flatcar · chewi · Feb 4, 2026 · Feb 4, 2026 · Jan 27, 2026 · Jan 28, 2026
@@ -11,19 +11,3 @@ EXTRA_SYSEXTS=(
   "python|dev-lang/python,dev-python/pip"
   "zfs|sys-fs/zfs"
 )
-
-_get_unversioned_sysext_packages_unsorted() {
-  for sysext in "${EXTRA_SYSEXTS[@]}"; do
-    IFS="|" read -r _ PACKAGE_ATOMS _ <<< "$sysext"
-
-    IFS=,
-    for atom in $PACKAGE_ATOMS; do
-       qatom "$atom" -F "%{CATEGORY}/%{PN}"
-    done
-    unset IFS
-  done
-}
-
-get_unversioned_sysext_packages() {
-  _get_unversioned_sysext_packages_unsorted | sort | uniq
-}
@@ -75,7 +75,7 @@ get_oem_sysext_matrix() {
   local -a matrix=()
   local oem_id
   for oem_id in "${oem_ids[@]}"; do
-    matrix+=("oem-${oem_id}|coreos-base/oem-${oem_id}|${oem_id}")
+    matrix+=("oem-${oem_id}|coreos-base/oem-${oem_id}|flatcar-oem")
   done
 
   local -n matrix_ref="${list_var_name}"

@@ -289,6 +289,10 @@ fi
 export KBUILD_BUILD_USER="${BUILD_USER:-build}"
 export KBUILD_BUILD_HOST="${BUILD_HOST:-pony-truck.infra.kinvolk.io}"
 
+# Gather a list of packages we build with --buildpkgonly to prevent them from
+# getting cleaned by `eclean --deep packages` below.
+eclean_excludes=$(mktemp) || die_notrace "Couldn't create temporary exclusions file for eclean"
+
 # Build sysext packages from an array of sysext definitions.
 # Usage: build_sysext_packages "description" "${SYSEXT_ARRAY[@]}"
 # Array format: "name|packages|useflags|arches"
@@ -305,15 +309,20 @@ build_sysext_packages() {
 
     info "Building packages for $sysext_name sysext with USE=$useflags"
     IFS=,
+    qatom -F "%{CATEGORY}/%{PN}" ${package_atoms} >> "${eclean_excludes}"
     for package in $package_atoms; do
        # --buildpkgonly does not install dependencies, so we install them
-       # separately before building the binary package
+       # separately before building the binary package. --ignore-world is needed
+       # to allow packages to be installed to both /usr and sysexts with
+       # conflicting USE flags. This will "break" the board root, but it's not
+       # used for execution, and affected packages will be rebuilt as needed.
        sudo --preserve-env=MODULES_SIGN_KEY,MODULES_SIGN_CERT \
          env USE="$useflags" FEATURES="-ebuild-locks binpkg-multi-instance" "${EMERGE_CMD[@]}" \
          "${EMERGE_FLAGS[@]}" \
          --quiet \
          --onlydeps \
          --binpkg-respect-use=y \
+         --ignore-world=y \
          "${package}"
 
        sudo --preserve-env=MODULES_SIGN_KEY,MODULES_SIGN_CERT \
@@ -322,6 +331,7 @@ build_sysext_packages() {
          --quiet \
          --buildpkgonly \
          --binpkg-respect-use=y \
+         --ignore-world=y \
          "${package}"
     done
     unset IFS
@@ -373,16 +383,11 @@ if [[ "${FLAGS_usepkgonly}" -eq "${FLAGS_FALSE}" ]]; then
   fi
 fi
 
-exclusions_file=$(mktemp)
-if [ ! -f "$exclusions_file" ]; then
-    die_notrace "Couldn't create temporary exclusions file $exclusions_file for eclean"
-fi
-get_unversioned_sysext_packages > "$exclusions_file"
-eclean-"$BOARD" -d --exclude-file="$exclusions_file" packages
-rm -f "$exclusions_file"
+eclean-"$BOARD" --deep --exclude-file="${eclean_excludes}" packages --unique-use
+rm -f "${eclean_excludes}"
 # run eclean again, this time without the --deep option, to clean old versions
 # of sysext packages (those, for which .ebuild file no  longer exists)
-eclean-"$BOARD" packages
+eclean-"$BOARD" packages --unique-use
 
 info "Checking build root"
 test_image_content "${BOARD_ROOT}"

@@ -22,7 +22,7 @@ default_install_root_basename='install-root'
 DEFINE_string board "${DEFAULT_BOARD}" \
   "The board to build a sysext for."
 DEFINE_string metapkgs '' \
-  "Comma-separated list of meta-packages to build from source and install into sysext image."
+  "Comma-separated list of binary meta-packages to install into the sysext image."
 DEFINE_string squashfs_base '' \
   "The path to the squashfs base image. Defaults to the most current image built in '${default_imagedir}/${FLATCAR_PRODUCTION_IMAGE_SYSEXT_BASE}'."
 DEFINE_string image_builddir '' \
@@ -206,9 +206,9 @@ if [ "$VERSION_BOARD" != "$FLATCAR_VERSION" ]; then
 fi
 
 if [[ -n "${FLAGS_metapkgs}" ]]; then
-  mapfile -t metapkgs < <(tr ',' '\n' <<<"${FLAGS_metapkgs}")
-  "emerge-${FLAGS_board}" --nodeps --buildpkgonly --usepkg n --verbose "${metapkgs[@]}"
-  set -- "${metapkgs[@]}" "${@}"
+  IFS=,
+  set -- ${FLAGS_metapkgs} "${@}"
+  unset IFS
 fi
 
 if [[ ${#} -lt 1 ]]; then

@@ -0,0 +1 @@
+- Updated the GCE udev disk rules to include NVMe disks.
@@ -23,13 +23,12 @@ gets built into a developer image and is not OEM specific.
 gets built into the Container Linux SDK.
 
 `coreos-devel/board-packages` is everything that could be built into a
-development or production image, plus any OEM specific packages.
+development or production image.
 
 `coreos-base/oem-*` are the OEM specific packages. They mostly install things
-that belong in the OEM partition. Any RDEPENDS from these packages should
-be copied to the RDEPENDS in `board-packages` to ensure they are built.
+that belong in the OEM partition.
 
-`coreos-base/coreos-oem-*` are metapackages for OEM specific ACIs. 
+`coreos-base/coreos-oem-*` are metapackages for OEM specific ACIs.
 
 # Updating
 

@@ -0,0 +1 @@
+DIST google-guest-configs-20260116.00.tar.gz 50190 BLAKE2B a9d546c87245114bd650c1b5116a9619b927e9afb0702adb0d3b41efeab680da65055f37490fe88d4923ceb7a5f596a3f59848f74cb9f8ce074d3f2568f40757 SHA512 995b350700feba28cdd6250c2ca0788539f1e58f3bae9d23081671fff82c7ff139ec9a0f56411e9ead6bfca62ced2c4bb729f516352982441c6a769162d9f4f2
@@ -0,0 +1,50 @@
+diff --git a/src/etc/sysctl.d/60-gce-network-security.conf b/src/etc/sysctl.d/60-gce-network-security.conf
+index b40085b..d89d87d 100644
+--- a/src/etc/sysctl.d/60-gce-network-security.conf
++++ b/src/etc/sysctl.d/60-gce-network-security.conf
+@@ -14,45 +14,6 @@
+ #
+ # Google-recommended kernel parameters
+
+-# Turn on SYN-flood protections.  Starting with 2.6.26, there is no loss
+-# of TCP functionality/features under normal conditions.  When flood
+-# protections kick in under high unanswered-SYN load, the system
+-# should remain more stable, with a trade off of some loss of TCP
+-# functionality/features (e.g. TCP Window scaling).
+-net.ipv4.tcp_syncookies=1
+-
+-# Ignore source-routed packets
+-net.ipv4.conf.all.accept_source_route=0
+-net.ipv4.conf.default.accept_source_route=0
+-
+-# Ignore ICMP redirects from non-GW hosts
+-net.ipv4.conf.all.accept_redirects=0
+-net.ipv4.conf.default.accept_redirects=0
+-net.ipv4.conf.all.secure_redirects=1
+-net.ipv4.conf.default.secure_redirects=1
+-
+-# Don't pass traffic between networks or act as a router
+-net.ipv4.ip_forward=0
+-net.ipv4.conf.all.send_redirects=0
+-net.ipv4.conf.default.send_redirects=0
+-
+-# Turn on Source Address Verification in all interfaces to
+-# prevent some spoofing attacks.
+-net.ipv4.conf.all.rp_filter=1
+-net.ipv4.conf.default.rp_filter=1
+-
+-# Ignore ICMP broadcasts to avoid participating in Smurf attacks
+-net.ipv4.icmp_echo_ignore_broadcasts=1
+-
+-# Ignore bad ICMP errors
+-net.ipv4.icmp_ignore_bogus_error_responses=1
+-
+ # Log spoofed, source-routed, and redirect packets
+ net.ipv4.conf.all.log_martians=1
+ net.ipv4.conf.default.log_martians=1
+-
+-# Addresses of mmap base, heap, stack and VDSO page are randomized
+-kernel.randomize_va_space=2
+-
+-# Reboot the machine soon after a kernel panic.
+-kernel.panic=10
@@ -0,0 +1,25 @@
+From a848f8f181e2a7080a7ee06fb87ffbfe05e66a24 Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <[email protected]>
+Date: Tue, 20 Jan 2026 15:55:29 +0000
+Subject: [PATCH] dracut: Install dd and ln as these are used by google_nvme_id
+
+I found that the disk name symlink was missing on Flatcar due to the
+lack of dd. I thought about using pure Bash, but it can't handle the
+null bytes. I also thought about using tail, but this is just as likely
+to be missing.
+
+I've also added ln for good measure.
+--- a/src/lib/dracut/modules.d/30gcp-udev-rules/module-setup.sh
++++ b/src/lib/dracut/modules.d/30gcp-udev-rules/module-setup.sh
+@@ -4,7 +4,7 @@
+
+ # called by dracut
+ install() {
+-  inst_multiple nvme grep sed
++  inst_multiple nvme dd ln grep sed
+   inst_simple /usr/lib/udev/google_nvme_id
+   inst_simple /usr/lib/udev/rules.d/65-gce-disk-naming.rules
+ }
+-- 
+2.51.2
+
@@ -0,0 +1,66 @@
+# Copyright 2026 The Flatcar Container Linux Maintainers
+# Distributed under the terms of the Apache License 2.0
+
+# IMPORTANT! When bumping, ensure that the Dracut modules do not install files
+# that would make runtime changes to systems to other than GCE VMs because the
+# initrd is shared between image types. The udev disk rules are currently safe.
+
+EAPI=8
+
+inherit udev
+
+DESCRIPTION="Configuration and scripts to support the Google Compute Engine guest environment"
+HOMEPAGE="http://github.com/GoogleCloudPlatform/guest-configs"
+SRC_URI="https://github.com/GoogleCloudPlatform/guest-configs/archive/${PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/guest-configs-${PV}"
+
+LICENSE="Apache-2.0 BSD ZLIB"
+SLOT="0"
+KEYWORDS="amd64"
+IUSE="flatcar-oem"
+
+RDEPEND="
+	!<app-emulation/google-compute-engine-20190124-r3
+	sys-apps/nvme-cli
+	flatcar-oem? (
+		net-misc/curl
+		sys-apps/ethtool
+		sys-apps/iproute2
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-20211116.00-sysctl.patch
+	"${FILESDIR}"/${PN}-dracut-deps.patch
+)
+
+src_install() {
+	exeinto "$(get_udevdir)"
+	doexe src/lib/udev/google_nvme_id
+
+	udev_dorules src/lib/udev/rules.d/65-gce-disk-naming.rules
+
+	insinto /usr/lib/dracut/modules.d
+	doins -r src/lib/dracut/modules.d/*
+
+	# We want the above files available before the OEM sysext is mounted.
+	# Anything below here only goes into the sysext.
+	use flatcar-oem || return
+
+	udev_dorules src/lib/udev/rules.d/75-gce-network.rules
+
+	insinto /usr/lib/sysctl.d
+	doins src/etc/sysctl.d/60-gce-network-security.conf
+
+	dobin src/usr/bin/google_set_multiqueue
+	dobin src/usr/bin/google_optimize_local_ssd
+	dobin src/usr/bin/gce-nic-naming
+}
+
+pkg_postinst() {
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<upstream>
+		<remote-id type="github">GoogleCloudPlatform/guest-configs</remote-id>
+	</upstream>
+</pkgmetadata>
@@ -28,3 +28,10 @@ RDEPEND="
 	sys-apps/iproute2
 	sys-apps/shadow
 "
+
+src_install() {
+	distutils-r1_src_install
+
+	# Newer versions are installed by app-admin/google-guest-configs.
+	rm -v "${ED}"/usr/bin/google_{optimize_local_ssd,set_multiqueue} || die
+}
@@ -212,6 +212,7 @@ RDEPEND="${RDEPEND}
 # OEM specific bits that need to go in USR
 RDEPEND+="
 	amd64? (
+		app-admin/google-guest-configs[-flatcar-oem]
 		sys-auth/google-oslogin
 	)
 "

@@ -0,0 +1,35 @@
+# Copyright (c) 2013 CoreOS, Inc.. All rights reserved.
+# Distributed under the terms of the GNU General Public License v2
+# Copyright (c) 2020 Kinvolk GmbH. All rights reserved.
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit systemd
+
+DESCRIPTION="OEM suite for Google Compute Engine images"
+HOMEPAGE="https://cloud.google.com/products/compute-engine/"
+S="${WORKDIR}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64"
+
+RDEPEND="
+	app-admin/google-guest-configs[flatcar-oem]
+	app-emulation/google-compute-engine
+"
+
+OEM_NAME="Google Compute Engine"
+
+src_install() {
+	systemd_dounit "${FILESDIR}"/units/{oem-gce,oem-gce-enable-oslogin,setup-oem}.service
+	systemd_install_dropin multi-user.target "${FILESDIR}"/units/10-oem-gce.conf
+	systemd_enable_service multi-user.target ntpd.service
+
+	dobin "${FILESDIR}"/bin/{enable-oslogin,init.sh}
+
+	# These files will be symlinked to /etc via 'setup-oem.service'
+	insinto /usr/share/gce
+	doins "${FILESDIR}"/files/{google-cloud-sdk.sh,hosts}
+}
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		- Updated the GCE udev disk rules to include NVMe disks.
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		DIST google-guest-configs-20260116.00.tar.gz 50190 BLAKE2B a9d546c87245114bd650c1b5116a9619b927e9afb0702adb0d3b41efeab680da65055f37490fe88d4923ceb7a5f596a3f59848f74cb9f8ce074d3f2568f40757 SHA512 995b350700feba28cdd6250c2ca0788539f1e58f3bae9d23081671fff82c7ff139ec9a0f56411e9ead6bfca62ced2c4bb729f516352982441c6a769162d9f4f2