a testcase (or
> better
> even a real usage in meta-isar/meta-test) for this feature.
>

I don't disagree.

[Anton Mikanovich]

09/02/2025 11:19, Jan Kiszka wrote:

After some testing with ISAR_REBUILD_ESSENTIAL_PKGS="pcre2" the issue is
still
there. Steps to reproduce (clean build inside kas,
ISAR_REBUILD_ESSENTIAL_PKGS
is set to "pcre2"):

builder@a1f979144422:/build$ bitbake -c build pcre2
builder@a1f979144422:/build$ echo -e "\npython
do_rootfs_install:append() {\n\n}" >> /work/meta/classes/rootfs.bbclass
builder@a1f979144422:/build$ bitbake -c build pcre2

So the question is the same: which use case does your original commit
suppose
to fix?

[Jan Kiszka]

Let me try. Maybe we have more regressions piled up since the patch was
merged.

> So the question is the same: which use case does your original commit
> suppose
> to fix?

A) the one from above
B) when you are rebuilding some non-essential package that happens to be
in the sbuild-chroot already

[Anton Mikanovich]

10/02/2025 13:13, Jan Kiszka wrote:
> On 10.02.25 11:59, Anton Mikanovich wrote:
>> After some testing with ISAR_REBUILD_ESSENTIAL_PKGS="pcre2" the issue is
>> still
>> there. Steps to reproduce (clean build inside kas,
>> ISAR_REBUILD_ESSENTIAL_PKGS
>> is set to "pcre2"):
>>
>> builder@a1f979144422:/build$ bitbake -c build pcre2
>> builder@a1f979144422:/build$ echo -e "\npython
>> do_rootfs_install:append() {\n\n}" >> /work/meta/classes/rootfs.bbclass
>> builder@a1f979144422:/build$ bitbake -c build pcre2
>>
> Let me try. Maybe we have more regressions piled up since the patch was
> merged.

The same issue can be easily reproduced on 0e846829 itself.
And it was ok on previous commit (c44c088c).

>> So the question is the same: which use case does your original commit
>> suppose
>> to fix?
> A) the one from above
> B) when you are rebuilding some non-essential package that happens to be
> in the sbuild-chroot already
>
> Jan
>

As I've already said both downgrade and upgrade cases are ok on the
latest next
with reverted 0e846829. And they were also ok on c44c088c (previous commit).
Are there any opensource downstream effected?
I just want to make sure that my next fix for this pcre2 issue will not
cause
any more regressions.

[Jan Kiszka]

Without 0e846829, packages that are already in the sbuild-chroot are not
updated. That is what the patch fixes. If things apparently "work", then
you are not using the self-built package. Please read my length commit
message to understand the issue better.

Jan

> Are there any opensource downstream effected?
> I just want to make sure that my next fix for this pcre2 issue will not
> cause
> any more regressions.
>

[Jan Kiszka]

Invalid partial rebuild scenario: If you are enforcing a rebuild of the
sbuild-chroot, you also need to wipe all ISAR_REBUILD_ESSENTIAL_PKGS
first. Can you explain what you actually did to trigger this?

If you sit down for a moment, it should become clear what makes
rebuilding complex when essential packages are replaced: They can become
part of their own sbuild-chroot.

Simply excluding isar-apt from the sbuild-chroots of essential packages
could help - but only as long as we are not rebuilding a dependency
chain of multiple packages. Granted, the latter is even less likely to
happen than already having to rebuild essential packages. We are going
down the rabbit hole of distro boot strapping here...

[Anton Mikanovich]

10/02/2025 14:02, Jan Kiszka wrote:
> Invalid partial rebuild scenario: If you are enforcing a rebuild of the
> sbuild-chroot, you also need to wipe all ISAR_REBUILD_ESSENTIAL_PKGS
> first. Can you explain what you actually did to trigger this?
>
> If you sit down for a moment, it should become clear what makes
> rebuilding complex when essential packages are replaced: They can become
> part of their own sbuild-chroot.
>
> Simply excluding isar-apt from the sbuild-chroots of essential packages
> could help - but only as long as we are not rebuilding a dependency
> chain of multiple packages. Granted, the latter is even less likely to
> happen than already having to rebuild essential packages. We are going
> down the rabbit hole of distro boot strapping here...
>
> Jan
>

Ok, it looks like I've found the case that was fixed: If package A (already
installed in sbuild-chroot) gets rebuilt with an updated version, package B
depends on any version of A (not just =new version like in my case), when B is
built, apt would keep the old version of A and not pull the newly built one.

The issues were triggered downstream after updating Isar version. I've changed
a bbclass and bitbake has failed. As a user, I'd like to be able to perform
rebuilds without wiping packages.

I'll work on a testcase and a fix for this issue.