[WIP] Compatibility layer for EESSI version 2026.x

ansible/playbooks/roles/compatibility_layer/defaults/main.yml

@@ -1,49 +1,53 @@
 # Defaults file for the compatibility layer role.
 ---
-eessi_version: "2025.06"
+eessi_version: "2026.06"
+eessi_host_os: "linux"
+eessi_host_arch: "x86_64"
 
 custom_overlays:
-  - name: eessi
-    source: git
-    url: https://github.com/EESSI/gentoo-overlay.git
-    eclass-overrides: true
+    - name: eessi
+      source: git
+      url: https://github.com/EESSI/gentoo-overlay.git
+      eclass-overrides: true
 
 cvmfs_repository: software.eessi.io
 
 gentoo_prefix_path: /cvmfs/{{ cvmfs_repository }}/versions/{{ eessi_version }}/compat/{{ eessi_host_os }}/{{ eessi_host_arch }}
 
+compat_defaults_dir: /cvmfs/{{ cvmfs_repository }}/defaults/compat
+
 # How to build the prefix.
 gentoo_git_repo: https://github.com/gentoo/gentoo.git
-# Select a specific commit in the gentoo_git_repo that should be used for the bootstrap,
-# e.g. by checking: https://github.com/gentoo/gentoo/commits/master
-# June 7 2025 (083e38cef302128d595e9f9cfd029ad8f67ec2b7) commit that includes Lmod 8.7.60 and glibc 2.41
-gentoo_git_commit: 083e38cef302128d595e9f9cfd029ad8f67ec2b7
+gentoo_git_branch: master
 prefix_required_space: 15 GB
-prefix_user_defined_trusted_dirs:
-  - "/cvmfs/{{ cvmfs_repository }}/versions/{{ eessi_version }}/compat/{{ eessi_host_os }}/{{ eessi_host_arch }}/lib/override"
-  - "/cvmfs/{{ cvmfs_repository }}/versions/{{ eessi_version }}/compat/{{ eessi_host_os }}/{{ eessi_host_arch }}/lib/nvidia"
-  - "/cvmfs/{{ cvmfs_repository }}/versions/{{ eessi_version }}/compat/{{ eessi_host_os }}/{{ eessi_host_arch }}/lib/amd"
-prefix_mask_packages: |
-  # stick to GCC 13.x; using a too recent compiler in the compat layer may complicate stuff in the software layer,
-  # see for example https://github.com/EESSI/software-layer/issues/151
-  >=sys-devel/gcc-14
-prefix_unmask_packages: |
-  # if necessary, unmask for instance an older GCC to make it installable
-prefix_bootstrap_use_flags: |
-  # only build libnss, don't build the daemon (use the one from the host)
-  sys-auth/nss-pam-ldapd -nslcd
-  # don't build the SSSD daemon (and man pages) either
-  sys-auth/sssd -daemon -man
-  # only install Python 3.13
-  */* PYTHON_TARGETS: -* python3_13
-  */* PYTHON_SINGLE_TARGET: -* python3_13
-  # Modules: disable installation of man pages and shell setup files to be able
-  # to also install Lmod. enable *conflict unload* and *require via* features.
-  sys-cluster/modules -shell-setup -man-install +new-features
+prefix_user_defined_trusted_dirs: []
+prefix_accept_keywords:
+prefix_make_conf_files:
+    0001_use_rpath.conf: |
+        LDFLAGS="${LDFLAGS} -Wl,-rpath,${EPREFIX}/usr/lib64:${EPREFIX}/usr/lib -Wl,--disable-new-dtags"
+prefix_package_env_files:
+    package.env: |
+        dev-util/direnv test.conf
+        sys-apps/archspec test.conf
+        sys-cluster/lmod test.conf
+        sys-cluster/reframe test.conf
+    env/test.conf: |
+        FEATURES="test"
+    env/sys-libs/glibc: |
+        # Don't use RPATH for glibc itself
+        LDFLAGS="$(echo \"${LDFLAGS}\" | sed 's|-Wl,-rpath,[^ ]*||g' | sed 's|-Wl,--disable-new-dtags||g')"
+
+prefix_profile_package_use_mask:
+    # unmask the pam USE flag for nss-pam-ldapd and sssd
+    sys-auth/nss-pam-ldapd -pam
+    sys-auth/sssd -pam
+prefix_mask_packages:
+prefix_unmask_packages:
+prefix_bootstrap_use_flags:
 prefix_use_builtin_bootstrap: false
 prefix_custom_bootstrap_script:
-  local: "{{ playbook_dir }}/../../bootstrap-prefix.sh"
-  remote: /tmp/bootstrap-prefix.sh
+    local: "{{ playbook_dir }}/../../bootstrap-prefix.sh"
+    remote: /tmp/bootstrap-prefix.sh
 prefix_source_options: "{{ gentoo_prefix_path }} noninteractive"
 prefix_install: >-
     {{ prefix_use_builtin_bootstrap | ternary('/usr/local/bin/bootstrap-prefix.sh', prefix_custom_bootstrap_script.remote) }}
@@ -60,69 +64,17 @@
 emerge_log: "{{ gentoo_prefix_path }}/var/log/emerge.log"
 
 prefix_locales:
-  - en_US.UTF-8 UTF-8
+    - en_US.UTF-8 UTF-8
 
 # By default, we install an architecture-specific set
 package_sets:
-  - "eessi-{{ eessi_version }}-{{ eessi_host_os }}-{{ eessi_host_arch }}"
-
-prefix_packages:
+    - "eessi-{{ eessi_version }}-{{ eessi_host_os }}-{{ eessi_host_arch }}"
 
-prefix_remove_packages:
-  - app-eselect/eselect-rust
-  - dev-lang/go
-  - dev-lang/go-bootstrap
-  - dev-lang/rust
-  - dev-lang/rust-bin
-  - dev-python/setuptools-rust
-  - dev-util/cmake
-  - dev-util/hermes
-  - dev-util/ninja
-  - virtual/rust
+prefix_packages: []
+prefix_remove_packages: []
 
 reframe_venv_dir: /tmp/reframe_venv
 
 # List of locations that should get a symlink $EPREFIX/$LOCATION -> $LOCATION.
 # This ensures that things like user/group ids are correct/looked up in the right way in the Prefix environment.
-symlinks_to_host:
-  # required to ensure local user groups are known
-  - /etc/group
-
-  # required to ensure local users are known (see https://github.com/EESSI/compatibility-layer/issues/15)
-  - /etc/passwd
-
-  # required to ensure that hosts specified in the host's hosts file can be resolved by tools in the Prefix
-  - /etc/hosts
-
-  # required to ensure name-service information is taken from the right source (e.g. ldap)
-  # - /etc/nsswitch.conf
-
-  # required to use the DNS resolver from the host (should be done automatically)
-  - /etc/resolv.conf
-
-  # required to pick up the right timezone from the host
-  - /etc/localtime
-
-  # required if Centrify is used in nsswitch.conf
-  - /lib64/libnss_centrifydc.so.2
-
-  # required if LDAP is used in nsswitch.conf
-  # - /lib64/libnss_ldap.so.2
-
-  # required if SSSD is used in nsswitch.conf
-  # - /lib64/libnss_sss.so.2
-
-  # required to make runtime data available for lots of tools (including who and w)
-  # - /var/run
-
-  # required by the last command
-  # - /var/log/wtmp
-
-#  - /var/lib/munge
-#  - /var/lib/unbound
-#  - /var/lib/VirtualGL
-#  - /var/log/munge
-#  - /var/spool
-#  - /var/tmp
-#  - /run/dbus
-#  - /tmp
+symlinks_to_host: []

ansible/playbooks/roles/compatibility_layer/tasks/add_overlay.yml

@@ -29,25 +29,21 @@
         selectattr('eclass-overrides', 'equalto', True) | map(attribute='name') | join(' ')
       }}
 
+- name: "Import the task for checking out the specific commit of git-based overlays"
+  ansible.builtin.include_tasks: sync_git_overlay.yml
+  vars:
+    gitrepo: "{{ item }}"
+  # also include the Gentoo git repo here in case we want to switch to a different commit
+  loop: >-
+    {{
+      custom_overlays | selectattr('source', 'equalto', 'git') +
+      [{'name': 'gentoo', 'url': gentoo_git_repo, 'branch': gentoo_git_branch, 'commit': gentoo_git_commit}]
+    }}
+
 # We do an explicit sync here (instead of using a handler),
-# so we can be sure that the overlays are up-to-date.
-- name: Sync the overlays to make sure that they are up to date
+# so we can be sure that non-git overlays are also up-to-date.
+- name: Sync overlays with auto-sync enabled to make sure that they are up to date
   community.general.portage:
     sync: 'yes'
     verbose: true
-
-- name: Find all files and directories in the etc/portage directory of the overlay
-  ansible.builtin.find:
-    file_type: any
-    paths: "{{ gentoo_prefix_path }}/var/db/repos/{{ item.name }}/etc/portage"
-  loop: "{{ custom_overlays }}"
-  register: find_configs
-
-- name: Make symlinks to the portage settings in the custom overlay
-  ansible.builtin.file:
-    src: "{{ item.path }}"
-    dest: "{{ gentoo_prefix_path }}/etc/portage/{{ item.path | basename }}"
-    state: link
-    force: true
-  with_items:
-    "{{ find_configs.results | rejectattr('files', 'equalto', []) | map(attribute='files') | list }}"
+...

ansible/playbooks/roles/compatibility_layer/tasks/create_host_symlinks.yml

@@ -1,16 +1,16 @@
-# Replace a list of files/directories in Gentoo Prefix installation by symlinks to corresponding files/directories
+# Replace a list of files/directories in Gentoo Prefix installation by (variant) symlinks to corresponding files/directories
 # on the host in order to solve some common issues.
 ---
 
 - name: Check type of original files/directories
   ansible.builtin.stat:
-    path: "{{ gentoo_prefix_path }}{{ item }}"
+    path: "{{ item.dest if item is mapping else gentoo_prefix_path + item }}"
   with_items: "{{ symlinks_to_host }}"
   register: orig_types
 
 - name: Remove original files/directories
   ansible.builtin.file:
-    path: "{{ gentoo_prefix_path }}{{ item.item }}"
+    path: "{{ item.item.dest if item is mapping else gentoo_prefix_path + item.item }}"
     state: absent
   with_items: "{{ orig_types.results }}"
   when:
@@ -19,8 +19,18 @@
 
 - name: Make symlinks
   ansible.builtin.file:
-    src: "{{ item }}"
-    dest: "{{ gentoo_prefix_path }}{{ item }}"
+    # Variant symlink destinations look like: $(EESSI_202606_COMPAT_ETC_HOSTS:-/cvmfs/software.eessi.io/defaults/compat/etc/hosts)
+    # So, if we don't want to use variant symlinks, we use the default source by using the part after :- without the ) at the end
+    # and we also cut off the path to the defaults directory to get a working symlink, i.e. for the example the result would be
+    # /etc/hosts
+    src: "{{ symlink_src if (use_variant_symlinks | default(true))
+             else (symlink_src | split(':-/cvmfs/' + cvmfs_repository + '/defaults/compat') | last | trim(')')) }}"
+    dest: "{{ symlink_dest }}"
     state: link
     force: true
+  vars:
+    # If the list item is a string, the symlink is assumed to be like /dir/file -> $EPREFIX/dir/file.
+    # Otherwise, it should have a src and dest attribute and we use that.
+    symlink_dest: "{{ item.dest if item is mapping else gentoo_prefix_path + item }}"
+    symlink_src: "{{ item.src if item is mapping else item }}"
   with_items: "{{ symlinks_to_host }}"

ansible/playbooks/roles/compatibility_layer/tasks/install_packages.yml

@@ -1,15 +1,41 @@
 # Install a specified list of sets and packages.
 ---
-- name: Install package set {{ package_sets }}
+- name: Install package sets
   community.general.portage:
     package: "@{{ item }}"
     state: present
   with_items: "{{ package_sets }}"
   tags:
     - set
 
-- name: Install additional packages
+- name: Determine packages to be installed for this architecture
+  ansible.builtin.set_fact:
+    # Join the following subsets of items from the package list:
+    #   - packages without architecture constraints
+    #   - packages with a "include_on" constraint that includes this architecture
+    #   - packages with a "exclude_on" constraint that don't include this architecture
+    eessi_os_arch_packages: |
+      {{ prefix_packages
+           | rejectattr('include_on', 'defined')
+           | rejectattr('exclude_on', 'defined')
+         + prefix_packages
+           | selectattr('include_on', 'defined')
+           | selectattr('include_on', 'contains', eessi_host_os + '-' + eessi_host_arch)
+         + prefix_packages
+           | rejectattr('include_on', 'defined')
+           | selectattr('exclude_on', 'defined')
+           | rejectattr('exclude_on', 'contains', eessi_host_os + '-' + eessi_host_arch)
+      }}
+
+- name: Install EESSI packages
   community.general.portage:
-    package: "{{ item }}"
+    # Construct package atom:
+    #   category/name
+    #   =category/name-version
+    #   =category/name-version::overlay
+    package: "{{ '=' if item.version is defined }}\
+      {{ item.name }}\
+      {{ '-' + item.version if item.version is defined }}\
+      {{ '::' + item.overlay if item.overlay is defined }}"
     state: present
-  with_items: "{{ prefix_packages }}"
+  loop: "{{ eessi_os_arch_packages }}"

ansible/playbooks/roles/compatibility_layer/tasks/install_prefix.yml

@@ -94,33 +94,14 @@
   tags:
     - build_prefix
 
-- name: "Clone the Gentoo git repository into the overlay directory"
-  ansible.builtin.git:
-    repo: "{{ gentoo_git_repo }}"
-    dest: "{{ gentoo_prefix_path }}/var/db/repos/gentoo"
-    depth: 1
-    force: true
-    version: master
-  tags:
-    - build_prefix
-
-- name: "Fetch the specific git commit to be used for the bootstrap"
-  ansible.builtin.git:
-    repo: "{{ gentoo_git_repo }}"
-    dest: "{{ gentoo_prefix_path }}/var/db/repos/gentoo"
-    clone: false
-    refspec: "{{ gentoo_git_commit }}"
-    depth: 1
-    version: master
-  tags:
-    - build_prefix
-
-- name: "Checkout the fetched git commit"
-  ansible.builtin.git:
-    repo: "{{ gentoo_git_repo }}"
-    dest: "{{ gentoo_prefix_path }}/var/db/repos/gentoo"
-    clone: false
-    version: "{{ gentoo_git_commit }}"
+- name: "Import the task for checking out the specific commit of git-based overlays"
+  ansible.builtin.import_tasks: sync_git_overlay.yml
+  vars:
+    gitrepo:
+      name: "gentoo"
+      url: "{{ gentoo_git_repo }}"
+      branch: "{{ gentoo_git_branch }}"
+      commit: "{{ gentoo_git_commit }}"
   tags:
     - build_prefix
 
@@ -135,21 +116,8 @@
   tags:
     - build_prefix
 
-- name: "Mask packages for the bootstrap"
-  ansible.builtin.copy:
-    dest: "{{ gentoo_prefix_path }}/etc/portage/package.mask"
-    content: "{{ prefix_mask_packages }}"
-    mode: "0644"
-  when: prefix_mask_packages is defined and prefix_mask_packages | length > 0
-  tags:
-    - build_prefix
-
-- name: "Unmask packages for the bootstrap"
-  ansible.builtin.copy:
-    dest: "{{ gentoo_prefix_path }}/etc/portage/package.unmask"
-    content: "{{ prefix_unmask_packages }}"
-    mode: "0644"
-  when: prefix_unmask_packages is defined and prefix_unmask_packages | length > 0
+- name: "Import task for configuring Portage"
+  ansible.builtin.import_tasks: portage_configuration.yml
   tags:
     - build_prefix
 
@@ -163,15 +131,6 @@
   tags:
     - build_prefix
 
-- name: "Specify use flags before completing bootstrap"
-  ansible.builtin.copy:
-    dest: "{{ gentoo_prefix_path }}/etc/portage/package.use"
-    content: "{{ prefix_bootstrap_use_flags }}"
-    mode: "0644"
-  when: prefix_bootstrap_use_flags is defined and prefix_bootstrap_use_flags | length > 0
-  tags:
-    - build_prefix
-
 - name: "Continue Gentoo Prefix bootstrap via {{ prefix_install }}"
   ansible.builtin.shell: set -o pipefail && ( {{ prefix_install }} | tee -a {{ prefix_build_log }} | grep -E '^(>>> Installing|\\* )' )
   args:
@@ -206,3 +165,13 @@
   when: not startprefix.stat.exists
   tags:
     - build_prefix
+
+# Right after we have built a new Prefix, we create regular symlinks first,
+# as variant symlinks will not resolve here, and it will break things.
+# We replace the regular symlinks by variant symlinks at the end.
+- name: Create (regular) symlinks to host files
+  ansible.builtin.include_tasks: create_host_symlinks.yml
+  vars:
+    use_variant_symlinks: false
+  tags:
+    - build_prefix