move state creation to prepare-boot

Signed-off-by: Allison Karlitskaya <[email protected]>

Author: allisonkarlitskaya

examples/bls/build

@@ -51,11 +51,6 @@ podman build \
 BASE_ID="$(sed s/sha256:// tmp/base.iid)"
 ${CFSCTL} oci pull containers-storage:${BASE_ID}
 BASE_IMAGE_FSVERITY="$(${CFSCTL} oci compute-id --bootable "${BASE_ID}")"
-
-mkdir -p "tmp/sysroot/state/${BASE_IMAGE_FSVERITY}/etc/work"
-mkdir -p "tmp/sysroot/state/${BASE_IMAGE_FSVERITY}/etc/upper"
-mkdir -p "tmp/sysroot/state/${BASE_IMAGE_FSVERITY}/var"
-
 ${CFSCTL} oci prepare-boot "${BASE_ID}" --bootdir tmp/efi
 
 OPTIONS="console=ttyS0,115200 composefs=${BASE_IMAGE_FSVERITY} rw"

examples/uki/build

@@ -58,11 +58,6 @@ FINAL_IMAGE_FSVERITY="$(${CFSCTL} oci compute-id --bootable "${FINAL_ID}")"
 
 ## IMPORTANT: the filesystems of the base and final images are identical
 test "${BASE_IMAGE_FSVERITY}" = "${FINAL_IMAGE_FSVERITY}"
-
-mkdir -p "tmp/sysroot/state/${BASE_IMAGE_FSVERITY}/etc/work"
-mkdir -p "tmp/sysroot/state/${BASE_IMAGE_FSVERITY}/etc/upper"
-mkdir -p "tmp/sysroot/state/${BASE_IMAGE_FSVERITY}/var"
-
 ${CFSCTL} oci prepare-boot "${FINAL_ID}" --bootdir tmp/efi
 
 ../common/install-systemd-boot

examples/unified-secureboot/build

@@ -48,12 +48,6 @@ podman build \
 
 IMAGE_ID="$(sed s/sha256:// tmp/iid)"
 ${CFSCTL} oci pull containers-storage:"${IMAGE_ID}"
-IMAGE_FSVERITY="$(${CFSCTL} oci compute-id --bootable "${IMAGE_ID}")"
-
-mkdir -p "tmp/sysroot/state/${IMAGE_FSVERITY}/etc/work"
-mkdir -p "tmp/sysroot/state/${IMAGE_FSVERITY}/etc/upper"
-mkdir -p "tmp/sysroot/state/${IMAGE_FSVERITY}/var"
-
 ${CFSCTL} oci prepare-boot "${IMAGE_ID}" --bootdir tmp/efi
 
 # install a signed copy of systemd-boot

examples/unified/build

@@ -30,12 +30,6 @@ podman build \
 
 IMAGE_ID="$(sed s/sha256:// tmp/iid)"
 ${CFSCTL} oci pull containers-storage:"${IMAGE_ID}"
-IMAGE_FSVERITY="$(${CFSCTL} oci compute-id --bootable "${IMAGE_ID}")"
-
-mkdir -p "tmp/sysroot/state/${IMAGE_FSVERITY}/etc/work"
-mkdir -p "tmp/sysroot/state/${IMAGE_FSVERITY}/etc/upper"
-mkdir -p "tmp/sysroot/state/${IMAGE_FSVERITY}/var"
-
 ${CFSCTL} oci prepare-boot "${IMAGE_ID}" --bootdir tmp/efi
 
 ../common/install-systemd-boot

src/bin/cfsctl.rs

@@ -1,4 +1,8 @@
-use std::{path::PathBuf, sync::Arc};
+use std::{
+    fs::create_dir_all,
+    path::{Path, PathBuf},
+    sync::Arc,
+};
 
 use anyhow::Result;
 use clap::{Parser, Subcommand};
@@ -249,7 +253,19 @@ async fn main() -> Result<()> {
                 ref bootdir,
             } => {
                 let verity = verity_opt(config_verity)?;
-                oci::prepare_boot(&repo, config_name, verity.as_ref(), bootdir)?;
+                let id = oci::prepare_boot(&repo, config_name, verity.as_ref(), bootdir)?;
+
+                let state = args
+                    .repo
+                    .as_ref()
+                    .map(|p: &PathBuf| p.parent().unwrap())
+                    .unwrap_or(Path::new("/sysroot"))
+                    .join("state")
+                    .join(id.to_hex());
+
+                create_dir_all(state.join("var"))?;
+                create_dir_all(state.join("etc/upper"))?;
+                create_dir_all(state.join("etc/work"))?;
             }
         },
         Command::ComputeId {

src/oci/mod.rs

@@ -370,13 +370,13 @@ pub fn prepare_boot<ObjectID: FsVerityHashValue>(
     name: &str,
     verity: Option<&ObjectID>,
     output_dir: &Path,
-) -> Result<()> {
+) -> Result<ObjectID> {
     let (config, refs) = open_config(repo, name, verity)?;
 
     /* TODO: check created image ID against composefs label on container, if set */
     /* TODO: check created image ID against composefs= .cmdline in UKI or loader entry */
     let mut fs = crate::oci::image::create_filesystem(repo, name, verity)?;
-    fs.commit_image(repo, None)?;
+    let id = fs.commit_image(repo, None)?;
 
     /*
     let layer_digest = config
@@ -403,7 +403,9 @@ pub fn prepare_boot<ObjectID: FsVerityHashValue>(
         .root
         .get_directory("composefs-meta/boot".as_ref())?;
 
-    write_to_path(repo, boot, output_dir)
+    write_to_path(repo, boot, output_dir)?;
+
+    Ok(id)
 }
 
 #[cfg(test)]