The editable install of the Supervisor package resolves its build backend
(setuptools, pinned via build-system.requires in pyproject.toml) in an
isolated build environment. Unlike the runtime requirements install, this
step was not given the locally built wheels, so it resolved build
dependencies solely from the configured package indexes.
When a pinned build dependency is newer than what the Home Assistant
musllinux wheels index currently carries (e.g. a Dependabot setuptools
bump), uv's default first-index strategy never falls through to PyPI and
the editable install fails with "No solution found".
Pass the locally built wheels via --find-links, mirroring the runtime
requirements step, so the isolated build environment can satisfy build
dependencies from them.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The s6 supervision tree only waited S6_SERVICES_GRACETIME (10s) for the
Supervisor service in /etc/services.d to stop before tearing down the rest
of the tree, which cut graceful shutdown short well before the container's
stop timeout. Now that the OS grants the Supervisor container more time to
shut down, raise S6_SERVICES_GRACETIME to 415s so a long-running graceful
shutdown can complete.
Also set S6_KILL_GRACETIME explicitly to its default of 3000ms. It only acts
as the final SIGTERM-to-SIGKILL grace at the very end of shutdown, so the
default is fine, but stating it keeps both shutdown timers documented in one
place.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This flattens the Docker image from 9 layers to 5 by using multi-stage
build that squashes layers into logical blocks. The first layer on top
of the base image adds system-wide packages and uv (which is not updated
so often - if it were, it may be wise to move it into the next or
separate layer; it weights roughly 50 MB) which should be preserved
between releases, while the next layer adds all Supervisor Python code
and dependencies.
This means that unless the base image or packages installed in the first
stage are changed (or in other words, only Supervisor code is changed),
only a single layer is pulled from the repository. Previously, it
generally resulted in pull of all the following 4 layers, as just a
change in the requirements invalidated the following layers. The fetched
payload size remains roughly the same.
* Fix version/requirements parsing in setup.py, set version in Dockerfile
Remove the step patching const.py with detected version in CI and do
this during Dockerfile version from BUILD_VERSION argument instead.
Also, fix parsing of the version in `setup.py` - it wasn't working
because it was splitting the files on "/n" instead of newlines,
resulting in all Python packages installed having version string set to
`9999.9.9.dev9999` instead of the expected version.
(Note: setuptools are doing a version string normalization, so the
installed package has stripped leading zeroes and the second component
is `9` instead of the literal `09` used in default string in all places.
Fixing this is out of scope of this change as the ideal solution would
be to change the versioning schema but it should be noted.)
Lastly, clean up builder.yaml environment variables (crane is not used
anymore after #6679).
* Generate setuptools-compatible version for PR builds
For PR builds, we're using plain commit SHA as the version. This is
perfectly fine for Docker tags but it's not acceptable for Python
package version. By fixing the setup.py bug this error surfaced. Work it
around by setting the Package version to the string we used previously
suffixed by the commit SHA as build metadata (delimited by `+`).
* Migrate builder workflow to new builder actions
Migrate Supervisor image build to new builder actions. The resulting images
should be identical to those built by the builder.
Refs #6646 - does not implement multi-arch manifest publishing (will be done in
a follow-up)
* Update devcontainer version to 3
* Use unpublished local wheels during PR builds
Refactor wheel building to use the new `local-wheels-repo-path` and move wheels
building into a separate CI job. Wheels are only published on published (i.e.
release or merged dev), for PR builds they are passed as artifacts to the build
job instead.
* Address review comments
* Add trailing slash for wheels folder
* Always run the changed_files check to ensure build_wheels runs on publish
* Use full path for workflow and escape dots in changed files regexp
To avoid accidential writes to the Supervisor root filesystem, we might
use the Docker read-only mode at one point. This is not yet the default,
but using s6-overlay with the read-only flag seems not to have any
downsides. So enable this by default.
To start Supervisor with read-only root file system teh following
arguments have to be used: `--read-only --tmpfs /run:exec`.
We don't intent to run uv again, so the cache is not really useful.
The cache directory size is around 80MB, however, the files are mostly
hardlinks to the original files in `/usr/local/lib/python3.13/site-packages`
so the actual saving is much smaller.
Since transition from pip to uv in #5152, Supervisor container doesn't
contain bytecode for site-packages anymore, and because our AppArmor
profile denies mkdir operations, the compiled *.pyc files are never
created. Enable uv --compile option to opt for the same behavior as pip
had, to fix of the AA errors and the potential penalty of compilation on
every import.
* Use find to delete files recursively
Instead of using rm -rf use find to delete files recursively. This
has the added benefit that we do not need to rely on shell expansion.
In particular, shell expansion caused the --one-file-system flag to
not work as intended: The idea was that the content of a (left-over)
bind mounted directory would not get deleted. However, since shell
expansion passed the directory to rm, rm happily deleted also files in
that bind mounted directory.
* Pass arguments correctly
* Fix argument order and stderr output
* Improve error handling
Log with exception level if there is an OS level error. Decode the
stderr output correctly.
* Remove unnecessary newline
This reverts commit b1010c3c61.
It seems that the git version deployed with the latest Alpine doesn't
play nice with Supervisor. Specifically it leads to "fatal: cannot exec
'remote-https': Permission denied" errors.
* Using CAS for content-trust
* v2
* Fix linting errors
* Adjust field checked for status in CAS response
* CI workflow needs CAS not VCN now
* Use cwd in test as code won't be in /usr/src
* Pre-cache CAS pub key for supervisor
* Cas doesn't actually need key file executable
Co-authored-by: Mike Degatano <michael.degatano@gmail.com>
* Use the correct interface name to get properties of systemd
It seems that gdbus (or systemd) automatically pick the correct
interface and return the properties. However, dbussy requires the
correct interface name to get all properties.
* Don't expect array from Strength property
The property returns a type "y" which equates to "guchar":
https://developer-old.gnome.org/NetworkManager/stable/gdbus-org.freedesktop.NetworkManager.AccessPoint.html#gdbus-property-org-freedesktop-NetworkManager-AccessPoint.Strength
It seems that the old D-Bus implementation returned an array. With
dbus-next a integer is returned, so no list indexing required.
* Support signals and remove no longer used tests and code
* Pass rauc update file path as string
That is what the interface is expecting, otherwise the new lib chocks on
the Pathlib type.
* Support Network configuration with dbus-next
Assemble Python native objects and pass them to dbus-next. Use dbus-next
specific Variant class where necessary.
* Use org.freedesktop.NetworkManager.Connection.Active.StateChanged
org.freedesktop.NetworkManager.Connection.Active.PropertyChanged is
depricated. Also it seems that StateChanged leads to fewer and more
accurate signals.
* Pass correct data type to RequestScan.
RequestScan expects an option dictionary. Pass an empty option
dictionary to it.
* Update unit tests
Replace gdbus specific fixtures with json files representing the return
values. Those can be easily converted into native Python objects.
* Rename D-Bus utils module gdbus to dbus
Mike DegatanoandGitHub
Robert ReschandGitHub
Franck NijhofandGitHub
Joakim SørensenandGitHub