SBUILD.CONF(5)

📦
version 0.91.10ubuntu1 · 10 versions
, in ubuntu stonking

🌸 SBUILD.CONF(5) — Debian sbuild 💖

okay bestie, welcome to sbuild.conf from the Debian sbuild corner of the manual, section 5 🫶 this is THE config file. let's get into it.

✨ NAME ✨

sbuild.conf — configuration file for sbuild 💅

🎀 DESCRIPTION 🎀

So here's the tea: sbuild.conf is a Perl script that gets sourced by sbuild so you can configure stuff. It runs in a sandbox and it's restricted to setting a small number of variables — all detailed below — which you use to configure how sbuild behaves. Each variable has an internal name, shown in ALL CAPS, and a perl variable showing the default setting.

Heads up bestie: the internal name is not accessible inside sbuild.conf — you can only assign to the variable. No cap, that's just how it is. 🙈

Also note that some of the defaults are set to be unique for each build, which means a few of the defaults shown here are unique to the user and system that was used to build sbuild itself, and they're gonna be different on your system. Sorry, it's giving ✨bespoke✨.

While sbuild lets you configure many aspects of its behaviour, this should not normally be required. The defaults should be adequate for most uses, and you should only change them if you're doing something more advanced or you have specialist requirements. Like, the defaults ate, fr fr. 🔥

👑 CONFIGURATION 👑

🦋 Build environment 🌈

PATH

STRING type. The PATH to set when running dpkg-buildpackage.

Related sbuild(1) command line options:

  • --use-snapshot

Default:

$path =
'/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games';

LD_LIBRARY_PATH

STRING type. Library search path to use inside the chroot.

Related sbuild(1) command line options:

  • --use-snapshot

Default:

$ld_library_path = undef;

🧚 Build options 💜

DISTRIBUTION

STRING type. The default distribution. By default, no distribution is defined, and the user has to specify it with the -d option. But you can configure a default here if you want to.

⚠️ bestie listen — you must take care not to upload to the wrong distribution when this option is set. For example, experimental packages will be built for upload to unstable when that is not what is required. 💀

In unshare mode, this setting controls how the chroot tarball is created, because rules like $unshare_mmdebstrap_extra_args and $unshare_mmdebstrap_distro_mangle use the value of the distribution and not the chroot name. iykyk.

Related sbuild(1) command line options:

  • -d
  • --dist

Default:

$distribution = undef;

HOST_ARCH

STRING type. Host architecture (the arch we are building for).

Related sbuild(1) command line options:

  • --arch
  • --host
host_arch = ...;

BUILD_ARCH

STRING type. Build architecture (the arch we are building on).

Related sbuild(1) command line options:

  • --arch
  • --build
build_arch = ...;

BUILD_ARCH_ALL

BOOL type. Build architecture: all packages by default.

Related sbuild(1) command line options:

  • --arch-all
  • --no-arch-all

Default:

$build_arch_all = undef;

BUILD_ARCH_ANY

BOOL type. Build architecture: any packages by default.

Related sbuild(1) command line options:

  • --arch-any
  • --no-arch-any

Default:

$build_arch_any = 1;

BUILD_PROFILES

STRING type. Build profiles, separated by spaces. Defaults to the value of the DEB_BUILD_PROFILES environment variable when building natively, and to the cross and nocheck profiles when cross-building. ✨

Related sbuild(1) command line options:

  • --profiles

Default:

$build_profiles = undef;

ENABLE_NETWORK

STRING type. By default network access is blocked during the build (only implemented for the unshare mode). This lifts the restriction. 🚫🌐→🌐

Related sbuild(1) command line options:

  • --enable-network

Default:

$enable_network = 0;

BUILD_ENV_CMND

STRING type. This command is run with the dpkg-buildpackage command line passed to it (inside the chroot, if you're doing a chrooted build). It's used by the sparc buildd (which is sparc64) to call the wrapper script that sets the environment to sparc (32-bit). It could also be used for other build environment setup scripts. Note that this is superseded by schroot's command-prefix option. 👀

Default:

$build_env_cmnd = '';

PGP_OPTIONS

ARRAY:STRING type. Additional signing options for dpkg-buildpackage.

Default:

$pgp_options = [
                 '-us',
                 '-uc'
               ];

TOOLCHAIN_REGEX

ARRAY:STRING type. Regular expressions identifying toolchain packages. Note that for backward compatibility, this is also settable using the array @toolchain_regex (deprecated), rather than an array reference. 🙈

Default:

$toolchain_regex = [
                     'binutils$',
                     'dpkg-dev$',
                     'gcc-[\d.]+$',
                     'g\+\+-[\d.]+$',
                     'libstdc\+\+',
                     'libc[\d.]+-dev$',
                     'linux-kernel-headers$',
                     'linux-libc-dev$',
                     'gnumach-dev$',
                     'hurd-dev$',
                     'kfreebsd-kernel-headers$'
                   ];

CLEAN_APT_CACHE

BOOL type. Run apt-get distclean before the build to clean the apt package cache, if the command is available. This makes sure the build environment isn't polluted by extra information, but it also means you need to run apt update before manually installing packages for debugging. You can disable this to save the extra call, but remember to not use the information from the apt cache. Also note that this silently fails when the command isn't available, to stay compatible with older releases. 🤫

Related sbuild(1) command line options:

  • --apt-distclean
  • --no-apt-distclean

Default:

$clean_apt_cache = 1;

CHECK_SPACE

BOOL type. Check free disk space prior to starting a build. sbuild requires the free space to be at least twice the size of the unpacked sources to allow a build to proceed. Can be disabled to allow building if space is very limited, but the threshold to abort a build has been exceeded despite there being sufficient space for the build to complete. 😭

Default:

$check_space = 1;

BUILD_PATH

STRING type. This option lets you specify a custom path where the package is built inside the chroot. The sbuild user in the chroot must have permissions to create the path. Common writable locations are subdirectories of /tmp or /build.

⚠️ Using /tmp might be dangerous, because (depending on the chroot backend) the /tmp inside the chroot might be a world-writable location that can be accessed by processes outside the chroot.

The directory /build can only be accessed by the sbuild user and group and should be a safe location. The buildpath must be an empty directory, because the last component of the path will be removed after the build is finished.

Notice that depending on the chroot backend (see CHROOT_MODE), some locations inside the chroot might be bind mounts that are shared with other sbuild instances. You must avoid using these shared locations as the build path, or otherwise concurrent runs of sbuild will likely fail. 🔥 With the default schroot chroot backend, the directory /build is shared between multiple schroot sessions. You can change this behaviour in /etc/schroot/sbuild/fstab. The behaviour of other chroot backends will vary.

To let sbuild choose a random build location of the format /build/packagename-XXXXXX/packagename-version/ where XXXXXX is a random ascii string, set this variable to the empty string. 🎲

Related sbuild(1) command line options:

  • --build-path

Default:

$build_path = '/build/reproducible-path';

DSC_DIR

STRING type. By default the package is built in a path of the following format: /build/packagename-XXXXXX/packagename-version/ where packagename-version are replaced by the values in debian/changelog. This option lets you specify a custom packagename-version path where the package is built inside the chroot. This is useful to specify a static path for different versions, for example for ccache. ✨

Related sbuild(1) command line options:

  • --dsc-dir

Default:

$dsc_dir = undef;

FORCE_ORIG_SOURCE

BOOL type. By default, the -s option only includes the .orig.tar.gz when needed (i.e. when the Debian revision is 0 or 1). By setting this option to 1, the .orig.tar.gz will always be included when -s is used. 📦

Related sbuild(1) command line options:

  • --force-orig-source

Default:

$force_orig_source = 0;

BUILD_SOURCE

BOOL type. By default, do not build a source package (binary only build). Set to 1 to force creation of a source package, but note that this is inappropriate for binary NMUs, where the option will always be disabled. 🚫

Related sbuild(1) command line options:

  • -s
  • --source
  • --no-source

Default:

$build_source = 0;

BIN_NMU

STRING type. Binary NMU changelog entry. 📝

Related sbuild(1) command line options:

  • --make-binNMU

Default:

$bin_nmu = undef;

BIN_NMU_VERSION

STRING type. Binary NMU version number. 🔢

Related sbuild(1) command line options:

  • --binNMU
  • --make-binNMU

Default:

$bin_nmu_version = undef;

and that's only part 1 bestie, hold on, there's more coming 💖✨

BIN_NMU_TIMESTAMP 💅

STRING type, bestie. This one is the binary NMU timestamp, and the way it gets conveyed is… flexible, ok? Like there's multiple routes:

  • An integer prefixed with a plus sign gets read as a Unix time. yes really.
  • The special value "now" = the current time. obviously.
  • The special value "increment" deterministically computes a timestamp from the NMU version and the last sourceful changelog timestamp. it's giving ✨algorithmic✨.
  • Anything else? Then it should be a string in the format compatible with Debian changelog entries (i.e. exactly how date -R spits it out).

And "increment" is what's used by default. periodt.

Related sbuild(1) command line options:

  • --binNMU-timestamp

Default:

$bin_nmu_timestamp = 'increment';

APPEND_TO_VERSION 🎀

STRING type. This is a suffix to append to the version number. Lowkey made for derivative distributions, iykyk.

Related sbuild(1) command line options:

  • --append-to-version

Default:

$append_to_version = undef;

BIN_NMU_CHANGELOG 🦋

STRING type. The actual content of a binary-only changelog entry. Heads up bestie: leading and trailing newlines will be stripped. she cleans up after herself 💖

Related sbuild(1) command line options:

  • --binNMU-changelog

Default:

$bin_nmu_changelog = undef;

GCC_SNAPSHOT 🌸

BOOL type. Build using the current GCC snapshot? simple as that, no thoughts.

Related sbuild(1) command line options:

  • --use-snapshot

Default:

$gcc_snapshot = 0;

CLEAN_SOURCE 🧚

BOOL type. When you're running sbuild from within an unpacked source tree, this runs the 'clean' target before generating the source package. Sounds cute, but it might require some of the build dependencies that are necessary for running that 'clean' target to be installed on the host machine. So. Only disable this if you start from a clean checkout and you actually know what you are doing. 👑

Related sbuild(1) command line options:

  • --clean-source
  • --no-clean-source

Default:

$clean_source = 1;

SOURCE_ONLY_CHANGES ⭐

BOOL type. Also produce a changes file suitable for a source-only upload. slay for archive hygiene honestly.

Related sbuild(1) command line options:

  • --source-only-changes

Default:

$source_only_changes = 0;

BUILD_AS_ROOT_WHEN_NEEDED 👑

BOOL type. Build packages as root when Rules-Requires-Root: binary-targets. that's the whole vibe.

Default:

$build_as_root_when_needed = 0;

🌈 Build timeouts 🌈

STALLED_PKG_TIMEOUT ⏳

NUMERIC type. The time (in minutes) of inactivity after which a build gets terminated 😭. And how is activity even measured? By output to the log file. no output = no vibes = bye.

Default:

$stalled_pkg_timeout = 150;

MAX_LOCK_TRYS 🔒

NUMERIC type. Number of times to try waiting for a lock. patience is a virtue fr fr.

Default:

$max_lock_trys = 120;

LOCK_INTERVAL ⏱️

NUMERIC type. Lock wait interval (seconds). And the max wait time is (max_lock_trys x lock_interval). do with that math what u will bestie.

Default:

$lock_interval = 5;

INDIVIDUAL_STALLED_PKG_TIMEOUT 🐌

HASH:NUMERIC type. Some packages just take longer than the general timeout (e.g. redirecting output to a file) and need a different one. so this is a mapping between source package name and timeout.

ngl, heads up: for backward compatibility this is also settable using the hash %individual_stalled_pkg_timeout (deprecated), rather than a hash reference. don't be that girl.

Example:

$individual_stalled_pkg_timeout->{'llvm-toolchain-3.8'} = 300;
$individual_stalled_pkg_timeout->{'kicad-packages3d'} = 90;

Default:

$individual_stalled_pkg_timeout = {};

🌟 Build validation 🌟

LINTIAN 🧹

STRING type. Path to the lintian binary.

Default:

$lintian = 'lintian';

RUN_LINTIAN ✨

BOOL type. Run lintian? yes or no, the eternal question.

Related sbuild(1) command line options:

  • --run-lintian
  • --no-run-lintian

Default:

$run_lintian = 1;

LINTIAN_OPTIONS 💜

ARRAY:STRING type. Options to pass to lintian. Each option is a separate arrayref element. For example, ['-i', '-v'] to add -i and -v. one per slot bestie, no string-splitting shenanigans.

Related sbuild(1) command line options:

  • --lintian-opt
  • --lintian-opts

Default:

$lintian_opts = [];

LINTIAN_REQUIRE_SUCCESS 💀

BOOL type. Let sbuild fail if lintian fails. harsh but fair.

Default:

$lintian_require_success = 0;

PIUPARTS 🍓

STRING type. Path to the piuparts binary.

Related sbuild(1) command line options:

  • --piuparts-opt
  • --piuparts-opts

Default:

$piuparts = 'piuparts';

RUN_PIUPARTS 🌀

BOOL type. Run piuparts. that's it, that's the option.

Related sbuild(1) command line options:

  • --run-piuparts
  • --no-run-piuparts

Default:

$run_piuparts = 0;

PIUPARTS_OPTIONS 🎯

ARRAY:STRING type. Options to pass to piuparts. Each option is a separate arrayref element. For example, ['-b', '<chroot_tarball>'] to add -b and <chroot_tarball>.

Default:

$piuparts_opts = undef;

PIUPARTS_ROOT_ARGS 👸

ARRAY:STRING type. Preceding arguments to launch piuparts as root. With the default value (the empty array) "sudo --" will be used as a prefix unless sbuild is run in unshare mode. If the first element in the array is the empty string, no prefixing will be done. If the value is a scalar, it will be prefixed by that string. If the scalar is an empty string, no prefixing will be done.

Related sbuild(1) command line options:

  • --piuparts-root-arg
  • --piuparts-root-args

Example:

# prefix with "sudo --":
$piuparts_root_args = [];
$piuparts_root_args = ['sudo', '--'];
# prefix with "env":
$piuparts_root_args = ['env'];
$piuparts_root_args = 'env';
# prefix with nothing:
$piuparts_root_args = '';
$piuparts_root_args = [''];
$piuparts_root_args = ['', 'whatever'];

Default:

$piuparts_root_args = [];

PIUPARTS_REQUIRE_SUCCESS 🫶

BOOL type. Let sbuild fail if piuparts fails.

Default:

$piuparts_require_success = 0;

AUTOPKGTEST 🔥

STRING type. Path to the autopkgtest binary.

Related sbuild(1) command line options:

  • --autopkgtest-opt
  • --autopkgtest-opts

Default:

$autopkgtest = 'autopkgtest';

RUN_AUTOPKGTEST 🚀

BOOL type. Run autopkgtest.

Related sbuild(1) command line options:

  • --run-autopkgtest
  • --no-run-autopkgtest

Default:

$run_autopkgtest = 0;

AUTOPKGTEST_OPTIONS 🧁

ARRAY:STRING type. Options to pass to autopkgtest. Each option is a separate arrayref element. For example, ['-b', '<chroot_tarball>'] to add -b and <chroot_tarball>.

Default:

$autopkgtest_opts = undef;

AUTOPKGTEST_ROOT_ARGS 💖

ARRAY:STRING type. Preceding arguments to launch autopkgtest as root. With the default value (the empty array) "sudo --" will be used as a prefix unless sbuild is run in unshare mode. If the first element in the array is the empty string, no prefixing will be done. If the value is a scalar, it will be prefixed by that string. If the scalar is an empty string, no prefixing will be done.

Related sbuild(1) command line options:

  • --autopkgtest-root-arg
  • --autopkgtest-root-args

Example:

# prefix with "sudo --":
$autopkgtest_root_args = [];
$autopkgtest_root_args = ['sudo', '--'];
# prefix with "env":
$autopkgtest_root_args = ['env'];
$autopkgtest_root_args = 'env';
# prefix with nothing:
$autopkgtest_root_args = '';
$autopkgtest_root_args = [''];
$autopkgtest_root_args = ['', 'whatever'];

Default:

$autopkgtest_root_args = [];

AUTOPKGTEST_REQUIRE_SUCCESS 🌈

BOOL type. Let sbuild fail if autopkgtest fails.

Default:

$autopkgtest_require_success = 0;

💫 Chroot options 💫

CHROOT 🏠

STRING type. The default chroot, which defaults to distribution[-arch][-sbuild].

Ok so in unshare mode, this setting gets used to decide the name of the tarball in ~/.cache/sbuild. But — and this is the important part bestie — this setting does not influence what options are used to create the chroot in unshare mode (unless as the very last fallback for $unshare_mmdebstrap_extra_args). Use the distribution name (either in debian/changelog or by using --dist) for that. two different jobs, don't mix them up 💅

Related sbuild(1) command line options:

  • -c
  • --chroot

Default:

$chroot = undef;

PACKAGE_CHECKLIST 📋

STRING type. Where to store the list of currently installed packages inside the chroot.

Default:

$package_checklist = '/var/lib/sbuild/package-checklist';

PURGE_BUILD_DEPS 🧽

STRING type. When to purge the build dependencies after a build. Possible values are "never", "successful", and "always".

Related sbuild(1) command line options:

  • -p
  • --purge
  • --purge-deps

Default:

$purge_build_deps = 'always';

PURGE_BUILD_DIRECTORY 🗑️

STRING type. When to purge the build directory after a build. Possible values are "never", "successful", and "always".

Related sbuild(1) command line options:

  • -p
  • --purge
  • --purge-build

Default:

$purge_build_directory = 'always';

PURGE_SESSION 🧼

STRING type. Purge the schroot session following a build. This is useful in conjunction with the --purge and --purge-deps options when using snapshot chroots, since by default the snapshot will be deleted. Possible values are "always" (default), "never", and "successful".

Related sbuild(1) command line options:

  • -p
  • --purge
  • --purge-session

Default:

$purge_session = 'always';

CHROOT_MODE 🦋

STRING type. The mechanism to use for chroot virtualisation. Possible values are "schroot", "sudo", "autopkgtest" and "unshare" (default). pick ur fighter.

Related sbuild(1) command line options:

  • --chroot-mode

Default:

$chroot_mode = undef;

CHROOT_ALIASES

okay so this one is a HASH:STRING type, and it's basically a lil phonebook mapping distribution names → their aliases, and those aliases get used to look up chroots. It's the same energy as the aliases option in schroot config. If you're on the unshare backend, this does something very similar to dropping a symlink into ~/.cache/sbuild. 🫶

⚠️ but listen — if you wanna declare a mapping from an overlay distribution (think experimental or backcports) to its base, use $unshare_mmdebstrap_distro_mangle for that instead of this option. This one is a hash because the order of its entries literally does not matter, slay.

also highkey important: in unshare mode you might still need an entry in $unshare_mmdebstrap_distro_mangle on top of an entry here, because this option only influences the chroot lookup. The distribution name that gets passed to mmdebstrap? Not affected by this option. periodt.

Default:

$chroot_aliases = {
                      'UNRELEASED' => 'unstable',
                      'rc-buggy' => 'experimental'
                    };

CHROOT_SPLIT

BOOL type, bestie. Are we running in split mode? In split mode, apt-get and dpkg get run on the host system, not inside the chroot. it's giving "outsourcing the work" 💅

Default:

$chroot_split = 0;

CHROOT_SETUP_SCRIPT

STRING type. This is the script you run to do your custom setup tasks inside the chroot. it's your little finishing-touches routine ✨

Related sbuild(1) command line options:

  • --setup-hook

Default:

$chroot_setup_script = undef;

APT_CLEAN

BOOL type. APT clean, no cap. Set it to 1 to enable running apt-get clean at the start of each build, or 0 to disable. Fresh start energy 🧼

Related sbuild(1) command line options:

  • --apt-clean
  • --no-apt-clean

Default:

$apt_clean = 0;

APT_KEEP_DOWNLOADED_PACKAGES

BOOL type. Do we keep the downloaded packages chillin' in cache by APT? This controls the APT::Keep-Downloaded-Packages option that gets used when downloading dependencies. 🍓

heads up though: this option only makes sense if /var/cache/apt/archive inside the chroot is made persistent between multiple sbuild invocations. Otherwise you're just hoarding for no reason, bestie.

1 = keep those downloaded packages in cache. 0 = delete them after installation.

Default:

$apt_keep_downloaded_packages = 0;

APT_UPDATE

BOOL type. APT update! 1 enables running apt-get update at the start of each build, 0 disables it.

okay this one has ✨lore✨ so stay with me. This option only applies to the default repositories of the chroot. The internal sbuild apt repository, the repository for extra packages (peep EXTRA_PACKAGES), and any repositories set via EXTRA_REPOSITORIES are always updated no matter what. 🙈

do NOT set this to 0 casually. It's not recommended, because you should be building with the latest available packages in each distribution. And if you do disable updates, you'd better make sure the chroot already contains downloaded package lists — otherwise apt literally cannot install any packages. 💀

If you're in unshare chroot mode, you can add --skip=cleanup/apt/lists to UNSHARE_MMDEBSTRAP_EXTRA_ARGS to retain the package lists inside the chroot taball. 👑

Related sbuild(1) command line options:

  • --apt-update
  • --no-apt-update

Default:

$apt_update = 1;

APT_UPGRADE

BOOL type. APT upgrade. 1 to enable running apt-get upgrade at the start of each build, or 0 to disable. glow up those packages ⭐

Related sbuild(1) command line options:

  • --apt-upgrade
  • --no-apt-upgrade

Default:

$apt_upgrade = 0;

APT_DISTUPGRADE

BOOL type. APT distupgrade. 1 to enable running apt-get dist-upgrade at the start of each build, or 0 to disable. the full transformation 💅

Related sbuild(1) command line options:

  • --apt-distupgrade
  • --no-apt-distupgrade

Default:

$apt_distupgrade = 1;

APT_ALLOW_UNAUTHENTICATED

BOOL type. This one forces APT to accept unauthenticated packages. 😭 By default, unauthenticated packages are not allowed — that's on purpose, to keep the build environment secure using apt-secure(8). Setting this to 1 sets APT::Get::AllowUnauthenticated to "true" when running apt-get.

this is disabled by default for a reason: only enable it if you know what you are doing. no cap.

Default:

$apt_allow_unauthenticated = 0;

EXTERNAL_COMMANDS

HASH:ARRAY:STRING type. These are external commands you can run at various stages of a build, and they're held in a hash of arrays of arrays data structure. 🎀

just so you know: there is no equivalent for the --anything-failed-commands command line option here. Also, all percent escapes mentioned in the sbuild man page can be used. yes queen, all of them.

Related sbuild(1) command line options:

  • --setup-hook
  • --pre-build-commands
  • --chroot-setup-commands
  • --chroot-update-failed-commands
  • --build-deps-failed-commands
  • --build-failed-commands
  • --anything-failed-commands
  • --starting-build-commands
  • --finished-build-commands
  • --chroot-cleanup-commands
  • --post-build-commands
  • --post-build-failed-commands

Example:

# general format
$external_commands = {
    "pre-build-commands" => [
        ['foo', 'arg1', 'arg2'],
        ['bar', 'arg1', 'arg2', 'arg3'],
    ],
    "chroot-setup-commands" => [
        ['foo', 'arg1', 'arg2'],
        ['bar', 'arg1', 'arg2', 'arg3'],
    ],
    "chroot-update-failed-commands" => [
        ['foo', 'arg1', 'arg2'],
        ['bar', 'arg1', 'arg2', 'arg3'],
    ],
    "build-deps-failed-commands" => [
        ['foo', 'arg1', 'arg2'],
        ['bar', 'arg1', 'arg2', 'arg3'],
    ],
    "build-failed-commands" => [
        ['foo', 'arg1', 'arg2'],
        ['bar', 'arg1', 'arg2', 'arg3'],
    ],
    "starting-build-commands" => [
        ['foo', 'arg1', 'arg2'],
        ['bar', 'arg1', 'arg2', 'arg3'],
    ],
    "finished-build-commands" => [
        ['foo', 'arg1', 'arg2'],
        ['bar', 'arg1', 'arg2', 'arg3'],
    ],
    "chroot-cleanup-commands" => [
        ['foo', 'arg1', 'arg2'],
        ['bar', 'arg1', 'arg2', 'arg3'],
    ],
    "post-build-commands" => [
        ['foo', 'arg1', 'arg2'],
        ['bar', 'arg1', 'arg2', 'arg3'],
    ],
    "post-build-failed-commands" => [
        ['foo', 'arg1', 'arg2'],
        ['bar', 'arg1', 'arg2', 'arg3'],
    ],
};
# the equivalent of specifying --anything-failed-commands=%SBUILD_SHELL on the
# command line
$external_commands = {
    "chroot-update-failed-commands" => [ [ '%SBUILD_SHELL' ] ],
    "build-deps-failed-commands" => [ [ '%SBUILD_SHELL' ] ],
    "build-failed-commands" => [ [ '%SBUILD_SHELL' ] ],
    "post-build-failed-commands" => [ [ '%SBUILD_SHELL' ] ],
};

Default:

$external_commands = {
                       'build-deps-failed-commands' => [],
                       'build-failed-commands' => [],
                       'chroot-cleanup-commands' => [],
                       'chroot-setup-commands' => [],
                       'chroot-update-failed-commands' => [],
                       'finished-build-commands' => [],
                       'post-build-commands' => [],
                       'pre-build-commands' => [],
                       'starting-build-commands' => []
                     };

LOG_EXTERNAL_COMMAND_OUTPUT

BOOL type. Should we log the standard output of commands run by sbuild? 👀

Related sbuild(1) command line options:

  • --log-external-command-output

Default:

$log_external_command_output = 1;

LOG_EXTERNAL_COMMAND_ERROR

BOOL type. And this one: should we log the standard error of commands run by sbuild? 🫣

Related sbuild(1) command line options:

  • --log-external-command-error

Default:

$log_external_command_error = 1;

PURGE_EXTRA_PACKAGES

BOOL type. Should we try to remove all the extra packages that aren't strictly required for the build, right after the build dependencies were installed? 🧹 This currently works best with the aspcud resolver, ngl.

Here's the tea on the other resolvers: the apt resolver will not make as much effort to remove all unneeded packages, and it will keep all providers of a virtual package and all packages from any dependency alternative that happen to be installed. The aptitude and xapt resolvers do not implement this feature yet. 🙈

also! the removed packages are not yet added again after the build finished. That can have some genuinely undesirable side effects — like lintian not working (because there's no apt to install its dependencies), or bare chroots becoming totally unusable after apt was removed from them. 💀

So: only use this with throw-away chroots, like the ones schroot provides, where the original state is automatically restored after each build. otherwise bestie, don't. 😭

Related sbuild(1) command line options:

  • --purge-extra-packages

Default:

$purge_extra_packages = 0;

Chroot options (unshare) 🦋

UNSHARE_TMPDIR_TEMPLATE

STRING type. This is the template used to create the temporary unpack directory for the unshare chroot mode. It uses $TMPDIR if that's set, and /tmp otherwise. 🌈

caveats, because of course: in unshare mode, all components of the path need to be accessible by the unshared user — meaning world execute permissions. And in unshare mode, the unshared user needs to have write permissions to this directory. so like. set it up properly. 💅

Example:

# Choose /var/tmp if /tmp is too small
$unshare_tmpdir_template = '/var/tmp/tmp.sbuild.XXXXXXXXXX';

Default:

$unshare_tmpdir_template = '/tmp/tmp.sbuild.XXXXXXXXXX';

UNSHARE_BIND_MOUNTS

ARRAY type. This is for bind mounting directories from the outside onto a mountpoint inside the chroot, in unshare mode. 🔗

Example:

$unshare_bind_mounts = [ { directory => "/home/path/outside", mountpoint => "/path/inside" } ];

Default:

$unshare_bind_mounts = [];
  • UNSHARE_MMDEBSTRAP_AUTO_CREATE — BOOL type. ✨ experimental feature alert ✨ so bestie, listen: in unshare mode, if the chroot tarball you want doesn't exist, or it's giving expired (peep UNSHARE_MMDEBSTRAP_MAX_AGE), sbuild goes and runs mmdebstrap to build you a fresh chroot for the build. And if you wanna customize how that mmdebstrap gets called? Run, don't walk, to UNSHARE_MMDEBSTRAP_EXTRA_ARGS. 💅

Default:

$unshare_mmdebstrap_auto_create = 1;
  • MMDEBSTRAP — STRING type. Just the path to the mmdebstrap binary, no drama. 🎀

Default:

$mmdebstrap = 'mmdebstrap';
  • UNSHARE_MMDEBSTRAP_KEEP_TARBALL — BOOL type. Another experimental one, okay? In unshare mode, and only when UNSHARE_MMDEBSTRAP_AUTO_CREATE is true, it writes the tarball it just made back to its rightful home at ~/.cache/sbuild/${release}-${arch}.tar. Now — if a chroot tarball was handed to you explicitly by passing a path with the --chroot option, sbuild will never update that chroot, periodt. But if that chroot tarball was outdated (again, see UNSHARE_MMDEBSTRAP_MAX_AGE), it still gets re-created and used, it just won't get saved back to the path you gave it. 🫶

Default:

$unshare_mmdebstrap_keep_tarball = 0;
  • UNSHARE_MMDEBSTRAP_EXTRA_ARGS — HASH:STRING type. Yep, experimental too, we stay experimental in this section 😭. In unshare mode, when mmdebstrap actually runs because UNSHARE_MMDEBSTRAP_AUTO_CREATE was set to true, these extra args get passed straight into the mmdebstrap invocation. The option array is given as key/value pairs, and every key gets matched against strings built from sbuild config variables, namely: DISTRIBUTION, DISTRIBUTION-BUILD_ARCH, DISTRIBUTION-BUILD_ARCH-HOST_ARCH, plus the name of the chroot itself (defined if you use --chroot). If a key matches one of those strings, the value — which holds the extra mmdebstrap arguments — gets appended to the mmdebstrap argument list. 🦋

A key can be a plain string, and if it is, glob-style expressions are fair game. A plain-string key has to fully match, no half-credit. A plain-string key also gets %a and %r percentage escapes swapped out for the host architecture and the distribution of the current build respectively. 🔥

A key can also be a precompiled qr// regular expression — but heads up, match groups cannot be referenced in the extra arguments, so don't try it. 🙈 The value is an array of extra arguments, and they get appended to the end of the mmdebstrap exec array.

Example:

$unshare_mmdebstrap_extra_args = [
   "*-%a-arm64" => [ ... ] # options for cross-builds with arm64 as the host architecture
   "debcargo-unstable-%a" => ["--include=dh-cargo,cargo"], # %a will be replaced by the host architecture
   "ubuntu-*" => [ "--components=main,universe,multiverse" ], # add universe and multiverse for ubuntu
   "/srv/custom-chroot.tar" => [ "--variant=apt", --arch="i386,ppc64el" ],
   qr/(jessie|stretch)-amd64/ => [ ... ] # do something special for jessie and stretch
   "{jessie,stretch}-amd64"   => [ ... ] # the same as above but with a glob instead of a regex
];

Default:

…and bestie, it just keeps going. Here's the rest of the array, and I need you to clock the pattern here: it's a flat list of alternating things — first a release codename (or a qr// regex that matches one), then an arrayref of extra args that get dumped onto mmdebstrap when that release matches. Accepts either a string or a regular expression, on the left, with the matching array of arguments on the right. Slay. 🎀

$unshare_mmdebstrap_extra_args = [
                                  qr/^(.*)-(backports|backports-sloppy|proposed-updates|updates)$/,
                                  [
                                    '--setup-hook=echo "deb http://deb.debian.org/debian %r main" > "$1"/etc/apt/sources.list.d/%r.list'
                                  ],
                                  qr/^(experimental|rc-buggy)$/,
                                  [
                                    '--setup-hook=echo "deb http://deb.debian.org/debian %r main" > "$1"/etc/apt/sources.list.d/%r.list'
                                  ],
                                  qr/^unreleased$/,
                                  [
                                    '--setup-hook=echo "deb http://deb.debian.org/debian-ports %r main" > "$1"/etc/apt/sources.list.d/%r.list'
                                  ],
                                  'resolute-backports',
                                  [
                                    '--components=main,universe',
                                    '--include=ca-certificates',
                                    '--setup-hook=echo "deb [signed-by=/usr/share/keyrings/ubuntu-archive-keyring.gpg] https://snapshot.ubuntu.com/ubuntu resolute-backports main universe" > "$1"/etc/apt/sources.list.d/backports.list'
                                  ],
                                  'jammy-proposed',
                                  [
                                    '--components=main,universe',
                                    '--include=ca-certificates',
                                    '--setup-hook=echo "deb [signed-by=/usr/share/keyrings/ubuntu-archive-keyring.gpg] https://snapshot.ubuntu.com/ubuntu jammy-proposed main universe" > "$1"/etc/apt/sources.list.d/proposed.list',
                                    '--aptopt=APT::Default-Release "jammy";'
                                  ],
                                  'questing-security',
                                  [
                                    '--components=main,universe',
                                    '--setup-hook=sed -i /-updates/d "$1"/etc/apt/sources.list'
                                  ],
                                  'stonking-backports',
                                  [
                                    '--components=main,universe',
                                    '--include=ca-certificates',
                                    '--setup-hook=echo "deb [signed-by=/usr/share/keyrings/ubuntu-archive-keyring.gpg] https://snapshot.ubuntu.com/ubuntu stonking-backports main universe" > "$1"/etc/apt/sources.list.d/backports.list'
                                  ],
                                  'noble-security',
                                  [
                                    '--components=main,universe',
                                    '--setup-hook=sed -i /-updates/d "$1"/etc/apt/sources.list'
                                  ],
                                  'jammy',
                                  [
                                    '--components=main,universe'
                                  ],
                                  'resolute-security',
                                  [
                                    '--components=main,universe',
                                    '--setup-hook=sed -i /-updates/d "$1"/etc/apt/sources.list'
                                  ],
                                  'noble-backports',
                                  [
                                    '--components=main,universe',
                                    '--include=ca-certificates',
                                    '--setup-hook=echo "deb [signed-by=/usr/share/keyrings/ubuntu-archive-keyring.gpg] https://snapshot.ubuntu.com/ubuntu noble-backports main universe" > "$1"/etc/apt/sources.list.d/backports.list'
                                  ],
                                  'questing-backports',
                                  [
                                    '--components=main,universe',
                                    '--include=ca-certificates',
                                    '--setup-hook=echo "deb [signed-by=/usr/share/keyrings/ubuntu-archive-keyring.gpg] https://snapshot.ubuntu.com/ubuntu questing-backports main universe" > "$1"/etc/apt/sources.list.d/backports.list'
                                  ],
                                  'stonking-security',
                                  [
                                    '--components=main,universe',
                                    '--setup-hook=sed -i /-updates/d "$1"/etc/apt/sources.list'
                                  ],
                                  'questing-proposed',
                                  [
                                    '--components=main,universe',
                                    '--include=ca-certificates',
                                    '--setup-hook=echo "deb [signed-by=/usr/share/keyrings/ubuntu-archive-keyring.gpg] https://snapshot.ubuntu.com/ubuntu questing-proposed main universe" > "$1"/etc/apt/sources.list.d/proposed.list',
                                    '--aptopt=APT::Default-Release "questing";'
                                  ],
                                  'noble-proposed',
                                  [
                                    '--components=main,universe',
                                    '--include=ca-certificates',
                                    '--setup-hook=echo "deb [signed-by=/usr/share/keyrings/ubuntu-archive-keyring.gpg] https://snapshot.ubuntu.com/ubuntu noble-proposed main universe" > "$1"/etc/apt/sources.list.d/proposed.list',
                                    '--aptopt=APT::Default-Release "noble";'
                                  ],
                                  'resolute',
                                  [
                                    '--components=main,universe'
                                  ],
                                  'jammy-security',
                                  [
                                    '--components=main,universe',
                                    '--setup-hook=sed -i /-updates/d "$1"/etc/apt/sources.list'
                                  ],
                                  'stonking',
                                  [
                                    '--components=main,universe'
                                  ],
                                  'noble',
                                  [
                                    '--components=main,universe'
                                  ],
                                  'questing',
                                  [
                                    '--components=main,universe'
                                  ],
                                  'resolute-proposed',
                                  [
                                    '--components=main,universe',
                                    '--include=ca-certificates',
                                    '--setup-hook=echo "deb [signed-by=/usr/share/keyrings/ubuntu-archive-keyring.gpg] https://snapshot.ubuntu.com/ubuntu resolute-proposed main universe" > "$1"/etc/apt/sources.list.d/proposed.list',
                                    '--aptopt=APT::Default-Release "resolute";'
                                  ],
                                  'jammy-backports',
                                  [
                                    '--components=main,universe',
                                    '--include=ca-certificates',
                                    '--setup-hook=echo "deb [signed-by=/usr/share/keyrings/ubuntu-archive-keyring.gpg] https://snapshot.ubuntu.com/ubuntu jammy-backports main universe" > "$1"/etc/apt/sources.list.d/backports.list'
                                  ],
                                  'stonking-proposed',
                                  [
                                    '--components=main,universe',
                                    '--include=ca-certificates',
                                    '--setup-hook=echo "deb [signed-by=/usr/share/keyrings/ubuntu-archive-keyring.gpg] https://snapshot.ubuntu.com/ubuntu stonking-proposed main universe" > "$1"/etc/apt/sources.list.d/proposed.list',
                                    '--aptopt=APT::Default-Release "stonking";'
                                  ]
                                ];

✨ UNSHARE_MMDEBSTRAP_ENV_CMD ✨

Type: ARRAY. Heads up bestie — this one is an experimental feature. 🙈

In unshare mode, when mmdebstrap is the one being used to create the chroot environment, you prefix that command with this option array. It's giving "dress rehearsal before the real thing" energy. 💅

Example, so you can see the shape of it:

$unshare_mmdebstrap_env_cmd = [ "env", "TMPDIR=/dev/shm/" ];

Default:

$unshare_mmdebstrap_env_cmd = [];

🌸 UNSHARE_MMDEBSTRAP_MAX_AGE 🌸

Type: NUMERIC. Also an experimental feature, no cap. 🫶

In unshare mode — and specifically when UNSHARE_MMDEBSTRAP_AUTO_CREATE=1 — tarballs get treated as outdated if they're older than the number of seconds you hand over here. So like, the tarball goes past its prime and the whole thing gets a vibe check. ⏳

Wanna just… turn the whole check off? Give it a negative value and this check is completely disabled. Periodt.

Default:

$unshare_mmdebstrap_max_age = 604800;

UNSHARE_MMDEBSTRAP_DISTRO_MANGLE

ARRAY:STRING type, bestie. So here's the tea: the distro you're building for might lowkey just be an overlay of another distro. Like, if you're building for stable-backports, what you actually want is a stable chroot with backports piled on top. Same energy with experimental — you want an unstable chroot and then experimental sprinkled on top of that. This option lets you do exactly that name mangling, from distro name to the base distro you actually want. 🎀

The option array is given as substitution pairs. The first regex that matches gets applied and every remaining regex is skipped, periodt. If you actually want to define an alias of one name to another — like the aliases schroot configuration option, or symlinks in unshare mode — use the $chroot_aliases option instead. And why is this an array instead of a hash? Because order matters, babe. The entries have to go in order. 💅

Example:

$unshare_mmdebstrap_distro_mangle = [qr/(.*)-armhf$/ => '$1-arm64'];

Default:

$unshare_mmdebstrap_distro_mangle = [
                                      qr/^(experimental|rc-buggy|unreleased|UNRELEASED.*)$/,
                                      'unstable',
                                      qr/^(.*)-(security|backports|backports-sloppy|proposed|proposed-updates|updates)$/,
                                      '$1'
                                    ];

Core options

BUILD_USER

STRING type. The username used for running dpkg-buildpackage. By default the user running sbuild — and sbuild itself for the unshare mode — gets used inside the chroot too. Which sounds innocent but is actually a whole thing: it might let a process inside the chroot break out of the chroot by attaching to a process running outside the chroot with, say, gdb, and then becoming root inside the chroot through schroot, and boom — it's out. 😭

build_user = ...;

BUILD_DIR

STRING type. This is the output directory for the build artifacts that dpkg-buildpackage makes, plus the log file. Defaults to the current directory if you don't specify anything. It's used as the location of chroot symlinks (obsolete, girl) and for current build log symlinks and some build logs. There is no default — if you leave it unset, it defaults to the current working directory. $HOME/build is another super common configuration. ✨

Related sbuild(1) command line options:

  • --build-dir

Example:

$build_dir = '/home/pete/build';
build_dir = ...;

SBUILD_MODE

STRING type. sbuild's behaviour. Possible values are "user" (exit status reports build failures) and "buildd" (exit status does not report build failures) for use in a buildd setup. Heads up: "buildd" also currently implies enabling "legacy features" like chroot symlinks in the build directory and the creation of current symlinks in the build directory. 👑

Related sbuild(1) command line options:

  • --sbuild-mode

Default:

$sbuild_mode = 'user';

ENVIRONMENT_FILTER

ARRAY:STRING type. Only environment variables that match one of the regular expressions in this arrayref get passed through to dpkg-buildpackage and the other programs sbuild runs. The default here is the list of variable names returned by Dpkg::BuildInfo::get_build_env_allowed() — which is also the list of variable names whitelisted to be recorded in .buildinfo files. 🔥

Caution, bestie: the default value listed below was grabbed from the dpkg Perl library version that was available when this man page got generated. If your dpkg Perl library version is different, it might be different too. Don't come for me. 💀

Example:

# Setting the old environment filter
$environment_filter = ['^PATH$',
               '^DEB(IAN|SIGN)?_[A-Z_]+$',
               '^(C(PP|XX)?|LD|F)FLAGS(_APPEND)?$',
               '^USER(NAME)?$',
               '^LOGNAME$',
               '^HOME$',
               '^TERM$',
               '^SHELL$'];
# Appending FOOBAR to the default
use Dpkg::BuildInfo;
$environment_filter = [(sort (map "^$_\$",
Dpkg::BuildInfo::get_build_env_allowed())), '^FOOBAR$'];
# Removing FOOBAR from the default
use Dpkg::BuildInfo;
$environment_filter = [ sort (map /^FOOBAR$/ ? () : "^$_\$",
Dpkg::BuildInfo::get_build_env_allowed()) ];

Default:

$environment_filter = [
                        '^AR$',
                        '^ARFLAGS$',
                        '^AS$',
                        '^ASFLAGS$',
                        '^ASFLAGS_FOR_BUILD$',
                        '^AWK$',
                        '^CC$',
                        '^CFLAGS$',
                        '^CFLAGS_FOR_BUILD$',
                        '^CPP$',
                        '^CPPFLAGS$',
                        '^CPPFLAGS_FOR_BUILD$',
                        '^CXX$',
                        '^CXXFLAGS$',
                        '^CXXFLAGS_FOR_BUILD$',
                        '^DATEMSK$',
                        '^DEB_BUILD_OPTIONS$',
                        '^DEB_BUILD_PROFILES$',
                        '^DEB_VENDOR$',
                        '^DFLAGS$',
                        '^DFLAGS_FOR_BUILD$',
                        '^DPKG_ADMINDIR$',
                        '^DPKG_DATADIR$',
                        '^DPKG_GENSYMBOLS_CHECK_LEVEL$',
                        '^DPKG_ORIGINS_DIR$',
                        '^DPKG_ROOT$',
                        '^FC$',
                        '^FFLAGS$',
                        '^FFLAGS_FOR_BUILD$',
                        '^GCONV_PATH$',
                        '^GETCONF_DIR$',
                        '^GNUMAKEFLAGS$',
                        '^I18NPATH$',
                        '^LANG$',
                        '^LANGUAGE$',
                        '^LC_ADDRESS$',
                        '^LC_ALL$',
                        '^LC_COLLATE$',
                        '^LC_CTYPE$',
                        '^LC_IDENTIFICATION$',
                        '^LC_MEASUREMENT$',
                        '^LC_MESSAGES$',
                        '^LC_MONETARY$',
                        '^LC_NAME$',
                        '^LC_NUMERIC$',
                        '^LC_PAPER$',
                        '^LC_TELEPHONE$',
                        '^LC_TIME$',
                        '^LD$',
                        '^LDFLAGS$',
                        '^LDFLAGS_FOR_BUILD$',
                        '^LD_ASSUME_KERNEL$',
                        '^LD_AUDIT$',
                        '^LD_BIND_NOT$',
                        '^LD_BIND_NOW$',
                        '^LD_DYNAMIC_WEAK$',
                        '^LD_LIBRARY_PATH$',
                        '^LD_ORIGIN_PATH$',
                        '^LD_PREFER_MAP_32BIT_EXEC$',
                        '^LD_PRELOAD$',
                        '^LEX$',
                        '^LFLAGS$',
                        '^LOCPATH$',
                        '^M2C$',
                        '^MAKE$',
                        '^MAKEFLAGS$',
                        '^NLSPATH$',
                        '^OBJC$',
                        '^OBJCFLAGS$',
                        '^OBJCFLAGS_FOR_BUILD$',
                        '^OBJCXX$',
                        '^OBJCXXFLAGS$',
                        '^OBJCXXFLAGS_FOR_BUILD$',
                        '^PC$',
                        '^POSIXLY_CORRECT$',
                        '^RANLIB$',
                        '^RESOLV_HOST_CONF$',
                        '^RESOLV_MULTI$',
                        '^RESOLV_REORDER$',
                        '^RES_OPTIONS$',
                        '^SOURCE_DATE_EPOCH$',
                        '^TZ$',
                        '^TZDIR$',
                        '^YACC$',
                        '^YFLAGS$'
                      ];

BUILD_ENVIRONMENT

HASH:STRING type. The environment to set during the build. Defaults to setting PATH and LD_LIBRARY_PATH only. 🌸 Note that these environment variables are not subject to filtering with ENVIRONMENT_FILTER — they skip the line entirely, iykyk. Example:

Example:

$build_environment = {
        'CCACHE_DIR' => '/build/cache'
};

Default:

$build_environment = {};

BATCH_MODE

BOOL type. Enable batch mode? Slay or nah. 💅

Related sbuild(1) command line options:

  • -b
  • --batch

Default:

$batch_mode = 0;

CORE_DEPENDS

ARRAY:STRING type. Packages which absolutely must be installed in the chroot for all builds. The non-negotiables. 👑

Default:

$core_depends = [
                  'build-essential:native'
                ];

MANUAL_DEPENDS

ARRAY:STRING type. Additional per-build dependencies.

Related sbuild(1) command line options:

  • --add-depends

Default:

$manual_depends = [];

MANUAL_CONFLICTS

ARRAY:STRING type. Additional per-build dependencies.

Related sbuild(1) command line options:

  • --add-conflicts

Default:

$manual_conflicts = [];

MANUAL_DEPENDS_ARCH

ARRAY:STRING type. Additional per-build dependencies.

Related sbuild(1) command line options:

  • --add-depends-arch

Default:

$manual_depends_arch = [];

MANUAL_CONFLICTS_ARCH

ARRAY:STRING type. Additional per-build dependencies.

Related sbuild(1) command line options:

  • --add-conflicts-arch

Default:

$manual_conflicts_arch = [];

MANUAL_DEPENDS_INDEP

ARRAY:STRING type. Additional per-build dependencies.

  • Related sbuild(1) command line options:
    • --add-depends-indep

Default:

$manual_depends_indep = [];

🌸 MANUAL_CONFLICTS_INDEP 🌸

ARRAY:STRING type, no cap. It's your additional per-build dependencies — like, extra stuff you want in the mix for this specific build.

  • Related sbuild(1) command line options:
    • --add-conflicts-indep

Default:

$manual_conflicts_indep = [];

💖 ARCHIVE 💖

STRING type. This is the archive being built. Heads up though — it's only set in the build log, it doesn't do anything else. It might be useful for derivative distributions. iykyk.

  • Related sbuild(1) command line options:
    • --archive

Default:

$archive = undef;

🎀 JOB_FILE 🎀

STRING type. The job status file — only used in batch mode, bestie, so if you're not batching it's just vibing there unused.

Default:

$job_file = 'build-progress';

🧚 Dependency resolution 🧚

👑 BUILD_DEP_RESOLVER 👑

STRING type. The build dependency resolver. The 'apt' resolver is currently the default, and honestly it's recommended for most users. This resolver uses apt-get to resolve dependencies.

Alternative resolvers are 'apt', 'aptitude' and 'aspcud'. So yes, 'apt' shows up in both lists, that's just how it is 💅.

  • The 'apt' resolver uses a built-in resolver module.
  • The 'aptitude' resolver uses aptitude to resolve build dependencies. It's similar to apt, but it's useful in more complex situations — like where multiple distributions are required, for example when building from experimental, where packages are needed from both unstable and experimental, but defaulting to unstable.
  • If the dependency situation is too complex for either apt or aptitude to solve it, you can use the 'aspcud' resolver, which (in contrast to apt and aptitude) is a real solver (in the math sense) and will thus always find a solution if a solution exists. periodt.
  • Additionally, the 'null' solver is provided. It's a dummy resolver which does not install, upgrade or remove any packages. This allows one to completely control package installation via hooks.
  • Related sbuild(1) command line options:
    • --build-dep-resolver

Default:

$build_dep_resolver = 'apt';

⭐ ASPCUD_CRITERIA ⭐

STRING type. Optimization criteria in extended MISC 2012 syntax passed to aspcud through apt-cudf.

Here's the tea 🫖: optimization criteria are separated by commas, sorted by decreasing order of priority, and are prefixed with a polarity (+ to maximize and - to minimize).

The default criteria is '-removed,-changed,-new' which:

  1. first minimizes the number of removed packages,
  2. then the number of changed packages (up or downgrades),
  3. and then the number of new packages.

A common task is to minimize the number of packages from experimental. To do this you can add a criteria like '-count(solution,APT-Release:=/a=experimental/)' to the default criteria. This will then minimize the number of packages in the solution which contain the string 'a=experimental' in the 'APT-Release' field of the EDSP output created by apt. See the apt-cudf man page help on the --criteria option for more information.

  • Related sbuild(1) command line options:
    • --aspcud-criteria

Default:

$aspcud_criteria = '-removed,-changed,-new';

🦋 RESOLVE_ALTERNATIVES 🦋

BOOL type. Should the dependency resolver use alternatives in Build-Depends, Build-Depends-Arch and Build-Depends-Indep?

By default, using 'apt' resolver, only the first alternative will be used; all other alternatives will be removed. When using the 'aptitude' resolver, it will default to using all alternatives.

👀 Note that this does not include architecture-specific alternatives, which are reduced to the build architecture prior to alternatives removal.

This should be left disabled when building for unstable; it may be useful when building for experimental or backports.

Set to undef to use the default, 1 to enable, or 0 to disable.

  • Related sbuild(1) command line options:
    • --resolve-alternatives
    • --no-resolve-alternatives

Example:

$resolve_alternatives = 0;

Default:

$resolve_alternatives = undef;

🌈 EXTRA_PACKAGES 🌈

ARRAY:STRING type. Additional per-build packages available as build dependencies.

  • Related sbuild(1) command line options:
    • --extra-package

Default:

$extra_packages = [];

💜 EXTRA_REPOSITORY_KEYS 💜

ARRAY:STRING type. Additional per-build apt repository keys.

  • Related sbuild(1) command line options:
    • --extra-repository-key

Default:

$extra_repository_keys = [];

🍓 EXTRA_REPOSITORIES 🍓

ARRAY:STRING type. Additional per-build apt repositories.

  • Related sbuild(1) command line options:
    • --extra-repository

Default:

$extra_repositories = [];

💀 BD_UNINSTALLABLE_EXPLAINER 💀

STRING type. Method to use for explaining build dependency installation failures. Possible value are "dose3" (default), "apt" and "none".

Set to "none", the empty string "" or Perl undef to disable running any explainer.

  • Related sbuild(1) command line options:
    • --bd-uninstallable-explainer

Default:

$bd_uninstallable_explainer = 'dose3';

✨ Logging options ✨

🌸 VERBOSE 🌸

NUMERIC type. Verbose logging level.

Default:

$verbose = 0;

🎀 DEBUG 🎀

NUMERIC type. Debug logging level.

Default:

$debug = 0;

🫶 NOLOG 🫶

BOOL type. Disable use of log file. fr fr, no log for you.

  • Related sbuild(1) command line options:
    • -n
    • --nolog

Default:

$nolog = 0;

🌟 LOG_DIR 🌟

STRING type. Directory for storing build logs.

This defaults to '.' when SBUILD_MODE is set to 'user' (the default), and to '$HOME/logs' when SBUILD_MODE is set to 'buildd'.

Default:

$log_dir = undef;

🦋 LOG_FILENAME_TIMESTAMP_FORMAT 🦋

STRING type. Set the format of the timestamp used in the build log filename.

  • Related sbuild(1) command line options:
    • --log-filename-ts-format

Default:

$log_filename_timestamp_format = '%FT%TZ';

🌈 LOG_COLOUR 🌈

BOOL type. Add colour highlighting to interactive log messages (informational, warning and error messages).

Heads up bestie: log files will not be coloured. Only the interactive ones get the glow-up 💅

Default:

$log_colour = 1;

⭐ LOG_FILTER ⭐

BOOL type. Filter variable strings from log messages such as the chroot name and build directory.

Default:

$log_filter = 0;

💖 LOG_HIDDEN_SECTIONS 💖

ARRAY:STRING type. Log sections to prevent from being printed to standard output.

Supported section names that can be hidden are: postbuild, cleanup, changes, buildinfo, contents and summary.

  • Related sbuild(1) command line options:
    • --hide-log-sections

Default:

$log_hidden_sections = [];

👑 MAILTO 👑

STRING type. email address to mail build logs to.

  • Related sbuild(1) command line options:
    • --mail-log-to

Default:

$mailto = '';

🧚 MAILTO_HASH 🧚

HASH:STRING type. Like MAILTO, but per-distribution. This is a hashref mapping distribution name to MAILTO.

📌 Note that for backward compatibility, this is also settable using the hash %mailto (deprecated), rather than a hash reference.

Default:

$mailto_hash = {};

💌 MAILFROM 💌

STRING type. email address set in the From line of build logs.

  • Related sbuild(1) command line options:
    • --mailfrom

Default:

$mailfrom = 'Source Builder <sbuild>';

🎁 COMPRESS_BUILD_LOG_MAILS 🎁

BOOL type. Should build log mails be compressed?

Default:

$compress_build_log_mails = 1;

🎊 MIME_BUILD_LOG_MAILS 🎊

BOOL type. Should build log mails be MIME encoded?

Default:

$mime_build_log_mails = 1;

💅 Maintainer options 💅

🌟 MAINTAINER_NAME 🌟

STRING type. Name to use as override in .changes files for the Maintainer field.

The Maintainer field will not be overridden unless set here.
  • Related sbuild(1) command line options:
    • -m
    • --maintainer

Default:

$maintainer_name = undef;

🦋 UPLOADER_NAME 🦋

STRING type. Name to use as override in .changes file for the Changed-By: field.

  • Related sbuild(1) command line options:
    • -e
    • --uploader

Default:

$uploader_name = undef;

🔑 KEY_ID 🔑

STRING type. Key ID to use in .changes for the current upload. It overrides both $maintainer_name and $uploader_name. main character energy, honestly.

  • Related sbuild(1) command line options:
    • -k
    • --keyid

Default:

$key_id = undef;

🌈 Multiarch support (transitional) 🌈

💜 CROSSBUILD_CORE_DEPENDS 💜

HASH:ARRAY:STRING type. Per-architecture dependencies required for cross-building.

By default, if a Debian architecture is not found as a key in this hash, the following will be added to the Build-Depends: crossbuild-essential-${hostarch}:native, libc-dev, libstdc++-dev. The latter two are to work around bug #815172.

Example:

$crossbuild_core_depends = {
    nios2 => ['crossbuild-essential-nios2:native', 'special-package'],
    musl-linux-mips => ['crossbuild-essential-musl-linux-mips:native', 'super-special'],
};

Default:

$crossbuild_core_depends = {};

🛠️ Programs 🛠️

📬 MAILPROG 📬

STRING type. Program to use to send mail.

Default:

$mailprog = '/usr/sbin/sendmail';

🔥 SUDO 🔥

STRING type. Path to sudo binary.

Default:

$sudo = 'sudo';

🏰 SCHROOT 🏰

STRING type. Path to schroot binary.

Default:

$schroot = 'schroot';

⚙️ SCHROOT_OPTIONS ⚙️

ARRAY:STRING type. Additional command-line options for schroot.

Default:

$schroot_options = [
                     '-q'
                   ];

🧪 AUTOPKGTEST_VIRT_SERVER 🧪

STRING type. Path to autopkgtest-virt-* binary, selecting the virtualization server.

  • Related sbuild(1) command line options:
    • --autopkgtest-virt-server

Default:

$autopkgtest_virt_server = 'autopkgtest-virt-schroot';

AUTOPKGTEST_VIRT_SERVER_OPTIONS

<span style="color:purple">ARRAY:STRING</span> type, bestie — it's a whole list of strings, not just one lil guy. Extra command-line options you wanna hand over to autopkgtest-virt-* 🧚

Related sbuild(1) command line options:

  • --autopkgtest-virt-server-opt
  • --autopkgtest-virt-server-opts

Default:

$autopkgtest_virt_server_options = [];

APT_GET

STRING type. Where the apt-get binary is chillin' 💅

Default:

$apt_get = 'apt-get';

APT_CACHE

STRING type. Path to the apt-cache binary, no cap.

Default:

$apt_cache = 'apt-cache';

APTITUDE

STRING type. Path to the aptitude binary. yes she still exists and she's still iconic 🎀

Default:

$aptitude = 'aptitude';

XAPT

STRING type.

Default:

$xapt = 'xapt';

DPKG_BUILDPACKAGE_USER_OPTIONS

ARRAY:STRING</purl> — a list of strings, slay. Extra command-line options for dpkg-buildpackage 🔥

Related sbuild(1) command line options:

  • --debbuildopt
  • --debbuildopts
  • --jobs

Default:

$dpkg_buildpackage_user_options = [];

DPKG_FILE_SUFFIX

STRING type. The suffix that gets added to filenames for files generated by dpkg-buildpackage ✨

Related sbuild(1) command line options:

  • --dpkg-file-suffix

Default:

$dpkg_file_suffix = '';

DPKG_SOURCE

STRING type. Path to the dpkg-source binary 🦋

Default:

$dpkg_source = 'dpkg-source';

DPKG_SOURCE_OPTIONS

ARRAY:STRING type. Extra command-line options for dpkg-source 💖

Related sbuild(1) command line options:

  • --dpkg-source-opt
  • --dpkg-source-opts

Default:

$dpkg_source_opts = [];

📊 Statistics 📊

STATS_DIR

STRING type. The directory where build statistics get written to. receipts, but make it nerd data 📈

Related sbuild(1) command line options:

  • --stats-dir
stats_dir = ...;

📁 FILES 📁

  • /etc/sbuild/sbuild.conf — the system configuration, maintained by the system administrator. This may be used to override the defaults — so she has main character energy over your defaults, respectfully 💅
  • ~/.sbuildrc — your own user-specific configuration, just for you bestie 🫶

👑 AUTHORS 👑

Roman Hodek <Roman.Hodek@informatik.uni-erlangen.de>.

sbuild is based on debbuild, written by James Troup <james@nocrew.org> and has been modified by:

  • Ben Collins <bcollins@debian.org>
  • Ryan Murray <rmurray@debian.org>
  • Francesco Paolo Lovergine <frankie@debian.org>
  • Michael Banck <mbanck@debian.org>
  • Roger Leigh <rleigh@debian.org>
Copyright © 1998-2000 Roman Hodek <roman@hodek.net>
Copyright © 1998-1999 James Troup <troup@debian.org>
Copyright © 2003-2006 Ryan Murray <rmurray@debian.org>
Copyright © 2001-2003 Rick Younie <younie@debian.org>
Copyright © 2003-2004 Francesco Paolo Lovergine <frankie@debian.org>
Copyright © 2005      Michael Banck <mbanck@debian.org>
Copyright © 2005-2009 Roger Leigh <rleigh@debian.org>

👀 SEE ALSO 👀

sbuild(1).

and that's the whole page bestie, you read every single line and I'm so proud 😭💖 this was SBUILD.CONF(5), Version 0.91.10ubuntu1, dated 29 June 2026 — go forth and configure, you ate periodt 🌈✨

📦 where this page comes from