The stale trust store after an update is a property of the ostree /etc
merge, not of the standard content set. minimal already ships
ca-certificates (a hard dependency of openssl-libs), update-ca-trust and
systemd-update-done.service, so it has the same problem and everything
the unit needs. Moving the unit to minimal makes minimal-plus, standard,
ELN and IoT inherit it, and gives the image-based variants built on
minimal-plus (CoreOS, Atomic Desktops) a path to a shared fix.
The unit is unchanged. Its conditions already skip containers, images
without update-ca-trust, boots where /etc is current, and images that
carry coreos-update-ca-trust.service.
The rootfs check now runs in every tier instead of only in standard.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vcy8XfBfUtxbEWMu62CiF6
Use ConditionNeedsUpdate=/etc so the service only runs when /etc may be
stale relative to /usr: on first boot and on the first boot after a new
deployment, where ostree removes /etc/.updated. Local edits to the trust
sources still require running update-ca-trust by hand, as on any other
system. Order the unit before systemd-update-done.service, as required
for units using that condition.
Skip the unit when coreos-update-ca-trust.service is present. Fedora
CoreOS ships that unit for first boot, and update-ca-trust does not lock
its output, so both running concurrently is unsafe. The condition can be
dropped once CoreOS rebases on this image.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vcy8XfBfUtxbEWMu62CiF6
Rename the service to atomic-update-ca-trust, remove the legacy extract argument, and defer crypto-policy regeneration. Document early-boot and initramfs limitations and keep regeneration failures visible without preventing boot.
Add standard-image regression coverage for stale bundles, vendor CA changes, local trust and distrust, repeated refreshes, and service activation.
The way it was done before with a symlink in
/usr/lib/systemd/system/default.target.wants/bootc-fetch-apply-updates.timer
meant that users (or derivative builds) can't easily disable
this service without masking it.
The docs at [1] would work for the current boot because of the
`--now` but the next boot the timer would be running again.
[1] e7d868de85/modules/ROOT/pages/manual-rollbacks.adoc
The repo locations moved in F45+ [1] and so now when
testing F44 in CI we end up with a failure like:
```
[2/3] STEP 2/2: RUN --mount=type=bind,from=repos,src=/,dst=/repos,rw <<EORUN (echo -e '--install\nltrace' > args.txt...)
rpm-ostree version: 2026.2
error: Installing packages: No enabled repositories
error: Executing compose install: ExitStatus(unix_wait_status(256))
Error executing command: Command '['rpm-ostree', 'compose', 'rootfs', '--source-root-rw=/repos', '/tmp/tmpmnq4sg6s.json', '/target-rootfs']' returned non-zero exit status 1.
subprocess exited with status 1
```
Let's drop using the rawhide image just for `repos` and use the
repos baked into the image we built instead (which should match
the target Fedora version we're testing).
[1] https://fedoraproject.org/wiki/Changes/RelocateRpmRepoConfigsToUsr
See https://github.com/konflux-ci/build-tasks-dockerfiles/pull/243
Unfortunately...some 3rd party container scanners just hard require these JSON files
to exist at the target path. It's going to be a painful long road to get them fixed
to rely on something else.
Add `tmpfiles.d` entries to silence `bootc container lint` for this. It will have
the effect of course of creating these files if they don't exist on boot, so in
the future we'll probably aim to add an "ignore" entry for this into the bootc container
lint.
Also adds a rootfs test case verifying the tmpfiles config is present in built images.
Assisted-by: OpenCode (Claude Sonnet 4.6)
Signed-off-by: Colin Walters <walters@verbum.org>
jq is not available in the minimal tier. Use grep instead to verify
that the bootupd EFI has both grub2 and shim components installed.
Assisted-by: OpenCode (Claude Opus 4.6)
Per https://issues.redhat.com/browse/RHEL-115278
Longer term of course we want to hard require systemd-sysusers
for this one instead.
Signed-off-by: Colin Walters <walters@verbum.org>
The current custom base image flow of rebuilding a "built-in" image with
custom repos and then adding your own content separate is reasonable,
but it would be nice if one could augment the list of packages to
install in that initial build rather than as a separate transaction.
Then, you don't have to cleanup after dnf and `/var` content, re-inject
repo definitions, and refetch repo metadata. It also allows building
container images with additional packages without `dnf` necessarily
being in the package set.
We don't want to leak rpm-ostree implementation details, nor do we want
to invent a new format. So just add support for a `--install` arg and a
generic `--args-file` to pass arguments via a file.
We then generate a new treefile on the fly to extend the `packages`
list.
I'm sure there is a reason for why it is the way it is, which I will
learn about, but the way it is currently set up makes it hard to run
commands in the target system (like `rpm -q`) without doing a chroot
and doing a chroot requires some setup to happen.
I guess the nice thing about the way it is prior is we get to the look
at the filesystem untouched by the container runtime; which can
definitely be useful for tests.
This works around two issues:
- First, rpm switched to reading users/groups directly for
its implementation of systemd-sysusers, which meant
it no longer reads via nss, which breaks nss-altfiles.
xref: https://github.com/rpm-software-management/rpm/pull/2503#issuecomment-1536435351
and below.
- Second, even if that was fixed, `keylime` wants to add
its user to the group, which can't be done when it's a system
uid.
Since nothing in the OS content is owned by this group, we can
move underneath `/etc` by default.
Signed-off-by: Colin Walters <walters@verbum.org>
I just saw the sqlite-shm corruption in
https://gitlab.com/redhat/centos-stream/containers/bootc/-/merge_requests/437#note_2372766792
so let's just go ahead and turn on rpmdb_normalize which
also aids the reproducibility of the rpmdb.
While we're here let's also add a long overdue "unit test" for
the rootfs. This operates as a container build that mounts
the container-under-test as part of a multi-stage build.
Signed-off-by: Colin Walters <walters@verbum.org>
As part of all of this we're de-emphasizing "tier-x" and focusing
on making it ergonomic to either build up from minimal, or down+up
from standard.
Second, also add a CI test for our derived image.
Signed-off-by: Colin Walters <walters@verbum.org>
- Embed the manifests into the container image
- Add bootc-base-imagectl which is a tightly controlled frontend
to execute on those manifests.
For now, we don't attempt to rework how we build the standard
image to actually look like `dnf install`, but we show that
it can work.
Signed-off-by: Colin Walters <walters@verbum.org>
