Skip to content

Releases: coreos/rpm-ostree

v2023.3

24 Apr 18:04
07f029e

Choose a tag to compare

Notable changes this release:

Client

  • New --enablerepo, --disablerepo, --setreleasever options on the cli. These allow
    users to enable specific repositories and set releasever when installing packages.

Daemon:

  • Unconditionally authorize uid 0 first - unconditionally query the credentials via dbus-{daemon,broker} first, this should avoid errors that can occur if polkit isn't installed or running.
Colin Walters (13):
      main: Don't use timestamps and colors in tracing logs when running in systemd
      cached-sigs: Be compatible with `cosa build-fast`
      libtest: Hack around regression in journalctl
      tests/layering-fedorainfra: Bump to newer systemd
      core: Don't try to load rpm IMA sigs client side unless requested
      main: Don't write colors to non-ttys
      Bump tokio to 1.26
      daemon: Unconditionally authorize uid 0 first
      progress: Add more logging/tracing
      console: Also print which task is being overwritten
      build: Allow GLib 2.70, also `-Wno-error=deprecated-declarations`
      Cargo.lock: Bump many dependencies
      deny: Allow Unicode-DFS-2016

Jan Macku (2):
      ci: trigger `differential-shellcheck` workflow on `push`
      ci(fix): add missing permissions - `security-events`

Joseph Marrero (8):
      rust/src/scripts: ignore rt and automotive debug scripts.
      tests/vmcheck/test-override-kernel: account for kernel-modules-core
      treefile: Add enablerepo/disablerepo/setreleasever cli options
      treefile: cleanup enable_repo function
      test-container: Add test for enablerepo,disablerepo and releasever
      ci: Make sure cxx code is clang-formatted
      ci: Update tests for Fedora 38
      Release 2023.3

Timothée Ravier (1):
      docs: Use upstream theme & update to 0.4.1

Full Changelog: v2023.2...v2023.3

v2023.2

06 Mar 20:42

Choose a tag to compare

Notable changes this release:

Client

  • New --compare-with-build option on the cli Uses the ostree container library to compare OCI compliant images.

Compose

  • New --copy-retry-times option to specify the amount of times we retry when copying images fails.

Daemon:

  • Support LockLayering=true configuration option that provides an easy way for a sysadmin to disable all package layering and initramfs customizations.
  • Use a socket in /run, require non-abstract. The new glib changed to use non-abstract sockets by default, which broke us.
Colin Walters (11):
      Update ostree-ext, use version API
      compose/image: Add `--copy-retry-times`
      core: Add some more debugging and error info around repos
      treefile: Return `.` instead of `""` for parent directory
      ci: Stop using Fedora 32
      main: Drop deprecated `container-encapsulate` entrypoint
      Drop `ex-container` entrypoint
      daemon: Use a socket in `/run`, require non-abstract
      ci: Use `cosa kola` to properly set `ARTIFACT_DIR`
      spec: Add `Requires: /usr/bin/setpriv`
      Bump ostree-ext

Jonathan Lebon (1):
      Support `LockLayering=true` config knob

Joseph Marrero (1):
      rust/src/scripts.rs: ignore posttrans for kernel-rt-core

RishabhSaini (1):
      Add --compare-with-build to cli Uses the ostree container library to comapre OCI compliant images

Thorsten Leemhuis (1):
      docs: adjust to new location of kernel-vanilla-repos

Full Changelog: v2023.1...v2023.2

v2023.1

16 Jan 20:55
v2023.1

Choose a tag to compare

Client

  • Log when a client joins an existing transaction.
  • Fix local initramfs regeneration on systems composed with
    boot-location: new.
  • Fix container flow in Turkish locales ( #4237 )

Compose

  • Loosen lockfile semantics so that a missing locked package does not trigger
    an error unless the compose requires it.
  • Drop support for locking by source packages.

Internals

  • Update workflow actions to Fedora 37.
  • Replace unmaintained actions-rs/toolchain with dtolnay/rust-toolchain.
  • Add more error-prefixing in passwd, kernel, and cleanup-related paths.
  • Add container-based upgrade test via Prow.
Benjamin Gilbert (2):
      workflows: update actions to current major versions
      workflows: replace actions-rs/toolchain with dtolnay/rust-toolchain

Colin Walters (8):
      ci: Add infrastructure for use with Prow upgrade testing
      passwd: Add various error prefixing
      sysroot: Log when client joins an existing transaction
      Update to ostree-ext 0.10.4
      tests/upgrades: Disable zincati
      Add a `try_fail_point!` macro and use it in more places
      kernel: Add some error prefixing
      cleanup: Add some error prefixing

Jonathan Lebon (11):
      core: Disable modules earlier
      core: Allow lockfiles to reference missing package names
      libpriv/kernel: fix kver parsing from vmlinuz in /boot and /usr/lib/ostree-boot
      .gitignore: add clangd-related files
      compose: Drop support for `source-packages` in lockfiles
      core: Further loosen lockfile handling
      Revert ".gitignore: add clangd-related files"
      Release 2023.1

2022.19

20 Dec 00:48
bbefa75

Choose a tag to compare

What's Changed

Full Changelog: v2022.18...v2022.19

2022.18

13 Dec 23:07

Choose a tag to compare

What's Changed

New Contributors

Full Changelog: v2022.17...v2022.18

2022.17

12 Dec 20:48

Choose a tag to compare

This pulls in several notable fixes for the container flow
around image garbage collection.

Aside from that there's some cleanup to the initramfs
and initramfs-etc commands, a few documentation tweaks
and internal improvements.

Alessandro Di Stefano (1):
      Fix the treefiles reference link in ex-rebuild.md

Colin Walters (19):
      container-encapsulate: Format errors correctly
      composepost: Port symlink generation to cap-std
      composepost: Port rpmdb hardlinking to cap-std
      composepost: Handle existing absolute symlinks
      cxxrsutil: Drop use of `&mut` in `gobj_wrap()`
      Prune container image layers during cleanup too
      Update to ostree-ext 0.10, glib 0.16, cap-std 1.0
      sysroot: Centralize layer prune + logging
      lockfile: Port to non-deprecated chrono APIs
      upgrader: Can't currently check-only in container flow
      upgrade: Make image pruning idempotent
      override: Honor `--install` in container case too
      docs: Document registry auth
      composepost: Port selinux timestamp tweaks to cap-std
      README.md: More clearly link to container bits
      Use default `all` rule for bindings
      daemon: Make failure to query base image non-fatal
      Update to ostree-ext 0.10.1
      Release 2022.17

Jonathan Lebon (7):
      packaging/spec: Upstream "Disable LTO on 32 bits"
      packaging/spec: Drop el8-specific block
      docs: Make clearer that `initramfs --enable` involves dracut
      man: drop `ex` prefix on initramfs-etc command
      man: move `initramfs-etc` to right after `initramfs`
      man: mention `initramfs-etc` in `initramfs` docs
      app: Make `initramfs-etc` help string more explicit

Joseph Marrero (1):
      cliwrap/kernel_install: use original systemctl when running dracut

Luca BRUNO (1):
      importer: fix translation of top directories

dependabot[bot] (11):
      build(deps): bump futures from 0.3.24 to 0.3.25
      build(deps): bump cxx from 1.0.79 to 1.0.82
      build(deps): bump libc from 0.2.135 to 0.2.137
      build(deps): bump serde_json from 1.0.87 to 1.0.89
      build(deps): bump rayon from 1.5.3 to 1.6.0
      build(deps): bump serde from 1.0.147 to 1.0.148
      build(deps): bump chrono from 0.4.22 to 0.4.23
      build(deps): bump cxx-build from 1.0.81 to 1.0.83
      build(deps): bump indicatif from 0.17.1 to 0.17.2
      build(deps): bump rustix from 0.36.4 to 0.36.5
      build(deps): bump openssl from 0.10.42 to 0.10.44

-----BEGIN SSH SIGNATURE-----
U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAg5CRAd4pqfdf6DWMgvDhrcq1x8Q
gQPSQHIoZaiiRTt68AAAADZ2l0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5
AAAAQD49w7kXNafZSiQJIcmKNYfvPfme48c/GqcA+unajguEpGUYcmOw41r+G+a5CcsNB8
n6kzgDJKcHL6uL5C9GJgE=
-----END SSH SIGNATURE-----

v2022.16

18 Nov 17:44
v2022.16
a25ded6

Choose a tag to compare

Client

  • Rebasing to a container refspec has now been declared stable and no longer
    requires the --experimental flag.
  • Include version in rpm-ostree status output even when deployed from a
    container.
  • Improve container-related documentation.
  • Prune previous container payloads during rebase.

Compose

  • Support a new repovars experimental treefile key. This key feeds into the
    librepo URL variable substitution logic. This is useful for the case where the
    same repo files are used by multiple streams and e.g. the baseurl needs to
    be templated by more than just releasever and basearch.
  • Support rpm-ostree compose image --label to directly add labels to the OCI
    image.
  • Workaround a recent semanage bug causing the SELinux policy to be recompiled
    on client systems even when unneeded. If you've been using Fedora 37 before
    GA, your system may be unnecessarily carrying a customized SELinux policy.
    This is harmless (base policy updates still take effect) but less efficient.
    You can get back to the original policy by following
    these steps.
  • Make container: true imply more appropriate defaults like selinux: false
    and tmp-is-dir: true.

Internals

  • Update CI to Fedora 37.
  • Fix some new compiler warnings.
  • Port more Rust code from openat to cap-std
  • Improve error-reporting in importer path.
  • Stop using deprecated interrupt safety librpm API on rpm 4.18 and newer.
  • Fix a memory leak in the core.
Colin Walters (27):
      tests/override-kernel: Adapt for Linux kernels newer than 5
      ci: Fix references to old FCOS location
      util: Fix `-fpermissive` warning
      Add version to status even for containers
      treefile: Make `container: true` opt-in to saner defaults
      build-sys: Don't delete systemd units in `make clean`
      Update to ostree-ext 0.9
      docs/container: Flesh out a bit more and tweak
      Stabilize container functionality
      docs/container: Explain you can upgrade too
      Always use merge commit for container deployments
      compose/image: Add `--label`
      Update to ostree-ext v0.9.1
      daemon: Query container image commit
      When rebasing, prune previous container by default
      composepost: Port a few bits to cap-std
      composepost: Port default target bits to cap-std
      composepost: Port remove files handling to cap-std
      composepost: Port script function to cap-std
      composepost: Port rpmdb symlinking to cap-std
      composepost: Port os-release handling to cap-std
      composepost: Port outer wrapper function to cap-std
      composepost: Port one test to cap-std
      composepost: Port directory size computation to cap-std
      composepost: Port altfiles mutation to cap-std
      build: Compile with rpm 4.18
      packaging/spec: Add a dummy changelog

Jonathan Lebon (11):
      libpriv/postprocess: work around semanage bug
      ci: Update for Fedora 37
      ci: Run "Build Integration Test Data" GHA privileged
      core: Plug leak in vars dir handling
      rust/extensions: Copy `directory` field to generated treefile
      app/compose: Factor out helper to set repos dir
      app/compose: Clear out vars dir
      treefile: Support `repovars` key
      Release 2022.16

Luca BRUNO (1):
      libpriv/importer: bubble up filepath errors

v2022.15

01 Nov 19:23

Choose a tag to compare

The biggest feature here is that in the new container-native
flow, installing packages that invoke useradd will by
default generate systemd-sysusers fragments. This means
that e.g. RUN rpm-ostree install libvirt in a Dockerfile
will still end up with the qemu user client side.

There's also a notable bugfix for unauthenticated container
fetches.

Also on the client side, there are new DBus APIs for
fetching package metadata, which will be used by
e.g. gnome-software.

Git-EVTag-v0-SHA512: 0bcda4f74d0cf9caef533d1d14a4742c347bf46b48c3a57b63ed74a1a1b3ee31d2eb70a9a5d988387f9f2a817ed165cf3096783a25cfeac2c3e6f524e747fdc2

v2022.14

13 Oct 16:54
dab0425

Choose a tag to compare

Release 2022.14

Client

  • rpm-ostree apply-live now prints out systemd units that changed

Container

  • It's no longer necessary to rpm-ostree cliwrap --enable in a Dockerfile when overriding the kernel.
  • The initramfs generated in containers now includes device files.
  • A change to encapsulate at format version 1 by default was made. This moves towards deprecating version 0 in future releases.
  • Related to this, the client now explicitly warns loudly if it encounters a format v0 image.

Compose

  • The metadata field now correctly functions with inheritance.
  • Container whiteouts found at build time are now converted to be generated at ostree deployment time
  • new configuration options to enable individual cliwraps.

Internals

  • rpm-ostree remove can now be used inside a container as well as using it via dnf/yum compatibility layer i.e. dnf remove.
Akihiko Odaki (1):
      core: Get the kernel version from the kernel path

Colin Walters (41):
      container: Add progress spinners to `compose container-encapsulate`
      build: Ignore changes to `metadata`
      core: Initialize unprivileged member variable
      core: Add an API to deinitialize libdnf
      core: Also only set bootable metadata if `!container`
      Add `compose image`
      cliwrap/rpm: Don't drop privileges in a container image
      cliwrap/yumdnf: Add `dnf image apply-live`
      pkg: Make `rpm-ostree remove` functional in a container
      cliwrap/yumdnf: Implement `remove`
      client: Fix some unused variable warnings
      build-sys: Disable LTO by default
      compose: stop passing JSON treefile to function computing checksum
      compose: Add `cliwrap-binaries`
      ci: Tweaks for stopping infra container
      compose-image: Add `--layer-repo` option
      core: Make checksum API support caller picking the algorithm
      Deduplicate code to compute state digest
      tests/container-image: Add another fast compression, bump timeout
      treefile: Merge metadata field
      tests: Use `--offline` for second build
      rust: Update to ostree-rs-ext 0.8.5
      compose-image: Support `--lockfile`
      compose-image: Print diff of layers
      rust: Update to ostree-ext 0.8.6
      docs: Describe `compose image`
      container: Ensure unprivileged fetch can read `/run/ostree/auth.json`
      docs/experimental: Describe `ex rebuild`
      rust: Bump ostree-ext
      override: Don't crash if argument produces no file descriptors
      tests: Add a helper to go more fully offline
      cliwrap: Also inject /dev/random into cliwrap'd dracut
      container: Encapsulate at format version 1 by default
      rebuild: Fix logic for container-only handling
      compose: Handle embedded whiteouts
      container: Enable wrappers duing transaction
      upgrade: Warn and sleep if we find a deprecated v0 format container
      tests: Bump memory requests to work around Fedora repodata size
      ci: Adjust limits for bumping memory
      systemctl-wrapper: Pass through usage of --root directly
      ci: Add a test case for container builds

Jan Macku (1):
      ci(lint): add shell linter - Differential ShellCheck

Jonathan Lebon (2):
      core: Filter for latest when downloading packages
      ci: Request more memory for RPM building

Joseph Marrero (2):
      ridiculous-rhel-devel-workaround: use yum localinstall instead of rpm -U
      rust/src/client: change container test to use environment variable

Luca BRUNO (2):
      libpriv/utils: add some non-null assertions
      libdnf-sys: remove incorrect noexcept

RishabhSaini (1):
      apply-live: Invoke `systemctl daemon-reload` after unit files change

New Contributors

Full Changelog: v2022.13...v2022.14

2022.13

27 Aug 17:23
v2022.13

Choose a tag to compare

Release 2022.13

Client

A major update in this release is that rpm-ostree apply-live is now
a stabilized interface. There's a lot more to do to enhance this;
among other things, we should (much like dnf needs-restarting)
help you find processes and services that should be restarted, but
the basic mechanics can be relied on here.

The ex module interface is still experimental, but now may be
used as part of container builds.

We now more cleanly handle the lack of polkit.

Some enhancements to the (not enabled by default) yum/dnf "personality"
landed; this is active when cliwrap: true.

There is now the first use of privilege separation in the daemon;
we use DynamicUser=rpm-ostree in the main rpm-ostreed.service,
and this unprivileged userid is used for forking off the
skopeo process to perform container image fetches. This avoids
doing network requests (HTTP) as root. Much more use of
privilege separation is planned.

There's a notable bugfix for service start speed on systems with
a lot of container mounts in /var/lib/containers.

Build/Compose

rpm-ostree has gained the ability to intercept and process useradd
and groupadd invocations run from RPM scripts; this will aid
synthesizing systemd sysusers.d fragments automatically.

The branch names of ostree-layers are now ignored when computing
the change checksum.

Internals

All unnecessary use of Pin<&mut T> in the Rust/C++ bridge is gone.
The ongoing conversion to the Rust cap-std crate continues.

Colin Walters (49):
      rust: Drop rustix linux_raw backend (and pre-generated `.a` files)
      container: Make `--format-version` properly optional
      dirdiff: Port to cap-std
      tests/encapsulate.sh: Explicitly test chunked encapsulation here
      packaging: Drop `gnome-common`
      ridiculous-rhel-devel-workaround: Try to replace all packages
      Enable `ex module` in a container
      polkit-agent: Don't print a warning if not installed
      cliwrap: Add -y option to yum/dnf
      treefile: `#[derive(Clone)]`
      build-sys: Switch to committing cxx.rs generated code
      Remove last uses of `Pin<&mut someglibtype>`
      lib: Add `deny(clippy::dbg_macro & todo)`
      rust: Fix single-character clippy lint
      rust: Fix clippy unnecessary ref lints
      rust: A few more misc clippy fixes
      rust: A few more misc clippy fixes
      rust: A few more misc clippy fixes
      rust: A few more misc clippy fixes
      rust: A few more misc clippy fixes
      rust/cxx: Fix clippy lint around use of `transmute`
      rust/treefile: Allow a clippy lint
      install: Add `-y/--assumeyes` option, prompt on tty by default
      ci: Add a clippy check
      yumdnf: Remove interception of --help and --version
      yumdnf: Add a `yum image rebase` subcommand
      Deprecate `ex-container` entrypoint (use `ostree container`)
      Move `container-encapsulate` under `compose`
      rust: Bump to ostree-ext 0.8.2
      tests/container-image: Use `--compression-fast`
      docs/container: Talk about `compose container-encapsulate`
      unit: Bump `TimeoutStartSec=5m`
      Stabilize `rpm-ostree apply live`
      scripts: Ignore filesystem.posttrans
      compose: Fix `container` to work again, add a test
      yumdnf: Make `yum install cowsay` just do it and not lecture
      rust/bwrap: Use cap-std
      Use `DynamicUser=yes` for main service, isolate container fetch
      Switch to `BindReadOnlyPaths` for `/var/lib/containers`
      build-sys: Stop generating systemd units
      Add an always-on `container` feature
      rust: Run `cargo clippy --fix`
      core: Ignore subdirectories of `/usr/lib/modules` without a kernel
      Fix tokio panic in legacy `rpm-ostree container-encapsulate` path
      Add `ex deploy-from-self`
      rust: Bump to ostree-ext 0.8.4
      tests: Use `--bootable` when generating derived commits
      treefile: Add generic metadata
      Release 2022.13

Jonathan Lebon (3):
      libpriv/kernel: Run dracut with `DRACUT_NO_MKNOD=1`
      app/status: Fix printing commits without rpmmd-repos metadata
      Add .git-blame-ignore-revs and seed with `clang-format` commit

Luca BRUNO (8):
      libpriv/core: overlay ostree content before running scriptlets
      core: wrap and intercept `groupadd` calls in scriptlets
      libpriv/scripts: inject pkgname in scriptlets environment
      core: wrap and intercept `useradd` calls in scriptlets
      builtins: properly mark a future incompatibility warning
      core: wrap and intercept `usermod` calls in scriptlets
      builtins/scriptlet_intercept: improve error paths
      builtins/scriptlet-intercept: misc tweaks and refinements

RishabhSaini (1):
      treefile: Exclude ostree_layer_names from checksum

dependabot[bot] (45):
      build(deps): bump phf from 0.10.1 to 0.11.0
      build(deps): bump cxx-build from 1.0.71 to 1.0.72
      build(deps): bump cxx from 1.0.71 to 1.0.72
      build(deps): bump serde_yaml from 0.8.25 to 0.8.26
      build(deps): bump tracing-subscriber from 0.3.14 to 0.3.15
      build(deps): bump reqwest from 0.11.4 to 0.11.11
      build(deps): bump clap from 3.2.8 to 3.2.14
      build(deps): bump libdnf from `eff7e68` to `6529773`
      build(deps): bump rustix from 0.35.6 to 0.35.7
      build(deps): bump nix from 0.24.1 to 0.24.2
      build(deps): bump serde from 1.0.138 to 1.0.140
      build(deps): bump serde_yaml from 0.8.26 to 0.9.2
      build(deps): bump tracing from 0.1.35 to 0.1.36
      build(deps): bump indicatif from 0.16.2 to 0.17.0 (+ new API port)
      build(deps): bump libglnx from `c59eb27` to `26375b5`
      build(deps): bump libc from 0.2.126 to 0.2.127
      build(deps): bump serde_json from 1.0.82 to 1.0.83
      build(deps): bump serde_yaml from 0.9.2 to 0.9.4
      build(deps): bump chrono from 0.4.19 to 0.4.20
      build(deps): bump indoc from 1.0.6 to 1.0.7
      build(deps): bump clap from 3.2.14 to 3.2.16
      build(deps): bump anyhow from 1.0.58 to 1.0.60
      build(deps): bump chrono from 0.4.20 to 0.4.21
      build(deps): bump phf from 0.11.0 to 0.11.1
      build(deps): bump cxx from 1.0.72 to 1.0.73
      build(deps): bump paste from 1.0.7 to 1.0.8
      build(deps): bump cxx-build from 1.0.72 to 1.0.73
      build(deps): bump serde from 1.0.140 to 1.0.143
      build(deps): bump camino from 1.0.9 to 1.1.1
      build(deps): bump chrono from 0.4.21 to 0.4.22
      build(deps): bump libdnf from `6529773` to `a361dab`
      build(deps): bump clap from 3.2.16 to 3.2.17
      build(deps): bump nix from 0.24.2 to 0.25.0
      build(deps): bump serde_yaml from 0.9.4 to 0.9.9
      build(deps): bump anyhow from 1.0.60 to 1.0.61
      build(deps): bump libc from 0.2.127 to 0.2.131
      build(deps): bump futures from 0.3.21 to 0.3.23
      build(deps): bump either from 1.7.0 to 1.8.0
      build(deps): bump once_cell from 1.13.0 to 1.13.1
      build(deps): bump anyhow from 1.0.61 to 1.0.62
      build(deps): bump libc from 0.2.131 to 0.2.132
      build(deps): bump serde_json from 1.0.83 to 1.0.85
      build(deps): bump serde from 1.0.143 to 1.0.144
      build(deps): bump libdnf from `a361dab` to `6744080`
      build(deps): bump rustix from 0.35.7 to 0.35.9

Git-EVTag-v0-SHA512: eb20de8ec592da61d697c85a9e39181fb02df689adf516988e574f12df94f55945623ecb764064339665bce8f9001b207c22cf8af4e52c4858397fe5c4f1d61a