From 5ca92e99dc0706c1dcda0edd29aec46a3ccdd851 Mon Sep 17 00:00:00 2001 From: Bruce Ashfield Date: Tue, 10 Feb 2026 19:10:52 +0000 Subject: container tasks: move network access out of build chain yocto-check-layer reports an error for any task between do_fetch and do_build that has network enabled. Two changes fix this: container-bundle.bbclass: Move do_fetch_containers from a standalone task into a do_fetch postfunc. When remote containers are configured, the anonymous function adds extend_recipe_sysroot as a do_fetch prefunc (so skopeo-native is available) and do_fetch_containers as a postfunc. Network access during do_fetch is permitted by the QA check. container-registry-index: Remove do_container_registry_index from the build dependency chain (drop "before do_build"). Registry push is a deployment action requiring explicit invocation: bitbake container-registry-index -c container_registry_index The default do_build task now prints usage instructions. Signed-off-by: Bruce Ashfield --- classes/container-bundle.bbclass | 13 ++++++++++--- .../container-registry/container-registry-index.bb | 13 ++++++++++++- 2 files changed, 22 insertions(+), 4 deletions(-) diff --git a/classes/container-bundle.bbclass b/classes/container-bundle.bbclass index 53b7b2f8..6f43149b 100644 --- a/classes/container-bundle.bbclass +++ b/classes/container-bundle.bbclass @@ -280,6 +280,12 @@ python __anonymous() { d.setVar('_PROCESSED_BUNDLES', ' '.join(processed_bundles)) d.setVar('_BUNDLE_RUNTIME', runtime) + # Remote containers are fetched during do_fetch (network is allowed there). + # extend_recipe_sysroot populates the native sysroot so skopeo is available. + if remote_urls: + d.appendVarFlag('do_fetch', 'prefuncs', ' extend_recipe_sysroot') + d.appendVarFlag('do_fetch', 'postfuncs', ' do_fetch_containers') + # Build service file map for custom service files # Format: container1=/path/to/file1;container2=/path/to/file2 service_mappings = [] @@ -324,7 +330,7 @@ python do_fetch_containers() { fetched_dir = os.path.join(workdir, 'fetched') os.makedirs(fetched_dir, exist_ok=True) - # Find skopeo in native sysroot (available after do_prepare_recipe_sysroot) + # Find skopeo in native sysroot (populated by extend_recipe_sysroot prefunc) # skopeo-native installs to sbindir, not bindir staging_sbindir = d.getVar('STAGING_SBINDIR_NATIVE') skopeo = os.path.join(staging_sbindir, 'skopeo') @@ -363,8 +369,9 @@ python do_fetch_containers() { bb.fatal(f"Failed to fetch container '{url}': {e}") } -do_fetch_containers[network] = "1" -addtask fetch_containers after do_prepare_recipe_sysroot before do_compile +# do_fetch_containers runs as a postfunc of do_fetch (set in __anonymous +# when remote containers are configured). This keeps network access within +# do_fetch where it is permitted by yocto-check-layer. do_compile() { set -e diff --git a/recipes-containers/container-registry/container-registry-index.bb b/recipes-containers/container-registry/container-registry-index.bb index 590e89b3..7d53e28e 100644 --- a/recipes-containers/container-registry/container-registry-index.bb +++ b/recipes-containers/container-registry/container-registry-index.bb @@ -84,7 +84,18 @@ python do_container_registry_index() { bb.plain(f"Pushed {len(pushed_refs)} image references to {registry}") } -addtask do_container_registry_index before do_build +addtask do_container_registry_index + +python do_build() { + bb.plain("") + bb.plain("Container registry push requires explicit invocation (network access") + bb.plain("is not permitted during the normal build chain).") + bb.plain("") + bb.plain("To push OCI images to the registry, run:") + bb.plain("") + bb.plain(" bitbake container-registry-index -c container_registry_index") + bb.plain("") +} # Generate a helper script with paths baked in # Script is placed alongside registry storage (outside tmp/) so it persists -- cgit v1.2.3-54-g00ecf