45 lines
2.4 KiB
Bash
45 lines
2.4 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# coreutils: --without-selinux. The host has libselinux; Arch does not.
|
||
|
|
#
|
||
|
|
# THE TRAP: the chroot test reported "coreutils links against libselinux",
|
||
|
|
# and the obvious reading -- build libselinux next -- is wrong twice over.
|
||
|
|
#
|
||
|
|
# $ readelf -d repo/s390x/.../usr/bin/ls | grep NEEDED
|
||
|
|
# (NEEDED) Shared library: [libselinux.so.1]
|
||
|
|
#
|
||
|
|
# There is no libselinux package in Arch. The clone of it 404s, and
|
||
|
|
# gitlab.archlinux.org answers a 404 by asking for a login, which is why the
|
||
|
|
# driver log said "could not read Username" rather than "no such project".
|
||
|
|
# Arch's own coreutils declares depends=(acl attr glibc gmp libcap openssl)
|
||
|
|
# -- no selinux, because Arch's build chroot has no libselinux to find.
|
||
|
|
#
|
||
|
|
# Ours found one. Ubuntu 25.10 carries libselinux1-dev (it arrives with
|
||
|
|
# libmount-dev / libgio-2.0-dev), coreutils' configure probes for
|
||
|
|
# selinux/selinux.h unconditionally, and thirteen binaries -- ls, cp, mv,
|
||
|
|
# install, id, stat, mkdir, mknod, mkfifo, dir, vdir, chcon, runcon -- came
|
||
|
|
# out linked to a library the target rootfs will never contain.
|
||
|
|
#
|
||
|
|
# Uninstalling the header on the host is not the way out: apt takes
|
||
|
|
# libmount-dev, libglib2.0-dev, libcryptsetup-dev and libdevmapper-dev with
|
||
|
|
# it, which is what systemd and util-linux still need.
|
||
|
|
#
|
||
|
|
# So this is not disabling a feature. It is removing a HOST artefact that
|
||
|
|
# stage 1 exists to keep out, and the result matches Arch's binary exactly:
|
||
|
|
# Arch's coreutils ships neither chcon nor runcon, for this very reason.
|
||
|
|
# Losing them converges with Arch, it does not diverge from it.
|
||
|
|
#
|
||
|
|
# The same probe catches findutils, sed and tar -- each has its own hook --
|
||
|
|
# and glibc's makedb, which deliberately does NOT. Nothing in the bootstrap
|
||
|
|
# runs makedb, and rebuilding glibc for it would relink the foundation under
|
||
|
|
# all sixty-nine other packages. Stage 2 rebuilds glibc in a chroot that has
|
||
|
|
# no libselinux, where the problem cannot recur.
|
||
|
|
#
|
||
|
|
# Only one ./configure in this PKGBUILD (verified), so the anchor is safe.
|
||
|
|
set -euo pipefail
|
||
|
|
grep -c -- '--with-openssl' PKGBUILD | grep -qx 1 || {
|
||
|
|
echo "coreutils: expected exactly one --with-openssl anchor" >&2; exit 1; }
|
||
|
|
sed -i 's|^\(\s*\)--with-openssl$|\1--with-openssl \\\n\1--without-selinux|' PKGBUILD
|
||
|
|
grep -q -- '--without-selinux' PKGBUILD || {
|
||
|
|
echo "coreutils: --without-selinux not inserted" >&2; exit 1; }
|
||
|
|
echo "coreutils: --without-selinux (Arch has no libselinux; the host does)"
|