Add support for multiple composefs= digests#2248
Open
cgwalters wants to merge 3 commits into
Open
Conversation
Merged
Collaborator
Author
|
OK I think the chain here should be:
|
cgwalters
force-pushed
the
adapt-composefs-rs-v1-erofs-2
branch
from
3b90847 to
f92013b
Compare
cgwalters
force-pushed
the
adapt-composefs-rs-v1-erofs-2
branch
from
f92013b to
69757fc
Compare
jmarrero
previously approved these changes
Jun 28, 2026
Contributor
There was a problem hiding this comment.
lgtm
just needs a rebase I think.
The only nit is that
config.erofs_formats = composefs_ctl::composefs::erofs::format::FormatConfig {
default: composefs_ctl::composefs::erofs::format::FormatVersion::V1,
extra: [composefs_ctl::composefs::erofs::format::FormatVersion::V2].into(),
};
Is duplicated 3 times here. So if we add a new version in the future we need to care about 3 places. Maybe it should be a helper function?
Johan-Liebert1
requested changes
Jun 29, 2026
Johan-Liebert1
left a comment
Johan-Liebert1
left a comment
Collaborator
There was a problem hiding this comment.
Lots of .clone() that I believe shouldn't be needed, I might be wrong though. Supporting both V1 and V2 are great, but it is a bit messy, not sure if there's a better way to do this. Also, some inconsistencies here and there (esp in comments) regarding whether V1 is the default or V2
| seal_state=$1 | ||
| shift | ||
| # EROFS format version to pass to bootc container ukify (optional, default: v2) | ||
| erofs_version=${1:-v2} |
Collaborator
There was a problem hiding this comment.
Kind of conflicts with composefs/composefs-rs#330. We'd probably want to have the same defaults everywhere
| os_id: Option<String>, | ||
| boot_digest: String, | ||
| /// The composefs image digest parsed from (and validated against) the UKI's | ||
| /// own cmdline. This is the authoritative deployment key for UKI boots: |
Collaborator
There was a problem hiding this comment.
This is for every boot right, not just UKIs?
| let composefs_info = BootComposefsCmdline::<Sha512HashValue>::from_cmdline(&cmdline) | ||
| .context("Parsing composefs=")? | ||
| .ok_or_else(|| anyhow::anyhow!("No composefs= or composefs.digest.v1= karg found in UKI cmdline"))?; | ||
| let composefs_cmdline = composefs_info.digest().clone(); |
Collaborator
There was a problem hiding this comment.
This name is a bit confusing. afaiu this is only the digest and not the entire cmdline?
|
|
||
| if test "${boot_type}" = "uki"; then | ||
| /run/packaging/seal-uki /run/target /out /run/secrets "${allow_missing_verity}" "${seal_state}" | ||
| /run/packaging/seal-uki /run/target /out /run/secrets "${allow_missing_verity}" "${seal_state}" "${erofs_version}" |
Collaborator
There was a problem hiding this comment.
We also need this in tmt/tests/booted/test-install-to-filesystem-var-mount.sh
| // (see setup_composefs_boot for the full rationale). Provisional value for | ||
| // BLS (where bootc writes the karg from this same id); overridden for UKI by | ||
| // the digest the UKI cmdline actually carries. | ||
| let provisional_deploy_id = boot_id_v2.clone().unwrap_or_else(|| id.clone()); |
Collaborator
There was a problem hiding this comment.
id here is confusing especially with both boot_id_v1/v2 defined. I believe it's the erofs digest corresponding to the erofs version that the repo is currently using?
| // Authoritative collision check against the final deploy key. For UKI this | ||
| // may differ from the provisional checked above (the UKI may carry a | ||
| // non-default digest), so this is the load-bearing guarantee. | ||
| ensure_no_deploy_collision(host, &deploy_id)?; |
Collaborator
There was a problem hiding this comment.
why do we need to do this again?
| // setup-root opens `state/deploy/<this>` using that same karg, so we must | ||
| // key the deployment off exactly this value -- whether the UKI was sealed | ||
| // with the V2 (default) or V1 EROFS digest. | ||
| let deploy_id = uki_info.composefs_cmdline.clone(); |
Collaborator
There was a problem hiding this comment.
we shouldn't need to clone this?
cgwalters
force-pushed
the
adapt-composefs-rs-v1-erofs-2
branch
from
69757fc to
4ecc241
Compare
The `--bind-storage-ro` host container-storage passthrough relies on a libvirt-managed virtiofsd, which cannot run in some environments such as nested user namespaces or cloud/non-qemu setups. Plans that normally request bind-storage previously had no way to opt out short of editing plan metadata. Add a `--skip-bind-storage` flag (and matching `BOOTC_skip_bind_storage` env var) that forces those plans to run without the host container-storage mount. Default behavior is unchanged: bind-storage is still used wherever it is requested and supported. Plans that depend on a locally built upgrade image reaching the VM via bind-storage will be unable to perform the upgrade/switch step when this is set. Signed-off-by: Colin Walters <walters@verbum.org>
composefs-rs landed support for V1 EROFS, which we need to enable composefs on RHEL9. Make new installs produce both V1 and V2 EROFS images for committed composefs images, and make V1 the default wherever a single format must be chosen: the repository's default EROFS format, the `--erofs-version` flag on `bootc container ukify` and `compute-composefs-digest`, and the provisional BLS deploy key computed at install time. V2 remains available via `--erofs-version=v2` and is always generated alongside V1, so a deployment can still be booted via the legacy `composefs=` karg. This keeps the install path consistent with the upgrade and GC paths, which already prefer V1. Critically, a V1 digest must be written as a `composefs.digest=v1-...` karg, not the legacy `composefs=` shorthand (which upstream reserves for V2). Add `build_composefs_karg`, which selects the correct form via composefs-boot's own `ComposefsCmdline::new_v1`/`new_v2` and `to_cmdline_arg`, and use it everywhere bootc writes a new karg (install, upgrade, `container ukify`, soft-reboot) instead of the version-unaware helper that only ever emitted `composefs=`. Signed-off-by: Colin Walters <walters@verbum.org>
With V1 EROFS as the default, sealed UKIs are now viable on CentOS-9. Replace the blanket composefs exclusion for centos-9 with targeted exclusions for the modes that still don't work: BLS (needs newer dracut) and unsealed composefs. This leaves composefs + sealed + UKI enabled. Signed-off-by: Colin Walters <walters@verbum.org>
cgwalters
force-pushed
the
adapt-composefs-rs-v1-erofs-2
branch
from
4ecc241 to
6ec1bf4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This adapts bootc to build on top of the work in composefs/composefs-rs#297
A toplevel goal here is supporting both the v1 and v2 EROFS formats, which means we'll work with RHEL9 era systems.
Right now
bootc container ukifystill generatescomposefs=i.e. v2, but I'd like to change that to do both - it's a pretty cheap thing (the main cost is generating the fsverity digests).