WIP: Rough draft for updated generic OCI sealing

.github/workflows/build-cfsctl-artifact.yml

@@ -0,0 +1,51 @@
+name: Build cfsctl OCI artifact
+
+on:
+  push:
+    branches: ['**']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Build cfsctl (release)
+        run: cargo build --release -p composefs-ctl --features composefs/rhel9,composefs-oci/oci-client
+
+      - name: Install oras CLI
+        run: |
+          curl -sLO https://github.com/oras-project/oras/releases/download/v1.3.1/oras_1.3.1_linux_amd64.tar.gz
+          tar xzf oras_1.3.1_linux_amd64.tar.gz -C /usr/local/bin oras
+          oras version
+
+      - name: Login to GHCR
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | oras login ghcr.io -u ${{ github.actor }} --password-stdin
+
+      - name: Push OCI artifact
+        working-directory: target/release
+        run: |
+          set -eux
+          oras push ghcr.io/${GITHUB_REPOSITORY}/cfsctl:${GITHUB_REF_NAME} \
+            --artifact-type application/vnd.composefs.cfsctl.v1 \
+            cfsctl:application/octet-stream
+          SHA_SHORT=$(echo "${GITHUB_SHA}" | head -c 12)
+          oras push "ghcr.io/${GITHUB_REPOSITORY}/cfsctl:${SHA_SHORT}" \
+            --artifact-type application/vnd.composefs.cfsctl.v1 \
+            cfsctl:application/octet-stream

Justfile

@@ -47,9 +47,13 @@ test-all: test test-integration
 check: clippy check-feature-combos fmt-check test check-fuzz
 
 # Base image for test container builds.
+# Defaults to centos-bootc:stream10: ghcr.io/bootcrew/debian-bootc:latest currently
+# fails to bootstrap (a circular dependency in Debian sid's systemd/mount/libselinux1
+# packaging surfaces when apt installs onto the empty dpkg database that debian-bootc
+# ships with by design; this is an upstream packaging issue, not ours).
 # Override to test on a different distro, e.g.:
-#   just base_image=quay.io/centos-bootc/centos-bootc:stream10 test-integration-vm
-base_image := env("COMPOSEFS_BASE_IMAGE", "ghcr.io/bootcrew/debian-bootc:latest")
+#   just base_image=ghcr.io/bootcrew/debian-bootc:latest cfsctl_features='' test-integration-vm
+base_image := env("COMPOSEFS_BASE_IMAGE", "quay.io/centos-bootc/centos-bootc:stream10")
 
 # cfsctl feature flags for the container build.  Defaults match the base_image:
 #   debian (>= 6.15 kernel): no compat features needed

contrib/packaging/install-test-deps.sh

@@ -15,7 +15,7 @@ case "${ID}" in
         ;;
     debian|ubuntu)
         pkg_install \
-            openssl e2fsprogs bubblewrap openssh-server \
+            openssl e2fsprogs bubblewrap openssh-server fsverity \
             ostree podman skopeo
 
         # OSTree symlink targets — /root, /home, /srv, etc. are symlinks

crates/composefs-ctl/Cargo.toml

@@ -33,8 +33,9 @@ fn-error-context = "0.2"
 clap = { version = "4.5.0", default-features = false, features = ["std", "help", "usage", "derive", "wrap_help"] }
 clap_complete = { version = "4.5.0", default-features = false, features = ["unstable-dynamic"] }
 comfy-table = { version = "7.1", default-features = false }
-composefs = { workspace = true, features = ["varlink"] }
+composefs = { workspace = true, features = ["varlink", "keyring"] }
 composefs-boot = { workspace = true }
+composefs-ioctls = { workspace = true, features = ["keyring"] }
 composefs-oci = { workspace = true, optional = true, features = ["boot"] }
 composefs-splitdirfdstream = { path = "../composefs-splitdirfdstream", version = "0.7.0", optional = true }
 composefs-http = { workspace = true, optional = true }