support converting ACL images to COSI format#757
Draft
bfjelds wants to merge 3 commits into
Draft
Conversation
… queries ACL images do not ship rpm or tdnf CLI binaries, causing the convert-to-COSI flow to fail when probing for installed packages and bootloader type. Changes: - DetectBootloaderType: return systemd-boot directly (ACL always uses it) - ValidateUkiDependencies: return nil (systemd-boot is always present) - GetAllPackagesFromChroot: use host rpm --root instead of in-chroot rpm -qa - IsPackageInstalled: use host rpm -q --root instead of in-chroot tdnf - Extract parseRpmQueryOutput helper shared by both rpm query paths - Add --dbpath /var/lib/rpm to host rpm calls for deterministic DB location - Add unit tests for parser and hardcoded ACL handler returns Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…otfs The convert-to-COSI path only reads files and queries the RPM database — it does not execute programs inside the chroot. Skip default mounts (/dev, /proc, /sys, /run, /tmp) since creating their mount directories requires a writable rootfs, which fails on images with a read-only root filesystem (e.g., ACL's btrfs+dm-verity). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
ACL images may strip the RPM database for size. Fall back to an empty package list with a warning instead of hard-failing the conversion. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
bfjelds
commented
Jun 3, 2026
| packages, err := getAllPackagesFromChrootRpmViaHost(imageChroot) | ||
| if err != nil { | ||
| logger.Log.Warnf("Could not query RPM DB for ACL image, returning empty package list: %v", err) | ||
| return nil, nil |
Member
Author
There was a problem hiding this comment.
seems a little overkill to provide getAllPackagesFromChrootRpmViaHost AND be ok with returning an empty set. if empty set is acceptable for ACL, maybe just do that?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enables
imagecustomizer convert --output-image-format cosifor Azure Container Linux (ACL) images. Previously this failed because ACL images lackrpm/tdnfCLI binaries and have a read-only rootfs.Problem
Three issues blocked ACL → COSI conversion:
rpmbinary —GetAllPackagesFromChrootrunsrpm -qainside the chroot to build the COSI package manifest. ACL images don't ship rpm.tdnfbinary —DetectBootloaderTypeprobes for thesystemd-bootpackage viatdnf info. ACL images don't ship tdnf, so detection silently fails and errors with"unknown bootloader"./dev,/proc,/sys), which requires creating directories on the rootfs. ACL's btrfs+dm-verity rootfs is read-only, soMkdirAllfails.Changes
distrohandler_acl.goDetectBootloaderType: Returnsystemd-bootdirectly. ACL always uses systemd-boot + UKI (the handler already blocks GRUB in three other methods).ValidateUkiDependencies: Return nil. ACL always ships systemd-boot.IsPackageInstalled: Use hostrpm -q --root --dbpathinstead of in-chroottdnf info.GetAllPackagesFromChroot: Use hostrpm -qa --root --dbpath, gracefully returning an empty list if the RPM DB doesn't exist (common for minimal ACL images).customizepackages_rpm.gogetAllPackagesFromChrootRpmViaHost()andisPackageInstalledViaHostRpm()helpers that query the image's RPM DB using the host's rpm binary with--rootand explicit--dbpath /var/lib/rpm.parseRpmQueryOutput()shared parser (also handles empty output).artifactsinputoutput.goincludeDefaultMounts=falseinprepareImageConversionData. The convert path only reads files and queries the RPM DB — it doesn't execute programs in the chroot, so/dev//proc//sysmounts are unnecessary.Testing
parseRpmQueryOutput(valid, empty, malformed input) and ACL handler hardcoded returns (DetectBootloaderType,ValidateUkiDependencies).