Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

checkout: Only verify digest if repo requires fsverity #3331

Merged
merged 2 commits into from
Nov 4, 2024
Merged

checkout: Only verify digest if repo requires fsverity #3331

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6ed1f83
checkout: Only verify digest if repo requires fsverity
cgwalters Oct 30, 2024
9e0d778
bootupd-static: Drop this test
cgwalters Nov 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions src/libostree/ostree-repo-checkout.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1346,9 +1346,14 @@ ostree_repo_checkout_composefs (OstreeRepo *self, GVariant *options, int destina
if (!ostree_composefs_target_write (target, tmpf.fd, &fsverity_digest, cancellable, error))
return FALSE;

/* If the commit specified a composefs digest, verify it */
if (!compare_verity_digests (metadata_composefs, fsverity_digest, error))
return FALSE;
/* If the commit specified a composefs digest and the target is known to have fsverity,
* then double check our ouptut.
*/
if (verity == OT_TRISTATE_YES)
{
if (!compare_verity_digests (metadata_composefs, fsverity_digest, error))
return FALSE;
}

if (!glnx_fchmod (tmpf.fd, 0644, error))
return FALSE;
Expand Down
2 changes: 1 addition & 1 deletion tests/inst/src/composefs.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,7 +153,7 @@ pub(crate) fn itest_composefs() -> Result<()> {
return Ok(());
}
{
let fstype = cmd!(sh, "stat -f / -c %T").read()?;
let fstype = cmd!(sh, "stat -f /sysroot -c %T").read()?;
if fstype.trim() == "xfs" {
println!("SKIP no xfs fsverity yet");
return Ok(());
Expand Down
36 changes: 0 additions & 36 deletions tests/kolainst/destructive/bootupd-static.sh
View file
Open in desktop

This file was deleted.

10 changes: 10 additions & 0 deletions tests/test-composefs.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,4 +62,14 @@ composefs-info dump test2-co-noverity.cfs > dump.txt
assert_file_has_content_literal dump.txt '/baz/cow 4 100644 1 0 0 0 0.0 f6/a517d53831a40cff3886a965c70d57aa50797a8e5ea965b2c49cc575a6ff51.file - -'
tap_ok "checkout composefs noverity"

# Test with a corrupted composefs digest
$OSTREE commit ${COMMIT_ARGS} -b test-composefs-bad-digest --tree=ref=test-composefs \
'--add-metadata=ostree.composefs.digest.v0=[byte 0x13, 0xae, 0xae, 0xed, 0xc0, 0x34, 0xd1, 0x39, 0xef, 0xfc, 0xd6, 0x6f, 0xe3, 0xdb, 0x08, 0xd3, 0x32, 0x8a, 0xec, 0x2f, 0x02, 0xc5
, 0xa7, 0x8a, 0xee, 0xa6, 0x0f, 0x34, 0x6d, 0x7a, 0x22, 0x6d]'
if $OSTREE checkout --composefs test-composefs-bad-digest test2-co.cfs 2>err.txt; then
fatal "checked out composefs with mismatched digest"
fi
assert_file_has_content_literal err.txt "doesn't match expected digest"
tap_ok "checkout composefs bad digest"

tap_end
Loading