container tasks: move network access out of build chain

yocto-check-layer reports an error for any task between do_fetch and
do_build that has network enabled. Two changes fix this:

container-bundle.bbclass: Move do_fetch_containers from a standalone
task into a do_fetch postfunc. When remote containers are configured,
the anonymous function adds extend_recipe_sysroot as a do_fetch
prefunc (so skopeo-native is available) and do_fetch_containers as a
postfunc. Network access during do_fetch is permitted by the QA check.

container-registry-index: Remove do_container_registry_index from the
build dependency chain (drop "before do_build"). Registry push is a
deployment action requiring explicit invocation:
  bitbake container-registry-index -c container_registry_index
The default do_build task now prints usage instructions.

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

2 files changed, 22 insertions, 4 deletions

diff --git a/classes/container-bundle.bbclass b/classes/container-bundle.bbclass
index 53b7b2f8..6f43149b 100644
--- a/classes/container-bundle.bbclass
+++ b/classes/container-bundle.bbclass
@@ -280,6 +280,12 @@ python __anonymous() {
     d.setVar('_PROCESSED_BUNDLES', ' '.join(processed_bundles))
     d.setVar('_BUNDLE_RUNTIME', runtime)
 
+    # Remote containers are fetched during do_fetch (network is allowed there).
+    # extend_recipe_sysroot populates the native sysroot so skopeo is available.
+    if remote_urls:
+        d.appendVarFlag('do_fetch', 'prefuncs', ' extend_recipe_sysroot')
+        d.appendVarFlag('do_fetch', 'postfuncs', ' do_fetch_containers')
+
     # Build service file map for custom service files
     # Format: container1=/path/to/file1;container2=/path/to/file2
     service_mappings = []
@@ -324,7 +330,7 @@ python do_fetch_containers() {
     fetched_dir = os.path.join(workdir, 'fetched')
     os.makedirs(fetched_dir, exist_ok=True)
 
-    # Find skopeo in native sysroot (available after do_prepare_recipe_sysroot)
+    # Find skopeo in native sysroot (populated by extend_recipe_sysroot prefunc)
     # skopeo-native installs to sbindir, not bindir
     staging_sbindir = d.getVar('STAGING_SBINDIR_NATIVE')
     skopeo = os.path.join(staging_sbindir, 'skopeo')
@@ -363,8 +369,9 @@ python do_fetch_containers() {
             bb.fatal(f"Failed to fetch container '{url}': {e}")
 }
 
-do_fetch_containers[network] = "1"
-addtask fetch_containers after do_prepare_recipe_sysroot before do_compile
+# do_fetch_containers runs as a postfunc of do_fetch (set in __anonymous
+# when remote containers are configured). This keeps network access within
+# do_fetch where it is permitted by yocto-check-layer.
 
 do_compile() {
     set -e
diff --git a/recipes-containers/container-registry/container-registry-index.bb b/recipes-containers/container-registry/container-registry-index.bb
index 590e89b3..7d53e28e 100644
--- a/recipes-containers/container-registry/container-registry-index.bb
+++ b/recipes-containers/container-registry/container-registry-index.bb
@@ -84,7 +84,18 @@ python do_container_registry_index() {
     bb.plain(f"Pushed {len(pushed_refs)} image references to {registry}")
 }
 
-addtask do_container_registry_index before do_build
+addtask do_container_registry_index
+
+python do_build() {
+    bb.plain("")
+    bb.plain("Container registry push requires explicit invocation (network access")
+    bb.plain("is not permitted during the normal build chain).")
+    bb.plain("")
+    bb.plain("To push OCI images to the registry, run:")
+    bb.plain("")
+    bb.plain("  bitbake container-registry-index -c container_registry_index")
+    bb.plain("")
+}
 
 # Generate a helper script with paths baked in
 # Script is placed alongside registry storage (outside tmp/) so it persists