many: switch to bootc install to-filesystem (HMS-3453)

pkg/image/bootc_disk.go

@@ -5,26 +5,38 @@ import (
 	"math/rand"
 
 	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/customizations/users"
+	"github.com/osbuild/images/pkg/disk"
 	"github.com/osbuild/images/pkg/manifest"
 	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/platform"
 	"github.com/osbuild/images/pkg/runner"
 )
 
 type BootcDiskImage struct {
-	*OSTreeDiskImage
+	Base
+
+	Platform       platform.Platform
+	PartitionTable *disk.PartitionTable
+
+	Filename string
+
+	ContainerSource *container.SourceSpec
+
+	// Customizations
+	KernelOptionsAppend []string
+
+	// "Users" is a bit misleading as only root and its ssh key is supported
+	// right now because that is all that bootc gives us by default but that
+	// will most likely change over time.
+	// See https://github.com/containers/bootc/pull/267
+	Users []users.User
 }
 
 func NewBootcDiskImage(container container.SourceSpec) *BootcDiskImage {
-	// XXX: hardcoded for now
-	ref := "ostree/1/1/0"
-
 	return &BootcDiskImage{
-		&OSTreeDiskImage{
-			Base:            NewBase("bootc-raw-image"),
-			ContainerSource: &container,
-			Ref:             ref,
-			OSName:          "default",
-		},
+		Base:            NewBase("bootc-raw-image"),
+		ContainerSource: &container,
 	}
 }
 
@@ -40,14 +52,17 @@ func (img *BootcDiskImage) InstantiateManifestFromContainers(m *manifest.Manifes
 	// this is signified by passing nil to the below pipelines.
 	var hostPipeline manifest.Build
 
-	opts := &baseRawOstreeImageOpts{useBootupd: true}
-
-	fileBasename := img.Filename
+	// TODO: no support for customization right now but minimal support
+	// for root ssh keys is supported
+	baseImage := manifest.NewRawBootcImage(buildPipeline, containers, img.Platform)
+	baseImage.PartitionTable = img.PartitionTable
+	baseImage.Users = img.Users
+	baseImage.KernelOptionsAppend = img.KernelOptionsAppend
 
 	// In BIB, we export multiple images from the same pipeline so we use the
 	// filename as the basename for each export and set the extensions based on
 	// each file format.
-	baseImage := baseRawOstreeImage(img.OSTreeDiskImage, buildPipeline, opts)
+	fileBasename := img.Filename
 	baseImage.SetFilename(fmt.Sprintf("%s.raw", fileBasename))
 
 	qcow2Pipeline := manifest.NewQCOW2(hostPipeline, baseImage)

pkg/image/bootc_disk_test.go

@@ -25,7 +25,7 @@ func TestBootcDiskImageNew(t *testing.T) {
 
 	img := image.NewBootcDiskImage(containerSource)
 	require.NotNil(t, img)
-	assert.Equal(t, img.OSTreeDiskImage.Base.Name(), "bootc-raw-image")
+	assert.Equal(t, img.Base.Name(), "bootc-raw-image")
 }
 
 func makeFakeDigest(t *testing.T) string {
@@ -38,6 +38,8 @@ func makeFakeDigest(t *testing.T) string {
 type bootcDiskImageTestOpts struct {
 	ImageFormat platform.ImageFormat
 	BIOS        bool
+
+	KernelOptionsAppend []string
 }
 
 func makeFakePlatform(opts *bootcDiskImageTestOpts) platform.Platform {
@@ -63,18 +65,20 @@ func makeBootcDiskImageOsbuildManifest(t *testing.T, opts *bootcDiskImageTestOpt
 	containers := []container.SourceSpec{containerSource}
 
 	img := image.NewBootcDiskImage(containerSource)
+	img.Filename = "fake-disk"
 	require.NotNil(t, img)
 	img.Platform = makeFakePlatform(opts)
 	img.PartitionTable = testdisk.MakeFakePartitionTable("/", "/boot", "/boot/efi")
+	img.KernelOptionsAppend = opts.KernelOptionsAppend
 
 	m := &manifest.Manifest{}
 	runi := &runner.Fedora{}
 	err := img.InstantiateManifestFromContainers(m, containers, runi, nil)
 	require.Nil(t, err)
 
 	fakeSourceSpecs := map[string][]container.Spec{
-		"build":             []container.Spec{{Source: "some-src", Digest: makeFakeDigest(t), ImageID: makeFakeDigest(t)}},
-		"ostree-deployment": []container.Spec{{Source: "other-src", Digest: makeFakeDigest(t), ImageID: makeFakeDigest(t)}},
+		"build": []container.Spec{{Source: "some-src", Digest: makeFakeDigest(t), ImageID: makeFakeDigest(t)}},
+		"image": []container.Spec{{Source: "other-src", Digest: makeFakeDigest(t), ImageID: makeFakeDigest(t)}},
 	}
 
 	osbuildManifest, err := m.Serialize(nil, fakeSourceSpecs, nil)
@@ -127,39 +131,32 @@ func TestBootcDiskImageInstantiateVmdk(t *testing.T) {
 	require.NotNil(t, pipeline)
 }
 
-func TestBootcDiskImageUsesBootupd(t *testing.T) {
-	osbuildManifest := makeBootcDiskImageOsbuildManifest(t, nil)
+func TestBootcDiskImageUsesBootcInstallToFs(t *testing.T) {
+	opts := &bootcDiskImageTestOpts{
+		KernelOptionsAppend: []string{"karg1", "karg2"},
+	}
+	osbuildManifest := makeBootcDiskImageOsbuildManifest(t, opts)
 
-	// check that bootupd is part of the "image" pipeline
+	// check that bootc.install-to-filesystem is part of the "image" pipeline
 	imagePipeline := findPipelineFromOsbuildManifest(t, osbuildManifest, "image")
 	require.NotNil(t, imagePipeline)
-	bootupdStage := findStageFromOsbuildPipeline(t, imagePipeline, "org.osbuild.bootupd")
-	require.NotNil(t, bootupdStage)
-
-	// ensure that "grub2" is not part of the ostree pipeline
-	ostreeDeployPipeline := findPipelineFromOsbuildManifest(t, osbuildManifest, "ostree-deployment")
-	require.NotNil(t, ostreeDeployPipeline)
-	grubStage := findStageFromOsbuildPipeline(t, ostreeDeployPipeline, "org.osbuild.grub2")
-	require.Nil(t, grubStage)
-}
-
-func TestBootcDiskImageBootupdBiosSupport(t *testing.T) {
-	for _, withBios := range []bool{false, true} {
-		osbuildManifest := makeBootcDiskImageOsbuildManifest(t, &bootcDiskImageTestOpts{BIOS: withBios, ImageFormat: platform.FORMAT_QCOW2})
-
-		imagePipeline := findPipelineFromOsbuildManifest(t, osbuildManifest, "image")
-		require.NotNil(t, imagePipeline)
-		bootupdStage := findStageFromOsbuildPipeline(t, imagePipeline, "org.osbuild.bootupd")
-		require.NotNil(t, bootupdStage)
-
-		opts := bootupdStage["options"].(map[string]interface{})
-		if withBios {
-			biosOpts := opts["bios"].(map[string]interface{})
-			assert.Equal(t, biosOpts["device"], "disk")
-		} else {
-			require.Nil(t, opts["bios"])
-		}
+	bootcStage := findStageFromOsbuildPipeline(t, imagePipeline, "org.osbuild.bootc.install-to-filesystem")
+	require.NotNil(t, bootcStage)
+
+	// ensure loopback for the entire disk with partscan is used or install
+	// to-filesystem will fail
+	devicesDisk := bootcStage["devices"].(map[string]interface{})["disk"].(map[string]interface{})
+	assert.Equal(t, "org.osbuild.loopback", devicesDisk["type"])
+	devicesDiskOpts := devicesDisk["options"].(map[string]interface{})
+	expectedDiskOpts := map[string]interface{}{
+		"partscan": true,
+		"filename": "fake-disk.raw",
 	}
+	assert.Equal(t, expectedDiskOpts, devicesDiskOpts)
+
+	// ensure options got passed
+	bootcOpts := bootcStage["options"].(map[string]interface{})
+	assert.Equal(t, []interface{}{"karg1", "karg2"}, bootcOpts["kernel-args"])
 }
 
 func TestBootcDiskImageExportPipelines(t *testing.T) {

pkg/manifest/build.go

@@ -235,18 +235,15 @@ func (p *BuildrootFromContainer) serialize() osbuild.Pipeline {
 	pipeline.Runner = p.runner.String()
 
 	image := osbuild.NewContainersInputForSingleSource(p.containerSpecs[0])
-	options := &osbuild.ContainerDeployOptions{
-		Exclude: []string{"/sysroot"},
-	}
-
-	stage, err := osbuild.NewContainerDeployStage(image, options)
+	stage, err := osbuild.NewContainerDeployStage(image, &osbuild.ContainerDeployOptions{})
 	if err != nil {
 		panic(err)
 	}
 	pipeline.AddStage(stage)
 	pipeline.AddStage(osbuild.NewSELinuxStage(
 		&osbuild.SELinuxStageOptions{
 			FileContexts: "etc/selinux/targeted/contexts/files/file_contexts",
+			ExcludePaths: []string{"/sysroot"},
 			Labels:       p.getSELinuxLabels(),
 		},
 	))

pkg/manifest/export_test.go

@@ -0,0 +1,3 @@
+package manifest
+
+var FindStage = findStage

pkg/manifest/pipeline.go

@@ -97,7 +97,7 @@ func (p Base) getCheckpoint() bool {
 }
 
 func (p *Base) Export() *artifact.Artifact {
-	panic("can't export pipeline")
+	panic("can't export pipeline directly from pipeline.Base")
 }
 
 func (p Base) getExport() bool {

pkg/manifest/raw_bootc.go

@@ -0,0 +1,142 @@
+package manifest
+
+import (
+	"fmt"
+
+	"github.com/osbuild/images/pkg/artifact"
+	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/customizations/users"
+	"github.com/osbuild/images/pkg/disk"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/ostree"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+// A RawBootcImage represents a raw bootc image file which can be booted in a
+// hypervisor.
+type RawBootcImage struct {
+	Base
+
+	filename string
+	platform platform.Platform
+
+	containers     []container.SourceSpec
+	containerSpecs []container.Spec
+
+	// customizations go here because there is no intermediate
+	// tree, with `bootc install to-filesystem` we can only work
+	// with the image itself
+	PartitionTable *disk.PartitionTable
+
+	KernelOptionsAppend []string
+
+	// "Users" is a bit misleading as only root and its ssh key is supported
+	// right now because that is all that bootc gives us by default but that
+	// will most likely change over time.
+	// See https://github.com/containers/bootc/pull/267
+	Users []users.User
+}
+
+func (p RawBootcImage) Filename() string {
+	return p.filename
+}
+
+func (p *RawBootcImage) SetFilename(filename string) {
+	p.filename = filename
+}
+
+func NewRawBootcImage(buildPipeline Build, containers []container.SourceSpec, platform platform.Platform) *RawBootcImage {
+	p := &RawBootcImage{
+		Base:     NewBase("image", buildPipeline),
+		filename: "disk.img",
+		platform: platform,
+
+		containers: containers,
+	}
+	buildPipeline.addDependent(p)
+	return p
+}
+
+func (p *RawBootcImage) getContainerSources() []container.SourceSpec {
+	return p.containers
+}
+
+func (p *RawBootcImage) getContainerSpecs() []container.Spec {
+	return p.containerSpecs
+}
+
+func (p *RawBootcImage) serializeStart(_ []rpmmd.PackageSpec, containerSpecs []container.Spec, _ []ostree.CommitSpec) {
+	if len(p.containerSpecs) > 0 {
+		panic("double call to serializeStart()")
+	}
+	p.containerSpecs = containerSpecs
+}
+
+func (p *RawBootcImage) serializeEnd() {
+	if len(p.containerSpecs) == 0 {
+		panic("serializeEnd() call when serialization not in progress")
+	}
+	p.containerSpecs = nil
+}
+
+func (p *RawBootcImage) serialize() osbuild.Pipeline {
+	pipeline := p.Base.serialize()
+
+	pt := p.PartitionTable
+	if pt == nil {
+		panic(fmt.Errorf("no partition table in live image"))
+	}
+
+	if len(p.Users) > 1 {
+		panic(fmt.Errorf("raw bootc image only supports a single root key for user customization, got %v", p.Users))
+	}
+	if len(p.Users) == 1 && p.Users[0].Name != "root" {
+		panic(fmt.Errorf("raw bootc image only supports the root user, got %v", p.Users))
+	}
+
+	for _, stage := range osbuild.GenImagePrepareStages(pt, p.filename, osbuild.PTSfdisk) {
+		pipeline.AddStage(stage)
+	}
+
+	if len(p.containerSpecs) != 1 {
+		panic(fmt.Errorf("expected a single container input got %v", p.containerSpecs))
+	}
+	opts := &osbuild.BootcInstallToFilesystemOptions{
+		Kargs: p.KernelOptionsAppend,
+	}
+	if len(p.Users) == 1 && p.Users[0].Key != nil {
+		opts.RootSSHAuthorizedKeys = []string{*p.Users[0].Key}
+	}
+	inputs := osbuild.ContainerDeployInputs{
+		Images: osbuild.NewContainersInputForSingleSource(p.containerSpecs[0]),
+	}
+	devices, mounts, err := osbuild.GenBootupdDevicesMounts(p.filename, p.PartitionTable)
+	if err != nil {
+		panic(err)
+	}
+	st, err := osbuild.NewBootcInstallToFilesystemStage(opts, inputs, devices, mounts)
+	if err != nil {
+		panic(err)
+	}
+	pipeline.AddStage(st)
+
+	// XXX: there is no way right now to support any customizations,
+	// we cannot touch the filesystem after bootc installed it or
+	// we risk messing with it's selinux labels or future fsverity
+	// magic.  Once we have a mechanism like --copy-etc from
+	// https://github.com/containers/bootc/pull/267 things should
+	// be a bit better
+
+	for _, stage := range osbuild.GenImageFinishStages(pt, p.filename) {
+		pipeline.AddStage(stage)
+	}
+
+	return pipeline
+}
+
+// XXX: copied from raw.go
+func (p *RawBootcImage) Export() *artifact.Artifact {
+	p.Base.export = true
+	return artifact.New(p.Name(), p.Filename(), nil)
+}

pkg/manifest/raw_bootc_export_test.go

@@ -0,0 +1,20 @@
+package manifest
+
+import (
+	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/ostree"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+func (br *BuildrootFromContainer) Dependents() []Pipeline {
+	return br.dependents
+}
+
+func (rbc *RawBootcImage) Serialize() osbuild.Pipeline {
+	return rbc.serialize()
+}
+
+func (rbc *RawBootcImage) SerializeStart(a []rpmmd.PackageSpec, b []container.Spec, c []ostree.CommitSpec) {
+	rbc.serializeStart(a, b, c)
+}