FIXUP: Add comment for needs: prepare

.github/workflows/build-push-image.yml

@@ -20,9 +20,6 @@ on:
         required: true
 
 
-env:
-  BUILDKIT_IMAGE: "docker.io/moby/buildkit:v19.0@sha256:14aa1b4dd92ea0a4cd03a54d0c6079046ea98cd0c0ae6176bdd7036ba370cbbe"
-
 jobs:
   lint:
     runs-on: ubuntu-latest
@@ -55,6 +52,7 @@ jobs:
       - name: Compute image parameters
         id: params
         run: |
+          source Dockerfile.env
           DEBIAN_ARCHIVE_DATE=$(date -u +'%Y%m%d')
           SOURCE_DATE_EPOCH=$(date -u -d ${DEBIAN_ARCHIVE_DATE} +"%s")
           TAG=${DEBIAN_ARCHIVE_DATE}-$(git describe --long --first-parent | tail -c +2)
@@ -64,19 +62,20 @@ jobs:
           echo "source_date_epoch=${SOURCE_DATE_EPOCH}" >> $GITHUB_OUTPUT
           echo "tag=${DEBIAN_ARCHIVE_DATE}-${TAG}" >> $GITHUB_OUTPUT
           echo "full_image_name=${FULL_IMAGE_NAME}" >> $GITHUB_OUTPUT
+          echo "buildkit_image=${BUILDKIT_IMAGE}" >> $GITHUB_OUTPUT
 
   build:
     name: Build ${{ matrix.platform.name }} image
-    runs-on: ubuntu-24.04${{ matrix.platform.suffix }}
+    runs-on: ${{ matrix.platform.runs-on }}
     needs:
       - prepare
     strategy:
       fail-fast: false
       matrix:
         platform:
-          - suffix: ""
+          - runs-on: "ubuntu-24.04"
             name: "linux/amd64"
-          - suffix: "-arm"
+          - runs-on: "ubuntu-24.04-arm"
             name: "linux/arm64"
     steps:
       - uses: actions/checkout@v4
@@ -98,7 +97,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
-          driver-opts: image=${{ env.BUILDKIT_IMAGE }}
+          driver-opts: image=${{ needs.prepare.outputs.buildkit_image }}
 
       - name: Build and push by digest
         id: build
@@ -110,7 +109,7 @@ jobs:
             DEBIAN_ARCHIVE_DATE=${{ needs.prepare.outputs.debian_archive_date }}
             SOURCE_DATE_EPOCH=${{ needs.prepare.outputs.source_date_epoch }}
           provenance: false
-          outputs: type=image,"name=${{ inputs.registry }}/${{ needs.image_name }}",push-by-digest=true,push=true,rewrite-timestamp=true,name-canonical=true
+          outputs: type=image,"name=${{ inputs.registry }}/${{ inputs.image_name }}",push-by-digest=true,push=true,rewrite-timestamp=true,name-canonical=true
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
@@ -132,7 +131,7 @@ jobs:
   merge:
     runs-on: ubuntu-latest
     needs:
-      - prepare
+      - prepare  # implied by build, but required here to access image params
       - build
     outputs:
       digest_root: ${{ steps.image.outputs.digest_root }}
@@ -193,11 +192,11 @@ jobs:
   # the container registry.
   provenance:
     needs:
-      - prepare
+      - prepare  # implied by merge, but required here to access image params
       - merge
     strategy:
       matrix:
-        digest:
+        manifest_type:
           - root
           - amd64
           - arm64
@@ -217,16 +216,16 @@ jobs:
   check-reproducibility:
     if: ${{ inputs.reproduce }}
     needs:
-      - prepare
+      - prepare  # implied by merge, but required here to access image params
       - merge
-    runs-on: ubuntu-24.04${{ matrix.platform.suffix }}
+    runs-on: ${{ matrix.platform.runs-on }}
     strategy:
       fail-fast: false
       matrix:
         platform:
-          - suffix: ""
+          - runs-on: "ubuntu-24.04"
             name: "amd64"
-          - suffix: "-arm"
+          - runs-on: "ubuntu-24.04-arm"
             name: "arm64"
     steps:
       - uses: actions/checkout@v4

.github/workflows/release-container-image.yml

@@ -19,4 +19,4 @@ jobs:
       image_name: dangerzone/dangerzone
       reproduce: true
     secrets:
-      registry_token : ${{ github.token }}
+      registry_token: ${{ secrets.GITHUB_TOKEN }}

Dockerfile

@@ -182,8 +182,11 @@ RUN mkdir -p \
     /new_root/tmp \
     /new_root/home/dangerzone/dangerzone-image/rootfs
 
-# XXX: Remove /etc/resolv.conf, so that the network configuration of the host
-# does not leak.
+# Copy the /etc and /var directories under the new root directory. Also,
+# copy /etc/, /opt, and /usr to the Dangerzone image rootfs.
+#
+# XXX: We also have to remove the resolv.conf file, in order to not leak any DNS
+# servers added there during image build time.
 RUN cp -r /etc /var /new_root/ \
     && rm /new_root/etc/resolv.conf
 RUN cp -r /etc /opt /usr /new_root/home/dangerzone/dangerzone-image/rootfs \

Dockerfile.env

@@ -7,3 +7,7 @@ GVISOR_ARCHIVE_DATE=20250217
 # Can be bumped to the latest version and checksum from https://github.com/ebandal/H2Orestart/releases
 H2ORESTART_CHECKSUM=452331f8603ef456264bd72db6fa8a11ca72b392019a8135c0b2f3095037d7b1
 H2ORESTART_VERSION=v0.7.1
+
+# Buildkit image (taken from freedomofpress/repro-build)
+BUILDKIT_IMAGE="docker.io/moby/buildkit:v19.0@sha256:14aa1b4dd92ea0a4cd03a54d0c6079046ea98cd0c0ae6176bdd7036ba370cbbe"
+BUILDKIT_IMAGE_ROOTLESS="docker.io/moby/buildkit:v0.19.0-rootless@sha256:e901cffdad753892a7c3afb8b9972549fca02c73888cf340c91ed801fdd96d71"

Dockerfile.in

@@ -182,8 +182,11 @@ RUN mkdir -p \
     /new_root/tmp \
     /new_root/home/dangerzone/dangerzone-image/rootfs
 
-# XXX: Remove /etc/resolv.conf, so that the network configuration of the host
-# does not leak.
+# Copy the /etc and /var directories under the new root directory. Also,
+# copy /etc/, /opt, and /usr to the Dangerzone image rootfs.
+#
+# XXX: We also have to remove the resolv.conf file, in order to not leak any DNS
+# servers added there during image build time.
 RUN cp -r /etc /var /new_root/ \
     && rm /new_root/etc/resolv.conf
 RUN cp -r /etc /opt /usr /new_root/home/dangerzone/dangerzone-image/rootfs \

dangerzone/container_utils.py

@@ -128,11 +128,9 @@ def get_expected_tag() -> str:
 def load_image_tarball() -> None:
     log.info("Installing Dangerzone container image...")
     tarball_path = get_resource_path("container.tar")
-    with open(tarball_path) as f:
     try:
         res = subprocess.run(
-                [get_runtime(), "load"],
-                stdin=f,
+            [get_runtime(), "load", "-i", tarball_path],
             startupinfo=get_subprocess_startupinfo(),
             capture_output=True,
             check=True,

dangerzone/isolation_provider/qubes.py

@@ -130,7 +130,7 @@ def is_qubes_native_conversion() -> bool:
         # This disambiguates if it is running a Qubes targetted build or not
         # (Qubes-specific builds don't ship the container image)
 
-        compressed_container_path = get_resource_path("container.tar")
-        return not os.path.exists(compressed_container_path)
+        container_image_path = get_resource_path("container.tar")
+        return not os.path.exists(container_image_path)
     else:
         return False

dev_scripts/repro-build.py

@@ -220,7 +220,22 @@ def oci_normalize_path(path):
 
 
 def oci_get_file_from_tarball(tar: tarfile.TarFile, path: str) -> dict:
-    return
+    """Get file from an OCI tarball.
+
+    If the filename cannot be found, search again by prefixing it with "./", since we
+    have encountered path names in OCI tarballs prefixed with "./".
+    """
+    try:
+        return tar.extractfile(path).read().decode()
+    except KeyError:
+        if not path.startswith("./") and not path.startswith("/"):
+            path = "./" + path
+            try:
+                return tar.extractfile(path).read().decode()
+            except KeyError:
+                # Do not raise here, so that we can raise the original exception below.
+                pass
+        raise
 
 
 def oci_parse_manifest(tar: tarfile.TarFile, path: str, platform: dict | None) -> dict:
@@ -231,7 +246,7 @@ def oci_parse_manifest(tar: tarfile.TarFile, path: str, platform: dict | None) -
     carry it from the previous manifest and include in the info here.
     """
     path = oci_normalize_path(path)
-    contents = tar.extractfile(path).read().decode()
+    contents = oci_get_file_from_tarball(tar, path)
     digest = "sha256:" + hashlib.sha256(contents.encode()).hexdigest()
     contents_dict = json.loads(contents)
     media_type = get_key(contents_dict, "mediaType")

dev_scripts/reproduce-image.py

@@ -102,7 +102,7 @@ def main():
         f"Check that the reproduced image has the expected digest: {args.digest}"
     )
     run(
-        "./dev_scripts/repro-build",
+        "./dev_scripts/repro-build.py",
         "analyze",
         "--show-contents",
         "share/container.tar",

install/common/build-image.py

@@ -122,7 +122,7 @@ def main():
 
     subprocess.run(
         [
-            "./dev_scripts/repro-build",
+            "./dev_scripts/repro-build.py",
             "build",
             "--runtime",
             args.runtime,