Colin Walters [Mon, 4 Nov 2024 18:48:56 +0000 (13:48 -0500)]
prepare-root: Fix composefs docs
In practice in ostree-sysroot-deploy.c we only react to having
`composefs = yes`; the docs mention `maybe` but that never did
anything.
The value is wrong in the code too, but I'm not touching
that here to avoid conflating changes - the main thing to fix
is the docs because here `maybe == no`.
Colin Walters [Wed, 30 Oct 2024 14:07:26 +0000 (10:07 -0400)]
checkout: Only verify digest if repo requires fsverity
Fixes a regression from the previous commit; in
the case where the target repo doesn't have composefs in
signed mode there's no reason to verify the digest
at checkout time because we aren't verifying it at
boot time either.
The regression is in cases that use rpm-ostree e.g.
where as of recently we unconditionally add the composefs
digest, but for e.g. FCOS we aren't deploying with fsverity
enabled.
Closes: https://github.com/ostreedev/ostree/issues/3330 Signed-off-by: Colin Walters <walters@verbum.org>
Simon McVittie [Thu, 31 Oct 2024 10:54:13 +0000 (10:54 +0000)]
tests: Work around GPG 2.2.45 error behaviour when revoking an expired key
In GPG 2.2.45, a diagnostic message about the only trusted key having
already expired causes this import to produce exit status 2, but the
import still succeeds (the key is still revoked).
Colin Walters [Sun, 27 Oct 2024 14:20:29 +0000 (10:20 -0400)]
deploy: Don't recompute verity checksums if not enabled
This fixes a truly horrific performance bug when
composefs is enabled, but fsverity is not supported
by the filesystem. We'd fall back to doing *userspace*
checksumming of all files at deployment time which was absolutely
not expected or required.
There's really an immense amount of technical debt
here, such as the confusion between `ex-integity.composefs`
vs the prepare-root config, how we handle "torn" states
where some objects don't have verity enabled but some do,
etc.
The ostree composefs state has two modes:
- signed: We need to enforce fsverity
- unsigned: Best effort resilience
So we fix this by making the deploy path to make verity
"opportunistic" - if the ioctl gives us the data, then we
add it to the composefs.
However, this code path is also invoked when we're
computing the expected composefs digest to inject
as commit metadata, and *that* API must work regardless
of whether the target repo has fsverity enabled as
it may operate on a build server.
One lucky thing in all of this: When I went to add
the "checkout composefs" API I added a stub `GVariant`
for options extensibility, which we now use.
Colin Walters [Wed, 18 Sep 2024 17:41:59 +0000 (13:41 -0400)]
curl: Make socket callback during cleanup into no-op
Because curl_multi_cleanup may invoke callbacks, we effectively have
some circular references going on here. See discussion in
https://github.com/curl/curl/issues/14860
Basically what we do is the socket callback libcurl may invoke into a no-op when
we detect we're finalizing. The data structures are owned by this object and
not by the callbacks, and will be destroyed below. Note that
e.g. g_hash_table_unref() may itself invoke callbacks, which is where
some data is cleaned up.
Dan Nicholson [Sun, 15 Sep 2024 19:59:36 +0000 (13:59 -0600)]
workflow/docs: Fix deployments
A couple fixes to make PRs and non-PRs work correctly:
* In a conditional expression, `true` or `false` are returned unless you
terminate both sides in a ternary. That was causing 2 strings to be
suffixed with `false` instead of an empty string.
* For a PR, we do actually want to cancel in progress runs since there's
no danger of breaking an in progress deployment.
* For PRs, just use the same `github-pages-pr` name for the artifact.
The important part is that it's not called `github-pages` where an in
progress deployment could pick it up. Otherwise it can use the same
name all the time.
Colin Walters [Tue, 20 Aug 2024 20:18:54 +0000 (16:18 -0400)]
lib/traverse: Fix minor memory leak
I was trying to check something with `-fsanitize=address`
and it warned about this memory leak. It's...subtle, basically
we were leaking when the same commit was added to the hash table.
But unfortunately fixing that then complicates ownership
over the return value; what we really want to use here is
`g_hash_table_steal_all_keys` but RHEL 9.4 is still rocking
`glib2-2.68.4` so we can't use it.
(Rust would mean we wouldn't have leaked anything here in the
first place...)
Dan Nicholson [Fri, 30 Aug 2024 00:19:30 +0000 (18:19 -0600)]
switchroot: Stop making /sysroot mount private
Back in 2b8d586c5, /sysroot was changed to be a private mount so that
submounts of /var do not propagate back to the stateroot /var. That's
laudible, but it makes /sysroot different than every other shared mount
in the root namespace. In particular, it means that submounts of
/sysroot do not propagate into separate mount namespaces.
Rather than make /sysroot private, make /var a slave+shared mount so
that it receives mount events from /sysroot but not vice versa. That
achieves the same effect of preventing /var submount events from
propagating back to /sysroot while allowing /sysroot mount events to
propagate forward like every other system mount. See
mount_namespaces(7)[1] and the linux shared subtrees[2] documentation
for details on slave+shared mount propagation.
When /var is mounted in the initramfs, this is accomplished with
mount(2) syscalls. When /var is mounted after switching to the real
root, the mount propagation flags are applied as options in the
generated var.mount unit. This depends on a mount(8) feature that has
been present since util-linux 2.23. That's available in RHEL 7 and every
non-EOL Debian and Ubuntu release. Applying the propagation from
var.mount fixes a small race, too. Previously, if a /var submount was
added before /sysroot was made private, it would have propagated back
into /sysroot. That was possible since ostree-remount.service orders
itself after var.mount but not before any /var submounts.
Dan Nicholson [Fri, 30 Aug 2024 11:53:10 +0000 (05:53 -0600)]
tests: Add mount propagation test
This tests the current behavior of making /sysroot a private mount so
that submounts on /var do not propagate back to /sysroot. It also shows
how submounts of /sysroot do not propagate into separate mount
namespaces for the same reason.
Simon McVittie [Wed, 31 Aug 2022 08:44:06 +0000 (09:44 +0100)]
d/control, d/rules: Disable gjs-based tests on armel
It's looking as though mozjs128, and therefore the next gjs release,
will not support armel due to its lack of atomic instructions causing
relatively basic features to be disabled.
Colin Walters [Thu, 15 Aug 2024 16:14:33 +0000 (12:14 -0400)]
commit/payload-link: Ensure we don't overrun target_checksum size
This is another warning from recently changed code from Coverity:
```
1. Defect type: OVERRUN
16. libostree-2024.7/src/libostree/ostree-repo-commit.c:823:7: overrun-buffer-arg: Overrunning array "target_checksum" of 65 bytes by passing it to a function which accesses it at byte offset 258 using argument "size" (which evaluates to 259). [Note: The source code implementation of the function has been overridden by a builtin model.]
```
I think this can only happen if the repository is corrupt; the
data shouldn't be that long. But fix this by passing the max
length we expect; this will ignore the rest currently.
Colin Walters [Thu, 15 Aug 2024 15:28:45 +0000 (11:28 -0400)]
sysroot: Make coverity happy with dirname+strdup
Similar to d528083cae3492f9b9424f3c9830869af7b4cbd0 - I don't
believe we actually had a leak here because `dirname` always
returns the same start pointer, but this makes Coverity
happy.
libostree: Remove compatibility code with GLib < 2.44
As the build system has required GLib 2.44 since commit eb09207e1abd7499bd92866cce1de6148d659a4a, the manual expansion of
G_DECLARE_INTERFACE and G_DECLARE_FINAL_TYPE is no longer necessary.
Luke Yang [Thu, 13 Jun 2024 18:41:27 +0000 (14:41 -0400)]
prepare: Create global var for tmp_sysroot_etc
Coverity points out that ""/sysroot.tmp/etc"" could be a copy-paste
error. This is mistake from coverity, but to supress the warning,
we create a global var, tmp_sysroot_etc, which replaces all
instances of TMP_SYSROOT "/etc".
Luke Yang [Wed, 12 Jun 2024 19:55:37 +0000 (15:55 -0400)]
repo: Fix `dir_or_file_path` memory leak
Coverity points out that we have a memory leak from
`g_strdup(dir_or_file_path)`. Make the duplication of the string a
temporary variable that is freed using `g_autofree`.
Luke Yang [Wed, 12 Jun 2024 19:50:54 +0000 (15:50 -0400)]
tree: Fix `name` memory leak
Coverity points out that we have a memory leak from `g_strdup(name)`.
`insert_child_mtree()` takes a const char * and duplicates it.
`name` can be passed directly to `insert_child_mtree()`.
projects / ostree.git / log