From 0dd4390f7662da8c53fbe2f2ee720cdd61cfee14 Mon Sep 17 00:00:00 2001 From: Flatcar Buildbot Date: Tue, 10 Nov 2026 04:03:20 +0000 Subject: [PATCH 1/7] gentoo: Update to a1662c61dc98 Signed-off-by: Flatcar Buildbot --- sdk_container/src/third_party/gentoo | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sdk_container/src/third_party/gentoo b/sdk_container/src/third_party/gentoo index 9374e148b92..a1662c61dc9 160000 --- a/sdk_container/src/third_party/gentoo +++ b/sdk_container/src/third_party/gentoo @@ -1 +1 @@ -Subproject commit 9374e148b92394c5c8025d6a51ba2b217c42fd48 +Subproject commit a1662c61dc989f8a1ba90cd8de54b91c3f35a9de From b38a3141052258ba92c4f4faeaf6aff019f4d006 Mon Sep 17 00:00:00 2001 From: James Le Cuirot Date: Mon, 9 Nov 2026 15:38:23 +0000 Subject: [PATCH 2/7] sys-apps/portage: Backport --binpkg-respect-user-patches fix Signed-off-by: James Le Cuirot --- ...tage-buildpkg-proactive-user-patches.patch | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/portage/portage-buildpkg-proactive-user-patches.patch diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/portage/portage-buildpkg-proactive-user-patches.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/portage/portage-buildpkg-proactive-user-patches.patch new file mode 100644 index 00000000000..2505fcdf77f --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/portage/portage-buildpkg-proactive-user-patches.patch @@ -0,0 +1,26 @@ +From b1a85fb629593de585e63271cfd20cc93319dd01 Mon Sep 17 00:00:00 2001 +From: James Le Cuirot +Date: Mon, 9 Nov 2026 15:13:23 +0000 +Subject: [PATCH] depgraph: Make buildpkg-proactive aware of + --binpkg-respect-user-patches + +This now triggers a rebuild when --binpkg-respect-user-patches would +mask a binary package. + +Signed-off-by: James Le Cuirot +--- a/lib/_emerge/depgraph.py ++++ b/lib/_emerge/depgraph.py +@@ -8344,6 +8344,10 @@ class depgraph: + binpkg_changed_deps + and self._changed_deps(binpkg) + ) ++ and not ( ++ binpkg_respect_user_patches ++ and binpkg.user_patches != pkgsettings.userPatchDigest(binpkg) ++ ) + ): + break + else: +-- +2.56.0 + From e9a1afbeb015bd5ac7f81779eec2b44873ebed96 Mon Sep 17 00:00:00 2001 From: James Le Cuirot Date: Tue, 10 Nov 2026 10:50:59 +0000 Subject: [PATCH 3/7] build_image_util: Drop outdated EROOT workaround This workaround only applied when glibc was below EAPI 3. Signed-off-by: James Le Cuirot --- build_library/build_image_util.sh | 4 ---- 1 file changed, 4 deletions(-) diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh index 9992c7d4c20..af78fe1962a 100755 --- a/build_library/build_image_util.sh +++ b/build_library/build_image_util.sh @@ -520,10 +520,6 @@ start_image() { # First thing first, install baselayout to create a working filesystem. emerge_to_image "${root_fs_dir}" --nodeps --oneshot sys-apps/baselayout - # FIXME(marineam): Work around glibc setting EROOT=$ROOT - # https://bugs.gentoo.org/show_bug.cgi?id=473728#c12 - sudo mkdir -p "${root_fs_dir}/etc/ld.so.conf.d" - # Set /etc/lsb-release on the image. "${BUILD_LIBRARY_DIR}/set_lsb_release" \ --root="${root_fs_dir}" \ From a4165a9c984b87f67051638bf9d6c8c46365cf4e Mon Sep 17 00:00:00 2001 From: James Le Cuirot Date: Tue, 10 Nov 2026 11:15:29 +0000 Subject: [PATCH 4/7] build_image_util: Drop explicit env-update call Portage has reliably done this for ROOT for a long time. Signed-off-by: James Le Cuirot --- build_library/build_image_util.sh | 3 --- 1 file changed, 3 deletions(-) diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh index af78fe1962a..cc3547ea860 100755 --- a/build_library/build_image_util.sh +++ b/build_library/build_image_util.sh @@ -144,9 +144,6 @@ emerge_to_image() { # Shortcut if this was just baselayout [[ "$*" == *sys-apps/baselayout ]] && return - # Make sure profile.env has been generated - sudo -E ROOT="${root_fs_dir}" env-update --no-ldconfig - # TODO(marineam): just call ${BUILD_LIBRARY_DIR}/check_root directly once # all tests are fatal, for now let the old function skip soname errors. ROOT="${root_fs_dir}" PORTAGE_CONFIGROOT="${BUILD_DIR}"/configroot \ From b080bd0a9ff88d8394e545bb4e66b2415125963b Mon Sep 17 00:00:00 2001 From: James Le Cuirot Date: Tue, 10 Nov 2026 11:16:13 +0000 Subject: [PATCH 5/7] Drop explicit ldconfig calls Portage has supported calling this via a CHOST-based wrapper for a very long time, so just name our wrapper that instead. We don't need to specify the -r option for the root directory because Portage does this for us. Signed-off-by: James Le Cuirot --- build_library/build_image_util.sh | 5 ----- build_library/dev_container_util.sh | 1 - build_library/prod_image_util.sh | 1 - setup_board | 7 ++----- 4 files changed, 2 insertions(+), 12 deletions(-) diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh index cc3547ea860..f84e5286930 100755 --- a/build_library/build_image_util.sh +++ b/build_library/build_image_util.sh @@ -102,11 +102,6 @@ zip_update_tools() { --arch "$(get_sdk_arch)" --output-dir "${BUILD_DIR}" --zip-name "${update_zip}" } -run_ldconfig() { - # This wrapper is created by setup_board. - sudo "ldconfig-${BOARD}" -r "$1" -} - run_localedef() { local root_fs_dir="$1" info "Generating C.UTF-8 locale..." diff --git a/build_library/dev_container_util.sh b/build_library/dev_container_util.sh index 3724846979d..8e9e4321ca8 100755 --- a/build_library/dev_container_util.sh +++ b/build_library/dev_container_util.sh @@ -75,7 +75,6 @@ create_dev_container() { set_image_profile dev emerge_to_image "${root_fs_dir}" @system ${base_pkg} - run_ldconfig "${root_fs_dir}" run_localedef "${root_fs_dir}" write_packages "${root_fs_dir}" "${BUILD_DIR}/${image_packages}" write_licenses "${root_fs_dir}" "${BUILD_DIR}/${image_licenses}" diff --git a/build_library/prod_image_util.sh b/build_library/prod_image_util.sh index 955ec5542be..359b17e8e3f 100755 --- a/build_library/prod_image_util.sh +++ b/build_library/prod_image_util.sh @@ -95,7 +95,6 @@ create_prod_image() { set_image_profile prod extract_prod_gcc "${root_fs_dir}" emerge_to_image "${root_fs_dir}" "${base_pkg}" - run_ldconfig "${root_fs_dir}" run_localedef "${root_fs_dir}" local root_with_everything="${root_fs_dir}" diff --git a/setup_board b/setup_board index c7d0c987c7b..561ec016401 100755 --- a/setup_board +++ b/setup_board @@ -134,16 +134,13 @@ EOF # ldconfig cannot generate caches for non-native arches. Use QEMU and the # native ldconfig to work around that. Don't use the bwrap wrapper above # because it's unnecessarily complex for this use case. - wrapper="/usr/local/sbin/ldconfig-${BOARD_VARIANT}" + wrapper="/usr/local/sbin/${BOARD_CHOST}-ldconfig" sudo_clobber "${wrapper}" < Date: Tue, 10 Nov 2026 11:22:04 +0000 Subject: [PATCH 6/7] build_image_util: Move test_image_content call to avoid special cases sys-apps/baselayout is no longer the only shortcut case, so just move this call to where it's needed. Signed-off-by: James Le Cuirot --- build_library/build_image_util.sh | 8 -------- build_library/dev_container_util.sh | 6 ++++++ build_library/prod_image_util.sh | 5 +++++ 3 files changed, 11 insertions(+), 8 deletions(-) diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh index f84e5286930..1d330fa1cc3 100755 --- a/build_library/build_image_util.sh +++ b/build_library/build_image_util.sh @@ -135,14 +135,6 @@ emerge_to_image() { --jobs="${NUM_JOBS}" \ --verbose \ "$@" - - # Shortcut if this was just baselayout - [[ "$*" == *sys-apps/baselayout ]] && return - - # TODO(marineam): just call ${BUILD_LIBRARY_DIR}/check_root directly once - # all tests are fatal, for now let the old function skip soname errors. - ROOT="${root_fs_dir}" PORTAGE_CONFIGROOT="${BUILD_DIR}"/configroot \ - test_image_content "${root_fs_dir}" } # Switch to the dev or prod sub-profile diff --git a/build_library/dev_container_util.sh b/build_library/dev_container_util.sh index 8e9e4321ca8..64f08165899 100755 --- a/build_library/dev_container_util.sh +++ b/build_library/dev_container_util.sh @@ -76,6 +76,12 @@ create_dev_container() { set_image_profile dev emerge_to_image "${root_fs_dir}" @system ${base_pkg} run_localedef "${root_fs_dir}" + + # TODO(marineam): just call ${BUILD_LIBRARY_DIR}/check_root directly once + # all tests are fatal, for now let the old function skip soname errors. + ROOT="${root_fs_dir}" PORTAGE_CONFIGROOT="${BUILD_DIR}"/configroot \ + test_image_content "${root_fs_dir}" + write_packages "${root_fs_dir}" "${BUILD_DIR}/${image_packages}" write_licenses "${root_fs_dir}" "${BUILD_DIR}/${image_licenses}" insert_licenses "${BUILD_DIR}/${image_licenses}" "${root_fs_dir}" diff --git a/build_library/prod_image_util.sh b/build_library/prod_image_util.sh index 359b17e8e3f..b0efb7c3706 100755 --- a/build_library/prod_image_util.sh +++ b/build_library/prod_image_util.sh @@ -97,6 +97,11 @@ create_prod_image() { emerge_to_image "${root_fs_dir}" "${base_pkg}" run_localedef "${root_fs_dir}" + # TODO(marineam): just call ${BUILD_LIBRARY_DIR}/check_root directly once + # all tests are fatal, for now let the old function skip soname errors. + ROOT="${root_fs_dir}" PORTAGE_CONFIGROOT="${BUILD_DIR}"/configroot \ + test_image_content "${root_fs_dir}" + local root_with_everything="${root_fs_dir}" # Call helper script for adding sysexts to the base OS. From d78e63839f847799ff54e08012ab6d53f289df06 Mon Sep 17 00:00:00 2001 From: James Le Cuirot Date: Tue, 10 Nov 2026 10:55:26 +0000 Subject: [PATCH 7/7] build_image_util: Install the libc ASAP when building an image This is currently necessary for just one case, openssl's pkg_preinst where it does a fipsinstall. Signed-off-by: James Le Cuirot --- build_library/build_image_util.sh | 7 +++++++ build_library/dev_container_util.sh | 3 +-- build_library/prod_image_util.sh | 3 +-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh index 1d330fa1cc3..b7795ade839 100755 --- a/build_library/build_image_util.sh +++ b/build_library/build_image_util.sh @@ -481,6 +481,7 @@ start_image() { local disk_layout="$2" local root_fs_dir="$3" local update_group="$4" + local profile="$5" local disk_img="${BUILD_DIR}/${image_name}" @@ -491,6 +492,8 @@ start_image() { "${BOARD_ROOT}"/etc/portage/repos.conf \ "${BUILD_DIR}"/configroot/etc/portage/ + set_image_profile "${profile}" + info "Using image type ${disk_layout}" "${BUILD_LIBRARY_DIR}/disk_util" --disk_layout="${disk_layout}" \ format "${disk_img}" @@ -504,6 +507,10 @@ start_image() { # First thing first, install baselayout to create a working filesystem. emerge_to_image "${root_fs_dir}" --nodeps --oneshot sys-apps/baselayout + # We need the libc ASAP to execute binaries from the ROOT at install time, but + # the dependency is implicit, so explicitly install. + emerge_to_image "${root_fs_dir}" --oneshot virtual/libc + # Set /etc/lsb-release on the image. "${BUILD_LIBRARY_DIR}/set_lsb_release" \ --root="${root_fs_dir}" \ diff --git a/build_library/dev_container_util.sh b/build_library/dev_container_util.sh index 64f08165899..5bee2889e55 100755 --- a/build_library/dev_container_util.sh +++ b/build_library/dev_container_util.sh @@ -71,9 +71,8 @@ create_dev_container() { local image_packages="${image_name%.bin}_packages.txt" local image_licenses="${image_name%.bin}_licenses.json" - start_image "${image_name}" "${disk_layout}" "${root_fs_dir}" "${update_group}" + start_image "${image_name}" "${disk_layout}" "${root_fs_dir}" "${update_group}" dev - set_image_profile dev emerge_to_image "${root_fs_dir}" @system ${base_pkg} run_localedef "${root_fs_dir}" diff --git a/build_library/prod_image_util.sh b/build_library/prod_image_util.sh index b0efb7c3706..0ea886b9a00 100755 --- a/build_library/prod_image_util.sh +++ b/build_library/prod_image_util.sh @@ -89,10 +89,9 @@ create_prod_image() { local image_realinitrd_contents_wtd="${image_name%.bin}_realinitrd_contents_wtd.txt" local image_sysext_base="${image_name%.bin}_sysext.squashfs" - start_image "${image_name}" "${disk_layout}" "${root_fs_dir}" "${update_group}" + start_image "${image_name}" "${disk_layout}" "${root_fs_dir}" "${update_group}" prod # Install minimal GCC (libs only) and then everything else - set_image_profile prod extract_prod_gcc "${root_fs_dir}" emerge_to_image "${root_fs_dir}" "${base_pkg}" run_localedef "${root_fs_dir}"