Skip to content

WIP: Rough draft for updated generic OCI sealing #226

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
cgwalters wants to merge 18 commits into
base: main
Choose a base branch
from
Draft

WIP: Rough draft for updated generic OCI sealing #226

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
d88fbe9
composefs-oci: Add OCI sealing spec, canonical tar, incremental pulls…
cgwalters Feb 12, 2026
72e0eaf
composefs-oci,composefs-boot: Extend V1 EROFS to OCI and booting
cgwalters Jun 5, 2026
a496455
fuse: Update fuser dependency 0.15.1 → 0.17.0
cgwalters Jun 2, 2026
8c8ff15
fuse: Expose FUSE serving via CLI and varlink RPC
cgwalters Jun 2, 2026
f3643a6
fuse: Add readdirplus, multithreading, and passthrough
cgwalters Jun 2, 2026
e9d916d
fsverity: Add block_size/digest_size helpers to Algorithm
cgwalters Jun 6, 2026
383b3d6
composefs-ioctls: Add keyring module for fs-verity certificate injection
cgwalters Jun 4, 2026
971b78d
composefs: Add fs-verity sealing primitives (algorithm, formatted dig…
cgwalters Jun 6, 2026
5a72c70
composefs-oci: Add OCI sealing/signing/referrers infrastructure
cgwalters Jun 6, 2026
7b7a599
composefs-ctl: Add seal/sign/verify/run/stop/keyring CLI commands
cgwalters Jun 6, 2026
88002fc
composefs-ctl: Add varlink Seal/Sign/Verify methods
cgwalters Jun 6, 2026
e0d1cdf
composefs-oci: refactor to use new sealing spec
cgwalters Jun 27, 2026
d6027d8
tests/ostree: Poll for HTTP server readiness instead of fixed sleep
cgwalters Jun 28, 2026
c6fdebf
composefs-oci,tests: Drop needless &mut on ValidatedFileSystem
cgwalters Jun 28, 2026
4035080
composefs-oci: Make base64 a non-optional dependency
cgwalters Jun 28, 2026
aa9e3f5
composefs-ctl: Fix feature-combo dead-code warnings
cgwalters Jun 28, 2026
de3002b
composefs-ctl: Classify OCI errors through the anyhow chain
cgwalters Jun 28, 2026
8527474
composefs-oci: Implement OCI signature verification (artifact + inline)
cgwalters Jun 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion contrib/packaging/install-test-deps.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ case "${ID}" in
;;
debian|ubuntu)
pkg_install \
openssl e2fsprogs bubblewrap openssh-server \
openssl e2fsprogs bubblewrap openssh-server fsverity \
ostree podman skopeo

# OSTree symlink targets — /root, /home, /srv, etc. are symlinks
Expand Down
12 changes: 8 additions & 4 deletions crates/composefs-ctl/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,21 +17,24 @@ name = "cfsctl"
path = "src/main.rs"

[features]
default = ['pre-6.15', 'oci', 'containers-storage', 'ostree']
default = ['pre-6.15', 'oci', 'containers-storage', 'ostree', 'fuse']
fuse = ['dep:composefs-fuse']
http = ['composefs-http']
oci = ['composefs-oci', 'composefs-oci/varlink']
containers-storage = ['composefs-oci/containers-storage', 'cstorage']
ostree = ['composefs-ostree']
rhel9 = ['composefs/rhel9']
rhel9 = ['composefs/rhel9', 'composefs/keyring']
'pre-6.15' = ['composefs/pre-6.15']

[dependencies]
anyhow = { version = "1.0.87", default-features = false }
fn-error-context = "0.2"
clap = { version = "4.5.0", default-features = false, features = ["std", "help", "usage", "derive", "wrap_help"] }
comfy-table = { version = "7.1", default-features = false }
composefs = { workspace = true, features = ["varlink"] }
composefs = { workspace = true, features = ["varlink", "keyring"] }
composefs-boot = { workspace = true }
composefs-fuse = { path = "../composefs-fuse", optional = true }
composefs-ioctls = { workspace = true, features = ["keyring"] }
composefs-oci = { workspace = true, optional = true, features = ["boot"] }
composefs-http = { workspace = true, optional = true }
cstorage = { package = "composefs-storage", path = "../composefs-storage", version = "0.7.0", features = ["userns-helper"], optional = true }
Expand All @@ -41,7 +44,8 @@ hex = { version = "0.4.0", default-features = false }
indicatif = { version = "0.17.0", default-features = false }
libsystemd = { version = "0.7" }
log = { version = "0.4", default-features = false }
rustix = { version = "1.0.0", default-features = false, features = ["fs", "process"] }
oci-spec = { version = "0.9", default-features = false, features = ["image", "runtime"] }
rustix = { version = "1.0.0", default-features = false, features = ["fs", "mount", "process"] }
serde = { version = "1.0", default-features = false, features = ["derive"] }
serde_json = { version = "1.0", default-features = false, features = ["std"] }
tokio = { version = "1.24.2", default-features = false, features = ["io-std", "io-util", "net", "rt", "sync"] }
Expand Down
Loading