From e3c62122086fd318494bd775f43604321d1c3ae2 Mon Sep 17 00:00:00 2001 From: DevomB Date: Thu, 15 Oct 2026 02:27:05 -0700 Subject: [PATCH 1/2] The browser image carries the texts of Firefox's licences Firefox's top-level LICENSE says only to see toolkit/content/license.html, and source_licences took top-level files alone, so the image's licence directory held a pointer to a path in the source tree. license.html holds the texts of everything Firefox carries (its about:license): the licences row takes it too, and fails if it is not there. --- build/images/browser.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/build/images/browser.sh b/build/images/browser.sh index bcbe2bcf..a313c398 100644 --- a/build/images/browser.sh +++ b/build/images/browser.sh @@ -124,6 +124,10 @@ EOF EOF } +# Firefox's top-level LICENSE only points to toolkit/content/license.html, the texts of everything it +# carries (its about:license): that file is taken too, and must be there. s_browser_licences() { - echo "$(source_licences < <("${KRYPTIK_ROOT}/tools/fetch-sources.sh" --list-image browser)) licence files" + echo "$(source_licences '^[^/]+/toolkit/content/license\.html$' \ + < <("${KRYPTIK_ROOT}/tools/fetch-sources.sh" --list-image browser)) licence files" + test -s /usr/share/licenses/firefox/toolkit/content/license.html } From f11fb556433d14aea3dfdd96b59190717313c9d0 Mon Sep 17 00:00:00 2001 From: DevomB Date: Thu, 15 Oct 2026 09:19:57 -0700 Subject: [PATCH 2/2] Each image's chroot is entered with KRYPTIK_STICK_BIN cleared, as with kryptikd's and the proxy's make images passes KRYPTIK_STICK_BIN through CHROOT_ENV like the other two Rust binaries, but only those two were cleared for an image's chroot. With it set, as in one `make system images` naming all three, stage 03 would make /kryptik-stick in the image's overlay to bind the binary over, and tools/check-image-tree.sh refuses that file as one outside /usr: its mount points name kryptikd's and the proxy's alone. CI's images job runs `make -o system images` without the variable, so no run met it. 04-images.sh is among every image's inputs, so this rebuilds each image once. --- build/stages/04-images.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/build/stages/04-images.sh b/build/stages/04-images.sh index 2a9b44c0..9ad97e28 100755 --- a/build/stages/04-images.sh +++ b/build/stages/04-images.sh @@ -123,7 +123,8 @@ build_image() { # build_image NAME done MOUNTED="$top" mount -t overlay overlay -o "lowerdir=${lowers}${SYSROOT},upperdir=${top}/upper,workdir=${top}/overlay-work" "${top}/sysroot" - env KRYPTIK_WORK="$top" KRYPTIK_KRYPTIKD_BIN= KRYPTIK_WLPROXY_BIN= \ + # The Rust binaries are the base system's; a mount point for one would be a file the image adds. + env KRYPTIK_WORK="$top" KRYPTIK_KRYPTIKD_BIN= KRYPTIK_WLPROXY_BIN= KRYPTIK_STICK_BIN= \ "$CHROOTD" run /kryptik/build/stages/04-images.sh --inside "$name" unmount_image "$top" MOUNTED=""