chunkah: upstream fakecap-xattr for BuildStream xattr support

[hanthor]

Background

chunkah uses user.component xattrs to assign files to components for content-based layer splitting. BST-based images (including dakota) have no RPM database, and xattrs set during BST artifact installation are stripped at OCI export time — so chunkah currently falls back to bigfiles-only splitting.

What we have

files/fakecap-xattr/fakecap-xattr.c (on branch chunkah-xattrs) is a path-keyed LD_PRELOAD shim that intercepts getxattr/setxattr/listxattr and serves user.component from a sidecar directory tree keyed by file path (not inode). Unlike the original freedesktop-sdk fakecap (which is inode-keyed and only handles security.capability), this survives OCI export.

The sidecar DB is generated by querying bst artifact list-contents at build time — the same data that powers the filemap.json approach.

Blocker

chunkah's xattr scan uses cap-std-ext → rustix::fs::lgetxattr, which makes raw Linux syscalls bypassing libc entirely. LD_PRELOAD cannot intercept raw syscalls, so the shim is never called. Tracked upstream in coreos/chunkah#113.

Plan

Once coreos/chunkah#113 lands (libc fallback for xattr reads):

1. Submit fakecap-xattr.c upstream — either to freedesktop-sdk (so any BST-based image gets it) or as a dakota-local BST element.
2. Wire it into the OCI assembly step: generate the sidecar DB from bst artifact list-contents, copy sidecar + .so into the image.
3. Remove the apply-xattrs.py overlay workaround (added in the interim PR).

Interim

Until #113 lands, the workaround is a pre-rechunk step that physically sets xattrs on a writable overlay of the rootfs (scripts/apply-xattrs.py). This achieves the same 99% component coverage but adds ~67 s setup overhead.

Dakota · issue pipeline

  ✓  triage     needs kind/ + area/ then /approve
  ▶  discussing —
  ·  queued     —
  ·  claimed    —
  ·  done       —

area: area/buildstream, area/upstream   priority: priority/p1
maintainer: reach consensus, then comment /approve
reporter: add spec, context, or requirements to the issue body