mkosi: Update to latest

Let's make sure we're testing unprivileged builds properly. Usage
of SourceFileTransfer= and SourceFileTransferFinal= are removed as
they were dropped by mkosi. SourceFileTransfer=mount is now the
default in mkosi so behavior for the build script is unchanged. We
stop copying sources in the final image until mkosi adds support
for virtiofs.

.github/workflows/mkosi.yml

@@ -79,7 +79,7 @@ jobs:
 
     steps:
     - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
-    - uses: systemd/mkosi@500f93a36cc3d5bf1d06848a0a8870bf1424625f
+    - uses: systemd/mkosi@4be912b0fa4931403fddf649aa242cd4406471c4
 
     - name: Configure
       run: |
@@ -87,6 +87,7 @@ jobs:
         [Distribution]
         Distribution=${{ matrix.distro }}
         Release=${{ matrix.release }}
+        SecureBoot=yes
 
         [Content]
         Environment=CI_BUILD=1
@@ -96,13 +97,13 @@ jobs:
         EOF
 
     - name: Generate secure boot key
-      run: sudo mkosi genkey
+      run: mkosi genkey
 
     - name: Build ${{ matrix.distro }}
-      run: sudo mkosi --idmap no --secure-boot
+      run: mkosi
 
     - name: Show ${{ matrix.distro }} image summary
-      run: sudo mkosi summary
+      run: mkosi summary
 
     - name: Boot ${{ matrix.distro }} systemd-nspawn
       run: sudo mkosi boot ${{ env.KERNEL_CMDLINE }} audit=0
@@ -111,7 +112,7 @@ jobs:
       run: sudo mkosi shell bash -c "[[ -e /testok ]] || { cat /failed-services; exit 1; }"
 
     - name: Boot ${{ matrix.distro }} QEMU
-      run: sudo timeout -k 30 10m mkosi qemu
+      run: timeout -k 30 10m mkosi qemu
 
     - name: Check ${{ matrix.distro }} QEMU
       run: sudo mkosi shell bash -c "[[ -e /testok ]] || { cat /failed-services; exit 1; }"

mkosi.build

@@ -175,10 +175,6 @@ fi
 cd "$BUILDDIR"
 ninja "$@"
 if [ "$WITH_TESTS" = 1 ] ; then
-        for id in 1 2 3; do
-                getent group $id >/dev/null || echo "g testgroup$id $id -" | ./systemd-sysusers -
-        done
-
         if [ -n "$SANITIZERS" ]; then
                 export ASAN_OPTIONS="$ASAN_OPTIONS"
                 export UBSAN_OPTIONS="$UBSAN_OPTIONS"

mkosi.conf.d/10-systemd.conf

@@ -11,8 +11,6 @@ OutputDirectory=mkosi.output
 [Content]
 BuildDirectory=mkosi.builddir
 Cache=mkosi.cache
-SourceFileTransfer=mount
-SourceFileTransferFinal=copy-git-others
 Packages=
         acl
         bash-completion

mkosi.prepare

@@ -17,3 +17,11 @@ if [ "$(grep '^ID=' /etc/os-release)" = "ID=\"centos\"" ] && [ "$(grep '^VERSION
     alternatives --install /usr/bin/python3 python3 /usr/bin/python3.9 1
     alternatives --set python3 /usr/bin/python3.9
 fi
+
+# Make sure the necessary test users are available in the build image. We do this here because the build
+# script does not run as root.
+if [ "$1" = "build" ]; then
+    for id in 1 2 3; do
+        getent group $id >/dev/null || echo "g testgroup$id $id -" | systemd-sysusers -
+    done
+fi