Add support for multiple composefs= digests

.github/workflows/ci.yml

@@ -265,8 +265,10 @@ jobs:
 
       - name: Setup env
         run: |
-          BASE=$(just pullspec-for-os base ${{ matrix.test_os }})
-          echo "BOOTC_base=${BASE}" >> $GITHUB_ENV
+          BASE="$(just pullspec-for-os base "${{ matrix.test_os }}")"
+          BUILDROOT_BASE="$(just pullspec-for-os buildroot-base "${{ matrix.test_os }}")"
+          printf 'BOOTC_base=%s\n' "$BASE" >> "$GITHUB_ENV"
+          printf 'BOOTC_buildroot_base=%s\n' "$BUILDROOT_BASE" >> "$GITHUB_ENV"
 
       - name: Build packages (and verify build system)
         run: just check-buildsys
@@ -302,6 +304,14 @@ jobs:
         seal_state: ["sealed", "unsealed"]
 
         exclude:
+          # centos-9 composefs: only sealed UKI is supported (V1 EROFS).
+          # BLS and unsealed modes require newer dracut/systemd features.
+          - test_os: centos-9
+            variant: composefs
+            boot_type: bls
+          - test_os: centos-9
+            variant: composefs
+            seal_state: unsealed
           - seal_state: "sealed"
             boot_type: bls
           - seal_state: "sealed"
@@ -352,8 +362,10 @@ jobs:
 
       - name: Setup env
         run: |
-          BASE=$(just pullspec-for-os base ${{ matrix.test_os }})
-          echo "BOOTC_base=${BASE}" >> $GITHUB_ENV
+          BASE="$(just pullspec-for-os base "${{ matrix.test_os }}")"
+          BUILDROOT_BASE="$(just pullspec-for-os buildroot-base "${{ matrix.test_os }}")"
+          printf 'BOOTC_base=%s\n' "$BASE" >> "$GITHUB_ENV"
+          printf 'BOOTC_buildroot_base=%s\n' "$BUILDROOT_BASE" >> "$GITHUB_ENV"
           echo "RUST_BACKTRACE=full" >> $GITHUB_ENV
           echo "RUST_LOG=debug" >> $GITHUB_ENV
 
@@ -451,8 +463,10 @@ jobs:
 
       - name: Setup env
         run: |
-          BASE=$(just pullspec-for-os base ${{ matrix.test_os }})
-          echo "BOOTC_base=${BASE}" >> $GITHUB_ENV
+          BASE="$(just pullspec-for-os base "${{ matrix.test_os }}")"
+          BUILDROOT_BASE="$(just pullspec-for-os buildroot-base "${{ matrix.test_os }}")"
+          printf 'BOOTC_base=%s\n' "$BASE" >> "$GITHUB_ENV"
+          printf 'BOOTC_buildroot_base=%s\n' "$BUILDROOT_BASE" >> "$GITHUB_ENV"
           echo "BOOTC_variant=${{ matrix.variant }}" >> $GITHUB_ENV
           echo "BOOTC_SKIP_PACKAGE=1" >> $GITHUB_ENV
           echo "RUST_BACKTRACE=full" >> $GITHUB_ENV
@@ -513,8 +527,10 @@ jobs:
 
       - name: Setup env
         run: |
-          BASE=$(just pullspec-for-os base ${{ matrix.test_os }})
-          echo "BOOTC_base=${BASE}" >> $GITHUB_ENV
+          BASE="$(just pullspec-for-os base "${{ matrix.test_os }}")"
+          BUILDROOT_BASE="$(just pullspec-for-os buildroot-base "${{ matrix.test_os }}")"
+          printf 'BOOTC_base=%s\n' "$BASE" >> "$GITHUB_ENV"
+          printf 'BOOTC_buildroot_base=%s\n' "$BUILDROOT_BASE" >> "$GITHUB_ENV"
           echo "BOOTC_variant=composefs" >> $GITHUB_ENV
           echo "BOOTC_baseconfigs=${{ matrix.baseconfigs }}" >> $GITHUB_ENV
           echo "RUST_BACKTRACE=full" >> $GITHUB_ENV

Dockerfile

@@ -354,6 +354,7 @@ ARG variant
 ARG filesystem
 ARG seal_state
 ARG boot_type
+ARG erofs_version=auto
 # Install our bootc package (only needed for the compute-composefs-digest command)
 RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
     --mount=type=bind,from=packages,src=/,target=/run/packages \
@@ -381,7 +382,8 @@ if test "${boot_type}" = "uki"; then
       --secrets /run/secrets \
       "${allow_missing_verity[@]}" \
       --kernel-dir "/run/kernel/$kver" \
-      --seal-state $seal_state
+      --seal-state $seal_state \
+      --erofs-version $erofs_version
 fi
 EORUN
 

Justfile

@@ -27,8 +27,8 @@ mod bcvk 'bcvk.just'
 #   sealed  → requires boot_type=uki and filesystem with fsverity (ext4/btrfs)
 #   uki     → requires bootloader=systemd
 
-# Output image name
-base_img := "localhost/bootc"
+# Output image name (override with BOOTC_image to isolate worktree images)
+base_img := env("BOOTC_image", "localhost/bootc")
 # Synthetic upgrade image for testing
 upgrade_img := base_img + "-upgrade"
 # Base image with tmt dependencies added, used as the boot source for upgrade tests
@@ -43,6 +43,8 @@ filesystem := env("BOOTC_filesystem", "ext4")
 boot_type := env("BOOTC_boot_type", "bls")
 # Only used for composefs tests
 seal_state := env("BOOTC_seal_state", "unsealed")
+# Only used for composefs UKI tests: "v1" or "v2"
+erofs_version := env("BOOTC_erofs_version", "v1")
 # Baseconfigs to inject into the image for testing (e.g. "etc-transient" or "root-transient")
 baseconfigs := env("BOOTC_baseconfigs", "")
 # Base container image to build from
@@ -75,6 +77,7 @@ base_buildargs := generic_buildargs + " " + _extra_src_args \
                   + " --build-arg=boot_type=" + boot_type \
                   + " --build-arg=seal_state=" + seal_state \
                   + " --build-arg=filesystem=" + filesystem \
+                  + " --build-arg=erofs_version=" + erofs_version \
                   + " --build-arg=baseconfigs=" + baseconfigs
 buildargs := base_buildargs \
              + " --cap-add=all --security-opt=label=type:container_runtime_t --device /dev/fuse" \
@@ -250,6 +253,7 @@ test-upgrade *ARGS: build _build-upgrade-source-image
             --karg=enforcing=0)
     fi
     cargo xtask run-tmt --env=BOOTC_variant={{variant}} \
+        --env=BOOTC_erofs_version={{erofs_version}} \
         --env=BOOTC_test_upgrade_image={{base_img}} \
         --upgrade-image={{base_img}} \
         "${composefs_args[@]}" \
@@ -290,7 +294,7 @@ test-container-export: build
 # Run tmt tests without rebuilding (for fast iteration)
 [group('testing')]
 test-tmt-nobuild *ARGS:
-    cargo xtask run-tmt --env=BOOTC_variant={{variant}} {{_baseconfigs_env}} --upgrade-image={{upgrade_img}} {{base_img}} {{ARGS}}
+    cargo xtask run-tmt --env=BOOTC_variant={{variant}} --env=BOOTC_erofs_version={{erofs_version}} {{_baseconfigs_env}} --upgrade-image={{upgrade_img}} {{base_img}} {{ARGS}}
 
 # Run readonly tests with a baseconfig baked into the image at build time.
 # Requires composefs variant. Example: just variant=composefs test-tmt-baseconfig root-transient
@@ -300,6 +304,7 @@ test-tmt-baseconfig baseconfig *ARGS:
     just variant=composefs baseconfigs={{baseconfig}} _build-upgrade-image
     cargo xtask run-tmt \
         --env=BOOTC_variant=composefs \
+        --env=BOOTC_erofs_version={{erofs_version}} \
         --env=BOOTC_baseconfigs={{baseconfig}} \
         --upgrade-image={{upgrade_img}} \
         --composefs-backend \
@@ -508,6 +513,8 @@ _build-upgrade-image:
         --build-arg "boot_type={{boot_type}}" \
         --build-arg "seal_state={{seal_state}}" \
         --build-arg "filesystem={{filesystem}}" \
+        --build-arg "base={{base_img}}" \
+        --build-arg "erofs_version={{erofs_version}}" \
         --secret=id=secureboot_key,src=target/test-secureboot/db.key \
         --secret=id=secureboot_cert,src=target/test-secureboot/db.crt \
         "${extra_args[@]}" \

contrib/packaging/install-buildroot

@@ -15,8 +15,17 @@ if test -x /usr/bin/dnf5; then
 else
   dnf -y install 'dnf-command(builddep)'
 fi
-# Handle version skew, xref https://gitlab.com/redhat/centos-stream/containers/bootc/-/issues/1174
-dnf -y distro-sync ostree{,-libs} systemd
+# Handle version skew in packages already installed in the base image,
+# xref https://gitlab.com/redhat/centos-stream/containers/bootc/-/issues/1174
+sync_packages=()
+for package in ostree{,-libs} systemd; do
+  if rpm -q --quiet "$package"; then
+    sync_packages+=("$package")
+  fi
+done
+if test "${#sync_packages[@]}" -gt 0; then
+  dnf -y distro-sync "${sync_packages[@]}"
+fi
 # Install base build requirements
 dnf -y builddep bootc.spec
 # And extra packages

contrib/packaging/seal-uki

@@ -4,6 +4,7 @@ set -xeuo pipefail
 
 missing_verity=()
 dumpfile_args=()
+erofs_version=auto
 
 while [ ! -z "${1:-}" ]; do
     case "$1" in
@@ -45,6 +46,12 @@ while [ ! -z "${1:-}" ]; do
             shift
         ;;
 
+        "--erofs-version")
+            erofs_version="$2"
+            shift
+            shift
+        ;;
+
         # Path to the directory containing kernel and initramfs
         "--kernel-dir")
             kernel_dir="$2"
@@ -89,6 +96,9 @@ fi
 
 # Baseline container ukify options
 containerukifyargs=(--rootfs "${target}")
+if [[ $erofs_version != "auto" ]]; then
+    containerukifyargs+=(--erofs-version="${erofs_version}")
+fi
 
 # Build the UKI using bootc container ukify
 # This computes the composefs digest, reads kargs from kargs.d, and invokes ukify

crates/initramfs/bootc-root-setup.service

@@ -2,7 +2,8 @@
 Description=bootc setup root
 Documentation=man:bootc(1)
 DefaultDependencies=no
-ConditionKernelCommandLine=composefs
+ConditionKernelCommandLine=|composefs
+ConditionKernelCommandLine=|composefs.digest
 ConditionPathExists=/etc/initrd-release
 After=sysroot.mount
 After=ostree-prepare-root.service

crates/initramfs/dracut/module-setup.sh

@@ -26,4 +26,6 @@ install() {
     # dracut --force in a Containerfile RUN layer).
     [[ -e /usr/lib/composefs/setup-root-conf.toml ]] && \
         inst_simple /usr/lib/composefs/setup-root-conf.toml
+
+    return 0
 }