sysext: Allow per-sysext USE flags

build_library/extra_sysexts.sh

@@ -3,3 +3,19 @@ EXTRA_SYSEXTS=(
   podman:app-containers/podman,net-misc/passt
   python:dev-lang/python,dev-python/pip
 )
+
+_get_unversioned_sysext_packages_unsorted() {
+  for sysext in "${EXTRA_SYSEXTS[@]}"; do
+    IFS=":" read -r _ PACKAGE_ATOMS _ <<< "$sysext"
+
+    IFS=,
+    for atom in $PACKAGE_ATOMS; do
+       qatom "$atom" -F "%{CATEGORY}/%{PN}"
+    done
+    unset IFS
+  done
+}
+
+get_unversioned_sysext_packages() {
+  _get_unversioned_sysext_packages_unsorted | sort | uniq
+}

build_library/prod_image_util.sh

@@ -213,9 +213,16 @@ create_prod_sysexts() {
   local image_name="$1"
   local image_sysext_base="${image_name%.bin}_sysext.squashfs"
   for sysext in "${EXTRA_SYSEXTS[@]}"; do
-    local name="flatcar-${sysext%:*}"
-    local pkgs="${sysext#*:}"
+    local name="flatcar-${sysext%%:*}"
+    local pkgs_and_useflags="${sysext#*:}"
+    local pkgs="${pkgs_and_useflags%%:*}"
     local pkg_array=(${pkgs//,/ })
+    local useflags=""
+    if [[ "$pkgs_and_useflags" == *:* ]]; then
+      useflags="${pkgs_and_useflags#*:}"
+    fi
+    local useflags_array=(${useflags//,/ })
+
     local mangle_script="${BUILD_LIBRARY_DIR}/sysext_mangle_${name}"
     if [[ ! -x "${mangle_script}" ]]; then
       mangle_script=
@@ -223,8 +230,9 @@ create_prod_sysexts() {
     sudo rm -f "${BUILD_DIR}/${name}.raw" \
 	"${BUILD_DIR}/flatcar-test-update-${name}.gz" \
 	"${BUILD_DIR}/${name}_*"
-    sudo "${SCRIPT_ROOT}/build_sysext" --board="${BOARD}" \
-        --squashfs_base="${BUILD_DIR}/${image_sysext_base}" \
+    # we use -E to pass the USE flags, but also MODULES_SIGN variables
+    USE="${useflags_array[*]}" sudo -E "${SCRIPT_ROOT}/build_sysext" --board="${BOARD}" \
+	--squashfs_base="${BUILD_DIR}/${image_sysext_base}" \
 	--image_builddir="${BUILD_DIR}" \
 	${mangle_script:+--manglefs_script=${mangle_script}} \
 	"${name}" "${pkg_array[@]}"

build_packages

@@ -117,6 +117,7 @@ fi
 . "${BUILD_LIBRARY_DIR}/toolchain_util.sh" || exit 1
 . "${BUILD_LIBRARY_DIR}/board_options.sh" || exit 1
 . "${BUILD_LIBRARY_DIR}/test_image_content.sh" || exit 1
+. "${BUILD_LIBRARY_DIR}/extra_sysexts.sh" || exit 1
 
 # Setup all the emerge command/flags.
 EMERGE_FLAGS=( --update --deep --newuse --verbose --backtrack=30 --select )
@@ -285,6 +286,34 @@ export KBUILD_BUILD_HOST="${BUILD_HOST:-pony-truck.infra.kinvolk.io}"
 info "Merging board packages now"
 sudo -E "${EMERGE_CMD[@]}" "${EMERGE_FLAGS[@]}" "$@"
 
+info "Merging sysext packages now"
+for sysext in "${EXTRA_SYSEXTS[@]}"; do
+  IFS=":" read SYSEXT_NAME PACKAGE_ATOMS USEFLAGS < <(echo "$sysext");
+
+  info "Building packages for $SYSEXT_NAME sysext with USE=$USEFLAGS"
+  IFS=,
+  for package in $PACKAGE_ATOMS; do
+     # --buildpkgonly does not install dependencies, so we install them
+     # separately before building the binary package
+     sudo --preserve-env=MODULES_SIGN_KEY,MODULES_SIGN_CERT \
+       env USE="$USEFLAGS" FEATURES="-ebuild-locks binpkg-multi-instance" "${EMERGE_CMD[@]}" \
+       "${EMERGE_FLAGS[@]}" \
+       --quiet \
+       --onlydeps \
+       --binpkg-respect-use=y \
+       "${package}"
+
+     sudo --preserve-env=MODULES_SIGN_KEY,MODULES_SIGN_CERT \
+       env USE="$USEFLAGS" FEATURES="-ebuild-locks binpkg-multi-instance" "${EMERGE_CMD[@]}" \
+       "${EMERGE_FLAGS[@]}" \
+       --quiet \
+       --buildpkgonly \
+       --binpkg-respect-use=y \
+       "${package}"
+  done
+  unset IFS
+done
+
 info "Removing obsolete packages"
 # The return value of emerge is not clearly reliable. It may fail with
 # an output like following:
@@ -319,7 +348,16 @@ if [[ "${FLAGS_usepkgonly}" -eq "${FLAGS_FALSE}" ]]; then
   fi
 fi
 
-eclean-$BOARD -d packages
+exclusions_file=$(mktemp)
+if [ ! -f "$exclusions_file" ]; then
+    die_notrace "Couldn't create temporary exclusions file $exclusions_file for eclean"
+fi
+get_unversioned_sysext_packages > "$exclusions_file"
+eclean-"$BOARD" -d --exclude-file="$exclusions_file" packages
+rm -f "$exclusions_file"
+# run eclean again, this time without the --deep option, to clean old versions
+# of sysext packages (those, for which .ebuild file no  longer exists)
+eclean-"$BOARD" packages
 
 info "Checking build root"
 test_image_content "${BOARD_ROOT}"

build_sysext

@@ -221,11 +221,12 @@ info "Building '${SYSEXTNAME}' squashfs with (meta-)packages '${@}' in '${BUILD_
 
 for package; do
   echo "Installing package into sysext image: $package"
-  FEATURES="-ebuild-locks" emerge \
+  FEATURES="-ebuild-locks binpkg-multi-instance" emerge \
     --root="${BUILD_DIR}/install-root" \
     --config-root="/build/${FLAGS_board}"  \
     --sysroot="/build/${FLAGS_board}"  \
     --usepkgonly \
+    --binpkg-respect-use=y \
     --getbinpkg \
     --verbose \
     --jobs=${NUM_JOBS} \