Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fedora: allow disabling weak dependencies #1252

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

supakeen
Copy link
Member

@supakeen supakeen commented Feb 24, 2025

Weak dependency resolution is hardcoded per imagetype. This commit changes it so weak dependency resolution can be turned off per image.

We guard on the Fedora version to ensure we don't accidentally change older images.

This commit also disables weak dependency resolution for Fedora Minimal which I have mentioned here.

@supakeen supakeen requested a review from a team as a code owner February 24, 2025 20:56
@schuellerf
Copy link
Contributor

The inverted logic is necessary for "backwards compatibility" or just to map the default behavior better? I.e. disableWeakDeps=false is actually weakDeps=true

@supakeen
Copy link
Member Author

The inverted logic is necessary for "backwards compatibility" or just to map the default behavior better? I.e. disableWeakDeps=false is actually weakDeps=true

I did it because the imageType struct has no constructor and the default value for a boolean is false. It also maps pretty well on the behavior I'd like; fetch weak deps by default but explicitly disallow them per-image :)

@supakeen
Copy link
Member Author

I'll be moving this to draft so it can be rewritten to use image config(s) as per @thozza / @achilleas-k 's request.

@supakeen supakeen marked this pull request as draft February 25, 2025 15:58
@supakeen
Copy link
Member Author

supakeen commented Feb 26, 2025

Undrafting again. I gave it some thought and I'd prefer to merge as-is unless there are problems.

Moving this to image configs in a nice way requires a bunch of thought and it'd be nice to build images more quickly in the shorter term, especially with risc-v cross compilation and then do a follow up after :)

@supakeen supakeen marked this pull request as ready for review February 26, 2025 08:29
@schutzbot
Copy link
Contributor

schutzbot commented Feb 26, 2025

A previous version of this PR changed the images API or behaviour causing integration issues with osbuild-composer.
This is now fixed.

@supakeen
Copy link
Member Author

This PR changes the images API or behaviour causing integration failures with osbuild-composer. The next update of the images dependency in osbuild-composer will need work to adapt to these changes.

This is simply a notice. It will not block this PR from being merged.

Huh, why? :)

@supakeen supakeen requested a review from thozza February 26, 2025 09:50
Copy link
Member

@thozza thozza left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd suggest to move the option to ImageConfig and have the logic to not install weak deps in the image type generator function (which does not exist yet in Fedora).

Comment on lines 342 to 346
// We only support disabling weak dependencies starting at Fedora 43, this is to
// ensure that we don't break older images when/if this toggle is added to an image.
if common.VersionGreaterThanOrEqual(d.osVersion, VERSION_WEAKDEPS) && t.disableWeakDeps {
img.InstallWeakDeps = common.ToPtr(false)
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't like these conditionals in the ImageKind generator function. Especially since this will become a problem once we consolidate the implementation across fedora and rhel.

I'd suggest to move this to the ImageConfig and instead set it in the image type's default ImageConfig.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've adjusted this PR to move InstallWeakDeps into the ImageConfig instead.

@supakeen supakeen force-pushed the weak-deps branch 4 times, most recently from e6dcedd to d57566c Compare February 27, 2025 21:59
@supakeen
Copy link
Member Author

supakeen commented Feb 28, 2025

So, I'm a bit confused here @thozza this PR seems like it really shouldn't touch RHEL yet we now have a missing package (or script) on RHEL which makes it seem that crypto-policies-scripts is no longer installed.

The same happens for Fedora. I'm not entirely sure because the default is still the same and I'm only setting this to false on minimal?

My guess is something about how the OSCustomizations get applied after NewOS and overwrite the default?


As an aside, it seems wise if the FIPS customization would add crypto-policies-scripts to the package sets since it depends on it.

@supakeen
Copy link
Member Author

I've adjusted the code to always take InstallWeakDeps from ImageConfig. The only failures left now are RHEL 8.9, and RHEL 8.10 in Schutzbot.

Weak dependency resolution is hardcoded per imagetype. This commit
changes it so weak dependency resolution can be turned off per image.

Then we set weak dependency resolution to true for all distros, but turn
it off again for Fedora Minimal >= 43.

Signed-off-by: Simon de Vlieger <[email protected]>
@supakeen
Copy link
Member Author

Cool, all is good in this PR now as far as I can see :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants