summaryrefslogtreecommitdiff
path: root/src/libostree
Commit message (Collapse)AuthorAgeFilesLines
* deploy: Also log to journal if we time out global sync()Colin Walters2022-01-201-1/+4
| | | | | | | | | | We do implicitly have this data because we log timings via structured metadata in a later journal entry, but it's quite common to lose the structured metadata because a lot of tooling just grabs the default syslog-compatible text from `journalctl`. Let's be louder when we hit this case as a general rule too; I think most people shipping ostree systems want to see if it's happening.
* lib/commit: reject empty metadata keysLuca BRUNO2022-01-201-0/+13
| | | | | This adds one more check to the metadata validation logic in order to reject empty metadata keys.
* lib/commit: always validate metadataLuca BRUNO2022-01-191-6/+2
| | | | | This tweaks commit logic in order to always validate metadata, including on commits where the expected checksum is already known.
* deploy: Add a 5s max timeout on global filesystem `sync()`Colin Walters2022-01-183-1/+78
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=2003532 Basically there's a systemd bug where it's losing the `_netdev` aspect of Ceph filesystem mounts. This means the network is taken down before Ceph is unmounted. In turn, our invocation of `sync()` blocks on Ceph, which won't succeed. And this in turn manifests as a failure to transition to the new deployment. I initially did this patch to just rip out the global `sync()`. I am pretty sure we don't need it anymore. We've been doing individual `syncfs()` on `/sysroot` and `/boot` for a while now, and those are the only filesystems we should be touching. But *proving* that is a whole other thing of course. To be conservative, let's instead just add a timeout of 5s on our invocation of `sync()`. It doesn't return any information on success/error anyways. To allow testing without the `sync()` invocation, we also support a new `OSTREE_SYSROOT_OPT_SKIP_SYNC=1` environment variable. For staged deployments, this needs to be injected via e.g. systemd unit overrides into `ostree-finalize-staged.service`. Implementing this is a bit hairy - we need to spawn a thread. I debated blocking in arecursive mainloop, but I think `g_cond_wait_until()` is also fine here.
* Merge pull request #2516 from cgwalters/define-ostree-bootedJonathan Lebon2022-01-122-3/+11
|\
| * sysroot: Add a public `#define OSTREE_PATH_BOOTED`Colin Walters2022-01-122-3/+11
| | | | | | | | | | This is public API. Motivated by https://github.com/coreos/rpm-ostree/pull/3325/files#diff-56528694f6f3213d6fb88d872f77291412dceec263b57166519843b13eca9a4dR30
* | Merge pull request #2514 from lucab/ups/drop-setenvColin Walters2022-01-121-4/+0
|\ \ | |/ |/| libostree/sepolicy: get rid of a g_setenv() call
| * libostree/sepolicy: get rid of a g_setenv() callLuca BRUNO2022-01-111-4/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This removes a 'g_setenv()' call, which could potentially be unsafe in a multi-thread context. The current libselinux codebase does not seem to check for `LIBSELINUX_DISABLE_PCRE_PRECOMPILED`, so I think this has no effects nowadays. Additionally, I could not find any reference to it in libselinux git history, so I'm not sure if it ever played any role at all. My current understanding is that this is coming from version incompatibilities between an older libselinux in the build environment and a newer policy (with precompiled regexs) in the target. But from the ML discussion I found, I think it eventually got solved in a different way, possibly by avoiding the policy binary caches. Refs: * https://www.spinics.net/lists/selinux/msg14822.html * https://github.com/ostreedev/ostree/pull/2513#discussion_r781042884
* | main: Also support CLI extensions in `/usr/libexec/libostree/ext`Colin Walters2022-01-111-0/+1
|/ | | | | | | | | | | | | In fixing https://github.com/coreos/rpm-ostree/pull/3323 I felt that it was a bit ugly we're installing `/usr/bin/ostree-container`. It's kind of an implementation detail. We want users to use `ostree container`. Let's support values outside of $PATH too. For example, this also ensures that TAB completion for `ost` expands to `ostree ` with a space.
* ostree: check g_setenv return valueLuca BRUNO2022-01-101-1/+4
| | | | | This adds proper return-value checks on g_setenv calls. It fixes a static analysis warning highlighted by Coverity.
* lib/static-delta: throw a proper error on bspatch failureLuca BRUNO2022-01-031-1/+1
| | | | | This makes sure that a populated GError is returned when bsdiff patching fails. The human-friendly label also helps in debugging.
* lib: use ostree-content-writer headerLuca BRUNO2022-01-031-0/+1
| | | | | | This installs and exposes the content of `ostree-content-writer.h`, so that library consumers can properly reference symbols defined in that header.
* soup-uri: Fix clang-analyzer warning by dropping dead codeColin Walters2021-12-211-45/+0
| | | | | | | | Fixes `Argument with 'nonnull' attribute passed null` by making the code not exist at all anymore. In upstream libsoup this code is gone too; it uses `GUri` from glib which we probably could now too, but one thing at a time.
* Merge pull request #2496 from lucab/ups/repo-assertsColin Walters2021-12-071-4/+9
|\ | | | | lib/repo: fix problematic invariant checks
| * lib/repo: do no return a NULL on failureLuca BRUNO2021-12-071-2/+4
| | | | | | | | | | | | This turns an existing check into an assert. The previously returned NULL may result in confusing callers, as none of them is checking for that.
| * lib/repo: do no return an arbitrary mode on failureLuca BRUNO2021-12-071-1/+2
| | | | | | | | | | This turns the existing check into an assert. Otherwise, the previous code may return an arbitrary repo mode (bare) on failure.
| * lib/repo: assert that writable state and error agreeLuca BRUNO2021-12-071-1/+3
| | | | | | | | | | This adds an assertion to check that writable stable and error are in sync. The subsequent logic uses them interchangeably.
* | Merge pull request #2494 from jmarrero/fsf-addressColin Walters2021-12-07130-390/+130
|\ \ | |/ |/| Update FSF license notices to use URL instead of address
| * Update FSF license notices to use URL instead of addressJoseph Marrero2021-12-07130-390/+130
| |
* | repo: Change locking for summary regeneration to be sharedColin Walters2021-12-031-8/+2
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is trying to address: https://pagure.io/fedora-iot/issue/48 Basically we changed rpm-ostree to start doing a shared lock during commit by default, but this broke because pungi is starting a process doing a commit for each architecture, and then trying to regenerate the summary after each one. This patch is deleting a big comment with a rationale for why summary regeneration should be exclusive. Point by point: > This makes sure the commits and deltas don't get > deleted while generating the summary. But prune operations require an exclusive lock, which means that data still can't be deleted when the summary grabs a shared lock. > It also means we can be sure refs > won't be created/updated/deleted during the operation, without having to > add exclusive locks to those operations which would prevent concurrent > commits from working. First: The status quo *has* prevented concurrent commits from working! There is no real locking solution to this problem. What we really need to do here is regenerate the summary after each commit *or* when the caller decides to do it and e.g. include deltas at the same time. It's OK if multiple threads race to regenerate the summary; last-one-wins behavior here is totally fine.
* lib: misc static analysis fixesLuca BRUNO2021-11-262-3/+3
| | | | | This fixes a few warnings from coverity, none of which really interesting.
* lib/prune: Avoid unnecessary object serializationDan Nicholson2021-11-181-12/+9
| | | | | | `repo_prune_internal` was deserializing each object and passing the components to `maybe_prune_loose_object`, which promptly reserialized it.
* lib: Avoid dereferencing NULL error valuesRyan Gonzalez2021-11-122-6/+16
| | | | | | Otherwise, this will segfault when callers don't need any exact errors. Signed-off-by: Ryan Gonzalez <ryan.gonzalez@collabora.com>
* lib: Fix a bad call to g_file_get_childValentin David2021-11-031-1/+1
| | | | | | | | | | | | | | | | | | In Glib, since commit 3a6e8bc8876e149c36b6b14c6a25a718edb581ed, `g_file_get_child` does not accept absolute path as paramater anymore. The broken assertion was encountered during `ostree admin deploy` command for the checkout of subpath `etc`. Example of error log: ``` (ostree admin deploy:1640): GLib-GIO-CRITICAL **: 03:42:00.570: g_file_get_child: assertion '!g_path_is_absolute (name)' failed (ostree admin deploy:1640): GLib-GIO-CRITICAL **: 03:42:00.570: g_file_query_info: assertion 'G_IS_FILE (file)' failed ** OSTree:ERROR:src/ostree/ot-main.c:232:ostree_run: assertion failed: (success || error) Bail out! OSTree:ERROR:src/ostree/ot-main.c:232:ostree_run: assertion failed: (success || error) ```
* Merge pull request #2463 from cgwalters/fix-fanalyzerLuca Bruno2021-10-144-8/+12
|\ | | | | Fix various mostly theoretical gcc `-fanalyzer` issues
| * fetcher/soup: Fix gcc `-fanalyzer` warningColin Walters2021-10-131-1/+1
| | | | | | | | | | | | | | | | | | In general, we're probably going to need to change most of our `g_return_if_fail` to `g_assert`. The analyzer flags that the function can return `NULL`, but the caller isn't prepared for this. In practice, let's abort.
| * sysroot: Fix gcc `-fanalyzer` warningColin Walters2021-10-131-2/+6
| | | | | | | | | | | | | | | | | | In general, we're probably going to need to change most of our `g_return_if_fail` to `g_assert`. The analyzer flags that the function can return `NULL`, but the caller isn't prepared for this. In practice, let's abort.
| * deployment: Fix gcc `-fanalyzer` warningColin Walters2021-10-131-3/+3
| | | | | | | | | | | | | | | | | | In general, we're probably going to need to change most of our `g_return_if_fail` to `g_assert`. The analyzer flags that the function can return `NULL`, but the caller isn't prepared for this. In practice, let's abort.
| * remote: Fix gcc `-fanalyzer` warningColin Walters2021-10-131-2/+2
| | | | | | | | | | | | | | | | | | In general, we're probably going to need to change most of our `g_return_if_fail` to `g_assert`. The analyzer flags that the function can return `NULL`, but the caller isn't prepared for this. In practice, let's abort.
* | repo/private: move OstreeRepoAutoTransaction to a boxed typeLuca BRUNO2021-10-112-16/+51
|/ | | | | | | This defines `OstreeRepoAutoTransaction` as a boxed type, in order to support auto-generating bindings for it. That first requires adding internal reference-counting to it, to allow freely copying/freeing references to a single transaction guard.
* Remove OstreeTlsCertInteraction bits from introspectionColin Walters2021-10-063-2/+2
| | | | | | | | We filter out everything named `-private.h` from scanning, which differs from the gtk-doc exclude. Eventually this will be solved when we switch to the new gir-based docs. Came up in https://github.com/ostreedev/ostree-rs/pull/34#discussion_r723337772
* Release 2021.5v2021.5Colin Walters2021-10-052-6/+6
|
* Merge pull request #2449 from cgwalters/mtree-from-commitJonathan Lebon2021-10-053-0/+43
|\
| * lib: Add an API to construct a `MutableTree` from a commitColin Walters2021-10-013-0/+43
| | | | | | | | | | | | | | This is nicer than having the caller parse the commit object, or indirect via the `OstreeRepoFile*` object of the root. Will be used in ostree-rs-ext around tar parsing.
* | Merge pull request #2454 from lucab/ups/auto-txn-completeColin Walters2021-10-054-35/+156
|\ \ | | | | | | repo/private: allow committing/aborting through a transaction guard
| * | repo/private: allow committing/aborting through a transaction guardLuca BRUNO2021-10-054-35/+156
| |/ | | | | | | | | | | | | | | | | This enhances the auto-transaction logic, augmenting the scope of a transaction guard. It allows committing or aborting a transaction through its guard. It also supports tracking the completion status of a transaction guard, avoiding double commits/aborts, while retaining the auto-cleanup logic.
* | deploy: Ignore sockets, fifos in /etc during mergeColin Walters2021-10-011-3/+1
|/ | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=1945274 is an issue where a privileged kubernetes daemonset is writing a socket into `/etc`. This makes ostree upgrades barf. Now, they should clearly move it to `/run`. However, one option is for us to just ignore it instead of erroring out. Some brief investigation shows that e.g. `git add somesocket` is a silent no-op, which is an argument in favor of ignoring it. Closes: https://github.com/ostreedev/ostree/issues/2446
* sepolicy: Add deprecation comment for `_get_path()`Colin Walters2021-09-301-1/+5
| | | | | Came up in review https://github.com/ostreedev/ostree/pull/2447#issuecomment-931428312
* repo: Add an API to init `OstreeSePolicy` from commit directlyColin Walters2021-09-304-31/+68
| | | | | | | | | | This is part of `OstreeCommitModifier`, but I'm not using that in some of the ostree-ext Rust code. It just makes more sense as a direct policy API, where it should have been in the first place. There's already support for setting a policy object on a commit modifier, so that's all the old API needs to do now.
* Release 2021.4Colin Walters2021-09-082-6/+7
|
* Merge pull request #2434 from cgwalters/custom-remoteColin Walters2021-09-082-13/+32
|\ | | | | Add support for "custom remotes"
| * Add support for "custom remotes"Colin Walters2021-09-082-13/+32
| | | | | | | | | | | | | | | | | | | | This will be helpful for the "ostree native container" work in https://github.com/ostreedev/ostree-rs-ext/ Basically in order to reuse GPG/signapi verification, we need to support adding a remote, even though it can't be used via `ostree pull`. (At least, not until we merge ostree-rs-ext into ostree, but even then I think the principle stands)
* | Merge pull request #2435 from RBuddel/fix-delta-files-resume-legacy-transactionLuca Bruno2021-09-081-1/+1
|\ \ | | | | | | repo-pull: legacy_transaction_resuming flag ignored
| * | repo-pull: legacy_transaction_resuming flag ignoredBuddelmann, Richard RB2021-09-081-1/+1
| |/ | | | | | | | | | | for deltafiles the legacy_transaction_resuming flag is not used, which will mark the commit as done, even if files are missing. using already existing commitstate_is_partial function as fix
* | upgrade: Stabilize deployment stagingColin Walters2021-09-072-1/+6
|/ | | | | | | | | | We're waaay overdue for this, it's been the default in rpm-ostree for years, and solves several important bugs around not capturing `/etc` while things are running. Also, `ostree admin upgrade --stage` (should) become idempotent. Closes: https://github.com/ostreedev/ostree/issues/2389
* Merge pull request #2340 from cgwalters/sign-verify-apiColin Walters2021-08-313-0/+139
|\ | | | | Add an API to verify a commit signature explicitly
| * Add an API to verify a commit signature explicitlyColin Walters2021-08-303-0/+139
| | | | | | | | | | | | | | | | | | | | | | | | | | We have a bunch of APIs to do GPG verification of a commit, but that doesn't generalize to signapi. Further, they require the caller to check the signature status explicitly which seems like a trap. This much higher level API works with both GPG and signapi. The intention is to use this in things that are doing "external pulls" like the ostree-ext tar import support. There we will get the commitmeta from the tarball and we want to verify it at the same time we import the commit.
* | Merge pull request #2426 from cgwalters/xattrs-bareuseronly-unionLuca Bruno2021-08-271-2/+2
|\ \ | | | | | | checkout: Also ignore xattrs for union in bare-user-only mode
| * | checkout: Also ignore xattrs for union in bare-user-only modeColin Walters2021-08-261-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Followup to PRs related to https://github.com/ostreedev/ostree/issues/2410 Since the test suite now covers this the test was failing on a Fedora SELinux enabled host where we see `security.selinux` even if not in the commit.
* | | Merge pull request #2425 from cgwalters/hardlink-correct-errnoLuca Bruno2021-08-271-0/+2
|\ \ \ | | | | | | | | checkout: Save errno when re-throwing
View Lorry Controller Status