Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

deploy: Honor prepare-root.conf at deploy time for composefs #3165

Merged
merged 4 commits into from
Feb 9, 2024

Conversation

cgwalters
Copy link
Member

lib: Move parsing of composefs config into otcore

So it can be shared with the deployment path. Prep for dropping
ex-integrity.composefs.


prepare-root: Fix crash if no keys were found

Handle a NULL pointer.


switchroot: Move a define into library too


deploy: Honor prepare-root.conf at deploy time

I want to try to get away from the "repository global" configuration
in the repo config.

A major problem is that there's not an obvious way to configure
it as part of an ostree commit/container build - it needs
to be managed "out of band".

With this change, we parse the usr/lib/ostree/prepare-root.conf
in the deployment root, and if composefs is enabled there,
then we honor it.

We do still honor ex-integrity.composefs but that I think
we can schedule to remove.


So it can be shared with the deployment path.  Prep for dropping
`ex-integrity.composefs`.
I want to try to get away from the "repository global" configuration
in the repo config.

A major problem is that there's not an obvious way to configure
it as part of an ostree commit/container build - it needs
to be managed "out of band".

With this change, we parse the `usr/lib/ostree/prepare-root.conf`
in the deployment root, and if composefs is enabled there,
then we honor it.

We do still honor `ex-integrity.composefs` but that I think
we can schedule to remove.
Copy link
Collaborator

@ericcurtin ericcurtin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@cgwalters cgwalters merged commit 1c18bd2 into ostreedev:main Feb 9, 2024
24 checks passed
cgwalters added a commit to cgwalters/coreos-assembler that referenced this pull request Feb 15, 2024
Since ostreedev/ostree#3165
this can be configured in the ostree commit itself.
@alexlarsson
Copy link
Member

We do still honor ex-integrity.composefs but that I think we can schedule to remove.

I don't think we can fully get rid of global options though. In particular, we need the fact that use_composefs implies that use_fsverity defaults to MAYBE when use_composefs is enabled.

Or maybe we should just switch use_fsverity to always be maybe?

@cgwalters
Copy link
Member Author

I don't think we can fully get rid of global options though. In particular, we need the fact that use_composefs implies that use_fsverity defaults to MAYBE when use_composefs is enabled.
Or maybe we should just switch use_fsverity to always be maybe?

Ug yes, good point. There's some circularity inherent in all this if we're aiming to have the commit/image define defaults.

I think the way to break this circularity is probably to add a post-deploy phase that enables fsverity on all objects in a given commit if the prepare-root configuration says that composefs is "maybe". And hard errors if fsverity can't be enabled in a "always" mode.

@cgwalters
Copy link
Member Author

Moving this to #3202

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/prepare-root Issue relates to ostree-prepare-root
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants