mmdebstrap

Author	SHA1	Message	Date
Johannes Schauer Marin Rodrigues	91d8be5f9c	Do not use gpg --trust-model=always - gpg will not create a trustdb when running with --update-trustdb with --trust-model=always: gpg: no need for a trustdb update with 'always' trust model - subsequent gpg calls will fail because there is no trustdb in GPGHOME	2021-08-26 07:58:27 +02:00
Johannes Schauer Marin Rodrigues	850eeb24d5	more code comments	2021-08-25 05:21:57 +02:00
Johannes Schauer Marin Rodrigues	8b12375de3	add more references to #808203	2021-08-25 05:15:44 +02:00
Johannes Schauer Marin Rodrigues	c627606110	document copy:// vs. file://	2021-08-23 10:41:44 +02:00
Johannes Schauer Marin Rodrigues	dddccd5e55	tarfilter: expand description text	2021-08-23 10:33:31 +02:00
Johannes Schauer Marin Rodrigues	60dba1c19e	fixup read_subuid_subgid - use $REAL_USER_ID from English instead of $< - use getgrgid $REAL_GROUP_ID to get the group name instead of assuming the group name to be equal to the user name - also check whether /etc/subgid exists and is readable	2021-08-19 13:02:44 +02:00
Joe Groocock	15029c1c3b	improve error message for missing /etc/subuid entry (closes: #9 )	2021-08-19 11:18:53 +02:00
Johannes Schauer Marin Rodrigues	3c37d692a0	write 'uninitialized' to /etc/machine-id to support systemd ConditionFirstBoot (closes: #10 )	2021-08-19 07:18:21 +02:00
Nicolas Vigier	5283d74dfe	Remove files inside the auxfiles directory This is fixing the error: cannot rmdir /var/lib/apt/lists/auxfiles: Directory not empty at ./mmdebstrap/mmdebstrap line 3084. which happens when using apt-transport-mirror.	2021-08-19 07:18:21 +02:00
Johannes Schauer Marin Rodrigues	ea82b267c9	only run test_unshare_userns() if not root user	2021-08-18 22:06:16 +02:00
Johannes Schauer Marin Rodrigues	dfbf9cdcef	several fixes to chrootless mode	2021-08-17 23:39:20 +02:00
Johannes Schauer Marin Rodrigues	f868073b6e	add --skip=setup, --skip=update and --skip=cleanup	2021-08-17 11:11:00 +02:00
Johannes Schauer Marin Rodrigues	d62c5b7a91	README.md: add more docs	2021-08-17 11:07:48 +02:00
Johannes Schauer Marin Rodrigues	b354502b7c	README.md: add missing contributors	2021-08-17 11:06:55 +02:00
Johannes Schauer Marin Rodrigues	98f1f0abde	use apt pattern to select essential set	2021-08-17 10:30:06 +02:00
Johannes Schauer Marin Rodrigues	aae47da9ab	coverage.sh: fix test that was wrongly installing outside the chroot and download-only	2021-08-16 23:14:18 +02:00
Johannes Schauer Marin Rodrigues	3e488dd1dd	use apt from the outside by setting DPkg::Chroot-Directory	2021-08-16 22:33:39 +02:00
Johannes Schauer Marin Rodrigues	3e61382763	README.md: fix my name	2021-08-16 13:12:55 +02:00
Johannes Schauer Marin Rodrigues	c63ad87310	changes for release of Debian 11 Buster	2021-08-16 13:11:42 +02:00
Johannes Schauer Marin Rodrigues	594ea3c72e	improve busybox and --hook-dir examples in man page -- thanks Jochen Sprickerhof!	2021-05-31 16:33:34 +02:00
Johannes Schauer Marin Rodrigues	3f79c18a0d	since apt 2.1.16 we can use --error-on=any and do not anymore need to error out on all W: lines (closes: #6 )	2021-05-31 11:17:45 +02:00
Benjamin Drung	0378c101bb	Pass extended attributes (excluding system) to tar2sqfs /bin/ping (from iputils-ping) uses the security capabilities to allow users to use the program: ``` $ getcap /bin/ping /bin/ping cap_net_raw=ep ``` Debian testing/unstable images (variant important) contain security and system attributes: ``` $ mmdebstrap --variant=important bullseye root.tar $ tar --xattrs --xattrs-include='' -vv -tf root.tar \| grep -B 1 '^ ' -rwxr-xr-x 0/0 77432 2021-02-02 18:49 ./bin/ping x: 20 security.capability -- drwxr-sr-x* 0/102 0 2021-05-07 15:10 ./var/log/journal/ x: 44 system.posix_acl_access x: 44 system.posix_acl_default ``` When generating a squashfs image with mmdebstrap 0.7.5-2, these security capabilities are lost. Example for building a squashfs image in a minimal Debian unstable schroot: ``` $ apt install -y mmdebstrap squashfs-tools-ng $ mmdebstrap --variant=important buster root.squashfs $ rdsquashfs -x /bin/ping root.squashfs $ ``` tar2sqfs from squashfs-tools-ng 1.0.4-1 supports encoding extended attributes from the namespace `user`, `trusted`, and `security` (see `include/sqfs/xattr.h`). GNU tar (version 1.34) supports these three namespaces plus the namespace `system`. Passing extended attributes from the `system` namespace to tar2sqfs will produce an error: ``` ERROR: squashfs does not support xattr prefix of system.posix_acl_default ``` So pass the extended attributes to tar2sqfs, but exclude the `system` namespace. Then ping will keep its security attributes: ``` $ rdsquashfs -x /bin/ping root.squashfs security.capability=0x0100000200200000000000000000000000000000 ``` Closes: #988100 Signed-off-by: Benjamin Drung <benjamin.drung@ionos.com>	2021-05-17 21:43:10 +02:00
Johannes Schauer Marin Rodrigues	88a031477a	add --skip=cleanup/apt/lists and --skip=cleanup/apt/cache	2021-05-09 20:44:02 +02:00
Vagrant Cascadian	c51fb24c7b	Use all cores when compressing with zstd.	2021-05-09 17:32:04 +02:00
Johannes Schauer Marin Rodrigues	236b84a486	tarfilter: add --pax-exclude and --pax-include to strip extended attributes because tar2sqfs only supports user., trusted. and security.*	2021-05-07 09:39:40 +02:00
Johannes Schauer Marin Rodrigues	bd5d3c3dab	tarfilter: remove leftover debugging statement	2021-05-07 09:20:36 +02:00
Johannes Schauer Marin Rodrigues	ebfac91738	also choose null format if stdout is /dev/null and check whether major and minor number of /dev/null are as expected to avoid false positives	2021-05-04 15:01:53 +02:00
Konstantin Demin	ccd4b5c163	gpg: handle ASCII-armored keyrings as well gpg command "--list-keys" requires input files to be passed with option "--keyring" and each file must match type "public keyring v4" while gpg command "--show-keys" doesn't require extra options and handles also ASCII-armored public keyrings as well. Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>	2021-04-25 22:33:37 +03:00
Helmut Grohne	2767b051bc	implement --format=null	2021-03-25 07:04:14 +01:00
Johannes Schauer Marin Rodrigues	4c17f36072	better document the TMPDIR env var	2021-03-08 19:33:51 +01:00
Johannes Schauer Marin Rodrigues	4cd69d444a	coverage.sh: let cover output to stderr to prevent wrong message output order	2021-03-08 19:33:24 +01:00
Johannes Schauer Marin Rodrigues	4cd547286c	coverage.sh: sysvinit-utils also works with chrootless	2021-03-08 19:32:53 +01:00
Johannes Schauer Marin Rodrigues	65070e23da	coverage.sh: add more docs for chrootless essential test	2021-03-08 19:32:19 +01:00
Johannes Schauer Marin Rodrigues	5a3d1ab5c4	Rework /dev, /sys, /proc mounting - assume all entries in @devfiles to be in /dev - allow for /dev, /sys and /proc not to exist in the target and print warning - allow for /dev entries as well as /sys and /proc not to exist on the outside - simplify umount by storing special options in @umountopts - remove superfluous checks for root and unshare mode - make sure /dev entries are less than 100 chars in size for tar	2021-03-08 08:04:35 +01:00
Johannes Schauer Marin Rodrigues	d52eaa4814	instead of checking for defined-ness and then comparing with the empty string, we can just use 'length' which returns undef if its argument is undef	2021-03-08 07:54:04 +01:00
Johannes Schauer Marin Rodrigues	270fd09b43	update copyright information	2021-03-08 07:52:14 +01:00
Johannes Schauer Marin Rodrigues	d5c8a85ace	document problems with chrootless mode in man page	2021-02-23 12:50:18 +01:00
Johannes Schauer Marin Rodrigues	ecbc10794c	warn if --dpkgopt is used in chrootless mode because of #808203	2021-02-23 12:49:46 +01:00
Johannes Schauer Marin Rodrigues	49f464e7da	create /etc/dpkg/dpkg.cfg.d/ if --dpkgopt is used	2021-02-23 12:49:26 +01:00
Johannes Schauer Marin Rodrigues	bbf12c221d	tarfilter: fixup last commit by formatting with black	2021-02-22 13:45:55 +01:00
Benjamin Drung	043ab3bbf0	tarfilter: Compile prefix pattern only once According to Debian bug #978742, mmtarfilter has a slow performance with many path exclusions. The execution can be speed up if the regular expression is only compiled once instead of every time in the hot loop. Signed-off-by: Benjamin Drung <benjamin.drung@cloud.ionos.com>	2021-02-22 13:15:16 +01:00
Johannes Schauer Marin Rodrigues	5fd1ca62d9	coverage.sh: don't attempt deleting non-existant directory	2021-02-19 14:40:20 +01:00
Johannes Schauer Marin Rodrigues	067daaf4c2	also run unshare with --propagation unchanged in root mode	2021-02-19 12:53:14 +01:00
Josh Triplett	f8fc7d9bbf	Fix typo in hook directory example	2021-02-06 18:58:30 +01:00
Johannes Schauer Marin Rodrigues	976cc9c1c4	release 0.7.5	2021-02-06 14:46:37 +01:00
Johannes Schauer Marin Rodrigues	276363c2a1	coverage.sh: remove chroot directories	2021-02-06 14:46:37 +01:00
Johannes Schauer Marin Rodrigues	0009e62b3e	coverage.sh: do not run cap_sys_admin test under lxc	2021-02-06 14:46:37 +01:00
Johannes Schauer Marin Rodrigues	73cd7cd2e8	run unshare --mount with --propagation unchanged to prevent 'cannot change root filesystem propagation' when running mmdebstrap from inside a chroot	2021-02-06 10:11:53 +01:00
Trent W. Buck	f976dabb51	add examples/twb	2021-02-06 10:10:17 +01:00
Johannes Schauer Marin Rodrigues	39167dbc30	expose hook name to hooks via MMDEBSTRAP_HOOK environment variable	2021-02-06 09:18:05 +01:00

... 5 6 7 8 9 ...

934 commits