Colin Walters [Thu, 26 Jun 2025 11:48:38 +0000 (07:48 -0400)]
Import jsonwrt code from util-linux
We've had a longstanding need to emit JSON to be friendlier
to shell scripting tools.
I hesitated for (way too long) on which JSON libraries to
use, but actually since we don't need to *parse* JSON,
we only need to omit it, the problem domain is super
simple.
Colin Walters [Tue, 24 Jun 2025 20:08:29 +0000 (16:08 -0400)]
prepare-root: Move metadata for deployment into otcore
- Rename `mount_composefs` to `mount_rootfs` to make a little clearer
what it does; even though if the rootfs is not composefs we don't
do anything before.
- But do always unconditionally update the metadata builder with
the device/inode
Colin Walters [Fri, 30 May 2025 20:14:36 +0000 (16:14 -0400)]
ci: Rework Dockerfile, add Justfile and improved testing
- Move the Dockerfile to the toplevel as a primary dev entrypoint
- The Justfile is intended especially for agentic AI like
block/goose or Claude Code as an allowlistable-command entrypoint
- Include attempt at incremental build caching, partially defeated
by autotools
- Add new tests-unit-container that tests ostree-prepare-root in
a container
Samuel Zeter [Wed, 21 May 2025 00:49:48 +0000 (10:49 +1000)]
tests: remove unused import
Fixes:
warning: unused import: `with_procspawn_tempdir::with_procspawn_tempdir`
--> src/test.rs:11:9
|
11 | pub use with_procspawn_tempdir::with_procspawn_tempdir;
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
help: if this is a test module, consider adding a `#[cfg(test)]` to the containing module
--> src/insttestmain.rs:9:1
|
9 | mod test;
| ^^^^^^^^^
= note: `#[warn(unused_imports)]` on by default
Colin Walters [Sun, 6 Apr 2025 21:24:26 +0000 (17:24 -0400)]
sysroot: Detect early on when /boot is on vfat
We do want to support this (as part of supporing the
Boot Loader Spec) but because we use symlinks in `/boot`,
can't yet.
Error out very early on consistently if we detect
vfat for /boot, but also add a member variable to keep track
of this in preparation for supporting it.
Colin Walters [Wed, 30 Apr 2025 12:30:05 +0000 (08:30 -0400)]
tests/prune: Ensure /boot is big enough for 3 bootdata
The size of kernel+initramfs (bootdata) for FCOS has crept up
enough that it's *always* triggering this path, which perturbs
the test into incorrectly triggering early prune.
If we detect that /boot is too small, allocate a new loopback-mounted
copy.
Basically when run via a non-static prepareroot we create
`/run/ostree-booted` consistently in the initramfs,
using the kernel argument presence as source of truth.
But for the static prepareroot, the generator checked
the kernel argument, and had a fallback of creating it.
Except that's busted in the case of running in a
container, where with many runtimes we still
default to seeing the host's commandline (which
is basically wrong...but fixing that requires a
userspace virtualizer/interceptor for `/proc`
so it's not commonly done).
This should fix the static prepareroot path
by detecting the case where we're compiled
with a static prepareroot, and if so we then
hardcode creating the `/run/ostree-booted`
file in the generator. I think basically
everyone who is compiling ostree with
a static prepareroot *and* including it
in their filesystem trees can be pretty
much guaranteed to be actually using it.
Colin Walters [Tue, 8 Apr 2025 19:52:11 +0000 (19:52 +0000)]
sysroot: Load bootloader configs via boot_fd
This was a general principle cleanup, preparation
for handling VFAT for /boot for systemd-boot/BLS
support.
However I ran into an ugly corner case in our
unit tests that pointed at a sysroot without a
boot directory. The previous logic handled
ENOENT for boot/loader but not /boot.
Continue to cope with that degenerate situation.
Colin Walters [Thu, 20 Mar 2025 16:47:48 +0000 (12:47 -0400)]
unlock: Use deployment backing dir
Closes: https://github.com/ostreedev/ostree/issues/3391
Basically it's not uncommon to make `/var/tmp` a separate
partition, but this constrains the amount of data that
can be written to `/usr` when unlocking.
Change things here to write to the deployment's backing
dir which is part of the same rootfs as the storage
and is lifecycle bound to the deployment, ensuring
it gets GC'd.
Daiki Ueno [Mon, 24 Mar 2025 12:25:12 +0000 (21:25 +0900)]
Fix build error with --with-ed25519-libsodium and --with-openssl
While libotcore can be configured with those options individually, the
latter is always required for OpenSSL's EVP functions. This splits the
ifdefs to accommodate that.
Colin Walters [Fri, 21 Mar 2025 12:11:50 +0000 (08:11 -0400)]
tests/auto-prune: Don't go negative
- First I kept wondering what the magic of 10000 was here before
looking above and noticing it matched the number of dtb files.
Make a shared variable so the connection is more obvious
- Next, I *believe* the intention of this test was to test
the edge case of bytes vs blocks, but we ended up subtracting
blocks and I think recent FCOS images happened to get small
enough that we started going negative here.
Fix this to convert the bytes into blocks.
sign: Support generic "spki" type of commit signatures
The current "ed25519" signing type assumes raw Ed25519 key format for
both public and private keys. This patch generalizes it by adding a
new signature type "spki" which uses the X.509 SubjectPublicKeyInfo
format for public keys. Keys in this format can easily be created with
openssl tools and provide crypto agility[1] as the format embeds
algorithm identifier.
The supposed use-case of this feature is to attach multiple signatures
with different algorithms to a single commit, so even if an algorithm
turned vulnerable, the signatures made with other algorithms can still
be used as a fallback. For instance, signer can create an Ed25519
signature along with a quantum-resistent ML-DSA signature.
The following are a couple of implementation notes:
- The private keys shall be stored in the PKCS#8 format, though future
extensions may support other format such as opaque key handles on a
hardware token.
- The "spki" signature type prefers the keys to be encoded in the PEM
format on disk, while it still accepts base64 encoded keys when given
through the command-line.
Daiki Ueno [Fri, 9 Aug 2024 05:54:27 +0000 (14:54 +0900)]
sign: Add PEM reading facility
This adds a new class OstreePemReader, which reads PEM blocks from an
input stream. This would be useful for the "x509" signing backend, as
the keys are typically stored in the PEM format.
Daiki Ueno [Sun, 11 Aug 2024 06:08:12 +0000 (15:08 +0900)]
sign: Factor out logic to read key blobs
This defines a new interface OstreeBlobReader, which encapsulates the
key file parsing logic. This would make it easy to support custom file
formats such as PEM.
Use fsfreeze_thaw_cycle(/boot) instead of fsync(/boot)
Grub doesn't support replaying XFS journal, so when using
XFS for /boot, fsync() or syncfs() are not enough and can
leave the system in an unbootable state.
Jonathan Lebon [Fri, 7 Mar 2025 21:49:27 +0000 (16:49 -0500)]
boot: Drop ostree-finalize-staged.path
This effectively reverts ac1a919f ("boot: Add
ostree-finalize-staged.path").
A bug came in on the OCP side that demonstrates that the way things are
setup right now is racy. If a reboot is triggered quickly after staging
a deployment, the whole pipeline of:
- ostree-finalize-staged.path, which triggers
- ostree-finalize-staged.service, which triggers
- ostree-finalize-staged-hold.service,
may not fully have happened before systemd isolates to `reboot.target`
which will want to kill all pending jobs.
Just directly starting the systemd unit is less elegant but much more
explicit and gets rid of any possible race because it's directly part of
the staging operation.
Colin Walters [Tue, 25 Feb 2025 19:14:19 +0000 (14:14 -0500)]
core: canonicalize bare-user xattrs
Previously we were erroring out if xattrs were provided in
non-canonical (e.g. unsorted) form all the way down to just
the bare-user path. But for archive repos and dirmeta we
canonicalized.
Canonicalize bare-user xattrs on both read and write consistently
instead of erroring.
projects / ostree.git / log