Skip to content

podman: T7736: update netavark and aardvark-dns packages #1259

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sever-sever merged 1 commit into from
Aug 5, 2026
Merged

podman: T7736: update netavark and aardvark-dns packages #1259

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions scripts/package-build/podman/.gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
/podman/
/aardvark-dns/
/netavark/
171 changes: 171 additions & 0 deletions scripts/package-build/podman/package.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,174 @@
[[packages]]
name = "netavark"
commit_id = "debian/1.14.0-2"
scm_url = "https://salsa.debian.org/debian/netavark"

# The Debian packaging for netavark targets trixie/sid: it builds via dh-cargo
# against a wall of librust-*-dev packages that don't exist in the bookworm
# archive VyOS builds against, and bookworm's rustc (1.63) is below netavark's
# rust-version = "1.76" floor. Rewrite debian/control and debian/rules to build
# directly against crates.io with a rustup-installed toolchain instead, and
# drop the quilt patches that only exist to pin Cargo.toml/Cargo.lock to
# whatever librust-*-dev versions happen to be in the trixie/sid archive - our
# network build uses upstream's own (pristine) Cargo.lock instead.
#
# debian/patches/series and debian/control/rules are edited in place here
# rather than via a patch file: mk-build-deps (which runs before build_cmd)
# reads debian/control straight off disk, before dpkg-buildpackage's automatic
# quilt-patch application would ever get a chance to apply a patch to it.
pre_build_hook = """
sed -i \
-e '/^0009-Revert-fix-deps-update-rust-crate-rand-to-0.9.0.patch$/d' \
-e '/^0010-Revert-fix-deps-update-rust-crate-sysctl-to-0.6.0.patch$/d' \
-e '/^0012-relax-tokio-stream-dependency.patch$/d' \
-e '/^0013-Relax-nispor-dependency.patch$/d' \
-e '/^0013-Build-against-url-2.5.2.patch$/d' \
-e '/^0013-compile-against-prost-12.6.patch$/d' \
-e '/^0015-update-zbus.patch$/d' \
debian/patches/series

cat > debian/control <<'EOF'
Source: netavark
Section: net
Priority: optional
Maintainer: Reinhard Tartler <siretart@tauware.de>
Build-Depends: debhelper-compat (= 13),
pkg-config,
protobuf-compiler
Standards-Version: 4.7.2
Homepage: https://github.com/containers/netavark
Vcs-Browser: https://salsa.debian.org/debian/netavark
Vcs-Git: https://salsa.debian.org/debian/netavark.git
Rules-Requires-Root: no

Package: netavark
Architecture: any
Depends: ${misc:Depends}, ${shlibs:Depends}
Provides: container-network-stack (= 2)
Recommends: aardvark-dns, nftables
Breaks: aardvark-dns (<< 1.12)
Enhances: podman
Description: Rust based network stack for containers
Netavark is designed to work with but is also applicable
for other OCI container management applications.
EOF

cat > debian/rules <<'EOF'
#!/usr/bin/make -f

# cf. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1091318
export NETAVARK_DEFAULT_FW := nftables

# VyOS builds on Debian bookworm, whose librust-*-dev / dh-cargo stack is far
# behind what this package needs, so we build directly against crates.io via
# the upstream Cargo.lock instead of Debian's offline vendored-crate scheme.
%:
dh $@

override_dh_auto_build:
cargo build --release --bin netavark --bin netavark-dhcp-proxy-client

override_dh_auto_test:

override_dh_auto_install:
install -D -m 0755 target/release/netavark \
debian/netavark/usr/lib/podman/netavark
install -D -m 0755 target/release/netavark-dhcp-proxy-client \
debian/netavark/usr/lib/podman/netavark-dhcp-proxy-client
install -D -m 664 contrib/systemd/system/netavark-dhcp-proxy.socket \
debian/netavark/usr/lib/systemd/system/netavark-dhcp-proxy.socket
sed -e 's;@@NETAVARK@@;/usr/lib/podman/netavark;g' \
< contrib/systemd/system/netavark-dhcp-proxy.service.in \
> debian/netavark/usr/lib/systemd/system/netavark-dhcp-proxy.service
sed -e 's;@@NETAVARK@@;/usr/lib/podman/netavark;g' \
< contrib/systemd/system/netavark-firewalld-reload.service.in \
> debian/netavark/usr/lib/systemd/system/netavark-firewalld-reload.service
Comment on lines +78 to +85

@coderabbitai coderabbitai Bot Aug 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Use 0644 for the systemd unit, and set explicit modes on the generated units.

Line 78 installs the socket unit group-writable (0664) into /usr/lib/systemd/system. Debian policy expects 0644 for unit files. The two sed-generated .service files inherit the build umask instead of an explicit mode.

🔧 Proposed fix 
-	install -D -m 664 contrib/systemd/system/netavark-dhcp-proxy.socket \
+	install -D -m 0644 contrib/systemd/system/netavark-dhcp-proxy.socket \
 		debian/netavark/usr/lib/systemd/system/netavark-dhcp-proxy.socket
+	install -d -m 0755 debian/netavark/usr/lib/systemd/system
 	sed -e 's;@@NETAVARK@@;/usr/lib/podman/netavark;g' \
 		< contrib/systemd/system/netavark-dhcp-proxy.service.in \
 		> debian/netavark/usr/lib/systemd/system/netavark-dhcp-proxy.service
+	chmod 0644 debian/netavark/usr/lib/systemd/system/netavark-dhcp-proxy.service
 	sed -e 's;@@NETAVARK@@;/usr/lib/podman/netavark;g' \
 		< contrib/systemd/system/netavark-firewalld-reload.service.in \
 		> debian/netavark/usr/lib/systemd/system/netavark-firewalld-reload.service
+	chmod 0644 debian/netavark/usr/lib/systemd/system/netavark-firewalld-reload.service
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
install -D -m 664 contrib/systemd/system/netavark-dhcp-proxy.socket \
debian/netavark/usr/lib/systemd/system/netavark-dhcp-proxy.socket
sed -e 's;@@NETAVARK@@;/usr/lib/podman/netavark;g' \
< contrib/systemd/system/netavark-dhcp-proxy.service.in \
> debian/netavark/usr/lib/systemd/system/netavark-dhcp-proxy.service
sed -e 's;@@NETAVARK@@;/usr/lib/podman/netavark;g' \
< contrib/systemd/system/netavark-firewalld-reload.service.in \
> debian/netavark/usr/lib/systemd/system/netavark-firewalld-reload.service
install -D -m 0644 contrib/systemd/system/netavark-dhcp-proxy.socket \
debian/netavark/usr/lib/systemd/system/netavark-dhcp-proxy.socket
install -d -m 0755 debian/netavark/usr/lib/systemd/system
sed -e 's;@@NETAVARK@@;/usr/lib/podman/netavark;g' \
< contrib/systemd/system/netavark-dhcp-proxy.service.in \
> debian/netavark/usr/lib/systemd/system/netavark-dhcp-proxy.service
chmod 0644 debian/netavark/usr/lib/systemd/system/netavark-dhcp-proxy.service
sed -e 's;@@NETAVARK@@;/usr/lib/podman/netavark;g' \
< contrib/systemd/system/netavark-firewalld-reload.service.in \
> debian/netavark/usr/lib/systemd/system/netavark-firewalld-reload.service
chmod 0644 debian/netavark/usr/lib/systemd/system/netavark-firewalld-reload.service
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/package-build/podman/package.toml` around lines 78 - 85, Update the
systemd unit installation in the package build to use mode 0644 instead of 0664,
and explicitly set mode 0644 on both service files generated by the sed
commands. Apply the changes to the socket installation and the generated
netavark-dhcp-proxy.service and netavark-firewalld-reload.service artifacts.


override_dh_auto_clean:
rm -rf target
EOF
chmod 0755 debian/rules

# bookworm's rustc (1.63) predates netavark's rust-version = "1.76"; install a
# current stable toolchain and shadow any apt-installed one via /usr/local/bin,
# which every later shell invocation in this build picks up ahead of /usr/bin.
if [ ! -x "$HOME/.cargo/bin/rustup" ]; then
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
else
"$HOME/.cargo/bin/rustup" update stable
fi
sudo ln -sf "$HOME/.cargo/bin/cargo" /usr/local/bin/cargo
sudo ln -sf "$HOME/.cargo/bin/rustc" /usr/local/bin/rustc
sudo ln -sf "$HOME/.cargo/bin/rustup" /usr/local/bin/rustup
Comment on lines +95 to +102

@coderabbitai coderabbitai Bot Aug 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -e
printf '%s\n' '--- package hooks ---'
sed -n '80,110p;148,178p' scripts/package-build/podman/package.toml
printf '%s\n' '--- relevant build commands and Rust references ---'
rg -n -C 3 'cargo|rustc|rustup|netavark|aardvark-dns|build_cmd|pre_build_hook' scripts/package-build/podman/package.toml scripts/package-build/build.py
printf '%s\n' '--- exact duplication check ---'
python3 - <<'PY'
from pathlib import Path
p = Path("scripts/package-build/podman/package.toml")
s = p.read_text()
block = '''if [ ! -x "$HOME/.cargo/bin/rustup" ]; then
    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
else
    "$HOME/.cargo/bin/rustup" update stable
fi
sudo ln -sf "$HOME/.cargo/bin/cargo" /usr/local/bin/cargo
sudo ln -sf "$HOME/.cargo/bin/rustc" /usr/local/bin/rustc
sudo ln -sf "$HOME/.cargo/bin/rustup" /usr/local/bin/rustup'''
print("occurrences:", s.count(block))
PY

Repository: vyos/vyos-build

Length of output: 20303

Unverified Software Download In Build Pipeline (CWE-494): Download of Code Without Integrity Check

Reachability: Internal · Exploitability: Difficult

Use one pinned, verified Rust toolchain setup for both package hooks. The curl ... | sh pipeline has no checksum or signature validation, and stable changes over time. The compiler builds the shipped netavark and aardvark-dns binaries. The /usr/local/bin symlinks also change command resolution for later builds. Replace both blocks with one shared helper that verifies rustup-init, installs an explicit toolchain version, and prepends $HOME/.cargo/bin to PATH.

📍 Affects 1 file
  • scripts/package-build/podman/package.toml#L95-L102 (this comment)
  • scripts/package-build/podman/package.toml#L162-L169
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/package-build/podman/package.toml` around lines 95 - 102, The Rust
setup blocks at scripts/package-build/podman/package.toml lines 95-102 and
162-169 must be replaced with one shared helper. Have the helper download and
checksum- or signature-verify rustup-init, install an explicit pinned Rust
toolchain version instead of stable, and prepend $HOME/.cargo/bin to PATH;
remove the /usr/local/bin symlink creation so both package hooks use the same
verified toolchain and command resolution.

"""

[[packages]]
name = "aardvark-dns"
commit_id = "debian/1.14.0-3"
scm_url = "https://salsa.debian.org/debian/aardvark-dns"

# aardvark-dns and netavark are versioned in lockstep upstream (this
# aardvark-dns Depends: netavark (>> 1.14)) and share the same trixie-only
# dh-cargo/librust-*-dev packaging problem on bookworm - see the netavark
# entry above for the full rationale. Same fix: build directly against
# crates.io with a rustup-installed toolchain.
pre_build_hook = """
sed -i -e '/^relax-deps.patch$/d' debian/patches/series

cat > debian/control <<'EOF'
Source: aardvark-dns
Section: net
Priority: optional
Maintainer: Reinhard Tartler <siretart@tauware.de>
Build-Depends: debhelper-compat (= 13)
Standards-Version: 4.7.2
Homepage: https://github.com/containers/aardvark-dns
Vcs-Browser: https://salsa.debian.org/debian/aardvark-dns
Vcs-Git: https://salsa.debian.org/debian/aardvark-dns.git
Rules-Requires-Root: no

Package: aardvark-dns
Architecture: any
Depends: netavark (>> 1.14), ${misc:Depends}, ${shlibs:Depends}
Enhances: podman
Description: Container-focused DNS server
Netavark is designed to work with podman but is also applicable for other OCI
container management applications.
EOF

cat > debian/rules <<'EOF'
#!/usr/bin/make -f

# VyOS builds on Debian bookworm, whose librust-*-dev / dh-cargo stack is far
# behind what this package needs, so we build directly against crates.io via
# the upstream Cargo.lock instead of Debian's offline vendored-crate scheme.
%:
dh $@

override_dh_auto_build:
cargo build --release --bin aardvark-dns

override_dh_auto_test:

override_dh_auto_install:
install -D -m 0755 target/release/aardvark-dns \
debian/aardvark-dns/usr/lib/podman/aardvark-dns

override_dh_auto_clean:
rm -rf target
EOF
chmod 0755 debian/rules

if [ ! -x "$HOME/.cargo/bin/rustup" ]; then
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
else
"$HOME/.cargo/bin/rustup" update stable
fi
sudo ln -sf "$HOME/.cargo/bin/cargo" /usr/local/bin/cargo
sudo ln -sf "$HOME/.cargo/bin/rustc" /usr/local/bin/rustc
sudo ln -sf "$HOME/.cargo/bin/rustup" /usr/local/bin/rustup
"""

[[packages]]
name = "podman"
commit_id = "v5.8.4"
Expand Down
Loading