ostree-push uses ssh to push commits from a local OSTree repo to a
remote OSTree repo. This is to fill a gap where currently you can only
pull commits in core ostree. To publish commits to a remote repository,
you either have to pull from the local repo to the remote repo or use
an out of band mechanism like rsync.
Both approaches have significant limitations. To pull over the network,
only http is supported. So, in addition to having to login on the remote
machine and run ostree pull, the local repository needs to be served
over http. This means your build machine needs to be an http server with
appropriate configuration in addition to simply making commits. This
pushes the builds to be done on the public repository server, which
prevents reasonable separation of duties and makes multiarch
repositories impossible.
Using rsync for publishing has some major benefits since only updated
objects are published. However, it has no concept of the OSTree object
store or refs structures. There are a few problems deriving from this
issue. First, objects are published in sort order, but this means that
objects can be published before their children. In the most extreme
case, a commit object could be published before it's complete. The
remote repo would assume this commit object was valid even though some
children might be missing. Second, the refs might get updated before the
commit objects are in place. If a client pulls while rsync is
publishing, it may attempt to pull an incomplete or entirely missing
commit. Finally, rsync will push the objects directly into the store
rather than using a staging directory like pull or commit do. If
rsync is interrupted, it could leave partial objects in the store.
ostree-push tries to offer functionality like git where commits can
be pushed over ssh to avoid these issues.
When ostree-push is started, it first starts a local HTTP server
providing the contents of the local ostree repo. It then connects to the
remote host with ssh and tunnels the HTTP server port through the SSH
connection. Finally, it runs ostree-receive on the remote host with
the URL of the tunneled HTTP server. ostree-receive then creates a
temporary remote using this URL and pulls the desired refs from it.
In essence, ostree-push and ostree-receive coordinate to pull from
the local repo to a remote repo while avoiding the limitations described
above. Namely, no HTTP server needs to be running and no port needs to
be exposed on the local host. Both resources are created temporarily and
only exposed to the remote host through the secure SSH connection.
Use pip to install the otpush package and the ostree-push and
ostree-receive scripts. From a git checkout, run:
pip install .
If ostree-receive is not in a default PATH location, it may not be
located when run in the environment spawned by the SSH server. As a
workaround, make a symbolic link in a standard location:
sudo ln -s /path/to/ostree-receive /usr/bin/ostree-receive
In order to restrict SSH usage to only running ostree-receive, the
ostree-receive-shell script can be used as a login shell. This way
someone with SSH access to the remote machine cannot run arbitrary
commands as the user owning the repositories. To use it, set the login
shell of the repo owner to ostree-receive-shell:
sudo chsh -s /path/to/ostree-receive-shell <user>
ostree-receive-shell will also append the directory it's installed in
to PATH to allow ostree-receive to be found in non-standard
locations. In that scenario, the symbolic link to ostree-receive
described above is not needed.
Both ostree-push and ostree-receive require the OSTree GObject
Introspection bindings. Typically these would be installed from the host
distro. On Debian systems the package is gir1.2-ostree-1.0 while on
RedHat systems they are in the ostree-libs package.
ostree-push relies on the connection sharing and port forwarding
features of OpenSSH and is unlikely to work with another SSH client.
Similarly, ostree-receive has only be tested with the OpenSSH server,
but it might work correctly with other SSH servers.
ostree-receive can be configured from YAML formatted files. It will
load ~/.config/ostree/ostree-receive.conf and
/etc/ostree/ostree-receive.conf or a file specified in the
OSTREE_RECEIVE_CONF environment variable. See the example
ostree-receive.conf file for available options.
A test suite is provided using pytest. Most of the time simply
running pytest from a git checkout will run it correctly. tox
can also be used to automate running the test suite in a prepared Python
environment.
In addition to the ostree-push dependencies, many of the tests depend
on using OpenSSH sshd locally. On both Debian and RedHat systems this
is available in the openssh-server package.