Repository navigation
.github: Don't install QEMU on the Ubuntu systems - #4340
Conversation
|
Turns we out do have QEMU on Jenkins. I'd spotted it before and forgotten. It's not in the PATH, so I missed it this time. It's an ancient version, so it would be good to get rid of it. I've adjusted the |
|
@copilot What do you mean it "does not exercise the relocated policy-generation path" ? |
I meant the The linked kernel-release workflow sets up an amd64 SDK and updates kernel ebuilds; it never runs |
Test report for 4860.0.0+nightly-20261021-2100 / amd64Platforms tested : qemu_uefi-amd64 🟢 ok bpf.ig; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.basic; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.cloudinit.basic; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.cloudinit.multipart-mime; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.cloudinit.script; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.disk.raid0.data; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.disk.raid0.root; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.disk.raid1.data; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.disk.raid1.root; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.etcd-member.discovery; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.etcd-member.etcdctlv3; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.etcd-member.v2-backup-restore; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.filesystem; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.flannel.udp; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.flannel.vxlan; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.instantiated.enable-unit; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.kargs; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.luks; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.oem.indirect; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.oem.indirect.new; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.oem.regular; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.oem.regular.new; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.oem.reuse; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.oem.wipe; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.partition_on_boot_disk; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.symlink; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.translation; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.v1.btrfsroot; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.v1.ext4root; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.v1.groups; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.v1.once; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.v1.sethostname; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.v1.users; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.v1.xfsroot; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.v2.btrfsroot; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.v2.ext4root; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.v2.users; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.v2.xfsroot; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.v2_1.ext4checkexisting; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.v2_1.swap; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.ignition.v2_1.vfat; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.install.cloudinit; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.internet; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.locksmith.cluster; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.network.initramfs.second-boot; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.network.iptables; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.network.listeners; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.network.nftables; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.network.wireguard; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.omaha.ping; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.osreset.ignition-rerun; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.overlay.cleanup; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.swap_activation; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.sysext.boot; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.sysext.fallbackdownload # SKIP; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.tang.nonroot; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.tang.root; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.toolbox.dnf-install; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.tpm.eventlog; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.tpm.nonroot; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.tpm.root; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.tpm.root-cryptenroll; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.tpm.root-cryptenroll-pcr-noupdate; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.tpm.root-cryptenroll-pcr-withupdate; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.update.badverity; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.update.reboot; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.users.shells; Succeeded: qemu_uefi-amd64 (1) 🟢 ok cl.verity; Succeeded: qemu_uefi-amd64 (1) 🟢 ok confext.skiprefresh; Succeeded: qemu_uefi-amd64 (1) 🟢 ok coreos.auth.verify; Succeeded: qemu_uefi-amd64 (1) 🟢 ok coreos.ignition.groups; Succeeded: qemu_uefi-amd64 (1) 🟢 ok coreos.ignition.once; Succeeded: qemu_uefi-amd64 (1) 🟢 ok coreos.ignition.resource.local; Succeeded: qemu_uefi-amd64 (1) 🟢 ok coreos.ignition.resource.remote; Succeeded: qemu_uefi-amd64 (1) 🟢 ok coreos.ignition.resource.s3.versioned; Succeeded: qemu_uefi-amd64 (1) 🟢 ok coreos.ignition.security.tls; Succeeded: qemu_uefi-amd64 (1) 🟢 ok coreos.ignition.sethostname; Succeeded: qemu_uefi-amd64 (1) 🟢 ok coreos.ignition.systemd.enable-service; Succeeded: qemu_uefi-amd64 (1) 🟢 ok coreos.locksmith.reboot; Succeeded: qemu_uefi-amd64 (1) 🟢 ok coreos.locksmith.tls; Succeeded: qemu_uefi-amd64 (1) 🟢 ok coreos.selinux.boolean; Succeeded: qemu_uefi-amd64 (1) 🟢 ok coreos.selinux.enforce; Succeeded: qemu_uefi-amd64 (1) 🟢 ok coreos.tls.fetch-urls; Succeeded: qemu_uefi-amd64 (1) 🟢 ok coreos.update.badusr; Succeeded: qemu_uefi-amd64 (1) ❌ not ok devcontainer.docker; Failed: qemu_uefi-amd64 (1, 2, 3, 4, 5) Diagnostic output for qemu_uefi-amd64, run 5Diagnostic output for qemu_uefi-amd64, run 4Diagnostic output for qemu_uefi-amd64, run 3Diagnostic output for qemu_uefi-amd64, run 2Diagnostic output for qemu_uefi-amd64, run 1❌ not ok devcontainer.systemd-nspawn; Failed: qemu_uefi-amd64 (1, 2, 3, 4, 5) Diagnostic output for qemu_uefi-amd64, run 5Diagnostic output for qemu_uefi-amd64, run 4Diagnostic output for qemu_uefi-amd64, run 3Diagnostic output for qemu_uefi-amd64, run 2Diagnostic output for qemu_uefi-amd64, run 1🟢 ok docker.base; Succeeded: qemu_uefi-amd64 (1) 🟢 ok docker.btrfs-storage; Succeeded: qemu_uefi-amd64 (1) 🟢 ok docker.containerd-restart; Succeeded: qemu_uefi-amd64 (1) 🟢 ok docker.enable-service.sysext; Succeeded: qemu_uefi-amd64 (1) 🟢 ok docker.lib-coreos-dockerd-compat; Succeeded: qemu_uefi-amd64 (1) 🟢 ok docker.network-openbsd-nc; Succeeded: qemu_uefi-amd64 (1) 🟢 ok docker.selinux; Succeeded: qemu_uefi-amd64 (1) 🟢 ok docker.userns; Succeeded: qemu_uefi-amd64 (1) 🟢 ok kubeadm.v1.35.1.calico.base; Succeeded: qemu_uefi-amd64 (1) 🟢 ok kubeadm.v1.35.1.cilium.base; Succeeded: qemu_uefi-amd64 (1) 🟢 ok kubeadm.v1.35.1.flannel.base; Succeeded: qemu_uefi-amd64 (1) 🟢 ok kubeadm.v1.36.1.calico.base; Succeeded: qemu_uefi-amd64 (1) 🟢 ok kubeadm.v1.36.1.cilium.base; Succeeded: qemu_uefi-amd64 (1) 🟢 ok kubeadm.v1.36.1.flannel.base; Succeeded: qemu_uefi-amd64 (1) 🟢 ok kubeadm.v1.37.0.calico.base; Succeeded: qemu_uefi-amd64 (1) 🟢 ok kubeadm.v1.37.0.cilium.base; Succeeded: qemu_uefi-amd64 (1) 🟢 ok kubeadm.v1.37.0.flannel.base; Succeeded: qemu_uefi-amd64 (1) 🟢 ok linux.nfs.v3; Succeeded: qemu_uefi-amd64 (1) 🟢 ok linux.nfs.v4; Succeeded: qemu_uefi-amd64 (1) 🟢 ok linux.ntp; Succeeded: qemu_uefi-amd64 (1) 🟢 ok misc.fips; Succeeded: qemu_uefi-amd64 (1) 🟢 ok packages; Succeeded: qemu_uefi-amd64 (1) 🟢 ok sysext.custom-docker.sysext; Succeeded: qemu_uefi-amd64 (1) ❌ not ok sysext.custom-oem; Failed: qemu_uefi-amd64 (1, 2, 3, 4, 5) Diagnostic output for qemu_uefi-amd64, run 5Diagnostic output for qemu_uefi-amd64, run 4Diagnostic output for qemu_uefi-amd64, run 3Diagnostic output for qemu_uefi-amd64, run 2Diagnostic output for qemu_uefi-amd64, run 1🟢 ok sysext.disable-containerd; Succeeded: qemu_uefi-amd64 (1) 🟢 ok sysext.disable-docker; Succeeded: qemu_uefi-amd64 (1) 🟢 ok sysext.simple; Succeeded: qemu_uefi-amd64 (1) 🟢 ok systemd.journal.remote; Succeeded: qemu_uefi-amd64 (1) 🟢 ok systemd.journal.user; Succeeded: qemu_uefi-amd64 (1) 🟢 ok systemd.sysusers.gshadow; Succeeded: qemu_uefi-amd64 (1) |
This requires QEMU for non-native boards, but we want to avoid the implicit use of QEMU. Use semodule's -p option instead, which restricts writes to within the given directory. Some data is read from /etc/selinux on the host, but I think this is okay. Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
policycoreutils was outdated, and these shouldn't be limited to non-arm64. Perhaps they weren't keyworded at the time. Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
If we are to not rely on binfmt_misc, then we must explicitly invoke the given command with QEMU, not just bind mount the QEMU binary. Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
The bwrap wrapper is limited in that it only invokes QEMU for the given command and does not invoke it for any subprocesses. There is sadly no way to do that when you're not relying on binfmt_misc. localedef invokes gzip, so it doesn't work with this wrapper. We don't need to use the non-native localedef anyway. The host's copy is sufficient if you point it at the right locations. Endianness is the only potential compatibility issue, but all our boards are currently little endian. Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
This is now failing due to Ubuntu changes, but we no longer rely on implicit QEMU usage anyway, so the SDK's copy will always be used. Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
e7c3832 to
15cc22f
Compare
There was a problem hiding this comment.
🔵 Needs a closer look
The linked kernel-release run skipped image generation, leaving the ARM64 switch to SDK-native locale and SELinux-policy tools without image-build and boot validation free of host binfmt registration.
1 resolved since last review
Review effort: Balanced
|
Okay, this expanded a little beyond the original scope, but it's now really building without QEMU. |

This is now failing due to Ubuntu changes, but the changes here ensure we no longer rely on implicit QEMU usage, so the SDK's copy will always be used.
Note that we don't have QEMU on our Jenkins workers either.Tested with the kernel release job. main and alpha failed but for an unrelated reason. The rest worked, albeit there was no new kernel release.
Also tested with a GHA build.