Colin Walters [Fri, 5 Jan 2024 15:58:57 +0000 (10:58 -0500)]
systemd/ostree-boot-complete: Start earlier
Prep for changing this service to perform state computations
such as "is this boot the default, or did we get rolled back"
that can be used by higher level tools.
Colin Walters [Thu, 4 Jan 2024 18:55:14 +0000 (13:55 -0500)]
status: Pass correct remote name when verifying
The default `ostree admin status` tries to do signature
verification, but doesn't error out if that fails.
However, an extremely longstanding bug here is that we passed
the "osname" aka stateroot instead of the remote name. This
happens to work for e.g. Fedora Silverblue today, where they
are the same. It doesn't work on FCOS (remote = fedora, stateroot = fedora-coreos).
Jonathan Lebon [Thu, 4 Jan 2024 16:14:40 +0000 (11:14 -0500)]
lib/deploy: Add safety margin in early prune space check
There are a few things the estimator doesn't account for, e.g. writing
the new BLS entries. Rather than trying to perfect it (since I think we
should change approach entirely -- see previous commit message), just
add a 1M margin to the space check.
Jonathan Lebon [Thu, 4 Jan 2024 16:14:39 +0000 (11:14 -0500)]
lib/deploy: Round to block size in early prune space check
When we estimate how much space a new bootcsum dir will use, we
weren't accounting for the space overhead from files not using the
last filesystem block completely. This doesn't matter much if counting
a few files, but e.g. on FCOS aarch64, we include lots of small
devicetree blobs in the bootfs. That loss can add up to enough for the
`fallocate()` check to pass but copying still hitting `ENOSPC` later on.
I think a better fix here is to change approach entirely and instead
refactor `install_deployment_kernel()` so that we can call just the
copying bits of it as part of the early prune logic. We'll get a more
accurate assessment and it's not lost work since we won't need to
recopy later on. Also this would not require having to keep in sync the
estimator and the install bits.
That said, this is blocking FCOS releases, so I went with a more tactical
fix for now.
There's a test case for `ostree admin unlock --hotfix` that
runs in FCOS, not here; it breaks when enabling composefs.
The reason is because the composefs is mounted readonly, and
we tried to remount it writable. Instead of trying to remount
the rootfs writable at this point forcibly, honor the
*real* sysroot readonly state flag from the underlying FS before
we mounted the composefs.
Note that in FCOS derivatives we always have the root mounted
writable via `rw` on the kernel cmdline and this is the default
general expectation now with ostree usage.
Eric Curtin [Thu, 21 Dec 2023 17:11:55 +0000 (17:11 +0000)]
switchroot: Be explicit about what could cause /sysroot to be ro
If you don't have rw in the kernel cmdline or have ro in it, often you
hit this issue. This is just to be really explicit about that in the
error messages so people can check.
Colin Walters [Tue, 19 Dec 2023 20:00:05 +0000 (15:00 -0500)]
deploy: Log calculated needed space
To aid debugging issues like https://github.com/coreos/fedora-coreos-tracker/issues/1637
If we're hitting this path where we think we have enough space,
let's log what we calculated here to aid in diagnosing why we
may later fail with ENOSPC.
Colin Walters [Wed, 20 Dec 2023 02:01:21 +0000 (21:01 -0500)]
rust: Add missing feature versions
- We missed 2022_2, which specifically includes
https://docs.rs/ostree/latest/ostree/static.PATH_BOOTED.html
and I was really confused why that was missing
- Add more recent upstream versions too
Colin Walters [Thu, 7 Dec 2023 15:21:05 +0000 (10:21 -0500)]
prepare-root: Add support for root.transient
Closes: https://github.com/ostreedev/ostree/issues/3113
It'd greatly improve compatibility with things like RPMs that install
in `/opt` if we supported a full "original docker" style model where
`/` is a transient overlayfs. We'd still keep our semantics for `/etc`
and `/var` by default, but e.g. we'd stop recommending
`/opt` :arrow_right: `/var/opt`, in this model,
so `/opt` would be on the overlayfs.
Note this all aligns with composefs, where we'd actually be making
`/` a *read-only* overlayfs by default; it'd be really nice of course
to *implement* this by just making the composefs overlayfs writable,
but I am not sure we can hard require composefs for this right now.
So this change adds support for `root.transient = true`
in `/usr/lib/ostree/prepare-root.conf`.
The major downside is that people could be surprised if files they
write to e.g. `/opt` don't persist across upgrades. But, that's
already again how it works since Docker started.
Note as part of the implementation of this, we need to add a whole
new "backing" directory distinct from the deployment directories.
(Tangentially related to this, it's tempting to switch to always
using a *read-only* overlay mount by default.
Colin Walters [Sun, 3 Dec 2023 14:32:36 +0000 (09:32 -0500)]
tests: Drop bare-user on tmpfs negative test
As of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2daf18a7884dc03d5164ab9c7dc3f2ea70638469
the restriction is lifted, FINALLY.
Colin Walters [Thu, 30 Nov 2023 23:16:33 +0000 (18:16 -0500)]
bootloader/zipl: Run in target deployment as container if needed
xref https://issues.redhat.com/browse/MGMT-16303
Basically the OCP Assisted installer has now grown code
to try to do OS updates offline post-install, and this means
we need to handle the case of running zipl from the target
root.
Colin Walters [Thu, 30 Nov 2023 20:33:42 +0000 (15:33 -0500)]
tmpfiles: Copy `/usr/share/factory/var` to `/var`
This is a pattern we want to encourage. It's honestly just
way simpler than what rpm-ostree is doing today in auto-synthesizing
individual tmpfiles.d snippets.
Colin Walters [Tue, 28 Nov 2023 01:08:43 +0000 (20:08 -0500)]
main: Drop some redundant includes of `ot-main.h`
When backporting a patch recently we hit a non-obvious
dependency on another fix for `ot-main.h` includes. Clean
this up a bit by dropping the redundant includes.
Colin Walters [Wed, 8 Nov 2023 22:19:19 +0000 (17:19 -0500)]
sysroot: Stabilize deployment finalization, add API and CLI
It's about time we do this; deployment finalization locking
is a useful feature. An absolutely key thing here is that
we've slowly been moving towards the deployments as the primary
"source of truth".
Specifically in bootc for example, we will GC container images
not referenced by a deployment.
This is then neecessary to support a "pull but don't apply automatically" model.
This stabilizes the existing `ostree admin deploy --lock-finalization`
CLI, and adds a new `ostree admin unlock-finalization`.
We still check the old lock file path, but there's a new boolean
value as part of the staged deployment data which is intended
to be the source of truth in the future. At some point then we
can drop the rpm-ostree lockfile handling.
Colin Walters [Mon, 27 Nov 2023 15:59:04 +0000 (10:59 -0500)]
tests: Turn off gpg verification for dev builds
Right now `ostree admin status` errors out in this case, but
`rpm-ostree status` doesn't. The former behavior is probably
more of a bug, work around it for now.
Mark McLoughlin [Fri, 24 Nov 2023 14:27:11 +0000 (14:27 +0000)]
man: improve sysroot.readonly docs
The explanation of sysroot.readonly is a little confusing - we say
that "everything else is mounted read-only" but it's perhaps clearer
to say /sysroot is mounted read-only.
Also note that read-only is the default with composefs.
Finally, document the option in ostree.repo-config even though it is
now considered legacy - as of commit 22b8e4f9 (#2930) - it is still
commonly seen in repo configs, so users will look to understand
what it means.
This command will apply fs-verity on all objects that need it and
needs to be called when an ostree deployment has been copied on a
file-by-file basis, which would loose information such as fs-verity.
This is needed by osbuild which works by creating the final image in a
rootfs, and then separately copying that rootfs file-by-file to a
loopback mounted filesystem image.
Colin Walters [Fri, 10 Nov 2023 01:53:52 +0000 (20:53 -0500)]
unlock: Don't pass options again to overlayfs
There seems to be a tricky regression here with the util-linux
support for the new mount API, plus overlays support for it.
```
[2023-11-09T21:05:30.633Z] Nov 09 21:05:26 qemu0 kola-runext-unlock-transient.sh[2108]: + unshare -m -- /bin/sh -c 'mount -o remount,rw /usr && echo hello from transient unlock >/usr/share/writable-usr-test'
[2023-11-09T21:05:30.633Z] Nov 09 21:05:26 qemu0 kola-runext-unlock-transient.sh[2148]: mount: /usr: mount point not mounted or bad option.
[2023-11-09T21:05:30.633Z] Nov 09 21:05:26 qemu0 kola-runext-unlock-transient.sh[2148]: dmesg(1) may have more information after failed mount system call.
```
OK this seems related to the new mount API support in util-linux and overlayfs. From a strace:
Jonathan Lebon [Thu, 19 Oct 2023 15:35:25 +0000 (11:35 -0400)]
lib/deploy: Log SELinux policy refresh
I have a suspicion that the `semodule -N --refresh` we do here is
involved in https://github.com/coreos/fedora-coreos-tracker/issues/1597.
Let's log when we execute it and include its time.
While we're here, also log the time it takes to `syncfs()` and the
fsfreeze/thaw cycling. It's logged in a structured journal entry, but
that's less accessible than just having it in the journal message field.
Joseph Marrero [Mon, 3 Apr 2023 23:04:57 +0000 (19:04 -0400)]
ostree-repo-pull: add options to configure retry behavior
This introduces the "retry-all-network-errors" option which
is enabled by default. This is a behavior change as now
ostree will retry on requests that fail except when
they fail with NOT_FOUND. It also introduces the options
"low-speed-limit-bytes" and "low-speed-time-seconds these"
map to CURL options only at the moment. Which have defaults
set following librepo:
https://github.com/rpm-software-management/librepo/blob/7c9af219abd49f8961542b7622fc82cfdaa572e3/librepo/handle.h#L90
https://github.com/rpm-software-management/librepo/blob/7c9af219abd49f8961542b7622fc82cfdaa572e3/librepo/handle.h#L96
Currently these changes only apply when using libcurl.
Finally this change adds a final option that affects all
backends to control the max amount of connections of the
fetcher "max-outstanding-fetcher-requests".
projects / ostree.git / log