Drop coreos-base/misc-files - #4230
Open
krnowak wants to merge 17 commits into
Open
Conversation
There was a problem hiding this comment.
Pull request overview
Removes coreos-base/misc-files by relocating its per-package tweaks into coreos/config/env/*, moving the “core” account setup into dedicated acct-{user,group}/core packages, and keeping only the OEM-migration file lists as coreos-base/old-oem-files.
Changes:
- Drop
coreos-base/misc-filesand remove its USE-flag wiring from the profile. - Re-home audit/SELinux/openssh/ntp/bash adjustments into per-package env hooks and add the Kubernetes compatibility symlink to
sys-apps/baselayout. - Introduce
acct-user/core,acct-group/core, andcoreos-base/old-oem-files, and updatecoreos-base/coreosdependencies accordingly.
Reviewed changes
Copilot reviewed 27 out of 37 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild | Add Kubernetes write-redirect symlink and keepdir to baselayout install. |
| sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-3.6.8-r24.ebuild | Add versioned baselayout ebuild containing the same Kubernetes symlink logic. |
| sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use | Remove coreos-base/misc-files USE-flag selection. |
| sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit | Move audit rules + compat links into audit env hook. |
| sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libsemanage | Add compat links + placeholder file for semanage.conf. |
| sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils | Keep SELinux policy path/symlink hack and add tmpfiles entry for /var/lib/selinux symlink. |
| sdk_container/src/third_party/coreos-overlay/coreos/config/env/sec-policy/selinux-base | Add SELinux compat links + placeholder files for old reference paths. |
| sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh | Move ssh/sshd config snippets, compat symlinks, and socket drop-in into openssh env hook. |
| sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp | Move ntp.conf provisioning and systemd drop-ins into ntp env hook. |
| sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-shells/bash | Move bash/skel compat symlinks and bashrc.d snippet into bash env hook. |
| sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/old-oem-files-0.ebuild | New package carrying OEM migration file lists (previously in misc-files). |
| sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/metadata.xml | Metadata stub for new package. |
| sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/vmware | Add VMware OEM migration file list. |
| sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/qemu | (Empty in diff) OEM marker/list file for qemu. |
| sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/packet | Add Packet OEM migration file list. |
| sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/openstack | Add OpenStack OEM migration file list. |
| sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/gce | Add GCE OEM migration file list. |
| sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/digitalocean | Add DigitalOcean OEM migration file list. |
| sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/azure | Add Azure OEM migration file list. |
| sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/ami | Add AMI OEM migration file list. |
| sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/misc-files-0-r9.ebuild | Remove misc-files ebuild (functionality migrated elsewhere). |
| sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/selinux/10-var-lib-selinux.conf | Remove tmpfiles snippet (now generated in policycoreutils env hook). |
| sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/no-trigger-limit-burst.conf | Remove socket drop-in file (now generated in openssh env hook). |
| sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/50-flatcar-sshd.conf | Remove sshd snippet file (now generated in openssh env hook). |
| sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/50-flatcar-ssh.conf | Remove ssh client snippet file (now generated in openssh env hook). |
| sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntpd-always-restart.conf | Remove ntpd drop-in file (now generated in ntp env hook). |
| sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntp.conf | Remove ntp.conf file (now generated in ntp env hook). |
| sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntp-environment.conf | Remove ntp env drop-in file (now generated in ntp env hook). |
| sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/bash/99-flatcar-bcc.bash | Remove bashrc.d snippet file (now generated in bash env hook). |
| sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/99-default.rules | Remove audit rule file (now generated in audit env hook). |
| sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/80-selinux.rules | Remove audit rule file (now generated in audit env hook). |
| sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/00-clear.rules | Remove audit rule file (now generated in audit env hook). |
| sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild | Switch dependency from misc-files to old-oem-files; add acct-group/core and acct-user/core deps. |
| sdk_container/src/third_party/coreos-overlay/acct-user/core/metadata.xml | Metadata stub for new core user package. |
| sdk_container/src/third_party/coreos-overlay/acct-user/core/core-0.ebuild | Add core user package and tmpfiles-based home symlink setup. |
| sdk_container/src/third_party/coreos-overlay/acct-group/core/metadata.xml | Metadata stub for new core group package. |
| sdk_container/src/third_party/coreos-overlay/acct-group/core/core-0.ebuild | Add core group package with enforced GID 500. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| ( | ||
| insopts -m 0644 | ||
| unit_dir=$(systemd_get_systemunitdir) | ||
| insinto "${unit_dir}/ntpd.service.d" |
Comment on lines
+55
to
+59
| target=${CORE_BASH_SYMLINKS["${name}"]} | ||
| link="/home/core/${name}" | ||
| dosym -r "${target}" "${link}" | ||
| fowners --no-dereference core:core "${link}" | ||
| done |
krnowak
force-pushed
the
krnowak/misc-files-be-gone
branch
from
August 21, 2026 15:40
56305c9 to
9ef8321
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 27 out of 37 changed files in this pull request and generated 3 comments.
Suppressed comments (1)
sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit:12
newinstakes exactly two arguments (source, destination). This call passes multiple destination filenames and will fail, so the compatibility placeholder files won't be created.
| @@ -0,0 +1,7 @@ | |||
| cros_post_src_install_flatcar_modifications() { | |||
| # This links exist because old installations can still have | |||
krnowak
force-pushed
the
krnowak/misc-files-be-gone
branch
from
August 25, 2026 09:21
9ef8321 to
94f3d10
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 27 out of 37 changed files in this pull request and generated 2 comments.
Suppressed comments (2)
sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit:12
newinsis being invoked with multiple destination filenames.newinsonly installs one file at a time, so this call will fail and prevent the audit package from merging.
sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libsemanage:2- Grammar: "This links exist" should be "These links exist".
Comment on lines
5
to
7
| if [[ $(flatcar_target) != 'sdk' ]] ; then | ||
| openssh_mask=" /usr/lib*/misc/ssh-keysign /etc/ssh/sshd_config.d/*gentoo-subsystem.conf " | ||
| PKG_INSTALL_MASK+="${openssh_mask}" | ||
| INSTALL_MASK+="${openssh_mask}" | ||
| unset openssh_mask | ||
| INSTALL_MASK+=" /usr/lib*/misc/ssh-keysign /etc/ssh/sshd_config.d/*gentoo-subsystem.conf " | ||
| fi |
Comment on lines
+2
to
+4
| INSTALL_MASK+=" /etc/systemd " | ||
| # Do not install perl scripts to /usr/bin. | ||
| ntp_install_mask+=" /usr/bin/calc_tickadj /usr/bin/ntp-wait /usr/bin/ntptrace /usr/bin/update-leap" | ||
| # Do not install perl package to /usr/share/ntp. | ||
| ntp_install_mask+=" /usr/share/ntp" | ||
|
|
||
| ntp_install_mask+=' ' | ||
| INSTALL_MASK+=${ntp_install_mask} | ||
| PKG_INSTALL_MASK+=${ntp_install_mask} | ||
| unset ntp_install_mask | ||
| INSTALL_MASK+=" /usr/bin/calc_tickadj /usr/bin/ntp-wait /usr/bin/ntptrace /usr/bin/update-leap " |
Member
Author
|
CI passed. |
krnowak
marked this pull request as ready for review
August 27, 2026 11:11
chewi
requested changes
Aug 31, 2026
|
|
||
| # coreutils for realpath | ||
| BDEPEND+=" | ||
| sys-apps/coreutils |
Contributor
There was a problem hiding this comment.
We generally don't include @system dependencies unless there's a very good reason.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 27 out of 37 changed files in this pull request and generated no new comments.
Suppressed comments (1)
sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit:12
newinsonly accepts exactly two arguments (newins <src> <dest>). This call passes three destination names, so the install phase will fail.
If the goal is to create empty placeholder files for compatibility symlinks, create one empty temp file and newins it three times.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 27 out of 37 changed files in this pull request and generated no new comments.
Suppressed comments (5)
Previously missed (1) — in code that hasn't changed since the last review.
sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit:4
- This mask is only applied to source builds via
INSTALL_MASK. The build system also installs from binary packages (--usepkg/--getbinpkg), so this should be mirrored inPKG_INSTALL_MASKas well to avoid these files reappearing when merging binpkgs.
sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit:15
newinstakes a single destination name; this call passes three, so only one file will be created (or the install will fail). Create each placeholder file separately.
sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh:7- This mask is currently applied only via
INSTALL_MASK. Since images can be assembled from binary packages, mirror it inPKG_INSTALL_MASKtoo so the masked files don't come back when merging binpkgs.
if [[ $(flatcar_target) != 'sdk' ]] ; then
INSTALL_MASK+=" /usr/lib*/misc/ssh-keysign /etc/ssh/sshd_config.d/*gentoo-subsystem.conf "
fi
sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp:4
- These install masks are only applied to source builds (
INSTALL_MASK). Since the build system can merge binary packages, mirror these inPKG_INSTALL_MASKas well to keep the same behavior for binpkg merges.
INSTALL_MASK+=" /etc/systemd "
# Do not install perl scripts to /usr/bin.
INSTALL_MASK+=" /usr/bin/calc_tickadj /usr/bin/ntp-wait /usr/bin/ntptrace /usr/bin/update-leap "
sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libsemanage:2
- Grammar: singular subject.
…sc-files Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
…base/misc-files Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
…c-files Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
…c-files Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
…to baselayout Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
…install Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Co-authored-by: James Le Cuirot <jlecuirot@microsoft.com> Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Co-authored-by: James Le Cuirot <jlecuirot@microsoft.com> Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
krnowak
force-pushed
the
krnowak/misc-files-be-gone
branch
from
August 31, 2026 14:52
b0c685c to
6cbc950
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 27 out of 37 changed files in this pull request and generated 1 comment.
Suppressed comments (3)
sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh:7
- Only setting INSTALL_MASK here means these files can still be installed when consuming a binary package (PKG_INSTALL_MASK is explicitly meant for that; see profiles/coreos/base/make.defaults). This risks reintroducing ssh-keysign and the Gentoo subsystem snippet in production images built from binpkgs.
if [[ $(flatcar_target) != 'sdk' ]] ; then
INSTALL_MASK+=" /usr/lib*/misc/ssh-keysign /etc/ssh/sshd_config.d/*gentoo-subsystem.conf "
fi
sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp:4
- This masks files during source builds, but without also updating PKG_INSTALL_MASK the same paths can still get merged from binary packages (make.defaults documents PKG_INSTALL_MASK for this). If you’re relying on binpkgs for image builds, that can reintroduce the unwanted /etc/systemd entries and perl helper scripts.
# Do not install ntpdate or sntp systemd files in /etc.
INSTALL_MASK+=" /etc/systemd "
# Do not install perl scripts to /usr/bin.
INSTALL_MASK+=" /usr/bin/calc_tickadj /usr/bin/ntp-wait /usr/bin/ntptrace /usr/bin/update-leap "
sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libsemanage:2
- Grammar: “This links exist” should be “These links exist”.
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 27 out of 37 changed files in this pull request and generated no new comments.
Suppressed comments (2)
Previously missed (1) — in code that hasn't changed since the last review.
sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp:15
- This removes "${ED}/etc/ntp/ntp.conf", but the upstream ebuild and init script reference /etc/ntp.conf (no /etc/ntp/ subdir). As written, the removal is a no-op and looks like a path bug.
newins - ntp.conf
rm -f "${ED}/etc/ntp/ntp.conf"
insinto /etc
newins - ntp.conf <<'EOF'
sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libsemanage:4
- Typo in comment: “This links exist” is grammatically incorrect; keep comments consistent with other env hooks (e.g., “These links exist …”).
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 27 out of 37 changed files in this pull request and generated no new comments.
Suppressed comments (1)
Previously missed (1) — in code that hasn't changed since the last review.
sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp:13
- The NTP ebuild installs the default config as /etc/ntp.conf (see portage-stable net-misc/ntp src_install). Removing "${ED}/etc/ntp/ntp.conf" is a no-op and leaves the upstream /etc/ntp.conf in place (even if it gets overwritten later, this is misleading and can mask future changes).
rm -f "${ED}/etc/ntp/ntp.conf"
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The contents of this package were:
CI: https://jenkins.flatcar.org/job/container/job/sdk/166/cldsv/
No changelog entry, this is not a user-visible change.