Repository navigation
iso, rootfs-cleanup: ship the ISO and its images with an empty machine-id - #16
Merged
Merged
Conversation
added 2 commits
October 1, 2026 19:20
…e-id buildtasks#15 empties /etc/machine-id in every layer bt-layer exports, which covers the tar.zst templates. The ISO and every image made from it did not pass through that reset (Keel-Linux/tracker#24). fab squashes root.patched into /live/10root.squashfs with the bootstrap's id in it, and tkl-installer unpacks that squashfs onto the disk as it is: it has no machine-id step, so every machine installed from one ISO shared the id, and with it the DHCP DUID and IAID, the journal and networkd identity and keel's MariaDB server_id. bt-vm, bt-container, bt-xen, bt-openstack, bt-ec2, bt-otc and bt-docker extract that rootfs and then run apt and patches in a chroot, where systemd's postinst can write a fresh id of its own. - bin/reset-machine-id applies layer_reset_machine_id to any rootfs: an empty /etc/machine-id, /var/lib/dbus/machine-id the link to it when present. - bt-iso builds root.patched first, resets it, then lets fab squash it. The second make reuses root.patched, since nothing it depends on changed. - bin/iso-machine-id-check reads the squashfs out of the ISO with xorriso and the two files out of it with unsquashfs, and refuses an ISO that is not in that state. bt-iso runs it before screenshots and release, -u included, so an ISO made before this change is not released again. - bin/rootfs-cleanup, which every image made from the ISO's rootfs runs after its chroot work, resets the id last. - layer-lib gains layer_machine_id_is_reset, the predicate the check uses, and its comment no longer says a first boot disables units: preset-all on a first boot only enables, unless systemd was built with first-boot-full-preset, which Debian's is not (review of buildtasks#15). tests/machine-id covers the predicate, both scripts, rootfs-cleanup with a chroot stub that writes an id, and bt-iso against a fake product whose root.patched carries the 2026-09-30 id: the released ISO is empty, -u with an old ISO is refused before iso-release, a failed root.patched stops the build. Reverting the bt-iso or the rootfs-cleanup change each turns it red. CI installs squashfs-tools and xorriso for it. Coverage stays at 99.
From the review of the previous commit: - the squashfs is copied out next to the ISO, in build/ for bt-iso, not to /tmp, which can be a tmpfs smaller than a squashfs; a directory that cannot take it is refused by name; - the message says what is at each path, a directory included; - bt-iso detaches a root.sandbox left mounted by an earlier DEBUG run before the reset writes into root.patched under it, cleans the build when the reset or the check fails, and tells an ISO reused with -u apart from one it just built; - rootfs-cleanup no longer repeats reset-machine-id's own message; - the first-boot comment names Debian 13's systemd 257, since upstream means to turn first-boot-full-preset on later.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes Keel-Linux/tracker#24 for buildtasks: the ISO, and every image made from the ISO's rootfs, now ship an empty
/etc/machine-id, as the layers have since #15.Why
root.patchedinto/live/10root.squashfs. That tree still had the bootstrap's id,f0e97605....tkl-installerunpacks that squashfs onto the disk unchanged. It has no machine-id step:tkl_installer/installer.pyrunsunsquashfs -f -d targetand then grub, nothing else. So every machine installed from one ISO shared the id, and with it the DHCP DUID and IAID and MariaDB'sserver_id.bt-vm,bt-container,bt-xen,bt-openstack,bt-ec2,bt-otcandbt-dockerextract that rootfs and then run apt and patches in a chroot. There, systemd's postinst can write a new id of its own.What changes
bin/reset-machine-id ROOTFSrunslayer_reset_machine_id, the same resetbt-layerdoes.bt-isobuildsbuild/stamps/root.patchedfirst, resets it, then runsmakefor the rest. fab's stamps reuseroot.patched, so it is not rebuilt.bin/iso-machine-id-check ISOreads the squashfs out of the ISO with xorriso and checks the two files withlayer_machine_id_is_reset.bt-isoruns it before screenshots and release,-uincluded.bin/rootfs-cleanupresets the id as its last step. Every ISO-derivedbt-*calls it after its chroot work.layer-lib's first-boot comment is corrected, as the layer: export every layer with an empty machine-id #15 review asked: on systemd 257 withoutfirst-boot-full-preset, preset-all only enables units.Tests
tests/machine-idis a new suite under kcov intests/coverage.sh, and CI installssquashfs-tools xorrisofor it.rootfs-cleanupwith a chroot stub that writes an id.bt-isoend to end against a fake product whoseroot.patchedcarries the 2026-09-30 id:-uwith an old ISO is refused beforeiso-release;root.patchedstops the build.bt-isoor therootfs-cleanupchange each turns the suite red.layer-libis 390 of 391, the same one line uncovered as on 19.x.Real build
bt-iso -s -n coreran on the build host from this branch (f2a79a3), in an isolated tree (/var/tmp/keel-testbuild/i2, copies of fab-keel, no key, nothing published). It took 13 minutes, including the wait for the build lock, and made a 444,596,224 byte ISO (sha51242e1faf1...f21745). The check ran:Inside the ISO's
/live/10root.squashfs:An earlier run with longer paths (
i1) failed at fab'sroot.sandboxoverlay mount, after the reset and the squashfs had already worked. That is the overlay path-length limit known on that host, not this change.Not in this PR
bt-vmstill cannot build trixie:VM_GUESTOSstops at bullseye;vm-bundlereads a 4.19 kernel version;ovftool.layer_audit_keys.Both are steps of the plan in handbook decision 0043 (proposed).