Keep /var's package-shipped files, and pin BOOTC_REF #6
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/var-files-and-bootc-pin"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Two fixes, independent of each other, one commit each.
1.
/varfiles were being droppedbootc-rootfs.shtranscribed/varinto tmpfiles as directories (d) andsymlinks (
L) and emitted nothing for regular files — which a tmpfiles entrycannot fill anyway. Step 3 then deletes them.
This isn't confined to the
bootc upgradepath the generator was written for.Step 3 empties the
/varthat ships in the image, so a freshbootc installhas nothing to materialise either.bootc container lintdoesn't catch it —
var-tmpfilesis about directories.The fix copies the content to
/usr/share/factory/varat build time and emitsCentries, whose bare argument resolves to exactly that path.Conly copieswhen the destination is absent, so a file a host has since edited is left alone.
Which files count is asked of dpkg rather than read off the tree: a
.listentry is content some package installed, and build residue (apt lists, dpkg's
own logs,
/var/backups) belongs to no package and is skipped without anexception list to maintain.
On scope — smaller than the
/vartree suggests. Of ~350.listentriesunder
/varon a desktop root, ~228 are symlinks — all of/var/lib/ghostscript/CMappoints into/usr/share/poppler, already coveredby the
Lentries — and ~100 are directories. What was actually being lost isthe couple of dozen regular files left over:
/var/lib/dictionaries-common/hunspell/*— how hunspell dictionaries arefound at all
/var/lib/usbutils/usb.ids/var/lib/xkb/README.compiledtex-common'sfmtutil/font-map fragments, on an image that installs TeXA few hundred KiB. Worth it at that size because the failure mode is a file
that is simply not there, on a system with no
apt install --reinstallto putit back — and because the file case is now covered for whatever gets added to
the Containerfile later, rather than being correct by accident for today's
package list.
Verification
Replayed a generated conf with
systemd-tmpfiles --root --createover anemptied
/var, against a synthetic root mimicking the state at step 2:0644,0640checked)0750case)/var/log/dpkg.logabsent,/var/logpresent/var/lib/dpkgsymlink intact, and not followed into/usrd/L/CentriesNot built end-to-end — no trixie builder here — so the real check is one
publish.ymlrun plusgrep -c '^C ' /usr/lib/tmpfiles.d/zz-os4-var.confonthe result.
2.
BOOTC_REFwas unpinnedIt defaulted to empty, which
bootc-build.shresolves to whateverbootc-dev/bootc has most recently released.
publish.ymlbuilds every other dayand passes no build-arg, so an unattended build was free to replace the thing
that mounts the root filesystem with a version nobody had booted.
Pinned to
v1.16.9— the newest release as of now, and also the one theREADME's source references were read against (the bootupd/systemd-boot branch
in
install.rs, the kargs handling inbootc_composefs/boot.rs), so the docsand the binary now describe the same program. Empty still means "newest
release" for testing what upstream has moved to.
Nothing here touches the
/opt, AppArmor or composefs work.README.mdisupdated alongside both changes.