Introduce generic ostree repository configuration

[rborn-tx]

This allows one to set the ostree repositories configuration; settings can be independently set for both the main repository (where commits are made) and for the one that is part of OTA image (belonging to a sysroot).

This addition should be helpful when one needs to configure the repository (particularly the OTA one) before generating a deployment. This is the case today with the recently added ostree config "ex-integrity.composefs". When set to "true", ostree admin deploy will produce a composefs image and include it as part of the deployment.

[pattivacek]

Seems fine, but I'm curious, what sort of configuration is relevant to you? Where does it get read and used?

[rborn-tx]

@pattivacek The example that I mentioned of "ex-integrity.composefs" is the real case for me at the moment (I'm working with integrating composefs into our Torizon OS). That setting is read by ostree admin deploy when producing the deployment that goes into the sysroot (during build); it would be used by ostree later, at runtime, when producing new deployments upon software updates as well. When "ex-integrity.composefs" is set, ostree generates a deployment as usual but it also generates a new file as part of the deployment, a composefs image. On a device, that composefs image could be mounted and by enabling fs-verity on it one can create a system with a root filesystem protected against tampering. We're doing this to implement a full chain of trust system in Torizon OS.

Since the IMAGE_CMD:ota() function (1) creates a sysroot, (2) populates it from the main ostree repo and (3) generates the deployment, today it's not possible to configure the repo before step (3) which would be required for ostree to produce the composefs image.

The above relates only to the ostree repo on the sysroot (part of the OTA image). I added the feature also to the main ostree repository just for consistency.

[pattivacek]

Great, thanks for the explanation! That sounds really cool. Glad to hear progress is finally being made on securing the boot process.

[rborn-tx]

@pattivacek Thanks the quick reply and merge! Yeah, this work being done on ostree/composefs is really great!

Let me ask you: should I cherry-pick the commits in the present PR into other branches? If so, which ones?

[pattivacek]

should I cherry-pick the commits in the present PR into other branches? If so, which ones?

That's entirely up to you or anyone else interested. My employer is still using dunfell and I don't think we'll be rolling out features like this, so I'm not personally invested in backporting. I used to try to keep things fairly closely synchronized among the branches but I no longer find it to be worth the effort. I'll gladly review PRs but can't do much more than that at present!