Go to file
Jonathan Lebon 83b385bc59 libpriv/scripts: Replace crypto-policies lua script
The latest crypto-policies package changed recently to dynamically set
the policy at install time so that if FIPS is enabled, the selected
backend is `FIPS`:

9b9c9f7378

This doesn't really make sense for us though since the compose server
configuration should be decoupled from the installroot. (More generally,
this also affects e.g. `yum install --installroot`).

Override the script for now so that we always select the `DEFAULT`
policy. We'll discuss with upstream to see what the right solution is
there.

This also works around the fact that rpm-ostree doesn't yet implement
Lua (#749).

Related: https://bugzilla.redhat.com/show_bug.cgi?id=1847454
Resolves: https://github.com/coreos/fedora-coreos-tracker/issues/540
2020-06-17 15:05:53 -04:00
.github Fix GitHub issue template formatting 2018-03-14 21:54:16 +00:00
api-doc rust/treefile: Support dash convention for all options 2019-03-02 19:20:21 +00:00
bindgen rust: Add nix as a dependency 2019-08-30 10:29:23 -04:00
buildutil buildutils: Add libglnx.m4 to .gitignore 2018-04-05 15:26:46 +00:00
ci ci-commitmessage-submodules: Ignore empty merge commits 2020-05-07 22:21:16 +02:00
completion Add support for bash completion 2019-03-01 21:36:39 +00:00
design Initial renaming pass of "jigdo" to "rojig" 2018-02-26 15:32:50 +00:00
docs compose: Add a "warn and sleep" if --unified-core is not provided 2020-05-20 17:17:28 +02:00
experiments-and-demos/skopeo2ostree experiments-and-demos: New subdir with skopeo2ostree Dockerfile 2018-01-11 14:07:17 +00:00
libdnf@44c436bbe9 build(deps): bump libdnf from 066c627 to 44c436b 2020-06-15 13:05:31 -04:00
libglnx@3c285a7b3a build(deps): bump libglnx from fc9073e to 3c285a7 2020-06-15 12:40:54 -04:00
man s/RPM-OSTree/rpm-ostree/ 2020-05-07 21:55:50 +02:00
packaging spec: Fix up conditionals for ELN 2020-05-23 10:18:00 -04:00
rust build(deps): bump serde_json from 1.0.53 to 1.0.55 in /rust 2020-06-15 17:29:01 -04:00
scripts tests: Bump to Python 3 only 2019-05-08 19:02:32 +00:00
src libpriv/scripts: Replace crypto-policies lua script 2020-06-17 15:05:53 -04:00
tests libpriv/scripts: Replace crypto-policies lua script 2020-06-17 15:05:53 -04:00
vagrant vagrant: Add header noting coreos-assembler 2019-05-13 19:50:58 +00:00
.cci.jenkinsfile tests/kola: Move into tests/kolainst, run installed 2020-05-26 15:34:00 -04:00
.dir-locals.el .dir-locals.el: Global Emacs style settings 2017-01-12 16:09:16 +00:00
.editorconfig tree: add vimrc and editorconfig 2017-10-02 14:36:44 +00:00
.gitmodules Rebase to latest libdnf 2019-03-19 14:29:15 +00:00
.vimrc tree: add vimrc and editorconfig 2017-10-02 14:36:44 +00:00
autogen.sh build-sys: Fix use of libglnx configure bits 2017-12-15 16:32:39 +00:00
configure.ac build-sys: Disable zchunk for libdnf if we don't have it 2020-05-14 17:52:43 -07:00
CONTRIBUTING.md docs: fix ostree and CONTRIBUTING.md links 2016-07-12 15:46:53 +00:00
COPYING.GPL Clarify license situation to include GPLv2, relicense Rust code 2019-09-05 20:49:18 +00:00
COPYING.LGPL Clarify license situation to include GPLv2, relicense Rust code 2019-09-05 20:49:18 +00:00
git.mk build: Use git.mk, make git status clean 2016-03-10 14:36:44 -05:00
HACKING.md tests: Start converting some bits into kola ext framework 2020-04-09 23:07:45 +02:00
LICENSE Clarify license situation to include GPLv2, relicense Rust code 2019-09-05 20:49:18 +00:00
Makefile-bash.am build: Hook up bash completions 2019-03-07 00:47:39 +00:00
Makefile-daemon.am build-sys: Remove --enable-new-name 2020-05-14 13:18:00 -07:00
Makefile-decls.am packaging: Support vendoring the Rust sources 2018-06-06 15:52:48 +00:00
Makefile-extra.inc ci: Verify rustfmt 2018-11-21 21:16:03 +00:00
Makefile-lib-defines.am lib: Add version macros and version checking function 2017-07-21 20:35:26 +00:00
Makefile-lib.am Makefile.am: Link with --enable-new-dtags 2020-05-11 21:42:05 +02:00
Makefile-libdnf.am Rebase to latest libdnf 2019-03-19 14:29:15 +00:00
Makefile-libpriv.am app,daemon: Use public libostree's kargs API 2019-08-21 16:47:52 -04:00
Makefile-man.am man: Add rpm-ostreed-automatic page 2018-03-07 22:54:33 +00:00
Makefile-rpm-ostree.am build-sys: Remove --enable-new-name 2020-05-14 13:18:00 -07:00
Makefile-tests.am Rework vmcheck to use kola spawn, move off of PAPR 2019-12-13 19:18:30 +01:00
Makefile.am build-sys: Remove --enable-new-name 2020-05-14 13:18:00 -07:00
mkdocs.yml docs: Start using mkdocs 2016-03-09 11:10:58 -05:00
OWNERS OWNERS: New file for Prow integration 2019-09-27 14:58:21 -04:00
README.md Clarify license situation to include GPLv2, relicense Rust code 2019-09-05 20:49:18 +00:00
Vagrantfile vagrant: Use a Fedora 29 container 2019-05-09 00:08:14 +00:00

rpm-ostree: A true hybrid image/package system

rpm-ostree combines libostree (an image system), with libdnf (a package system), bringing many of the benefits of both together.

                         +-----------------------------------------+
                         |                                         |
                         |       rpm-ostree (daemon + CLI)         |
                  +------>                                         <---------+
                  |      |     status, upgrade, rollback,          |         |
                  |      |     pkg layering, initramfs --enable    |         |
                  |      |                                         |         |
                  |      +-----------------------------------------+         |
                  |                                                          |
                  |                                                          |
                  |                                                          |
+-----------------|-------------------------+        +-----------------------|-----------------+
|                                           |        |                                         |
|         libostree (image system)          |        |            libdnf (pkg system)          |
|                                           |        |                                         |
|   C API, hardlink fs trees, system repo,  |        |    ties together libsolv (SAT solver)   |
|   commits, atomic bootloader swap         |        |    with librepo (RPM repo downloads)    |
|                                           |        |                                         |
+-------------------------------------------+        +-----------------------------------------+

For more information, see the online manual: Read The Docs (rpm-ostree)

Features:

  • Transactional, background image-based (versioned/checksummed) upgrades
  • OS rollback without affecting user data (/usr but not /etc, /var) via libostree
  • Client-side package layering (and overrides)
  • Easily make your own: rpm-ostree compose tree and CoreOS Assembler

Projects using rpm-ostree

The OSTree project is independent of distributions and agnostic to how content is delivered and managed; it's used today by e.g. Debian, Fedora, and OpenEmbedded derived systems among others. There are some examples in the OSTree github.

In contrast, rpm-ostree is intended to be tightly integrated with the Fedora ecosystem. Today it is the underlying update mechanism of Fedora CoreOS as well as its derivative RHEL CoreOS. It is also used by Fedora IoT and Fedora Silverblue.

Originally, it was productized as part of Project Atomic.

Why?

Package systems such as apt and yum are highly prevalent in Linux-based operating systems. The core premise of rpm-ostree is that image-based updates should be the default. This provides a high degree of predictability and resiliency. However, where rpm-ostree is fairly unique in the ecosystem is supporting client-side package layering and overrides; deeply integrating RPM as an (optional) layer on top of OSTree.

A good way to think of package layering is recasting RPMs as "operating system extensions", similar to how browser extensions work (although before those were sandboxed). One can use package layering for components not easily containerized, such as PAM modules, custom shells, etc.

Further, one can easily use rpm-ostree override replace to override the kernel or userspace components with the very same RPMs shipped to traditional systems. The Fedora project for example continues to only have one kernel build.

Layering and overrides are still built on top of the default OSTree engine - installing and updating client-side packages constructs a new filesystem root, it does not by default affect your booted root. This preserves the "image" nature of the system.

Manual

For more information, see the online manual: Read The Docs (rpm-ostree)

Talks and media

A number of Project Atomic talks are available; see for example this post which has a bigger collection that also includes talks on containers.

rpm-ostree specific talks:

License

rpm-ostree includes code licensed under GPLv2+, LGPLv2+, (Apache 2.0 OR MIT). For more information, see LICENSE.