Repository navigation
fix(images): build from recipes that carry the machine fixes - #102
Merged
Merged
Conversation
nspawn/mkosi-definitions now carries the fixes nsl used to apply itself: the Arch keyring is made on each machine's first boot, and the images install pam_systemd, a session bus, mount, the account tools and zone data. Pin 1418e84 and delete what became duplicate: those packages from the Debian and openSUSE families, systemd-pam from the rpm family, and nsl-pacman-keyring.service with its preset. Azure Linux has no recipe, so its profile now names systemd-pam itself. The same Debian recipe builds the VM, which never had pam_systemd. With it, every agent call over SSH would open a logind session and start a user manager, so the VM removes libpam-systemd and dbus-user-session again, and the VM spec requires that. Every image's revision rises, since the recipes are an input to each.
github-actions
Bot
added
level:L1
frostyard-machines
approved these changes
Nov 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nsl builds its images from a pinned
nspawn/mkosi-definitionscommit. The recipes now carry fixes nsl used to apply itself (#52, #55, #56 and others). This moves the pin from68263d0to1418e84and deletes what became duplicate.mount,libpam-systemd,dbus-user-session,passwdandtzdata.shadowandtimezone.systemd-pam. Azure Linux has no recipe, so its profile now names it.nsl-pacman-keyring.serviceand its preset. The recipe ships no keyring, and itspacman-init.servicemakes each machine's on first boot.pam_systemd, so every agent call over SSH would open a logind session and start a user manager. The VM never had that, so it removeslibpam-systemdanddbus-user-sessionagain. The VM spec now requires this.Every image's revision rises, since the recipes are an input to each. Machines keep the same packages; they now come from the recipes instead of nsl's layers.
Risk tier
Risk tier: 3 — changes the source of every published VM and machine image.
Docs housekeeping
No new docs. The machine-image and VM specs, the image README and the open Azure Linux plan are updated.
Verification
make cigreen.RemovePackages=taken out ofimage/vm/mkosi.conf,python3 -m unittest scripts/test_image_profiles.pyfails.Built the VM image and all 11 machine images locally with
scripts/build-image.sh, then accepted them on KVM:probe-vm.py, VM r12 (b48bdd7c…)probe-machines.py --gui --isolated, 11 machineslibpam-systemdnordbus-user-session. Against the last VM image I had a manifest for (r10), the only package differences are a kernel update andsystemd-sysv, whichlibpam-systemdpulled in and its removal left behind.keyringscheck found no private key in the image, and a key generated by the machine.Nothing is published by this PR; the next run of the publication workflow on
mainbuilds and accepts these revisions itself.