fix: Non-subscribers are only able to build rolling releases

[onedr0p]

Change Summary

Hi 👋🏼

Currently LTS releases (from the 1.4.0-epa1 tag) are not able to be built by Non-subscribers.

To be honest I'm not sure on the exact wording your team would be comfortable with here but it should be updated to avoid any confusion

These parts of the docs can be updated again if reproducible builds ever become a thing.

Related Task(s)

• T5868
• T6064

There is a forum thread on this issue, please read thru it to get an idea of the confusion
https://forum.vyos.io/t/build-issue-for-1-4-0-epa/13943

There are also other forum topics around this issue brought up in the past

• https://forum.vyos.io/t/erroring-when-building-1-3-1/8928
• https://forum.vyos.io/t/clean-vyos-1-2-6-build-fails-due-to-extra-argument-4-19-176-amd64-vyos-on-root-17-gen-initramfs-chroot/6660

Related PR(s)

Backport

Checklist:

• I have read the CONTRIBUTING document

[dmbaturin]

VyOS 1.4/Sagitta's latest commit is the latest LTS branch — it's just that there's not 1.4.0 tag yet.

Non-subscribers will not be able to build past point releases, that's true. For example, a non-subscriber cannot easily build 1.3.3 now, but they can build from the Equuleus branch and get what is now upcoming 1.3.7.
They can build the latest LTS branch, though. The docs should reflect that.

[onedr0p]

... it's just that there's not 1.4.0 tag yet.

This is not true, there is a tag for the release here and here which are now both behind https://github.com/vyos/vyos-1x/tree/sagitta

Non-subscribers will not be able to build past point releases, that's true. For example, a non-subscriber cannot easily build 1.3.3 now, but they can build from the Equuleus branch and get what is now upcoming 1.3.7.

Please read the forum thread here because that is also not true, when 1.4.0-epa1 was the latest release it could not be built as described in the forum thread. To re-iterate what was brought up in that forum thread, if you are building from the sagitta branch and not the tag you are NOT building the LTS release, you are building the rolling release.

They can build the latest LTS branch, though. The docs should reflect that.

Building from the LTS branch is building the rolling release. The docs should be updated to stamp out any of this confusion.

---

If anything the wording could be something like this:

Non-Subscribers will have a small window of opportunity to build the latest LTS release from source when the LTS tags are created, otherwise they will only be able to build rolling releases from source.

[dmbaturin]

Sagitta is the 1.4 LTS branch. You can build from that branch. You are guaranteed to never get any config or behavior breaking changes in your build as per the LTS maintenance policy.

You cannot reproduce builds of older tagged releases as a non-subscriber. That's all.

[p3lim]

The sagitta branch contains changes that differ from your own LTS releases, as of right now there are 39 commits that differ, some of them could include new/updated packages. Since those packages were updated the previous version(s) of them are no longer in your repos, and thus we cannot build an image that matches your own LTS releases. The thread linked at the top goes into detail on this topic.

I just tried to build a LTS release ISO to match your 1.4.0-epa2 release and am unable to because packages used to build this tag are missing in the repo. The fact that your repo is named "rolling-packages.vyos.net/sagitta" kinda gives away why this is an issue.

You are guaranteed to never get any config or behavior breaking changes in your build as per the LTS maintenance policy.

T6133 which is not in the 1.4.0-epa2 release but is part of the rolling sagitta branch is an example of a change that introduces behavior changes (although not a big deal). One would assume, going by your statement, that the sagitta branch == latest tag you've released, and end up with differences in behavior, or differences in versions (typically the kernel or modules).

A simple solution to this is to not automatically prune packages that are still used by the latest LTS tag.

[dmbaturin]

Meta: why non of you asks Debian for an easy way to reproduce 12.1 now that 12.5 is the latest Bookworm?

[onedr0p]

Meta: why non of you asks Debian for an easy way to reproduce 12.1 now that 12.5 is the latest Bookworm?

That's a silly question but I'll give you a real answer... because Debian publishes their LTS releases for everyone to download and install for free and I don't have to jump thru these hoops to build it just to run it on my home infrastructure.

I'm just trying to build and install what your team says should be possible, a "LTS release", not a "rolling 'LTS' release". If this is not possible, the docs need to be updated so people aren't confused which is why this PR exists in the first place.

[p3lim]

I'm also not trying to build 1.4.0-epa1 or 1.4.0-rc3, I'm trying to build the latest tag. This is a direct comparison to us trying to build 12.5 (which is entirely possible), and you've failed to understand this entire issue.

[onedr0p]

I have just committed a change to the sentence. I hope this wording can bring less confusion.

[RSully]

I'm also not trying to build 1.4.0-epa1 or 1.4.0-rc3, I'm trying to build the latest tag. This is a direct comparison to us trying to build 12.5 (which is entirely possible), and you've failed to understand this entire issue.

100% agreed here. It would be one thing if I could still build 1.4.0-epa2 right now, but my understanding is I can only build what is going to be part of the next release. And until all of those changes are in, it's a state of limbo where what I'm building is not epa2 or epa3, but a rolling release. Same with 1.3.x, I cannot build 1.3.6, but I can build 1.3.6 with a few extra changes which is probably going to be 1.3.7, but might not be

Edit: or just give us a chance to pay a small amount for LTS images again :D (or both!)

[andamasov]

once we remove the prebuilt packages repository, these changes will be obsolete, so there is no reason to merge them
@dmbaturin, maybe we should add in vyos-build README that self-made builds from the LTS branch are not binary identical to official LTS release images

[p3lim]

once we remove the prebuilt packages repository, these changes will be obsolete

@andamasov Can you clarify what you mean by this? Are you removing the rolling-packages.vyos.net/sagitta repository?

[Ralms]

(...) self-made builds from the LTS branch are not binary identical to official LTS release images

I feel this can be considered false advertising then, when blog updates and emails say thing such as:
We are happy to announce that the VyOS 1.4.0-epa1 image is now available to customers and contributors (and everyone can build it, of course)!.

When now we are getting the realization that no, not everyone can build it.

I completely accept that people that don't contribute or pay for anything need to spend some time building the images, but VyOS team is getting every time more toxic with little games like this, which feel completely unnecessary.

[dmbaturin]

This all is devolving into complaints that getting LTS releases is not as easy as they wish it was. We will make updates to the READMEs and the docs about LTS repository access when we are done with more immediate issues.

To everyone who's concerned: the repositories of the rolling release will remain public and rolling releases will be as trivial to build as before.

[p3lim]

For what it's worth, it was never about how hard or easy it was to build LTS images, it was about the misinformation around them being possible to be built at all after any changes to the rolling repositories after a release was made. Creating or using a rolling release is fine for most, if not all hobbyists using this project.

[hanisirfan]

I'm trying to build 1.4 ISO using these steps:

$ docker pull vyos/vyos-build:sagitta

$ mkdir vyos_build/1.4.0 -p
$ cd vyos_build/1.4.0

$ git clone -b sagitta --single-branch https://github.com/vyos/vyos-build

$ git clone -b sagitta --single-branch https://github.com/vyos/vyos-1x

$ alias vybld_sagitta='docker pull vyos/vyos-build:sagitta && docker run --rm -it \
    -v "$(pwd)":/vyos \
    -v "$HOME/.gitconfig":/etc/gitconfig \
    -v "$HOME/.bash_aliases":/home/vyos_bld/.bash_aliases \
    -v "$HOME/.bashrc":/home/vyos_bld/.bashrc \
    -w /vyos --privileged --sysctl net.ipv6.conf.lo.disable_ipv6=0 \
    -e GOSU_UID=$(id -u) -e GOSU_GID=$(id -g) \
    vyos/vyos-build:sagitta bash'

$ vybld_sagitta

$ cd vyos-1x
$ dpkg-buildpackage -uc -us -tc -b
$ mv ../*.deb ../vyos-build/packages/

$ cd ../vyos-build

$ sudo make clean
$ sudo ./build-vyos-image iso --architecture amd64 --build-by "[email protected]"
$ sudo ./build-vyos-image --architecture amd64 --build-by "[email protected]" --vyos-mirror https://rolling-packages.vyos.net/sagitta/ --debian-mirror http://deb.debian.org/debian/ --build-type release --version "1337-2023" iso

I got this error:

Reading package lists... Done
E: The repository 'https://rolling-packages.vyos.net/sagitta sagitta Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
N: Repository 'Debian bookworm' changed its 'non-free component' value from 'non-free' to 'non-free non-free-firmware'
N: More information about this can be found online in the Release notes at: https://www.debian.org/releases/bookworm/amd64/release-notes/ch-information.html#non-free-split
E: An unexpected failure occurred, exiting...

Is https://rolling-packages.vyos.net/sagitta/ not available?