From 591731f86bdebab5fceadd8961bf60350428cad1 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Wed, 16 Sep 2026 18:35:19 +0200
Subject: [PATCH] Update gardenlinux ref (main)

* using latest gardenlinux ref
* requires adjustment on the build script to mount the gardenlinux path
* adjust the Makefile to update the builder version automatically

Signed-off-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
---
 .github/workflows/dev.yml        |   2 +-
 .github/workflows/nightly.yaml   |   4 +-
 .github/workflows/upload_oci.yml |   2 +-
 Makefile                         |  10 +-
 build                            | 181 ++++++++++++++++++++++++++++++-
 features/_archgrouped            |   1 +
 gardenlinux                      |   2 +-
 requirements.defs                |   1 +
 8 files changed, 196 insertions(+), 7 deletions(-)
 mode change 120000 => 100755 build
 create mode 120000 features/_archgrouped
 create mode 120000 requirements.defs

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index d81374b..a8f9531 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -42,7 +42,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@bd5e711d06acb6e93da02deb47ad2ce569af0914
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@c15e9789b16b0e64019b52b45fb6fa3b3c0f608c
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 3d91687..44c1fc0 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@bd5e711d06acb6e93da02deb47ad2ce569af0914
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@c15e9789b16b0e64019b52b45fb6fa3b3c0f608c
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -49,7 +49,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@bd5e711d06acb6e93da02deb47ad2ce569af0914
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@c15e9789b16b0e64019b52b45fb6fa3b3c0f608c
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index c709c42..b1c37b4 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@bd5e711d06acb6e93da02deb47ad2ce569af0914
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@c15e9789b16b0e64019b52b45fb6fa3b3c0f608c
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
diff --git a/Makefile b/Makefile
index 7ac935a..386a410 100644
--- a/Makefile
+++ b/Makefile
@@ -2,6 +2,7 @@ SHELL := /usr/bin/env bash
 .SHELLFLAGS := -euo pipefail -c
 
 ROOT_DIR := $(shell git rev-parse --show-toplevel)
+SED := $(shell command -v gsed 2>/dev/null || command -v sed)
 
 # Default to latest commit if COMMIT is not specified
 COMMIT ?= $(shell git ls-remote https://github.com/gardenlinux/gardenlinux.git HEAD | cut -f1)
@@ -29,7 +30,7 @@ update:
 	git add gardenlinux
 
 	# update workflow commit references
-	sed -i -E 's|(gardenlinux/gardenlinux/.github/workflows/[^@]*)@[0-9a-f]{40}|\1@$(COMMIT)|g' $(ROOT_DIR)/.github/workflows/*.y*ml
+	$(SED) -i -E 's|(gardenlinux/gardenlinux/.github/workflows/[^@]*)@[0-9a-f]{40}|\1@$(COMMIT)|g' $(ROOT_DIR)/.github/workflows/*.y*ml
 
 	# update features
 	mkdir -p $(ROOT_DIR)/features
@@ -56,6 +57,13 @@ update:
 		fi; \
 	done
 
+	# update builder image
+	new_builder_image=$$(grep -m1 '^container_image=' $(ROOT_DIR)/gardenlinux/build | cut -d= -f2); \
+	current_builder_image=$$(grep -m1 '^container_image=' $(ROOT_DIR)/build | cut -d= -f2); \
+	if [ "$$new_builder_image" != "$$current_builder_image" ]; then \
+		$(SED) -i -E 's|^container_image=.*|container_image=$$new_builder_image|' $(ROOT_DIR)/build; \
+	fi
+
 clean:
 	git reset --soft
 	rm -rf $(ROOT_DIR)/gardenlinux
diff --git a/build b/build
deleted file mode 120000
index 9a5480a..0000000
--- a/build
+++ /dev/null
@@ -1 +0,0 @@
-gardenlinux/build
\ No newline at end of file
diff --git a/build b/build
new file mode 100755
index 0000000..a3f117e
--- /dev/null
+++ b/build
@@ -0,0 +1,180 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+shopt -s nullglob
+
+exec 3>&1
+exec 1>&2
+
+container_image=ghcr.io/gardenlinux/builder:0196add0ce875ac0b7721c19b2ee3ac37cf84387
+container_engine=podman
+target_dir=.build
+
+container_run_opts=(
+	--memory 4G
+	--security-opt seccomp=unconfined
+	--security-opt apparmor=unconfined
+	--security-opt label=disable
+	--read-only
+)
+
+container_cmd=()
+
+use_kms=0
+resolve_cname=0
+allow_frankenstein=0
+apparmor_profile=
+
+while [ $# -gt 0 ]; do
+	case "$1" in
+		--allow-frankenstein) # https://xkcd.com/1589/
+			allow_frankenstein=1
+			shift
+			;;
+		--container-image)
+			container_image="$2"
+			shift 2
+			;;
+		--container-engine)
+			container_engine="$2"
+			shift 2
+			;;
+		--container-run-opts)
+			declare -a "container_run_opts=($2)"
+			shift 2
+			;;
+		--privileged)
+			container_run_opts+=(--privileged)
+			container_cmd=(--second-stage)
+			shift
+			;;
+		--kms)
+			use_kms=1
+			shift
+			;;
+		--print-container-image)
+			printf '%s\n' "$container_image" >&3
+			exit 0
+			;;
+		--resolve-cname)
+			resolve_cname=1
+			shift
+			;;
+		--target)
+			target_dir="$2"
+			shift 2
+			;;
+		--apparmor-profile)
+			apparmor_profile="$2"
+			shift 2
+			;;
+		*)
+			break
+			;;
+	esac
+done
+
+[ -d "$target_dir" ] || mkdir "$target_dir"
+
+container_mount_opts=(
+	-v "$PWD/keyring.gpg:/builder/keyring.gpg:ro"
+	-v "$(realpath "$target_dir"):/builder/.build"
+)
+
+# mount all features to enable dynamic discovery of requirements.mod files
+container_mount_opts+=(-v "$(realpath -- "features"):/builder/features:ro")
+container_mount_opts+=(-v "$(realpath -- "gardenlinux"):/builder/gardenlinux:ro")
+container_mount_opts+=(-v "$(realpath -- "requirements.defs"):/builder/requirements.defs:ro")
+
+if [ "$container_image" = localhost/builder ]; then
+	dir="$(dirname -- "$(realpath -- "${BASH_SOURCE[0]}")")"
+	"$container_engine" build -t "$container_image" "$dir"
+fi
+
+repo="$(./get_repo)"
+commit="$(./get_commit)"
+timestamp="$(./get_timestamp)"
+default_version="$(./get_version)"
+
+
+if [ "$resolve_cname" = 1 ]; then
+	arch="$("$container_engine" run --rm "${container_run_opts[@]}" "${container_mount_opts[@]}" "$container_image" dpkg --print-architecture)"
+	cname="$("$container_engine" run --rm "${container_run_opts[@]}" "${container_mount_opts[@]}" "$container_image" /builder/parse_features --feature-dir /builder/features --default-arch "$arch" --default-version "$default_version" --cname "$1")"
+	short_commit="$(head -c 8 <<< "$commit")"
+	echo "$cname-$short_commit" >&3
+	exit 0
+fi
+
+make_opts=(
+	REPO="$repo"
+	COMMIT="$commit"
+	TIMESTAMP="$timestamp"
+	DEFAULT_VERSION="$default_version"
+	LOG_WITH_TIMESTAMP="${LOG_WITH_TIMESTAMP:-true}"
+)
+
+if [ "$allow_frankenstein" = 1 ]; then
+	make_opts+=("ALLOW_FRANKENSTEIN=1")
+fi
+
+if [ "$use_kms" = 1 ]; then
+	for e in AWS_DEFAULT_REGION AWS_REGION AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN; do
+		if [ -n "${!e-}" ]; then
+			make_opts+=("$e=${!e}")
+		fi
+	done
+fi
+
+# Default values which can be overridden via 'build.config' file
+tempfs_size=2G
+
+if [[ -f "$PWD"/build.config ]]; then
+	. "$PWD"/build.config
+fi
+
+make_opts+=("TEMPFS_SIZE=$tempfs_size")
+
+if [ -d cert ]; then
+	container_mount_opts+=(-v "$PWD/cert:/builder/cert:ro")
+fi
+
+# Check if builder apparmor profile has to be created or selected
+if [ "$container_engine" = "docker" ] \
+	&& [ ! "$apparmor_profile" ] \
+	&& out=$(sysctl kernel.apparmor_restrict_unprivileged_userns 2> /dev/null) \
+	&& [[ $out = "kernel.apparmor_restrict_unprivileged_userns = 1" ]]; then
+	if [ ! -f /etc/apparmor.d/builder ]; then
+		echo "You are using Docker on a system restricting unprivileged user namespaces with apparmor, which prevents a successful build. For more information please refer to the #Usage section in the README."
+		read -r -p "Do you want to permanently create a new apparmor profile at /etc/apparmor.d/builder to solve the issue? [Y/n] " response
+		response=${response,,}
+		if [[ "$response" =~ ^(yes|y)$ ]]; then
+			if [ ! -f /etc/apparmor.d/builder ]; then
+				profile="abi <abi/4.0>, include <tunables/global> profile builder flags=(unconfined) {userns, }"
+				echo "$profile" | sudo tee /etc/apparmor.d/builder > /dev/null
+				sudo apparmor_parser -r -W /etc/apparmor.d/builder
+			fi
+			echo "Created profile builder at /etc/apparmor.d/builder"
+		else
+			echo Abort.
+			exit 1
+		fi
+	fi
+	apparmor_profile=builder
+fi
+
+# Apply apparmor profile if selected
+if [ "$apparmor_profile" ]; then
+	replaced=false
+	for i in "${!container_run_opts[@]}"; do
+			if [ "${container_run_opts[$i]}" = "apparmor=unconfined" ]; then
+					container_run_opts["$i"]="apparmor=$apparmor_profile"
+					replaced=true
+			fi
+	done
+
+	if ! $replaced; then
+			container_run_opts+=(--security-opt "apparmor=$apparmor_profile")
+	fi
+fi
+
+"$container_engine" run --rm "${container_run_opts[@]}" "${container_mount_opts[@]}" "$container_image" ${container_cmd[@]+"${container_cmd[@]}"} fake_xattr make --no-print-directory -C /builder "${make_opts[@]}" "$@" >&3
diff --git a/features/_archgrouped b/features/_archgrouped
new file mode 120000
index 0000000..fdd2adc
--- /dev/null
+++ b/features/_archgrouped
@@ -0,0 +1 @@
+../gardenlinux/features/_archgrouped
\ No newline at end of file
diff --git a/gardenlinux b/gardenlinux
index bd5e711..c15e978 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit bd5e711d06acb6e93da02deb47ad2ce569af0914
+Subproject commit c15e9789b16b0e64019b52b45fb6fa3b3c0f608c
diff --git a/requirements.defs b/requirements.defs
new file mode 120000
index 0000000..fcbe494
--- /dev/null
+++ b/requirements.defs
@@ -0,0 +1 @@
+gardenlinux/requirements.defs
\ No newline at end of file