Colin Walters [Thu, 29 Jun 2023 06:42:04 +0000 (02:42 -0400)]
fetcher: Always open tmpfiles in repo (except on FUSE)
This reverts commit 4e61e6f7d0d6aebd6abcdc455ec53164afe39e8d
and re-instates the fix for ensuring that we download temporary
files into the repository location.
However in order to ensure we don't re-introduce
https://github.com/ostreedev/ostree/issues/2900
we detect the case where we're writing to a FUSE mount
and keep the prior behavior.
I've verified that this works with flatpak.
Note a downside of this is the change needs to be triplicated
across the 3 http backends.
This then again Closes: https://github.com/ostreedev/ostree/issues/2571
Colin Walters [Wed, 21 Jun 2023 17:25:52 +0000 (13:25 -0400)]
prepare-root: Link to glib
Since we've split off the "prepare root as init" code
into a separate file, we can now use glib to parse
the config file again, which is a lot less hacky.
This is particularly motivated by composefs, where
we want to do more in the initramfs. Future patches
may also link to parts of libostree.
Colin Walters [Sat, 17 Jun 2023 14:05:22 +0000 (10:05 -0400)]
Separate prepare-root static path
We should have done this a long time ago. We don't have any test
coverage for the no-initramfs path, and I think it's not long
term supportable as we want to add more features like composefs.
Particularly now that there's good support for embedding an
initramfs in a kernel image, I see little value in a path for
having custom static linking for this prepare root flow.
That said, we will continue to make a best-effort "it compiles"
attempt to support it.
Fork the "pid 1" prepare root code into a new
`ostree-prepare-root-static.c` file, and drop the runtime conditionals.
We can drop the composefs logic from `-static.c` which ends up
keeping that file much smaller.
A further next step here will be to actually fold the
`prepare-root.c` logic into the main `ostree` binary which we
can then just include in the initramfs.
Colin Walters [Tue, 27 Jun 2023 10:59:51 +0000 (06:59 -0400)]
test-composefs: Sync flow with other tests
I am not sure why this is failing on older Debian systems,
but I'm wildly guessing that something being done in `libtest.sh`
is setting up automake in a way that we need. This is done
in other tests.
Or maybe it's the missing `$CMD_PREFIX`? Let's see...
Colin Walters [Wed, 28 Jun 2023 15:45:15 +0000 (11:45 -0400)]
Fix return value of generator on non-ostree systems
Commit aa72caffb540114a0e8635ab2990b9c8b0b8f9db
regressed the `ostree-system-generator` on non-ostree systems.
If there's no `ostree=` karg, we need to just exit 0.
Colin Walters [Tue, 27 Jun 2023 09:27:23 +0000 (05:27 -0400)]
ci/prow: Build tests before trying to install
Our `install` target doesn't depend on `all` unlike the
rpm-ostree version; not doing so is arguably better, so let's
explicitly build before installing.
Eric Curtin [Mon, 26 Jun 2023 10:44:32 +0000 (11:44 +0100)]
bootloader: Pass "options" to aboot bootloader backend
aboot-deploy must know where the next root filesystem to boot is to set
up a symlink /ostree/root.a or /ostree/root.b , this location is in the
ostree= part of these passed in options.
Colin Walters [Mon, 19 Jun 2023 23:07:01 +0000 (19:07 -0400)]
ci: Sync prow config with rpm-ostree, enable composefs there
I want to gain testing over the composefs path; but without
yet changing the main Jenkins build. Because we have duplicate/overlapping
CI systems, we can take advantage of this by testing the composefs
flow via Prow.
Sync the Prow build scripts with what's in coreos/rpm-ostree
right now.
Then let's test the composefs flow a bit more e2e there.
Colin Walters [Fri, 16 Jun 2023 18:52:53 +0000 (14:52 -0400)]
composefs: Avoid double unref
The interaction of `iter_loop` and autofree is way too subtle;
I happened to be reading this code and noticed we did the NULL
reset in one path but not another.
Colin Walters [Thu, 15 Jun 2023 18:26:12 +0000 (14:26 -0400)]
Add more error prefixing when parsing commit objects
I've got more debug information in the error case that motivated
https://github.com/ostreedev/ostree/pull/2884/commits/bae4347abeaa2a66d213758f790058f42cb71fd1
"pull: Add error prefixing for corrupt checksums"
where the sole error is
`error: Invalid checksum of length 0 expected 32`
This must be coming from the pull code in the case where we've
already fetched the commit object.
- Add some error prefixing here in the core commit validation code
- Ensure that we do the validation immediately after loading, including
of the parent commit reference where I think this error must be coming
from
- Then the pull code can just safely call `ostree_commit_get_parent`
which already does the hex conversion etc.
Dylan Aïssi [Thu, 15 Jun 2023 12:29:47 +0000 (14:29 +0200)]
ostree-fetcher-curl: explicitly use HTTP1.1 when HTTP2 is disabled
The current logic to select the HTTP version to be use relies on
the fact that curl don't use by default HTTP2. This assumption seems wrong with
recent versions of curl.
Khem Raj [Mon, 12 Jun 2023 21:04:44 +0000 (14:04 -0700)]
libostree: Link with libgpg-error for gpg_strerror_r API
With f461c02bb55bf2853a3b81ed5c8618040ab54e98 use of gpg_strerror_r
was added this symbol comes from libgpg-error however, therefore its
needed to add -lgpg-error to cmdline to resolve this symbol especially
with gold and lld linker. Fixes
aarch64-yoe-linux-ld.lld: error: undefined reference due to --no-allow-shlib-undefined: gpg_strerror_r
>>> referenced by ./.libs/libostree-1.so
Colin Walters [Tue, 13 Jun 2023 20:17:16 +0000 (16:17 -0400)]
test-concurrency: Don't lower timeout
I think there's never been a real race condition here. Instead
the problem is:
- We have a timeout on the lock, after which we error out (30s)
- This test actually *lowers* the timeout
Looking through the failures for test-concurrency what I see
is
`error: Locking repo exclusive failed: Resource temporarily unavailable`
which is us hitting the timeout.
Hardcoded timeouts are just going to be subject to race conditions.
I understand not wanting to block forever in some cases, but any
arbitrary timeout is just going to get hit in real world conditions
too.
Anyways for now, stop shooting ourselves in the foot and at least
keep the timeout at the default.
Currently we generate a signature for the actual composefs image, and
then we apply that when we enable fsverity on the composefs
image. However, there are some issues with this.
First of all, such a signed fs-verity image file can only be read if
the corresponding puiblic keyring is loaded into the fs-verity
keyring. In a typical secure setup we will have a per-commit key that
is loaded from the initrd. Additionally, the keyring is often sealed
to avoid loading more keys later.
This means you can only ever mount (or even look at) composefs images
from the current boot. While this is not a huge issue it is something
of a pain for example when debugging things.
Secondly, and more problematic, during a deploy we can't enable
fs-verity on the newly created composefs file, because and at that
point you need to pass in the signature. Unfortunately this will fail
if the matching public key is not in the keyring, which will fail for
similar reasons as the first issue.
The current workaround is to *not* enable fs-verity during deploy, but
write the signature to a file. Then the first time the particular
commit is booted we apply the signature to the iamge. This works
around issue two, but not issue one. But it causes us to do a lot of
writes and computation during the first boot as we need to write the
fs-verity merkle tree to disk. It would be much better and robust if
the merkle tree could be written during the deployment of the update
(i.e. before boot).
The new apporach is to always deploy an unsigned, but fs-verity
enabled composefs image. Then we create separate files that contain
the expected digest, and a signature of that file. On the first boot
we sign the digest file, and on further boots we can just verify
that it is signed before using it.
This fixes issue 1, since all deploys are always readable, and it
makes the workaround for issue 2 much less problematic, as we only
need to change a much smaller file on the first boot.
Long term I would like to avoid the first-boot writing totally, and
I've been chatting with David Howells (kernel keyring maintainer) and
he proposed adding a new keyring syscall that verifies a PKCS#7
signature from userspace directly. This would be exactly what
fs-verity does, except we wouldn't have to write the digest to disk
during boot, we would just read the digest file and the signature file
each boot and ask the kernel to verify it.
Eric Curtin [Thu, 8 Jun 2023 11:40:28 +0000 (12:40 +0100)]
Add ostree=aboot for signed Android Boot Images
Some kernel images are delivered in a signed kernel + cmdline +
initramfs + dtb blob. When this is added to the commit server side, only
after this do you know what the cmdline is, this creates a recursion
issue. To avoid this, in the case where we have ostree=aboot karg
set, create a symlink after deploy to the correct ostree target in the
rootfs, as the cmdline can't be malleable and secured client-side at
the same time.
Colin Walters [Tue, 6 Jun 2023 21:09:30 +0000 (17:09 -0400)]
fetcher: Always open tmpfiles in repo location
In an installation environment (like a live ISO) we may
not have significant space outside of the target installation
repository.
There's no reason not to always open a linkable tempfile. In
the future we should fix the pull path to verify the checksum
and then just directly link in the object instead of copying.
Abylay Ospan [Tue, 6 Jun 2023 02:13:14 +0000 (02:13 +0000)]
commit: fix ostree deployment on 64-bit inode fs
This commit addresses a bug that was causing ostree deployment
to become corrupted on the large fs, when any package was installed using
'rpm-ostree install'.
In such instances, multiple files were assigned the same inode. For
example, the '/home' directory and a regular file 'pkg-get' were
assigned the same inode (2147484070), making the deployment unusable.
A root cause analysis was performed, running the process under gdb,
which revealed a lossy conversion from guint64 to guint32, for example 6442451366 converted to 2147484070:
(gdb) s
device=66311, modifier=0x7fe914791840) at
src/libostree/ostree-repo-commit.c:1590
The conversion resulted in entirely independent files potentially
receiving the same inode.
The issue was discovered on PoC machine equipped with a large NVME
(3.4TB), but the bug can be easily reproduced using `cosa run -m 4000
--qemu-size +3TB', followed by installation of any package using
`rpm-ostree install`. The resulting deployment will be unusable due to
many files being "corrupted" by the aforementioned issue.
composefs: When using signatures, delay application until first boot
We can't safely apply the fs-verity with signature until we have
booted with the new initrd, because the public key that matches the
signature is loaded from it. So, instead we save the .sig file next
to the compoosefs, and on the first boot we detect that it is there, and
the composefs file isn't fs-verity, so we apply it.
Things get a bit more complex due to having to temporarily make
/sysroot read-write for the fsverity operation too.
Instead of using pkg-config, etc we just include composefs.
In the end the library is just 5 c source files, and it is set up
to be easy to use as a submodule.
For now, composefs support is disabled by default.
ostree-remount: Don't skip remount if root is composefs
When using composefs the root fs will always be read-only, but in this
case we should still continue remounting /sysroot. So, we record a
/run/ostree-composefs-root.stamp file in ostree-prepare-root if composefs
is used, and then react to it in ostree-remount.
sysroot: Ensure deployment detection works when using composefs
In the case of composefs, we cannot compare the devino of the rootfs
and the deploy dir, because the root is the composefs mount, not a
bind mount. Instead we check the devino of the etc subdir of the
deploy, because this is a bind mount even when using composefs.
prepare-root: Support using composefs as root filesystem
This changes ostree-prepare-root to use the .ostree.cfs image as a
composefs filesystem, instead of the checkout.
By default, composefs is used if support is built in and the .ostree.cfs
file exists in the deploy dir, otherwise we fall back to the old
method. However, if the ot-composefs kernel option is specified this
can be tweaked as per:
* off: Never use composefsz
* maybe: Use if possible
* on: Fail if not possible
* signed: Fail if the cfs image is not fs-verity signed with
a key in the keyring.
* digest=....: Fail if the cfs image does not match the specified
digest.
The final layout when composefs is active is:
/ ro overlayfs mount for composefs
/sysroot "real" root
/etc rw bind mount to $deploydir/etc
/var rw bind mount to $vardir
We also specify the $deploydir/.ostree-mnt directory as the (internal)
mountpoint for the erofs mount for composefs. This can be used to map
the root fs back to the deploy id/dir in use,
A further note: I didn't test the .usr-ovl-work overlayfs case, but a
comment mentions that you can't mount overlayfs on top of a readonly
mount. That seems incompatible with composefs. If this is needed we
have to merge that with the overlayfs that composefs itself sets up,
which is possible with the libcomposefs APIs.
composefs deploy: Store cfs signature in .ostree.cfs.sig file
In many cases, such as when using osbuild, we are not preparing the final
deployment but rather a rootfs tree that will eventually be copied to the
final location. In that case we don't want to apply the signature directly
but when the deployment is copied in place.
To make this situateion workable we also write the signature to a file
next to the composefs image file. Then whatever mechanism that does
the final copy can apply the signature.
deploy: Write a .ostree.cfs composefs image in the deploy dir
This can be used as a composefs source for the root fs instead of
the checkout by pointing the basedir to /ostree/repo/objects.
We only write the file is `composefs` is enabled.
We enable ensure_rootfs_dirs when building the image which adds the
required root dirs to the image. In particular, this includes /etc
which often isn't in ostree commits in use.
We also create an (empty) .ostree.mnt directory, where composefs
will mount the erofs image that will be used as overlayfs lowerdir
for the root overlayfs mount. This way we can find the deploy
dir from the root overlayfs mount options.
If the commit has composefs digests recorded we verify those with the
created file. It also applies the fs-verity signature if it is
recorded, unless this is disabled with the
ex-integrity.composefs-apply-sign=false option.
Commit: Add composefs digest and sig to the commit metadata
If `composefs-apply-sig` is enabled (default no) we add an
ostree.composefs digest to the commit metadata. This can be verified
on deploy.
This is a separate option from the generic `composefs` option which
controls whether composefs is used during deploy. It is separate
because we want to not have to force use of fs-verity, etc during the
build.
If the `composefs-certfile` and `composefs-keyfile` keys in the
ex-integrity group are set, then the commit metadata also gets a
ostree.composefs-sig containing the signature of the composefs file.
lib: Add (private) API for checking out commits into a composefs image
This supports checking out a commit into a tree which is then
converted into a composefs image containing fs-verity digests for all
the regular files, and payloads that are relative to a the
`repo/objects` directory of a bare ostree repo.
Some specal files are always created in the image. This ensures that
various directories (usr, etc, boot, var, sysroot) exists in the
created image, even if they were not in the source commit. These are
needed (as bindmount targets) if you want to boot from the image. In
the non-composefs case these are just created as needed in the checked
out deploydir, but we can't do that here.
This is all controlled by the new ex-integrity config section, which
has the following layout:
The `fsverity` key overrides the old `ex-fsverity` section if
specified. The default for all these is for the new behaviour to be
disabled. Additionally, enabling composefs implies fsverity defaults
to `maybe`, to avoid having to set both.
projects / ostree.git / log