Hi @ruihe774. Thanks for your PR.

I'm waiting for a ostreedev member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Also ref composefs/composefs#251

One thing I could imagine doing here is checking if a stamp file like /run/ostree/composefs-signed or so is present, then we skip our own signature checks and assume that an external systemd unit that ran before this code executed.

I think it's a bit of complicated and over-designed. If we do that, the "external" verification tool needs to explicitly cooperate with ostree and write the stamp file, or the end user needs to write a custom systemd service and add it to initramfs, which is troublesome.

Can you also update man/ostree-prepare-root.xml?

Done. PTAL.

/ok-to-test

/override ci/prow/fcos-e2e
At some point will need to debug Prow but for now

@cgwalters: Overrode contexts on behalf of cgwalters: ci/prow/fcos-e2e

To help with upgrades, would a verity-maybe make sense ?

To help with upgrades, would a verity-maybe make sense ?

You mean setting option verity=on on the overlayfs mount? Unfortunately, libcompose does not support it.

It only supports either no option (equivalent to verity=off) or verity=require.

https://www.kernel.org/doc/html/latest/filesystems/overlayfs.html#fs-verity-support
https://github.com/containers/composefs/blob/2e98bef7a783a850b431273fd6928c1d5ff280f8/libcomposefs/lcfs-mount.h#L25

BTW, LCFS_MOUNT_FLAGS_TRY_VERITY is to try whether the kernel support the verity mount option, not to try whether fs-verity is enabled.

To upgrade, you can simply enable fs-verity for all files under repo/objects (There are existing tools to do that) before you deploy with composefs.enabled=verity.

I'm late to the party here but is it too late to change the option? Before this change, afaik, all options were boolean and the config file was effectively toml. This takes us into a somewhat more freeform direction.... probably ini-ish.... that might make things more difficult in the future if we want to add more advanced features.

Something more like

[composefs]
enable=true
verity=true

instead?

This takes us into a somewhat more freeform direction.... probably ini-ish

It's always been ini, we've parsed using GKeyFile; and especially booleans in ini/GKeyFile accept values like "yes/no" and "0/1" that aren't valid in TOML.

You're right of course regardless that it'd definitely have been cleaner to use a separate boolean for verity=true. (That said, verity=true should probably imply enable=true just to simplify things further) Happy to do that now too.

I'm assuming you're asking this because you want to reimplement it in composefs-rs, but note there is already Rust code in bootc that's parsing this too, and I did have to adjust it for this in e.g. bootc-dev/bootc@06933ed