Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement usrmerge for binaries #40273

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Implement usrmerge for binaries #40273

wants to merge 1 commit into from

Conversation

xnox
Copy link
Member

@xnox xnox commented Jan 22, 2025

This implements usrmerge for binaries. See:

@octo-sts octo-sts bot added the bincapz/pass bincapz/pass Bincapz (aka. malcontent) scan didn't detect any CRITICALs on the scanned packages. label Jan 22, 2025
busybox.yaml Show resolved Hide resolved
@xnox

This comment was marked as resolved.

@xnox xnox force-pushed the sbin-merge branch 3 times, most recently from f6ac440 to 9666018 Compare January 23, 2025 11:49
busybox.yaml Show resolved Hide resolved
@xnox xnox marked this pull request as ready for review January 23, 2025 23:01
busybox.yaml Show resolved Hide resolved
busybox.yaml Show resolved Hide resolved
scriptlets:
# Must work with busybox, coreutils, any $shell-binsh
pre-upgrade: |
#!/bin/sh
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When can we get rid of this?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As in the shebang? one must specify it; or the whole thing?

Apk will attempt the upgrade regardless; replacing symlinks will fail; and one ends up in a system with broken shell most likely. If one ends up in such state without backup one will have to do all of the below steps regardless; thus may as well document / attempt them anyway. Depending on what users have places in those locations it can still fail, but at least we ensure they will still have a working shell and utilities that we provided for them to fix up the container further if they have such a need.

I am only doing this, because there is no other way to stop the install or upgrade; as apk continues with unpacking broken things regardless.

I guess I can or should specify conflicts maybe? But not sure what I can conflict on.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added https://github.com/chainguard-dev/internal-dev/issues/8673 to track the post-migration code removal

pre-upgrade: |
#!/bin/sh
[ -h /bin ] && exit 0
echo Performing usr-merge...
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we set -ex this during the migration period to help with debugging?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bincapz/pass bincapz/pass Bincapz (aka. malcontent) scan didn't detect any CRITICALs on the scanned packages.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants