vcontainer-tarball: track rootfs hash via explicit mcdepends

vcontainer-tarball bundles vdkr and vpdmn rootfs images alongside
the helper scripts into a single-shot SDK tarball. Those rootfs
images live in the vruntime-x86-64 / vruntime-aarch64 multiconfigs
and are pulled into the tarball at do_populate_sdk time from
tmp-<mc>/deploy/images/<machine>/<tool>/<arch>/rootfs.img. For
sstate to behave correctly, the tarball task's hash must reflect
the actual rootfs content.

In practice it didn't. A rootfs content change — adding netavark
to the image, switching the runtime from iptables to nftables —
left consumers of the SDK with a stale runtime even though their
config asked for the new behaviour. Cleansstate of vcontainer-tarball
alone didn't help: the path through the cached intermediates was
serving the old image back.

The recipe was relying on the chain

  rootfs-image:do_build
    -> initramfs-create:do_compile
    -> initramfs-create:do_deploy
    -> mcdepends -> tarball:do_populate_sdk

to propagate the rootfs hash. The break is at do_deploy: it reads
its rootfs.img out of DEPLOY_DIR, which is a known sstate sharp edge.
do_deploy can sstate-hit on its own hash while the file it deploys
came from a stale prior run, after which the downstream tarball task
hash is computed against the stale content and also hits cache.

Add a direct mcdepends from do_populate_sdk to
{vdkr,vpdmn}-rootfs-image:do_image_complete for each enabled vruntime
multiconfig. The rootfs-image task's hash now feeds the tarball hash
directly, independent of the intermediate do_deploy step. If a rootfs
content change moves the rootfs-image hash, the tarball is forced to
rebuild. When the chain was already healthy this dep adds nothing
new and costs nothing.

Verified end-to-end:

  bitbake vcontainer-tarball -c cleansstate
  bitbake vcontainer-tarball
  sha256sum tmp/deploy/sdk/vcontainer-standalone.sh
  # -> f8e75f947a506202d88a6eb196a3616f5088b11247207beab589e91fb6f2bba7

  echo 'IMAGE_INSTALL:append:pn-vpdmn-rootfs-image = " bash"' \
      >> conf/local.conf
  bitbake vcontainer-tarball
  sha256sum tmp/deploy/sdk/vcontainer-standalone.sh
  # -> 1e89554500b2a4aaabc149a01f85fad2e78ba35796977469e7fcb1ecf15a856f

Hashes differ — the rootfs content change correctly invalidated the
tarball's sstate hash and produced a fresh build.

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

1 files changed, 21 insertions, 0 deletions

diff --git a/recipes-containers/vcontainer/vcontainer-tarball.bb b/recipes-containers/vcontainer/vcontainer-tarball.bb
index 42a13527..7e59c77d 100644
--- a/recipes-containers/vcontainer/vcontainer-tarball.bb
+++ b/recipes-containers/vcontainer/vcontainer-tarball.bb
@@ -140,6 +140,25 @@ VCONTAINER_ARCHITECTURES ?= "x86_64 aarch64"
 
 # Conditionally set mcdepends based on available multiconfigs
 # (avoids parse errors when BBMULTICONFIG is not set, e.g. yocto-check-layer)
+#
+# Two layers of dependency per arch:
+#
+#   1. initramfs-create:do_deploy
+#      Task ordering — guarantees the rootfs.img / kernel / initramfs are
+#      staged under tmp-<mc>/deploy/images/<machine>/<tool>/<arch>/ before
+#      do_populate_sdk reads them.
+#
+#   2. rootfs-image:do_image_complete
+#      Defence-in-depth for sstate consistency. Without this, a rootfs
+#      content change (e.g. adding netavark, switching iptables -> nftables)
+#      would only invalidate the tarball's sstate hash if it propagates
+#      cleanly through rootfs-image:do_build -> initramfs-create:do_compile
+#      -> initramfs-create:do_deploy -> mcdepends. Any break in that chain
+#      (the DEPLOY_DIR-input sstate pattern is one known way to get a stale
+#      hit) re-introduces the netavark-stale-tarball failure mode. Listing
+#      the rootfs-image task directly puts its hash in our chain regardless
+#      of intermediate propagation, and costs nothing if the chain was
+#      already healthy.
 python () {
     bbmulticonfig = (d.getVar('BBMULTICONFIG') or "").split()
     mcdeps = []
@@ -147,6 +166,8 @@ python () {
         if mc in bbmulticonfig:
             mcdeps.append('mc::%s:vdkr-initramfs-create:do_deploy' % mc)
             mcdeps.append('mc::%s:vpdmn-initramfs-create:do_deploy' % mc)
+            mcdeps.append('mc::%s:vdkr-rootfs-image:do_image_complete' % mc)
+            mcdeps.append('mc::%s:vpdmn-rootfs-image:do_image_complete' % mc)
     if mcdeps:
         d.setVarFlag('do_populate_sdk', 'mcdepends', ' '.join(mcdeps))