Skip to content

Make base_ubuntu_warden_rosetta host-architecture agnostic so it can run in CI - #715

Closed
mkocher wants to merge 1 commit into
ubuntu-resolutefrom
resolute-better-rosetta
Closed

Make base_ubuntu_warden_rosetta host-architecture agnostic so it can run in CI#715
mkocher wants to merge 1 commit into
ubuntu-resolutefrom
resolute-better-rosetta

Conversation

@mkocher

@mkocher mkocher commented Aug 25, 2026

Copy link
Copy Markdown
Member

Human Summary

Make building the rosetta stemcell possible in CI by not relying on any of the arm binaries. Verified with a build and test deployment with the new stemcell.

AI Summary

The stage executed arm64 binaries while doing its work — the tar self-test, and dpkg -x in the chroot, which shells out to the just-swapped GNU tar — so it only ran on an Apple Silicon host. Download all the arm64 debs first, extract them from outside the chroot with the builder image's tar, then swap and statically verify (e_machine == 183) every replacement, including tar and the systemd daemons. The tar round-trip now runs only behind an exec probe and skips loudly otherwise, in the stage and in rosetta_spec.rb, so the stage can build on an x86-64 CI worker.

Also cover stage_collection's rosetta insertion, which had no unit test.

The stage executed arm64 binaries while doing its work — the tar self-test,
and `dpkg -x` in the chroot, which shells out to the just-swapped GNU tar — so
it only ran on an Apple Silicon host. Download all the arm64 debs first,
extract them from outside the chroot with the builder image's tar, then swap
and statically verify (e_machine == 183) every replacement, including tar and
the systemd daemons. The tar round-trip now runs only behind an exec probe and
skips loudly otherwise, in the stage and in rosetta_spec.rb, so the stage can
build on an x86-64 CI worker.

Also cover stage_collection's rosetta insertion, which had no unit test.
@coderabbitai

coderabbitai Bot commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Too many files!

This PR contains 211 files, which is 111 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 45e6595d-36a5-4d8a-b371-9af663d4159a

📥 Commits

Reviewing files that changed from the base of the PR and between 05cd708 and 7f5d9a0.

⛔ Files ignored due to path filters (5)
  • Gemfile.lock is excluded by !**/*.lock
  • acceptance-tests/go.sum is excluded by !**/*.sum
  • stemcell_builder/stages/bosh_monit/assets/monit-5.29.0.tar.gz is excluded by !**/*.gz
  • vendor/package/json-2.21.1.gem is excluded by !vendor/**
  • vendor/package/json-2.21.2.gem is excluded by !vendor/**
📒 Files selected for processing (211)
  • .envrc
  • .github/workflows/sbom.yml
  • .gitignore
  • README.md
  • Rakefile
  • acceptance-tests/go.mod
  • acceptance-tests/ipv4director/auditd/smoke_test.go
  • acceptance-tests/ipv4director/ipv6basic/basic_test.go
  • acceptance-tests/ipv4director/ipv6basic/manifest.yml
  • acceptance-tests/ipv4director/smoke/manifest.yml
  • acceptance-tests/ipv4director/smoke/smoke_suite_test.go
  • acceptance-tests/ipv4director/smoke/smoke_test.go
  • acceptance-tests/ipv4director/syslogrelease/manifest.yml
  • acceptance-tests/ipv6director/ipv6full/full_test.go
  • acceptance-tests/vendor/github.com/cloudfoundry/bosh-utils/system/process_priority_unix.go
  • acceptance-tests/vendor/github.com/go-logr/logr/context_noslog.go
  • acceptance-tests/vendor/github.com/go-logr/logr/context_slog.go
  • acceptance-tests/vendor/github.com/go-logr/logr/funcr/funcr.go
  • acceptance-tests/vendor/github.com/go-logr/logr/funcr/slogsink.go
  • acceptance-tests/vendor/github.com/go-logr/logr/sloghandler.go
  • acceptance-tests/vendor/github.com/go-logr/logr/slogr.go
  • acceptance-tests/vendor/github.com/go-logr/logr/slogsink.go
  • acceptance-tests/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md
  • acceptance-tests/vendor/github.com/onsi/ginkgo/v2/internal/group.go
  • acceptance-tests/vendor/github.com/onsi/ginkgo/v2/types/version.go
  • acceptance-tests/vendor/go.yaml.in/yaml/v3/parserc.go
  • acceptance-tests/vendor/go.yaml.in/yaml/v3/yamlh.go
  • acceptance-tests/vendor/golang.org/x/tools/go/ast/inspector/cursor.go
  • acceptance-tests/vendor/golang.org/x/tools/go/packages/visit.go
  • acceptance-tests/vendor/golang.org/x/tools/go/types/typeutil/callee.go
  • acceptance-tests/vendor/golang.org/x/tools/go/types/typeutil/imports.go
  • acceptance-tests/vendor/golang.org/x/tools/go/types/typeutil/map.go
  • acceptance-tests/vendor/golang.org/x/tools/go/types/typeutil/methodsetcache.go
  • acceptance-tests/vendor/golang.org/x/tools/go/types/typeutil/ui.go
  • acceptance-tests/vendor/golang.org/x/tools/internal/moremaps/maps.go
  • acceptance-tests/vendor/golang.org/x/tools/internal/typeparams/common.go
  • acceptance-tests/vendor/golang.org/x/tools/internal/typeparams/coretype.go
  • acceptance-tests/vendor/golang.org/x/tools/internal/typeparams/free.go
  • acceptance-tests/vendor/golang.org/x/tools/internal/typeparams/normalize.go
  • acceptance-tests/vendor/golang.org/x/tools/internal/typeparams/termlist.go
  • acceptance-tests/vendor/golang.org/x/tools/internal/typeparams/typeterm.go
  • acceptance-tests/vendor/golang.org/x/tools/internal/typesinternal/assignedaddress.go
  • acceptance-tests/vendor/golang.org/x/tools/internal/typesinternal/classify_call.go
  • acceptance-tests/vendor/golang.org/x/tools/internal/typesinternal/element.go
  • acceptance-tests/vendor/golang.org/x/tools/internal/typesinternal/toonew.go
  • acceptance-tests/vendor/golang.org/x/tools/internal/typesinternal/types.go
  • acceptance-tests/vendor/modules.txt
  • bosh-stemcell/image-metalinks/ubuntu-resolute.meta4
  • bosh-stemcell/lib/bosh/stemcell/build_environment.rb
  • bosh-stemcell/lib/bosh/stemcell/builder_options.rb
  • bosh-stemcell/lib/bosh/stemcell/definition.rb
  • bosh-stemcell/lib/bosh/stemcell/infrastructure.rb
  • bosh-stemcell/lib/bosh/stemcell/stage_collection.rb
  • bosh-stemcell/spec/assets/dpkg-list-ubuntu-azure-additions.txt
  • bosh-stemcell/spec/assets/dpkg-list-ubuntu-kernel.txt
  • bosh-stemcell/spec/assets/dpkg-list-ubuntu-softlayer-additions.txt
  • bosh-stemcell/spec/assets/dpkg-list-ubuntu-vsphere-additions.txt
  • bosh-stemcell/spec/assets/dpkg-list-ubuntu.txt
  • bosh-stemcell/spec/bosh/stemcell/builder_options_spec.rb
  • bosh-stemcell/spec/bosh/stemcell/definition_spec.rb
  • bosh-stemcell/spec/bosh/stemcell/infrastructure_spec.rb
  • bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb
  • bosh-stemcell/spec/bosh/stemcell/stemcell_packager_spec.rb
  • bosh-stemcell/spec/os_image/ubuntu_spec.rb
  • bosh-stemcell/spec/spec_helper.rb
  • bosh-stemcell/spec/stemcells/alicloud_spec.rb
  • bosh-stemcell/spec/stemcells/aws_spec.rb
  • bosh-stemcell/spec/stemcells/azure_spec.rb
  • bosh-stemcell/spec/stemcells/cis_spec.rb
  • bosh-stemcell/spec/stemcells/fips_spec.rb
  • bosh-stemcell/spec/stemcells/google_spec.rb
  • bosh-stemcell/spec/stemcells/openstack_spec.rb
  • bosh-stemcell/spec/stemcells/rosetta_spec.rb
  • bosh-stemcell/spec/stemcells/softlayer_spec.rb
  • bosh-stemcell/spec/stemcells/stig_spec.rb
  • bosh-stemcell/spec/stemcells/ubuntu_spec.rb
  • bosh-stemcell/spec/stemcells/vcloud_spec.rb
  • bosh-stemcell/spec/stemcells/vsphere_spec.rb
  • bosh-stemcell/spec/stemcells/warden_spec.rb
  • bosh-stemcell/spec/support/os_image_chrony_shared_examples.rb
  • bosh-stemcell/spec/support/os_image_linux_kernel_modules_shared_examples.rb
  • bosh-stemcell/spec/support/os_image_linux_kernel_shared_examples.rb
  • bosh-stemcell/spec/support/os_image_shared_examples.rb
  • bosh-stemcell/spec/support/os_image_systemd_shared_examples.rb
  • bosh-stemcell/spec/support/stemcell_image.rb
  • bosh-stemcell/spec/support/stemcell_shared_examples.rb
  • ci/configure.sh
  • ci/docker/os-image-stemcell-builder/.gitignore
  • ci/docker/os-image-stemcell-builder/Dockerfile
  • ci/pipeline-template.yml
  • ci/pipeline-vars.yml
  • docs/apple-silicon-builds.md
  • docs/noble-dev.md
  • docs/rosetta-stemcell-variant.md
  • image-metalinks/ubuntu-noble/ubuntu-noble.meta4
  • image-metalinks/ubuntu-resolute/ubuntu-resolute.meta4
  • scripts/stemcell-repack-debugger.sh
  • stemcell_builder/lib/helpers.sh
  • stemcell_builder/lib/prelude_bosh.bash
  • stemcell_builder/stages/base_apt/apply.sh
  • stemcell_builder/stages/base_apt/assets/etc/apt/apt.conf.d/50unattended-upgrades
  • stemcell_builder/stages/base_file_permission/apply.sh
  • stemcell_builder/stages/base_ssh/apply.sh
  • stemcell_builder/stages/base_ssh/assets/10-ssh-firstboot-done.conf
  • stemcell_builder/stages/base_ubuntu_build_essential/apply.sh
  • stemcell_builder/stages/base_ubuntu_firstboot/apply.sh
  • stemcell_builder/stages/base_ubuntu_firstboot/assets/etc/rc.local
  • stemcell_builder/stages/base_ubuntu_firstboot/assets/etc/systemd/system/firstboot.service
  • stemcell_builder/stages/base_ubuntu_firstboot/assets/root/firstboot.sh
  • stemcell_builder/stages/base_ubuntu_packages/apply.sh
  • stemcell_builder/stages/base_ubuntu_packages/assets/apparmor-local-sbin.dhclient
  • stemcell_builder/stages/base_ubuntu_packages/assets/runit.service
  • stemcell_builder/stages/base_ubuntu_warden_rosetta/apply.sh
  • stemcell_builder/stages/base_warden/apply.sh
  • stemcell_builder/stages/base_warden/assets/runit/cron/run
  • stemcell_builder/stages/base_warden/assets/runit/rsyslog/run
  • stemcell_builder/stages/base_warden/assets/runit/ssh/run
  • stemcell_builder/stages/base_warden/assets/runsvdir-start
  • stemcell_builder/stages/base_warden/assets/service
  • stemcell_builder/stages/base_warden/assets/unshare
  • stemcell_builder/stages/blobstore_clis/assets/bosh-blobstore-azure-storage.sha256sum
  • stemcell_builder/stages/blobstore_clis/assets/bosh-blobstore-azure-storage.url
  • stemcell_builder/stages/blobstore_clis/assets/bosh-blobstore-azure-storage.version
  • stemcell_builder/stages/blobstore_clis/assets/bosh-blobstore-dav.sha256sum
  • stemcell_builder/stages/blobstore_clis/assets/bosh-blobstore-dav.url
  • stemcell_builder/stages/blobstore_clis/assets/bosh-blobstore-dav.version
  • stemcell_builder/stages/blobstore_clis/assets/bosh-blobstore-gcs.sha256sum
  • stemcell_builder/stages/blobstore_clis/assets/bosh-blobstore-gcs.url
  • stemcell_builder/stages/blobstore_clis/assets/bosh-blobstore-gcs.version
  • stemcell_builder/stages/blobstore_clis/assets/bosh-blobstore-s3.sha256sum
  • stemcell_builder/stages/blobstore_clis/assets/bosh-blobstore-s3.url
  • stemcell_builder/stages/blobstore_clis/assets/bosh-blobstore-s3.version
  • stemcell_builder/stages/bosh_alicloud_agent_settings/assets/agent.json
  • stemcell_builder/stages/bosh_alicloud_agent_settings/assets/agent.md
  • stemcell_builder/stages/bosh_audit/shared_functions.bash
  • stemcell_builder/stages/bosh_aws_agent_settings/assets/agent.json
  • stemcell_builder/stages/bosh_aws_agent_settings/assets/agent.md
  • stemcell_builder/stages/bosh_azure_agent_settings/assets/agent.json
  • stemcell_builder/stages/bosh_cloudstack_agent_settings/assets/agent.json
  • stemcell_builder/stages/bosh_enable_password_authentication/apply.sh
  • stemcell_builder/stages/bosh_go_agent/apply.sh
  • stemcell_builder/stages/bosh_go_agent/assets/bosh-agent-version
  • stemcell_builder/stages/bosh_go_agent/assets/bosh-agent.service
  • stemcell_builder/stages/bosh_go_agent/assets/metalink.meta4
  • stemcell_builder/stages/bosh_go_agent/assets/runit/agent/log/run
  • stemcell_builder/stages/bosh_go_agent/assets/runit/agent/run
  • stemcell_builder/stages/bosh_go_agent/assets/runit/monit/down
  • stemcell_builder/stages/bosh_go_agent/assets/runit/monit/log/run
  • stemcell_builder/stages/bosh_go_agent/assets/runit/monit/run
  • stemcell_builder/stages/bosh_google_agent_settings/assets/agent.json
  • stemcell_builder/stages/bosh_google_agent_settings/assets/agent.md
  • stemcell_builder/stages/bosh_monit/apply.sh
  • stemcell_builder/stages/bosh_monit/assets/monit
  • stemcell_builder/stages/bosh_monit/assets/monit-access-helper.sh
  • stemcell_builder/stages/bosh_monit/assets/monit.service
  • stemcell_builder/stages/bosh_monit/assets/restrict-monit-api-access
  • stemcell_builder/stages/bosh_ntp/apply.sh
  • stemcell_builder/stages/bosh_openstack_agent_settings/assets/agent.json
  • stemcell_builder/stages/bosh_openstack_agent_settings/assets/agent.md
  • stemcell_builder/stages/bosh_softlayer_agent_settings/apply.sh
  • stemcell_builder/stages/bosh_softlayer_agent_settings/assets/agent.json
  • stemcell_builder/stages/bosh_sysctl/assets/60-bosh-sysctl.conf
  • stemcell_builder/stages/bosh_systemd/apply.sh
  • stemcell_builder/stages/bosh_systemd_resolved/apply.sh
  • stemcell_builder/stages/bosh_systemd_resolved/assets/add-container-listener-address.conf
  • stemcell_builder/stages/bosh_systemd_resolved/assets/create-systemd-resolved-listener-address.service
  • stemcell_builder/stages/bosh_users/assets/sudoers
  • stemcell_builder/stages/bosh_vsphere_agent_settings/assets/agent.json
  • stemcell_builder/stages/delay_monit_start/apply.sh
  • stemcell_builder/stages/dev_tools_config/assets/generate_dev_tools_file_list.sh
  • stemcell_builder/stages/image_create/apply.sh
  • stemcell_builder/stages/image_create_softlayer_two_partitions/apply.sh
  • stemcell_builder/stages/image_create_softlayer_two_partitions/config.sh
  • stemcell_builder/stages/image_install_grub/apply.sh
  • stemcell_builder/stages/image_install_grub_efi/apply.sh
  • stemcell_builder/stages/image_install_grub_efi/config.sh
  • stemcell_builder/stages/image_install_grub_softlayer_two_partitions/apply.sh
  • stemcell_builder/stages/image_install_grub_softlayer_two_partitions/config.sh
  • stemcell_builder/stages/logrotate_config/assets/logrotate.timer
  • stemcell_builder/stages/logrotate_config/assets/opensuse-logrotate.conf
  • stemcell_builder/stages/password_policies/apply.sh
  • stemcell_builder/stages/password_policies/assets/opensuse/common-account.patch
  • stemcell_builder/stages/password_policies/assets/opensuse/common-auth.patch
  • stemcell_builder/stages/password_policies/assets/opensuse/common-password.patch
  • stemcell_builder/stages/password_policies/assets/ubuntu/common-auth.patch
  • stemcell_builder/stages/password_policies/assets/ubuntu/common-password.patch
  • stemcell_builder/stages/restrict_su_command/apply.sh
  • stemcell_builder/stages/rsyslog_config/apply.sh
  • stemcell_builder/stages/rsyslog_config/assets/journal-override.conf
  • stemcell_builder/stages/rsyslog_config/assets/rsyslog.conf
  • stemcell_builder/stages/rsyslog_config/assets/rsyslog_90-bosh-agent.conf
  • stemcell_builder/stages/rsyslog_config/assets/rsyslog_logrotate.conf
  • stemcell_builder/stages/static_libraries_config/apply.sh
  • stemcell_builder/stages/static_libraries_config/assets/static_libraries_list.txt
  • stemcell_builder/stages/system_alicloud/apply.sh
  • stemcell_builder/stages/system_azure_init/apply.sh
  • stemcell_builder/stages/system_azure_init/assets/etc/systemd/system/cloud-config.service.d/firstboot-blocker.conf
  • stemcell_builder/stages/system_azure_init/assets/etc/waagent/walinuxagent.service
  • stemcell_builder/stages/system_azure_network/apply.sh
  • stemcell_builder/stages/system_azure_network/assets/01-azure-sriov-unmanaged.network
  • stemcell_builder/stages/system_azure_network/assets/10-azure-sriov-unmanaged.rules
  • stemcell_builder/stages/system_google_packages/assets/instance_configs.cfg.template
  • stemcell_builder/stages/system_grub/apply.sh
  • stemcell_builder/stages/system_kernel/apply.sh
  • stemcell_builder/stages/system_kernel_modules/apply.sh
  • stemcell_builder/stages/system_parameters/apply.sh
  • stemcell_builder/stages/system_softlayer_multipath_tools/apply.sh
  • stemcell_builder/stages/system_softlayer_multipath_tools/assets/etc/multipath.conf
  • stemcell_builder/stages/system_softlayer_netplan/apply.sh
  • stemcell_builder/stages/system_softlayer_open_iscsi/apply.sh
  • stemcell_builder/stages/udev_aws_rules/assets/nvme-id

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@mkocher
mkocher changed the base branch from ubuntu-jammy to ubuntu-resolute August 25, 2026 23:48
@mkocher mkocher closed this Aug 25, 2026
@mkocher mkocher reopened this Aug 25, 2026
@mkocher

mkocher commented Aug 26, 2026

Copy link
Copy Markdown
Member Author

closing to reopen fresh against the right branch

@mkocher mkocher closed this Aug 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant