bootc CI: build and test on a system with SELinux fully disabled (e.g. Arch) #103

Activity

1. cgwalters-bot

   added

   target:bootc-dev

   bootc-dev

   and removed

   target:bootc-dev

   bootc-dev

   on Sep 26, 2026
2. cgwalters-bot

   added this to Workstreamon Sep 30, 2026
3. cgwalters-bot

   added a parent issue on Oct 3, 2026

   • Epic: bootc and ostree family (parked) #333
4. cgwalters-bot

   added

   P2

   on Oct 3, 2026
5. cgwalters-bot

   moved this to Todo in Workstreamon Oct 7, 2026
6. cgwalters-bot

   added 3 commits that reference this issue on Oct 17, 2026

   supervisor: Use the shared actor to avoid duplicated policy

   ...

   64b369c

   supervisor: Use the shared actor to avoid duplicated policy

   ...

   a5e32d6

   supervisor: Use the shared actor to avoid duplicated policy

   ...

   6172db1
7. cgwalters-forge

   locked as resolved and limited conversation to collaborators on Oct 18, 2026
8. cgwalters-bot commented on Oct 22, 2026

   

   cgwalters-bot

   on Oct 22, 2026

   Last edited by cgwalters-bot

   CollaboratorAuthor

   More actions

   ✅ dispatch ended well. Result: #103 (comment)
9. cgwalters-bot commented on Oct 22, 2026

   

   cgwalters-bot

   on Oct 22, 2026

   CollaboratorAuthor

   More actions

   Triage (21 Oct 2026): still wanted, and it fits in one PR.

   • The feature exists. bootc#2494 merged on 30 Sep 2026. It puts libselinux behind the default selinux feature (crates/lib/Cargo.toml) and adds CARGO_OPTIONS to the Makefile.
   • The only CI coverage today is compile-only, on a host that has libselinux. The validate job in ci.yml runs on Ubuntu, and its make validate step only runs cargo check --no-default-features and cargo test -p bootc-lib --no-default-features --no-run. Nothing builds bootc on a system with no libselinux, and nothing runs the no-selinux unit tests. A regression that links libselinux unconditionally again (the 1.16.11 breakage) would not be caught.
   • I did not run anything for this triage. #2494's testing reports that the make bin command from this issue works on archlinux:latest.
   • Unclear:
     • Arch package names and rolling-release churn. The job may need a fix now and then. Mark it non-blocking (continue-on-error) at first if upstream prefers.
     • Whether upstream wants a just recipe for it. ci.yml's header asks that CI steps be easy to run locally.

   The target is the fork cgwalters-forge/bootc: the PR is staged there and the operator promotes it upstream, because bootc-dev/bootc is not in dispatch bounds.

   {
     "schema": "agent-board/job-plan/v1",
     "repo": "cgwalters-forge/bootc",
     "item": 103,
     "kind": "implement",
     "runner": "hosted",
     "brief": "Add a CI job to bootc that builds and unit-tests bootc without SELinux on a distribution that ships no libselinux (Arch Linux), following up bootc-dev/bootc#2494. (1) In .github/workflows/ci.yml add one job, e.g. build-no-selinux, next to validate: runs-on ubuntu-26.04 with container archlinux:latest. Install the build dependencies with pacman -Syu --noconfirm (at least base-devel rust ostree glib2 openssl zstd pkgconf git jq; adjust to what the build needs) and confirm libselinux is not installed. Run the steps through a new Justfile recipe or Makefile target, since the ci.yml header asks for steps that can be run locally. That recipe: runs make bin CARGO_OPTIONS='--no-default-features --features install-to-disk,pre-6.15'; fails if ldd target/release/bootc mentions libselinux; runs target/release/bootc --version; and runs cargo test -p bootc-lib --no-default-features --features install-to-disk, so the non-selinux code paths are executed, not only compiled. (2) Add a sentence to docs/src/bootc-packaging-and-integration.7.md, where #2494 documented CARGO_OPTIONS, saying CI covers this build on Arch. Do not restructure other jobs. Add rust caching only if it is trivial. Test: if podman works in the sandbox, run the recipe in podman run --rm -v $PWD:/src:Z -w /src archlinux:latest, following the sandbox notes on proxies and CAs for networked containers, and report the real result. Lint the workflow with actionlint if available, or at least parse the YAML. If containers cannot run, say so in the PR and leave CI to prove the job. In the PR description, quote the ldd check output and the unit test counts."
   }
   

   Generated by dispatch · ◷