Colin Walters [Mon, 27 Nov 2023 15:59:04 +0000 (10:59 -0500)]
tests: Turn off gpg verification for dev builds
Right now `ostree admin status` errors out in this case, but
`rpm-ostree status` doesn't. The former behavior is probably
more of a bug, work around it for now.
Mark McLoughlin [Fri, 24 Nov 2023 14:27:11 +0000 (14:27 +0000)]
man: improve sysroot.readonly docs
The explanation of sysroot.readonly is a little confusing - we say
that "everything else is mounted read-only" but it's perhaps clearer
to say /sysroot is mounted read-only.
Also note that read-only is the default with composefs.
Finally, document the option in ostree.repo-config even though it is
now considered legacy - as of commit 22b8e4f9 (#2930) - it is still
commonly seen in repo configs, so users will look to understand
what it means.
This command will apply fs-verity on all objects that need it and
needs to be called when an ostree deployment has been copied on a
file-by-file basis, which would loose information such as fs-verity.
This is needed by osbuild which works by creating the final image in a
rootfs, and then separately copying that rootfs file-by-file to a
loopback mounted filesystem image.
Colin Walters [Fri, 10 Nov 2023 01:53:52 +0000 (20:53 -0500)]
unlock: Don't pass options again to overlayfs
There seems to be a tricky regression here with the util-linux
support for the new mount API, plus overlays support for it.
```
[2023-11-09T21:05:30.633Z] Nov 09 21:05:26 qemu0 kola-runext-unlock-transient.sh[2108]: + unshare -m -- /bin/sh -c 'mount -o remount,rw /usr && echo hello from transient unlock >/usr/share/writable-usr-test'
[2023-11-09T21:05:30.633Z] Nov 09 21:05:26 qemu0 kola-runext-unlock-transient.sh[2148]: mount: /usr: mount point not mounted or bad option.
[2023-11-09T21:05:30.633Z] Nov 09 21:05:26 qemu0 kola-runext-unlock-transient.sh[2148]: dmesg(1) may have more information after failed mount system call.
```
OK this seems related to the new mount API support in util-linux and overlayfs. From a strace:
Jonathan Lebon [Thu, 19 Oct 2023 15:35:25 +0000 (11:35 -0400)]
lib/deploy: Log SELinux policy refresh
I have a suspicion that the `semodule -N --refresh` we do here is
involved in https://github.com/coreos/fedora-coreos-tracker/issues/1597.
Let's log when we execute it and include its time.
While we're here, also log the time it takes to `syncfs()` and the
fsfreeze/thaw cycling. It's logged in a structured journal entry, but
that's less accessible than just having it in the journal message field.
Joseph Marrero [Mon, 3 Apr 2023 23:04:57 +0000 (19:04 -0400)]
ostree-repo-pull: add options to configure retry behavior
This introduces the "retry-all-network-errors" option which
is enabled by default. This is a behavior change as now
ostree will retry on requests that fail except when
they fail with NOT_FOUND. It also introduces the options
"low-speed-limit-bytes" and "low-speed-time-seconds these"
map to CURL options only at the moment. Which have defaults
set following librepo:
https://github.com/rpm-software-management/librepo/blob/7c9af219abd49f8961542b7622fc82cfdaa572e3/librepo/handle.h#L90
https://github.com/rpm-software-management/librepo/blob/7c9af219abd49f8961542b7622fc82cfdaa572e3/librepo/handle.h#L96
Currently these changes only apply when using libcurl.
Finally this change adds a final option that affects all
backends to control the max amount of connections of the
fetcher "max-outstanding-fetcher-requests".
If the `prepare-root.conf` file contains:
```
[etc]
transient=yes
```
Then during prepare-root, an overlayfs is mounted as /etc, with the
upper dir being in /run. If composefs is used, the lower dir is
`usr/etc` from the composefs image , or it is the deployed
`$deploydir/usr/etc`.
Note that for this to work with selinux, the commit must have been
built with OSTREE_REPO_COMMIT_MODIFIER_FLAGS_USRETC_AS_ETC. Otherwise
the lowerdir (/usr/etc) will have the wrong selinux contexts for the
final location of the mount (/etc).
We also set the transient-etc key in the ostree-booted file, pointing it
to the directory that is used for the overlayfs.
There are some additional work happening in ostree-remount, mostly
related to selinux (as this needs to happen post selinux policy
load):
* Recent versions of selinux-poliy have issues with the overlayfs
mount being kernel_t, and that is not allowed to manage files as
needed. This is fixed in
https://github.com/fedora-selinux/selinux-policy/pull/1893
* Any /etc files created in the initramfs will not be labeled,
because the selinux policy has not been loaded. In addition, the
upper dir is on a tmpfs, and any manually set xattr-based selinux
labels on those are reset during policy load. To work around this
ostree-remount will relabel all files on /etc that have
corresponding files in overlayfs upper dir.
* During early boot, systemd mounts /run/machine-id on top of
/etc/machine-id (as /etc is readonly). Later during boot, when etc
is readwrite, systemd-machine-id-commit.service will remove the
mount and update the real file under it with the right content. To
ensure that this keeps working, we need to ensure that when we
relabel /etc/machine-id we relabel the real (covered) file, not the
temporary bind-mount.
* ostree-remount no longer needs to remount /etc read-only in the
transient-etc case.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
Colin Walters [Mon, 2 Oct 2023 15:05:31 +0000 (11:05 -0400)]
repo: Add an option to label /usr/etc as /etc
This will be very useful for enabling a "transient /etc" option
because we won't have to do hacks relabling in the initramfs, or
forcing it on just for composefs.
Owen W. Taylor [Fri, 29 Sep 2023 16:09:04 +0000 (12:09 -0400)]
When exporting, use hardlinks for duplicated files
For ostree_repo_export_tree_to_archive(), and 'ostree export', when the
exported tree contains multiple files with the same checksum, write an
archive with hard links.
Without this, importing a tree, then exporting it again breaks
hardlinks.
As an example of savings: this reduces the (compressed) size of the
Fedora Flatpak Runtime image from 1345MiB to 712MiB.
Colin Walters [Wed, 27 Sep 2023 15:41:55 +0000 (11:41 -0400)]
repo: Default bootloader to zipl on s390x
This will allow us to drop code like
https://github.com/coreos/coreos-assembler/blob/87fc693c115eae1e7ff0e1621ce26c9167af6e84/src/create_disk.sh#L503
which is really just unnecessary since there aren't any other
bootloaders we care about on this architecture.
Colin Walters [Wed, 20 Sep 2023 11:58:44 +0000 (07:58 -0400)]
gitmodules: Use github GNOME mirror
gitlab.gnome.org is down right now, but it's been somewhat
flaky in the past. Our CI uptime becomes an *intersection*
of all systems it depends on, and by cutting out gitlab.gnome.org
we increase its reliability.
Colin Walters [Fri, 8 Sep 2023 11:50:37 +0000 (07:50 -0400)]
rust: Switch to using `include`
This way we don't randomly pick up bits from the C library
unintentionally as things change on that side.
I think the support for `!` in `include` may be relatively new
and that's why the original author here chose to do things
via `exclude`. But using `include` with a few specific exclusions
is just way better.
Jonathan Lebon [Mon, 11 Sep 2023 02:14:39 +0000 (22:14 -0400)]
lib/pull: Drop static delta superblocks references
We don't need them long-lived anymore. They were just used for reporting
at this point, but we can use the new `static_delta_targets` hash table
size for that now.
Jonathan Lebon [Fri, 8 Sep 2023 20:54:29 +0000 (16:54 -0400)]
lib/pull: Don't scan commit objects we fetch via deltas
When we're fetching a commit via static delta, we already take care of
fetching the full commit, so there's no need to also scan it using the
regular object workflow.
Jonathan Lebon [Fri, 8 Sep 2023 20:50:47 +0000 (16:50 -0400)]
lib/pull: Fix miscounting of missing metadata
If e.g. detached metadata or a parent commit is missing, we
don't consider it an error but we erroneously still increment the
`n_fetched_metadata` counter, causing it to be higher than it should.
This will implicitly be tested by a test added in the next patch.
Colin Walters [Thu, 31 Aug 2023 18:40:01 +0000 (14:40 -0400)]
rust: Port to glib 0.18
- Also rolls up a few other changes in the C API
- Drop `&mut` from `OstreeKernelArgs`; it now confuses type inference.
More generally while using `&mut` here was well intentioned, it
goes against the glib standard of mapping everything to `&` and
accepting interior mutability.
projects / ostree.git / log