Compare commits

...
3 Commits
Author SHA1 Message Date
vhaudiquet ac83a939e3 snap: confine classically and carry the full packaging toolchain
CI / build (push) Successful in 2m50s
CI / test (push) Skipped
CI / snap (push) Successful in 5m55s
A devmode snap is a smoke test, not a distribution channel: pkh
drives the whole host packaging stack (unshare chroots, overlay
mounts, dpkg/quilt/lintian across arbitrary paths), which only
classic confinement can express.

The snap now bundles every host-side tool pkh execs (git, gnupg,
dpkg-dev, quilt, pristine-tar, mmdebstrap, lintian, fakeroot,
util-linux, mount, schroot, openssh, tar/xz/bzip2), with apt and
dpkg deliberately left to the host: a core24 apt managing a newer
host's package database is exactly the skew classic snaps must
avoid. Tools running only inside the build chroot stay out; pkh
provisions those itself.

Release metadata comes from Cargo.toml instead of the git hash, and
grade is stable, so a build of any commit packs as the declared
version.

Classic-mode correctness: noble's mount/umount are staged from the
split mount package, fakeroot is exposed via symlink since
update-alternatives does not run at staging, and every bundled ELF
is patched to the core24 loader with a DT_RPATH resolving the base
and $ORIGIN. Without this the host loader would pin the snap to
hosts with a matching glibc, and the host ld.so.cache would mix
host libraries with base ones.
2026-09-21 01:22:10 +02:00
vhaudiquet 1145ca55eb docs: drop the pkh context roadmap items
The subcommand is gone from the CLI; context survives only as the
internal build backend, so there is no user-facing surface left to
track on the roadmap.
2026-09-21 00:10:45 +02:00
vhaudiquet b99f945b98 cli: remove the pkh context subcommand
The context management interface never worked reliably, and keeping
it exposed presents a feature that is not ready. Contexts remain in
the library as the execution backend for pkh deb (unshare chroots
and friends); only the CLI surface goes.
2026-09-21 00:10:45 +02:00
4 changed files with 83 additions and 121 deletions
+7
View File
@@ -1,2 +1,9 @@
*.lock
target
# Local snapcraft builds
.craft
parts
prim
stage
*.snap
-9
View File
@@ -121,13 +121,4 @@ Missing features:
- [ ] 'pkh pull'
- [ ] Cache the Sources.gz files, to improve speed
- [ ] Work in an already downloaded package, to git pull and re-fetch orig tar gz
- [ ] 'pkh context'
- [x] Select, add, remove, list contexts
- [x] Context-scoped command execution
- [ ] Context-scoped deb and test commands
- [ ] Per-architecture contexts
- [ ] Per-series contexts
- [x] ssh contexts
- [ ] docker, lxc contexts?
- [ ] context push, context pop: context stack
+74 -8
View File
@@ -5,9 +5,13 @@ description: |
pkh aims at wrapping the different debian tools and workflows
into one tool, that would have the same interface for everything,
while being smarter at integrating all workflows.
This snap uses classic confinement and carries the packaging
toolchain it drives (dpkg-dev, git, mmdebstrap, lintian, quilt, ...)
so it behaves the same on any Debian/Ubuntu host.
adopt-info: pkh-part
confinement: devmode
confinement: classic
apps:
pkh:
@@ -19,24 +23,86 @@ parts:
source: .
override-pull: |
craftctl default
craftctl set version=$(git rev-parse --short=11 HEAD)
craftctl set grade="devel"
# Release metadata comes from the crate, not the git state: a build
# of any commit must produce the version the crate declares.
craftctl set version="$(awk -F'"' '/^version =/{print $2; exit}' Cargo.toml)"
craftctl set grade="stable"
build-packages:
- build-essential
- file
- patchelf
- pkg-config
- libssl-dev
- libgpg-error-dev
- libgpgme-dev
# Host-side tools pkh execs directly. Tools that only run *inside*
# the build chroot (dose-builddebcheck, dpkg-cross) are provisioned
# there by pkh itself and must not be staged; likewise qemu-user-static
# is host binfmt configuration, not a bundled file.
#
# The apt and dpkg state-owning tools are deliberately excluded below:
# they must be the host's (classic mode makes them visible), since a
# core24 apt/dpkg managing a newer host's package database is exactly
# the version skew classic snaps must avoid. The source-package tools
# (dpkg-buildpackage, dpkg-source, ...) are bundled instead.
stage-packages:
- libgpgme11t64
- git
- curl
- gnupg
- gpgv
- dpkg-dev
- quilt
- pristine-tar
- mmdebstrap
- lintian
- fakeroot
- util-linux
- dpkg-dev
# mount/umount moved to their own package (split from util-linux)
- mount
- schroot
- openssh-client
- tar
- xz-utils
- bzip2
stage:
- -usr/lib/x86_64-linux-gnu/libicuio.so.74.2
- -usr/lib/x86_64-linux-gnu/libicutest.so.74.2
- -usr/lib/x86_64-linux-gnu/libicutu.so.74.2
- -usr/lib/x86_64-linux-gnu/libicui18n.so.74.2
- -usr/bin/apt
- -usr/bin/apt-cache
- -usr/bin/apt-cdrom
- -usr/bin/apt-config
- -usr/bin/apt-get
- -usr/bin/apt-key
- -usr/bin/apt-mark
- -usr/lib/*/libapt-*
- -usr/lib/*/libicuio*
- -usr/lib/*/libicutest*
- -usr/lib/*/libicutu*
- -usr/lib/*/libicui18n*
# update-alternatives does not run at staging time: expose the sysv
# fakeroot under the plain name dpkg-buildpackage and pkh exec.
override-prime: |
craftctl default
ln -sfn fakeroot-sysv "${CRAFT_PRIME}/usr/bin/fakeroot"
# Classic-confined ELFs default to the host loader, which pins the
# snap to hosts shipping at least the build environment's glibc,
# and cannot see the libraries deduplicated against the base.
# Point every bundled ELF at the core24 loader and give it an
# rpath resolving base libraries from the mounted base and
# snap-local libraries from $ORIGIN — the classic linter's
# guidance, and what Canonical's own classic snaps do. DT_RPATH
# (--force-rpath) is required over the default DT_RUNPATH: the
# host ld.so.cache would otherwise resolve sonames to host
# libraries first, mixing host libm/libresolv with base libc.
# DT_RPATH also propagates transitively, covering dependencies of
# dependencies (libgpgme -> libassuan). Host tools spawned later
# (host apt-get, ...) run with a pristine environment since no
# LD_LIBRARY_PATH is exported.
find "${CRAFT_PRIME}" -type f -exec sh -c '
for f do
[ "$(od -An -N4 -tx1 "$f" | tr -d " \n")" = "7f454c46" ] || continue
patchelf --set-interpreter \
/snap/core24/current/lib64/ld-linux-x86-64.so.2 "$f" 2>/dev/null || true
patchelf --force-rpath --set-rpath \
"/snap/core24/current/lib/x86_64-linux-gnu:/snap/core24/current/usr/lib/x86_64-linux-gnu:\$ORIGIN:\$ORIGIN/../lib/x86_64-linux-gnu:\$ORIGIN/../usr/lib/x86_64-linux-gnu" \
"$f" 2>/dev/null || true
done' sh {} +
-102
View File
@@ -3,7 +3,6 @@ use std::io::Write;
extern crate clap;
use clap::{Command, arg, command};
use pkh::context::ContextConfig;
extern crate flate2;
@@ -274,33 +273,6 @@ fn main() {
.help("Print the pkh-native tag catalog and exit"),
),
)
.subcommand(
Command::new("context")
.about("Manage contexts")
.subcommand_required(true)
.subcommand(
Command::new("create")
.about("Create a new context")
.arg(arg!(<name> "Context name"))
.arg(arg!(--type <type> "Context type: ssh (only type supported for now)"))
.arg(arg!(--endpoint <endpoint> "Context endpoint (for example: ssh://user@host:port)"))
)
.subcommand(
Command::new("rm")
.about("Remove a context")
.arg(arg!(<name> "Context name"))
)
.subcommand(
Command::new("ls")
.about("List contexts")
)
.subcommand(Command::new("show").about("Show current context"))
.subcommand(
Command::new("use")
.about("Set current context")
.arg(arg!(<name> "Context name"))
)
)
.subcommand(
Command::new("prune")
.about("Prune residual pkh build artifacts and caches")
@@ -716,80 +688,6 @@ fn main() {
}
}
}
Some(("context", sub_matches)) => {
let mgr = pkh::context::manager();
match sub_matches.subcommand() {
Some(("create", args)) => {
let name = args.get_one::<String>("name").unwrap();
let type_str = args
.get_one::<String>("type")
.map(|s| s.as_str())
.unwrap_or("local");
let context = match type_str {
"local" => ContextConfig::Local,
"ssh" => {
let endpoint =
args.get_one::<String>("endpoint").unwrap_or_else(|| {
error!(
"An --endpoint is required to create an ssh context. \
Expected format: [ssh://][user@]host[:port]"
);
std::process::exit(1);
});
match pkh::context::ContextConfig::from_endpoint(endpoint) {
Ok(config) => config,
Err(e) => {
error!("{e}");
std::process::exit(1);
}
}
}
_ => {
error!("Unknown context type: {}", type_str);
std::process::exit(1);
}
};
if let Err(e) = mgr.add_context(name, context) {
error!("Failed to create context: {}", e);
std::process::exit(1);
}
info!("Context '{}' created.", name);
}
Some(("rm", args)) => {
let name = args.get_one::<String>("name").unwrap();
if let Err(e) = mgr.remove_context(name) {
error!("Failed to remove context: {}", e);
std::process::exit(1);
}
info!("Context '{}' removed.", name);
}
Some(("ls", _)) => {
let contexts = mgr.list_contexts();
let current = mgr.current_name();
for ctx in contexts {
if ctx == current {
println!("* {}", ctx);
} else {
println!(" {}", ctx);
}
}
}
Some(("show", _)) => {}
Some(("use", args)) => {
let name = args.get_one::<String>("name").unwrap();
if let Err(e) = mgr.set_current(name) {
error!("Failed to set context: {}", e);
std::process::exit(1);
}
info!("Switched to context '{}'.", name);
}
_ => unreachable!(),
}
}
Some(("prune", sub_matches)) => {
let dry_run = sub_matches
.get_one::<bool>("dry_run")