Repository navigation
Conversation
|
@imlk0 ，您好，您的请求已接收，请耐心等待结果。 |
|
@imlk0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。 |
The ghcr.io cryptpilot-fde image is alinux3-based and ships e2fsprogs
1.46.0, whose e2fsck rejects the casefold ext4 feature (FEATURE_C12) used
by alinux4 guest images, so cryptpilot-convert fails at the rootfs
check/shrink step ("Get a newer version of e2fsck!"). alinux4's packaged
e2fsprogs needs glibc >= 2.33 and cannot be installed on alinux3
(glibc 2.28), so build 1.47.0 from source (sha256-pinned) in a dedicated
Dockerfile.fde stage and copy the statically linked sbin binaries into
the release stage via an allowlist - e2fsprogs' make install also stages
an unmaintained 2003-era blkid plus fsck/findfs, which must not shadow
the util-linux versions the image relies on.
Also fix virt-customize availability: dnf resolves the
"(libguestfs-tools-c or libguestfs)" boolean on alinux3 to the
dependency-cheaper "libguestfs" meta package, which does not contain
virt-customize, so cryptpilot-enhance silently skipped hardening. Add
"Recommends: libguestfs-tools-c" so the tools are pulled in where
available (alinux3) and silently skipped on alinux4, keeping the RPM
installable there. Set LIBGUESTFS_BACKEND=direct in the image, as no
libvirtd runs inside containers.
Validated end-to-end in a locally assembled image: cryptpilot-enhance
and cryptpilot-convert --uki --uki-stub-version 258 against the alinux4
nocloud alibase image both succeed with no manual in-container steps.
Assisted-by: Claude:glm-5.3
Signed-off-by: Kun Lai <laikun@linux.alibaba.com>
|
@imlk0 ，您好，您的请求已接收，请耐心等待结果。 |
|
@imlk0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The published
ghcr.io/openanolis/cryptpilot-fdeimage cannot convert an alinux4 guest image end-to-end, andcryptpilot-enhancesilently does nothing inside it:FEATURE_C12), which 1.46.0'se2fsckrejects, socryptpilot-convertfails at the rootfs check/shrink step with "Get a newer version of e2fsck!". alinux4's packaged e2fsprogs 1.47 needs glibc >= 2.33 and cannot be installed on alinux3 (glibc 2.28), so it must be built from source.Requires: (libguestfs-tools-c or libguestfs)on alinux3 to the dependency-cheaperlibguestfsmeta package, which does not containvirt-customize, socryptpilot-enhanceskips hardening (with only a warning) and still exits 0.Changes
Dockerfile.fde: newe2fsprogs-builderstage compiles e2fsprogs 1.47.0 from source (kernel.org tarball, sha256-pinned) against the alinux3 glibc. The statically linked sbin binaries (e2fsck,fsck.ext2-4,resize2fs,tune2fs,mke2fs,mkfs.ext2-4,dumpe2fs) are copied intorelease-fdevia an allowlist, which deliberately excludes e2fsprogs' unmaintained 2003-erablkidand itsfsck/findfsso the util-linux versions keep working. Also setsENV LIBGUESTFS_BACKEND=direct.cryptpilot.spec: addsRecommends: libguestfs-tools-cnext to the existing boolean dependency — installed by default where available (alinux3), silently skipped on alinux4, so the RPM stays installable on both distros.Validation
e2fsprogs-builderstage built locally; staged binary set and static linking verified (ldd e2fsck→ libc only).yum installpulls inlibguestfs+libguestfs-tools-c(virt-customize present); on alinux4 the install stays green with onlylibguestfs.cryptpilot-enhance --mode partialandcryptpilot-convert --uki --uki-stub-version 258against the alinux4 nocloud alibase image both succeed with no manual in-container steps.No Rust code is touched; the per-PR docker build here will exercise the full image build.