If `/boot` is an automount, then the unit will be stopped as soon as the
automount expires. That's would defeat the purpose of using systemd to
delay finalizing the deployment until shutdown. This is not uncommon as
`systemd-gpt-auto-generator` will create an automount unit for `/boot`
when it's the EFI System Partition and there's no fstab entry.
To ensure that systemd doesn't stop the service early when the `/boot`
automount expires, introduce a new unit that holds `/boot` open until
it's sent `SIGTERM`. This uses a new `--hold` option for
`finalize-staged` that loads but doesn't lock the sysroot. A separate
unit is used since we want the process to remain active throughout the
finalization run in `ExecStop`. That wouldn't work if it was specified
in `ExecStart` in the same unit since it would be killed before the
`ExecStop` action was run.
Dan Nicholson [Tue, 30 Aug 2022 14:38:36 +0000 (08:38 -0600)]
main: Factor out sysroot loading
It can be useful to parse the options and initialize the sysroot without
actually loading it until later. Factor out the sysroot loading to a new
`ostree_admin_sysroot_load` and add a new
`OSTREE_ADMIN_BUILTIN_FLAG_NO_LOAD` flag to accommodate this.
Huijing Hei [Fri, 19 Aug 2022 03:31:46 +0000 (11:31 +0800)]
Fix `ostree admin kargs edit-in-place` assertion when deployments
are pending
This is to support pending deployments instead of rasing assertion.
For example:
```
$ sudo rpm-ostree kargs --append=foo=bar
$ sudo ostree admin kargs edit-in-place --append-if-missing=foobar
```
After reboot we get both `foo=bar foobar`.
Sam James [Tue, 23 Aug 2022 22:37:06 +0000 (23:37 +0100)]
buildutil/glibtests.m4: fix bashism
configure scripts need to be runnable with a POSIX-compliant /bin/sh.
On many (but not all!) systems, /bin/sh is provided by Bash, so errors
like this aren't spotted. Notably Debian defaults to /bin/sh provided
by dash which doesn't tolerate such bashisms as '=='.
This retains compatibility with bash.
Fixes configure warnings/errors like:
```
checking whether to build static libraries... no
./configure: 14795: test: unexpected operator
```
Colin Walters [Mon, 22 Aug 2022 19:59:33 +0000 (15:59 -0400)]
ci: Also drop seccomp on debian testing
I didn't deep dive into debugging this but I'm pretty sure it's
https://gitlab.gnome.org/GNOME/glib/-/issues/2580
which is us having an older Docker in the middle here.
Colin Walters [Tue, 16 Aug 2022 21:27:46 +0000 (17:27 -0400)]
cli/rev-parse: Add `--single` option
In the current "ostree native container" flow, we're inserting
a commit object into the repo but with no refs.
We have hacks in a few places to find the commit digest via e.g.
`find repo/objects -name *.commit` but that's a horrible hack.
Add `ostree rev-parse --single` which will print the single commit,
and error out if there is not exactly one commit.
Co-authored-by: Jonathan Lebon <jonathan@jlebon.com>
Commit 540e60c3 introduced _ostree_repo_auto_transaction_new(), a
private constructor to OstreeRepoAutoTransaction, by factoring out
some code from _ostree_repo_auto_transaction_start(). This factored
code increased the refcount of the 'repo' variable.
Subsequent commit 71304e854c made ostree_repo_prepare_transaction()
use ths newly introduced constructor. However, in this function, the
happy path assumed no ref was taken, and therefore did not unref it.
Commit 71304e854c didn't add the corresponding unref either.
This leaks a reference to OstreeRepo when calling
ostree_repo_prepare_transaction().
Plug this leak by using g_clear_object() to clear the repo field
of OstreeRepoAutoTransaction, instead of simply setting it to NULL.
Jonathan Lebon [Mon, 15 Aug 2022 17:54:35 +0000 (13:54 -0400)]
lib/commit: Directly use FICLONE for payload link
The idea of payload linking is to reflink between objects where
possible. Instead of relying on `glnx_regfile_copy_bytes` to hit the
`FICLONE` path, just call `FICLONE` directly. At that point in the code,
we've already established that the source and dest repos are on the same
filesystem and that it supports `FICLONE`.
Specifically, I verified that *before* the previous patch to the ed25519 C code, the last bit of code would fail with a SIGSEGV when
trying to read the empty signature.
Colin Walters [Thu, 14 Jul 2022 18:42:19 +0000 (14:42 -0400)]
sign/ed25519: Verify signatures are minimum length
The ed25519 signature verification code does not
check that the signature is a minimum/correct length.
As a result, if the signature is too short, libsodium will end up
reading a few bytes out of bounds.
Reported-by: Demi Marie Obenour <demi@invisiblethingslab.com> Co-authored-by: Demi Marie Obenour <demi@invisiblethingslab.com> Closes: https://github.com/ostreedev/ostree/security/advisories/GHSA-gqf4-p3gv-g8vw
Colin Walters [Wed, 13 Jul 2022 19:35:00 +0000 (15:35 -0400)]
sysroot: Have `ensure_writable` also always initialize
For historical reasons we have a fair bit of distinct sysroot
initialization going on. A lot of code is calling *just* the new
`ensure_writable()` API, which does basically what you'd expect...
except if we're not using a mount namespace.
Which is the case in unit tests and legacy setups.
Change this API to also ensure the sysroot is fully initialized
even in those cases. Specifically we'll have `self->sysroot_fd`.
For now, callers that need `/boot` also need to separately
call `_ensure_boot_fd()`.
Saqib Ali [Tue, 5 Jul 2022 16:00:16 +0000 (12:00 -0400)]
ostree-repo: bls-append-except-default followup
This PR is followup from https://github.com/coreos/coreos-assembler/pull/2863
Summary of changes:
- Moved bls-append-except-default parsing logic to reload_sysroot_config()
- Made sure heap allocated memory is being freed
Colin Walters [Wed, 6 Jul 2022 11:46:42 +0000 (07:46 -0400)]
lib: Stop using old `ostree_sysroot_get_repo()` API
It's falliable, and in one place we were actually ignoring
the error and leaving a `NULL` repo object which is just a trap
for people coming along later since it's rarely nullable.
Quite a while ago we switched to loading the repo at the same time
as the sysroot; convert callers in the library to use this infallible
accessor.
Prep for another patch which will use the repo object.
Saqib Ali [Mon, 6 Jun 2022 21:46:01 +0000 (17:46 -0400)]
lib/prune: speed up pruning by retrieving only commits
After landing the new --commit-only functionality, we still noticed
exceedingly long pruning times in large repos. Lets add an optimization
that will only retrieve commit objects when --commit-only flag is used.
Colin Walters [Thu, 23 Jun 2022 21:36:46 +0000 (17:36 -0400)]
repo: Metadata return values from `load_file` are not nullable
The pattern this API uses in C is to allow the input parameters
pointer targets to be `NULL`, and it doesn't return values in that
case.
A further complexity here is that the API will still return `NULL`
for symbolic links.
But Rust can't express this pattern as is, so we were always
returning values but in `Option<T>` wrappers that the caller needed
to unwrap for the metadata.
(We really want an even more efficient API here that avoids the glib
objects entirely, e.g. no reason not to pass directly back a type
that lets Rust directly read from the fd for bare repos, but
that can come later)
Jonathan Lebon [Tue, 21 Jun 2022 19:10:18 +0000 (15:10 -0400)]
Drop `.packit.yaml`
This repo is already hooked to the @CoreOS/continuous COPR repo for
multi-arch RPM builds of the latest commits.
It's possible we will use Packit in the future to help with the release
process. But for now, let's just drop this file since it's not needed
and the Packit failures are marking git main CI as failed.
Simon McVittie [Fri, 17 Jun 2022 13:15:35 +0000 (14:15 +0100)]
test-basic-c: Don't assert that extended attributes are available
Not all filesystems support extended attributes. This test uses
/var/tmp to try to get an extended-attributes-capable filesystem,
but that might not succeed.
projects / ostree.git / log