Commit Graph

3402 Commits

Author SHA1 Message Date
Colin Walters
de153dea30 lib/sysroot: Add journal-msg signal
This will allow us to drop the awful hack in rpm-ostree where we watch our own
stdout. In general, libraries shouldn't write to stdout.

Also we can kill the systemd journal wrapper code. There's some duplication at
each call site now...but it's easier than trying to write a `sd_journal_send()`
wrapper.

I was originally going to have this emit all of the structured data too as a
`GVariant` but decided it wasn't worth it right now.

Closes: #1052
Approved by: jlebon
2017-08-10 14:20:00 +00:00
Philip Withnall
75bce24cb9 lib/gpg-verify: Add an OstreeGpgError error domain
Add a new error domain for GPG signing/verification errors, and use it
throughout libostree for describing verification errors. This replaces
various uses of G_IO_ERROR_FAILED, and one instance of
G_IO_ERROR_NOT_FOUND (for which some code in ot-builtin-show.c had to be
changed to ensure it was still handled correctly).

The use of a separate error domain allows failures in GPG operations to
be handled separately from network failures (where the summary file
could not be found to be downloaded, for example) or timeouts.

Signed-off-by: Philip Withnall <withnall@endlessm.com>

Closes: #1064

Closes: #1071
Approved by: mbarnes
2017-08-10 13:38:40 +00:00
Colin Walters
f1102763df lib/sysroot-deploy: Refactor kernel layout parsing
I'd like to move the new canonical kernel directory to `/usr/lib/modules/$kver`,
as Fedora has done. The `get_kernel_from_tree()` function now abstracts over
parsing the data (src vs destination filenames, as well as checksum) in
preparation for adding the new case.

In preparation for this, let's change the current test suite to use the
*current* directory of `/usr/lib/ostree-boot`, and also add coverage of `/boot`.

Closes: #1053
Approved by: jlebon
2017-08-09 13:46:17 +00:00
Colin Walters
8b60f63f58 lib/sysroot-deploy: Port a kernel finding logic to new style
Prep for more work here.

Closes: #1053
Approved by: jlebon
2017-08-09 13:46:17 +00:00
Lisa St. John
596fc2967e Update introduction.md
Added missing "is" in the first sentence.
Closes: #1067
Approved by: cgwalters
2017-08-09 13:15:44 +00:00
Philip Withnall
8c148eb7e1 lib/repo-finder: Emit gpg-verify-summary=false in dynamic remote config
When returning results from finding repos, set gpg-verify-summary=false
in their configs, since any pulls from such remotes will necessarily
involve collection IDs, and hence should be using the unsigned summary
support. In the intended deployment mode for P2P transmission of OSTree
refs, summaries *cannot* be signed, so setting gpg-verify-summary=true
would cause all the pulls to fail.

The unsigned summary support is the move of repository metadata from
the summary file (not spliceable) to the well-known ostree-metadata ref
(spliceable, as it can exist for multiple collection IDs in the same
repository).

Signed-off-by: Philip Withnall <withnall@endlessm.com>

Closes: #1066
Approved by: cgwalters
2017-08-08 18:08:05 +00:00
Colin Walters
8642ef5ab3 lib/deploy: Use a FIFREEZE/FITHAW cycle for /boot
See: http://marc.info/?l=linux-fsdevel&m=149520244919284&w=2

XFS doesn't flush the journal on `syncfs()`. GRUB doesn't know how to follow the
XFS journal, so if the filesystem is in a dirty state (possible with xfs
`/boot`, extremely likely with `/`, if the journaled data includes content for
`/boot`, the system may be unbootable if a system crash occurs.

Fix this by doing a `FIFREEZE`+`FITHAW` cycle.  Now, most people
probably would have replaced the `syncfs()` invocation with those two
ioctls.  But this would have become (I believe) the *only* place in
libostree where we weren't safe against interruption.  The failure
mode would be ugly; nothing else would be able to write to the filesystem
until manual intervention.

The real fix here I think is to land an atomic `FIFREEZETHAW` ioctl
in the kernel.  I might try a patch.

In the meantime though, let's jump through some hoops and set up
a "watchdog" child process that acts as a fallback unfreezer.

Closes: https://github.com/ostreedev/ostree/issues/876

Closes: #1049
Approved by: jlebon
2017-08-08 16:09:04 +00:00
Colin Walters
9f8f351cd4 lib: Port gpg verification for remotes to fd-relative
This was the last use of `repo->repodir` internally, and will help finally add
`ostree_repo_open_at()`.

Closes: #1034
Approved by: jlebon
2017-08-08 15:50:25 +00:00
Philip Withnall
1672e2eee0 lib/repo: Fix handling of missing summary files when downloading
The API for downloading a summary file can legitimately return NULL for
the summary file contents when it returns TRUE (success). This indicates
an error 404 — the summary file was not found.

Two call sites were not handling that correctly, which was causing later
assertion failures.

Signed-off-by: Philip Withnall <withnall@endlessm.com>

Closes: #1061

Closes: #1065
Approved by: cgwalters
2017-08-08 15:33:45 +00:00
Philip Withnall
86dce4b252 ostree/parse-datetime: Ensure tm structs are initialised
Otherwise tm.tm_wday remains uninitialised and gets propagated
elsewhere.

Spotted by Coverity as issue #209265.

Signed-off-by: Philip Withnall <withnall@endlessm.com>

Closes: #1059
Approved by: cgwalters
2017-08-08 14:11:07 +00:00
Philip Withnall
e9b9123bae lib/sepolicy: Drop duplicate assignment
Spotted by Coverity as issue #1452619.

Signed-off-by: Philip Withnall <withnall@endlessm.com>

Closes: #1059
Approved by: cgwalters
2017-08-08 14:11:07 +00:00
Philip Withnall
4f187b576d lib/repo-commit: Drop unreachable conditional branch
(remaining > 0) is asserted by the loop condition, and remaining is not
modified between that check and the G_UNLIKELY — so the condition in the
G_UNLIKELY will always be true.

Spotted by Coverity as issue #1452617.

Signed-off-by: Philip Withnall <withnall@endlessm.com>

Closes: #1059
Approved by: cgwalters
2017-08-08 14:11:07 +00:00
Philip Withnall
baa9534fda lib/repo-finder-avahi: Drop redundant conditional
summary_timestamp is checked for non-NULL-ness above, and the function
bails if it’s NULL.

Fixes Coverity issue #1452616.

Signed-off-by: Philip Withnall <withnall@endlessm.com>

Closes: #1059
Approved by: cgwalters
2017-08-08 14:11:06 +00:00
Philip Withnall
f35b409077 lib/repo-refs: Add ostree_repo_remote_list_collection_refs() API
This parallels ostree_repo_remote_list_refs(), but returns a map of
OstreeCollectionRef → checksum, and includes refs from collection IDs
other than the remote repository’s main collection ID.

Use this in OstreeRepoFinderConfig to ensure that refs are matched
against even if they’re stored in the repository summary file’s
collection map, rather than its main ref map. This fixes false negatives
when searching for refs in some situations.

Signed-off-by: Philip Withnall <withnall@endlessm.com>

Closes: #1058
Approved by: cgwalters
2017-08-08 13:59:58 +00:00
Philip Withnall
11e165b154 lib/repo-pull: Add a missing precondition
This catches a few failure modes in the pull code a little earlier,
before the incorrectly-NULL repo makes its way into a closure and a
worker thread, where the cause of the problem is harder to track down.

Signed-off-by: Philip Withnall <withnall@endlessm.com>

Closes: #1058
Approved by: cgwalters
2017-08-08 13:59:58 +00:00
Philip Withnall
0d2a9a7909 lib/repo-finder: Avoid a potential unref-of-NULL crash
As the comment explains, it’s possible for a result to be freed while
ref_to_checksum is NULL, even though normally the data structure
guarantees it’s non-NULL. This was causing crashes when results were
filtered out of a find-remotes call. Guard against that.

Signed-off-by: Philip Withnall <withnall@endlessm.com>

Closes: #1058
Approved by: cgwalters
2017-08-08 13:59:58 +00:00
Philip Withnall
be4832242d lib/repo-pull: Fix counting of latest commits when finding repos
The intended behaviour of ostree_repo_find_remotes() is to return
results which have the latest version of at least one of the requested
refs. Results which have some of the requested refs, but don’t have the
latest version of any of them, should be ignored. The logic to do this
was broken in the case that a result contained a positive number of the
requested refs, but none of them were the latest version. (It previously
worked when the result contained none of the requested refs.)

Fix the counting to work correctly in both cases.

Signed-off-by: Philip Withnall <withnall@endlessm.com>

Closes: #1058
Approved by: cgwalters
2017-08-08 13:59:58 +00:00
Stef Walter
39b3c8e90a man: The min-free-space-percent item goes in [core] section
The documentation incorrectly indicates that min-free-space-percent
goes in the [remote "name"] section. It should go in [core] instead.

Closes: #1062
Approved by: cgwalters
2017-08-08 12:56:47 +00:00
Stef Walter
773154a513 autogen.sh: Fix running out of tree
The autogen.sh script should be runnable out of tree. It's mostly
already the case, just one little tweak to make it work.

   $ mkdir build
   $ cd build
   $ ../autogen.sh --prefix=/usr

Closes: #1063
Approved by: cgwalters
2017-08-08 12:44:17 +00:00
Colin Walters
6d861dd92d tree-wide: Remove trailing semicolon from autoptr declarations
It confuses `g-ir-scanner`, and isn't necessary.

Closes: #1056
Approved by: pwithnall
2017-08-07 17:42:32 +00:00
Colin Walters
48f8f32921 bin/pull: Fix @ override syntax when pulling multiple refs
Coverity spotted an infloop here since we were incrementing `i++`
instead of `j++`.  But adding a test revealed other bugs - we need
to keep the arrays in sync.

Coverity CID: 1452204

Closes: #1041
Approved by: pwithnall
2017-08-07 16:10:08 +00:00
Colin Walters
8eec337fee lib/deltas: Squash Coverity warning for div-by-zero in delta show
If a delta happens to have zero objects, we could end up doing
a divide-by-zero when inferring endianness.  In practice,
a zero-object delta isn't possible to generate I think, but
let's make sure the code is defensive all the same.

Spotted by Coverity.

Coverity CID: 1452208

Closes: #1041
Approved by: pwithnall
2017-08-07 16:10:08 +00:00
Guy Shapiro
b08a198f00 Documentation: static delta default from
Document that the default behavior of `ostree static-delta generate` if to generate the delta from the parent.
Closes: #1057
Approved by: cgwalters
2017-08-07 15:06:55 +00:00
Matthew Leeds
5682f4cc04 main: Fix subcommand usage output
This commit sets prgname correctly so that the "ostree subcommand
--help" output prints the subcommand rather than just "ostree".

This was removed in commit f0519e541f because it tripped the thread
sanitizer, but it's being added back conditionally so most users who
don't compile with -fsanitize=adress see proper help output.

Closes: #1054
Approved by: cgwalters
2017-08-05 00:55:36 +00:00
Colin Walters
4e068f3924 tree-wide: Fix the build with old glib (Ubuntu Trusty etc.)
This regressed with <https://github.com/ostreedev/ostree/pull/1040>
but currently the Travis builds aren't gating.

Closes: #1051
Approved by: jlebon
2017-08-03 16:23:41 +00:00
Colin Walters
d3897e52e7 lib: Define and use an autoptr cleanup for gpgme_key_t
Followup for previous patch, allows porting a bit to new code style.

Closes: #1039
Approved by: jlebon
2017-08-03 15:01:57 +00:00
Colin Walters
b929b620ae tree-wide: Use g_autoptr(Ostree*)
Part of cleaning up our usage of libglnx; we want to use what's in GLib where we
can.

Had to change a few .c files to `#include ostree.h` early on to pick up
autoptrs for the core types.

Closes: #1040
Approved by: jlebon
2017-08-03 13:48:12 +00:00
Guy Shapiro
aa63d0e0c5 Documentation: README: Remove deprecated wiki link
The old wiki only contains link back to readthedocs.
The link to is useless.
Closes: #1050
Approved by: cgwalters
2017-08-03 13:00:26 +00:00
Colin Walters
7f33d94dde tests/libtest-core.sh: Add a comment that this copy is canonical
Ref: https://github.com/projectatomic/bubblewrap/pull/203

Closes: #1047
Approved by: jlebon
2017-08-02 17:55:50 +00:00
Colin Walters
e0f17b41ba lib/pull: Log state of summary/commit GPG verification
Since we have both, we should clearly log the state of both of
them.  Split this out of a larger patch.

Closes: #1046
Approved by: jlebon
2017-08-02 17:45:49 +00:00
Colin Walters
d5273b34d0 lib/repo: Add API to create and list ref aliases
There are multiple use cases where we'd like to alias refs.

First, having a "stable" alias which gets swapped across major
versions: https://pagure.io/atomic-wg/issue/228

Another case is when a ref is obsoleted;
<https://pagure.io/atomic-wg/issue/303>
This second one could be done with endoflife rebase, but I think
this case is better on the server side, as we might later change
our minds and do actual releases there.

I initially just added some test cases for symlinks in the `refs/heads` dir to
ensure this actually works (and it did), but I think it's worth having APIs.

Closes: #1033
Approved by: jlebon
2017-08-02 17:33:10 +00:00
Colin Walters
d1eb909cd0 lib/deploy: Add structured logging info for syncfs() times
I plan to at some point change rpm-ostree to read the journal messages from
libostree and render things like the time we spent in syncfs().

Closes: #1044
Approved by: jlebon
2017-08-02 17:19:37 +00:00
Colin Walters
4d723df2f2 lib/sysroot: Add prefixes to syncfs/fsync error messages
And clean up one other bare `glnx_throw_errno()`.

Closes: #1044
Approved by: jlebon
2017-08-02 17:19:37 +00:00
Colin Walters
40b41d2cc9 tree-wide: Use GLib autocleanups for libarchive
Define typedefs for read/write archives, and use the GLib
autocleanups for them.   Prep for updating libglnx to drop its
custom autocleanup macros.

Closes: #1042
Approved by: jlebon
2017-08-02 16:55:38 +00:00
Colin Walters
ded6417aee lib/gpg: Switch to GLib autocleanups for gpgme types
Prep for dropping `GLNX_DEFINE_CLEANUP_FUNCTION` from libglnx
in favor of using GLib's `G_DEFINE_AUTO_CLEANUP_FREE_FUNC()`.

Closes: #1042
Approved by: jlebon
2017-08-02 16:55:38 +00:00
Colin Walters
6347c0fb88 lib/curl: Only check individual request errors
It looks like `curl_multi_socket_action()` will return an error
if *one* of the requests has an error, but we already check
for that explicitly by iterating over each handle.

In libcurl, the "easy" layer doesn't really make use of this
return value.  I did a bit of looking elsewhere; systemd
does check it as a runtime error, not an assertion.  librepo
doesn't use the multi interface.

Closes: https://github.com/ostreedev/ostree/issues/1035

Closes: #1038
Approved by: jlebon
2017-08-02 15:44:00 +00:00
Colin Walters
2f0707a054 lib/commit: Rework a conditional set for clarity and Coverity
Coverity complained that the `else if (bytes_read == 0)` was dead
code if we happened to find it was already false when testing
`else if (G_UNLIKELY (bytes_read == 0 ...`.

There was nothing wrong with the logic, but let's rework it to
only test the value once; I think it does end up nicer anyways.

Coverity CID: 1452186

Closes: #1037
Approved by: jlebon
2017-08-02 15:34:16 +00:00
Colin Walters
fe8938227e tests/lzma: Fix off-by-one in buffer size
Coverity spotted that we had an off-by-one here since we were using
`i+1`.  Fix this by adding a `-1` to the bounds check.  Also use
`sizeof()` to ensure the data and size are coupled.

Coverity CID: 1452207

Closes: #1037
Approved by: jlebon
2017-08-02 15:34:16 +00:00
Colin Walters
e70db67c01 rofiles-fuse: Add missing error handling for fcntl()
Spotted by Coverity.

Coverity CID: 1452201

Closes: #1037
Approved by: jlebon
2017-08-02 15:34:16 +00:00
Colin Walters
5daae8629e tests/lzma: Use GRand over random()
It's designed for test suites and non-critical random uses like this. This
silences a Coverity warning about weak randomness.

Closes: #1037
Approved by: jlebon
2017-08-02 15:34:16 +00:00
Colin Walters
78348fa296 bin/refs: Fix error handling logic
Spotted by Coverity.

Coverity CID: 1452202

Closes: #1037
Approved by: jlebon
2017-08-02 15:34:16 +00:00
Colin Walters
36ab8cd0e1 tests: Add some return value checking to pacify Coverity
No real problems here, but Coverity likes to see consistent checking of return
values, and I agree with it.

Coverity CID: 1452213
Coverity CID: 1452211

Closes: #1037
Approved by: jlebon
2017-08-02 15:34:16 +00:00
Colin Walters
fbefe875c7 docs/pull: Finish incomplete docs for pull@hash syntax
Closes: https://github.com/ostreedev/ostree/issues/1043

Closes: #1045
Approved by: guyshapiro
2017-08-01 21:51:17 +00:00
Robert McQueen
e8a9172daa gpg-verify-result: try to display the primary key ID from signatures
The fingerprint associated with each signature can be different to
the primary key ID (the normal one that people use to identify a
GPG key) if the signature is from a signing subkey. Try to find the
primary key and print this ID in preference to the subkey signature.

https://github.com/ostreedev/ostree/issues/608

Closes: #1036
Approved by: cgwalters
2017-07-31 14:37:09 +00:00
Robert McQueen
156cf23576 gpg-verify-result: canonicalise key when looking up signatures
Use gpgme_get_key to find the primary key for the key we are
looking for, and the primary key for each signature, and
compare these when looking up signatures.

The primary key is the first in the list of subkeys, which is
the normal key ID people use when referring to a GPG key as an
identity.

If the key has a signing subkey, signature->fpr will not match
the provided key_id, so looking up both keys and comparing the
primary key fingerprints ensures they are both canonicalised.

https://github.com/ostreedev/ostree/issues/608

Closes: #1036
Approved by: cgwalters
2017-07-31 14:37:09 +00:00
Colin Walters
d7f953aa3a lib/pull: Journal fetch results
This is a continuation of addition of journaling to libostree; see
e.g. <https://github.com/ostreedev/ostree/pull/708>.

I wanted more information at the end of fetches; in particular
some details about the delta execution (what opcodes etc.), but
this is a first step: we log things like the transferred data
as well as whether or not GPG was enabled, etc.

One awkward thing about this is how we map the fetcher options like
`tls-ca-path` back out into an enum for the code to log. But eh, hard to fix
without a bigger refactoring.

Closes: #1032
Approved by: jlebon
2017-07-28 13:50:22 +00:00
Colin Walters
d24b259cc5 grub2: Handle aarch64 (at least on Fedora/RHEL)
See: https://github.com/projectatomic/rpm-ostree-toolbox/issues/102#issuecomment-316483554

The logic here should now match what grubby does.  I have no
idea whether this applies to other distributions though.

Closes: #1021
Approved by: jlebon
2017-07-27 18:21:00 +00:00
Colin Walters
79a88ac249 build-sys: Post-release version bump
Closes: #1029
Approved by: jlebon
2017-07-26 21:04:08 +00:00
Colin Walters
fa3e07e5d7 Release 2017.9
Closes: #1029
Approved by: jlebon
2017-07-26 21:04:08 +00:00
Colin Walters
f1f199578e ci: Enable libcurl by default on Fedora
The insttest fell over since its build used libsoup, but that just dropped out
of FAH.

Closes: #1030
Approved by: jlebon
2017-07-26 20:54:35 +00:00