.gitignore

@@ -1 +1 @@
-SOURCES/libostree-2022.2.tar.xz
+SOURCES/libostree-2024.7.tar.xz

.ostree.metadata

@@ -1 +1 @@
-9f1cc3796da8b7892a8ef930a5086d4ff42c475f SOURCES/libostree-2022.2.tar.xz
+7d1cb267442682402152ed4bb5379853e666f06b SOURCES/libostree-2024.7.tar.xz

SOURCES/0001-Add-an-ostree-boot-complete.service-to-propagate-sta.patch

@@ -1,374 +0,0 @@
-From a6d45dc165e48e2a463880ebb90f34c2b9d3c4ce Mon Sep 17 00:00:00 2001
-From: Colin Walters <walters@verbum.org>
-Date: Fri, 22 Apr 2022 18:46:28 -0400
-Subject: [PATCH 1/6] Add an `ostree-boot-complete.service` to propagate
- staging failures
-
-Quite a while ago we added staged deployments, which solved
-a bunch of issues around the `/etc` merge.  However...a persistent
-problem since then is that any failures in that process that
-happened in the *previous* boot are not very visible.
-
-We ship custom code in `rpm-ostree status` to query the previous
-journal.  But that has a few problems - one is that on systems
-that have been up a while, that failure message may even get
-rotated out.  And second, some systems may not even have a persistent
-journal at all.
-
-A general thing we do in e.g. Fedora CoreOS testing is to check
-for systemd unit failures.  We do that both in our automated tests,
-and we even ship code that displays them on ssh logins.  And beyond
-that obviously a lot of other projects do the same; it's easy via
-`systemctl --failed`.
-
-So to make failures more visible, change our `ostree-finalize-staged.service`
-to have an internal wrapper around the process that "catches" any
-errors, and copies the error message into a file in `/boot/ostree`.
-
-Then, a new `ostree-boot-complete.service` looks for this file on
-startup and re-emits the error message, and fails.
-
-It also deletes the file.  The rationale is to avoid *continually*
-warning.  For example we need to handle the case when an upgrade
-process creates a new staged deployment.  Now, we could change the
-ostree core code to delete the warning file when that happens instead,
-but this is trying to be a conservative change.
-
-This should make failures here much more visible as is.
----
- Makefile-boot.am                             |  2 +
- Makefile-ostree.am                           |  1 +
- src/boot/ostree-boot-complete.service        | 33 +++++++++++
- src/libostree/ostree-cmdprivate.c            |  1 +
- src/libostree/ostree-cmdprivate.h            |  1 +
- src/libostree/ostree-impl-system-generator.c |  2 +
- src/libostree/ostree-sysroot-deploy.c        | 62 ++++++++++++++++++--
- src/libostree/ostree-sysroot-private.h       |  7 +++
- src/libostree/ostree-sysroot.c               |  2 +
- src/ostree/ot-admin-builtin-boot-complete.c  | 58 ++++++++++++++++++
- src/ostree/ot-admin-builtins.h               |  1 +
- src/ostree/ot-builtin-admin.c                |  3 +
- tests/kolainst/destructive/staged-deploy.sh  | 12 ++++
- 13 files changed, 181 insertions(+), 4 deletions(-)
- create mode 100644 src/boot/ostree-boot-complete.service
- create mode 100644 src/ostree/ot-admin-builtin-boot-complete.c
-
-diff --git a/Makefile-boot.am b/Makefile-boot.am
-index ec10a0d6..e42e5180 100644
---- a/Makefile-boot.am
-+++ b/Makefile-boot.am
-@@ -38,6 +38,7 @@ endif
- if BUILDOPT_SYSTEMD
- systemdsystemunit_DATA = src/boot/ostree-prepare-root.service \
- 	src/boot/ostree-remount.service \
-+	src/boot/ostree-boot-complete.service \
- 	src/boot/ostree-finalize-staged.service \
- 	src/boot/ostree-finalize-staged.path \
- 	$(NULL)
-@@ -64,6 +65,7 @@ endif
- EXTRA_DIST += src/boot/dracut/module-setup.sh \
- 	src/boot/dracut/ostree.conf \
- 	src/boot/mkinitcpio \
-+	src/boot/ostree-boot-complete.service \
- 	src/boot/ostree-prepare-root.service \
- 	src/boot/ostree-finalize-staged.path \
- 	src/boot/ostree-remount.service \
-diff --git a/Makefile-ostree.am b/Makefile-ostree.am
-index 82af1681..0fe2c5f8 100644
---- a/Makefile-ostree.am
-+++ b/Makefile-ostree.am
-@@ -70,6 +70,7 @@ ostree_SOURCES += \
- 	src/ostree/ot-admin-builtin-diff.c \
- 	src/ostree/ot-admin-builtin-deploy.c \
- 	src/ostree/ot-admin-builtin-finalize-staged.c \
-+	src/ostree/ot-admin-builtin-boot-complete.c \
- 	src/ostree/ot-admin-builtin-undeploy.c \
- 	src/ostree/ot-admin-builtin-instutil.c \
- 	src/ostree/ot-admin-builtin-cleanup.c \
-diff --git a/src/boot/ostree-boot-complete.service b/src/boot/ostree-boot-complete.service
-new file mode 100644
-index 00000000..5c09fdc9
---- /dev/null
-+++ b/src/boot/ostree-boot-complete.service
-@@ -0,0 +1,33 @@
-+# Copyright (C) 2022 Red Hat, Inc.
-+#
-+# This library is free software; you can redistribute it and/or
-+# modify it under the terms of the GNU Lesser General Public
-+# License as published by the Free Software Foundation; either
-+# version 2 of the License, or (at your option) any later version.
-+#
-+# This library is distributed in the hope that it will be useful,
-+# but WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+# Lesser General Public License for more details.
-+#
-+# You should have received a copy of the GNU Lesser General Public
-+# License along with this library. If not, see <https://www.gnu.org/licenses/>.
-+
-+[Unit]
-+Description=OSTree Complete Boot
-+Documentation=man:ostree(1)
-+# For now, this is the only condition on which we start, but it's
-+# marked as a triggering condition in case in the future we want
-+# to do something else.
-+ConditionPathExists=|/boot/ostree/finalize-failure.stamp
-+RequiresMountsFor=/boot
-+# Ensure that we propagate the failure into the current boot before
-+# any further finalization attempts.
-+Before=ostree-finalize-staged.service
-+
-+[Service]
-+Type=oneshot
-+# To write to /boot while keeping it read-only
-+MountFlags=slave
-+RemainAfterExit=yes
-+ExecStart=/usr/bin/ostree admin boot-complete
-diff --git a/src/libostree/ostree-cmdprivate.c b/src/libostree/ostree-cmdprivate.c
-index c9a6e2e1..f6c114f4 100644
---- a/src/libostree/ostree-cmdprivate.c
-+++ b/src/libostree/ostree-cmdprivate.c
-@@ -51,6 +51,7 @@ ostree_cmd__private__ (void)
-     _ostree_repo_static_delta_delete,
-     _ostree_repo_verify_bindings,
-     _ostree_sysroot_finalize_staged,
-+    _ostree_sysroot_boot_complete,
-   };
- 
-   return &table;
-diff --git a/src/libostree/ostree-cmdprivate.h b/src/libostree/ostree-cmdprivate.h
-index 46452ebd..17f943c8 100644
---- a/src/libostree/ostree-cmdprivate.h
-+++ b/src/libostree/ostree-cmdprivate.h
-@@ -33,6 +33,7 @@ typedef struct {
-   gboolean (* ostree_static_delta_delete) (OstreeRepo *repo, const char *delta_id, GCancellable *cancellable, GError **error);
-   gboolean (* ostree_repo_verify_bindings) (const char *collection_id, const char *ref_name, GVariant *commit, GError **error);
-   gboolean (* ostree_finalize_staged) (OstreeSysroot *sysroot, GCancellable *cancellable, GError **error);
-+  gboolean (* ostree_boot_complete) (OstreeSysroot *sysroot, GCancellable *cancellable, GError **error);
- } OstreeCmdPrivateVTable;
- 
- /* Note this not really "public", we just export the symbol, but not the header */
-diff --git a/src/libostree/ostree-impl-system-generator.c b/src/libostree/ostree-impl-system-generator.c
-index 769f0cbd..92d71605 100644
---- a/src/libostree/ostree-impl-system-generator.c
-+++ b/src/libostree/ostree-impl-system-generator.c
-@@ -134,6 +134,8 @@ require_internal_units (const char *normal_dir,
-     return FALSE;
-   if (symlinkat (SYSTEM_DATA_UNIT_PATH "/ostree-finalize-staged.path", normal_dir_dfd, "multi-user.target.wants/ostree-finalize-staged.path") < 0)
-     return glnx_throw_errno_prefix (error, "symlinkat");
-+  if (symlinkat (SYSTEM_DATA_UNIT_PATH "/ostree-boot-complete.service", normal_dir_dfd, "multi-user.target.wants/ostree-boot-complete.service") < 0)
-+    return glnx_throw_errno_prefix (error, "symlinkat");
- 
-   return TRUE;
- #else
-diff --git a/src/libostree/ostree-sysroot-deploy.c b/src/libostree/ostree-sysroot-deploy.c
-index b7cc232f..fc5916d8 100644
---- a/src/libostree/ostree-sysroot-deploy.c
-+++ b/src/libostree/ostree-sysroot-deploy.c
-@@ -3255,10 +3255,10 @@ ostree_sysroot_stage_tree_with_options (OstreeSysroot     *self,
- }
- 
- /* Invoked at shutdown time by ostree-finalize-staged.service */
--gboolean
--_ostree_sysroot_finalize_staged (OstreeSysroot *self,
--                                 GCancellable  *cancellable,
--                                 GError       **error)
-+static gboolean
-+_ostree_sysroot_finalize_staged_inner (OstreeSysroot *self,
-+                                       GCancellable  *cancellable,
-+                                       GError       **error)
- {
-   /* It's totally fine if there's no staged deployment; perhaps down the line
-    * though we could teach the ostree cmdline to tell systemd to activate the
-@@ -3355,9 +3355,63 @@ _ostree_sysroot_finalize_staged (OstreeSysroot *self,
-   if (!ostree_sysroot_prepare_cleanup (self, cancellable, error))
-     return FALSE;
- 
-+  // Cleanup will have closed some FDs, re-ensure writability
-+  if (!_ostree_sysroot_ensure_writable (self, error))
-+    return FALSE;
-+
-   return TRUE;
- }
- 
-+/* Invoked at shutdown time by ostree-finalize-staged.service */
-+gboolean
-+_ostree_sysroot_finalize_staged (OstreeSysroot *self,
-+                                 GCancellable  *cancellable,
-+                                 GError       **error)
-+{
-+  g_autoptr(GError) finalization_error = NULL;
-+  if (!_ostree_sysroot_ensure_boot_fd (self, error))
-+    return FALSE;
-+  if (!_ostree_sysroot_finalize_staged_inner (self, cancellable, &finalization_error))
-+    {
-+      g_autoptr(GError) writing_error = NULL;
-+      g_assert_cmpint (self->boot_fd, !=, -1);
-+      if (!glnx_file_replace_contents_at (self->boot_fd, _OSTREE_FINALIZE_STAGED_FAILURE_PATH, 
-+                                           (guint8*)finalization_error->message, -1,
-+                                           0, cancellable, &writing_error))
-+        {
-+          // We somehow failed to write the failure message...that's not great.  Maybe ENOSPC on /boot.
-+          g_printerr ("Failed to write %s: %s\n", _OSTREE_FINALIZE_STAGED_FAILURE_PATH, writing_error->message);
-+        }
-+      g_propagate_error (error, g_steal_pointer (&finalization_error));
-+      return FALSE;
-+    }
-+  return TRUE;
-+}
-+
-+/* Invoked at bootup time by ostree-boot-complete.service */
-+gboolean
-+_ostree_sysroot_boot_complete (OstreeSysroot *self,
-+                               GCancellable  *cancellable,
-+                               GError       **error)
-+{
-+  if (!_ostree_sysroot_ensure_boot_fd (self, error))
-+    return FALSE;
-+
-+  glnx_autofd int failure_fd = -1;
-+  if (!ot_openat_ignore_enoent (self->boot_fd, _OSTREE_FINALIZE_STAGED_FAILURE_PATH, &failure_fd, error))
-+    return FALSE;
-+  // If we didn't find a failure log, then there's nothing to do right now.
-+  // (Actually this unit shouldn't even be invoked, but we may do more in the future)
-+  if (failure_fd == -1)
-+    return TRUE;
-+  g_autofree char *failure_data = glnx_fd_readall_utf8 (failure_fd, NULL, cancellable, error);
-+  if (failure_data == NULL)
-+    return glnx_prefix_error (error, "Reading from %s", _OSTREE_FINALIZE_STAGED_FAILURE_PATH);
-+  // Remove the file; we don't want to continually error out.
-+  (void) unlinkat (self->boot_fd, _OSTREE_FINALIZE_STAGED_FAILURE_PATH, 0);
-+  return glnx_throw (error, "ostree-finalize-staged.service failed on previous boot: %s", failure_data);
-+}
-+
- /**
-  * ostree_sysroot_deployment_set_kargs:
-  * @self: Sysroot
-diff --git a/src/libostree/ostree-sysroot-private.h b/src/libostree/ostree-sysroot-private.h
-index cb34eeb3..a49a406c 100644
---- a/src/libostree/ostree-sysroot-private.h
-+++ b/src/libostree/ostree-sysroot-private.h
-@@ -96,6 +96,9 @@ struct OstreeSysroot {
- #define _OSTREE_SYSROOT_BOOT_INITRAMFS_OVERLAYS "ostree/initramfs-overlays"
- #define _OSTREE_SYSROOT_INITRAMFS_OVERLAYS "boot/" _OSTREE_SYSROOT_BOOT_INITRAMFS_OVERLAYS
- 
-+// Relative to /boot, consumed by ostree-boot-complete.service
-+#define _OSTREE_FINALIZE_STAGED_FAILURE_PATH "ostree/finalize-failure.stamp"
-+
- gboolean
- _ostree_sysroot_ensure_writable (OstreeSysroot      *self,
-                                  GError            **error);
-@@ -142,6 +145,10 @@ gboolean
- _ostree_sysroot_finalize_staged (OstreeSysroot *self,
-                                  GCancellable  *cancellable,
-                                  GError       **error);
-+gboolean
-+_ostree_sysroot_boot_complete (OstreeSysroot *self,
-+                               GCancellable  *cancellable,
-+                               GError       **error);
- 
- OstreeDeployment *
- _ostree_sysroot_deserialize_deployment_from_variant (GVariant *v,
-diff --git a/src/libostree/ostree-sysroot.c b/src/libostree/ostree-sysroot.c
-index 266a2975..f083f950 100644
---- a/src/libostree/ostree-sysroot.c
-+++ b/src/libostree/ostree-sysroot.c
-@@ -356,6 +356,8 @@ _ostree_sysroot_ensure_writable (OstreeSysroot      *self,
-   ostree_sysroot_unload (self);
-   if (!ensure_sysroot_fd (self, error))
-     return FALSE;
-+  if (!_ostree_sysroot_ensure_boot_fd (self, error))
-+    return FALSE;
- 
-   return TRUE;
- }
-diff --git a/src/ostree/ot-admin-builtin-boot-complete.c b/src/ostree/ot-admin-builtin-boot-complete.c
-new file mode 100644
-index 00000000..6e1052f5
---- /dev/null
-+++ b/src/ostree/ot-admin-builtin-boot-complete.c
-@@ -0,0 +1,58 @@
-+/*
-+ * Copyright (C) 2022 Red Hat, Inc.
-+ *
-+ * SPDX-License-Identifier: LGPL-2.0+
-+ *
-+ * This library is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU Lesser General Public
-+ * License as published by the Free Software Foundation; either
-+ * version 2 of the License, or (at your option) any later version.
-+ *
-+ * This library is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+ * Lesser General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU Lesser General Public
-+ * License along with this library. If not, see <https://www.gnu.org/licenses/>.
-+ */
-+
-+#include "config.h"
-+
-+#include <stdlib.h>
-+
-+#include "ot-main.h"
-+#include "ot-admin-builtins.h"
-+#include "ot-admin-functions.h"
-+#include "ostree.h"
-+#include "otutil.h"
-+
-+#include "ostree-cmdprivate.h"
-+
-+static GOptionEntry options[] = {
-+  { NULL }
-+};
-+
-+gboolean
-+ot_admin_builtin_boot_complete (int argc, char **argv, OstreeCommandInvocation *invocation, GCancellable *cancellable, GError **error)
-+{
-+  /* Just a sanity check; we shouldn't be called outside of the service though.
-+   */
-+  struct stat stbuf;
-+  if (fstatat (AT_FDCWD, OSTREE_PATH_BOOTED, &stbuf, 0) < 0)
-+    return TRUE;
-+  // We must have been invoked via systemd which should have set up a mount namespace.
-+  g_assert (getenv ("INVOCATION_ID"));
-+
-+  g_autoptr(GOptionContext) context = g_option_context_new ("");
-+  g_autoptr(OstreeSysroot) sysroot = NULL;
-+  if (!ostree_admin_option_context_parse (context, options, &argc, &argv,
-+                                          OSTREE_ADMIN_BUILTIN_FLAG_SUPERUSER,
-+                                          invocation, &sysroot, cancellable, error))
-+    return FALSE;
-+
-+  if (!ostree_cmd__private__()->ostree_boot_complete (sysroot, cancellable, error))
-+    return FALSE;
-+
-+  return TRUE;
-+}
-diff --git a/src/ostree/ot-admin-builtins.h b/src/ostree/ot-admin-builtins.h
-index d32b617e..8d9451be 100644
---- a/src/ostree/ot-admin-builtins.h
-+++ b/src/ostree/ot-admin-builtins.h
-@@ -39,6 +39,7 @@ BUILTINPROTO(deploy);
- BUILTINPROTO(cleanup);
- BUILTINPROTO(pin);
- BUILTINPROTO(finalize_staged);
-+BUILTINPROTO(boot_complete);
- BUILTINPROTO(unlock);
- BUILTINPROTO(status);
- BUILTINPROTO(set_origin);
-diff --git a/src/ostree/ot-builtin-admin.c b/src/ostree/ot-builtin-admin.c
-index e0d2a60c..af09a614 100644
---- a/src/ostree/ot-builtin-admin.c
-+++ b/src/ostree/ot-builtin-admin.c
-@@ -43,6 +43,9 @@ static OstreeCommand admin_subcommands[] = {
-   { "finalize-staged", OSTREE_BUILTIN_FLAG_NO_REPO | OSTREE_BUILTIN_FLAG_HIDDEN,
-     ot_admin_builtin_finalize_staged,
-     "Internal command to run at shutdown time" },
-+  { "boot-complete", OSTREE_BUILTIN_FLAG_NO_REPO | OSTREE_BUILTIN_FLAG_HIDDEN,
-+    ot_admin_builtin_boot_complete,
-+    "Internal command to run at boot after an update was applied" },
-   { "init-fs", OSTREE_BUILTIN_FLAG_NO_REPO,
-      ot_admin_builtin_init_fs,
-     "Initialize a root filesystem" },

SOURCES/0001-Support-overlayfs-whiteouts-on-checkout.patch

@@ -1,515 +0,0 @@
-From 0085494e350c72599fc5c0e00422885d80b3c660 Mon Sep 17 00:00:00 2001
-From: Miguel Angel Ajo <majopela@redhat.com>
-Date: Mon, 19 Sep 2022 17:15:24 +0200
-Subject: [PATCH] Support overlayfs whiteouts on checkout
-
-Introduces an intermediate format for overlayfs storage, where
-.wh-ostree. prefixed files will be converted into char 0:0
-whiteout devices used by overlayfs to mark deletions across layers.
-
-The CI scripts now uses a volume for the scratch directories
-previously in /var/tmp otherwise we cannot create whiteout
-devices into an overlayfs mounted filesystem.
-
-Related-Issue: #2712
-(cherry picked from commit e234b630f85b97e48ecf45d5aaba9b1aa64e6b54)
----
- .github/workflows/tests.yml                |   8 +-
- Makefile-tests.am                          |   1 +
- bash/ostree                                |   1 +
- man/ostree-checkout.xml                    |  11 ++
- src/libostree/ostree-repo-checkout.c       | 129 ++++++++++++++++++++-
- src/libostree/ostree-repo.h                |   5 +-
- src/libostree/ostree-sysroot-deploy.c      |   2 +-
- src/ostree/ot-builtin-checkout.c           |   7 +-
- tests/archive-test.sh                      |   7 +-
- tests/basic-test.sh                        |  29 ++++-
- tests/kolainst/data-shared/libtest-core.sh |   7 ++
- tests/libtest.sh                           |  52 ++++++++-
- tests/test-admin-deploy-whiteouts.sh       |  42 +++++++
- 13 files changed, 292 insertions(+), 9 deletions(-)
- create mode 100755 tests/test-admin-deploy-whiteouts.sh
-
---- a/Makefile-tests.am
-+++ b/Makefile-tests.am
-@@ -107,6 +107,7 @@ _installed_or_uninstalled_test_scripts = \
- 	tests/test-admin-deploy-nomerge.sh \
- 	tests/test-admin-deploy-none.sh \
- 	tests/test-admin-deploy-bootid-gc.sh \
-+	tests/test-admin-deploy-whiteouts.sh \
- 	tests/test-osupdate-dtb.sh \
- 	tests/test-admin-instutil-set-kargs.sh \
- 	tests/test-admin-upgrade-not-backwards.sh \
-diff --git a/bash/ostree b/bash/ostree
-index 46363315..6f3b86ea 100644
---- a/bash/ostree
-+++ b/bash/ostree
-@@ -249,6 +249,7 @@ _ostree_checkout() {
-         --union-identical
-         --user-mode -U
-         --whiteouts
-+        --process-passthrough-whiteouts
-     "
- 
-     local options_with_args="
-diff --git a/man/ostree-checkout.xml b/man/ostree-checkout.xml
-index 4ed53a91..8f7d4f9b 100644
---- a/man/ostree-checkout.xml
-+++ b/man/ostree-checkout.xml
-@@ -114,6 +114,17 @@ License along with this library. If not, see <https://www.gnu.org/licenses/>.
-                 </para></listitem>
-             </varlistentry>
- 
-+            <varlistentry>
-+                <term><option>--process-passthrough-whiteouts</option></term>
-+
-+                <listitem><para>
-+                   Enable overlayfs whiteout extraction into 0:0 character devices.
-+                   Overlayfs whiteouts are encoded inside ostree as <literal>.ostree-wh.filename</literal>
-+                   and extracted as 0:0 character devices. This is useful to carry
-+                   container storage embedded into ostree.
-+                </para></listitem>
-+            </varlistentry>
-+
-             <varlistentry>
-                 <term><option>--allow-noent</option></term>
- 
-diff --git a/src/libostree/ostree-repo-checkout.c b/src/libostree/ostree-repo-checkout.c
-index 663292a9..7c7d0cc7 100644
---- a/src/libostree/ostree-repo-checkout.c
-+++ b/src/libostree/ostree-repo-checkout.c
-@@ -35,6 +35,8 @@
- #define WHITEOUT_PREFIX ".wh."
- #define OPAQUE_WHITEOUT_NAME ".wh..wh..opq"
- 
-+#define OVERLAYFS_WHITEOUT_PREFIX ".ostree-wh."
-+
- /* Per-checkout call state/caching */
- typedef struct {
-   GString *path_buf; /* buffer for real path if filtering enabled */
-@@ -582,6 +584,117 @@ checkout_file_hardlink (OstreeRepo                          *self,
-   return TRUE;
- }
- 
-+static gboolean
-+_checkout_overlayfs_whiteout_at_no_overwrite (OstreeRepoCheckoutAtOptions    *options,
-+                                              int                             destination_dfd,
-+                                              const char                     *destination_name,
-+                                              GFileInfo                      *file_info,
-+                                              GVariant                       *xattrs,
-+                                              gboolean                       *found_exant_file,
-+                                              GCancellable                   *cancellable,
-+                                              GError                        **error)
-+{
-+  if (found_exant_file != NULL)
-+    *found_exant_file = FALSE;
-+  guint32 file_mode = g_file_info_get_attribute_uint32 (file_info, "unix::mode");
-+  if (mknodat(destination_dfd, destination_name, (file_mode & ~S_IFMT) | S_IFCHR, (dev_t)0) < 0)
-+    {
-+      if (errno == EEXIST && found_exant_file != NULL)
-+        {
-+          *found_exant_file = TRUE;
-+          return TRUE;
-+        }
-+      return glnx_throw_errno_prefix (error, "Creating whiteout char device");
-+    }
-+  if (options->mode != OSTREE_REPO_CHECKOUT_MODE_USER)
-+    {
-+      if (xattrs != NULL &&
-+          !glnx_dfd_name_set_all_xattrs(destination_dfd, destination_name, xattrs,
-+                                          cancellable, error))
-+          return glnx_throw_errno_prefix (error, "Setting xattrs for whiteout char device");
-+
-+      if (TEMP_FAILURE_RETRY(fchownat(destination_dfd, destination_name,
-+                                      g_file_info_get_attribute_uint32 (file_info, "unix::uid"),
-+                                      g_file_info_get_attribute_uint32 (file_info, "unix::gid"),
-+                                      AT_SYMLINK_NOFOLLOW) < 0))
-+          return glnx_throw_errno_prefix (error, "fchownat");
-+      if (TEMP_FAILURE_RETRY (fchmodat (destination_dfd, destination_name, file_mode & ~S_IFMT, 0)) < 0)
-+          return glnx_throw_errno_prefix (error, "fchmodat %s to 0%o", destination_name, file_mode & ~S_IFMT);
-+    }
-+
-+  return TRUE;
-+}
-+
-+static gboolean
-+_checkout_overlayfs_whiteout_at (OstreeRepo                     *repo,
-+                                 OstreeRepoCheckoutAtOptions    *options,
-+                                 int                             destination_dfd,
-+                                 const char                     *destination_name,
-+                                 GFileInfo                      *file_info,
-+                                 GVariant                       *xattrs,
-+                                 GCancellable                   *cancellable,
-+                                 GError                        **error)
-+{
-+  gboolean found_exant_file = FALSE;
-+  if (!_checkout_overlayfs_whiteout_at_no_overwrite(options, destination_dfd, destination_name,
-+                                                    file_info, xattrs,&found_exant_file,
-+                                                    cancellable, error))
-+    return FALSE;
-+
-+   if (!found_exant_file)
-+    return TRUE;
-+
-+  guint32 uid = g_file_info_get_attribute_uint32 (file_info, "unix::uid");
-+  guint32 gid = g_file_info_get_attribute_uint32 (file_info, "unix::gid");
-+  guint32 file_mode = g_file_info_get_attribute_uint32 (file_info, "unix::mode");
-+
-+  struct stat dest_stbuf;
-+
-+  switch(options->overwrite_mode)
-+    {
-+      case OSTREE_REPO_CHECKOUT_OVERWRITE_NONE:
-+        return FALSE;
-+      case OSTREE_REPO_CHECKOUT_OVERWRITE_UNION_FILES:
-+        if (!ot_ensure_unlinked_at (destination_dfd, destination_name, error))
-+          return FALSE;
-+        return _checkout_overlayfs_whiteout_at_no_overwrite(options, destination_dfd, destination_name,
-+                                                   file_info, xattrs, NULL, cancellable, error);
-+      case OSTREE_REPO_CHECKOUT_OVERWRITE_ADD_FILES:
-+        return TRUE;
-+
-+      case OSTREE_REPO_CHECKOUT_OVERWRITE_UNION_IDENTICAL:
-+        if (!glnx_fstatat(destination_dfd, destination_name, &dest_stbuf, AT_SYMLINK_NOFOLLOW,
-+                          error))
-+          return FALSE;
-+        if (!(repo->disable_xattrs || repo->mode == OSTREE_REPO_MODE_BARE_USER_ONLY))
-+          {
-+            g_autoptr(GVariant) fs_xattrs;
-+            if (!glnx_dfd_name_get_all_xattrs (destination_dfd, destination_name,
-+                                               &fs_xattrs, cancellable, error))
-+              return FALSE;
-+            if (!g_variant_equal(fs_xattrs, xattrs))
-+              return glnx_throw(error, "existing destination file %s xattrs don't match",
-+                                destination_name);
-+          }
-+        if (options->mode != OSTREE_REPO_CHECKOUT_MODE_USER)
-+          {
-+            if (gid != dest_stbuf.st_gid)
-+              return glnx_throw(error, "existing destination file %s does not match gid %d",
-+                                destination_name, gid);
-+
-+            if (uid != dest_stbuf.st_uid)
-+              return glnx_throw(error, "existing destination file %s does not match uid %d",
-+                                destination_name, gid);
-+
-+            if ((file_mode & ALLPERMS) != (dest_stbuf.st_mode & ALLPERMS))
-+              return glnx_throw(error, "existing destination file %s does not match mode %o",
-+                                destination_name, file_mode);
-+          }
-+        break;
-+    }
-+    return TRUE;
-+}
-+
- static gboolean
- checkout_one_file_at (OstreeRepo                        *repo,
-                       OstreeRepoCheckoutAtOptions       *options,
-@@ -603,7 +716,8 @@ checkout_one_file_at (OstreeRepo                        *repo,
- 
-   /* FIXME - avoid the GFileInfo here */
-   g_autoptr(GFileInfo) source_info = NULL;
--  if (!ostree_repo_load_file (repo, checksum, NULL, &source_info, NULL,
-+  g_autoptr(GVariant) source_xattrs = NULL;
-+  if (!ostree_repo_load_file (repo, checksum, NULL, &source_info, &source_xattrs,
-                               cancellable, error))
-     return FALSE;
- 
-@@ -623,6 +737,7 @@ checkout_one_file_at (OstreeRepo                        *repo,
-   const gboolean is_unreadable = (!is_symlink && (source_mode & S_IRUSR) == 0);
-   const gboolean is_whiteout = (!is_symlink && options->process_whiteouts &&
-                                 g_str_has_prefix (destination_name, WHITEOUT_PREFIX));
-+  const gboolean is_overlayfs_whiteout = (!is_symlink && g_str_has_prefix (destination_name, OVERLAYFS_WHITEOUT_PREFIX));
-   const gboolean is_reg_zerosized = (!is_symlink && g_file_info_get_size (source_info) == 0);
-   const gboolean override_user_unreadable = (options->mode == OSTREE_REPO_CHECKOUT_MODE_USER && is_unreadable);
- 
-@@ -643,6 +758,18 @@ checkout_one_file_at (OstreeRepo                        *repo,
- 
-       need_copy = FALSE;
-     }
-+  else if (is_overlayfs_whiteout && options->process_passthrough_whiteouts)
-+    {
-+      const char *name = destination_name + (sizeof (OVERLAYFS_WHITEOUT_PREFIX) - 1);
-+
-+      if (!name[0])
-+        return glnx_throw (error, "Invalid empty overlayfs whiteout '%s'", name);
-+
-+      g_assert (name[0] != '/'); /* Sanity */
-+
-+      return _checkout_overlayfs_whiteout_at(repo, options, destination_dfd, name,
-+                                             source_info, source_xattrs, cancellable, error);
-+    }
-   else if (is_reg_zerosized || override_user_unreadable)
-     {
-       /* In https://github.com/ostreedev/ostree/commit/673cacd633f9d6b653cdea530657d3e780a41bbd we
-diff --git a/src/libostree/ostree-repo.h b/src/libostree/ostree-repo.h
-index 98571170..b3d7f986 100644
---- a/src/libostree/ostree-repo.h
-+++ b/src/libostree/ostree-repo.h
-@@ -989,8 +989,9 @@ typedef struct {
-   gboolean force_copy; /* Since: 2017.6 */
-   gboolean bareuseronly_dirs; /* Since: 2017.7 */
-   gboolean force_copy_zerosized; /* Since: 2018.9 */
--  gboolean unused_bools[4];
--  /* 4 byte hole on 64 bit */
-+  gboolean process_passthrough_whiteouts;
-+  gboolean unused_bools[3];
-+  /* 3 byte hole on 64 bit */
- 
-   const char *subpath;
- 
-diff --git a/src/libostree/ostree-sysroot-deploy.c b/src/libostree/ostree-sysroot-deploy.c
-index 404f336f..5c98103b 100644
---- a/src/libostree/ostree-sysroot-deploy.c
-+++ b/src/libostree/ostree-sysroot-deploy.c
-@@ -641,7 +641,7 @@ checkout_deployment_tree (OstreeSysroot     *sysroot,
-     return FALSE;
- 
-   /* Generate hardlink farm, then opendir it */
--  OstreeRepoCheckoutAtOptions checkout_opts = { 0, };
-+  OstreeRepoCheckoutAtOptions checkout_opts = { .process_passthrough_whiteouts = TRUE };
-   if (!ostree_repo_checkout_at (repo, &checkout_opts, osdeploy_dfd,
-                                 checkout_target_name, csum,
-                                 cancellable, error))
-diff --git a/src/ostree/ot-builtin-checkout.c b/src/ostree/ot-builtin-checkout.c
-index d69c8b0b..bfa43885 100644
---- a/src/ostree/ot-builtin-checkout.c
-+++ b/src/ostree/ot-builtin-checkout.c
-@@ -37,6 +37,7 @@ static gboolean opt_union;
- static gboolean opt_union_add;
- static gboolean opt_union_identical;
- static gboolean opt_whiteouts;
-+static gboolean opt_process_passthrough_whiteouts;
- static gboolean opt_from_stdin;
- static char *opt_from_file;
- static gboolean opt_disable_fsync;
-@@ -77,6 +78,7 @@ static GOptionEntry options[] = {
-   { "union-add", 0, 0, G_OPTION_ARG_NONE, &opt_union_add, "Keep existing files/directories, only add new", NULL },
-   { "union-identical", 0, 0, G_OPTION_ARG_NONE, &opt_union_identical, "When layering checkouts, error out if a file would be replaced with a different version, but add new files and directories", NULL },
-   { "whiteouts", 0, 0, G_OPTION_ARG_NONE, &opt_whiteouts, "Process 'whiteout' (Docker style) entries", NULL },
-+  { "process-passthrough-whiteouts", 0, 0, G_OPTION_ARG_NONE, &opt_process_passthrough_whiteouts, "Enable overlayfs whiteout extraction into char 0:0 devices", NULL },
-   { "allow-noent", 0, 0, G_OPTION_ARG_NONE, &opt_allow_noent, "Do nothing if specified path does not exist", NULL },
-   { "from-stdin", 0, 0, G_OPTION_ARG_NONE, &opt_from_stdin, "Process many checkouts from standard input", NULL },
-   { "from-file", 0, 0, G_OPTION_ARG_STRING, &opt_from_file, "Process many checkouts from input file", "FILE" },
-@@ -129,7 +131,8 @@ process_one_checkout (OstreeRepo           *repo,
-   if (opt_disable_cache || opt_whiteouts || opt_require_hardlinks ||
-       opt_union_add || opt_force_copy || opt_force_copy_zerosized ||
-       opt_bareuseronly_dirs || opt_union_identical ||
--      opt_skiplist_file || opt_selinux_policy || opt_selinux_prefix)
-+      opt_skiplist_file || opt_selinux_policy || opt_selinux_prefix ||
-+      opt_process_passthrough_whiteouts)
-     {
-       OstreeRepoCheckoutAtOptions checkout_options = { 0, };
- 
-@@ -162,6 +165,8 @@ process_one_checkout (OstreeRepo           *repo,
-         }
-       if (opt_whiteouts)
-         checkout_options.process_whiteouts = TRUE;
-+      if (opt_process_passthrough_whiteouts)
-+        checkout_options.process_passthrough_whiteouts = TRUE;
-       if (subpath)
-         checkout_options.subpath = subpath;
- 
-diff --git a/tests/archive-test.sh b/tests/archive-test.sh
-index b6d84979..6b45790e 100644
---- a/tests/archive-test.sh
-+++ b/tests/archive-test.sh
-@@ -71,6 +71,11 @@ mkdir -p test-overlays
- date > test-overlays/overlaid-file
- $OSTREE commit ${COMMIT_ARGS} -b test-base --base test2 --owner-uid 42 --owner-gid 42 test-overlays/
- $OSTREE ls -R test-base > ls.txt
--assert_streq "$(wc -l < ls.txt)" 14
-+if can_create_whiteout_devices; then
-+    assert_streq "$(wc -l < ls.txt)" 17
-+else
-+    assert_streq "$(wc -l < ls.txt)" 14
-+fi
-+
- assert_streq "$(grep '42.*42' ls.txt | wc -l)" 2
- echo "ok commit overlay base"
-diff --git a/tests/basic-test.sh b/tests/basic-test.sh
-index 04506c3d..0878e6f6 100644
---- a/tests/basic-test.sh
-+++ b/tests/basic-test.sh
-@@ -19,7 +19,7 @@
- 
- set -euo pipefail
- 
--echo "1..$((87 + ${extra_basic_tests:-0}))"
-+echo "1..$((89 + ${extra_basic_tests:-0}))"
- 
- CHECKOUT_U_ARG=""
- CHECKOUT_H_ARGS="-H"
-@@ -1187,3 +1187,30 @@ if test "$(id -u)" != "0"; then
- else
-     echo "ok # SKIP not run when root"
- fi
-+
-+if ! skip_one_without_whiteouts_devices; then
-+    cd ${test_tmpdir}
-+    rm checkout-test2 -rf
-+    $OSTREE checkout test2 checkout-test2
-+
-+    assert_not_has_file checkout-test2/whiteouts/whiteout
-+    assert_not_has_file checkout-test2/whiteouts/whiteout2
-+    assert_has_file checkout-test2/whiteouts/.ostree-wh.whiteout
-+    assert_has_file checkout-test2/whiteouts/.ostree-wh.whiteout2
-+
-+    echo "ok checkout: no whiteout passthrough by default"
-+fi
-+
-+if ! skip_one_without_whiteouts_devices; then
-+    cd ${test_tmpdir}
-+    rm checkout-test2 -rf
-+    $OSTREE checkout --process-passthrough-whiteouts test2 checkout-test2
-+
-+    assert_not_has_file checkout-test2/whiteouts/.ostree-wh.whiteout
-+    assert_not_has_file checkout-test2/whiteouts/.ostree-wh.whiteout2
-+
-+    assert_is_whiteout_device checkout-test2/whiteouts/whiteout
-+    assert_is_whiteout_device checkout-test2/whiteouts/whiteout2
-+
-+    echo "ok checkout: whiteout with overlayfs passthrough processing"
-+fi
-diff --git a/tests/libtest.sh b/tests/libtest.sh
-index 686f08dc..5830f210 100755
---- a/tests/libtest.sh
-+++ b/tests/libtest.sh
-@@ -148,6 +148,20 @@ if ! have_selinux_relabel; then
- fi
- echo done
- 
-+# whiteout char 0:0 devices can be created as regular users, but
-+# cannot be created inside containers mounted via overlayfs
-+can_create_whiteout_devices() {
-+    mknod -m 000 ${test_tmpdir}/.test-whiteout c 0 0 || return 1
-+    rm -f ${test_tmpdir}/.test-whiteout
-+    return 0
-+}
-+
-+echo -n checking for overlayfs whiteouts...
-+if ! can_create_whiteout_devices; then
-+    export OSTREE_NO_WHITEOUTS=1
-+fi
-+echo done
-+
- if test -n "${OT_TESTS_DEBUG:-}"; then
-     set -x
- fi
-@@ -245,6 +259,15 @@ setup_test_repository () {
-     ln -s nonexistent baz/alink
-     mkdir baz/another/
-     echo x > baz/another/y
-+
-+    # if we are running inside a container we cannot test
-+    # the overlayfs whiteout marker passthrough
-+    if ! test -n "${OSTREE_NO_WHITEOUTS:-}"; then
-+        mkdir whiteouts
-+        touch whiteouts/.ostree-wh.whiteout
-+        touch whiteouts/.ostree-wh.whiteout2
-+        chmod 755 whiteouts/.ostree-wh.whiteout2
-+    fi
-     umask "${oldumask}"
- 
-     cd ${test_tmpdir}/files
-@@ -406,7 +429,7 @@ setup_os_repository () {
-     mkdir osdata
-     cd osdata
-     kver=3.6.0
--    mkdir -p usr/bin ${bootdir} usr/lib/modules/${kver} usr/share usr/etc
-+    mkdir -p usr/bin ${bootdir} usr/lib/modules/${kver} usr/share usr/etc usr/container/layers/abcd
-     kernel_path=${bootdir}/vmlinuz
-     initramfs_path=${bootdir}/initramfs.img
-     # the HMAC file is only in /usr/lib/modules
-@@ -449,6 +472,17 @@ EOF
-     mkdir -p usr/etc/testdirectory
-     echo "a default daemon file" > usr/etc/testdirectory/test
- 
-+    # if we are running inside a container we cannot test
-+    # the overlayfs whiteout marker passthrough
-+    if ! test -n "${OSTREE_NO_WHITEOUTS:-}"; then
-+        # overlayfs whiteout passhthrough marker files
-+        touch usr/container/layers/abcd/.ostree-wh.whiteout
-+        chmod 400 usr/container/layers/abcd/.ostree-wh.whiteout
-+
-+        touch usr/container/layers/abcd/.ostree-wh.whiteout2
-+        chmod 777 usr/container/layers/abcd/.ostree-wh.whiteout2
-+    fi
-+
-     ${CMD_PREFIX} ostree --repo=${test_tmpdir}/testos-repo commit ${bootable_flag} --add-metadata-string version=1.0.9 -b testos/buildmain/x86_64-runtime -s "Build"
- 
-     # Ensure these commits have distinct second timestamps
-@@ -588,6 +622,22 @@ skip_without_user_xattrs () {
-     fi
- }
- 
-+# Usage: if ! skip_one_without_whiteouts_devices; then ... more tests ...; fi
-+skip_one_without_whiteouts_devices() {
-+    if ! can_create_whiteout_devices; then
-+        echo "ok # SKIP - this test requires whiteout device support (test outside containers)"
-+        return 0
-+    else
-+        return 1
-+    fi
-+}
-+
-+skip_without_whiteouts_devices () {
-+    if ! can_create_whiteout_devices; then
-+        skip "this test requires whiteout device support (test outside containers)"
-+    fi
-+}
-+
- _have_systemd_and_libmount=''
- have_systemd_and_libmount() {
-     if test "${_have_systemd_and_libmount}" = ''; then
-diff --git a/tests/test-admin-deploy-whiteouts.sh b/tests/test-admin-deploy-whiteouts.sh
-new file mode 100755
-index 00000000..66421949
---- /dev/null
-+++ b/tests/test-admin-deploy-whiteouts.sh
-@@ -0,0 +1,42 @@
-+#!/bin/bash
-+#
-+# Copyright (C) 2022 Red Hat, Inc.
-+#
-+# SPDX-License-Identifier: LGPL-2.0+
-+#
-+# This library is free software; you can redistribute it and/or
-+# modify it under the terms of the GNU Lesser General Public
-+# License as published by the Free Software Foundation; either
-+# version 2 of the License, or (at your option) any later version.
-+#
-+# This library is distributed in the hope that it will be useful,
-+# but WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+# Lesser General Public License for more details.
-+#
-+# You should have received a copy of the GNU Lesser General Public
-+# License along with this library. If not, see <https://www.gnu.org/licenses/>.
-+
-+set -euox pipefail
-+
-+. $(dirname $0)/libtest.sh
-+
-+skip_without_whiteouts_devices
-+
-+# Exports OSTREE_SYSROOT so --sysroot not needed.
-+setup_os_repository "archive" "syslinux"
-+${CMD_PREFIX} ostree --repo=sysroot/ostree/repo pull-local --remote=testos testos-repo testos/buildmain/x86_64-runtime
-+
-+echo "1..3"
-+${CMD_PREFIX} ostree admin deploy --os=testos --karg=root=LABEL=foo --karg=testkarg=1 testos:testos/buildmain/x86_64-runtime
-+origdeployment=$(${CMD_PREFIX} ostree admin --sysroot=sysroot --print-current-dir)
-+
-+assert_is_whiteout_device "${origdeployment}"/usr/container/layers/abcd/whiteout
-+echo "ok whiteout deployment"
-+
-+assert_not_has_file  "${origdeployment}"/usr/container/layers/abcd/.ostree-wh.whiteout
-+echo "ok .ostree-wh.whiteout not created"
-+
-+assert_file_has_mode "${origdeployment}"/usr/container/layers/abcd/whiteout 400
-+assert_file_has_mode "${origdeployment}"/usr/container/layers/abcd/whiteout2 777
-+echo "ok whiteout permissions are preserved"
--- 
-2.37.3
-

SOURCES/0001-repo-NUL-terminate-readlinkat-result.patch

@@ -0,0 +1,52 @@
+From 6756841a7d04c3cc651a1ce7de35c55c754578d3 Mon Sep 17 00:00:00 2001
+From: Colin Walters <walters@verbum.org>
+Date: Mon, 29 Jul 2024 15:17:10 -0400
+Subject: [PATCH 1/1] repo: NUL terminate readlinkat result
+
+Coverity was correctly complaining about this.
+
+Signed-off-by: Colin Walters <walters@verbum.org>
+---
+ src/libostree/ostree-repo-commit.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/src/libostree/ostree-repo-commit.c b/src/libostree/ostree-repo-commit.c
+index 4d12d5ec..db83ebf2 100644
+--- a/src/libostree/ostree-repo-commit.c
++++ b/src/libostree/ostree-repo-commit.c
+@@ -794,7 +794,7 @@ _try_clone_from_payload_link (OstreeRepo *self, OstreeRepo *dest_repo, const cha
+       glnx_autofd int fdf = -1;
+       char loose_path_buf[_OSTREE_LOOSE_PATH_MAX];
+       char loose_path_target_buf[_OSTREE_LOOSE_PATH_MAX];
+-      char target_buf[_OSTREE_LOOSE_PATH_MAX + _OSTREE_PAYLOAD_LINK_PREFIX_LEN];
++      char target_buf[_OSTREE_LOOSE_PATH_MAX + _OSTREE_PAYLOAD_LINK_PREFIX_LEN + 1];
+       char target_checksum[OSTREE_SHA256_STRING_LEN + 1];
+       int dfd = dfd_searches[i];
+       ssize_t size;
+@@ -804,16 +804,21 @@ _try_clone_from_payload_link (OstreeRepo *self, OstreeRepo *dest_repo, const cha
+       _ostree_loose_path (loose_path_buf, payload_checksum, OSTREE_OBJECT_TYPE_PAYLOAD_LINK,
+                           self->mode);
+ 
+-      size = TEMP_FAILURE_RETRY (readlinkat (dfd, loose_path_buf, target_buf, sizeof (target_buf)));
++      size = TEMP_FAILURE_RETRY (
++          readlinkat (dfd, loose_path_buf, target_buf, sizeof (target_buf) - 1));
+       if (size < 0)
+         {
+           if (errno == ENOENT)
+             continue;
+           return glnx_throw_errno_prefix (error, "readlinkat");
+         }
++      target_buf[size] = '\0';
+ 
++      const size_t expected_len = OSTREE_SHA256_STRING_LEN + _OSTREE_PAYLOAD_LINK_PREFIX_LEN;
+       if (size < OSTREE_SHA256_STRING_LEN + _OSTREE_PAYLOAD_LINK_PREFIX_LEN)
+-        return glnx_throw (error, "invalid data size for %s", loose_path_buf);
++        return glnx_throw (error, "invalid data size for %s; expected=%llu found=%llu",
++                           loose_path_buf, (unsigned long long)expected_len,
++                           (unsigned long long)size);
+ 
+       snprintf (target_checksum, size, "%.2s%.62s", target_buf + _OSTREE_PAYLOAD_LINK_PREFIX_LEN,
+                 target_buf + _OSTREE_PAYLOAD_LINK_PREFIX_LEN + 3);
+-- 
+2.45.2
+

SOURCES/0002-libarchive-Handle-archive_entry_symlink-returning-NU.patch

@@ -1,40 +0,0 @@
-From e5b45f861a4d5738679f37d46ebca6e171bb3212 Mon Sep 17 00:00:00 2001
-From: Colin Walters <walters@verbum.org>
-Date: Mon, 4 Apr 2022 10:25:35 -0400
-Subject: [PATCH 2/6] libarchive: Handle `archive_entry_symlink()` returning
- NULL
-
-The `archive_entry_symlink()` API can definitely return `NULL`,
-reading through the libarchive sources.
-
-I hit this in the wild when using old ostree-ext to try to unpack
-a chunked archive.
-
-I didn't try to characterize this more, and sorry no unit test right
-now.
----
- src/libostree/ostree-repo-libarchive.c | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/src/libostree/ostree-repo-libarchive.c b/src/libostree/ostree-repo-libarchive.c
-index 679aa44d..631c6d4b 100644
---- a/src/libostree/ostree-repo-libarchive.c
-+++ b/src/libostree/ostree-repo-libarchive.c
-@@ -146,8 +146,12 @@ file_info_from_archive_entry (struct archive_entry *entry)
- 
-   g_autoptr(GFileInfo) info = _ostree_stbuf_to_gfileinfo (&stbuf);
-   if (S_ISLNK (stbuf.st_mode))
--    g_file_info_set_attribute_byte_string (info, "standard::symlink-target",
--                                           archive_entry_symlink (entry));
-+    {
-+      const char *target = archive_entry_symlink (entry);
-+      if (target != NULL)
-+        g_file_info_set_attribute_byte_string (info, "standard::symlink-target",
-+                                               target);
-+    }
- 
-   return g_steal_pointer (&info);
- }
--- 
-2.31.1
-

SOURCES/0003-repo-Factor-out-_ostree_repo_auto_transaction_new.patch

@@ -1,82 +0,0 @@
-From 4a997ae08605ebe6ca02d9f422082f954e667a6c Mon Sep 17 00:00:00 2001
-From: Simon McVittie <smcv@collabora.com>
-Date: Sat, 30 Apr 2022 12:20:11 +0100
-Subject: [PATCH 3/6] repo: Factor out _ostree_repo_auto_transaction_new()
-
-This will allow the direct allocation in
-ostree_repo_prepare_transaction() to be replaced with a call to this
-function, avoiding breaking encapsulation.
-
-Signed-off-by: Simon McVittie <smcv@collabora.com>
-(cherry picked from commit 540e60c3e3ace66dd4e6cf825488fc918260a642)
----
- src/libostree/ostree-repo-private.h |  4 ++++
- src/libostree/ostree-repo.c         | 32 ++++++++++++++++++++++++-----
- 2 files changed, 31 insertions(+), 5 deletions(-)
-
-diff --git a/src/libostree/ostree-repo-private.h b/src/libostree/ostree-repo-private.h
-index 988c2179..96253e77 100644
---- a/src/libostree/ostree-repo-private.h
-+++ b/src/libostree/ostree-repo-private.h
-@@ -554,4 +554,8 @@ GType _ostree_repo_auto_transaction_get_type (void);
- 
- G_DEFINE_AUTOPTR_CLEANUP_FUNC (OstreeRepoAutoTransaction, _ostree_repo_auto_transaction_unref);
- 
-+/* Internal function to break a circular dependency:
-+ * should not be made into public API, even if the rest is */
-+OstreeRepoAutoTransaction *_ostree_repo_auto_transaction_new (OstreeRepo *repo);
-+
- G_END_DECLS
-diff --git a/src/libostree/ostree-repo.c b/src/libostree/ostree-repo.c
-index a27591b3..f6bffd60 100644
---- a/src/libostree/ostree-repo.c
-+++ b/src/libostree/ostree-repo.c
-@@ -709,6 +709,32 @@ ostree_repo_auto_lock_cleanup (OstreeRepoAutoLock *auto_lock)
-     }
- }
- 
-+/**
-+ * _ostree_repo_auto_transaction_new:
-+ * @repo: (not nullable): an #OsreeRepo object
-+ * @cancellable: Cancellable
-+ * @error: a #GError
-+ *
-+ * Return a guard for a transaction in @repo.
-+ *
-+ * Do not call this function outside the OstreeRepo transaction implementation.
-+ * Use _ostree_repo_auto_transaction_start() instead.
-+ *
-+ * Returns: (transfer full): an #OstreeRepoAutoTransaction guard on success,
-+ * %NULL otherwise.
-+ */
-+OstreeRepoAutoTransaction *
-+_ostree_repo_auto_transaction_new (OstreeRepo *repo)
-+{
-+  g_assert (repo != NULL);
-+
-+  OstreeRepoAutoTransaction *txn = g_malloc(sizeof(OstreeRepoAutoTransaction));
-+  txn->atomic_refcount = 1;
-+  txn->repo = g_object_ref (repo);
-+
-+  return g_steal_pointer (&txn);
-+}
-+
- /**
-  * _ostree_repo_auto_transaction_start:
-  * @repo: (not nullable): an #OsreeRepo object
-@@ -730,11 +756,7 @@ _ostree_repo_auto_transaction_start (OstreeRepo     *repo,
-   if (!ostree_repo_prepare_transaction (repo, NULL, cancellable, error))
-     return NULL;
- 
--  OstreeRepoAutoTransaction *txn = g_malloc(sizeof(OstreeRepoAutoTransaction));
--  txn->atomic_refcount = 1;
--  txn->repo = g_object_ref (repo);
--
--  return g_steal_pointer (&txn);
-+  return _ostree_repo_auto_transaction_new (repo);
- }
- 
- /**
--- 
-2.31.1
-

SOURCES/0004-repo-Correctly-initialize-refcount-of-temporary-tran.patch

@@ -1,39 +0,0 @@
-From 51c7960bea081446ad217e9725408ce5cb531157 Mon Sep 17 00:00:00 2001
-From: Simon McVittie <smcv@collabora.com>
-Date: Sat, 30 Apr 2022 12:53:42 +0100
-Subject: [PATCH 4/6] repo: Correctly initialize refcount of temporary
- transaction
-
-Previously, the reference count was left uninitialized as a result of
-bypassing the constructor, and the intended abort-on-error usually
-wouldn't have happened.
-
-Fixes: 8a9737a "repo/private: move OstreeRepoAutoTransaction to a boxed type"
-Resolves: https://github.com/ostreedev/ostree/issues/2592
-Signed-off-by: Simon McVittie <smcv@collabora.com>
-(cherry picked from commit 71304e854cdb344adb8b1ae7866929fbdde6c327)
----
- src/libostree/ostree-repo-commit.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/src/libostree/ostree-repo-commit.c b/src/libostree/ostree-repo-commit.c
-index 5b16be5b..dba98c32 100644
---- a/src/libostree/ostree-repo-commit.c
-+++ b/src/libostree/ostree-repo-commit.c
-@@ -1688,10 +1688,10 @@ ostree_repo_prepare_transaction (OstreeRepo     *self,
-   g_debug ("Preparing transaction in repository %p", self);
- 
-   /* Set up to abort the transaction if we return early from this function.
--   * This needs to be manually built here due to a circular dependency. */
--  g_autoptr(OstreeRepoAutoTransaction) txn = g_malloc(sizeof(OstreeRepoAutoTransaction));
-+   * We can't call _ostree_repo_auto_transaction_start() here, because that
-+   * would be a circular dependency; use the lower-level version instead. */
-+  g_autoptr(OstreeRepoAutoTransaction) txn = _ostree_repo_auto_transaction_new (self);
-   g_assert (txn != NULL);
--  txn->repo = self;
- 
-   memset (&self->txn.stats, 0, sizeof (OstreeRepoTransactionStats));
- 
--- 
-2.31.1
-

SOURCES/0005-deploy-Try-to-rebuild-policy-in-new-deployment-if-ne.patch

@@ -1,172 +0,0 @@
-From 62e62bcfd8a1770b906faed083d11e451a50f566 Mon Sep 17 00:00:00 2001
-From: Ondrej Mosnacek <omosnace@redhat.com>
-Date: Wed, 9 Mar 2022 15:27:11 +0100
-Subject: [PATCH 5/6] deploy: Try to rebuild policy in new deployment if needed
-
-Whenever the user has SELinux enabled and has any local
-modules/modifications installed, it is necessary to rebuild the policy
-in the final deployment, otherwise ostree will leave the binary policy
-files unchanged from last deployment as it detects difference against
-the base content (in rpm-ostree case this is the RPM content).
-
-To avoid the situation where the policy binaries go stale once any local
-customization of the policy is made, try to rebuild the policy as part
-of sysroot_finalize_deployment(). Use the special
---rebuild-if-modules-changed switch, which detects if the input module
-files have changed relative to last time the policy was built and skips
-the most time-consuming part of the rebuild process if modules are
-unchanged (thus making this a relatively cheap operation if the user
-hasn't made any modifications to the shipped policy).
-
-As suggested by Jonathan Lebon, this uses bubblewrap (via
-g_spawn_sync()) to perform the rebuild inside the deployment's
-filesystem tree, which also means that ostree will have a runtime
-dependency on bubblewrap.
-
-Partially addresses: https://github.com/coreos/fedora-coreos-tracker/issues/701
-
-Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
-(cherry picked from commit edb4f3893474736156c654aa43bdbf3784991811)
----
- ci/gh-install.sh                      |   1 +
- src/libostree/ostree-sysroot-deploy.c | 117 ++++++++++++++++++++++++++
- 2 files changed, 118 insertions(+)
-
-diff --git a/src/libostree/ostree-sysroot-deploy.c b/src/libostree/ostree-sysroot-deploy.c
-index fc5916d8..a44721d8 100644
---- a/src/libostree/ostree-sysroot-deploy.c
-+++ b/src/libostree/ostree-sysroot-deploy.c
-@@ -2830,6 +2830,118 @@ get_var_dfd (OstreeSysroot      *self,
-   return glnx_opendirat (base_dfd, base_path, TRUE, ret_fd, error);
- }
- 
-+#ifdef HAVE_SELINUX
-+static void
-+child_setup_fchdir (gpointer data)
-+{
-+  int fd = (int) (uintptr_t) data;
-+  int rc __attribute__((unused));
-+
-+  rc = fchdir (fd);
-+}
-+
-+/*
-+ * Derived from rpm-ostree's rust/src/bwrap.rs
-+ */
-+static gboolean
-+run_in_deployment (int deployment_dfd,
-+                   const gchar * const *child_argv,
-+                   gsize child_argc,
-+                   gint *exit_status,
-+                   gchar **stdout,
-+                   GError **error)
-+{
-+  static const gchar * const COMMON_ARGV[] = {
-+    "/usr/bin/bwrap",
-+    "--dev", "/dev", "--proc", "/proc", "--dir", "/run", "--dir", "/tmp",
-+    "--chdir", "/",
-+    "--die-with-parent",
-+    "--unshare-pid",
-+    "--unshare-uts",
-+    "--unshare-ipc",
-+    "--unshare-cgroup-try",
-+    "--ro-bind", "/sys/block",    "/sys/block",
-+    "--ro-bind", "/sys/bus",      "/sys/bus",
-+    "--ro-bind", "/sys/class",    "/sys/class",
-+    "--ro-bind", "/sys/dev",      "/sys/dev",
-+    "--ro-bind", "/sys/devices",  "/sys/devices",
-+    "--bind", "usr", "/usr",
-+    "--bind", "etc", "/etc",
-+    "--bind", "var", "/var",
-+    "--symlink", "/usr/lib",      "/lib",
-+    "--symlink", "/usr/lib32",    "/lib32",
-+    "--symlink", "/usr/lib64",    "/lib64",
-+    "--symlink", "/usr/bin",      "/bin",
-+    "--symlink", "/usr/sbin",     "/sbin",
-+  };
-+  static const gsize COMMON_ARGC = sizeof (COMMON_ARGV) / sizeof (*COMMON_ARGV);
-+
-+  gsize i;
-+  GPtrArray *args = g_ptr_array_sized_new (COMMON_ARGC + child_argc + 1);
-+  g_autofree gchar **args_raw = NULL;
-+
-+  for (i = 0; i < COMMON_ARGC; i++)
-+    g_ptr_array_add (args, (gchar *) COMMON_ARGV[i]);
-+
-+  for (i = 0; i < child_argc; i++)
-+    g_ptr_array_add (args, (gchar *) child_argv[i]);
-+
-+  g_ptr_array_add (args, NULL);
-+
-+  args_raw = (gchar **) g_ptr_array_free (args, FALSE);
-+
-+  return g_spawn_sync (NULL, args_raw, NULL, 0, &child_setup_fchdir,
-+                       (gpointer) (uintptr_t) deployment_dfd,
-+                       stdout, NULL, exit_status, error);
-+}
-+
-+/*
-+ * Run semodule to check if the module content changed after merging /etc
-+ * and rebuild the policy if needed.
-+ */
-+static gboolean
-+sysroot_finalize_selinux_policy (int deployment_dfd, GError **error)
-+{
-+  struct stat stbuf;
-+  gint exit_status;
-+  g_autofree gchar *stdout = NULL;
-+
-+  if (!glnx_fstatat_allow_noent (deployment_dfd, "etc/selinux/config", &stbuf,
-+                                 AT_SYMLINK_NOFOLLOW, error))
-+    return FALSE;
-+
-+  /* Skip the SELinux policy refresh if /etc/selinux/config doesn't exist. */
-+  if (errno != 0)
-+    return TRUE;
-+
-+  /*
-+   * Skip the SELinux policy refresh if the --rebuild-if-modules-changed
-+   * flag is not supported by semodule.
-+   */
-+  static const gchar * const SEMODULE_HELP_ARGV[] = {
-+    "semodule", "--help"
-+  };
-+  static const gsize SEMODULE_HELP_ARGC = sizeof (SEMODULE_HELP_ARGV) / sizeof (*SEMODULE_HELP_ARGV);
-+  if (!run_in_deployment (deployment_dfd, SEMODULE_HELP_ARGV,
-+                          SEMODULE_HELP_ARGC, &exit_status, &stdout, error))
-+    return FALSE;
-+  if (!g_spawn_check_exit_status (exit_status, error))
-+    return FALSE;
-+  if (!strstr(stdout, "--rebuild-if-modules-changed"))
-+    return TRUE;
-+
-+  static const gchar * const SEMODULE_REBUILD_ARGV[] = {
-+    "semodule", "-N", "--rebuild-if-modules-changed"
-+  };
-+  static const gsize SEMODULE_REBUILD_ARGC = sizeof (SEMODULE_REBUILD_ARGV) / sizeof (*SEMODULE_REBUILD_ARGV);
-+
-+  if (!run_in_deployment (deployment_dfd, SEMODULE_REBUILD_ARGV,
-+                          SEMODULE_REBUILD_ARGC, &exit_status, NULL, error))
-+    return FALSE;
-+  return g_spawn_check_exit_status (exit_status, error);
-+}
-+#endif /* HAVE_SELINUX */
-+
- static gboolean
- sysroot_finalize_deployment (OstreeSysroot     *self,
-                              OstreeDeployment  *deployment,
-@@ -2866,6 +2978,11 @@ sysroot_finalize_deployment (OstreeSysroot     *self,
-         return FALSE;
-     }
- 
-+#ifdef HAVE_SELINUX
-+  if (!sysroot_finalize_selinux_policy(deployment_dfd, error))
-+    return FALSE;
-+#endif /* HAVE_SELINUX */
-+
-   const char *osdeploypath = glnx_strjoina ("ostree/deploy/", ostree_deployment_get_osname (deployment));
-   glnx_autofd int os_deploy_dfd = -1;
-   if (!glnx_opendirat (self->sysroot_fd, osdeploypath, TRUE, &os_deploy_dfd, error))
--- 
-2.31.1
-

SOURCES/0006-deploy-Be-a-bit-more-verbose-about-SELinux-bits.patch

@@ -1,35 +0,0 @@
-From dd194eca7272afa457541abb2d8c25f90c4f478a Mon Sep 17 00:00:00 2001
-From: Colin Walters <walters@verbum.org>
-Date: Mon, 28 Mar 2022 17:46:59 -0400
-Subject: [PATCH 6/6] deploy: Be a bit more verbose about SELinux bits
-
-Let's log when we don't find the expected CLI argument which
-will help debug things.
-
-(cherry picked from commit c58a4fe661d9d3bf2c515aa5605b1e094c0a62ca)
----
- src/libostree/ostree-sysroot-deploy.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/src/libostree/ostree-sysroot-deploy.c b/src/libostree/ostree-sysroot-deploy.c
-index a44721d8..404f336f 100644
---- a/src/libostree/ostree-sysroot-deploy.c
-+++ b/src/libostree/ostree-sysroot-deploy.c
-@@ -2926,9 +2926,12 @@ sysroot_finalize_selinux_policy (int deployment_dfd, GError **error)
-                           SEMODULE_HELP_ARGC, &exit_status, &stdout, error))
-     return FALSE;
-   if (!g_spawn_check_exit_status (exit_status, error))
--    return FALSE;
-+    return glnx_prefix_error (error, "failed to run semodule");
-   if (!strstr(stdout, "--rebuild-if-modules-changed"))
--    return TRUE;
-+    {
-+      ot_journal_print (LOG_INFO, "semodule does not have --rebuild-if-modules-changed");
-+      return TRUE;
-+    }
- 
-   static const gchar * const SEMODULE_REBUILD_ARGV[] = {
-     "semodule", "-N", "--rebuild-if-modules-changed"
--- 
-2.31.1
-

SOURCES/0007-backport-GH2694-secure-execution-enablement-s390x.patch

@@ -1,298 +0,0 @@
-From 00697be199c08242e54c02e4557e20834030aaf3 Mon Sep 17 00:00:00 2001
-From: Nikita Dubrovskii <nikita@linux.ibm.com>
-Date: Mon, 4 Apr 2022 16:09:50 +0200
-Subject: [PATCH 1/5] s390x: generate sd-boot at its own partition
-
-Signed-off-by: Nikita Dubrovskii <nikita@linux.ibm.com>
----
- src/libostree/ostree-bootloader-zipl.c | 36 ++++++++++++++++++++++----
- src/libostree/s390x-se-luks-gencpio    |  4 +--
- 2 files changed, 33 insertions(+), 7 deletions(-)
-
-diff --git a/src/libostree/ostree-bootloader-zipl.c b/src/libostree/ostree-bootloader-zipl.c
-index 02c10826c3..fe024d8046 100644
---- a/src/libostree/ostree-bootloader-zipl.c
-+++ b/src/libostree/ostree-bootloader-zipl.c
-@@ -21,12 +21,17 @@
- #include "ostree-bootloader-zipl.h"
- #include "ostree-deployment-private.h"
- #include "otutil.h"
-+#include <sys/mount.h>
-+#include <sys/stat.h>
- #include <string.h>
- 
--#define SECURE_EXECUTION_BOOT_IMAGE     "/boot/sd-boot"
-+#define SECURE_EXECUTION_PARTITION      "/dev/disk/by-label/se"
-+#define SECURE_EXECUTION_MOUNTPOINT     "/sysroot/se"
-+#define SECURE_EXECUTION_BOOT_IMAGE     SECURE_EXECUTION_MOUNTPOINT "/sd-boot"
- #define SECURE_EXECUTION_HOSTKEY_PATH   "/etc/se-hostkeys/"
- #define SECURE_EXECUTION_HOSTKEY_PREFIX "ibm-z-hostkey"
- #define SECURE_EXECUTION_LUKS_ROOT_KEY  "/etc/luks/root"
-+#define SECURE_EXECUTION_LUKS_BOOT_KEY  "/etc/luks/boot"
- #define SECURE_EXECUTION_LUKS_CONFIG    "/etc/crypttab"
- #define SECURE_EXECUTION_RAMDISK_TOOL   PKGLIBEXECDIR "/s390x-se-luks-gencpio"
- 
-@@ -67,6 +72,25 @@ _ostree_bootloader_zipl_get_name (OstreeBootloader *bootloader)
-   return "zipl";
- }
- 
-+static gboolean
-+_ostree_secure_execution_mount(GError **error)
-+{
-+  const char *device = realpath (SECURE_EXECUTION_PARTITION, NULL);
-+  if (device == NULL)
-+    return glnx_throw_errno_prefix(error, "s390x SE: resolving %s", SECURE_EXECUTION_PARTITION);
-+  if (mount (device, SECURE_EXECUTION_MOUNTPOINT, "ext4", 0, NULL) < 0)
-+    return glnx_throw_errno_prefix (error, "s390x SE: Mounting %s", device);
-+  return TRUE;
-+}
-+
-+static gboolean
-+_ostree_secure_execution_umount(GError **error)
-+{
-+  if (umount (SECURE_EXECUTION_MOUNTPOINT) < 0)
-+    return glnx_throw_errno_prefix (error, "s390x SE: Unmounting %s", SECURE_EXECUTION_MOUNTPOINT);
-+  return TRUE;
-+}
-+
- static gboolean
- _ostree_bootloader_zipl_write_config (OstreeBootloader  *bootloader,
-                                           int                bootversion,
-@@ -152,8 +176,8 @@ _ostree_secure_execution_get_bls_config (OstreeBootloaderZipl *self,
- static gboolean
- _ostree_secure_execution_luks_key_exists (void)
- {
--  return (access(SECURE_EXECUTION_LUKS_ROOT_KEY, F_OK) == 0 &&
--          access(SECURE_EXECUTION_LUKS_CONFIG, F_OK) == 0);
-+  return (access(SECURE_EXECUTION_LUKS_CONFIG, F_OK) == 0 &&
-+    (access(SECURE_EXECUTION_LUKS_ROOT_KEY, F_OK) == 0 || access(SECURE_EXECUTION_LUKS_BOOT_KEY, F_OK) == 0));
- }
- 
- static gboolean
-@@ -250,7 +274,7 @@ static gboolean
- _ostree_secure_execution_call_zipl (GError **error)
- {
-   int status = 0;
--  const char *const zipl_argv[] = {"zipl", "-V", "-t", "/boot", "-i", SECURE_EXECUTION_BOOT_IMAGE, NULL};
-+  const char *const zipl_argv[] = {"zipl", "-V", "-t", SECURE_EXECUTION_MOUNTPOINT, "-i", SECURE_EXECUTION_BOOT_IMAGE, NULL};
-   if (!g_spawn_sync (NULL, (char**)zipl_argv, NULL, G_SPAWN_SEARCH_PATH,
-                        NULL, NULL, NULL, NULL, &status, error))
-     return glnx_prefix_error(error, "s390x SE: spawning zipl");
-@@ -274,9 +298,11 @@ _ostree_secure_execution_enable (OstreeBootloaderZipl *self,
-   g_autofree gchar* options = NULL;
- 
-   gboolean rc =
-+      _ostree_secure_execution_mount (error) &&
-       _ostree_secure_execution_get_bls_config (self, bootversion, &vmlinuz, &initramfs, &options, cancellable, error) &&
-       _ostree_secure_execution_generate_sdboot (vmlinuz, initramfs, options, keys, error) &&
--      _ostree_secure_execution_call_zipl (error);
-+      _ostree_secure_execution_call_zipl (error) &&
-+      _ostree_secure_execution_umount (error);
- 
-   return rc;
- }
-diff --git a/src/libostree/s390x-se-luks-gencpio b/src/libostree/s390x-se-luks-gencpio
-index f0ad24eb32..7d62258a31 100755
---- a/src/libostree/s390x-se-luks-gencpio
-+++ b/src/libostree/s390x-se-luks-gencpio
-@@ -12,11 +12,11 @@ gzip -cd ${old_initrd} | cpio -imd --quiet
- 
- # Adding LUKS root key and crypttab config
- mkdir -p etc/luks
--cp -f /etc/luks/root etc/luks/
-+cp -f /etc/luks/* etc/luks/
- cp -f /etc/crypttab etc/
- 
- # Creating new initramdisk image
--find . | cpio --quiet -H newc -o | gzip -9 -n >> ${new_initrd}
-+find . -mindepth 1 | cpio --quiet -H newc -o | gzip -9 -n >> ${new_initrd}
- 
- # Cleanup
- rm -rf ${workdir}
-
-From 91e71022ebc2422f278c285e55f4c88d7f572eeb Mon Sep 17 00:00:00 2001
-From: Nikita Dubrovskii <nikita@linux.ibm.com>
-Date: Mon, 23 May 2022 17:28:54 +0200
-Subject: [PATCH 2/5] s390x: ensure SecureExecution is enabled before sd-boot
- generation
-
-Signed-off-by: Nikita Dubrovskii <nikita@linux.ibm.com>
----
- src/libostree/ostree-bootloader-zipl.c | 24 ++++++++++++++++++------
- 1 file changed, 18 insertions(+), 6 deletions(-)
-
-diff --git a/src/libostree/ostree-bootloader-zipl.c b/src/libostree/ostree-bootloader-zipl.c
-index fe024d8046..348dfe036d 100644
---- a/src/libostree/ostree-bootloader-zipl.c
-+++ b/src/libostree/ostree-bootloader-zipl.c
-@@ -25,6 +25,7 @@
- #include <sys/stat.h>
- #include <string.h>
- 
-+#define SECURE_EXECUTION_SYSFS_FLAG     "/sys/firmware/uv/prot_virt_guest"
- #define SECURE_EXECUTION_PARTITION      "/dev/disk/by-label/se"
- #define SECURE_EXECUTION_MOUNTPOINT     "/sysroot/se"
- #define SECURE_EXECUTION_BOOT_IMAGE     SECURE_EXECUTION_MOUNTPOINT "/sd-boot"
-@@ -109,6 +110,14 @@ _ostree_bootloader_zipl_write_config (OstreeBootloader  *bootloader,
-   return TRUE;
- }
- 
-+static gboolean _ostree_secure_execution_is_enabled (GCancellable *cancellable) {
-+  gsize len = 0;
-+  g_autofree char *data = glnx_file_get_contents_utf8_at (-1, SECURE_EXECUTION_SYSFS_FLAG, &len, cancellable, NULL);
-+  if (!data)
-+    return FALSE;
-+  return strstr (data, "1") != NULL;
-+}
-+
- static gboolean
- _ostree_secure_execution_get_keys (GPtrArray **keys,
-                                    GCancellable *cancellable,
-@@ -329,12 +338,15 @@ _ostree_bootloader_zipl_post_bls_sync (OstreeBootloader  *bootloader,
-     return TRUE;
- 
-   /* Try with Secure Execution */
--  g_autoptr(GPtrArray) keys = NULL;
--  if (!_ostree_secure_execution_get_keys (&keys, cancellable, error))
--    return FALSE;
--  if (keys && keys->len)
--    return _ostree_secure_execution_enable (self, bootversion, keys, cancellable, error);
--
-+  if ( _ostree_secure_execution_is_enabled (cancellable) )
-+    {
-+      g_autoptr(GPtrArray) keys = NULL;
-+      if (!_ostree_secure_execution_get_keys (&keys, cancellable, error))
-+        return FALSE;
-+      if (!keys || keys->len == 0)
-+          return glnx_throw (error, "s390x SE: no keys");
-+      return _ostree_secure_execution_enable (self, bootversion, keys, cancellable, error);
-+    }
-   /* Fallback to non-SE setup */
-   const char *const zipl_argv[] = {"zipl", NULL};
-   int estatus;
-
-From 2e2854239189044cc1ffd100959b7c7bfe92b0f9 Mon Sep 17 00:00:00 2001
-From: Nikita Dubrovskii <nikita@linux.ibm.com>
-Date: Tue, 24 May 2022 19:30:35 +0200
-Subject: [PATCH 3/5] s390x: fail on error during reading of SecureExecution
- sysfs flag
-
----
- src/libostree/ostree-bootloader-zipl.c | 24 ++++++++++++++++++------
- 1 file changed, 18 insertions(+), 6 deletions(-)
-
-diff --git a/src/libostree/ostree-bootloader-zipl.c b/src/libostree/ostree-bootloader-zipl.c
-index 348dfe036d..87b9b67aec 100644
---- a/src/libostree/ostree-bootloader-zipl.c
-+++ b/src/libostree/ostree-bootloader-zipl.c
-@@ -110,12 +110,21 @@ _ostree_bootloader_zipl_write_config (OstreeBootloader  *bootloader,
-   return TRUE;
- }
- 
--static gboolean _ostree_secure_execution_is_enabled (GCancellable *cancellable) {
--  gsize len = 0;
--  g_autofree char *data = glnx_file_get_contents_utf8_at (-1, SECURE_EXECUTION_SYSFS_FLAG, &len, cancellable, NULL);
-+static gboolean _ostree_secure_execution_is_enabled (gboolean *out_enabled,
-+                                                     GCancellable *cancellable,
-+                                                     GError **error)
-+{
-+  *out_enabled = FALSE;
-+  glnx_autofd int fd = -1;
-+  if (!ot_openat_ignore_enoent (AT_FDCWD, SECURE_EXECUTION_SYSFS_FLAG, &fd, error))
-+    return FALSE;
-+  if (fd == -1)
-+    return TRUE; //ENOENT --> SecureExecution is disabled
-+  g_autofree char *data = glnx_fd_readall_utf8 (fd, NULL, cancellable, error);
-   if (!data)
-     return FALSE;
--  return strstr (data, "1") != NULL;
-+  *out_enabled = strstr (data, "1") != NULL;
-+  return TRUE;
- }
- 
- static gboolean
-@@ -338,13 +347,16 @@ _ostree_bootloader_zipl_post_bls_sync (OstreeBootloader  *bootloader,
-     return TRUE;
- 
-   /* Try with Secure Execution */
--  if ( _ostree_secure_execution_is_enabled (cancellable) )
-+  gboolean se_enabled = FALSE;
-+  if ( !_ostree_secure_execution_is_enabled (&se_enabled, cancellable, error))
-+    return FALSE;
-+  if (se_enabled)
-     {
-       g_autoptr(GPtrArray) keys = NULL;
-       if (!_ostree_secure_execution_get_keys (&keys, cancellable, error))
-         return FALSE;
-       if (!keys || keys->len == 0)
--          return glnx_throw (error, "s390x SE: no keys");
-+        return glnx_throw (error, "s390x SE: no keys");
-       return _ostree_secure_execution_enable (self, bootversion, keys, cancellable, error);
-     }
-   /* Fallback to non-SE setup */
-
-From 89ed46e8a9f584e2a6c1966fbf4c99f0fe51424e Mon Sep 17 00:00:00 2001
-From: Nikita Dubrovskii <nikita@linux.ibm.com>
-Date: Fri, 27 May 2022 09:13:18 +0200
-Subject: [PATCH 4/5] s390x: do not unpack existing initrd, just append LUKS
- keys to its copy
-
-Signed-off-by: Nikita Dubrovskii <nikita@linux.ibm.com>
----
- src/libostree/s390x-se-luks-gencpio | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/src/libostree/s390x-se-luks-gencpio b/src/libostree/s390x-se-luks-gencpio
-index 7d62258a31..f444198a40 100755
---- a/src/libostree/s390x-se-luks-gencpio
-+++ b/src/libostree/s390x-se-luks-gencpio
-@@ -4,19 +4,19 @@ set -euo pipefail
- 
- old_initrd=$1
- new_initrd=$2
-+currdir=$PWD
- 
--# Unpacking existing initramdisk
-+# Copying existing initramdisk
-+cp ${old_initrd} ${new_initrd}
-+
-+# Appending LUKS root keys and crypttab config to the end of initrd
- workdir=$(mktemp -d -p /tmp se-initramfs-XXXXXX)
- cd ${workdir}
--gzip -cd ${old_initrd} | cpio -imd --quiet
--
--# Adding LUKS root key and crypttab config
- mkdir -p etc/luks
- cp -f /etc/luks/* etc/luks/
- cp -f /etc/crypttab etc/
--
--# Creating new initramdisk image
- find . -mindepth 1 | cpio --quiet -H newc -o | gzip -9 -n >> ${new_initrd}
- 
- # Cleanup
-+cd ${currdir}
- rm -rf ${workdir}
-
-From 2c8d5b95c7f2fee90e73bdd9222e002c44e797b7 Mon Sep 17 00:00:00 2001
-From: Nikita Dubrovskii <nikita@linux.ibm.com>
-Date: Thu, 23 Jun 2022 15:54:04 +0200
-Subject: [PATCH 5/5] s390x: rename sd-boot to sdboot
-
-Signed-off-by: Nikita Dubrovskii <nikita@linux.ibm.com>
----
- src/libostree/ostree-bootloader-zipl.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/libostree/ostree-bootloader-zipl.c b/src/libostree/ostree-bootloader-zipl.c
-index 87b9b67aec..0ff350f942 100644
---- a/src/libostree/ostree-bootloader-zipl.c
-+++ b/src/libostree/ostree-bootloader-zipl.c
-@@ -28,7 +28,7 @@
- #define SECURE_EXECUTION_SYSFS_FLAG     "/sys/firmware/uv/prot_virt_guest"
- #define SECURE_EXECUTION_PARTITION      "/dev/disk/by-label/se"
- #define SECURE_EXECUTION_MOUNTPOINT     "/sysroot/se"
--#define SECURE_EXECUTION_BOOT_IMAGE     SECURE_EXECUTION_MOUNTPOINT "/sd-boot"
-+#define SECURE_EXECUTION_BOOT_IMAGE     SECURE_EXECUTION_MOUNTPOINT "/sdboot"
- #define SECURE_EXECUTION_HOSTKEY_PATH   "/etc/se-hostkeys/"
- #define SECURE_EXECUTION_HOSTKEY_PREFIX "ibm-z-hostkey"
- #define SECURE_EXECUTION_LUKS_ROOT_KEY  "/etc/luks/root"

SOURCES/0008-backport-GH2696-ed25519-verify-signatures-minimum-length.patch

@@ -1,32 +0,0 @@
-From 56820e54392efc5dd59032f8872aaf219190ad4f Mon Sep 17 00:00:00 2001
-From: Colin Walters <walters@verbum.org>
-Date: Thu, 14 Jul 2022 14:42:19 -0400
-Subject: [PATCH] sign/ed25519: Verify signatures are minimum length
-
-The ed25519 signature verification code does not
-check that the signature is a minimum/correct length.
-As a result, if the signature is too short, libsodium will end up
-reading a few bytes out of bounds.
-
-Reported-by: Demi Marie Obenour <demi@invisiblethingslab.com>
-Co-authored-by: Demi Marie Obenour <demi@invisiblethingslab.com>
-
-Closes: https://github.com/ostreedev/ostree/security/advisories/GHSA-gqf4-p3gv-g8vw
----
- src/libostree/ostree-sign-ed25519.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/src/libostree/ostree-sign-ed25519.c b/src/libostree/ostree-sign-ed25519.c
-index 809ffe8790..f271fd49e0 100644
---- a/src/libostree/ostree-sign-ed25519.c
-+++ b/src/libostree/ostree-sign-ed25519.c
-@@ -209,6 +209,9 @@ gboolean ostree_sign_ed25519_data_verify (OstreeSign *self,
-       g_autoptr (GVariant) child = g_variant_get_child_value (signatures, i);
-       g_autoptr (GBytes) signature = g_variant_get_data_as_bytes(child);
- 
-+      if (g_bytes_get_size (signature) != crypto_sign_BYTES)
-+        return glnx_throw (error, "Invalid signature length of %" G_GSIZE_FORMAT " bytes, expected %" G_GSIZE_FORMAT, (gsize) g_bytes_get_size (signature), (gsize) crypto_sign_BYTES);
-+
-       g_autofree char * hex = g_malloc0 (crypto_sign_PUBLICKEYBYTES*2 + 1);
- 
-       g_debug("Read signature %d: %s", (gint)i, g_variant_print(child, TRUE));

SOURCES/0016-commit-fix-ostree-deployment-on-64-bit-inode-fs.patch

@@ -1,57 +0,0 @@
-From 9053aaffab2ec02ed377a82389422cc4e77dff8a Mon Sep 17 00:00:00 2001
-From: Abylay Ospan <aospan@amazon.com>
-Date: Tue, 6 Jun 2023 02:13:14 +0000
-Subject: [PATCH 16/17] commit: fix ostree deployment on 64-bit inode fs
-
-This commit addresses a bug that was causing ostree deployment
-to become corrupted on the large fs, when any package was installed using
-'rpm-ostree install'.
-
-In such instances, multiple files were assigned the same inode. For
-example, the '/home' directory and a regular file 'pkg-get' were
-assigned the same inode (2147484070), making the deployment unusable.
-
-A root cause analysis was performed, running the process under gdb,
-which revealed a lossy conversion from guint64 to guint32, for example
-6442451366 converted to 2147484070:
-
-(gdb) p name
-$10 = 0x7fe9224d2d70 "home"
-
-(gdb) p inode
-$73 = 6442451366
-
-(gdb) s
-    device=66311, modifier=0x7fe914791840) at
-src/libostree/ostree-repo-commit.c:1590
-
-The conversion resulted in entirely independent files potentially
-receiving the same inode.
-
-The issue was discovered on PoC machine equipped with a large NVME
-(3.4TB), but the bug can be easily reproduced using `cosa run -m 4000
---qemu-size +3TB', followed by installation of any package using
-`rpm-ostree install`. The resulting deployment will be unusable due to
-many files being "corrupted" by the aforementioned issue.
-
-(cherry picked from commit de6fddc6adee09a93901243dc7074090828a1912)
----
- src/libostree/ostree-repo-commit.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/libostree/ostree-repo-commit.c b/src/libostree/ostree-repo-commit.c
-index dba98c32..e224d1cb 100644
---- a/src/libostree/ostree-repo-commit.c
-+++ b/src/libostree/ostree-repo-commit.c
-@@ -1584,7 +1584,7 @@ static const char *
- devino_cache_lookup (OstreeRepo           *self,
-                      OstreeRepoCommitModifier *modifier,
-                      guint32               device,
--                     guint32               inode)
-+                     guint64               inode)
- {
-   OstreeDevIno dev_ino_key;
-   OstreeDevIno *dev_ino_val;
--- 
-2.40.1
-

SOURCES/0017-Add-an-always-on-inode64-feature.patch

@@ -1,33 +0,0 @@
-From 8b86c6c0b520f6856f9f8dba09c97114113d3244 Mon Sep 17 00:00:00 2001
-From: Colin Walters <walters@verbum.org>
-Date: Thu, 20 Jul 2023 09:13:43 -0400
-Subject: [PATCH 17/17] Add an always-on `inode64` feature
-
-As I (and others) will be backporting the fix in
-https://github.com/ostreedev/ostree/pull/2874/commits/de6fddc6adee09a93901243dc7074090828a1912
-pretty far, I want a way for sysadmins and OS builders to
-be able to reliably see when their version of ostree has this fix
-(Because comparing version numbers isn't portable).
----
- configure.ac | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/configure.ac b/configure.ac
-index 3bd735ed..b58d0a67 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -82,7 +82,10 @@ AM_COND_IF([BUILDOPT_TSAN],
- LT_PREREQ([2.2.4])
- LT_INIT([disable-static])
- 
--OSTREE_FEATURES=""
-+dnl We have an always-on feature now to signify the fix for 
-+dnl https://github.com/ostreedev/ostree/pull/2874/commits/de6fddc6adee09a93901243dc7074090828a1912
-+dnl "commit: fix ostree deployment on 64-bit inode fs"
-+OSTREE_FEATURES="inode64"
- AC_SUBST([OSTREE_FEATURES])
- 
- GLIB_TESTS
--- 
-2.40.1
-

SOURCES/0018-Backport-7f70614a1ac1950ebde3df0e26cc9ab1d72b2f1f.patch

@@ -1,27 +0,0 @@
-From 3443baa6e63b36d169f57027d7e80df614592c8e Mon Sep 17 00:00:00 2001
-From: Joseph Marrero <jmarrero@redhat.com>
-Date: Fri, 4 Aug 2023 16:09:20 -0400
-Subject: [PATCH] Backport: 7f70614a1ac1950ebde3df0e26cc9ab1d72b2f1f
-
----
- src/libostree/ostree-sysroot-deploy.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/src/libostree/ostree-sysroot-deploy.c b/src/libostree/ostree-sysroot-deploy.c
-index 2454a587..4d6d796e 100644
---- a/src/libostree/ostree-sysroot-deploy.c
-+++ b/src/libostree/ostree-sysroot-deploy.c
-@@ -1613,9 +1613,8 @@ static void *
- sync_in_thread (void *ptr)
- {
-   SyncData *syncdata = ptr;
--  // Ensure that the caller is blocked waiting
--  g_mutex_lock (&syncdata->mutex);
-   sync ();
-+  g_mutex_lock (&syncdata->mutex);
-   // Signal success
-   syncdata->success = true;
-   g_cond_broadcast (&syncdata->cond);
--- 
-2.41.0
-

SOURCES/ostree-readonly-sysroot-migration

@@ -0,0 +1,81 @@
+#!/bin/bash
+# Update an existing system to use a read only sysroot
+# and https://bugzilla.redhat.com/show_bug.cgi?id=2060976
+
+set -euo pipefail
+
+main() {
+
+    # Used to condition execution of this unit at the systemd level
+    local -r stamp_file="/var/lib/.ostree-readonly-sysroot"
+
+    if [[ -f "${stamp_file}" ]]; then
+        exit 0
+    fi
+
+    local -r ostree_sysroot_readonly="$(ostree config --repo=/sysroot/ostree/repo get "sysroot.readonly" &> /dev/null || echo "false")"
+    if [[ "${ostree_sysroot_readonly}" == "true" ]]; then
+        # Nothing to do
+        touch "${stamp_file}"
+        exit 0
+    fi
+
+    local -r boot_entries="$(ls -A /boot/loader/entries/ | wc -l)"
+
+    # Ensure that we can read BLS entries to avoid touching systems where /boot
+    # is not mounted
+    if [[ "${boot_entries}" -eq 0 ]]; then
+        echo "No BLS entry found: Maybe /boot is not mounted?" 1>&2
+        echo "This is unexpected thus no migration will be performed" 1>&2
+        touch "${stamp_file}"
+        exit 0
+    fi
+
+    # Check if any existing deployment is still missing the rw karg
+    local rw_kargs_found=0
+    local count=0
+    for f in "/boot/loader/entries/"*; do
+        count="$(grep -c "^options .* rw" "${f}" || true)"
+        if [[ "${count}" -ge 1 ]]; then
+            rw_kargs_found=$((rw_kargs_found + 1))
+        fi
+    done
+
+    # Some deployments are still missing the rw karg. Let's try to update them
+    if [[ "${boot_entries}" -ne "${rw_kargs_found}" ]]; then
+        # work around https://github.com/ostreedev/ostree/issues/2734#issuecomment-2353739450
+        stateroot=$(ls /ostree/deploy | head -n1)
+        if ls /boot/loader/entries/ostree-*-$stateroot.conf &>/dev/null; then
+            echo "Enabling bootloader naming workaround" 1>&2
+            export OSTREE_SYSROOT_OPTS=bootloader-naming-1
+        fi
+        ostree admin kargs edit-in-place --append-if-missing=rw || \
+            echo "Failed to edit kargs in place with ostree" 1>&2
+    fi
+
+    # Re-check if any existing deployment is still missing the rw karg
+    rw_kargs_found=0
+    count=0
+    for f in "/boot/loader/entries/"*; do
+        count="$(grep -c "^options .* rw" "${f}" || true)"
+        if [[ "${count}" -ge 1 ]]; then
+            rw_kargs_found=$((rw_kargs_found + 1))
+        fi
+    done
+    unset count
+
+    # If all deployments are good, then we can set the sysroot.readonly option
+    # in the ostree repo config
+    if [[ "${boot_entries}" -eq "${rw_kargs_found}" ]]; then
+        echo "Setting up the sysroot.readonly option in the ostree repo config"
+        ostree config --repo=/sysroot/ostree/repo set "sysroot.readonly" "true"
+        touch "${stamp_file}"
+        exit 0
+    fi
+
+    # If anything else before failed, we will retry on next boot
+    echo "Will retry next boot" 1>&2
+    exit 0
+}
+
+main "${@}"

SOURCES/ostree-readonly-sysroot-migration.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Read-Only Sysroot Migration
+Documentation=https://ostreedev.github.io/ostree
+ConditionPathExists=!/var/lib/.ostree-readonly-sysroot
+ConditionPathExists=/run/ostree-booted
+RequiresMountsFor=/sysroot /boot
+ConditionPathIsReadWrite=/sysroot
+ 
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/ostree-readonly-sysroot-migration
+RemainAfterExit=yes
+ 
+[Install]
+WantedBy=multi-user.target

SPECS/ostree.spec

@@ -1,4 +1,4 @@
-# Don't ship tests on RHEL > 7.
+# We haven't yet "productized" the tests
 %if 0%{?rhel} > 7
     %bcond_with tests
 %else
@@ -7,29 +7,17 @@
 
 Summary: Tool for managing bootable, immutable filesystem trees
 Name: ostree
-Version: 2022.2
+Version: 2024.7
-Release: 8%{?dist}
+Release: 3%{?dist}
 Source0: https://github.com/ostreedev/%{name}/releases/download/v%{version}/libostree-%{version}.tar.xz
+Source1: ostree-readonly-sysroot-migration
+Source2: ostree-readonly-sysroot-migration.service
+
+Patch0: 0001-repo-NUL-terminate-readlinkat-result.patch
+
 License: LGPLv2+
 URL: https://ostree.readthedocs.io/en/latest/
 
-# We now track the rhel8 branch upstream, these are the patches
-# since the 2022.2 release.
-Patch0: 0001-Add-an-ostree-boot-complete.service-to-propagate-sta.patch
-Patch1: 0002-libarchive-Handle-archive_entry_symlink-returning-NU.patch
-Patch2: 0003-repo-Factor-out-_ostree_repo_auto_transaction_new.patch
-Patch3: 0004-repo-Correctly-initialize-refcount-of-temporary-tran.patch
-Patch4: 0005-deploy-Try-to-rebuild-policy-in-new-deployment-if-ne.patch
-Patch5: 0006-deploy-Be-a-bit-more-verbose-about-SELinux-bits.patch
-Patch6: 0007-backport-GH2694-secure-execution-enablement-s390x.patch
-Patch7: 0008-backport-GH2696-ed25519-verify-signatures-minimum-length.patch
-Patch8: 0001-Support-overlayfs-whiteouts-on-checkout.patch
-# The original intention was to sync to the rhel8 branch upstream; that appears not to have happened
-# Patches for https://bugzilla.redhat.com/show_bug.cgi?id=2224102
-Patch16: 0016-commit-fix-ostree-deployment-on-64-bit-inode-fs.patch
-Patch17: 0017-Add-an-always-on-inode64-feature.patch
-Patch18: 0018-Backport-7f70614a1ac1950ebde3df0e26cc9ab1d72b2f1f.patch
-
 BuildRequires: make
 BuildRequires: git
 # We always run autogen.sh
@@ -40,6 +28,7 @@ BuildRequires: gtk-doc
 BuildRequires: pkgconfig(zlib)
 BuildRequires: pkgconfig(libcurl)
 BuildRequires: openssl-devel
+BuildRequires: pkgconfig(composefs)
 # The tests still require soup
 BuildRequires: pkgconfig(libsoup-2.4)
 BuildRequires: libattr-devel
@@ -62,6 +51,7 @@ Requires: dracut
 Requires: /usr/bin/gpgv2
 Requires: systemd-units
 Requires: %{name}-libs%{?_isa} = %{?epoch:%{epoch}:}%{version}-%{release}
+Requires: composefs
 
 %description
 libostree is a shared library designed primarily for
@@ -110,17 +100,27 @@ the functionality of the installed %{name} package.
 %autosetup -Sgit -n libostree-%{version}
 
 %build
+# gobject introspection does not work with LTO.  There is an effort to fix this
+# in the appropriate project upstreams, so hopefully LTO can be enabled someday
+# Disable LTO.
+%define _lto_cflags %{nil}
+
 env NOCONFIGURE=1 ./autogen.sh
 %configure --disable-silent-rules \
            --enable-gtk-doc \
            --with-selinux \
            --with-curl \
            --with-openssl \
+           --with-composefs \
            %{?with_tests:--enable-installed-tests=exclusive} \
            --with-dracut=yesbutnoconf
 %make_build
 
 %install
+install -m 644 -D %{SOURCE2} %{buildroot}/usr/lib/systemd/system/ostree-readonly-sysroot-migration.service
+install -m 755 -D %{SOURCE1} %{buildroot}/usr/libexec/ostree-readonly-sysroot-migration
+install -dm0755 %{buildroot}%{_unitdir}/multi-user.target.wants/
+ln -sf ../ostree-readonly-sysroot-migration.service %{buildroot}%{_unitdir}/multi-user.target.wants/
 %make_install INSTALL="install -p -c"
 find %{buildroot} -name '*.la' -delete
 
@@ -146,11 +146,13 @@ find %{buildroot} -name '*.la' -delete
 %{_prefix}/lib/systemd/system-generators/ostree-system-generator
 %exclude %{_sysconfdir}/grub.d/*ostree
 %exclude %{_libexecdir}/libostree/grub2*
-%exclude %{_libexecdir}/libostree/ostree-trivial-httpd
 %{_prefix}/lib/tmpfiles.d/*
 %{_prefix}/lib/ostree
 # Moved in git master
 %{_libexecdir}/libostree/*
+%{_prefix}/lib/systemd/system/ostree-readonly-sysroot-migration.service
+%{_libexecdir}/ostree-readonly-sysroot-migration
+%{_unitdir}/multi-user.target.wants/ostree-readonly-sysroot-migration.service
 
 %files libs
 %{_sysconfdir}/ostree
@@ -176,98 +178,246 @@ find %{buildroot} -name '*.la' -delete
 %files tests
 %{_libexecdir}/installed-tests
 %{_datadir}/installed-tests
-%{_libexecdir}/libostree/ostree-trivial-httpd
 %endif
 
 %changelog
-* Tue Aug 08 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2022.2-8
+* Thu Sep 12 2024 Joseph Marrero <jmarrero@fedoraproject.org> - 2024.7-3
-- Backport for https://github.com/ostreedev/ostree/commit/7f70614a1ac1950ebde3df0e26cc9ab1d72b2f1f
+- Rebuild to pickup changes to ostree-readonly-sysroot-migration
-- Resolves: rhbz#2229895
+  Resolves: #RHEL-58437
 
-* Thu Jul 20 2023 Colin Walters <walters@verbum.org> - 2022.2-7
+* Wed Aug 14 2024 Joseph Marrero <jmarrero@fedoraproject.org> - 2024.7-2
-- Backport for https://bugzilla.redhat.com/show_bug.cgi?id=2224102
+- Backport https://github.com/ostreedev/ostree/pull/3281
+  Resolves: #RHEL-50680
 
-* Fri Oct 14 2022 Colin Walters <walters@verbum.org> - 2022.2-6
+* Fri Jul 26 2024 Joseph Marrero <jmarrero@fedoraproject.org> - 2024.7-1
-- Backport https://github.com/ostreedev/ostree/commit/0085494e350c72599fc5c0e00422885d80b3c660
+- https://github.com/ostreedev/ostree/releases/tag/v2024.7
-- Resolves: rhbz#2134629
+  Resolves: #RHEL-50680
 
-* Tue Aug 23 2022 Luca BRUNO <lucab@redhat.com> - 2022.2-5
+* Fri May 17 2024 Joseph Marrero <jmarrero@fedoraproject.org> - 2024.6-1
-- Backport enablement patches for Secure Execution on s390x
+- https://github.com/ostreedev/ostree/releases/tag/v2024.6
-  https://github.com/ostreedev/ostree/pull/2694
+  Resolves: #RHEL-35886
-  Resolves: rhbz#2120522
-- Backport security fix to verify signatures are minimum length (advisory GHSA-gqf4-p3gv-g8vw)
-  https://github.com/ostreedev/ostree/pull/2696
-  Resolves: rhbz#2119444
 
-* Wed May 04 2022 Colin Walters <walters@verbum.org> - 2022.2-4
+* Thu Mar 14 2024 Colin Walters <walters@verbum.org> - 2024.5-2
-- Backport patches from 2022.3, particularly SELinux
+- https://github.com/ostreedev/ostree/releases/tag/v2024.5
-  Resolves: rhbz#2057497
 
-* Tue Apr 19 2022 Colin Walters <walters@verbum.org> - 2022.2-3
+* Wed Feb 28 2024 Colin Walters <walters@verbum.org> - 2024.4-3
-- https://github.com/ostreedev/ostree/releases/tag/v2022.2
+- Backport
-  Resolves: rhbz#2057497
+  https://github.com/ostreedev/ostree/pull/3205/commits/e47b37096343efa3bea8295f3f44c4dc90cc04e2
+
+* Fri Feb 23 2024 Colin Walters <walters@verbum.org> - 2024.4-2
+- https://github.com/ostreedev/ostree/releases/tag/v2024.4
+
+* Wed Feb 14 2024 Colin Walters <walters@verbum.org> - 2024.3-2
+- https://github.com/ostreedev/ostree/releases/tag/v2024.3
+  Resolves: #RHEL-19419
+
+* Thu Feb 08 2024 Colin Walters <walters@verbum.org> - 2024.2-2
+- https://github.com/ostreedev/ostree/releases/tag/v2024.2
+
+* Sun Jan 21 2024 Colin Walters <walters@verbum.org> - 2024.1-2
+- https://github.com/ostreedev/ostree/releases/tag/v2024.1
+  Resolves: #RHEL-19419
+
+* Wed Dec 13 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2023.8-3
+- https://github.com/ostreedev/ostree/releases/tag/v2023.8
+  Resolves: #RHEL-19419
+
+* Wed Dec 06 2023 Colin Walters <walters@verbum.org> - 2023.8-2
+- https://github.com/ostreedev/ostree/releases/tag/v2023.8
+  Resolves: #RHEL-19419
+
+* Fri Oct 20 2023 Colin Walters <walters@verbum.org> - 2023.7-2
+- https://github.com/ostreedev/ostree/releases/tag/v2023.7
+  Resolves: #RHEL-14381
+
+* Fri Aug 25 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2023.6-1
+- https://github.com/ostreedev/ostree/releases/tag/v2023.6
+  Resolves: rhbz#2234351
+
+* Fri Aug 4 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2023.5-1
+- https://github.com/ostreedev/ostree/releases/tag/v2023.5
+  backport: https://github.com/ostreedev/ostree/commit/7f70614a1ac1950ebde3df0e26cc9ab1d72b2f1f
+  Resolves: rhbz#2221997
+
+* Wed Jun 28 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2023.4-2
+- Add patch https://github.com/ostreedev/ostree/pull/2901
+  Resolves: rhbz#2216810
+
+* Thu Jun 22 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2023.4-1
+- https://github.com/ostreedev/ostree/releases/tag/v2023.4
+  Resolves: rhbz#2216810
+
+* Tue Jun 13 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2023.3-1
+- https://github.com/ostreedev/ostree/releases/tag/v2023.3
+  Resolves: rhbz#2211487
+
+* Thu Mar 23 2023 Colin Walters <walters@verbum.org> - 2023.2-2
+- https://github.com/ostreedev/ostree/releases/tag/v2023.2
+  Resolves: rhbz#2172898
+
+* Thu Feb 23 2023 Colin Walters <walters@verbum.org> - 2023.1-2
+- Update to 2023.1
+  Resolves: rhbz#2172898
+  xref https://issues.redhat.com/browse/COS-2069
+
+* Thu Feb 9 2023 Sayan Paul <saypaul@redhat.com> - 2022.6-3
+- Resolves: rhbz#2167344
+
+* Wed Dec 14 2022 Sayan Paul <saypaul@redhat.com> - 2022.6-2
+- Resolves: rhbz#2060976
+
+* Thu Oct 13 2022 Luca BRUNO <lucab@redhat.com> - 2022.6-1
+- New upstream version
+  https://github.com/ostreedev/ostree/releases/tag/v2022.6
+  Resolves: rhbz#2134054
+
+* Mon Aug 22 2022 Luca BRUNO <lucab@redhat.com> - 2022.5-1
+- New upstream version
+  https://github.com/ostreedev/ostree/releases/tag/v2022.5
+  Resolves: rhbz#2119815
+
+* Thu May 05 2022 Colin Walters <walters@verbum.org> - 2022.3-2
+- https://github.com/ostreedev/ostree/releases/tag/v2022.3
+  Resolves: rhbz#2081840
+
+* Fri Apr 01 2022 Luca BRUNO <lucab@redhat.com> - 2022.2-1
+- New upstream version
+  https://github.com/ostreedev/ostree/releases/tag/v2022.2
+  Resolves: rhbz#2070964
 
 * Mon Jan 10 2022 Colin Walters <walters@verbum.org> - 2022.1-2
 - Rebase to 2022.1
-  Resolves: rhbz#2032593
+  Resolves: rhbz#2039071
 
-* Wed Dec 15 2021 Colin Walters <walters@verbum.org> - 2021.6-2
+* Fri Nov 26 2021 Luca BRUNO <lucab@redhat.com> - 2021.6-1
-- Rebase to 2021.6
+- New upstream version
-  Resolves: rhbz#2032593
+  https://github.com/ostreedev/ostree/releases/tag/v2021.6
+  Resolves: rhbz#2026931
 
-* Tue Nov 30 2021 Colin Walters <walters@verbum.org> - 2021.3-2
+* Tue Oct 19 2021 Colin Walters <walters@verbum.org> - 2021.5-3
-- Backport
+- Pointless rebuild to re-trigger gating etc
-  https://github.com/ostreedev/ostree/pull/2453/commits/e6a560b40797324aa8b90e7100c6d50bff91f14d
-  Resolves: rhbz#2027788
 
-* Tue Jul 20 2021 Luca BRUNO <lucab@redhat.com> - 2021.3-1
+* Wed Oct 06 2021 Colin Walters <walters@verbum.org> - 2021.5-2
+- https://github.com/coreos/ostree/releases/tag/v2021.5
+
+* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 2021.3-3
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
+
+* Wed Jul 28 2021 Florian Weimer <fweimer@redhat.com> - 2021.3-2
+- Rebuild to pick up OpenSSL 3.0 Beta ABI (#1984097)
+
+* Fri Jul 16 2021 Luca BRUNO <lucab@redhat.com> - 2021.3-1
 - New upstream version
   https://github.com/ostreedev/ostree/releases/tag/v2021.3
-  Resolves: rhbz#1981865
+  Resolves: rhbz#1981859
+
+* Wed Jun 16 2021 Mohan Boddu <mboddu@redhat.com> - 2021.2-2
+- Rebuilt for RHEL 9 BETA for openssl 3.0
+  Related: rhbz#1971065
 
 * Fri May 14 2021 Luca BRUNO <lucab@redhat.com> - 2021.2-1
 - New upstream version 2021.2
   https://github.com/ostreedev/ostree/releases/tag/v2021.2
 
-* Tue Nov  3 15:04:48 UTC 2020 Colin Walters <walters@verbum.org> - 2020.7-1
+* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 2020.8-3
-- Update to 2020.7
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
-  Resolves: #1894062
 
-* Wed Sep 09 2020 Colin Walters <walters@verbum.org> - 2020.5-4
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2020.8-2
-- Backport patches for https://bugzilla.redhat.com/show_bug.cgi?id=1875567
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 
-* Mon Aug 24 2020 Colin Walters <walters@verbum.org> - 2020.5-3
+* Wed Nov 18 08:42:24 UTC 2020 Luca BRUNO <lucab@lucabruno.net> - 2020.8-1
-- Backport
+- New upstream version
-  https://github.com/ostreedev/ostree/pull/2179/commits/06ed04a816141914adb9bd3e32392801fce5bc8e
+- https://github.com/ostreedev/ostree/releases/tag/v2020.8
-  Resolves: #1867601
+
+* Fri Oct 30 2020 Jeff Law <law@redhat.com> - 2020.7-4
+- Fix volatile issues exposed by gcc-11
+
+* Thu Oct 15 2020 Jonathan Lebon <jonathan@jlebon.com> - 2020.7-3
+- Backport https://github.com/ostreedev/ostree/pull/2219 for
+  https://bugzilla.redhat.com/show_bug.cgi?id=1888436
+
+* Wed Oct 14 2020 Colin Walters <walters@verbum.org> - 2020.7-2
+- https://github.com/ostreedev/ostree/releases/tag/v2020.7
+
+* Wed Oct 07 2020 Jonathan Lebon <jonathan@jlebon.com> - 2020.6-5
+- Backport https://github.com/ostreedev/ostree/pull/2211 for
+  https://bugzilla.redhat.com/show_bug.cgi?id=1886149
+
+* Thu Sep 24 2020 Colin Walters <walters@verbum.org> - 2020.6-4
+- Backport https://github.com/ostreedev/ostree/pull/2202
+
+* Fri Sep 18 2020 Jonathan Lebon <jonathan@jlebon.com> - 2020.6-3
+- Revert support for devicetrees
+  https://github.com/ostreedev/ostree/issues/2154
+  https://bugzilla.redhat.com/show_bug.cgi?id=1880499
+
+* Thu Sep 03 2020 Colin Walters <walters@verbum.org> - 2020.6-2
+- https://github.com/ostreedev/ostree/releases/tag/v2020.6
 
 * Tue Aug 18 2020 Colin Walters <walters@verbum.org> - 2020.5-2
-- Update to https://github.com/ostreedev/ostree/releases/tag/v2020.5
+- https://github.com/ostreedev/ostree/releases/tag/v2020.5
-  Specifically to fix readonly-sysroot for e.g. RHEL Edge and
-  older RHCOS versions
-- Related: #1861507
 
-* Tue Jul 28 2020 Colin Walters <walters@verbum.org> - 2020.4-1
+* Sat Aug 01 2020 Colin Walters <walters@verbum.org> - 2020.4-4
+- Backport patch for https://bugzilla.redhat.com/show_bug.cgi?id=1862568
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2020.4-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Wed Jul 22 2020 Colin Walters <walters@verbum.org> - 2020.4-2
 - https://github.com/ostreedev/ostree/releases/tag/v2020.4
-- We plan to use per-object-fsync for etcd in OpenShift 4
-- Resolves: #1861507
 
-* Thu May 21 2020 Colin Walters <walters@verbum.org> - 2020.3-3
+* Tue Jun 30 2020 Jeff Law <law@redhat.com> - 2020.3-6
-- Backport https://github.com/ostreedev/ostree/pull/2108
+- Disable LTO
 
-* Fri May 15 2020 Colin Walters <walters@verbum.org> - 2020.3-2
+* Thu Jun 18 2020 Jonathan Lebon <jonathan@jlebon.com> - 2020.3-5
+- Backport patch to handle EOPNOTSUPP on NFS:
+  https://gitlab.gnome.org/GNOME/libglnx/-/merge_requests/18
+
+* Thu May 21 2020 Jonathan Lebon <jonathan@jlebon.com> - 2020.3-4
+- Backport patch to neuter sysroot.readonly for FCOS
+  https://github.com/coreos/fedora-coreos-tracker/issues/488
+  https://github.com/ostreedev/ostree/pull/2108
+
+* Fri Apr 17 2020 Dusty Mabe <dusty@dustymabe.com> - 2020.3-3
+- Backport patchset that should help us with concurrently pulling
+  https://github.com/ostreedev/ostree/pull/2077
+
+* Sat Mar 14 2020 Colin Walters <walters@verbum.org> - 2020.3-2
 - https://github.com/ostreedev/ostree/releases/tag/v2020.3
-  Resolves: #1836306
+
+* Fri Feb 21 2020 Colin Walters <walters@verbum.org> - 2020.2-2
+- https://github.com/ostreedev/ostree/releases/tag/v2020.2
+
+* Thu Feb 20 2020 Colin Walters <walters@verbum.org> - 2020.1-2
+- https://github.com/ostreedev/ostree/releases/tag/v2020.1
+
+* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2019.6-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
 
 * Tue Dec 10 2019 Colin Walters <walters@verbum.org> - 2019.6-2
 - https://github.com/ostreedev/ostree/releases/tag/v2019.6
 
-* Wed Oct 30 2019 Colin Walters <walters@verbum.org> - 2019.5-1
+* Wed Oct 30 2019 Colin Walters <walters@verbum.org> - 2019.5-2
 - https://github.com/ostreedev/ostree/releases/tag/v2019.5
 
-* Mon Oct 14 2019 Colin Walters <walters@verbum.org> - 2019.4-3
+* Thu Sep 26 2019 Jonathan Lebon <jonathan@jlebon.com> - 2019.4-2
+- Revert ostree-grub2 patch to fix duplicate entries
+  https://github.com/ostreedev/ostree/pull/1929#issuecomment-539022174
+
+* Thu Sep 26 2019 Jonathan Lebon <jonathan@jlebon.com> - 2019.4-2
+- Backport patch to fix duplicate GRUB2 entries when using BLS
+  https://bugzilla.redhat.com/show_bug.cgi?id=1751272#c27
+
+* Wed Sep 25 2019 Jonathan Lebon <jonathan@jlebon.com> - 2019.4-1
 - https://github.com/ostreedev/ostree/releases/tag/v2019.4
 
+* Thu Aug 22 2019 Colin Walters <walters@verbum.org> - 2019.3-3
+- https://github.com/ostreedev/ostree/releases/tag/v2019.3
+
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2019.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
 * Wed Apr 24 2019 Jonathan Lebon <jonathan@jlebon.com> - 2019.2-1
 - https://github.com/ostreedev/ostree/releases/tag/v2019.2