[reyreavman]

Summary

A stapel image with import: fails to build under build.sbom.enable: true with the Docker backend: the dependencies* stage dies with rsync: failed to connect to <import-server ip>: Network unreachable (101), is retried once "in a clean container after a transport failure" and fails again with container run failed: exit code 10. Repro from a clean checkout:

project: demo
configVersion: 1
build:
  sbom:
    enable: true
    standard: cyclonedx@1.6
---
image: donor
from: alpine:3.20
---
image: app
from: alpine:3.20
import:
- image: donor
  add: /etc/os-release
  to: /donor/os-release
  before: install

WERF_BUILDAH_MODE=docker werf build

What

• Under build.sbom.enable: true with the Docker backend the dependencies* (import) stages run with the backend's default network again and the import completes; previously they ran with --network=none.
• Shell stages (beforeInstall, install, beforeSetup, setup) still run with --network=none under build.sbom.enable: true, and --backend-network / werf.yaml network: still cannot open them.
• The packages stage is unchanged: it keeps the network it had.
• build.sbom.enable: false is unchanged: no stage gets a network override.
• The "Network is disabled for shell stages" warning is unchanged.
• Stage digests are unchanged, so already built stages are reused.

Why

With build.sbom.enable: true the isolation code marks every stage except packages as network-less, dependencies* included. Until 09f22e7 that mark never reached the import container: only BaseStage.PrepareImage applied it and DependenciesStage.PrepareImage bypasses that path, so the write was dead and imports worked. 09f22e7 made the build phase forward a stage's own network override into the builder for every stage — to keep the sign stages closed against --backend-network — which turned the dead write live. Under the Docker backend an import is an rsync from the import-server container over the bridge network, so a network-less import stage cannot succeed.

Leaving the import stage network-less buys nothing for the SBOM: the stage carries no shell: commands and copies files out of an image that import: already declares and whose BOM the importing image already inherits. Marking the dependencies* stages as needing network, the way packages already is, keeps shell stages offline and lets imports work.

Rejected: special-casing the import stages inside the build phase's option merge — the exemption belongs where packages is exempted, so one rule decides which stages the SBOM isolation leaves alone.

Fixes: 09f22e7 ("feat(build, stapel): sign files inside the image with a key the build container never sees")

[reyreavman]

Verification

• task test:e2e paths=./test/e2e/sbom labelFilter=pip parallel=1 -- -focus="marks a package of the donor" (Docker backend, Linux host with kind registry): fails on main with the rsync Network unreachable (101) transport error, passes with this branch — 1 of 75 specs, 98 s.
• task test:e2e paths=./test/e2e/build labelFilter=managed-deps parallel=1 (Docker backend, same host): both specs pass — sbom.enable=true still enforces --network=none on shell stages, sbom.enable=false still does not.
• Mutation: reverted newDependenciesStage to pass the base options through unchanged → DependenciesStage needs network regardless of the base options fails for all four stage names, and all four entries of network isolation under build.sbom.enable fail on the import stage's network expecting empty, getting none.

Review focus

• The exemption is decided by NeedsNetwork(), the same predicate the SBOM isolation already uses for packages; confirm no other consumer of that predicate gives the import stage something beyond skipping the override.