1 files changed, 60 insertions, 3 deletions

diff --git a/recipes-containers/vcontainer/vcontainer-tarball.bb b/recipes-containers/vcontainer/vcontainer-tarball.bb
index ee3c1147..f943cfd0 100644
--- a/recipes-containers/vcontainer/vcontainer-tarball.bb
+++ b/recipes-containers/vcontainer/vcontainer-tarball.bb
@@ -50,6 +50,15 @@ TOOLCHAIN_TARGET_TASK = ""
 TARGET_ARCH = "none"
 TARGET_OS = "none"
 
+# Must use ${SDK_ARCH}-${SDKPKGSUFFIX} (e.g. x86_64-nativesdk) to match
+# the pattern explicitly listed in SSTATE_ARCHS, which SPDX's find_jsonld()
+# searches when locating the static recipe SPDX document generated by
+# do_create_recipe_spdx.  Using ${SDK_ARCH}_${SDK_OS} (x86_64_linux) is NOT
+# in SSTATE_ARCHS and causes do_create_spdx to fatal with "Could not find a
+# static SPDX document named static-vcontainer-tarball".
+# See: meta/classes-global/sstate.bbclass SSTATE_ARCHS definition and
+#      buildtools-tarball.bb for the reference pattern.
+
 # Host tools to include via SDK
 # Note: nativesdk-qemu-vcontainer is a minimal QEMU without OpenGL/virgl
 # to avoid mesa -> llvm -> clang build dependency chain
@@ -66,7 +75,7 @@ SDK_TITLE = "vcontainer tools (vdkr/vpdmn)"
 
 # SDK configuration (same pattern as buildtools-tarball)
 MULTIMACH_TARGET_SYS = "${SDK_ARCH}-nativesdk${SDK_VENDOR}-${SDK_OS}"
-PACKAGE_ARCH = "${SDK_ARCH}_${SDK_OS}"
+PACKAGE_ARCH = "${SDK_ARCH}-${SDKPKGSUFFIX}"
 PACKAGE_ARCHS = ""
 SDK_PACKAGE_ARCHS += "vcontainer-dummy-${SDKPKGSUFFIX}"
 
@@ -131,6 +140,25 @@ VCONTAINER_ARCHITECTURES ?= "x86_64 aarch64"
 
 # Conditionally set mcdepends based on available multiconfigs
 # (avoids parse errors when BBMULTICONFIG is not set, e.g. yocto-check-layer)
+#
+# Two layers of dependency per arch:
+#
+#   1. initramfs-create:do_deploy
+#      Task ordering — guarantees the rootfs.img / kernel / initramfs are
+#      staged under tmp-<mc>/deploy/images/<machine>/<tool>/<arch>/ before
+#      do_populate_sdk reads them.
+#
+#   2. rootfs-image:do_image_complete
+#      Defence-in-depth for sstate consistency. Without this, a rootfs
+#      content change (e.g. adding netavark, switching iptables -> nftables)
+#      would only invalidate the tarball's sstate hash if it propagates
+#      cleanly through rootfs-image:do_build -> initramfs-create:do_compile
+#      -> initramfs-create:do_deploy -> mcdepends. Any break in that chain
+#      (the DEPLOY_DIR-input sstate pattern is one known way to get a stale
+#      hit) re-introduces the netavark-stale-tarball failure mode. Listing
+#      the rootfs-image task directly puts its hash in our chain regardless
+#      of intermediate propagation, and costs nothing if the chain was
+#      already healthy.
 python () {
     bbmulticonfig = (d.getVar('BBMULTICONFIG') or "").split()
     mcdeps = []
@@ -138,6 +166,8 @@ python () {
         if mc in bbmulticonfig:
             mcdeps.append('mc::%s:vdkr-initramfs-create:do_deploy' % mc)
             mcdeps.append('mc::%s:vpdmn-initramfs-create:do_deploy' % mc)
+            mcdeps.append('mc::%s:vdkr-rootfs-image:do_image_complete' % mc)
+            mcdeps.append('mc::%s:vpdmn-rootfs-image:do_image_complete' % mc)
     if mcdeps:
         d.setVarFlag('do_populate_sdk', 'mcdepends', ' '.join(mcdeps))
 
@@ -307,8 +337,9 @@ Quick Start:
 Architectures included: ${ARCHITECTURES}
 
 Contents:
-  init-env.sh           - Environment setup script
-  vdkr, vdkr-<arch>     - Docker CLI wrapper
+  init-env.sh               - Environment setup script (interactive bash)
+  environment-setup-ci      - CI environment (for yocto-autobuilder-helper)
+  vdkr, vdkr-<arch>        - Docker CLI wrapper
   vpdmn, vpdmn-<arch>   - Podman CLI wrapper
   vrunner.sh            - Shared QEMU runner
   vcontainer-common.sh  - Shared CLI code
@@ -399,6 +430,32 @@ ENVEOF
     # Create init-env.sh symlink for convenience
     ln -sf environment-setup-${REAL_MULTIMACH_TARGET_SYS} ${SDK_OUTPUT}/${SDKPATH}/init-env.sh
 
+    # -----------------------------------------------------------------------
+    # CI/AutoBuilder environment script
+    # -----------------------------------------------------------------------
+    # yocto-autobuilder-helper's enable_tools_tarball() parses environment
+    # scripts line-by-line in Python.  It only honours lines starting with
+    # "export " at column 0, only substitutes $PATH, and treats "unset " at
+    # column 0 as a removal.  It does NOT evaluate shell expressions like
+    # $(...) or variable references like $FOO.
+    #
+    # Rather than adding conditional logic to the interactive bash script,
+    # generate a separate flat file with baked-in absolute paths that the
+    # AB parser can consume directly.  SDK relocation rewrites these paths
+    # at install time just like the primary environment-setup-* script.
+    ci_script=${SDK_OUTPUT}/${SDKPATH}/environment-setup-ci
+    cat > $ci_script <<CISCRIPT
+# vcontainer CI environment — for yocto-autobuilder-helper
+# Flat export lines with absolute paths; no shell logic.
+# SDK relocation rewrites these paths at install time.
+export VCONTAINER_DIR="${SDKPATH}"
+export OECORE_NATIVE_SYSROOT="${SDKPATHNATIVE}"
+export PATH="${SDKPATH}:${SDKPATHNATIVE}/usr/bin:/usr/bin:/bin:\$PATH"
+# Clean up - unset to avoid confusing other Yocto tools' >> $script
+unset OECORE_NATIVE_SYSROOT
+CISCRIPT
+    chmod 755 $ci_script
+
     # Create version file
     echo "vcontainer SDK version: ${PV}" > ${SDK_OUTPUT}/${SDKPATH}/version.txt
     echo "Built: $(date)" >> ${SDK_OUTPUT}/${SDKPATH}/version.txt