Colin Walters [Sun, 23 Jul 2023 14:40:20 +0000 (10:40 -0400)]
generator: Stop creating `/run/ostree-booted`
This must have always been dead code. We're trying to iterate
towards a place where it's only `ostree-prepare-root.c` which
parses the `ostree=` kernel argument, and canonically sets up
`/run/ostree-booted`.
Colin Walters [Sat, 22 Jul 2023 19:31:52 +0000 (15:31 -0400)]
composefs: Use lowerdir in /run
I just noticed that this was another constant string duplicated
between prepare-root.c and libostree-1.so, and I went to make
it a common `#define` in libotcore.la.
But then I thought "it's ugly to have this directory mixed into
the deployment namespace" because in some theoretical world
it could also be in the ostree commit, which would cause weird
behavior.
I think this is transient state that is better in `/run`, so move
it there.
Colin Walters [Thu, 20 Jul 2023 13:13:43 +0000 (09:13 -0400)]
Add an always-on `inode64` feature
As I (and others) will be backporting the fix in
https://github.com/ostreedev/ostree/pull/2874/commits/de6fddc6adee09a93901243dc7074090828a1912
pretty far, I want a way for sysadmins and OS builders to
be able to reliably see when their version of ostree has this fix
(Because comparing version numbers isn't portable).
Eric Curtin [Thu, 20 Jul 2023 10:32:30 +0000 (11:32 +0100)]
bootloader: fold all Android Bootloader specific logic into prepare-root
Now that we use androidboot.slot_suffix karg to determine whether we
boot into /ostree/root.a or /ostree/root.b, we can use ostree= karg
simply for parsing the stateroot, although we will still boot into
what's pointed to by /ostree/root.a or /ostree/root.b.
Colin Walters [Wed, 19 Jul 2023 13:13:53 +0000 (09:13 -0400)]
prepare-root: Drop more dead code
Most of this was used for the old composefs signature model. We
now reuse the core signature code and link to glib, so we don't
need reimplementations of hex strings and reading files.
Colin Walters [Mon, 17 Jul 2023 17:48:35 +0000 (13:48 -0400)]
generator: Deduplicate ostree= karg parsing
Avoid having two copies of a regular expression for parsing
the `ostree=` kernel argument. Because the `ostree-system-generator`
binary already has access to the internals because it's implemented
in the shared library, expose the sysroot version internally
and use that.
Motivated by an attempt to change one of these copies but not
the other.
Colin Walters [Tue, 18 Jul 2023 11:54:03 +0000 (07:54 -0400)]
sign-ed25519: Don't set sk unless we've validated it
The semantics of this function now keep the key assigned
even if we fail to validate it, which is ugly. Only assign
the key after verifying its length.
Eric Curtin [Mon, 17 Jul 2023 12:22:49 +0000 (13:22 +0100)]
android-boot: Remove dependency on ostree= karg, use androidboot.slot_suffix=
Given the kernel argument androidboot.slot_suffix= is required in
Android AB updates [1] there is no need to check for ostree= or ostree=aboot
at all in the aboot case. This also ensures if the dependancy on ostree=
is removed, the android-boot technique will work regardless.
Colin Walters [Fri, 14 Jul 2023 23:20:45 +0000 (19:20 -0400)]
commit: Add `--sign-from-file`
Passing the private key via a direct command line argument
is just a bad idea because it's highly likely to get logged
or appear in `ps`.
Spotted in review of work for composefs signatures.
Colin Walters [Thu, 13 Jul 2023 20:37:41 +0000 (16:37 -0400)]
prepare-root: Refactor composefs config handling
- Convert the current enum into a struct, using `OtTristate` and
two member variables (expected signature and digest)
- Factor out a helper function to parse this config
- Clean up the logging by consistently using `composefs:` as a prefix
- Add more assertions to more strictly verify our runtime state
since this is security relevant
Colin Walters [Thu, 13 Jul 2023 11:47:32 +0000 (07:47 -0400)]
remount: Use new metadata in `/run/ostree-booted` for composefs
Since we now have a generalized more structured way of serializing
state in the initramfs instead of "stamp files", use it for
passing the composefs state.
Colin Walters [Wed, 12 Jul 2023 20:48:56 +0000 (16:48 -0400)]
prepare-root: Add metadata for composefs to `/run/ostree-booted`
Particularly for the signature case, having this metadata
acts as a reliable "proof of execution" of the signature verification
code (as opposed to parsing a log file or so).
Besides that, this is also just a stronger check for "we're using
composefs" instead of checking for "overlayfs on /".
Colin Walters [Tue, 11 Jul 2023 18:09:42 +0000 (14:09 -0400)]
build: Drop `make syntax-check`
As of lately it emits a ton of errors from `grep` about having `*`
at the start of a line, but more generally it's only generally
found papercut-style issues that aren't worth carrying a distinct
checking system for.
ostree-prepare-root: Validate ed25519 signatures when requested
If requested, by specifying ot-composefs=signed=/path/to/pub.key then
the commit object is validated against the specified ed25519 public
key, and if valid, the composefs digest from the commit object is used
to ensure we boot the right digest.
Colin Walters [Fri, 7 Jul 2023 20:31:58 +0000 (16:31 -0400)]
Factor out a libotcore
This will contain logic shared between ostree-prepare-root
and libostree-1.so. It will just link to libgio.so, so as
to avoid pulling in e.g. libcurl and other things.
In other words, `ostree-prepare-root` will not link to `libostree-1.so`,
but will pull in just what it needs from this library.
The checksum utils uses the crypto lib, but we're not explicitly linking
to it. I think this is why the CI got this error when using openssl
on debian, during ostree binary linking:
/usr/bin/ld: ./.libs/libotutil.a(libotutil_la-ot-checksum-utils.o): undefined reference to symbol 'EVP_DigestInit_ex@@OPENSSL_3.0.0'
/usr/bin/ld: /lib/x86_64-linux-gnu/libcrypto.so.3: error adding symbols: DSO missing from command line
collect2: error: ld returned 1 exit status
This adds some defines for ed25519 key sizes and drops uses
of the libsodium defines for these, as well as replacing sodium_bin2hex
use with ot_bin2hex. Some code that wes optionally built before are now
always built.
The goal for this is to support both libsodium and openssl.
Also fixes return value of _load_pk_from_stream(). It used
to always return FALSE.
- Was using the wrong metadata key
- We were missing setting the canonical commit args which assigns
e.g. owner uid 0, which is important for reproducibility
- Use the new --print-hex to make things easier to read
Colin Walters [Thu, 29 Jun 2023 06:42:04 +0000 (02:42 -0400)]
fetcher: Always open tmpfiles in repo (except on FUSE)
This reverts commit 4e61e6f7d0d6aebd6abcdc455ec53164afe39e8d
and re-instates the fix for ensuring that we download temporary
files into the repository location.
However in order to ensure we don't re-introduce
https://github.com/ostreedev/ostree/issues/2900
we detect the case where we're writing to a FUSE mount
and keep the prior behavior.
I've verified that this works with flatpak.
Note a downside of this is the change needs to be triplicated
across the 3 http backends.
This then again Closes: https://github.com/ostreedev/ostree/issues/2571
Colin Walters [Wed, 21 Jun 2023 17:25:52 +0000 (13:25 -0400)]
prepare-root: Link to glib
Since we've split off the "prepare root as init" code
into a separate file, we can now use glib to parse
the config file again, which is a lot less hacky.
This is particularly motivated by composefs, where
we want to do more in the initramfs. Future patches
may also link to parts of libostree.
Colin Walters [Sat, 17 Jun 2023 14:05:22 +0000 (10:05 -0400)]
Separate prepare-root static path
We should have done this a long time ago. We don't have any test
coverage for the no-initramfs path, and I think it's not long
term supportable as we want to add more features like composefs.
Particularly now that there's good support for embedding an
initramfs in a kernel image, I see little value in a path for
having custom static linking for this prepare root flow.
That said, we will continue to make a best-effort "it compiles"
attempt to support it.
Fork the "pid 1" prepare root code into a new
`ostree-prepare-root-static.c` file, and drop the runtime conditionals.
We can drop the composefs logic from `-static.c` which ends up
keeping that file much smaller.
A further next step here will be to actually fold the
`prepare-root.c` logic into the main `ostree` binary which we
can then just include in the initramfs.
Colin Walters [Tue, 27 Jun 2023 10:59:51 +0000 (06:59 -0400)]
test-composefs: Sync flow with other tests
I am not sure why this is failing on older Debian systems,
but I'm wildly guessing that something being done in `libtest.sh`
is setting up automake in a way that we need. This is done
in other tests.
Or maybe it's the missing `$CMD_PREFIX`? Let's see...
Colin Walters [Wed, 28 Jun 2023 15:45:15 +0000 (11:45 -0400)]
Fix return value of generator on non-ostree systems
Commit aa72caffb540114a0e8635ab2990b9c8b0b8f9db
regressed the `ostree-system-generator` on non-ostree systems.
If there's no `ostree=` karg, we need to just exit 0.
Colin Walters [Tue, 27 Jun 2023 09:27:23 +0000 (05:27 -0400)]
ci/prow: Build tests before trying to install
Our `install` target doesn't depend on `all` unlike the
rpm-ostree version; not doing so is arguably better, so let's
explicitly build before installing.
projects / ostree.git / log