Problem

Building EVE-OS (and similar multi-package Linuxkit projects) requires that:

1. A source-code change to a leaf package (e.g. pkg/zfs) propagates a new hash to all downstream consumers (pkg/pillar, pkg/dom0-ztools, etc.) so Docker cache tags change and images are rebuilt.
2. Make can drive individual package builds as file targets — skipping the actual Docker build when nothing changed — rather than always running linuxkit pkg build.
3. The contentHash (dirty-tree computation) must not be pathologically slow on repos with large untracked directories (e.g. linux-firmware, build artefacts).
4. Versioned packages that have no build.yml (only build-2.4.yml, build-2.3.yml, …) must work without a symlink.

Issues: #4180, related to #4195.

Solution (4 commits)

1. pkglib: scope contentHash to package directory

contentHash previously ran git ls-files on the entire repo. Scope it to pkg/<name>/ so it only hashes files relevant to the package being tagged.

2. pkglib: add --hash-dir flag; write YAML build manifests from show-tag

Add a --hash-dir <path> persistent flag shared by show-tag and build.

Write side (show-tag --hash-dir): after computing a tag, write a YAML manifest to <hash-dir>/<pkgname>.hash with write-if-changed semantics (mtime only updates when the tag actually changes, so downstream make targets are not spuriously re-triggered):

tag: lfedge/eve-zfs:cbda1fe2...-2.4
build-yml: build-2.4.yml
deps:
  - path: pkg/alpine
    tag: lfedge/eve-alpine:abc123...

Read side (pkg build --hash-dir): @lkt:pkg: and @lkt:pkgs: references are resolved from the stored hash files rather than by recursive NewFromConfig calls. This eliminates dependency cycles and correctly propagates version-specific build variants (e.g. ZFS_VERSION selecting build-2.4.yml) through downstream combined hashes.

pkg build auto-detects build-yml: when --hash-dir is set and --build-yml was not given, build reads the effective build-yml from the package's hash file. No per-package --build-yml flag needed in the calling Makefile.

3. pkglib: filter @lkt:pkgs: wildcard to Dockerfile-declared ARGs; relax build.yml requirement

When resolving @lkt:pkgs:../* wildcards, parse the anchor package's Dockerfile to collect declared ARG names and skip any glob-matched package whose computed key is not declared. This eliminates oscillating hashes caused by packages referencing themselves or unrelated neighbours.

Also: return "" (lenient) instead of erroring when a versioned package has no default build.yml — makes ZFS-style packages first-class citizens.

4. pkg: add update-hashes subcommand

New subcommand: linuxkit pkg update-hashes --hash-dir <dir> [path[:build-yml]]...

• Accepts explicit build-yml per package (pkg/zfs:build-2.4.yml) for versioned packages.
• Builds a dependency graph from @lkt:pkgs: build args, topologically sorts it (Kahn's algorithm), and calls show-tag --hash-dir in dependency order so each package's hash file is ready before its consumers are processed.
• --strict-deps: error if a dep is missing from the provided list.

This is the entry-point that a Makefile calls once per invocation to refresh all hash files before per-package linuxkit pkg build calls.

Usage (EVE Makefile pattern)

# Stage 1 — always run; fast (hash computation only)
update-hashes: $(LINUXKIT)
    $(LINUXKIT) pkg update-hashes --hash-dir .gen-deps \
        $(foreach p,$(PKGS),$p:$(call get_pkg_build_yml,$(notdir $p)))

# Stage 2 — PHONY; linuxkit checks docker cache, skips actual build if cached
.PHONY: eve-%
eve-%: update-hashes | $(LINUXKIT)
    $(LINUXKIT) pkg build --hash-dir .gen-deps pkg/$*

Testing

• pkg/zfs source change → show-tag pkg/zfs new hash → update-hashes propagates new hash to pkg/pillar, pkg/dom0-ztools, pkg/vtpm.
• ZFS_VERSION=2.4 update-hashes → pkg/zfs gets build-2.4.yml recorded in hash file → pkg build --hash-dir picks it up automatically.
• No hang/infinite recursion with circular @lkt:pkgs:../* patterns.
• contentHash completes in normal time on repos with large untracked trees.

🤖 Generated with Claude Code