Parts that organize to the overlay should not accept `overlay-script` or `override-overlay`
Metadata
Current evaluation
craft-parts accepts overlay-script/override-overlay on parts whose organize targets (overlay), silently doing the wrong thing. Triaged by lengau, assigned to randyli, and targeted by open PR #1747 adding PartSpec validation plus tests/docs.
Suggested action: keep open
Reason: lengau filed this as a real gap ("Those parts should error if we have either of those with an explanation of what to do instead"), randyli proposed reusing the existing organizes_to_overlay check in PartSpec, and lengau confirmed with "I've assigned this to you"; the check does not yet exist in craft_parts/parts.py, which only validates overlay-script against plugins that use the overlay (_check_overlay_script_plugin_conflict). PR #1747 is still open with one unresolved comment, so the fix is not yet merged and the issue should stay open. Impact is moderate (misuse yields silent/incorrect behavior rather than a data-loss crash), while the change is small and well-scoped to existing validation helpers.
Evaluated by: mr-cal-bot
Impact:
45
Quick Win:
27
Complexity:
30
Confidence:
88
Actionability:
85
Issue body
### Bug Description
When pre-building an overlay root, we don't want to put things into the overlay. Those parts should error if we have either of those with an explanation of what to do instead.
### To Reproduce
Run imagecraft with an `overlay-script` in the rootfs part
### part yaml
```shell
name: ec2
title: EC2 Minimized
summary: Bootable EC2 minimized image for amd64
description: |
Bootable EC2 Minimized disk image for amd64.
The root filesystem is bootstrapped with mmdebstrap and the disk uses
a GPT partition layout.
version: '0.1'
base: bare
build-base: devel
platforms:
amd64:
volumes:
pc:
schema: gpt
structure:
- name: rootfs
type: 0FC63DAF-8483-4772-8E79-3D69D8477DE4
filesystem: ext4
role: system-data
filesystem-label: cloudimg-rootfs
size: 7G
id: f9dd4dd2-a3a9-5090-8356-4be3d674fe74
number: 1
- name: boot
type: BC13C2FF-59E6-4262-A352-B275FD6F7172
filesystem: ext4
role: system-boot
filesystem-label: BOOT
size: 913M
id: 8ebef2f2-e171-54bb-90b8-572059b94c35
number: 13
- name: bios-boot
type: 21686148-6449-6E6F-744E-656564454649
filesystem: vfat
role: system-boot
size: 4M
number: 14
- name: efi
type: C12A7328-F81F-11D2-BA4B-00A0C93EC93B
filesystem: vfat
role: system-boot
filesystem-label: UEFI
size: 106M
id: a2406914-032c-5027-ac8c-07569970143e
number: 15
filesystems:
default:
- device: (volume/pc/rootfs)
mount: /
- device: (volume/pc/boot)
mount: /boot
- device: (volume/pc/efi)
mount: /boot/efi
parts:
rootfs:
plugin: nil
build-packages:
- mmdebstrap
after: []
overlay-script: |
mmdebstrap \
--arch="$CRAFT_ARCH_BUILD_FOR" \
--mode=sudo \
--format=dir \
--variant=minbase \
--include=apt \
--aptopt='APT::Install-Recommends "false";' \
--aptopt='APT::Architecture-Variants "amd64v3";' \
--dpkgopt='path-exclude=/usr/share/man/*' \
--dpkgopt='path-exclude=/usr/share/locale/*' \
--dpkgopt='path-include=/usr/share/locale/locale.alias' \
--dpkgopt='path-exclude=/usr/share/doc/*' \
--dpkgopt='path-include=/usr/share/doc/*/copyright' \
--dpkgopt='path-include=/usr/share/doc/*/changelog.*' \
stonking \
"$CRAFT_OVERLAY/" \
http://archive.ubuntu.com/ubuntu/
mkdir -p "$CRAFT_OVERLAY/etc/dpkg/dpkg.cfg.d"
cat > "$CRAFT_OVERLAY/etc/dpkg/dpkg.cfg.d/excludes" << 'EOF'
# Suppress man pages, locale data, and most docs.
path-exclude /usr/share/man/*
path-exclude /usr/share/locale/*
path-include /usr/share/locale/locale.alias
path-exclude /usr/share/doc/*
path-include /usr/share/doc/*/copyright
path-include /usr/share/doc/*/changelog.*
EOF
mkdir -p "$CRAFT_OVERLAY/etc/apt/apt.conf.d"
printf 'APT::Architecture-Variants "amd64v3";\n' > "$CRAFT_OVERLAY/etc/apt/apt.conf.d/99architecture-variants"
rm -f "$CRAFT_OVERLAY/etc/apt/apt.conf.d/99mmdebstrap"
rm -f "$CRAFT_OVERLAY/etc/dpkg/dpkg.cfg.d/99mmdebstrap"
# Enable APT recommends in the image so the later install phase pulls in
# recommended packages (e.g. curl -> bash-completion). The bootstrap above may
# have left a recommends-off setting in the chroot; this overrides it. The seed
# install line still suppresses recommends explicitly for minimized, which takes
# precedence on that one command.
mkdir -p "$CRAFT_OVERLAY/etc/apt/apt.conf.d"
printf 'APT::Install-Recommends "true";\n' > "$CRAFT_OVERLAY/etc/apt/apt.conf.d/00recommends"
# Keep the bootstrap archive configured until all packages have been
# installed into the overlay.
cat > "$CRAFT_OVERLAY/etc/apt/sources.list" << 'EOF'
# Ubuntu sources have moved to /etc/apt/sources.list.d/ubuntu.sources.
EOF
mkdir -p "$CRAFT_OVERLAY/etc/apt/sources.list.d"
cat > "$CRAFT_OVERLAY/etc/apt/sources.list.d/ubuntu.sources" << 'EOF'
Types: deb
URIs: http://archive.ubuntu.com/ubuntu/
Suites: stonking stonking-updates stonking-backports
Components: main restricted universe multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
Types: deb
URIs: http://archive.ubuntu.com/ubuntu/
Suites: stonking-security
Components: main restricted universe multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
EOF
mkdir -p "$CRAFT_OVERLAY/boot/efi"
chroot "$CRAFT_OVERLAY" apt-get update
organize:
'*': (overlay)/
packages:
plugin: nil
after:
- rootfs
overlay-packages:
- sl
fstab:
plugin: nil
after:
- packages
overlay-script: |
# Use PARTUUID instead of LABEL to detect the right device
cat << EOF > $CRAFT_OVERLAY/etc/fstab
PARTUUID=f9dd4dd2-a3a9-5090-8356-4be3d674fe74 / ext4 defaults 0 1
PARTUUID=a2406914-032c-5027-ac8c-07569970143e /boot/efi vfat umask=0077 0 1
PARTUUID=8ebef2f2-e171-54bb-90b8-572059b94c35 /boot ext4 defaults 0 2
EOF
```
### Relevant log output
```shell
.
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
45
Quick Win:
27
Complexity:
30
Confidence:
88
Actionability:
85
|
keep open | craft-parts accepts overlay-script/override-overlay on parts whose organize targets (overlay), silently doing the wrong thing. Triaged by lengau, assigned to randyli, and targeted by open PR #1747 adding PartSpec validation plus tests/docs. | |
| stealth/space-bunny-alpha |
Impact:
44
Quick Win:
30
Complexity:
28
Confidence:
97
Actionability:
94
|
keep open | Validation for overlay-script/override-overlay on parts organizing to (overlay) is assigned and targeted by open PR #1747, with tests and documentation. | |
| qwen/qwen3.6-35b-a3b |
Impact:
40
Quick Win:
24
Complexity:
25
Confidence:
75
Actionability:
80
|
needs triage | Request to add validation preventing overlay-script and override-overlay on parts that organize to overlay. |
Update history
| Date | Change |
|---|---|
| updated | |
| updated | |
| created |
Related work
-
Likely Fixed By:
craft-parts#1747
(confidence 92%)
Open PR titled 'fix: reject overlay scripts in parts organizing to overlay' explicitly states it fixes #1735 and adds part validation, 17 regression tests, changelog and docs.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1747 fix: reject overlay scripts in parts organizing to overlay | craft-parts | open | Adds validation rejecting overlay lifecycle scripts when output organizes to (overlay), with guidance, 17 regression cases, and changelog/docs; open with no failing CI but one unresolved review comment. | |
| #1611 Extra part triggering stage step before overlay step | craft-parts | closed | Fixed in canonical/craft-parts#1618 (18239b07): overlay-organized parts now build and organize before dependency staging, preventing fstab content from being missed. | |
| #1226 Organize content into the overlay | craft-parts | closed | Parts can organize content into the mounted overlay via merged PR #1254 (commit 0c806f20), shipped in craft-parts 2.22.0. | |
| #1487 Multiple parts cannot organize to the same directory in the overlay | craft-parts | closed | Fixed by merged PR canonical/craft-parts#1586 (commit 0797420f), allowing wildcard-organized overlay directories from multiple parts to merge despite metadata differences. | |
| #1228 Reorder parts to prioritize organize to overlay | craft-parts | closed | Prioritized parts that organize overlays so installing overlay-package parts can use the prepared base; merged in canonical/craft-parts#1261 (55d01a3f). |