ostree-ext: Add composefs-repo to ostree-commit synthesis - #2236
ostree-ext: Add composefs-repo to ostree-commit synthesis#2236cgwalters wants to merge 1 commit into
Conversation
Sorry, something went wrong.
There was a problem hiding this comment.
Code Review
This pull request introduces a new composefs_import module to synthesize an ostree commit directly from a composefs OCI repository, utilizing FICLONE (reflink) for efficient zero-copy file sharing where supported. It also refactors the OCI export mechanism to support exporting from a commit checksum directly, and adds comprehensive integration tests. Feedback on the changes highlights two critical compilation issues: a type mismatch in xattrs_to_variant when calling glib::Variant::array_from_iter, and an invalid try_clone call on OwnedFd which should be replaced with try_clone_to_owned.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Sorry, something went wrong.
| // SELinux stores label values as NUL-terminated strings on the filesystem. | ||
| // The composefs selabel() function strips the NUL, but ostree fsck reads | ||
| // xattrs back from disk (where the kernel always stores them with NUL) when | ||
| // verifying checksums. Ensure our checksum matches by adding the NUL here | ||
| // for security.selinux values that are missing it. |
There was a problem hiding this comment.
Gotta say this one was fun
Sorry, something went wrong.
| let mut fs = composefs_oci::image::create_filesystem(composefs_repo, config_digest, None) | ||
| .context("Reconstructing composefs filesystem tree")?; | ||
|
|
||
| // Apply SELinux labels in-memory before writing any objects. |
There was a problem hiding this comment.
This should just use the transform_for_boot
Sorry, something went wrong.
| @@ -0,0 +1,970 @@ | |||
| //! Synthesize an ostree commit directly from a composefs OCI repository. | |||
There was a problem hiding this comment.
TODO: Let's add an equivalence/diff testing of this versus the current ostree-ext container backend
Sorry, something went wrong.
Johan-Liebert1
left a comment
There was a problem hiding this comment.
lgtm. This is a separate feature so unlikely to break anything. Just one comment
Sorry, something went wrong.
| let dirmeta = create_dirmeta(&dir.stat); | ||
| let meta_csum = orepo | ||
| .write_metadata( | ||
| crate::ostree::ObjectType::DirMeta, | ||
| None, | ||
| &dirmeta, | ||
| gio::Cancellable::NONE, | ||
| ) | ||
| .context("Writing dirmeta")?; | ||
| mtree.set_metadata_checksum(&meta_csum.to_hex()); |
There was a problem hiding this comment.
This code block is repeated a few times. Does it make sense to factor it out?
Sorry, something went wrong.
|
We can redo this on top of composefs/composefs-rs#347 |
Sorry, something went wrong.
Add `container::composefs_import::import_from_composefs_repo`, which walks a composefs `FileSystem` tree (already populated by a composefs-rs OCI pull) and synthesizes an equivalent ostree commit, reflinking file content into the ostree bare repo so the same disk blocks back both stores. This is the inverse of libostree's ostree→EROFS path. (Except of course, it is all still very circular because what happens here is ostree then turns around and uses composefs-c to make a composefs EROFS...that's a whole thing that in theory we could replace too) To support exporting such synthesized commits back out, `store.rs` gains `export_commit` (export straight from a commit checksum rather than an image ref) and `for_each_file_checksum` (walk a commit's regular-file content checksums), `export_to_oci` is refactored to take a `LayeredImageState` so both ref- and commit-based exports share it, and `query_image_commit` learns to treat a composefs-synthesized merge commit as its own base. A few existing metadata constants and helpers are promoted to `pub`/`pub(crate)` for use by the new module. This is library plumbing for bootc's unified storage work; it is unused by any in-tree caller on its own and lands separately to keep that feature's change set reviewable. Includes a standalone integration test (`test_composefs_import_to_ostree`) that builds a small OCI image, imports it through a composefs repo into ostree, and verifies the result. Assisted-by: OpenCode (claude-opus-4-8) Signed-off-by: Colin Walters <walters@verbum.org>
Reviewers
At least 1 approving review is required to merge this pull request.
Add container::composefs_import::import_from_composefs_repo, which walks a composefs FileSystem tree (already populated by a composefs-rs OCI pull) and synthesizes an equivalent ostree commit, reflinking file content into the ostree bare repo so the same disk blocks back both stores. This is the inverse of libostree's ostree→EROFS path.
To support exporting such synthesized commits back out, store.rs gains export_commit (export straight from a commit checksum rather than an image ref) and for_each_file_checksum (walk a commit's regular-file content checksums), export_to_oci is refactored to take a LayeredImageState so both ref- and commit-based exports share it, and query_image_commit learns to treat a composefs-synthesized merge commit as its own base. A few existing metadata constants and helpers are promoted to pub/pub(crate) for use by the new module.
This is library plumbing for bootc's unified storage work; it is unused by any in-tree caller on its own and lands separately to keep that feature's change set reviewable. Includes a standalone integration test (test_composefs_import_to_ostree) that builds a small OCI image, imports it through a composefs repo into ostree, and verifies the result.
Assisted-by: OpenCode (claude-opus-4-8)