SUSE-RU-2025:20280-1: important: Recommended update for python-kiwi
SLE-UPDATES
null at suse.de
Wed Jun 4 07:28:19 UTC 2025
# Recommended update for python-kiwi
Announcement ID: SUSE-RU-2025:20280-1
Release Date: 2025-04-22T14:42:49Z
Rating: important
References:
* bsc#1228741
* bsc#1235448
* bsc#1237772
Affected Products:
* SUSE Linux Micro 6.1
* SUSE Linux Micro Extras 6.1
An update that has three fixes can now be installed.
## Description:
This update for python-kiwi fixes the following issues:
* Bump version: 10.2.11 to 10.2.12
* Fix profile env variable name regression In the effort of adapting to the
latest snapper in Issue #2697 we overlooked the after effect of a different
variable name in the profile environment with regards to
$kiwi_btrfs_root_is_snapshot and $kiwi_btrfs_root_is_snapper_snapshot. Image
builds that references the former variable name would be broken by the
change. This commit makes sure no regression is introduced by providing both
variants (bsc#1237772).
* Fix grub mkimage call for the ppc platform The list of modules used to
create a grub platform image for ppc was the same list as used for the x86
bios platform. This commit fixes this and also cleans up the inconsistency
and misleading names used for creating platform specific output.
* Bump version: 10.2.10 to 10.2.11
* Update box plugin documentation Add chapter about new container build
feature. The box plugin can now also run the build in containers
* The ubuntu 20.04 github runner is closing down Make sure to move to another
runner for workloads which still uses ubuntu 20.04
* Bump version: 10.2.9 to 10.2.10
* Poetry build sdist timestamps set to epoch 0 Newer versions of poetry set
the timestamp for all source files to epoch 0. Such sources are not accepted
by e.g Debian FTP servers and in general I don't like when tools changes
their behavior just like that. This commit forces an older version of poetry
for the purpose of creating the sdist tarball which then gets published on
pypi. The argumentation for reproducible builds by forcing source files to a
certain timestamp doesn't fly for me. I'm open for any better solution
though.
* Bump version: 10.2.8 to 10.2.9
* Classify missing chkstat as debug message chkstat is a distribution specific
tool. If it is present we use it, if not we don't but it's not worth a
warning.
* Allow to run setfiles multi threaded Use option -T0 for newer setfiles
version.
* Add rd.kiwi.dialog.timeout option Allow to configure the timeout value for
dialogs displayed by the kiwi dracut code. By default the timeout is set to
60 seconds. With the special value "off" the dialog will never timeout.
* Make sure copy actions does not drop context Use shutil.copy2 to copy files
preserving their attributes in the grub BootLoader space.
* Improve unit test for archive target_dir Add a test case with absolute path
in the target_dir to make sure we never unpack the archive to the host
system.
* Fixed profiled overlay imports When building an image for profile: SOME and
providing an overlay directory named SOME/... kiwi will sync the contents of
this overlay directory to the root tree. However it took the toplevel name
SOME/ into account which is unwanted because only the sub data structure
should be synced into the new root tree.
* Bump version: 10.2.7 to 10.2.8
* Use multipath child instead of parent device On multipath systems we need to
find underlying child device instead of using parent device. This prevents
listing all parent devices for a multipath device
* Increase size for agama integration test build Agama needs more space to
build now
* Fixed agama integration test rubygem-byebug and rubygem-agama-yast seems to
no longer exist
* Update TW integration tests Package nscd was dropped from TW
* Fix documentation regarding URI styles In reference to commit
760a65558f9e2e91d3eaa3a2f9503ff596984b48 the support for iso:// URI types
was dropped some time ago. However, the documentation was not properly
updated. This commit fixes it
* Fix return value of grub helper methods The grub helper methods to find grub
tools returns a None value if the tool cannot be found. This None value
could be used later in a Command call where it will be used in a join()
command to log the resulting commandline. This join() call then fails and
raises an unhandled error causing a stack trace in the application. This
commit fixes it
* Added disk validation for duplicate installs Installing the same image to
different storage disks on the same machine creates device conflicts with
unexpected side effects. This commit adds a validation based on the PTUUID
of the disk image to check if another device on the system has the same ID
and if yes, does not allow to install the image again including a message
which device takes the same identifier (bsc#1228741).
* Fixed documentation for signing key attribute The source locator name for
local files was incorrect
* Bump version: 10.2.6 to 10.2.7
* Update documentation Added a new troubleshooting chapter as subsection to
the Build Host Constraints named Package Manager Behavior. It serves the
purpose to describe options for the customer to change the default package
manager behavior which we from the kiwi side do not influence intentionally.
This is a followup change to (bsc#1235448).
* Drop still present tox artifacts There were still some left over tox files
and the documentation contribution chapter was also wrong at several places
* Add support for reading optional pkgmgr env file If there is a file
.kiwi.package_manager.env in the root of the image tree it will be read and
put into the caller environment for the selected package and repository
manager. There are features in e.g zypper which can only be used via env
variables (bsc#1235448).
* Auto convert unit test XML data to schema v8.3
* Rename btrfs_root_is_snapshot Rename btrfs_root_is_snapshot to
btrfs_root_is_snapper_snapshot. This happens in preparation for the changes
suggested where we want to get rid of snapper specific btrfs code which will
be available in snapper natively soon. To make sure a btrfs layout specific
to snapper(and SUSE), the implicitly used attribute named
btrfs_root_is_snapshot now becomes explicit and its new name will indicate
that snapper sits behind it. Along with the rename a XSLT stylesheet to
automatically convert the old name into the new name for schema v8.3 will be
performed.
* Bump version: 10.2.5 to 10.2.6
* Fixed donate button target
* Added LUKS reencryption support Added rd.kiwi.oem.luks.reencrypt boot option
consumed by the kiwi-repart dracut module. For OEM LUKS2 encrypted disk
images. If set, reencrypts the disk prior an eventual resize and therefore
creates a new key pool and master key. The reencryption is advisable if the
image binary is not protected. With access to the image binary it's possible
to extract the luks header which then allows to decrypt the data unless it
was reencrypted. The reencryption process only runs if the checksum of the
luks header still matches the one from the original disk image. Be aware
that the reencryption will ask for the passphrase if the image has been
built with an initial luks passphrase.
* Fixed arm/tumbleweed/test-image-rpi No ruby required for this integration
test build
* Plain zipl loader needs boot partition If the rootfs is something zipl
cannot read, we need an extra boot partition using a supported filesystem
* Fixed IBM-Cloud-Standard profile The test-image-MicroOS integration test
builds an IBM-Cloud-Standard profile as encrypted variant with a random key
that is not protected by an encrypted boot image. This doesn't make sense.
Thus the encryption setup for the IBM cloud standard build got removed. Use
the IBM-Cloud-Secure-Execution profile to test encrypted secure linux builds
* Fixed test-image-qcow-openstack rsh package was dropped from TW
* Fix genprotimg for s390 builds A recent change on genprotimg now forbids to
use --cert in combination with --no-verify, even though this was allowed
before.
* Fix documentation for repo, package gpg settings In contrast to the
documentation, kiwi sets default values for any gpg setting if not
explicitly specified differently. We want to avoid to inherit a behavior
from how the distribution packages the package manager. This commit fixes
the documentation to be in line with the implementation
* Drop insecure and unsupported md5 digest Decommission the Checksum.md5()
method and move all places in code to sha256(). The md5 digest is considered
insecure and has also been removed from hashlib as a supported digest.
* Fix config functions action The action failed on the setup of the runtime
because the upgrade of pip failed.
* Bump version: 10.2.4 to 10.2.5
* Changed systemfiles provider Instead of providing a static list of
filenames, provide a list of package names. It is expected that the pilot of
flake-pilot resolves this list against the local package database to build
up the filelist for provisioning
* Bump version: 10.2.3 to 10.2.4
* Update system files setup for containers The attribute provide_system_files
creates a meta file in the root tree named 'systemfiles'. The contents of
this file were produced by just a dump of the package database so far. For a
more generic use of this data some adaptions were needed. First we allow to
skip packages matching a pattern from being part of the system files. Next
we do not put ghost and doc files into account. And last we handle library
files in a different file named 'systemfiles.libs' where we do not add
symlink targets if the target path is also part of the package. The consumer
of this information is flake-pilot which syncs that library system files
from the host via --copy-links. This allows a more generic use with regards
to versioned libraries e.g. libc
* Drop /dev/pts from bind mount locations This has created havoc in the Fedora
build environments by fully unmounting /dev/pts and breaking the builders
for subsquent tasks. This is a partial revert of commit
daf1323c5ded7e4e7783205f5e30457b40eb322f.
* Don't take ghost files into account When creating the system files
information do not take ghost files and artifact files into account
* Bump version: 10.2.2 to 10.2.3
* Update STYLEROOT to SUSE 2022
* Fix broken links in the documentation
* Fix legacy_bios_mode detection The code in this method does not work
correctly if the firmware is set to 'bios'. In bios only mode the method
returned a false value which is incorrect as it should return a true value
in this case. Without this patch ISO images will fail to boot because no
loader gets configured.
* Added /dev/pts to bind mount locations During runtime several kernel
filesystems are bind mounted into the image root system such that programs
expecting it can work. /dev/pts was not needed so far but seems to be a good
addition to the list to make tools like sudo to work properly when called
e.g. from a config.sh script.
* xorriso: respect efiparttable and gpt_hybrid_mbr This should make the
xorriso-based ISO build path respect the 'efiparttable' and 'gpt_hybrid_mbr'
settings when building a UEFI-compatible image, making it write a GPT disk
label by default instead of an MBR (msdos) one. If it's building an image
that is not UEFI-compatible it will always write an MBR label, regardless of
this setting. If 'gpt_hybrid_mbr' is set, xorriso will write an Ubuntu-style
MBR/GPT hybrid partition table, where the MBR partition table includes a
partition with type 00 and the bootable flag, as well as the partition with
type ee required by the UEFI spec. This mildly violates the UEFI spec but
may make the image bootable on native BIOS or CSM firmwares which refuse to
boot from a disk with no partition marked 'bootable' in the MBR. If
'gpt_hybrid_mbr' is not set, xorriso will write a strictly UEFI-spec
compliant label, with just the 'protective MBR' required by the UEFI spec
(no bootable partition) and the correct GPT partition table. Note this is
somewhat different from what gpt_hybrid_mbr does for disk images. Also, we
now pass -compliance no_emul_toc when building ISOs, as recommended by
upstream in https://lists.gnu.org/archive/html/bug-
xorriso/2024-11/msg00012.html This tool is generally always going to be
building ISOs intended for write-once use, not multi-session use (and which
are rarely, these days, written to physical discs at all anyway).
* Added provide/require system files for containers Added the attributes
provide_system_files and require_system_files to control the provider and
requester of system files in container image builds. systemfiles is a
metadata file which contains all files from the package database at call
time. It is used in flake-pilot to provision the systemfiles data from the
host into the container instance. One possible use case for this data is a
flake registration which uses a base container that is derived from a
runtime container but all data from the runtime should be provisioned from
the host. Using this feature tightly couples the flake to the host OS
distribution and version.
* Bump version: 10.2.1 to 10.2.2
* Fix scope issue Increase livetime of the the compressor instances to the
livetime of RootImportOCI. They create temporary files which are referenced
later and need to live longer than the block they got created in
* Bump version: 10.2.0 to 10.2.1
* Fixed use of fscreateoptions for iso type The information for
fscreateoptions was not passed along to the tooling if a custom filesystem
attribute was specified.
* Allow to derive from multiple containers Add support for multi inheritance
to the derived_from attribute In the order of a comma seperated list of
docker source URI's a base tree is created. This was possible only with one
container so far and Fixes #2680 as well as jira#OBS-354
* Bump version: 10.1.18 to 10.2.0
* Add selinux test build to TW Also update derived docker integration test to
latest Leap
* kiwi/schema: Fix allowed value type for ISO publisher and application ID
According to the spec, this should be constrained to 128 characters but also
allow quite a few other special characters (as well as spaces). We didn't
allow spaces in application ID, but allowed too much for Publisher. Now we
set up both correctly.
* Fix setup of kiwi environment variables Some kiwi env vars are initialized
with an empty value and not overwritten if another value is provided. For
the selected variables an empty value setting is not allowed because the
schema also enforces the value to be set at least once. In addition a
helpful option named --print-kiwi-env was added to the 'image info' command
which allows to print the environment variables and their values.
* Add random key support for LUKS encryption Allow to pass luks="random". In
random mode use the generated keyfile as the only key to decrypt. This is
only secure if the generated initrd also gets protected e.g. through
encryption like it is done with the secure linux execution on zSystems
* Added development group in pyproject setup generateDS and other tools are
needed and were forgotten to be added when we deleted the tox dependency
* Added containers integration with OBS When building in the Open Build
Service (OBS) there is no way to create outgoing connections from the build
workers. To allow the containers section to fetch containers from the SUSE
registry we need to apply an OCI URI translation into a local path. The
actual OCI container image is expected to be provided by the obs backend on
the worker. Along with this commit also an integration test named test-
image-disk-containers is provided (jira#OBS-351).
* Fix rendering of SUSE docs The SUSE documentation is produced through a
conversion of the ReST source into docbook. The name kiwi is reserved in the
index and needs to be referenced as kiwi-ng when used as command.
* Remove tox dependency tox was used as sort of a make target to run unit
tests and more in a python virtualenv. However, since we switched everything
to poetry it's no longer needed to let tox create the python virtual
environments. This commit moves the tox targets into the Makefile and adapts
the github workflow files accordingly. In addition the scripts container
based tests were re-activated and fixed such that they succeed again.
* Fix make build target Move the actions done by the tox target into the build
target and call them there in a clean and easy to spot sequence. There is no
need to call tox to prepare for the package submission, instead the checks
and poetry runs to prepare for the package target should be called directly
as part of the build target. In the future we might get rid of tox
completely.
* Bump version: 10.1.17 to 10.1.18
* Fixed zipl caller environment zipl gets confused with an active sysfs mount
inside the root tree at call time of zipl. This commit umounts the /sys bind
mount in the image tree prior calling zipl
* Fix s390 test-image-disk build Add missing kernel links used by suse tools
* Bump version: 10.1.16 to 10.1.17
* Fix coloring of build_status.sh flags Depending on the place of the status
flag the color setup might fail. This commit fixes it
* Add pytest-container as optional dependency The pyproject.toml listed
pytest-container as dependency but it is used only to run the container
based integration tests for the shell helper methods. For building the
package this dependency should not be pulled in
* Fix networking in erofs integration test The network setup was systemd-
networkd based but the provided network config was not for systemd
* Bump version: 10.1.15 to 10.1.16
* Fix erofs requires in spec erofs-utils for SUSE only exists in Tumbleweed.
The former conditon would also add the requirement for ALP and SLFO which is
wrong. This commit fixes it
* Add vagrantconfig rule for vagrant format If the format="vagrant" attribute
is set, a vagrantconfig section becomes mandatory. This commit enforces this
rule on the schema.
* Bump version: 10.1.14 to 10.1.15
* Fixed sphinx_rtd_theme setup Delete obsolete display_version attribute
* Evaluate eficsm everywhere Fixed _supports_bios_modules() to take an
eventually provided eficsm setup into account. The grub config still
searches for i386 grub modules even if eficsm="false" is set.
* Fixed debian bootstrap script calls Run scripts as commands with their
native shebang and not through bash. Not all debian package scripts uses
bash, some of them uses sh which can be a link to dash or other
interpreters.
* Update TW integration tests The package x86info was dropped from TW
* Turn DiskFormat into an ordinary class
* it does not need to be an abstract base class
* use f-strings where applicable instead of format()
* change return type of _custom_args_for_format from list to tuple
* Add new containers section Allow to specify references to OCI containers in
the image description During the kiwi process the containers are fetched
into a temporary location and a systemd service is configured to one time
load the containers into the local registry at first boot of the system.
* Bump version: 10.1.13 to 10.1.14
* Revert "Install usrmerge for Debian integration test" This reverts commit
95ac861741f14c4f35611c16328384c18e53dcfb. Solution needs to be provided in
code
* Install usrmerge for Debian integration test
* Support older apt versions for bootstrap
* Run package scripts in apt bootstrap phase The bootstrap procedure based on
apt only runs a manual collection of package scripts. This commit refactors
the code that unpacks the bootstrap packages to a python implementation and
adds a method to run the bootstrap scripts from all packages resolved by
apt.
* Bump version: 10.1.12 to 10.1.13
* Fix bundle extension for vagrant type When bundling result files that uses a
vagrant type, kiwi creates them with the extension .vagrant.virtualbox.box
or .vagrant.libvirt.box. The bundler code renames them using only the .box
suffix which is too short as it is missing the subformat information. This
commit fixes it and keeps this information in the result bundle file name.
* Use simple quotas (squota) for volumes
* Add quota attribute to volume section Allow to set quota per volume for the
btrfs filesystem
* Fix globbing with exclude with regex This fixes a collection of bugs when
producing erofs images. On one hand, this ensures that an exclude of `/sys`
doesn't accidentally match `/lib/libsystemd.so`, only `/sys/whatever`. On
the other hand, this ensures that `/dev/*` does match `/dev/vda` and not
just `/dev///////////`. This fixes libsystemd.so getting dropped in Kiwi-
built FEX images.
* Honour custom exclude for filesystem builds All other call sites honour the
custom exclude file, it's just this one that needs to be fixed. This
unblocks use of Kiwi for generating FEX rootfs.
* test: storage: update clone_device tests with new block size
* storage: clone_device: increase dd block size Increasing the block size used
for dd reduces the time needed to clone a device.
* Bump version: 10.1.11 to 10.1.12
* Add missing erofscompression validation In the filesystem builder I forgot
to evaluate the erofscompression attribute.
* Include PI and comments in XSL stylesheets So far comments and processing
instructions (PI) were ignored when applying the XSL stylesheets. This
commit updates all stylesheets to take them into account
* Bump version: 10.1.10 to 10.1.11
* doc: Add login information test build test images
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Micro 6.1
zypper in -t patch SUSE-SLE-Micro-6.1-80=1
* SUSE Linux Micro Extras 6.1
zypper in -t patch SUSE-SLE-Micro-6.1-80=1
## Package List:
* SUSE Linux Micro 6.1 (aarch64 ppc64le s390x x86_64)
* dracut-kiwi-oem-repart-10.1.10-slfo.1.1_2.1
* dracut-kiwi-lib-10.1.10-slfo.1.1_2.1
* dracut-kiwi-oem-dump-10.1.10-slfo.1.1_2.1
* SUSE Linux Micro Extras 6.1 (aarch64 ppc64le s390x x86_64)
* python3-kiwi-10.1.10-slfo.1.1_2.1
## References:
* https://bugzilla.suse.com/show_bug.cgi?id=1228741
* https://bugzilla.suse.com/show_bug.cgi?id=1235448
* https://bugzilla.suse.com/show_bug.cgi?id=1237772
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20250604/bf1f6b6b/attachment.htm>
More information about the sle-updates
mailing list