internal/mkcw/embed: cross-compile using Go #6471

nalind · 2025-11-04T22:42:45Z

What type of PR is this?

/kind other

What this PR does / why we need it:

Use the Go toolchain to cross-compile the "This image is designed to be run as a confidential workload using libkrun." entrypoint that we add to confidential workload images. It's bigger than it was before, but easier to port and can be built from source every time.

How to verify it

Check that we can still build on non-amd64 architectures.

Which issue(s) this PR fixes:

Special notes for your reviewer:

Sets up #6469, if we need to stop checking in a pre-built binary.

Does this PR introduce a user-facing change?

None

packit-as-a-service · 2025-11-04T22:45:02Z

Ephemeral COPR build failed. @containers/packit-build please check.

Luap99

That is a great idea to reuse go, I wonder do we have any test for this binary at all? I don;t see the messages matched anywhere in our tests? I mean we could only run it on amd64 but still I guess it would be nice to know the binary is functional?

Luap99 · 2025-11-05T12:24:54Z

Makefile

+internal/mkcw/embed/entrypoint_arm64.gz: internal/mkcw/embed/entrypoint_arm64
+	gzip -k9nf $^
+internal/mkcw/embed/entrypoint_ppc64le.gz: internal/mkcw/embed/entrypoint_ppc64le
+	gzip -k9nf $^
+internal/mkcw/embed/entrypoint_s390x.gz: internal/mkcw/embed/entrypoint_s390x
+	gzip -k9nf $^


What do we need the other arches for if we only ever embed the amd64 one? Seems like unnecessary churn having to maintain a assembly version for each arch that we don't ever end up using.

We don't build them, but the confidential workload folks have been making noises about supporting other architectures for a while now.

flouthoc

LGTM

nalind · 2025-11-05T17:02:29Z

Had to add the prebuilt binary back to avoid breaking people who vendor us as a library.

Luap99 · 2025-11-05T17:29:40Z

Had to add the prebuilt binary back to avoid breaking people who vendor us as a library.

How is the code reachable? Only via buildah mkcw or also directly via the normal podman/buildah build commands?
Because right now the code/package gets imported in podman and as such podman embeds the same binary so I think we would need to apply the same fix in podman to rebuild the binary in the vendor dir as part of the specfile I think?

IF it is not needed for build it might make sense to try to split the packages so it does not get leaked into podman then?

nalind · 2025-11-05T17:46:44Z

Had to add the prebuilt binary back to avoid breaking people who vendor us as a library.

How is the code reachable? Only via buildah mkcw or also directly via the normal podman/buildah build commands? Because right now the code/package gets imported in podman and as such podman embeds the same binary so I think we would need to apply the same fix in podman to rebuild the binary in the vendor dir as part of the specfile I think?

build has a --cw flag which changes how we commit the final image, along similar lines.

Luap99 · 2025-11-05T17:56:36Z

build has a --cw flag which changes how we commit the final image, along similar lines.

Ack, so then I guess we just need to figure out a way how to rebuild this binary as part of the podman rpm then. Since buildah has top level code the Makefile is actually part of vendor/. So I suppose the simple way would be to cd into vendor and just rerun the target like we do here.

cc @lsm5

lsm5

spec change looks good.

LGTM. Thanks a lot @nalind

lsm5 · 2025-11-05T19:22:11Z

Ack, so then I guess we just need to figure out a way how to rebuild this binary as part of the podman rpm then. Since buildah has top level code the Makefile is actually part of vendor/. So I suppose the simple way would be to cd into vendor and just rerun the target like we do here.

ack. Once this is vendored we can update the podman spec.

nalind · 2025-11-05T22:34:56Z

Native strip was removing the architecture from the ELF headers, switched to linking with -s.

Luap99 · 2025-11-06T10:58:24Z

internal/mkcw/embed/check.sh

@@ -0,0 +1,12 @@
+#!/bin/bash


nit: scripts tend to use #!/usr/bin/env bash here

b288b7a

We seem to be inconsistent about it, but sure, changing it.

Luap99 · 2025-11-06T11:00:53Z

internal/mkcw/embed/check.sh

+		arm64) QEMUARCH=aarch64;;
+		ppc64le|s390x) QEMUARCH=$GOARCH;;
+	esac
+	test "$(qemu-$QEMUARCH ./entrypoint_$GOARCH)" = "$msg"


Does this need to add a || echo "./entrypoint_$GOARCH is not working" show easy which arch failed?
Right now the script is not set -e either so this could fail silently and the script exit code could still be 0 if the latest s390x arch works.

Right, the tool outputs the error message and exits with an error code, so it's a little trickier. Changed it.

Use the Go toolchain to cross-compile the "This image is designed to be run as a confidential workload using libkrun." entrypoint that we add to confidential workload images. It's bigger than it was before, but easier to port and can be built from source every time when desired. Signed-off-by: Nalin Dahyabhai <[email protected]>

Luap99

/lgtm

openshift-ci · 2025-11-06T15:51:30Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: flouthoc, lsm5, Luap99, nalind

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Luap99,flouthoc,lsm5,nalind]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

nalind added the No New Tests Allow PR to proceed without adding regression tests label Nov 4, 2025

openshift-ci bot added kind/other approved labels Nov 4, 2025

nalind force-pushed the mkcw-entrypoint branch 2 times, most recently from 2395f99 to 2c09bf9 Compare November 4, 2025 23:02

Luap99 reviewed Nov 5, 2025

View reviewed changes

nalind force-pushed the mkcw-entrypoint branch from 2c09bf9 to d09eca9 Compare November 5, 2025 14:29

flouthoc approved these changes Nov 5, 2025

View reviewed changes

lsm5 approved these changes Nov 5, 2025

View reviewed changes

nalind force-pushed the mkcw-entrypoint branch from d09eca9 to 72d61d6 Compare November 5, 2025 22:34

nalind force-pushed the mkcw-entrypoint branch 3 times, most recently from 7659349 to 2841c21 Compare November 5, 2025 22:48

Luap99 reviewed Nov 6, 2025

View reviewed changes

nalind force-pushed the mkcw-entrypoint branch from 2841c21 to b6098a2 Compare November 6, 2025 15:46

Luap99 approved these changes Nov 6, 2025

View reviewed changes

openshift-ci bot assigned Luap99 Nov 6, 2025

openshift-ci bot added the lgtm label Nov 6, 2025

openshift-merge-bot bot merged commit 70220fa into containers:main Nov 6, 2025
37 of 41 checks passed

nalind deleted the mkcw-entrypoint branch November 6, 2025 16:21

nalind mentioned this pull request Nov 6, 2025

RPM: build the entrypoint binary before the main buildah binary #6469

Closed

internal/mkcw/embed: cross-compile using Go #6471

internal/mkcw/embed: cross-compile using Go #6471

Conversation

nalind commented Nov 4, 2025

What type of PR is this?

What this PR does / why we need it:

How to verify it

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Uh oh!

packit-as-a-service bot commented Nov 4, 2025

Uh oh!

Luap99 left a comment

Choose a reason for hiding this comment

Uh oh!

Luap99 Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

nalind Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

flouthoc left a comment

Choose a reason for hiding this comment

Uh oh!

nalind commented Nov 5, 2025

Uh oh!

Luap99 commented Nov 5, 2025

Uh oh!

nalind commented Nov 5, 2025

Uh oh!

Luap99 commented Nov 5, 2025

Uh oh!

lsm5 left a comment

Choose a reason for hiding this comment

Uh oh!

lsm5 commented Nov 5, 2025

Uh oh!

nalind commented Nov 5, 2025

Uh oh!

Luap99 Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

nalind Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

Luap99 Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

nalind Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

Luap99 left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Nov 6, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants