Commit Graph

7161 Commits

Author SHA1 Message Date
Misaki Kasumi
2bd95ea855 sysroot: Fix ostree in ostree nsenter 2024-12-21 04:00:26 +08:00
Misaki Kasumi
124035b36b Revert "prepare-root: Make leftover /sysroot immutable"
This reverts commit 1d4dc03de8.
2024-12-21 03:14:36 +08:00
Misaki Kasumi
c7caee9093 sysroot: Use glnx_fstatat_allow_noent, drop ot_path_exists 2024-12-21 03:12:21 +08:00
Misaki Kasumi
627b4f88df prepare-root: Tidy code for root_upperdir and root_workdir 2024-12-21 03:05:24 +08:00
Misaki Kasumi
01de3ea1e2 nsenter: Fix argument parsing 2024-12-21 02:46:00 +08:00
Misaki Kasumi
96e2fb8717 sysroot: Do not require enter mount namespace for ensure_visible and ensure_writable 2024-12-21 02:43:40 +08:00
Misaki Kasumi
646cc34a3f sysroot: rework _ostree_sysroot_ensure_visible 2024-12-20 22:10:21 +08:00
Misaki Kasumi
300d21c1cb sysroot: _ostree_sysroot_invisible & _ostree_in_root_mount_namespace 2024-12-20 22:10:21 +08:00
Misaki Kasumi
3dc167e2ee prepare-root: Fail if sysroot-ns already exists 2024-12-20 22:10:21 +08:00
Misaki Kasumi
6626f51e13 prepare-root: Add some comments 2024-12-20 22:10:21 +08:00
Misaki Kasumi
1d4dc03de8 prepare-root: Make leftover /sysroot immutable 2024-12-20 22:10:21 +08:00
Misaki Kasumi
a5c64da05e prepare-root: Add sysroot.protect as alias of sysroot.readonly 2024-12-20 22:10:21 +08:00
Misaki Kasumi
52d03d762e prepare-root: Use sysroot.readonly=invisible 2024-12-20 22:10:21 +08:00
Misaki Kasumi
fb8a0cec65 sysroot: Fix _ostree_sysroot_ensure_visible ns 2024-12-20 22:10:21 +08:00
Misaki Kasumi
bf10b40387 sysroot: Do not trust mount_namespace_in_use as it's per-thread 2024-12-20 22:10:21 +08:00
Misaki Kasumi
83438a10e6 sysroot: Assert not in root mount namespace 2024-12-20 22:10:21 +08:00
Misaki Kasumi
c5c414a921 chore: Use geteuid() instead of getuid() to check privilege 2024-12-20 22:10:21 +08:00
Misaki Kasumi
b7e46b4e54 ostree: Add command admin nsenter 2024-12-20 22:10:21 +08:00
Misaki Kasumi
a762caeb30 sysroot: Handle invisible sysroot 2024-12-20 22:10:21 +08:00
Misaki Kasumi
412ec41744 remount: Skip remount /sysroot if invisible 2024-12-20 22:10:21 +08:00
Misaki Kasumi
91dda713d7 prepare-sysroot: Add sysroot.invisible 2024-12-20 22:10:21 +08:00
Misaki Kasumi
cb03e4466e prepare-root: It's not necessary to make /var slave anymore 2024-12-20 18:59:41 +08:00
Misaki Kasumi
bfb84a3154 prepare-root: Unmount temporary var mount after /var is mounted 2024-12-20 18:59:09 +08:00
Misaki Kasumi
1db98c0c18 prepare-sysroot: Bind var under /run instead of inplace 2024-12-20 18:52:07 +08:00
Colin Walters
8aaea0c65d
Merge pull request #3361 from cgwalters/release
Release 2024.10
2024-12-19 17:10:40 -05:00
Colin Walters
45ddf3b798
Merge pull request #3351 from cgwalters/fix-transient-root-doc
man: Note semantics combining `root.transient` with `composefs.enabled`
2024-12-19 16:23:48 -05:00
Colin Walters
aca6f17ff8 Post-release version bump
Signed-off-by: Colin Walters <walters@verbum.org>
2024-12-19 15:11:42 -05:00
Colin Walters
66f5a77ae6 Release 2024.10
Signed-off-by: Colin Walters <walters@verbum.org>
2024-12-19 15:10:12 -05:00
Colin Walters
786b38c2cf man: Note semantics combining root.transient with composefs.enabled
It's all quite confusing having to reason about both the pre-composefs
ostree and the composefs version. But hopefully soon we more firmly
leave behind that first legacy.

Signed-off-by: Colin Walters <walters@verbum.org>
2024-12-17 16:04:38 -05:00
Colin Walters
64a38aec8c
Merge pull request #3353 from jlebon/pr/composefs-maybe
libostree/deploy: enable composefs by default
2024-12-17 15:34:37 -05:00
Colin Walters
1c68410368
Merge pull request #3354 from ruihe774/cfs-verity
prepare-root: Add composefs.enabled=verity
2024-12-17 14:59:00 -05:00
Colin Walters
08395e2479
Merge pull request #3348 from qiuzhiqian/main
rofiles-fuse: when fuse execution fails, rofiles-fuse still returns exit code 0
2024-12-17 14:22:10 -05:00
Colin Walters
3f7eb362f4
Merge pull request #3357 from ruihe774/validate-len
sign-ed25519: Fix error message of validate_length
2024-12-17 14:21:53 -05:00
Jonathan Lebon
41a7f36f8e
lib/deploy: error out if composefs enabled but unsupported
If composefs was explicitly requested (`enabled = true`) but libostree
was not compiled with composefs support, error out at deploy time. This
matches the logic in `ostree-prepare-root`.
2024-12-17 13:30:11 -05:00
Jonathan Lebon
9a0acd7249
libostree/deploy: enable composefs by default
The composefs libostree integration has been supported for a while now
and is actively in use in various ostree/bootc-based systems. Let's
turn it on by default.

This has no effect if composefs support is not compiled in. Note also
that this does not change the default value of the `composefs.enabled`
tristate to `true`. The default is still `maybe`, but the deploy API
will now also create composefs images for `maybe`.

The reason for doing it this way is so that systems upgrading from
old libostree versions (which may either not have composefs support or
may have composefs-related bugs) will still be able to upgrade and not
trip `ostree-prepare-root` in the new deployment (which allows missing
composefs images for `maybe`).

We may in the future change the default value to `true`.

See also: https://github.com/ostreedev/ostree/issues/2867
2024-12-17 13:30:08 -05:00
Colin Walters
ec363ade9d
Merge pull request #3356 from cgwalters/fix-ci
Fix ci
2024-12-17 11:39:49 -05:00
Misaki Kasumi
a8f75bfe35 sign-ed25519: Fix error message of validate_length 2024-12-17 15:55:08 +00:00
Misaki Kasumi
5831fb5a63 sysroot-deploy: Require fsverity when composefs.enabled=verity 2024-12-17 15:53:54 +00:00
Misaki Kasumi
881c88162a prepare-root: Add composefs.enabled=verity 2024-12-17 15:53:54 +00:00
Colin Walters
eb9aab652a deny: Add Unicode-3.0
This is under e.g.
https://docs.fedoraproject.org/en-US/legal/allowed-licenses/
and is now used by the unicode-ident crate.
2024-12-16 17:03:03 +00:00
Colin Walters
c1ef3942f3 Switch to quay.io vs registry.ci
The old one was a mirror that seems to have finally
been decommissioned.
2024-12-16 16:56:57 +00:00
Colin Walters
74efebdf50
Merge pull request #3346 from cgwalters/commit-label-ordering
core: Always sort incoming xattrs
2024-12-03 11:20:33 -05:00
qiuzhiqian
8346244443 rofiles-fuse: Fixed the problem that when fuse execution fails, the command returns a status code of 0
testcase:
`$ sudo rofiles-fuse a b`
fuse: bad mount point `b': No such file or directory
`$ echo $?`
0
2024-12-03 20:38:35 +08:00
Colin Walters
1858d3d300 core: Always sort incoming xattrs
When recomputing selinux attrs during commit, we weren't sorting,
which could cause various issues like fsck failures.

This is a big hammer; change things so we always canonicalize
(i.e. sort) the incoming xattrs when creating a file header
and directory metadata.

I think almost all places in the code were already keeping
things sorted, but it's better to ensure correctness first.
If we ever have some performance issue (I'm doubtful) we
could add something like `_ostree_file_header_known_canonicalized`
or so.

Closes: https://github.com/ostreedev/ostree/issues/3343

Signed-off-by: Colin Walters <walters@verbum.org>
2024-12-02 10:40:17 -05:00
Colin Walters
111a45fa5c
Merge pull request #3340 from smcv/issue3339
composefs: Ensure buffer is suitably aligned for struct fsverity_digest
2024-11-14 16:49:32 -07:00
Simon McVittie
67ed2acad4 composefs: Ensure buffer is suitably aligned for struct fsverity_digest
struct fsverity_digest starts with a __u16, so it will normally require
16-bit alignment, which is not guaranteed for a char array.

Resolves: https://github.com/ostreedev/ostree/issues/3339
Signed-off-by: Simon McVittie <smcv@debian.org>
2024-11-14 13:55:11 +00:00
Colin Walters
8705495bc5
Merge pull request #3337 from dabukalam/patch-1
README: Update buildstream URL to new github repo
2024-11-12 08:47:29 -07:00
Danny Abukalam
3543fd823c
README: Update buildstream URL to new github repo 2024-11-12 14:27:15 +00:00
John Eckersberg
295841b472
Merge pull request #3328 from cgwalters/release
Release 2024.9
2024-11-05 09:41:27 -05:00
Colin Walters
72b6963c95 configure: post-release version bump
Signed-off-by: Colin Walters <walters@verbum.org>
2024-11-04 17:27:41 -05:00