bootc: Test ostree against the Rust libcomposefs

[cgwalters-bot]

Stacked on #7 (ExternalPath, which keeps ostree's xx/<checksum>.file redirects), whose commit is the first one here; review only the last two. composefs#401 (the mount fixes it was stacked on before) is merged, so its commits are gone from this branch.

Adds just bootc/test-ostree, a second matrix entry in the bootc revdep workflow. It builds the composefs RPMs from the tree (pack.sh + composefs.spec) in a CentOS Stream 10 buildroot and puts them into the packages bootc installs into its test image, so they replace the C composefs. It checks that libostree loads our libcomposefs and that the initramfs has the identical file, then runs bootc's readonly and image-upgrade-reboot plans on the ostree backend (BOOTC_variant=ostree, set explicitly).

A prep commit adds PACK_VENDOR=cargo to pack.sh, so the test vendors with the distribution's cargo vendor instead of installing rustup and an unpinned cargo-vendor-filterer. pack.sh now also fails if vendoring printed no source replacement config. The RPM build runs with CARGO_NET_OFFLINE=true, so it has to use the vendored crates.

The workflow keeps upstream's temporary if: never() (waiting on bootc-dev/bootc#2490), so neither matrix entry runs until that's lifted. The ostree entry is no longer continue-on-error, since it passes with #7.

Tested on a 16-core RHEL 10 devspace (kernel 6.12), just bootc/test-ostree at 3d53788 (the same tree as this head 708ba90, which only rewords #7's commit message). bootc was bootc-dev/bootc#2490 plus the adaptation from bot/composefs-externalpath on cgwalters-bot/bootc, since bootc doesn't build against #7 without it:

• the RPMs build offline with PACK_VENDOR=cargo;
• libostree uses /usr/lib64/libcomposefs.so.1.4.0 from composefs-libs-202609290233.g3d53788b2b-1.el10.x86_64, and the initramfs has the same file;
• both tmt plans pass (plan-01-readonly, plan-24-image-upgrade-reboot): the ostree deployment boots through ostree-prepare-root on the Rust libcomposefs and survives an upgrade with a reboot.

Related: composefs#323

Generated-by: https://github.com/cgwalters/#llms

---

Review draft in cgwalters-forge, not upstream yet. This section is removed when the PR is opened upstream.

• Upstream: composefs/composefs-rs, base main
• Board item: PVTI_lAHOAQ_SPs4Bj2Gizg8qbJI
• Fork CI: off; the devspace testing described above is this PR's CI, and upstream CI runs once it is opened there

To review:

• Approve, or comment /promote on a line of its own, to open it upstream, ready for review. Either covers only the commits pushed so far.
• If upstream requires DCO, approving also signs off: promote adds Signed-off-by: Colin Walters <walters@verbum.org> to the commits lacking it (the bot's and yours; anyone else's only if you ask), with you as committer.
• Add a /draft line (in the same comment or before) to open it upstream as a draft (/ready undoes that).
• Close to drop it.
• Edit the title and description freely: they become the upstream PR's. Review comments are squashed into the commits they concern, with a reply here.

[cgwalters-bot]

Review guide for head 0ec9b999b3: where to look closely and what is safe to skim. It is advice from the bot's reviewer and doesn't replace reading the diff; the review app walks it.

Review only the last two commits: ef413b3 (pack.sh PACK_VENDOR=cargo) and 0ec9b99 (just bootc/test-ostree, plus the ostree matrix entry in bootc-revdep). The rest is #7 and upstream commits that the stale forge main doesn't have yet. Risk is low, because the workflow is still behind upstream's if: never(), so nothing runs in CI. Once that is lifted, both matrix entries need a bootc that builds against ExternalPath (from #7). Without it, both fail at compile time whether or not continue-on-error is set, so dropping continue-on-error from the ostree entry is fine. The check that libostree and the initramfs load our libcomposefs is the part that makes the test meaningful. Worth reading closely.

Hotspots

1. look-closely · logic — contrib/packaging/pack.sh:41-62 (ef413b3): The cargo branch relies on the sed below rewriting cargo vendor's absolute directory path to 'vendor'. Unlike the filterer path, its vendor tarball isn't created with --sort/--mtime, so it isn't reproducible. That's fine for tests but worth a comment if release builds might use it.
2. note · logic — bootc/Justfile:108-120 (0ec9b99): This clones HEAD of the checkout, and _require-clean makes that the tested tree. On GitHub the checkout is shallow; a local clone of a shallow repo works, but the version pack.sh derives from git should be checked there.
3. look-closely · logic — bootc/Justfile:128-157 (0ec9b99): This is what proves ostree runs on our library. It relies on bootc's local-repo priority, so check that it fails loudly (it does, by comparing the rpm owner) if the distro's C composefs wins. The initramfs glob assumes a single kernel.
4. note · logic — .github/workflows/bootc-revdep.yml:25-39 (0ec9b99): if: never() is upstream's and invalid per actionlint (there's no never() function); it isn't this PR's to fix. Two matrix entries each building bootc plus RPMs and VMs within timeout-minutes: 120 is untested on GitHub runners.

Safe to skim

• bootc/build-composefs-rpms: straightforward rpmbuild wrapper, tested on devspace
• crates/composefs/src/tree.rs: from #7, reviewed there
• crates/composefs/src/erofs/reader.rs: from #7, reviewed there
• crates/composefs/src/erofs/writer.rs: from #7, reviewed there
• crates/composefs/src/dumpfile.rs: from #7, reviewed there
• crates/composefs-capi/src/convert.rs: from #7, reviewed there

[cgwalters-bot]

Signed off 3 commit(s) with Signed-off-by: Colin Walters <walters@verbum.org> for composefs/composefs-rs's DCO check, on cgwalters's approval #4 (review) of 7985b2bf417a. Same trees; the head is now ffb38b15501d.

[cgwalters-bot]

Opened upstream as composefs#408. Closing this review draft.