@@ -111,7 +111,7 @@ sudo LANG=C chroot $FILESYSTEM_ROOT mount
111111[ -d $TRUSTED_GPG_DIR ] && [ ! -z " $( ls $TRUSTED_GPG_DIR ) " && sudo cp $TRUSTED_GPG_DIR /* ${FILESYSTEM_ROOT} /etc/apt/trusted.gpg.d/
112112
113113# # Pointing apt to public apt mirrors and getting latest packages, needed for latest security updates
114- scripts/build_mirror_config.sh files/apt $CONFIGURED_ARCH $IMAGE_DISTRO
114+ scripts/build_mirror_config.sh files/apt $CONFIGURED_ARCH $IMAGE_DISTRO
115115sudo cp files/apt/sources.list.$CONFIGURED_ARCH $FILESYSTEM_ROOT /etc/apt/sources.list
116116sudo cp files/apt/apt.conf.d/{81norecommends,apt-{clean,gzip-indexes,no-languages},no-check-valid-until,apt-multiple-retries} $FILESYSTEM_ROOT /etc/apt/apt.conf.d/
117117
294294 # # Install Kubernetes master
295295 echo ' [INFO] Install kubernetes master'
296296 install_kubernetes ${MASTER_KUBERNETES_VERSION}
297-
297+
298298 sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT curl -fsSL \
299299 https://packages.microsoft.com/keys/microsoft.asc | \
300300 sudo LANG=C chroot $FILESYSTEM_ROOT apt-key add -
309309 sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y remove gnupg
310310 sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT curl -o /tmp/cri-dockerd.deb -fsSL \
311311 https://github.com/Mirantis/cri-dockerd/releases/download/v${MASTER_CRI_DOCKERD} /cri-dockerd_${MASTER_CRI_DOCKERD} .3-0.debian-${IMAGE_DISTRO} _amd64.deb
312- sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install -f /tmp/cri-dockerd.deb
312+ sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install -f /tmp/cri-dockerd.deb
313313 sudo LANG=C chroot $FILESYSTEM_ROOT rm -f /tmp/cri-dockerd.deb
314314else
315315 echo ' [INFO] Skipping Install kubernetes master'
@@ -400,6 +400,7 @@ sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y in
400400 jq \
401401 auditd \
402402 linux-perf \
403+ resolvconf \
403404 lsof \
404405 sysstat
405406
@@ -447,6 +448,14 @@ sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y in
447448 systemd-sysv \
448449 ntp
449450
451+ # Workaround for issue: The udev rule may fail to be executed because the
452+ # daemon-reload command is executed in parallel
453+ # Github issue: https://github.com/systemd/systemd/issues/24668
454+ # Github PR: https://github.com/systemd/systemd/pull/24673
455+ # This workaround should be removed after a upstream already contains the fixes
456+ sudo patch $FILESYSTEM_ROOT /lib/systemd/system/systemd-udevd.service \
457+ files/image_config/systemd/systemd-udevd/fix-udev-rule-may-fail-if-daemon-reload-command-runs.patch
458+
450459if [[ $TARGET_BOOTLOADER == grub ]]; then
451460 if [[ $CONFIGURED_ARCH == amd64 ]]; then
452461 GRUB_PKG=grub-pc-bin
@@ -651,10 +660,10 @@ then
651660fi
652661
653662# #################
654- # secure boot
663+ # secure boot
655664# #################
656665if [[ $SECURE_UPGRADE_MODE == ' dev' || $SECURE_UPGRADE_MODE == " prod" && $SONIC_ENABLE_SECUREBOOT_SIGNATURE != ' y' ; then
657- # note: SONIC_ENABLE_SECUREBOOT_SIGNATURE is a feature that signing just kernel,
666+ # note: SONIC_ENABLE_SECUREBOOT_SIGNATURE is a feature that signing just kernel,
658667 # SECURE_UPGRADE_MODE is signing all the boot component including kernel.
659668 # its required to do not enable both features together to avoid conflicts.
660669 echo " Secure Boot support build stage: Starting .."
@@ -663,14 +672,14 @@ if [[ $SECURE_UPGRADE_MODE == 'dev' || $SECURE_UPGRADE_MODE == "prod" && $SONIC_
663672 sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install \
664673 shim-unsigned \
665674 grub-efi
666-
675+
667676 if [ ! -f $SECURE_UPGRADE_SIGNING_CERT ]; then
668677 echo " Error: SONiC SECURE_UPGRADE_SIGNING_CERT=$SECURE_UPGRADE_SIGNING_CERT key missing"
669678 exit 1
670679 fi
671680
672681 if [[ $SECURE_UPGRADE_MODE == ' dev' ; then
673- # development signing & verification
682+ # development signing & verification
674683
675684 if [ ! -f $SECURE_UPGRADE_DEV_SIGNING_KEY ]; then
676685 echo " Error: SONiC SECURE_UPGRADE_DEV_SIGNING_KEY=$SECURE_UPGRADE_DEV_SIGNING_KEY key missing"
@@ -782,7 +791,11 @@ sudo rm -f $ONIE_INSTALLER_PAYLOAD $FILESYSTEM_SQUASHFS
782791# # Note: -x to skip directories on different file systems, such as /proc
783792sudo du -h sx $FILESYSTEM_ROOT
784793sudo mkdir -p $FILESYSTEM_ROOT /var/lib/docker
785- sudo cp files/image_config/resolv-config/resolv.conf $FILESYSTEM_ROOT /etc/resolv.conf
794+
795+ # # Clear DNS configuration inherited from the build server
796+ sudo rm -f $FILESYSTEM_ROOT /etc/resolvconf/resolv.conf.d/original
797+ sudo cp files/image_config/resolv-config/resolv.conf.head $FILESYSTEM_ROOT /etc/resolvconf/resolv.conf.d/head
798+
786799sudo mksquashfs $FILESYSTEM_ROOT $FILESYSTEM_SQUASHFS -c omp zstd -b 1M -e boot -e var/lib/docker -e $PLATFORM_DIR
787800
788801# Ensure admin gid is 1000
0 commit comments