Operating system and container binary deployment and upgrades
Go to file
Dan Nicholson b786d1b4bc tests/gpg-verify-data: Empty out trustdb.gpg
When the private keys were generated, gpg added an ultimate trust entry
since you normally want to trust your own keys. However, this throws off
the expired signature testing since gpgme considers it valid if the key
is fully or ultimately trusted.

The use of a trustdb for the test-gpg-verify-result is unlike any other
GPG verification in ostree. Under normal circumstances, a temporary GPG
homedir is created without any trust information, so all keys are
treated as having unknown trust.

Regenerate an empty trustdb.gpg in gpg-verify-data so that the tests
behave as ostree normally operates. After this the expired signature
testing correctly shows up as a non-valid signature. The trustdb was
regenerated by simply removing it and running any gpg operation with the
gpg-verify-data directory as the homedir.
2020-01-24 13:02:09 -07:00
apidoc Support mounting /sysroot (and /boot) read-only 2019-12-11 15:33:57 +00:00
bash bin/refs: Allow overwriting existing ref 2019-06-12 15:00:19 +00:00
bsdiff@1edf9f6568 bsdiff: change submodule location 2015-03-26 23:33:07 +01:00
build-aux Add infrastructure for "make syntax-check" 2015-01-30 15:27:36 +01:00
buildutil build: create tests directory for split builds 2019-11-08 06:51:36 +00:00
ci ci/rpmostree: Bump to 2019.4 2020-01-21 20:33:58 -07:00
coccinelle tree-wide: Add+run spatch to use glnx_throw() 2017-05-26 19:27:11 +00:00
docs docs: fix missing as typo 2019-05-06 13:29:48 +00:00
libglnx@9d0711fe1d Bump libglnx 2019-11-08 13:36:23 +00:00
man bin/refs: Allow overwriting existing ref 2019-06-12 15:00:19 +00:00
manual-tests Add SPDX-License-Identifier to source files 2018-01-30 20:03:42 +00:00
rust rust/bupsplit: minor idiomatic fixes 2018-03-17 19:59:06 +00:00
src lib/gpg: Prefer declare-and-initialize style 2020-01-24 13:02:09 -07:00
tests tests/gpg-verify-data: Empty out trustdb.gpg 2020-01-24 13:02:09 -07:00
.dir-locals.el .dir-locals.el: Standard Emacs indentation config 2017-01-12 16:09:34 +00:00
.editorconfig Add a .vimrc and .editorconfig 2017-09-21 22:03:11 +00:00
.gitmodules .gitmodules: Update URL for libglnx 2018-05-30 13:48:48 +00:00
.papr-ex.yaml ci: Use Fedora 29 artifacts 2019-06-21 13:17:10 +00:00
.papr.yml ci: Trim PAPR config to drop required flag 2019-10-16 18:38:37 +00:00
.travis.yml travis: Update to Debian Stretch 2019-04-23 06:11:39 +00:00
.vimrc Add a .vimrc and .editorconfig 2017-09-21 22:03:11 +00:00
autogen.sh Make sure *.am.inc are up to date before make dist 2017-10-16 13:53:06 +00:00
cfg.mk tests: Add a test case for path traversal in a dirtree 2018-01-12 19:38:34 +00:00
configure.ac build: Expose systemd in OSTREE_FEATURES 2019-12-29 13:27:29 +00:00
CONTRIBUTING.md Rewrite manual in mkdocs 2016-01-28 09:31:37 -05:00
COPYING COPYING: Update to latest FSF with current address 2014-01-16 10:22:30 -05:00
git.mk Use git.mk 2016-04-07 12:49:40 +00:00
GNUmakefile Add infrastructure for "make syntax-check" 2015-01-30 15:27:36 +01:00
maint.mk build/maint.mk: Comment out setting of LC_ALL 2017-08-23 17:41:06 +00:00
Makefile-bash.am Add SPDX-License-Identifier to source files 2018-01-30 20:03:42 +00:00
Makefile-boot.am Makefile: declare ostree_boot_SCRIPTS and append values 2019-11-06 11:44:08 -03:00
Makefile-decls.am Makefile: declare ostree_boot_SCRIPTS and append values 2019-11-06 11:44:08 -03:00
Makefile-libostree-defines.am lib/kargs: Make API public and upstream new rpm-ostree APIs 2019-06-18 14:29:14 +00:00
Makefile-libostree.am bootloader: Add a zipl bootloader backend 2019-10-16 14:22:02 +00:00
Makefile-man.am build-sys: Cleanup handling for trivial-httpd-cmdline 2019-10-23 15:05:30 +00:00
Makefile-ostree.am Avoid race condition when building outside of source tree 2019-11-26 09:22:30 +01:00
Makefile-otutil.am build: Conditionally build GPGME-related sources 2019-08-01 02:06:47 +00:00
Makefile-switchroot.am Support mounting /sysroot (and /boot) read-only 2019-12-11 15:33:57 +00:00
Makefile-tests.am tests/gpg-verify-data: Split out signature data 2020-01-24 13:02:09 -07:00
Makefile.am Revert "Always enable trivial-httpd for tests" 2019-10-19 22:20:27 +01:00
mkdocs.yml docs: Add Contributing Tutorial to Mkdocs pages 2018-08-21 14:05:14 +00:00
ostree.doap doap category infrastructure 2014-07-31 11:26:32 +02:00
OWNERS OWNERS: New file 2019-10-14 19:52:22 +00:00
README-historical.md README: Just link to wiki, move most of it to README-historical.md 2014-01-20 18:00:09 -05:00
README.md README.md: Tweak text about BuildStream 2019-12-01 22:28:18 +01:00
TODO Fix repeated words. 2015-01-30 15:27:36 +01:00

libostree

New! See the docs online at Read The Docs (OSTree)


This project is now known as "libostree", though it is still appropriate to use the previous name: "OSTree" (or "ostree"). The focus is on projects which use libostree's shared library, rather than users directly invoking the command line tools (except for build systems). However, in most of the rest of the documentation, we will use the term "OSTree", since it's slightly shorter, and changing all documentation at once is impractical. We expect to transition to the new name over time.

As implied above, libostree is both a shared library and suite of command line tools that combines a "git-like" model for committing and downloading bootable filesystem trees, along with a layer for deploying them and managing the bootloader configuration.

The core OSTree model is like git in that it checksums individual files and has a content-addressed-object store. It's unlike git in that it "checks out" the files via hardlinks, and they thus need to be immutable to prevent corruption. Therefore, another way to think of OSTree is that it's just a more polished version of Linux VServer hardlinks.

Features:

  • Transactional upgrades and rollback for the system
  • Replicating content incrementally over HTTP via GPG signatures and "pinned TLS" support
  • Support for parallel installing more than just 2 bootable roots
  • Binary history on the server side (and client)
  • Introspectable shared library API for build and deployment systems
  • Flexible support for multiple branches and repositories, supporting projects like flatpak which use libostree for applications, rather than hosts.

Operating systems and distributions using OSTree

Endless OS uses libostree for their host system as well as flatpak. See their eos-updater and deb-ostree-builder projects.

Fedora derivatives use rpm-ostree (noted below); there are 3 variants using OSTree:

Red Hat Enterprise Linux CoreOS is a derivative of Fedora CoreOS, used in OpenShift 4. The machine-config-operator manages upgrades. RHEL CoreOS is also the successor to RHEL Atomic Host, which uses rpm-ostree as well.

GNOME Continuous is where OSTree was born - as a high performance continuous delivery/testing system for GNOME.

Liri OS has the option to install their distribution using ostree.

Distribution build tools

meta-updater is a layer available for OpenEmbedded systems.

QtOTA is Qt's over-the-air update framework which uses libostree.

The BuildStream build and integration tool supports importing and exporting from libostree repos.

Fedora coreos-assembler is the build tool used to generate Fedora CoreOS derivatives.

Projects linking to libostree

rpm-ostree is used by the Fedora-derived operating systems listed above. It is a full hybrid image/package system. By default it uses libostree to atomically replicate a base OS (all dependency resolution is done on the server), but it supports "package layering", where additional RPMs can be layered on top of the base. This brings a "best of both worlds"" model for image and package systems.

eos-updater is a daemon that implements updates on EndlessOS.

flatpak uses libostree for desktop application containers. Unlike most of the other systems here, flatpak does not use the "libostree host system" aspects (e.g. bootloader management), just the "git-like hardlink dedup". For example, flatpak supports a per-user OSTree repository.

Language bindings

libostree is accessible via GObject Introspection; any language which has implemented the GI binding model should work. For example, Both pygobject and gjs are known to work and further are actually used in libostree's test suite today.

Some bindings take the approach of using GI as a lower level and write higher level manual bindings on top; this is more common for statically compiled languages. Here's a list of such bindings:

Building

Releases are available as GPG signed git tags, and most recent versions support extended validation using git-evtag.

However, in order to build from a git clone, you must update the submodules. If you're packaging OSTree and want a tarball, I recommend using a "recursive git archive" script. There are several available online; this code in OSTree is an example.

Once you have a git clone or recursive archive, building is the same as almost every autotools project:

git submodule update --init
env NOCONFIGURE=1 ./autogen.sh
./configure --prefix=...
make
make install DESTDIR=/path/to/dest

More documentation

New! See the docs online at Read The Docs (OSTree)

Contributing

See Contributing.

Licensing

The licensing for the code of libostree can be canonically found in the individual files; and the overall status in the COPYING file in the source. Currently, that's LGPLv2+. This also covers the man pages and API docs.

The license for the manual documentation in the doc/ directory is: SPDX-License-Identifier: (CC-BY-SA-3.0 OR GFDL-1.3-or-later) This is intended to allow use by Wikipedia and other projects.

In general, files should have a SPDX-License-Identifier and that is canonical.