qubesbuilder-v2 cannot build DEB packages inside podman

[ydirson]

Qubes OS release

4.2

Brief summary

Building DEB packages works, both on Debian and Fedora, when using Docker, but fails on both when using Podman.

Steps to reproduce

Follow steps for building with podman as described in QubesOS/qubes-doc#1520

Actual behavior

The call to pbuilder create first shows one fishy warning:

16:01:00 [qb.build_deb.core-agent-linux.vm-bookworm.build] I: Extracting util-linux...
16:01:00 [qb.build_deb.core-agent-linux.vm-bookworm.build] I: Extracting util-linux-extra...
16:01:00 [qb.build_deb.core-agent-linux.vm-bookworm.build] I: Extracting zlib1g...
16:01:00 [qb.build_deb.core-agent-linux.vm-bookworm.build] W: Could not create /dev/ptmx, falling back to symlink. This chroot will require /dev/pts mounted with ptmxmode=666
16:01:00 [qb.build_deb.core-agent-linux.vm-bookworm.build] I: Installing core packages...

then fails with:

16:01:43 [qb.build_deb.core-agent-linux.vm-bookworm.build] I: installing dummy policy-rc.d
16:01:43 [qb.build_deb.core-agent-linux.vm-bookworm.build] Get:1 file:/tmp/qubes-deb bookworm InRelease
16:01:43 [qb.build_deb.core-agent-linux.vm-bookworm.build] Ign:1 file:/tmp/qubes-deb bookworm InRelease
16:01:43 [qb.build_deb.core-agent-linux.vm-bookworm.build] Get:2 file:/tmp/qubes-deb bookworm Release [337 B]
16:01:43 [qb.build_deb.core-agent-linux.vm-bookworm.build] Get:2 file:/tmp/qubes-deb bookworm Release [337 B]
16:01:43 [qb.build_deb.core-agent-linux.vm-bookworm.build] Get:3 file:/tmp/qubes-deb bookworm Release.gpg
16:01:43 [qb.build_deb.core-agent-linux.vm-bookworm.build] Ign:3 file:/tmp/qubes-deb bookworm Release.gpg
16:01:44 [qb.build_deb.core-agent-linux.vm-bookworm.build] Get:4 https://deb.qubes-os.org/r4.2/vm bookworm InRelease [4739 B]
16:01:44 [qb.build_deb.core-agent-linux.vm-bookworm.build] /usr/bin/apt-key: 95: cannot create /dev/null: Permission denied
16:01:44 [qb.build_deb.core-agent-linux.vm-bookworm.build] /usr/bin/apt-key: 95: cannot create /dev/null: Permission denied
16:01:44 [qb.build_deb.core-agent-linux.vm-bookworm.build] /usr/bin/apt-key: 95: cannot create /dev/null: Permission denied
16:01:44 [qb.build_deb.core-agent-linux.vm-bookworm.build] E: gpgv, gpgv2 or gpgv1 required for verification, but neither seems installed

Additional information

• simply running debootstrap bookworm ... inside a localhost/qubes-builder-fedora:latest instance does show the first warning mentionned above, and exits "in success"... though when looking at the resulting tree, /dev is obviously wrong, no device node can be created there:

[user@12fb6d79fdf3 /]$ ls /builder/build/test/dev/ -l
total 8
lrwxrwxrwx 1 root root   13 Sep 28 13:39 fd -> /proc/self/fd
-rw-r--r-- 1 root root    0 Sep 28 13:40 null
lrwxrwxrwx 1 root root    8 Sep 28 13:39 ptmx -> pts/ptmx
drwxr-xr-x 2 root root 4096 Sep 28 13:39 pts
drwxr-xr-x 2 root root 4096 Sep 28 13:39 shm
lrwxrwxrwx 1 root root   15 Sep 28 13:39 stderr -> /proc/self/fd/2
lrwxrwxrwx 1 root root   15 Sep 28 13:39 stdin -> /proc/self/fd/0
lrwxrwxrwx 1 root root   15 Sep 28 13:39 stdout -> /proc/self/fd/1
[user@12fb6d79fdf3 /]$ sudo rm /builder/build/test/dev/null
[user@12fb6d79fdf3 /]$ sudo mknod /builder/build/test/dev/null c 1 3 
mknod: /builder/build/test/dev/null: Operation not permitted

• getting "--bindmounts /dev:/dev" added to the pbuilder create invocation does not help

[ydirson]

One possible direction for getting rid if this, would be to remove the need for debootstrap to be able to really create device nodes, by running it and the subsequent steps until tarball creation under fakeroot. However that seems to cover just a part of what pbuilder create does, so some surgery could be needed.
Then there is the user-mode-linux variant of pbuilder, which could get rid of that problem with less hassle.