support deploying a composefs directly

[cgwalters]

ostree has two major parts:

• OstreeRepo (object store, commits)
• OstreeSysroot (has-a OstreeRepo, extends with bootloader support, deployments, etc.)

As part of containers/bootc#20 and https://github.com/cgwalters/composefs-oci what would be quite helpful as an intermediate step is if we could try to sever some of the dependencies of OstreeSysroot on OstreeRepo.

cfs-repo-in-ostree-repo

Let's introduce an opinionated "composefs repo" inside an ostree repo, something like cfs which would have its own cfs/objects named by verity digest.

commit stub → composefs

Specifically: I'd like to be able to pass a composefs blob to ostree_sysroot_deploy_tree instead of an ostree commit. In practice of course, we have a lot of things that refer to commits, and making them effectively take:

enum Source {
  OstreeCommit(digest)
  Composefs(name?)
}

would probably be quite invasive. A practical though brutal hack would be making up a stub/empty commit that has a metadata entry that points to a composefs. This would mean things like ostree diff would just break (or really: be nonfunctional)...which is probably fine! As long as we get far enough that one of these things can just go through the deployment path I think we're good.

GC

There's some more work for sure here too around things like generate_deployment_refs() ...we just skip that I think in this case and require the caller to do GC?

Filesystem mapping

We'd retain support for stateroots and etc merging. A deployment would contain 1-2 things:

• <name>.cfs -
• etc/ - if transient etc is not in use, this would be the merge source

IOW we'd have /ostree/deploy/$stateroot/composefs/<name>.cfs or so.

Prepare root

Simplest is to retain the ostree= karg, but honestly it's a bit more tempting to force this into a locally generated initramfs extension, basically go all in on "composefs digest+path in initramfs".

[cgwalters]

Though this relates to containers/composefs#332 in that if we did that we'd need to teach ostree how to crack open UKIs to get access to the embedded composefs in order to do GC.

[jbtrystram]

Another thing to consider is /etc versionning : being able to rollback on a previous deployment if I do a mistake in /etc and broke something is a nice feature to have, we should try to keep it

[cgwalters]

OK #3326 made me think more about this one...that bug was directly rooted in the impedance mismatch between ostree hashes and fsverity hashes. I'd love to get to the point where we hard switch over to fsverity in a new system and leave the ostree hashing behind - this would be a useful intermediate step.