cfsctl: Fix keyring command and seal for repo-less/config-less usage

Route keyring commands through run_app() before opening a repository,
fixing 'cfsctl keyring add-cert' which doesn't need a repo but was
failing with 'Cannot open composefs repository at /sysroot/composefs'.

Consolidate CLI dispatch: main.rs delegates to cfsctl::run_from_args()
instead of duplicating the dispatch logic.

Fix 'oci seal' to handle OCI images whose ImageConfiguration has
config: None (allowed by the OCI spec) by using unwrap_or_default().

Assisted-by: OpenCode (Claude claude-opus-4-6)

Author: cgwalters

crates/cfsctl/src/lib.rs

@@ -355,6 +355,11 @@ fn run_keyring_cmd(cmd: &KeyringCommand) -> Result<()> {
     Ok(())
 }
 
+/// Run the CLI using `std::env::args()`, as if invoked from the command line.
+pub async fn run_from_args() -> Result<()> {
+    run_app(App::parse()).await
+}
+
 /// Acts as a proxy for the `cfsctl` CLI by executing the CLI logic programmatically
 ///
 /// This function behaves the same as invoking the `cfsctl` binary from the
@@ -368,7 +373,10 @@ where
     let args = App::parse_from(
         std::iter::once(OsString::from("cfsctl")).chain(args.into_iter().map(Into::into)),
     );
+    run_app(args).await
+}
 
+async fn run_app(args: App) -> Result<()> {
     // Handle commands that don't need a repository first
     if let Command::Keyring { ref cmd } = args.cmd {
         return run_keyring_cmd(cmd);
@@ -1125,8 +1133,8 @@ where
                 );
             }
         }
-        Command::Keyring { ref cmd } => {
-            run_keyring_cmd(cmd)?;
+        Command::Keyring { .. } => {
+            unreachable!("keyring commands are handled before opening a repository")
         }
         #[cfg(feature = "http")]
         Command::Fetch { url, name } => {

crates/cfsctl/src/main.rs

@@ -4,20 +4,10 @@
 //! creating and mounting filesystem images, handling OCI containers, and performing
 //! repository maintenance operations like garbage collection.
 
-use cfsctl::{open_repo, run_cmd_with_repo, App, HashType};
-
 use anyhow::Result;
-use clap::Parser;
-use composefs::fsverity::{Sha256HashValue, Sha512HashValue};
 
 #[tokio::main]
 async fn main() -> Result<()> {
     env_logger::init();
-
-    let args = App::parse();
-
-    match args.hash {
-        HashType::Sha256 => run_cmd_with_repo(open_repo::<Sha256HashValue>(&args)?, args).await,
-        HashType::Sha512 => run_cmd_with_repo(open_repo::<Sha512HashValue>(&args)?, args).await,
-    }
+    cfsctl::run_from_args().await
 }

crates/composefs-oci/src/lib.rs

@@ -21,7 +21,7 @@ pub mod tar;
 
 use std::{collections::HashMap, io::Read, sync::Arc};
 
-use anyhow::{bail, ensure, Context, Result};
+use anyhow::{bail, ensure, Result};
 use containers_image_proxy::ImageProxyConfig;
 use oci_spec::image::ImageConfiguration;
 use sha2::{Digest, Sha256};
@@ -248,7 +248,7 @@ pub fn seal<ObjectID: FsVerityHashValue>(
     config_verity: Option<&ObjectID>,
 ) -> Result<ContentAndVerity<ObjectID>> {
     let (mut config, refs) = open_config(repo, config_name, config_verity)?;
-    let mut myconfig = config.config().clone().context("no config!")?;
+    let mut myconfig = config.config().clone().unwrap_or_default();
     let labels = myconfig.labels_mut().get_or_insert_with(HashMap::new);
     let fs = crate::image::create_filesystem(repo, config_name, config_verity)?;
     let id = fs.compute_image_id();