feat: keel assemble refuses a template with a kernel or bootloader #89

Merged

marcos-mendez merged 1 commit from feat/container-template-guard into main

2026-10-09 15:55:59 -03:00

marcos-mendez commented

2026-10-08 04:01:31 -03:00

(Migrated from github.com)

Change

keel.layers.container: MACHINE_ONLY is a list of fnmatch patterns, each with its reason. check(rootfs) reads var/lib/dpkg/status and refuses the rootfs (exit ASSEMBLE_FAILED) if any matching package is recorded. A package that was removed but not purged also counts. A dpkg database that is missing or unreadable is refused too.
keel assemble --template calls check before packing, so neither the template nor its .sha512 is written. A rootfs assembled without --template, which is what the ISO is made from, is not checked.
Tests: tests/test_layers_container.py. The fixture is the package list of the published core 19.0-9 template: its 28 machine-only packages must match and the 18 close-named packages it keeps must not. Future kernel, UEFI and microcode names are covered too, as are dpkg states, a template that is refused and not written, and a rootfs-only assemble. The synthetic core layer now carries a dpkg status file. Coverage is 100 % for container.py and assemble.py and 99 % in total.
Version 0.21.0 and changelog.

The 28 packages came to about 190 MB of core 19.0-9's 904 MB. Locally, with the same set purged, core's tar.zst went from 360.3 to 199.8 MB and web's from 383.1 to 224.0 MB.

Merge order

Merge this last: first Keel-Linux/common#47 and the buildtasks PR, then rebuild the layers with keel-release --rebuild. The current layers still contain the kernel, so this version refuses them.

Locally, the full suite had 21 failures outside the layer code, in mesh tests such as tests/test_mesh_vipbridge.py. That file also fails on main in this environment. CI is the reference.

Decision 0052: a container template must never contain a kernel, an initrd, firmware, a bootloader or the installer. These now live in a boot layer of their own (Keel-Linux/common#47, Keel-Linux/buildtasks `bt-layer --boot`). ## Change - `keel.layers.container`: `MACHINE_ONLY` is a list of fnmatch patterns, each with its reason. `check(rootfs)` reads `var/lib/dpkg/status` and refuses the rootfs (exit `ASSEMBLE_FAILED`) if any matching package is recorded. A package that was removed but not purged also counts. A dpkg database that is missing or unreadable is refused too. - `keel assemble --template` calls `check` before packing, so neither the template nor its `.sha512` is written. A rootfs assembled without `--template`, which is what the ISO is made from, is not checked. - Tests: `tests/test_layers_container.py`. The fixture is the package list of the published core 19.0-9 template: its 28 machine-only packages must match and the 18 close-named packages it keeps must not. Future kernel, UEFI and microcode names are covered too, as are dpkg states, a template that is refused and not written, and a rootfs-only assemble. The synthetic core layer now carries a dpkg status file. Coverage is 100 % for `container.py` and `assemble.py` and 99 % in total. - Version 0.21.0 and changelog. The 28 packages came to about 190 MB of core 19.0-9's 904 MB. Locally, with the same set purged, core's tar.zst went from 360.3 to 199.8 MB and web's from 383.1 to 224.0 MB. ## Merge order Merge this last: first Keel-Linux/common#47 and the buildtasks PR, then rebuild the layers with `keel-release --rebuild`. The current layers still contain the kernel, so this version refuses them. Locally, the full suite had 21 failures outside the layer code, in mesh tests such as `tests/test_mesh_vipbridge.py`. That file also fails on main in this environment. CI is the reference.