The original code in "ostree admin upgrade" had a comment:
/* Here we perform cleanup of any leftover data from previous
* partial failures. This avoids having to call gs_shutil_rm_rf()
* at random points throughout the process. */
But since I deleted that initial cleanup call, we *do* need to do the
cleanup during the process run. It turns out there are only a few
places this is necessary.
Colin Walters [Mon, 8 Sep 2014 15:47:58 +0000 (11:47 -0400)]
build: Unify CPPFLAGS settings
The libostree core uses SYSCONFDIR now, so we should ensure it's used
consistently. Someone else was seeing SYSCONFDIR not being defined
while compiling with a newer automake version, which may process
CPPFLAGS more precisely.
Colin Walters [Thu, 31 Jul 2014 22:50:19 +0000 (18:50 -0400)]
Add repository "summary" file and metalink support
For Fedora and potentially other distributions which use globally
distributed mirrors, metalink is a popular solution to redirect
clients to a dynamic set of mirrors.
In order to make metalink work though, it needs *one* file which can
be checksummed. (Well, potentially we could explode all refs into the
metalink.xml, but that would be a lot more invasive, and a bit weird
as we'd end up checksumming the checksum file).
This commit adds a new command:
$ ostree summary -u
To regenerate the summary file. Can only be run by one process at a
time.
After that's done, the metalink can be generated based on it, and the
client fetch code will parse and load it.
Anne LoVerso [Tue, 5 Aug 2014 12:41:50 +0000 (08:41 -0400)]
repo-pull: Allow pulling only one directory
Changes the pull API to allow pulling only a single directory instead
of the whole deployment. This option is utilized by the check-diff
option in rpm-ostree.
Add a new state directory to hold <checksum>.commitpartial files, so
we know that we've only downloaded partial state.
Colin Walters [Sun, 3 Aug 2014 18:32:52 +0000 (14:32 -0400)]
deploy: Also honor multiply-specified kernel args with existing config
If we deployed a new tree inside an existing OS, inheriting kernel
args, we need to use append() instead of replace() to avoid collapsing
multiply specified kernel arguments like console=/dev/foo
console=/dev/bar.
Colin Walters [Sun, 20 Jul 2014 16:18:09 +0000 (12:18 -0400)]
core: Do enumerate content objects in archive-z2 repositories
Prune has worked fine on bare repositories for some time, but now that
I finally try to delete data on the server side, I notice we weren't
actually enumerating content objects =/
Anne LoVerso [Fri, 11 Jul 2014 18:00:45 +0000 (14:00 -0400)]
ostree-repo-resolve-rev: Add function to accept a partial checksum
This patch adds a function that will parse a partial checksum when
resolving a refspec. If the inputted refspec matches a truncated
existing checksum, it will return that checksum to be parsed. If
multiple truncated checksums match the partial refspec, it is not
unique and will return false. This addition is inspired by the same
functionality in Docker, which allows a user to reference a specific
commit without typing the entire checksum.
partial checksums: Add function to abstract comparison
This modifies the list_objects and list_objects_at functions
to take an additional argument for the string that a commit starts
with. If this string arg is not null, it will only list commit
objects beginning with that string. This allows for a new function
ostree_repo_list_commit_objects_starting_with to pass a partial string
and return a list of all matching commits. This improves on the
previous strategy of listing refs because it will list all commit objects,
even ones in past history. This update also includes bugfixes on
error handling and string comparison, and changes the output structure
of resolve_partial_checksum. The new strcuture will no longer return FALSE
without error. Also, the hashtable foreach now uses iter. Also
includes modified test file
Owen W. Taylor [Wed, 9 Jul 2014 23:07:38 +0000 (19:07 -0400)]
ostree-remount: mount a tmpfs on /var if necessary so /var is read-write
/var needs to be read-write for a functioning system. Various
systemd services will fail to start if /var is read-only. After we
remount /var (or if we skip remounting /var because / is read-only),
if /var is still readonly, mount a tmpfs file system on /var.
While this isn't strictly part of ostree, keeping it here makes sense
because it keeps twiddling around with the /var mount in one place
for easier coordination and maintenance. This will likely need updating
if systemd gains better support for a readonly root filesystem.
Colin Walters [Thu, 26 Jun 2014 23:39:26 +0000 (19:39 -0400)]
core: add "tls-ca-path" option
Some organizations will want to use private Certificate Authorities to
serve content to their clients. While it's possible to add the CA
to the system-wide CA store, that has two drawbacks:
1) Compromise of that cert means it can be used for other web traffic
2) All of ca-certificates is trusted
This patch allows a much stronger scenario where *only* the CAs in
tls-ca-path are used for verification from the given repository.
Anne LoVerso [Tue, 17 Jun 2014 19:24:08 +0000 (15:24 -0400)]
manpage: Add separate manpages for each command
Using docker as a model, this update creates separate manpages
for each OSTree command, such that the main manpage is not
cluttered and the separate pages can provide more in-depth detail
and exanples that might be useful to a user. Each page includes
synopsis, description, example, and a list of options if needd.
This update also alphabetizes the usage error output for ostree
and ostree admin so that it matches the list on the manpage.
Colin Walters [Sat, 21 Jun 2014 21:30:11 +0000 (17:30 -0400)]
[staticanalysis]: Actually check errors on splice() of objects
We were using unsigned size when we should have been using signed,
this means we basically weren't checking for errors on write...ouch.
Luckily if we e.g. hit ENOSPC during a pull, the checksums wouldn't
match and we'd return an error anyways. However when writing an
object, we'd end up silently ignoring it =/
Colin Walters [Fri, 6 Jun 2014 20:17:05 +0000 (16:17 -0400)]
pull: Emit a better error if the remote isn't found
The generic GKeyFile error isn't quite informative enough here.
I hit this with the new compose process where we don't automatically
inject a configured remote into the generated disk images; we expect
people to add them.
Colin Walters [Mon, 16 Jun 2014 21:11:50 +0000 (17:11 -0400)]
pull: Support --mirror option
There's several use cases for calling into ostree itself to do
mirroring, instead of using bare rsync. For example, it's a bit more
efficient as it doesn't require syncing the objects/ directory.
Colin Walters [Wed, 11 Jun 2014 20:40:50 +0000 (16:40 -0400)]
log: Print a friendly error if we haven't downloaded the complete history
For the local repository on the system, it's not the usual case to
have the complete compose history. Rather than erroring out, provide
a bit more friendly message.
Colin Walters [Wed, 4 Jun 2014 22:21:32 +0000 (18:21 -0400)]
libostree: Silently ignore EPERM when setting EXT2_IMMUTABLE_FL
In the case of running ostree as non-root on a regular filesystem (not
tmpfs which doesn't support immutable), we should just silently do
nothing if we encounter EPERM. Cache the result to avoid spam in
strace.
Colin Walters [Sun, 8 Jun 2014 11:56:14 +0000 (07:56 -0400)]
libostree: Make OstreeLibarchiveInputStream explicitly private
We weren't installing the headers, but at the moment all symbols
starting with ostree_ were being exported. Fix that by prefixing
non-static symbols with '_'.
Vadim Rutkovsky [Tue, 3 Jun 2014 23:40:32 +0000 (01:40 +0200)]
Honor disable_fsync during checkout also
Finally, fsync to ensure all entries are on disk, unless disabled.
We support disabling this for cases like server-side buildroot
construction where we don't need to be robust against power loss
Colin Walters [Tue, 3 Jun 2014 21:38:00 +0000 (17:38 -0400)]
ostree-remount: Check for / being *mounted* read-only, not necessarily writable
The previous S_IMMUTABLE commit broke ostree-remount; / is now not
actually writable. All we really wanted to know though was whether it
was *mounted* writable, so check that via statvfs() which is cleaner
anyways (i.e. not via access() which kernel people hate).
James Antill [Mon, 2 Jun 2014 20:31:58 +0000 (16:31 -0400)]
Add --disable-fsync option to both commit and pull (non-local)
On some storage configurations, fsync() can be extremely expensive.
Developers and users with slow hard drives may want the ability to opt
for speed over safety.
Furthermore, many production servers have UPS and stable kernels, and
the risk of not fsync'ing in that scenario is fairly low. These users
should also be able to opt out.
Colin Walters [Fri, 30 May 2014 14:02:01 +0000 (10:02 -0400)]
deploy: Set the immutable bit on the deployment root
This prevents people from creating new directories there and expecting
them to be persisted. The OSTree model has all local state to be in
/etc and /var.
This introduces a compile-time dependency on libe2fsprogs.
We're only doing this for the root directory at the moment.
Colin Walters [Fri, 25 Apr 2014 19:14:42 +0000 (15:14 -0400)]
Limit metadata to 10 MiB
If fetching GPG-signed commits over plain HTTP, a MitM attacker can
fill up the drive of targets by simply returning an enormous stream
for the commit object.
Related to this, an attacker can also cause OSTree to perform large
memory allocations by returning enormous GVariants in the metadata.
This helps close that attack by limiting all metadata objects to 10
MiB, so the initial fetch will be truncated.
But now the attack is only slightly more difficult as the attacker
will have to return a correctly formed commit object, then return a
large stream of < 10 MiB dirmeta/dirtree objects.
Colin Walters [Mon, 26 May 2014 22:32:17 +0000 (18:32 -0400)]
repo: Don't require a txn for writing
The current "transaction" symlink was introduced to fix issues with
interrupted pulls; normally we assume that if we have a metadata
object, we also have all objects to which it refers.
There used to be a "summary" which had all the available refs, but I
deleted it because it wasn't really used, and was still racy despite
the transaction bits.
We still want the pull process to use the transaction link, so don't
delete the APIs, just relax the restriction on object writing, and
introduce a new ostree_repo_set_ref_immediate().
Colin Walters [Mon, 26 May 2014 22:36:03 +0000 (18:36 -0400)]
repo: Only load /etc/ostree/remotes.d for system repo
They shouldn't be loaded for random test/personal repositories. Doing
so triggers another bug in that we return them from
ostree_repo_get_config() when then causes clients to write them out
permanently to disk with ostree_repo_write_config(). This caused test
suite failures.
Colin Walters [Thu, 22 May 2014 23:24:39 +0000 (19:24 -0400)]
selinux-ensure-labeled: Support no arguments to just traverse deployment root
This makes it easy to use for the case where rpm-ostree-toolbox is
injecting systemd services into the deployment root, and we don't
actually need to traverse the whole FS.
Colin Walters [Thu, 8 May 2014 13:16:36 +0000 (09:16 -0400)]
Support /etc/ostree/remotes.d
For many OS install scenarios, one runs through an installer which may
come with embedded data, and then the OS is configured post-install to
receive updates.
In this model, it'd be nice to avoid the post-install having to rewrite
the /ostree/repo/config file.
Additionally, it feels weird for admins to interact with "/ostree" -
let's make the system feel more like Unix and have our important
configuration in /etc.
Owen W. Taylor [Mon, 5 May 2014 22:58:01 +0000 (18:58 -0400)]
trivial-httpd: flush after writing the port to stdout
The option --port-file=- is most useful when the stdout of the daemon
is programatically redirected and not going to a terminal. The
flush-after-a-line behavior of stdout is specific to terminals, so
we need an explicit flush.
projects / ostree.git / log