fix: support image cache on VFAT USB stick

Scenario: copy contents of the ISO to the USB VFAT stick.

Make sure VFAT filesystem has a label `TALOS_*`.

Fixes #9936

Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>

go.mod

@@ -142,7 +142,7 @@ require (
 	github.com/siderolabs/gen v0.7.0
 	github.com/siderolabs/go-api-signature v0.3.6
 	github.com/siderolabs/go-blockdevice v0.4.8
-	github.com/siderolabs/go-blockdevice/v2 v2.0.6
+	github.com/siderolabs/go-blockdevice/v2 v2.0.7
 	github.com/siderolabs/go-circular v0.2.1
 	github.com/siderolabs/go-cmd v0.1.3
 	github.com/siderolabs/go-copy v0.1.0

go.sum

@@ -645,8 +645,8 @@ github.com/siderolabs/go-api-signature v0.3.6 h1:wDIsXbpl7Oa/FXvxB6uz4VL9INA9fmr
 github.com/siderolabs/go-api-signature v0.3.6/go.mod h1:hoH13AfunHflxbXfh+NoploqV13ZTDfQ1mQJWNVSW9U=
 github.com/siderolabs/go-blockdevice v0.4.8 h1:KfdWvIx0Jft5YVuCsFIJFwjWEF1oqtzkgX9PeU9cX4c=
 github.com/siderolabs/go-blockdevice v0.4.8/go.mod h1:4PeOuk71pReJj1JQEXDE7kIIQJPVe8a+HZQa+qjxSEA=
-github.com/siderolabs/go-blockdevice/v2 v2.0.6 h1:/NAy3MbNZhjLWo28asZyS/hmf86PEPDMc9i6wIcgbwI=
-github.com/siderolabs/go-blockdevice/v2 v2.0.6/go.mod h1:74htzCV913UzaLZ4H+NBXkwWlYnBJIq5m/379ZEcu8w=
+github.com/siderolabs/go-blockdevice/v2 v2.0.7 h1:OCxxA7W1xVqbEP3MrCttqhKpuV4t1KkBTzNeboYDTmc=
+github.com/siderolabs/go-blockdevice/v2 v2.0.7/go.mod h1:74htzCV913UzaLZ4H+NBXkwWlYnBJIq5m/379ZEcu8w=
 github.com/siderolabs/go-circular v0.2.1 h1:a++iVCn9jyhICX3POQZZX8n72p2h5JGdGU6w1ulmpcA=
 github.com/siderolabs/go-circular v0.2.1/go.mod h1:ZDItzVyXK+B/XuqTBV5MtQtSv06VI+oCmWGRnNCATo8=
 github.com/siderolabs/go-cmd v0.1.3 h1:JrgZwqhJQeoec3QRON0LK+fv+0y7d0DyY7zsfkO6ciw=

internal/app/machined/pkg/controllers/block/internal/volumes/format.go

@@ -30,7 +30,7 @@ func Format(ctx context.Context, logger *zap.Logger, volumeContext ManagerContex
 		devPath = volumeContext.Status.Location
 	}
 
-	dev, err := blockdev.NewFromPath(devPath, blockdev.OpenForWrite())
+	dev, err := blockdev.NewFromPath(devPath)
 	if err != nil {
 		return xerrors.NewTaggedf[Retryable]("error opening disk: %w", err)
 	}

internal/app/machined/pkg/controllers/cri/image_cache_config.go

@@ -16,6 +16,7 @@ import (
 	"github.com/cosi-project/runtime/pkg/safe"
 	"github.com/cosi-project/runtime/pkg/state"
 	"github.com/dustin/go-humanize"
+	"github.com/google/cel-go/common/ast"
 	"github.com/google/cel-go/common/operators"
 	"github.com/google/cel-go/common/types"
 	"github.com/siderolabs/gen/optional"
@@ -198,19 +199,26 @@ func (ctrl *ImageCacheConfigController) Run(ctx context.Context, r controller.Ru
 func (ctrl *ImageCacheConfigController) createVolumeConfigISO(ctx context.Context, r controller.ReaderWriter) error {
 	builder := cel.NewBuilder(celenv.VolumeLocator())
 
-	// volume.name == "iso9660" && volume.label.startsWith("TALOS_")
+	// volume.name in ["iso9660", "vfat"] && volume.label.startsWith("TALOS_")
 	expr := builder.NewCall(
 		builder.NextID(),
 		operators.LogicalAnd,
 		builder.NewCall(
 			builder.NextID(),
-			operators.Equals,
+			operators.In,
 			builder.NewSelect(
 				builder.NextID(),
 				builder.NewIdent(builder.NextID(), "volume"),
 				"name",
 			),
-			builder.NewLiteral(builder.NextID(), types.String("iso9660")),
+			builder.NewList(
+				builder.NextID(),
+				[]ast.Expr{
+					builder.NewLiteral(builder.NextID(), types.String("iso9660")),
+					builder.NewLiteral(builder.NextID(), types.String("vfat")),
+				},
+				nil,
+			),
 		),
 		builder.NewMemberCall(
 			builder.NextID(),

internal/app/machined/pkg/controllers/cri/image_cache_config_test.go

@@ -63,7 +63,7 @@ func (suite *ImageCacheConfigSuite) TestReconcileFeatureEnabled() {
 	suite.Require().NoError(suite.State().Create(suite.Ctx(), cfg))
 
 	ctest.AssertResource(suite, crictrl.VolumeImageCacheISO, func(r *block.VolumeConfig, asrt *assert.Assertions) {
-		asrt.Equal(`volume.name == "iso9660" && volume.label.startsWith("TALOS_")`, r.TypedSpec().Locator.Match.String())
+		asrt.Equal(`volume.name in ["iso9660", "vfat"] && volume.label.startsWith("TALOS_")`, r.TypedSpec().Locator.Match.String())
 	})
 	ctest.AssertResource(suite, crictrl.VolumeImageCacheDISK, func(r *block.VolumeConfig, asrt *assert.Assertions) {
 		asrt.Equal(`volume.partition_label == "IMAGECACHE"`, r.TypedSpec().Locator.Match.String())

pkg/machinery/go.mod

@@ -27,7 +27,7 @@ require (
 	github.com/siderolabs/crypto v0.5.0
 	github.com/siderolabs/gen v0.7.0
 	github.com/siderolabs/go-api-signature v0.3.6
-	github.com/siderolabs/go-blockdevice/v2 v2.0.6
+	github.com/siderolabs/go-blockdevice/v2 v2.0.7
 	github.com/siderolabs/go-pointer v1.0.0
 	github.com/siderolabs/net v0.4.0
 	github.com/siderolabs/protoenc v0.2.1

pkg/machinery/go.sum

@@ -110,8 +110,8 @@ github.com/siderolabs/gen v0.7.0 h1:uHAt3WD0dof28NHFuguWBbDokaXQraR/HyVxCLw2QCU=
 github.com/siderolabs/gen v0.7.0/go.mod h1:an3a2Y53O7kUjnnK8Bfu3gewtvnIOu5RTU6HalFtXQQ=
 github.com/siderolabs/go-api-signature v0.3.6 h1:wDIsXbpl7Oa/FXvxB6uz4VL9INA9fmr3EbmjEZYFJrU=
 github.com/siderolabs/go-api-signature v0.3.6/go.mod h1:hoH13AfunHflxbXfh+NoploqV13ZTDfQ1mQJWNVSW9U=
-github.com/siderolabs/go-blockdevice/v2 v2.0.6 h1:/NAy3MbNZhjLWo28asZyS/hmf86PEPDMc9i6wIcgbwI=
-github.com/siderolabs/go-blockdevice/v2 v2.0.6/go.mod h1:74htzCV913UzaLZ4H+NBXkwWlYnBJIq5m/379ZEcu8w=
+github.com/siderolabs/go-blockdevice/v2 v2.0.7 h1:OCxxA7W1xVqbEP3MrCttqhKpuV4t1KkBTzNeboYDTmc=
+github.com/siderolabs/go-blockdevice/v2 v2.0.7/go.mod h1:74htzCV913UzaLZ4H+NBXkwWlYnBJIq5m/379ZEcu8w=
 github.com/siderolabs/go-pointer v1.0.0 h1:6TshPKep2doDQJAAtHUuHWXbca8ZfyRySjSBT/4GsMU=
 github.com/siderolabs/go-pointer v1.0.0/go.mod h1:HTRFUNYa3R+k0FFKNv11zgkaCLzEkWVzoYZ433P3kHc=
 github.com/siderolabs/go-retry v0.3.3 h1:zKV+S1vumtO72E6sYsLlmIdV/G/GcYSBLiEx/c9oCEg=

pkg/provision/providers/qemu/launch.go

@@ -448,7 +448,7 @@ func launchVM(config *LaunchConfig) error {
 			)
 		case config.USBPath != "":
 			args = append(args,
-				"-drive", fmt.Sprintf("if=none,id=stick,format=raw,file=%s", config.USBPath),
+				"-drive", fmt.Sprintf("if=none,id=stick,format=raw,read-only=on,file=%s", config.USBPath),
 				"-device", "nec-usb-xhci,id=xhci",
 				"-device", "usb-storage,bus=xhci.0,drive=stick,removable=on",
 			)