main: always use a bootstrap buildroot (but support disabling)

We recently had two issues where creating our buildroot was
broken in certain situations because the local rpm would
not be compatible with the requirements of the package
that got installed in the buildroot:
https://issues.redhat.com/browse/RHEL-128741
#413

The issue here is that the local rpm is something we do
not control but we need a way to "bootstrap" our buildroot
(once we have a buildroot we use that for everything else).

This commit enables the "bootstrap" container feature of
the images library by default to avoid this dependency.
This means that we "podman pull" a minimal container (e.g.
ubi for rhel) that contains python3 and rpm to then use it
to install our real buildroot.

Note that this enables it all the time even if the host
distribution and target distribution match. The reason
is rebuildability - ie. the same manifest should always
produce the same result and in the general case we do
not know if e.g. a manifest that was part of
`image-builder build --with-manifest` is used somewhere
else again.

For restricted environment where pulling a container is a
problem or for situations where its known that the host
rpm is fine we provide: `--without-bootstrap-container`
to disable this function.

Author: mvo5

cmd/image-builder/main.go

@@ -135,17 +135,10 @@ func subscriptionImageOptions(cmd *cobra.Command) (*subscription.ImageOptions, e
 	return regs.Redhat.Subscription, nil
 }
 
-type cmdManifestWrapperOptions struct {
-	useBootstrapIfNeeded bool
-}
-
 // used in tests
 var manifestgenDepsolver manifestgen.DepsolveFunc
 
-func cmdManifestWrapper(pbar progress.ProgressBar, cmd *cobra.Command, args []string, w io.Writer, wd io.Writer, wrapperOpts *cmdManifestWrapperOptions) (*imagefilter.Result, error) {
-	if wrapperOpts == nil {
-		wrapperOpts = &cmdManifestWrapperOptions{}
-	}
+func cmdManifestWrapper(pbar progress.ProgressBar, cmd *cobra.Command, args []string, w io.Writer, wd io.Writer) (*imagefilter.Result, error) {
 	dataDir, err := cmd.Flags().GetString("force-data-dir")
 	if err != nil {
 		return nil, err
@@ -217,6 +210,10 @@ func cmdManifestWrapper(pbar progress.ProgressBar, cmd *cobra.Command, args []st
 	if err != nil {
 		return nil, err
 	}
+	disableBootstrapContainer, err := cmd.Flags().GetBool("without-bootstrap-container")
+	if err != nil {
+		return nil, err
+	}
 	bootcRef, err := cmd.Flags().GetString("bootc-ref")
 	if err != nil {
 		return nil, err
@@ -314,6 +311,7 @@ func cmdManifestWrapper(pbar progress.ProgressBar, cmd *cobra.Command, args []st
 			RpmDownloader:          rpmDownloader,
 			DepsolveWarningsOutput: wd,
 			Depsolve:               manifestgenDepsolver,
+			UseBootstrapContainer:  !disableBootstrapContainer,
 		},
 		OutputDir:                outputDir,
 		OutputFilename:           outputFilename,
@@ -327,8 +325,7 @@ func cmdManifestWrapper(pbar progress.ProgressBar, cmd *cobra.Command, args []st
 
 		ForceRepos: forceRepos,
 	}
-	opts.ManifestgenOptions.UseBootstrapContainer = wrapperOpts.useBootstrapIfNeeded && (img.ImgType.Arch().Name() != arch.Current().String())
-	if opts.ManifestgenOptions.UseBootstrapContainer {
+	if img.ImgType.Arch().Name() != arch.Current().String() {
 		fmt.Fprintf(os.Stderr, "WARNING: using experimental cross-architecture building to build %q\n", img.ImgType.Arch().Name())
 	}
 
@@ -341,7 +338,7 @@ func cmdManifest(cmd *cobra.Command, args []string) error {
 	if err != nil {
 		return err
 	}
-	_, err = cmdManifestWrapper(pbar, cmd, args, osStdout, io.Discard, nil)
+	_, err = cmdManifestWrapper(pbar, cmd, args, osStdout, io.Discard)
 	return err
 }
 
@@ -409,13 +406,9 @@ func cmdBuild(cmd *cobra.Command, args []string) error {
 	}()
 
 	var mf bytes.Buffer
-	opts := &cmdManifestWrapperOptions{
-		useBootstrapIfNeeded: true,
-	}
-
 	// We discard any warnings from the depsolver until we figure out a better
 	// idea (likely in manifestgen)
-	res, err := cmdManifestWrapper(pbar, cmd, args, &mf, io.Discard, opts)
+	res, err := cmdManifestWrapper(pbar, cmd, args, &mf, io.Discard)
 	if err != nil {
 		return err
 	}
@@ -584,6 +577,7 @@ operating systems like Fedora, CentOS and RHEL with easy customizations support.
 	manifestCmd.Flags().Bool("ignore-warnings", false, `ignore warnings during manifest generation`)
 	manifestCmd.Flags().String("registrations", "", `filename of a registrations file with e.g. subscription details`)
 	manifestCmd.Flags().String("rpmmd-cache", "", `osbuild directory to cache rpm metadata`)
+	manifestCmd.Flags().Bool("without-bootstrap-container", false, `disable using a "bootstrap" container to generate the initial buildroot`)
 	rootCmd.AddCommand(manifestCmd)
 
 	uploadCmd := &cobra.Command{

cmd/image-builder/main_test.go

@@ -899,18 +899,60 @@ func TestBuildCrossArchSmoke(t *testing.T) {
 		assert.NoError(t, err)
 		pipelines, err := manifesttest.PipelineNamesFrom(manifest)
 		assert.NoError(t, err)
-		crossArchPipeline := "bootstrap-buildroot"
+		bootstrapPipeline := "bootstrap-buildroot"
 		crossArchWarning := `WARNING: using experimental cross-architecture building to build "aarch64"`
+		// the bootstrap pipeline is the default for all builds
+		assert.Contains(t, pipelines, bootstrapPipeline)
 		if withCrossArch {
-			assert.Contains(t, pipelines, crossArchPipeline)
 			assert.Contains(t, stderr, crossArchWarning)
 		} else {
-			assert.NotContains(t, pipelines, crossArchPipeline)
 			assert.NotContains(t, stderr, crossArchWarning)
 		}
 	}
 }
 
+func TestManifestBootstrapContainer(t *testing.T) {
+	if testing.Short() {
+		t.Skip("manifest generation takes a while")
+	}
+	if !hasDepsolveDnf() {
+		t.Skip("no osbuild-depsolve-dnf binary found")
+	}
+
+	restore := main.MockNewRepoRegistry(testrepos.New)
+	defer restore()
+
+	for _, disableBootstrapContainer := range []bool{false, true} {
+		cmd := []string{
+			"manifest",
+			"tar",
+			"--distro", "centos-10",
+		}
+		if disableBootstrapContainer {
+			cmd = append(cmd, "--without-bootstrap-container")
+		}
+		restore = main.MockOsArgs(cmd)
+		defer restore()
+
+		var fakeStdout bytes.Buffer
+		restore = main.MockOsStdout(&fakeStdout)
+		defer restore()
+
+		// XXX: capture stderr here too to ensure no cross build warning
+		err := main.Run()
+		assert.NoError(t, err)
+
+		pipelines, err := manifesttest.PipelineNamesFrom(fakeStdout.Bytes())
+		assert.NoError(t, err)
+		bootstrapPipeline := "bootstrap-buildroot"
+		if disableBootstrapContainer {
+			assert.NotContains(t, pipelines, bootstrapPipeline)
+		} else {
+			assert.Contains(t, pipelines, bootstrapPipeline)
+		}
+	}
+}
+
 func TestBuildIntegrationOutputFilename(t *testing.T) {
 	if testing.Short() {
 		t.Skip("manifest generation takes a while")