From 93da5caa695cb3dfd6679731242870656388bd9e Mon Sep 17 00:00:00 2001
From: Lars Karlitski <lars@karlitski.net>
Date: Mon, 23 Sep 2019 22:52:05 +0200
Subject: [PATCH] stages/dnf: add mandatory basearch argument

We've been effectively using the basearch of the host, making the stage
non-reproducible: if the same pipeline was run on machines with
different architectures, it would produce different results. However,
pipelines producing different outputs must be different. Thus, this
patch includes the basearch in the pipeline.

In principle, this allows cross-arch builds. dnf should be the only
stage running binaries from the target tree. This is not yet tested.
---
 README.md                    | 1 +
 samples/base-from-yum.json   | 2 ++
 samples/base-qcow2.json      | 1 +
 samples/base.json            | 1 +
 samples/build-from-yum.json  | 1 +
 stages/org.osbuild.dnf       | 2 ++
 test/pipelines/f30-boot.json | 2 ++
 test/pipelines/firewall.json | 1 +
 test/pipelines/locale.json   | 1 +
 test/pipelines/timezone.json | 1 +
 10 files changed, 13 insertions(+)

diff --git a/README.md b/README.md
index 724686c1..6241ee15 100644
--- a/README.md
+++ b/README.md
@@ -18,6 +18,7 @@ assembles it into an image. Pipelines are defined as JSON files like this one:
       "name": "org.osbuild.dnf",
       "options": {
         "releasever": "30",
+        "basearch": "x86_64",
         "repos": {
           "fedora": {
             "name": "Fedora",
diff --git a/samples/base-from-yum.json b/samples/base-from-yum.json
index 43dda7c6..74696fe2 100644
--- a/samples/base-from-yum.json
+++ b/samples/base-from-yum.json
@@ -7,6 +7,7 @@
         "name": "org.osbuild.yum",
         "options": {
           "releasever": "27",
+          "basearch": "x86_64",
           "repos": {
             "fedora": {
               "name": "Fedora",
@@ -27,6 +28,7 @@
       "name": "org.osbuild.dnf",
       "options": {
         "releasever": "30",
+        "basearch": "x86_64",
         "repos": {
           "fedora": {
             "name": "Fedora",
diff --git a/samples/base-qcow2.json b/samples/base-qcow2.json
index 6f79ae76..0b3f2cce 100644
--- a/samples/base-qcow2.json
+++ b/samples/base-qcow2.json
@@ -5,6 +5,7 @@
       "name": "org.osbuild.dnf",
       "options": {
         "releasever": "30",
+        "basearch": "x86_64",
         "install_weak_deps": true,
         "repos": {
           "fedora": {
diff --git a/samples/base.json b/samples/base.json
index b9190fcb..b76809ce 100644
--- a/samples/base.json
+++ b/samples/base.json
@@ -5,6 +5,7 @@
       "name": "org.osbuild.dnf",
       "options": {
         "releasever": "30",
+        "basearch": "x86_64",
         "repos": {
           "fedora": {
             "name": "Fedora",
diff --git a/samples/build-from-yum.json b/samples/build-from-yum.json
index 29a07403..1294f89f 100644
--- a/samples/build-from-yum.json
+++ b/samples/build-from-yum.json
@@ -5,6 +5,7 @@
       "name": "org.osbuild.yum",
       "options": {
         "releasever": "27",
+        "basearch": "x86_64",
         "repos": {
           "fedora": {
             "name": "Fedora",
diff --git a/stages/org.osbuild.dnf b/stages/org.osbuild.dnf
index a186e753..b76152a1 100755
--- a/stages/org.osbuild.dnf
+++ b/stages/org.osbuild.dnf
@@ -9,6 +9,7 @@ def main(tree, options):
     repos = options["repos"]
     packages = options["packages"]
     releasever = options["releasever"]
+    basearch = options["basearch"]
     operation = options.get("operation", "install")
     weak_deps = options.get("install_weak_deps", True)
 
@@ -45,6 +46,7 @@ def main(tree, options):
     cmd = [
         "dnf", "-yv",
         "--installroot", tree,
+        "--forcearch", basearch,
         "--setopt", "reposdir=",
         "--setopt", f"install_weak_deps={weak_deps}",
         "--releasever", releasever,
diff --git a/test/pipelines/f30-boot.json b/test/pipelines/f30-boot.json
index 5c9ebbd9..759cb461 100644
--- a/test/pipelines/f30-boot.json
+++ b/test/pipelines/f30-boot.json
@@ -7,6 +7,7 @@
         "name": "org.osbuild.dnf",
         "options": {
           "releasever": "30",
+          "basearch": "x86_64",
           "install_weak_deps": false,
           "repos": {
             "fedora": {
@@ -31,6 +32,7 @@
       "name": "org.osbuild.dnf",
       "options": {
         "releasever": "30",
+        "basearch": "x86_64",
         "install_weak_deps": true,
         "repos": {
           "fedora": {
diff --git a/test/pipelines/firewall.json b/test/pipelines/firewall.json
index e71de3ae..d4f943b4 100644
--- a/test/pipelines/firewall.json
+++ b/test/pipelines/firewall.json
@@ -5,6 +5,7 @@
       "name": "org.osbuild.dnf",
       "options": {
         "releasever": "30",
+        "basearch": "x86_64",
         "repos": {
           "fedora": {
             "name": "Fedora",
diff --git a/test/pipelines/locale.json b/test/pipelines/locale.json
index ced208f3..f778f108 100644
--- a/test/pipelines/locale.json
+++ b/test/pipelines/locale.json
@@ -5,6 +5,7 @@
       "name": "org.osbuild.dnf",
       "options": {
         "releasever": "30",
+        "basearch": "x86_64",
         "repos": {
           "fedora": {
             "name": "Fedora",
diff --git a/test/pipelines/timezone.json b/test/pipelines/timezone.json
index c9157f2b..38eabeda 100644
--- a/test/pipelines/timezone.json
+++ b/test/pipelines/timezone.json
@@ -5,6 +5,7 @@
       "name": "org.osbuild.dnf",
       "options": {
         "releasever": "30",
+        "basearch": "x86_64",
         "repos": {
           "fedora": {
             "name": "Fedora",