Xiaofeng Wang [Mon, 23 Mar 2026 08:55:56 +0000 (16:55 +0800)]
tests: Remove bcvk VM dispatch from Rust integration tests
VM deployment is now handled externally by `just test-tmt` (bcvk + tmt)
or `just integration-container` (bcvk direct SSH). The Rust test binary
runs inside the VM as root, so the require_root/RunMode dispatch logic
is no longer needed.
- Remove require_root(), RunMode enum, and bcvk dispatch code
- Simplify booted_test! and privileged_test! macros to just register
and run tests directly
- Remove rustix dependency (no longer checking getuid)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Xiaofeng Wang <henrywangxf@me.com>
Xiaofeng Wang [Fri, 20 Mar 2026 08:50:58 +0000 (16:50 +0800)]
ci: Add Packit CI with RPM builds and TMT integration tests
Add Packit-based CI pipeline that builds RPMs via COPR and runs TMT
integration tests on bootc image-mode systems. This follows the
bootc-dev/bootc pattern of per-plan VM isolation using bcvk.
Key changes:
- Dockerfile: Add rpmbuild stage, use RPM overlay for rootfs, run
provision-derived.sh for VM provisioning (cloud-init, rsync, etc.)
- Justfile: Add package target, test-tmt target with bcvk per-plan VMs,
longer SSH wait for cloud-init first boot
- .github/workflows/bootc.yaml: Split into unit-tests and integration
jobs, archive TMT logs with PR number in artifact name
- .packit.yaml: COPR builds + TMT tests for centos-stream-9/10 and
fedora-43/44 on x86_64/aarch64
- tmt/: FMF test plans and shell-based tests (booted verification,
privileged ostree tests) translated from Rust integration tests
- hack/: Packit provisioning scripts to convert package-mode VMs to
image-mode via bootc install to-filesystem
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Xiaofeng Wang <henrywangxf@me.com>
Colin Walters [Tue, 17 Mar 2026 21:00:34 +0000 (21:00 +0000)]
ci: Revamp bootc integration test suite with bcvk VM support
the old privtest CI job with a new tests/bootc-integration
Rust crate that runs inside a bcvk VM. The old tests/inst crate is
preserved for tests not yet ported.
Tests are split into two tiers based on what they need:
- booted_test!: needs a fully deployed ostree system. Dispatches via
`bcvk libvirt run` which does `bootc install to-disk`.
- privileged_test!: just needs root. Dispatches via the faster
`bcvk ephemeral run-ssh`.
The Justfile provides `integration-container` (full suite) and
`integration-ephemeral` (fast privileged-only path). JUnit XML output
is supported via the JUNIT_OUTPUT env var using quick-junit;
integration-container captures results to target/integration-results.xml.
Drop the vendored bootc-ubuntu-setup action in favor of the upstream
bootc-dev/actions/bootc-ubuntu-setup@main.
Assisted-by: OpenCode (Claude claude-opus-4-6) Signed-off-by: Colin Walters <walters@verbum.org>
Igor Opaniuk [Mon, 9 Mar 2026 11:04:07 +0000 (12:04 +0100)]
tests: Respect TEST_TMPDIR for temporary directories
Several C tests hardcoded /var/tmp as the base path for temporary
working directories, ignoring the TEST_TMPDIR environment variable
used by the shell test suite.
This caused tests to create their ostree repos on the overlayfs
filesystem even when TEST_TMPDIR points to a real filesystem,
bypassing the intended workaround for overlayfs's inaccurate
free-space reporting. As a result, ostree's min-free-space-percent
check (default 3%) would fire when writing content objects, making
tests fail in containerized environments where the rootfs is overlayfs.
Fix by reading TEST_TMPDIR at runtime and falling back to /var/tmp
when it is not set, consistent with how the shell test suite handles
this. Affected tests:
- tests/test-libarchive-import.c
- tests/test-basic-c.c
Signed-off-by: Igor Opaniuk <igor.opaniuk@foundries.io>
Pavel Valena [Fri, 6 Mar 2026 12:09:32 +0000 (13:09 +0100)]
boot/dracut: use systemdsystemunitdir instead of systemdsystemconfdir
since dracut-109 [*], the systemdsystemconfdir exists only in hostonly mode, which leads to unbootable system; as documented here:
https://src.fedoraproject.org/rpms/dracut/pull-request/90
Colin Walters [Thu, 8 Jan 2026 21:24:14 +0000 (16:24 -0500)]
libarchive: Handle UTF-8 filenames without locale dependency
When importing archives (including OCI container layers), libarchive
attempts to convert filenames from UTF-8 to the current locale charset.
In POSIX/C locale (which uses ASCII), this conversion fails for any
non-ASCII UTF-8 characters, returning ARCHIVE_WARN.
This is triggered by Python 3.14 which creates a "𝜋thon" symlink in
venvs, and affects bootc installations in environments where LANG is
not set (defaulting to POSIX locale).
Fix this by:
1. Using archive_entry_pathname_utf8() and archive_entry_symlink_utf8()
which return UTF-8 directly without locale conversion
2. Falling back to the regular accessors with explicit UTF-8 validation
when the _utf8 variants return NULL
3. Accepting ARCHIVE_WARN from archive_read_next_header() since we now
validate UTF-8 ourselves rather than relying on libarchive charset
conversion
This matches the behavior of GNU tar which treats filenames as opaque
bytes without charset conversion.
Dusty Mabe [Fri, 16 Jan 2026 02:48:43 +0000 (21:48 -0500)]
ci: drop running COSA as UID 0
With some changes made upstream to COSA [1] and a few fixups here
to make sure the directory tree for our built software doesn't have
setgid files we shouldn't need to runAsUser: 0 any longer.
ci: Sync bootc-ubuntu-setup action from bootc-dev/infra
The CI was failing because we were pulling podman/crun/skopeo
from Debian testing which has become unreliable. The bootc-dev/infra
repository maintains a reusable action that uses Ubuntu's plucky
repository instead, which is more appropriate for ubuntu-24.04 runners.
This also brings in additional improvements from the shared action:
- Disk space cleanup on the runner
- Unprivileged /dev/kvm access setup
- Optional libvirt stack support
state-overlay: Fix ENODATA handling for GLib < 2.74
The state overlay feature fails on first boot with:
error: lgetxattr(user.ostree.deploymentcsum): No data available
This happens because `lgetxattrat_allow_noent()` checks for
`G_IO_ERROR_INVALID_DATA` to detect when an xattr doesn't exist.
However, GLib's `g_io_error_from_errno()` only maps `ENODATA` to
`G_IO_ERROR_INVALID_DATA` since GLib 2.74. Older versions (such as
GLib 2.68 shipped in CentOS Stream 9) return `G_IO_ERROR_FAILED`
instead, causing the check to fail and the error to propagate.
This creates a chicken-and-egg problem: the code tries to read the
`user.ostree.deploymentcsum` xattr before it can set it, but the read
fails on fresh overlay directories where the xattr hasn't been set yet.
Fix this by checking `errno == ENODATA` directly after the failed call,
which is portable across all GLib versions. Also rename the function
from `lgetxattrat_allow_noent` to `lgetxattrat_allow_nodata` to more
accurately reflect its purpose (ENODATA vs ENOENT).
This bug has existed since the state overlay feature was introduced in
v2024.1 but was masked on systems with GLib >= 2.74 (e.g., Fedora,
CentOS Stream 10) where the mapping happens to exist.
Assisted-by: Claude Code (Opus 4.5) Signed-off-by: Joseph Marrero Corchado <jmarrero@redhat.com>
Colin Walters [Thu, 6 Nov 2025 19:35:04 +0000 (14:35 -0500)]
Add missing `:` to the gtk-doc in a few places
This is SUCH a giant trap. I am not totally sure why it's
working for me in a fedora-42 build env, but it seems like
it may have broken in a different build environment in
https://github.com/ostreedev/ostree/pull/3548#discussion_r2500278890
I used Sonnet to audit for similar instances beyond
`read_blob` and it found some, fix those too.
We didn't set error if there were zero valid signatures, which caused
a crash prefixing the error. While fixing this, the error messages were
slightly reworded to make it nicer.
rust-binding: Extend bindings to support composefs and signing
This adds GLib.VariantDict, which is needed for
ostree_repo_commit_add_composefs_metadata(), and OSTree.BlobReader
which are needed for ostree_sign_read_sk().
With these we can sign ostree commits with composefs digests in them.
gir: Add (nullable) to ostree_blob_reader_read_blob return value
This adds api docs to ostree_blob_reader_read_blob() so that we
can mark the return value as nullable. This is needed, because
this function can return NULL without setting error, and this
needs to be handled in bindings (such as the rust ones).
ostree-sign.ed25519/spki: Fix double free in set_sk()
When the gvariant is G_VARIANT_TYPE_BYTESTRING we need to duplicate
the data we get from g_variant_get_fixed_array(), otherwise we will
double-free it when we later free sign->secret_key.
Support using composefs signatures also with bootc commits
When using bootc, if you convert a signed ostree commit into an OCI
image `rpm-ostree compose container-encapsulate` you end up with a new
commit that isn't signed. However, the base commit object, and its
commitmeta are still in the image and will end up the repo, and
since https://github.com/bootc-dev/bootc/pull/1600 the base commit
id is available as the parent commit.
So, we change ostree-prepare-root to fall back to using the base
commit+commitmeta to find the expected composefs digest if the main
commit is not signed.
Note: This will only work with ostree-only commits. If you have any
layered data, then the content will change, and the composefs digest
in the base commit will not match the deployed one. This is expected
with such sealed commits though. If you want to layer, either disable
sealing, or create a new sealed ostree commit for the new image.
prepare-root: add allow_noent argument to load_variant
This is a minor preparation for a later change. Instead of
hand-rolling the G_FILE_ERROR_NOENT error check we add
a new allow_noent option.
Additionally, we move the handling of a no commitmeta being
an error to the caller of load_commit_for_deploy(), because
this check will be slightly more complex in the future.
Revert "Add ostree-shutdown.service: hide /sysroot and make /etc read-only"
Instead of adding a shutdown service, we rework how we create the mounts.
After the 2 previous commits, sysroot.mount umount works, and
systemd-shutdown will take care of remounting etc.mount read-only and
calling sync() as needed.
The composefs at /run/nextboot uses /sysroot, so systemd fails to
umount sysroot.mount during soft-reboot.
Create a temporary bind-mount, use it to prepare /run/nextboot
and MNT_DETACH it when we are done.
Moving the physical root at /sysroot, we end up
with a mount cycle between / and /sysroot, forcing us to use
MS_DETACH during shutdown (d0c454c23637dceda6d7395dd2141b564e3efa47).
We can replace ostree-shutdown.service by reworking how we mount
/sysroot, in short use MS_BIND instead of MS_MOVE.
Jo Zzsi [Sun, 31 Aug 2025 04:56:10 +0000 (00:56 -0400)]
Move dracut module from 98 ordering to the recommended 50 ordering
In dracut release v108 or later the recommended ordering for out
out of tree modules is 50. The following is a section from dracut
documentation:
> Not using the 50-59 range for out of tree dracut modules will likely
> lead to unintended errors in the initramfs generation process as your
> dracut module will either run too early or too late in the generation process.
> You have been warned.
Colin Walters [Thu, 28 Aug 2025 17:53:14 +0000 (13:53 -0400)]
Add ostree-shutdown.service: hide /sysroot and make /etc read-only
We have a lot of bind mounts; these are usually set up in the initramfs.
So far during shutdown we've let systemd just try to sort things out
via auto-generated mount units i.e. `sysroot.mount` and `etc.mount`
and so on.
systemd has some special casing for `-.mount` (i.e. `/`) and `etc.mount`
https://github.com/systemd/systemd/blob/e91bfad241799b449df73efc30d833b9c5937001/src/shared/fstab-util.c#L72
However it doesn't special case `/sysroot` - which is currently
an ostree-specific invention (when used in the real root).
We cannot actually unmount `/sysroot` while it's in use, and it
is because `/etc` is a bind mount into it. And we can't tear
down `/etc` because it's just expected that e.g. pid 1 and other
things hold open references to it - until things finally
transition into systemd-shutdown.
What we can do though is explicitly detach it during the shutdown
phase; this ensures that systemd won't try to clean it up then,
suppressing errors about its inability to do so.
While we're here, let's also remount `/etc` read-only; while
systemd itself will try to do so during systemd-shutdown.
Per comments if this service fails, it's a bug in something
else to be fixed.
Closes: https://github.com/ostreedev/ostree/issues/3513 Signed-off-by: Colin Walters <walters@verbum.org>
Daniel Hast [Fri, 29 Aug 2025 18:17:15 +0000 (14:17 -0400)]
fix: double free in checkout_tree_at_recurse
Both `xattrs` and `modified_xattrs` are declared with `g_autoptr`, but
`xattrs` is later simply assigned to be equal to `modified_xattrs`,
meaning the automatic cleanup is a double-free.
This is fixed by instead using `g_steal_pointer` to assign the old value
of `xattrs` to a temporary variable, which is used to create the new
value.
I believe this is the cause of issue #3303, and this should fix #3303.
(I can consistently reproduce the issue by attempting to deploy a
rechunked image with bootc, and with this patch, the issue no longer
occurs and the deployment succeeds.)
Signed-off-by: Daniel Hast <hast.daniel@protonmail.com>
Colin Walters [Thu, 21 Aug 2025 09:57:03 +0000 (11:57 +0200)]
Deduplicate repo+sysroot syncfs logic
This is a followup to https://github.com/ostreedev/ostree/pull/3504/commits/6e5a27a29d33d50a2a4380c406405435d919b6b4
which I believe is correct as is. However, we already have a file
descriptor open for the ostree repo, which *must* be on
the same filesystem as `/sysroot/ostree` (the deployment
code forces hardlinking today).
It's hence cleaner to reuse that extant fd instead of opening
a new one - we know we did writes to that fd.
But going farther here, there already is logic to use syncfs
for the repo when downloading objects (in a common case
we actually syncfs twice).
Since these are really the same operation, unify them:
- Add journaling to the repo one syncfs case
- Change the sysroot case to just call it
- Since we log consistently to the journal for all syncfs/fsfreeze
operations now, drop the SyncStats bits which was a way
to add info about that to a later journal message
Additionally, let's add an extra check when we're
opening the repo that it's on the same device just on general
principle.
Colin Walters [Wed, 20 Aug 2025 13:51:10 +0000 (15:51 +0200)]
prepare-root: Log to journal, not stdout
Since this can now be used as part of the shared library for
soft reboots, we shouldn't have a library write to stdout.
I noticed this in bootc. Use the journal instead.
In full_system_sync we were calling syncfs(/) expecting
all the recent modification in /ostree to be synced to disk.
With / now being composefs, syncfs(/) is a noop, so call
syncfs(/ostree) as that is what we really want.
The code in get_kernel_from_tree_usrlib_modules() that checks for an
"aboot.cfg" does nothing with it (and in fact may leak the fd in case
its there). In practice, /usr/lib/modules never has an aboot.cfg, so
this is just completely dead code.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
The change in https://github.com/ostreedev/ostree/pull/3413/ was meant
to change when the abootcfg option is set in the BLS file. However,
it also changed the value of this key, using the wrong directory
(bootcsumdir instead of /usr/lib/ostree-boot).
This means that during update, aboot-update gets the wrong path to the
config and cannot correctly write the aboot partition.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
Colin Walters [Tue, 22 Jul 2025 14:52:45 +0000 (10:52 -0400)]
rust: Fix a few warnings
- Unused imports because we weren't actually exporting the structs
from those modules
- glib prelude is empty now?
- mount namespace usage is conditional
projects / ostree.git / log